Function at 0x40b916
Capabilities:
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x40a8
call fcn.004fee60
cmp byte [ecx + 0x64], 0
mov al, 1
jne 0x40c27a
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x94]
lea edx, [esp + 0x80]
and dword [ecx], 0
mov dword [ecx + 4], 4
and dword [edx], 0
mov dword [edx + 4], 1
and dword [ecx + 8], 0
and dword [edx + 8], 0
call fcn.00404df6
lea esi, [esp + 0x2158]
lea edx, [esp + 0x218]
mov eax, 0x1010101
mov ecx, esi
mov dword [edx + 8], eax
mov dword [edx + 4], eax
mov dword [edx], eax
mov byte [edx + 0xc], 1
call fcn.004d84ce
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x18]
lea edi, [esp + 0x100]
xor ebx, ebx
movdqa xmm0, xmmword [eax]
lea esi, [eax + 0x10]
lea edx, [edx + eax + 1]
mov dword [edi], esi
mov dword [edi + 4], edx
mov dword [edi + 8], eax
pmovmskb esi, xmm0
not esi
mov word [edi + 0xc], si
mov dword [edi + 0x10], ecx
lea ecx, [esp + 0x100]
call fcn.00401094
test eax, eax
mov dword [esp + 4], edx
mov dword [esp + 0xc], ebx
je 0x40be24
mov esi, dword [esp + 0x84]
mov edx, dword [esp + 0x88]
and dword [esp + 0x58], 0
mov dword [esp + 0x5c], 1
and dword [esp + 0x60], 0
lea ecx, [esp + 0x58]
add edx, esi
mov dword [esp + 8], esi
mov dword [esp + 0x10], edx
push esi
call fcn.00419104
pop eax
mov edi, dword [esp + 4]
lea ecx, [esp + 0x218]
mov ebx, ecx
mov edx, dword [edi + 0xb8]
push dword [edi + 0xbc]
call fcn.00417470
pop eax
mov esi, dword [esp + 0x21c]
mov edx, dword [esp + 0x220]
lea ecx, [esp + 0x58]
add edx, esi
push esi
call fcn.00419104
pop eax
mov ecx, dword [esp + 0x218]
mov edx, esi
call fcn.0043e31d
mov edx, dword [esp + 0x5c]
mov esi, ebx
mov ecx, ebx
mov dword [esp + 0x8c], edx
push dword [esp + 0x60]
call fcn.00404d88
pop eax
lea ebx, [esp + 0x114]
mov edx, esi
mov ecx, ebx
call fcn.004c2481
lea esi, [esp + 0x3c]
mov edx, ebx
mov ecx, esi
call fcn.004c2676
lea ecx, [esp + 0x74]
mov edx, esi
call fcn.0040a1b8
mov eax, dword [edi + 0xbc]
cmp eax, 0xf
mov dword [esp + 0x24], eax
jbe 0x40bcb3
and dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
and dword [esp + 0x30], 0
mov edx, dword [esp + 0x10]
lea esi, [esp + 0x28]
mov ecx, esi
push dword [esp + 8]
call fcn.00419104
pop eax
mov edi, dword [esp + 4]
lea ecx, [esp + 0x64]
mov edx, dword [edi + 0xb8]
push dword [edi + 0xbc]
call fcn.00417470
pop eax
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x20], ecx
push 0x514254
push 0x10
push 0
call fcn.004010ff
add esp, 0xc
add edx, eax
mov ecx, esi
push eax
call fcn.00419104
pop eax
mov edx, dword [esp + 0x2c]
lea edi, [esp + 0x218]
mov ecx, edi
mov dword [esp + 0x1c], edx
push dword [esp + 0x30]
call fcn.00404d88
pop eax
lea ebx, [esp + 0x114]
mov edx, edi
mov ecx, ebx
call fcn.004c2481
lea esi, [esp + 0xa0]
mov edx, ebx
mov ecx, esi
call fcn.004c2676
mov ecx, edi
mov edx, esi
call fcn.0040a1b8
xor ecx, ecx
xor esi, esi
mov dword [esp + 0x50], 0
inc esi
mov edx, esi
call fcn.0043e31d
mov edx, dword [esp + 0x21c]
mov ecx, dword [esp + 0x220]
mov eax, dword [esp + 0x218]
mov dword [esp + 0x18], edx
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x70], eax
call fcn.0043e31d
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
call fcn.0043e31d
mov eax, dword [esp + 4]
mov eax, dword [eax + 0xbc]
cmp eax, 0x11
setae byte [esp + 0x20]
jb 0x40bce0
and dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
and dword [esp + 0x30], 0
mov edx, dword [esp + 0x10]
lea esi, [esp + 0x28]
mov ecx, esi
push dword [esp + 8]
call fcn.00419104
pop eax
mov eax, dword [esp + 4]
lea ecx, [esp + 0x64]
mov edx, dword [eax + 0xb8]
push dword [eax + 0xbc]
call fcn.00417470
pop eax
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov dword [esp + 4], ecx
push 0x514264
push 0x11
push 0
call fcn.004010ff
add esp, 0xc
add edx, eax
mov ecx, esi
push eax
call fcn.00419104
pop eax
mov edx, dword [esp + 0x2c]
lea esi, [esp + 0x218]
mov ecx, esi
mov dword [esp + 8], edx
push dword [esp + 0x30]
call fcn.00404d88
pop eax
lea ebx, [esp + 0x114]
mov edx, esi
mov ecx, ebx
call fcn.004c2481
lea edi, [esp + 0xa0]
mov edx, ebx
mov ecx, edi
call fcn.004c2676
mov ecx, esi
mov edx, edi
call fcn.0040a1b8
xor ecx, ecx
xor edx, edx
inc edx
call fcn.0043e31d
mov edx, dword [esp + 0x21c]
mov ecx, dword [esp + 0x220]
mov eax, dword [esp + 0x218]
mov dword [esp + 0x14], edx
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 4]
mov dword [esp + 0x50], eax
call fcn.0043e31d
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 8]
call fcn.0043e31d
jmp 0x40bcec
cmp eax, 0x11
mov dword [esp + 0x38], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x50], 0
setae byte [esp + 0x20]
xor eax, eax
inc eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
jmp 0x40bce4
mov dword [esp + 0x14], esi
mov dword [esp + 0x54], 0
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x98]
mov esi, dword [esp + 0x78]
mov edx, dword [esp + 0x7c]
mov ebx, dword [esp + 0xc]
shl eax, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], edx
add eax, ecx
mov dword [esp + 0x90], eax
cmp ecx, dword [esp + 0x90]
je 0x40bde8
mov dword [esp + 0xc], ebx
mov ebx, dword [ecx + 8]
imul eax, dword [ecx + 0xc], 0xc
mov dword [esp + 8], ecx
test eax, eax
je 0x40bddc
mov esi, dword [ebx + 4]
mov edi, dword [ebx + 8]
mov dword [esp + 4], eax
mov ecx, esi
mov edx, edi
push dword [esp + 0x1c]
push dword [esp + 0x14]
call fcn.004e4406
pop ecx
pop edx
test al, al
je 0x40bd6d
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
or eax, dword [ecx]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
cmp eax, 0xf
jbe 0x40bd9b
mov ecx, esi
mov edx, edi
push dword [esp + 0x38]
push dword [esp + 0x1c]
call fcn.004e4406
pop ecx
pop edx
test al, al
je 0x40bd9b
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
or eax, dword [ecx]
mov dword [esp + 0xc], eax
cmp byte [esp + 0x20], 0
je 0x40bdc9
mov ecx, esi
mov edx, edi
push dword [esp + 0x54]
push dword [esp + 0x18]
call fcn.004e4406
pop ecx
pop edx
test al, al
je 0x40bdc9
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
or eax, dword [ecx]
mov dword [esp + 0xc], eax
jmp 0x40bdcd
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
add ebx, 0xc
add eax, 0xfffffff4
jmp 0x40bd36
mov ebx, dword [esp + 0xc]
add ecx, 0x10
jmp 0x40bd1a
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x14]
call fcn.0043e31d
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x18]
call fcn.0043e31d
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x10]
call fcn.0043e31d
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x8c]
call fcn.0043e31d
jmp 0x40b9c0
test ebx, 0x13b002
jne 0x40c17b
push 0x14
pop esi
push esi
push 0x5141f6
lea ebx, [esp + 0x220]
push ebx
call fcn.005010b0
add esp, 0xc
lea eax, [ebx + esi]
mov dword [esp + 4], eax
push esi
push 0x51420a
push eax
call fcn.005010b0
add esp, 0xc
push 0x29
pop ecx
xor esi, esi
inc esi
mov edx, esi
call fcn.0040378a
mov edi, eax
push 0x28
pop eax
push eax
push ebx
push edi
call fcn.005010b0
add esp, 0xc
xor eax, eax
mov edx, 0x51421e
mov dword [esp + 0x10], edi
mov byte [edi + 0x28], al
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], esi
lea esi, [esp + 0xa0]
mov ecx, esi
push 0x2c
call fcn.004127c2
pop eax
mov edi, dword [esi + 4]
mov eax, dword [esi + 8]
lea esi, [esp + 0x114]
mov edx, 0x51424a
mov ecx, esi
mov dword [esp + 8], edi
mov dword [esp + 0x24], eax
push 0xa
call fcn.004127c2
pop eax
mov eax, esi
mov esi, dword [esi + 4]
mov edx, dword [esp + 0x24]
mov ecx, edi
push dword [eax + 8]
mov edi, eax
push esi
xor eax, eax
inc eax
push eax
push 0
lea eax, [esp + 0x4c]
push eax
call fcn.0040af46
add esp, 0x14
mov ecx, dword [edi]
mov edx, esi
call fcn.0043e31d
lea eax, [esp + 0xa0]
mov edx, dword [esp + 8]
mov ecx, dword [eax]
call fcn.0043e31d
mov edx, dword [esp + 0x10]
movzx eax, byte [edx + 0x28]
shl eax, 3
xor ecx, ecx
inc ecx
mov dword [esp + 8], eax
call fcn.004028eb
push 0x14
pop esi
push esi
push 0x514140
push edi
call fcn.005010b0
add esp, 0xc
mov ecx, 0x514154
lea eax, [edi + esi]
push esi
push ecx
push eax
call fcn.005010b0
add esp, 0xc
push 0x29
pop ecx
xor edi, edi
inc edi
mov edx, edi
call fcn.0040378a
mov esi, eax
push 0x28
pop eax
push eax
lea eax, [esp + 0x118]
push eax
push esi
call fcn.005010b0
add esp, 0xc
xor eax, eax
mov byte [esi + 0x28], al
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], edi
push 0x14
pop esi
push esi
push 0x514168
push ebx
call fcn.005010b0
add esp, 0xc
push esi
mov eax, 0x514154
push eax
push dword [esp + 0xc]
call fcn.005010b0
add esp, 0xc
push 0xa
pop ecx
lea edx, [esp + 0x114]
mov esi, ebx
mov edi, edx
rep movsd dword es:[edi], dword [esi]
push 0x28
pop eax
push eax
push edx
mov esi, edx
push ebx
call fcn.005010b0
add esp, 0xc
lea ecx, [esp + 0x218]
xor eax, eax
mov edx, ebx
mov byte [ecx + 0x28], al
lea ecx, [esp + 0x3c]
call fcn.0040372b
push 0x14
pop edi
push edi
push 0x51417c
push ebx
call fcn.005010b0
add esp, 0xc
mov eax, 0x514190
push edi
push eax
push dword [esp + 0xc]
call fcn.005010b0
add esp, 0xc
push 0xa
pop ecx
mov edx, esi
mov edi, esi
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
push 0x28
pop eax
push eax
push edx
mov esi, edx
push ebx
call fcn.005010b0
add esp, 0xc
xor eax, eax
lea ecx, [esp + 0x218]
mov edx, ebx
mov byte [ecx + 0x28], al
lea ecx, [esp + 0x3c]
call fcn.0040372b
push 0x14
pop edi
push edi
push 0x5141a4
push ebx
call fcn.005010b0
add esp, 0xc
push edi
mov eax, 0x514190
push eax
push dword [esp + 0xc]
call fcn.005010b0
add esp, 0xc
push 0xa
pop ecx
mov edx, esi
mov edi, esi
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
push 0x28
pop eax
push eax
push edx
push ebx
call fcn.005010b0
add esp, 0xc
xor eax, eax
lea ecx, [esp + 0x218]
lea esi, [esp + 0x3c]
mov edx, ebx
mov byte [ecx + 0x28], al
mov ecx, esi
call fcn.0040372b
lea edi, [esp + 0xa0]
mov edx, 0x5141b8
mov ecx, edi
push 0x1b
call fcn.004127c2
pop eax
lea ecx, [esp + 0x218]
mov edx, 0x5141d3
push 0x23
call fcn.004127c2
pop eax
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esp + 4], ecx
push 0
xor ebx, ebx
inc ebx
push ebx
push 2
push 0
push esi
call fcn.0040af46
add esp, 0x14
lea eax, [esp + 0x218]
mov edi, dword [eax + 4]
mov edx, dword [eax + 8]
mov ecx, edi
push 0
push ebx
push ebx
push 0
push esi
call fcn.0040af46
add esp, 0x14
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
imul esi, dword [esp + 0x44], 0x29
mov ebx, edx
test esi, esi
je 0x40c140
mov al, byte [ebx + 0x28]
cmp al, 2
je 0x40c140
add ebx, 0x29
add esi, 0xffffffd7
test al, 1
je 0x40c0f9
call fcn.00402910
xor edx, edx
xor ecx, ecx
inc edx
call fcn.0043e31d
mov ecx, dword [esp + 0x218]
mov edx, edi
call fcn.0043e31d
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 4]
call fcn.0043e31d
push 0x10
pop ebx
jmp 0x40c16f
call fcn.00402910
xor ebx, ebx
xor edx, edx
xor ecx, ecx
inc edx
call fcn.0043e31d
mov ecx, dword [esp + 0x218]
mov edx, edi
call fcn.0043e31d
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 4]
call fcn.0043e31d
or ebx, dword [esp + 0xc]
mov eax, dword [esp + 8]
or eax, ebx
mov ebx, eax
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x2158]
call fcn.004024eb
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x84]
call fcn.0043e31d
lea ecx, [esp + 0x94]
call fcn.004028b4
test bl, 1
je 0x40c1b3
mov byte [esi + 0x4c], 1
test bl, 2
je 0x40c1bc
mov byte [esi + 0x4d], 1
mov eax, ebx
test bl, 4
je 0x40c1c7
mov byte [esi + 0x4e], 1
mov ecx, eax
test cl, 8
je 0x40c1d2
mov byte [esi + 0x4f], 1
mov ecx, eax
test cl, 0x10
je 0x40c1dd
mov byte [esi + 0x50], 1
mov ecx, eax
test cl, 0x20
je 0x40c1e8
mov byte [esi + 0x51], 1
mov ecx, eax
test cl, 0x40
je 0x40c1f3
mov byte [esi + 0x52], 1
mov ecx, eax
test cl, cl
jns 0x40c1fd
mov byte [esi + 0x53], 1
bt eax, 8
mov ecx, eax
jae 0x40c209
mov byte [esi + 0x54], 1
bt eax, 9
mov ecx, eax
jae 0x40c215
mov byte [esi + 0x55], 1
bt eax, 0xa
mov ecx, eax
jae 0x40c221
mov byte [esi + 0x56], 1
bt eax, 0xb
mov ecx, eax
jae 0x40c22d
mov byte [esi + 0x57], 1
bt eax, 0xc
mov ecx, eax
jae 0x40c239
mov byte [esi + 0x58], 1
bt eax, 0xe
mov ecx, eax
jae 0x40c245
mov byte [esi + 0x59], 1
bt eax, 0x11
mov ecx, eax
jae 0x40c251
mov byte [esi + 0x5a], 1
bt eax, 0x12
mov ecx, eax
jae 0x40c25d
mov byte [esi + 0x5b], 1
bt eax, 0x14
mov ecx, eax
jae 0x40c269
mov byte [esi + 0x5c], 1
test eax, 0x13b002
je 0x40c282
mov byte [esi + 0x5c], 1
xor eax, eax
mov byte [esi + 0x64], 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 0x58]
lea edx, [esp + 0x74]
and dword [ecx], 0
mov dword [ecx + 4], 4
and dword [edx], 0
mov dword [edx + 4], 1
and dword [ecx + 8], 0
and dword [edx + 8], 0
call fcn.004075f8
and dword [esp + 0x80], 0
mov eax, 0xffffe0c0
test eax, eax
je 0x40c2c9
and dword [esp + eax + 0x2158], 0
add eax, 4
jmp 0x40c2b8
call sub.kernel32.dll_GetCurrentProcessId
lea esi, [esp + 0x2158]
mov edi, eax
and dword [esi + 4], 0
xor ebx, ebx
mov ecx, esi
inc ebx
mov dword [esi], ebx
call fcn.004ec3cc
push edi
push eax
push 0x410
call dword [sym.imp.kernel32.dll_OpenProcess]
mov dword [esi + 4], eax
mov dword [esi], ebx
lea esi, [esp + 0x2158]
mov dword [esp + 0x1c], eax
mov ecx, esi
call fcn.004ec3cc
mov edi, 0x7d0
lea ecx, [esp + 0x80]
push ecx
push edi
lea ebx, [esp + 0x220]
push ebx
push eax
call dword [sym.imp.kernel32.dll_K32EnumProcessModules]
push 0x1f40
push ebx
push esi
call fcn.005010b0
add esp, 0xc
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x60]
mov dword [esi + 0x1f44], edi
mov dword [esp + 8], 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x7c]
shl ecx, 4
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x5c]
add ecx, eax
mov dword [esp + 0x38], eax
xor eax, eax
mov dword [esp + 0x10], ecx
lea ebx, [esp + 0x114]
cmp edi, eax
je 0x40c56a
lea ecx, [eax + 1]
mov dword [esp + 0x4098], ecx
mov edi, dword [esp + eax*4 + 0x2158]
test edi, edi
je 0x40c56a
mov eax, 0x104
push eax
push 0
push ebx
call fcn.004ff8d0
add esp, 0xc
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x40], eax
xor eax, eax
inc eax
mov dword [esp + 0x3c], eax
call fcn.004ec3cc
mov esi, eax
xor eax, eax
lea ecx, [esp + 0xa0]
mov dword [esp + 0xa4], edi
inc eax
mov dword [esp + 0xa0], eax
call fcn.004ec3cc
mov edi, 0x104
push edi
push ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_K32GetModuleBaseNameA]
mov ecx, 0x104
call fcn.00441781
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edx
push edi
mov esi, 0x104
push ebx
push edx
call fcn.005010b0
add esp, 0xc
mov dword [esp + 0x44], esi
lea edi, [esp + 0xa0]
lea esi, [esp + 0x3c]
mov ecx, edi
mov edx, esi
call fcn.004037fc
mov ecx, esi
mov edx, edi
push 0x514274
call fcn.00403470
pop eax
mov esi, dword [esp + 0x40]
lea ecx, [esp + 0x28]
mov edx, esi
push dword [esp + 0x44]
call fcn.00417470
pop eax
mov ecx, dword [esp + 0x3c]
mov edx, esi
call fcn.0043e31d
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x24], ecx
call fcn.0040293c
mov esi, edx
mov edx, dword [esp + 0x18]
lea ebx, [esp + 0x64]
mov edi, eax
mov ecx, ebx
push dword [esp + 0x14]
call fcn.00417ce0
pop eax
add esi, edi
mov ecx, ebx
mov edx, esi
push edi
call fcn.00419104
pop eax
mov edx, dword [esp + 0x68]
lea edi, [esp + 0xa0]
mov ecx, edi
mov dword [esp + 0x20], edx
push dword [esp + 0x6c]
call fcn.00404d88
pop eax
lea ebx, [esp + 0x3c]
mov edx, edi
mov ecx, ebx
call fcn.004c2481
lea esi, [esp + 0x100]
mov edx, ebx
mov ecx, esi
call fcn.004c2676
mov ecx, edi
mov edx, esi
call fcn.0040a1b8
mov eax, dword [esp + 0xa4]
mov edi, dword [esp + 0xa8]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0xc], eax
cmp ecx, dword [esp + 0x10]
je 0x40c52d
mov eax, dword [ecx + 8]
imul ebx, dword [ecx + 0xc], 0xc
mov dword [esp + 4], ecx
add ebx, eax
cmp eax, ebx
je 0x40c524
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
lea esi, [eax + 0xc]
push edi
push dword [esp + 0x10]
call fcn.004e4406
pop ecx
pop edx
test al, al
mov eax, esi
je 0x40c4f3
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, dword [ecx]
mov dword [esp + 8], eax
mov eax, esi
jmp 0x40c4f3
mov ecx, dword [esp + 4]
add ecx, 0x10
jmp 0x40c4e0
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0xc]
call fcn.0043e31d
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x20]
call fcn.0043e31d
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
call fcn.0043e31d
mov eax, dword [esp + 0x4098]
mov edi, dword [esp + 0x409c]
jmp 0x40c36c
mov ecx, dword [esp + 0x1c]
call fcn.00403e97
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x18]
call fcn.0043e31d
lea ecx, [esp + 0x58]
call fcn.004028b4
mov eax, dword [esp + 8]
test eax, 0x1a002
je 0x40c5ad
mov esi, dword [esp + 0x34]
test al, 2
mov byte [esi + 0x5c], 1
je 0x40c274
mov byte [esi + 0x4d], 1
jmp 0x40c274
mov esi, dword [esp + 0x34]
mov al, 1
jmp 0x40c276