Function at 0x40de30
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x44014c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x85c
mov eax, dword [esp + 0x86c]
push ebx
push ebp
push esi
xor ebx, ebx
cmp eax, 2
push edi
mov esi, ecx
mov dword [esp + 0x10], ebx
mov ebp, 7
jne 0x40e066
push 0x44342c
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x44342c
lea ecx, [esp + 0x28]
call fcn.00402300
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x78]
push ecx
mov dword [esp + 0x87c], ebx
mov dword [esp + 0x18], 1
call fcn.00415770
mov edi, eax
push 0x443424
mov dword [esp + 0x880], 1
mov dword [esp + 0x1c], 3
call fcn.0042cd50
mov edx, dword [edi + 0x14]
add esp, 0xc
push eax
push 0x443424
push edx
push ebx
mov ecx, edi
call fcn.004060d0
test eax, eax
je 0x40df72
push 0x44342c
mov dword [esp + 0x74], ebp
mov dword [esp + 0x70], ebx
mov word [esp + 0x60], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x44342c
lea ecx, [esp + 0x60]
call fcn.00402300
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x87c], 2
mov dword [esp + 0x18], ebp
call fcn.00415770
mov edi, eax
push 0x443418
mov dword [esp + 0x880], 3
mov dword [esp + 0x1c], 0xf
call fcn.0042cd50
mov edx, dword [edi + 0x14]
add esp, 0xc
push eax
push 0x443418
push edx
push ebx
mov ecx, edi
call fcn.004060d0
test eax, eax
mov byte [esp + 0x16], bl
jne 0x40df77
mov byte [esp + 0x16], 1
test byte [esp + 0x10], 8
mov edi, 8
je 0x40dfb0
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x54]
and ecx, 0xfffffff7
cmp eax, edi
mov dword [esp + 0x10], ecx
jb 0x40dfa3
mov eax, dword [esp + 0x40]
push eax
call fcn.0042c508
add esp, 4
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], bx
test byte [esp + 0x10], 4
je 0x40dfe4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x70]
and ecx, 0xfffffffb
cmp eax, edi
mov dword [esp + 0x10], ecx
jb 0x40dfd7
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.0042c508
add esp, 4
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov word [esp + 0x5c], bx
test byte [esp + 0x10], 2
je 0x40e021
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x8c]
and ecx, 0xfffffffd
cmp eax, edi
mov dword [esp + 0x10], ecx
jb 0x40e00e
mov edx, dword [esp + 0x78]
push edx
call fcn.0042c508
add esp, 4
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], bx
test byte [esp + 0x10], 1
mov dword [esp + 0x874], 0xffffffff
je 0x40e053
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x38]
and ecx, 0xfffffffe
cmp eax, edi
mov dword [esp + 0x10], ecx
jb 0x40e053
mov eax, dword [esp + 0x24]
push eax
call fcn.0042c508
add esp, 4
cmp byte [esp + 0x16], bl
je 0x40e07e
mov dword [esp + 0x87c], 3
jmp 0x40e06b
cmp eax, 3
jne 0x40e07e
cmp dword [esi + 0xb08], ebx
jne 0x40e07e
mov dword [esp + 0x87c], 4
push 0x44342c
mov byte [esp + 0x1a], 1
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x44342c
lea ecx, [esp + 0x28]
call fcn.00402300
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x40]
push edx
mov dword [esp + 0x87c], 4
call fcn.00415770
mov edi, eax
push 0x443408
mov byte [esp + 0x880], 5
call fcn.0042cd50
add esp, 0xc
push eax
mov eax, dword [edi + 0x14]
push 0x443408
push eax
push ebx
mov ecx, edi
call fcn.004060d0
neg eax
sbb al, al
inc al
mov byte [esp + 0x17], al
cmp dword [esp + 0x54], 8
jb 0x40e10d
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x38], 8
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], bx
mov dword [esp + 0x874], 0xffffffff
jb 0x40e139
mov edx, dword [esp + 0x24]
push edx
call fcn.0042c508
add esp, 4
cmp byte [esp + 0x17], bl
mov edi, dword [esp + 0x87c]
je 0x40e184
cmp edi, 2
jne 0x40e184
lea eax, [esi + 0xa34]
push eax
call fcn.0041d3c0
add esp, 4
test al, al
jne 0x40e16d
lea eax, [esi + 0xa34]
push eax
call fcn.0041d530
add esp, 4
lea eax, [esi + 0xa34]
push eax
call fcn.0041d3c0
add esp, 4
test al, al
je 0x40e184
mov byte [esp + 0x16], bl
push 0x4424b8
mov dword [esi + 0x9f8], edi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x4424b8
lea ecx, [esp + 0x28]
call fcn.00402300
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x78]
push ecx
mov dword [esp + 0x87c], 6
call fcn.00415770
push 0x4424a8
push eax
lea edx, [esp + 0x4c]
push edx
mov byte [esp + 0x888], 7
call fcn.00402570
add esp, 0x14
push eax
mov ecx, esi
mov byte [esp + 0x878], 8
call fcn.00408e10
cmp dword [esp + 0x54], 8
jb 0x40e20c
mov eax, dword [esp + 0x40]
push eax
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x8c], 8
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], bx
jb 0x40e230
mov ecx, dword [esp + 0x78]
push ecx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x38], 8
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], bx
mov dword [esp + 0x874], 0xffffffff
jb 0x40e262
mov edx, dword [esp + 0x24]
push edx
call fcn.0042c508
add esp, 4
push edi
mov ecx, esi
call fcn.00406b00
cmp dword [esi + 0xab0], ebx
mov edi, 2
je 0x40e33a
cmp dword [esi + 0x9f8], edi
jne 0x40e321
push 0x4433f0
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x4433f0
lea ecx, [esp + 0x28]
call fcn.00402300
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x87c], 9
call fcn.00415770
add esp, 8
mov ecx, dword [esi + 0xab0]
push eax
mov byte [esp + 0x878], 0xa
call fcn.0041a050
cmp dword [esp + 0x54], 8
jb 0x40e2f5
mov edx, dword [esp + 0x40]
push edx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x38], 8
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], bx
mov dword [esp + 0x874], 0xffffffff
jb 0x40e321
mov eax, dword [esp + 0x24]
push eax
call fcn.0042c508
add esp, 4
mov edx, dword [esi + 0x9f8]
xor ecx, ecx
cmp edx, edi
sete cl
push ecx
mov ecx, dword [esi + 0xab0]
call fcn.004199f0
mov ecx, dword [esi + 0xab4]
cmp ecx, ebx
je 0x40e357
mov eax, dword [esi + 0x9f8]
xor edx, edx
cmp eax, edi
sete dl
push edx
call fcn.004199f0
mov ecx, dword [esi + 0xab8]
cmp ecx, ebx
je 0x40e374
mov edx, dword [esi + 0x9f8]
xor eax, eax
cmp edx, edi
sete al
push eax
call fcn.004199f0
mov ecx, dword [esi + 0xa84]
cmp ecx, ebx
je 0x40e3a1
mov eax, dword [esi + 0x9f8]
cmp eax, 1
je 0x40e396
cmp eax, edi
je 0x40e396
cmp eax, 6
je 0x40e396
xor eax, eax
jmp 0x40e39b
mov eax, 1
push eax
call fcn.004199f0
cmp dword [esi + 0xa80], ebx
je 0x40e3c4
mov ecx, dword [esi + 0x9f8]
push ecx
call fcn.004083f0
mov ecx, dword [esi + 0xa80]
add esp, 4
push eax
call fcn.004199f0
mov ecx, dword [esi + 0xa88]
cmp ecx, ebx
je 0x40e3ed
mov eax, dword [esi + 0x9f8]
cmp eax, 5
je 0x40e3e2
cmp eax, 8
je 0x40e3e2
xor eax, eax
jmp 0x40e3e7
mov eax, 1
push eax
call fcn.004199f0
mov ecx, dword [esi + 0xa8c]
cmp ecx, ebx
je 0x40e414
cmp dword [esi + 0x9f8], edi
jne 0x40e40c
cmp byte [esp + 0x16], bl
je 0x40e40c
mov eax, 1
jmp 0x40e40e
xor eax, eax
push eax
call fcn.004199f0
mov ecx, dword [esi + 0xa98]
cmp ecx, ebx
je 0x40e43b
cmp dword [esi + 0x9f8], edi
jne 0x40e433
cmp byte [esp + 0x16], bl
je 0x40e433
mov eax, 1
jmp 0x40e435
xor eax, eax
push eax
call fcn.004199f0
xor edi, edi
lea ecx, [ecx]
mov ecx, dword [esi + 0xae0]
cmp ecx, ebx
jne 0x40e44e
xor eax, eax
jmp 0x40e459
mov eax, dword [esi + 0xae4]
sub eax, ecx
sar eax, 2
cmp edi, eax
jge 0x40e47f
mov edx, dword [esi + 0xae0]
lea eax, [edx + edi*4]
mov edx, dword [esi + 0x9f8]
xor ecx, ecx
cmp edx, 1
sete cl
push ecx
mov ecx, dword [eax]
call fcn.004199f0
inc edi
jmp 0x40e440
mov eax, dword [esi + 0x9f8]
cmp eax, 3
je 0x40e497
cmp eax, 4
je 0x40e497
cmp eax, ebp
je 0x40e497
xor eax, eax
jmp 0x40e49c
mov eax, 1
mov ecx, dword [esi + 0xa9c]
push eax
call fcn.004199f0
mov eax, dword [esi + 0x9f8]
cmp eax, 3
je 0x40e4c0
cmp eax, 4
je 0x40e4c0
cmp eax, ebp
je 0x40e4c0
xor eax, eax
jmp 0x40e4c5
mov eax, 1
mov ecx, dword [esi + 0xaa0]
push eax
call fcn.004199f0
mov eax, dword [esi + 0x9f8]
cmp eax, 3
je 0x40e4e9
cmp eax, 4
je 0x40e4e9
cmp eax, ebp
je 0x40e4e9
xor eax, eax
jmp 0x40e4ee
mov eax, 1
mov ecx, dword [esi + 0xaa4]
push eax
call fcn.004199f0
mov eax, dword [esi + 0x9f8]
cmp eax, 3
je 0x40e512
cmp eax, 4
je 0x40e512
cmp eax, ebp
je 0x40e512
xor eax, eax
jmp 0x40e517
mov eax, 1
mov ecx, dword [esi + 0xa90]
push eax
call fcn.004199f0
mov eax, dword [esi + 0x9f8]
cmp eax, 3
je 0x40e53b
cmp eax, 4
je 0x40e53b
cmp eax, ebp
je 0x40e53b
xor eax, eax
jmp 0x40e540
mov eax, 1
mov ecx, dword [esi + 0xa94]
push eax
call fcn.004199f0
cmp dword [esi + 0x9f8], 2
jne 0x40e654
mov ecx, dword [esi + 0xab4]
mov edx, dword [ecx]
call dword [edx + 0x34]
test al, al
jne 0x40e5da
push 0x4433b8
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x4433b8
lea ecx, [esp + 0x28]
call fcn.00402300
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
or edx, 0x10
push ecx
mov dword [esp + 0x87c], 0xb
mov dword [esp + 0x18], edx
call fcn.00415770
add esp, 8
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 0x14]
or edx, 0x20
cmp ecx, ebx
mov dword [esp + 0x874], 0xc
mov dword [esp + 0x10], edx
ja 0x40e5da
xor al, al
jmp 0x40e5de
xor eax, eax
mov al, 1
mov ecx, dword [esi + 0xa84]
push eax
call fcn.00401090
test byte [esp + 0x10], 0x20
je 0x40e61f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x54]
and ecx, 0xffffffdf
cmp eax, 8
mov dword [esp + 0x10], ecx
jb 0x40e612
mov edx, dword [esp + 0x40]
push edx
call fcn.0042c508
add esp, 4
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], bx
test byte [esp + 0x10], 0x10
mov dword [esp + 0x874], 0xffffffff
je 0x40e661
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x38]
and ecx, 0xffffffef
cmp eax, 8
mov dword [esp + 0x10], ecx
jb 0x40e661
mov eax, dword [esp + 0x24]
push eax
call fcn.0042c508
add esp, 4
jmp 0x40e661
mov ecx, dword [esi + 0xa84]
push 1
call fcn.00401090
lea ecx, [esi + 0x958]
call fcn.0041a970
push 0x44342c
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x44342c
lea ecx, [esp + 0x28]
call fcn.00402300
or dword [esp + 0x10], 0x40
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x78]
push edx
mov dword [esp + 0x87c], 0xd
call fcn.00415770
mov edi, eax
mov ecx, dword [esp + 0x18]
or ecx, 0x80
push 0x443424
mov dword [esp + 0x880], 0xe
mov dword [esp + 0x1c], ecx
call fcn.0042cd50
add esp, 0xc
push eax
mov eax, dword [edi + 0x14]
push 0x443424
push eax
push ebx
mov ecx, edi
call fcn.004060d0
test eax, eax
je 0x40e783
push 0x44342c
mov dword [esp + 0x74], ebp
mov dword [esp + 0x70], ebx
mov word [esp + 0x60], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x44342c
lea ecx, [esp + 0x60]
call fcn.00402300
or dword [esp + 0x10], 0x100
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x40]
push edx
mov dword [esp + 0x87c], 0xf
call fcn.00415770
mov edi, eax
mov ecx, dword [esp + 0x18]
or ecx, 0x200
push 0x443418
mov dword [esp + 0x880], 0x10
mov dword [esp + 0x1c], ecx
call fcn.0042cd50
add esp, 0xc
push eax
mov eax, dword [edi + 0x14]
push 0x443418
push eax
push ebx
mov ecx, edi
call fcn.004060d0
test eax, eax
mov byte [esp + 0x16], bl
jne 0x40e788
mov byte [esp + 0x16], 1
mov eax, dword [esp + 0x10]
test ah, 2
mov edi, 8
je 0x40e7c4
mov ecx, eax
mov eax, dword [esp + 0x54]
and ecx, 0xfffffdff
cmp eax, edi
mov dword [esp + 0x10], ecx
jb 0x40e7b7
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0042c508
add esp, 4
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], bx
mov eax, dword [esp + 0x10]
test ah, 1
je 0x40e7fb
mov ecx, eax
mov eax, dword [esp + 0x70]
and ecx, 0xfffffeff
cmp eax, edi
mov dword [esp + 0x10], ecx
jb 0x40e7ee
mov edx, dword [esp + 0x5c]
push edx
call fcn.0042c508
add esp, 4
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov word [esp + 0x5c], bx
mov al, byte [esp + 0x10]
test al, al
jns 0x40e83c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x8c]
and ecx, 0xffffff7f
cmp eax, edi
mov dword [esp + 0x10], ecx
jb 0x40e829
mov eax, dword [esp + 0x78]
push eax
call fcn.0042c508
add esp, 4
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], bx
test byte [esp + 0x10], 0x40
mov dword [esp + 0x874], 0xffffffff
je 0x40e86e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x38]
and ecx, 0xffffffbf
cmp eax, edi
mov dword [esp + 0x10], ecx
jb 0x40e86e
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0042c508
add esp, 4
cmp byte [esp + 0x16], bl
je 0x40e87d
cmp dword [esp + 0x87c], edi
je 0x40e89d
mov edx, dword [esi + 4]
push edx
call dword [0x4422a8]
mov eax, dword [esi + 4]
push 1
push eax
call dword [fcn.004422b8]
mov ecx, dword [esi + 4]
push ecx
call dword [0x4422ac]
mov eax, dword [esi + 0x9f8]
dec eax
cmp eax, 6
ja case.default.0x40e8ad
jmp dword [eax*4 + 0x4105fc]
push 0x44b0f8
call fcn.00407e50
add esp, 4
test eax, eax
jne 0x40e8d4
lea ecx, [esi + 0xabc]
call fcn.00405cf0
test al, al
je 0x40e8ee
push ebx
mov ecx, esi
call fcn.00413df0
mov edx, dword [esi + 4]
push ebx
push 1
push 0x464
push edx
call dword [fcn.0044bd60]
cmp dword [0x44b10c], ebx
jne case.default.0x40e8ad
lea ecx, [esi + 0xabc]
call fcn.00405cf0
test al, al
jne case.default.0x40e8ad
mov eax, dword [esi + 0xac0]
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x44b0f8
call fcn.004015a0
push 1
mov ecx, esi
call fcn.00413df0
jmp case.default.0x40e8ad
mov ecx, dword [esi + 0xab4]
cmp ecx, ebx
je case.default.0x40e8ad
mov edx, dword [ecx]
push ebx
call dword [edx + 0x30]
jmp case.default.0x40e8ad
push 0xffffffffffffffff
push ebx
lea eax, [esi + 0xa18]
push eax
lea ecx, [esi + 0x898]
call fcn.004015a0
push ebx
push esi
lea ecx, [esi + 0x74]
call fcn.00420d80
jmp case.default.0x40e8ad
xor edi, edi
mov edi, edi
mov ecx, dword [esi + 0xb14]
cmp ecx, ebx
je 0x40e99e
mov eax, dword [esi + 0xb18]
sub eax, ecx
sar eax, 2
cmp edi, eax
jae 0x40e99e
lea eax, [ecx + edi*4]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
cmp ecx, ebx
je 0x40e99b
mov eax, ecx
mov edx, dword [eax]
call dword [edx]
inc edi
jmp 0x40e970
push 0xffffffffffffffff
push ebx
lea eax, [esi + 0xa18]
push eax
lea ecx, [esi + 0x8fc]
call fcn.004015a0
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0xa34]
push ecx
lea ecx, [esi + 0x918]
call fcn.004015a0
push ebx
push esi
lea ecx, [esi + 0x8f0]
call fcn.00420d80
jmp case.default.0x40e8ad
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], bx
lea edx, [esp + 0x20]
push edx
mov ecx, esi
mov dword [esp + 0x878], 0x11
call fcn.00408ea0
push 0x4424f0
mov byte [esp + 0x878], 0x12
mov dword [esp + 0x224], ebp
mov dword [esp + 0x220], ebx
mov word [esp + 0x210], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x4424f0
lea ecx, [esp + 0x210]
call fcn.00402300
push 0x4424f0
mov byte [esp + 0x878], 0x13
mov dword [esp + 0x144], ebp
mov dword [esp + 0x140], ebx
mov word [esp + 0x130], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x4424f0
lea ecx, [esp + 0x130]
call fcn.00402300
push 0x4424b8
mov byte [esp + 0x878], 0x14
mov dword [esp + 0x10c], ebp
mov dword [esp + 0x108], ebx
mov word [esp + 0xf8], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x4424b8
lea ecx, [esp + 0xf8]
call fcn.00402300
lea eax, [esp + 0xf0]
push eax
lea ecx, [esp + 0x508]
push ecx
mov byte [esp + 0x87c], 0x15
call fcn.00415770
push 0x4433ac
push eax
lea edx, [esp + 0x418]
push edx
mov byte [esp + 0x888], 0x16
call fcn.00402570
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x220]
push edx
lea ecx, [esp + 0x144]
push ecx
lea edx, [esp + 0x40]
push edx
push eax
mov byte [esp + 0x89c], 0x17
call fcn.00423880
add esp, 0x28
neg eax
sbb al, al
inc al
mov byte [esp + 0x17], al
cmp dword [esp + 0x420], edi
jb 0x40eb44
mov eax, dword [esp + 0x40c]
push eax
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x51c], edi
mov dword [esp + 0x420], ebp
mov dword [esp + 0x41c], ebx
mov word [esp + 0x40c], bx
jb 0x40eb73
mov ecx, dword [esp + 0x508]
push ecx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x108], edi
mov dword [esp + 0x51c], ebp
mov dword [esp + 0x518], ebx
mov word [esp + 0x508], bx
jb 0x40eba2
mov edx, dword [esp + 0xf4]
push edx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x140], edi
mov dword [esp + 0x108], ebp
mov dword [esp + 0x104], ebx
mov word [esp + 0xf4], bx
jb 0x40ebd1
mov eax, dword [esp + 0x12c]
push eax
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x220], edi
mov dword [esp + 0x140], ebp
mov dword [esp + 0x13c], ebx
mov word [esp + 0x12c], bx
mov byte [esp + 0x874], 0x12
jb 0x40ec08
mov ecx, dword [esp + 0x20c]
push ecx
call fcn.0042c508
add esp, 4
cmp byte [esp + 0x17], bl
mov dword [esp + 0x220], ebp
mov dword [esp + 0x21c], ebx
mov word [esp + 0x20c], bx
je 0x40ecb4
push 0x44339c
mov dword [esp + 0x240], ebp
mov dword [esp + 0x23c], ebx
mov word [esp + 0x22c], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x44339c
lea ecx, [esp + 0x22c]
call fcn.00402300
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x228]
push eax
lea ecx, [esi + 0x938]
mov byte [esp + 0x87c], 0x18
call fcn.0041ac20
cmp dword [esp + 0x23c], edi
mov byte [esp + 0x874], 0x12
jb 0x40ec9e
mov ecx, dword [esp + 0x228]
push ecx
call fcn.0042c508
add esp, 4
mov dword [esp + 0x23c], ebp
mov dword [esp + 0x238], ebx
mov word [esp + 0x228], bx
push 0x4424f0
mov dword [esp + 0xf0], ebp
mov dword [esp + 0xec], ebx
mov word [esp + 0xdc], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x4424f0
lea ecx, [esp + 0xdc]
call fcn.00402300
push 0x4424f0
mov byte [esp + 0x878], 0x19
mov dword [esp + 0x1b4], ebp
mov dword [esp + 0x1b0], ebx
mov word [esp + 0x1a0], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x4424f0
lea ecx, [esp + 0x1a0]
call fcn.00402300
push 0x4424b8
mov byte [esp + 0x878], 0x1a
mov dword [esp + 0x128], ebp
mov dword [esp + 0x124], ebx
mov word [esp + 0x114], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x4424b8
lea ecx, [esp + 0x114]
call fcn.00402300
lea edx, [esp + 0x10c]
push edx
lea eax, [esp + 0x4d0]
push eax
mov byte [esp + 0x87c], 0x1b
call fcn.00415770
push 0x4433ac
push eax
lea ecx, [esp + 0x4f8]
push ecx
mov byte [esp + 0x888], 0x1c
call fcn.00402570
lea edx, [esp + 0x88]
push edx
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0x1b4]
push edx
lea ecx, [esp + 0x40]
push ecx
push eax
mov byte [esp + 0x89c], 0x1d
call fcn.00423740
add esp, 0x28
neg eax
sbb al, al
inc al
mov byte [esp + 0x17], al
cmp dword [esp + 0x500], edi
jb 0x40edec
mov edx, dword [esp + 0x4ec]
push edx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x4e4], edi
mov dword [esp + 0x500], ebp
mov dword [esp + 0x4fc], ebx
mov word [esp + 0x4ec], bx
jb 0x40ee1b
mov eax, dword [esp + 0x4d0]
push eax
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x124], edi
mov dword [esp + 0x4e4], ebp
mov dword [esp + 0x4e0], ebx
mov word [esp + 0x4d0], bx
jb 0x40ee4a
mov ecx, dword [esp + 0x110]
push ecx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x1b0], edi
mov dword [esp + 0x124], ebp
mov dword [esp + 0x120], ebx
mov word [esp + 0x110], bx
jb 0x40ee79
mov edx, dword [esp + 0x19c]
push edx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0xec], edi
mov dword [esp + 0x1b0], ebp
mov dword [esp + 0x1ac], ebx
mov word [esp + 0x19c], bx
mov byte [esp + 0x874], 0x12
jb 0x40eeb0
mov eax, dword [esp + 0xd8]
push eax
call fcn.0042c508
add esp, 4
cmp byte [esp + 0x17], bl
mov dword [esp + 0xec], ebp
mov dword [esp + 0xe8], ebx
mov word [esp + 0xd8], bx
je 0x40ef11
push 0x44339c
lea ecx, [esp + 0x5cc]
call fcn.004024f0
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x5cc]
push edx
lea ecx, [esi + 0x938]
mov byte [esp + 0x87c], 0x1e
call fcn.0041ac20
lea ecx, [esp + 0x5c8]
mov byte [esp + 0x874], 0x12
call fcn.00401ea0
push 0x44338c
lea ecx, [esp + 0x284]
call fcn.004024f0
lea eax, [esi + 0xa34]
push eax
lea eax, [esp + 0x284]
lea ecx, [esi + 0x938]
push eax
mov byte [esp + 0x87c], 0x1f
call fcn.0041ac20
cmp dword [esp + 0x298], edi
mov byte [esp + 0x874], 0x12
jb 0x40ef65
mov ecx, dword [esp + 0x284]
push ecx
call fcn.0042c508
add esp, 4
push 0x442524
lea ecx, [esp + 0x2bc]
mov dword [esp + 0x29c], ebp
mov dword [esp + 0x298], ebx
mov word [esp + 0x288], bx
call fcn.004024f0
lea edx, [esp + 0x2b8]
push edx
lea eax, [esp + 0x364]
push eax
mov byte [esp + 0x87c], 0x20
call fcn.00415770
add esp, 8
push eax
lea ecx, [esp + 0x244]
mov byte [esp + 0x878], 0x21
call fcn.00422780
cmp dword [esp + 0x378], edi
jb 0x40efda
mov ecx, dword [esp + 0x364]
push ecx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x2d0], edi
mov dword [esp + 0x378], ebp
mov dword [esp + 0x374], ebx
mov word [esp + 0x364], bx
mov byte [esp + 0x874], 0x23
jb 0x40f011
mov edx, dword [esp + 0x2bc]
push edx
call fcn.0042c508
add esp, 4
push 0x44337c
lea ecx, [esp + 0x2f4]
mov dword [esp + 0x2d4], ebp
mov dword [esp + 0x2d0], ebx
mov word [esp + 0x2c0], bx
call fcn.004024f0
lea eax, [esi + 0xa34]
push eax
lea eax, [esp + 0x2f4]
push eax
lea ecx, [esp + 0x248]
mov byte [esp + 0x87c], 0x25
call fcn.00421f20
cmp dword [esp + 0x308], edi
mov byte [esp + 0x874], 0x23
jb 0x40f07c
mov ecx, dword [esp + 0x2f4]
push ecx
call fcn.0042c508
add esp, 4
lea edx, [esp + 0x440]
push edx
lea ecx, [esp + 0x244]
mov dword [esp + 0x30c], ebp
mov dword [esp + 0x308], ebx
mov word [esp + 0x2f8], bx
call fcn.00422b90
mov ecx, dword [eax + 0x14]
mov eax, dword [esp + 0x458]
cmp ecx, ebx
setne byte [esp + 0x17]
cmp eax, edi
jb 0x40f0cb
mov eax, dword [esp + 0x444]
push eax
call fcn.0042c508
add esp, 4
cmp byte [esp + 0x17], bl
mov dword [esp + 0x458], ebp
mov dword [esp + 0x454], ebx
mov word [esp + 0x444], bx
je 0x40f17e
push 0x44336c
lea ecx, [esp + 0x658]
call fcn.004024f0
lea ecx, [esp + 0x7dc]
push ecx
lea ecx, [esp + 0x244]
mov byte [esp + 0x878], 0x26
call fcn.00422b90
push 0x44337c
push eax
lea edx, [esp + 0x6e8]
push edx
mov byte [esp + 0x880], 0x27
call fcn.00402570
add esp, 0xc
push eax
lea eax, [esp + 0x658]
push eax
lea ecx, [esi + 0x938]
mov byte [esp + 0x87c], 0x28
call fcn.0041ac20
lea ecx, [esp + 0x6e0]
call fcn.00401ea0
lea ecx, [esp + 0x7dc]
call fcn.00401ea0
lea ecx, [esp + 0x654]
mov byte [esp + 0x874], 0x23
call fcn.00401ea0
push 0xffffffffffffffff
push ebx
lea eax, [esi + 0xa34]
push eax
lea ecx, [esp + 0x9c]
mov dword [esp + 0xb4], ebp
mov dword [esp + 0xb0], ebx
mov word [esp + 0xa0], bx
call fcn.004015a0
cmp dword [esp + 0xa8], edi
mov eax, dword [esp + 0x94]
mov byte [esp + 0x874], 0x29
jae 0x40f1c9
lea eax, [esp + 0x94]
mov ecx, dword [esp + 0xa4]
mov edi, 0x5c
cmp word [eax + ecx*2 - 2], di
je 0x40f1fb
push 0x4429e0
call fcn.0042cd50
add esp, 4
push eax
push 0x4429e0
lea ecx, [esp + 0x98]
call fcn.004021e0
push 0xffffffffffffffff
push 1
mov dword [esp + 0x20], edi
push 0xffffffffffffffff
lea edx, [esp + 0x24]
lea edi, [esi + 0x9fc]
push edx
mov ecx, edi
call fcn.00405430
inc eax
push eax
lea eax, [esp + 0x4b8]
push eax
mov ecx, edi
call fcn.00405520
push eax
lea ecx, [esp + 0x39c]
push 0x443368
push ecx
mov byte [esp + 0x880], 0x2a
call fcn.004039f0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x9c]
mov byte [esp + 0x880], 0x2b
call fcn.00402010
cmp dword [esp + 0x3b0], 8
jb 0x40f278
mov edx, dword [esp + 0x39c]
push edx
call fcn.0042c508
add esp, 4
mov eax, dword [esp + 0x4c8]
mov ecx, 8
cmp eax, ecx
mov dword [esp + 0x3b0], ebp
mov dword [esp + 0x3ac], ebx
mov word [esp + 0x39c], bx
mov byte [esp + 0x874], 0x29
jb 0x40f2bb
mov eax, dword [esp + 0x4b4]
push eax
call fcn.0042c508
add esp, 4
mov ecx, 8
cmp dword [esp + 0xa8], ecx
mov eax, dword [esp + 0x94]
mov dword [esp + 0x4c8], ebp
mov dword [esp + 0x4c4], ebx
mov word [esp + 0x4b4], bx
jae 0x40f2e8
lea eax, [esp + 0x94]
cmp dword [edi + 0x18], ecx
jb 0x40f2f2
mov edi, dword [edi + 4]
jmp 0x40f2f5
add edi, 4
push ebx
push eax
push edi
call dword [0x44d300]
cmp dword [esp + 0xa8], 8
mov eax, dword [esp + 0x94]
jae 0x40f316
lea eax, [esp + 0x94]
push 0x80
push eax
call dword [0x44d420]
xor edi, edi
mov ecx, dword [esi + 0xb14]
cmp ecx, ebx
je 0x40f353
mov eax, dword [esi + 0xb18]
sub eax, ecx
sar eax, 2
cmp edi, eax
jae 0x40f353
lea eax, [ecx + edi*4]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
cmp ecx, ebx
je 0x40f350
mov eax, ecx
mov edx, dword [eax]
call dword [edx + 4]
inc edi
jmp 0x40f324
push 0x442524
mov dword [esp + 0x1ec], ebp
mov dword [esp + 0x1e8], ebx
mov word [esp + 0x1d8], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x442524
lea ecx, [esp + 0x1d8]
call fcn.00402300
lea eax, [esp + 0x1d0]
push eax
lea ecx, [esp + 0x47c]
push ecx
mov byte [esp + 0x87c], 0x2c
call fcn.00415770
push eax
lea edx, [esp + 0x3dc]
push 0x443310
push edx
mov byte [esp + 0x888], 0x2d
call fcn.004039f0
add esp, 0x14
push eax
lea ecx, [esp + 0x264]
mov byte [esp + 0x878], 0x2e
call fcn.00422780
mov eax, dword [esp + 0x3e8]
mov edi, 8
cmp eax, edi
jb 0x40f3f8
mov eax, dword [esp + 0x3d4]
push eax
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x490], edi
mov dword [esp + 0x3e8], ebp
mov dword [esp + 0x3e4], ebx
mov word [esp + 0x3d4], bx
jb 0x40f427
mov ecx, dword [esp + 0x47c]
push ecx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x1e8], edi
mov dword [esp + 0x490], ebp
mov dword [esp + 0x48c], ebx
mov word [esp + 0x47c], bx
mov byte [esp + 0x874], 0x30
jb 0x40f45e
mov edx, dword [esp + 0x1d4]
push edx
call fcn.0042c508
add esp, 4
push 0x4424b8
mov dword [esp + 0x1ec], ebp
mov dword [esp + 0x1e8], ebx
mov word [esp + 0x1d8], bx
mov dword [esp + 0x208], ebp
mov dword [esp + 0x204], ebx
mov word [esp + 0x1f4], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x4424b8
lea ecx, [esp + 0x1f4]
call fcn.00402300
push 0x4432f8
mov byte [esp + 0x878], 0x33
mov dword [esp + 0x198], ebp
mov dword [esp + 0x194], ebx
mov word [esp + 0x184], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x4432f8
lea ecx, [esp + 0x184]
call fcn.00402300
lea eax, [esp + 0x1ec]
push eax
lea ecx, [esp + 0x310]
push ecx
mov byte [esp + 0x87c], 0x34
call fcn.00415770
add esp, 8
push eax
lea edx, [esp + 0x180]
push edx
lea ecx, [esp + 0x268]
mov byte [esp + 0x87c], 0x35
call fcn.00421f20
cmp dword [esp + 0x324], edi
jb 0x40f53c
mov eax, dword [esp + 0x310]
push eax
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x194], edi
mov dword [esp + 0x324], ebp
mov dword [esp + 0x320], ebx
mov word [esp + 0x310], bx
jb 0x40f56b
mov ecx, dword [esp + 0x180]
push ecx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x204], edi
mov dword [esp + 0x194], ebp
mov dword [esp + 0x190], ebx
mov word [esp + 0x180], bx
mov byte [esp + 0x874], 0x30
jb 0x40f5a2
mov edx, dword [esp + 0x1f0]
push edx
call fcn.0042c508
add esp, 4
push 0x4432d8
mov dword [esp + 0x208], ebp
mov dword [esp + 0x204], ebx
mov word [esp + 0x1f4], bx
mov dword [esp + 0x160], ebp
mov dword [esp + 0x15c], ebx
mov word [esp + 0x14c], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x4432d8
lea ecx, [esp + 0x14c]
call fcn.00402300
push 0x4432d4
mov byte [esp + 0x878], 0x36
mov dword [esp + 0x1d0], ebp
mov dword [esp + 0x1cc], ebx
mov word [esp + 0x1bc], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x4432d4
lea ecx, [esp + 0x1bc]
call fcn.00402300
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x1b8]
push ecx
lea edx, [esp + 0x34c]
push edx
mov byte [esp + 0x880], 0x37
call fcn.00402450
push 0x4432b8
push eax
lea eax, [esp + 0x33c]
push eax
mov byte [esp + 0x88c], 0x38
call fcn.00402570
add esp, 0x18
push eax
lea ecx, [esp + 0x148]
push ecx
lea ecx, [esp + 0x268]
mov byte [esp + 0x87c], 0x39
call fcn.00421f20
cmp dword [esp + 0x340], edi
jb 0x40f6a3
mov edx, dword [esp + 0x32c]
push edx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x35c], edi
mov dword [esp + 0x340], ebp
mov dword [esp + 0x33c], ebx
mov word [esp + 0x32c], bx
jb 0x40f6d2
mov eax, dword [esp + 0x348]
push eax
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x1cc], edi
mov dword [esp + 0x35c], ebp
mov dword [esp + 0x358], ebx
mov word [esp + 0x348], bx
jb 0x40f701
mov ecx, dword [esp + 0x1b8]
push ecx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x15c], edi
mov dword [esp + 0x1cc], ebp
mov dword [esp + 0x1c8], ebx
mov word [esp + 0x1b8], bx
mov byte [esp + 0x874], 0x30
jb 0x40f738
mov edx, dword [esp + 0x148]
push edx
call fcn.0042c508
add esp, 4
lea eax, [esp + 0x37c]
push eax
lea ecx, [esp + 0x264]
mov dword [esp + 0x160], ebp
mov dword [esp + 0x15c], ebx
mov word [esp + 0x14c], bx
call fcn.00422b90
mov ecx, dword [eax + 0x14]
mov eax, dword [esp + 0x394]
cmp ecx, ebx
setne byte [esp + 0x17]
cmp eax, edi
jb 0x40f787
mov ecx, dword [esp + 0x380]
push ecx
call fcn.0042c508
add esp, 4
cmp byte [esp + 0x17], bl
mov dword [esp + 0x394], ebp
mov dword [esp + 0x390], ebx
mov word [esp + 0x380], bx
je 0x40f856
push 0x44336c
lea ecx, [esp + 0x2a0]
call fcn.004024f0
lea edx, [esp + 0x3b4]
push edx
lea ecx, [esp + 0x264]
mov byte [esp + 0x878], 0x3a
call fcn.00422b90
push eax
lea eax, [esp + 0x2a0]
push eax
lea ecx, [esi + 0x938]
mov byte [esp + 0x87c], 0x3b
call fcn.0041ac20
cmp dword [esp + 0x3cc], edi
jb 0x40f809
mov ecx, dword [esp + 0x3b8]
push ecx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x2b4], edi
mov dword [esp + 0x3cc], ebp
mov dword [esp + 0x3c8], ebx
mov word [esp + 0x3b8], bx
mov byte [esp + 0x874], 0x30
jb 0x40f840
mov edx, dword [esp + 0x2a0]
push edx
call fcn.0042c508
add esp, 4
mov dword [esp + 0x2b4], ebp
mov dword [esp + 0x2b0], ebx
mov word [esp + 0x2a0], bx
lea eax, [esp + 0x3ec]
push eax
lea ecx, [esp + 0x244]
call fcn.00422b90
mov ecx, dword [eax + 0x14]
mov eax, dword [esp + 0x404]
cmp ecx, ebx
setne byte [esp + 0x17]
cmp eax, edi
jb 0x40f88f
mov ecx, dword [esp + 0x3f0]
push ecx
call fcn.0042c508
add esp, 4
cmp byte [esp + 0x17], bl
mov dword [esp + 0x404], ebp
mov dword [esp + 0x400], ebx
mov word [esp + 0x3f0], bx
je 0x40f9ab
push 0x44336c
lea ecx, [esp + 0x2d8]
call fcn.004024f0
lea edx, [esp + 0x45c]
push edx
lea ecx, [esp + 0x244]
mov byte [esp + 0x878], 0x3c
call fcn.00422b90
push 0x4432a4
push eax
lea eax, [esp + 0x42c]
push eax
mov byte [esp + 0x880], 0x3d
call fcn.00402570
add esp, 0xc
push eax
lea ecx, [esp + 0x2d8]
push ecx
lea ecx, [esi + 0x938]
mov byte [esp + 0x87c], 0x3e
call fcn.0041ac20
cmp dword [esp + 0x43c], edi
jb 0x40f92f
mov edx, dword [esp + 0x428]
push edx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x474], edi
mov dword [esp + 0x43c], ebp
mov dword [esp + 0x438], ebx
mov word [esp + 0x428], bx
jb 0x40f95e
mov eax, dword [esp + 0x460]
push eax
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x2ec], edi
mov dword [esp + 0x474], ebp
mov dword [esp + 0x470], ebx
mov word [esp + 0x460], bx
mov byte [esp + 0x874], 0x30
jb 0x40f995
mov ecx, dword [esp + 0x2d8]
push ecx
call fcn.0042c508
add esp, 4
mov dword [esp + 0x2ec], ebp
mov dword [esp + 0x2e8], ebx
mov word [esp + 0x2d8], bx
push 0x4432a4
mov dword [esp + 0x17c], ebp
mov dword [esp + 0x178], ebx
mov word [esp + 0x168], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x4432a4
lea ecx, [esp + 0x168]
call fcn.00402300
lea edx, [esp + 0x160]
push edx
lea ecx, [esi + 0x938]
mov byte [esp + 0x878], 0x3f
call fcn.0041afc0
cmp dword [esp + 0x178], edi
mov byte [esp + 0x874], 0x30
jb 0x40fa1c
mov eax, dword [esp + 0x164]
push eax
call fcn.0042c508
add esp, 4
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
mov dword [esp + 0x17c], ebp
mov dword [esp + 0x178], ebx
mov word [esp + 0x168], bx
mov dword [esp + 0x20], 0x442acc
call fcn.0040d9a0
mov dword [esp + 0x18], ebx
lea ebx, [ebx]
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov word [esp + 0x5c], bx
mov edx, dword [esp + 0x18]
push edx
sub esp, 0x1c
mov edi, esp
mov dword [esp + 0x30], esp
mov dword [edi + 0x18], ebp
mov dword [edi + 0x14], ebx
push 0x44328c
mov byte [esp + 0x898], 0x40
mov word [edi + 4], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x44328c
mov ecx, edi
call fcn.00402300
lea eax, [esp + 0x78]
push eax
call fcn.0041f710
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0xd4]
push edx
call fcn.00415770
add esp, 0x2c
cmp dword [esp + 0xc0], ebx
mov byte [esp + 0x874], 0x41
je 0x40fbaa
mov eax, dword [esp + 0x18]
push eax
sub esp, 0x1c
mov edi, esp
mov dword [esp + 0x30], esp
mov dword [edi + 0x18], ebp
mov dword [edi + 0x14], ebx
push 0x443270
mov word [edi + 4], bx
call fcn.0042cd50
add esp, 4
push eax
push 0x443270
mov ecx, edi
call fcn.00402300
lea ecx, [esp + 0x78]
push ecx
call fcn.0041f710
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x64]
push eax
call fcn.00415770
add esp, 0x2c
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0xb0]
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0x87c], 0x42
call fcn.00421f20
cmp dword [esp + 0x54], 8
jb 0x40fb4b
mov eax, dword [esp + 0x40]
push eax
call fcn.0042c508
add esp, 4
mov eax, dword [esp + 0xc4]
mov edi, 8
cmp eax, edi
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], bx
jb 0x40fb78
mov ecx, dword [esp + 0xb0]
push ecx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x70], edi
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xc0], ebx
mov word [esp + 0xb0], bx
jb 0x40fba1
mov edx, dword [esp + 0x5c]
push edx
call fcn.0042c508
add esp, 4
inc dword [esp + 0x18]
jmp 0x40fa50
mov eax, dword [esp + 0xc4]
mov edi, 8
cmp eax, edi
jb 0x40fbca
mov eax, dword [esp + 0xb0]
push eax
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x70], edi
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xc0], ebx
mov word [esp + 0xb0], bx
mov byte [esp + 0x874], 0x30
jb 0x40fbfb
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.0042c508
add esp, 4
lea edx, [esp + 0x494]
push edx
call fcn.004246a0
mov eax, dword [esp + 0x4b0]
add esp, 4
cmp eax, 0x10
jb 0x40fc27
mov eax, dword [esp + 0x498]
push eax
call fcn.0042c508
add esp, 4
mov ecx, 0x44f6b8
mov dword [esp + 0x4ac], 0xf
mov dword [esp + 0x4a8], ebx
mov byte [esp + 0x498], bl
call fcn.00418e10
mov ecx, dword [0x44eb74]
push ecx
call dword [fcn.004421f0]
cmp dword [esp + 0x27c], edi
mov dword [esi + 0xb04], 1
jb 0x40fc7a
mov edx, dword [esp + 0x268]
push edx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0xa8], edi
mov dword [esp + 0x27c], ebp
mov dword [esp + 0x278], ebx
mov word [esp + 0x268], bx
jb 0x40fca9
mov eax, dword [esp + 0x94]
push eax
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x25c], edi
mov dword [esp + 0xa8], ebp
mov dword [esp + 0xa4], ebx
mov word [esp + 0x94], bx
jb 0x40fcd8
mov ecx, dword [esp + 0x248]
push ecx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x38], edi
mov dword [esp + 0x25c], ebp
mov dword [esp + 0x258], ebx
mov word [esp + 0x248], bx
jb 0x40fd01
mov edx, dword [esp + 0x24]
push edx
call fcn.0042c508
add esp, 4
cmp dword [esp + 0x8c], edi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
jb case.default.0x40e8ad
mov eax, dword [esp + 0x78]
push eax
call fcn.0042c508
add esp, 4
jmp case.default.0x40e8ad
mov dword [esi + 0xb04], 1
jmp case.default.0x40e8ad
push 0x4432a4
lea ecx, [esp + 0x55c]
call fcn.004024f0
lea ecx, [esp + 0x558]
lea edi, [esi + 0x938]
push ecx
mov ecx, edi
mov dword [esp + 0x878], 0x43
call fcn.0041ad10
test eax, eax
lea ecx, [esp + 0x558]
setne byte [esp + 0x17]
mov dword [esp + 0x874], 0xffffffff
call fcn.00401ea0
cmp byte [esp + 0x17], bl
je 0x40fddc
push 0x44323c
lea ecx, [esp + 0x620]
call fcn.004024f0
mov eax, dword [esi + 4]
lea edx, [esp + 0x61c]
push edx
push eax
mov dword [esp + 0x87c], 0x44
call fcn.00402780
add esp, 8
lea ecx, [esp + 0x61c]
call fcn.00401ea0
mov ecx, dword [esi + 4]
push ecx
call dword [0x4422b0]
jmp case.default.0x40e8ad
mov ecx, edi
call fcn.0041b9e0
test eax, eax
je 0x40fe32
push 0x44323c
lea ecx, [esp + 0x63c]
call fcn.004024f0
mov eax, dword [esi + 4]
lea edx, [esp + 0x638]
push edx
push eax
mov dword [esp + 0x87c], 0x45
call fcn.00402780
add esp, 8
lea ecx, [esp + 0x638]
call fcn.00401ea0
mov ecx, dword [esi + 4]
push ecx
call dword [0x4422b0]
jmp case.default.0x40e8ad
push 0x443218
lea ecx, [esp + 0x594]
call fcn.004024f0
lea edx, [esp + 0x590]
push edx
lea eax, [esp + 0x94]
push eax
mov dword [esp + 0x87c], 0x46
call fcn.00415770
add esp, 8
lea ecx, [esp + 0x590]
call fcn.00401ea0
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xc0], ebx
mov word [esp + 0xb0], bx
lea ecx, [esp + 0xc8]
mov byte [esp + 0x874], 0x49
mov dword [esp + 0x1c], 0x442acc
call fcn.00422f30
push 0x443200
lea ecx, [esp + 0x524]
mov edi, 0x4a
mov byte [esp + 0x878], 0x4a
call fcn.004024f0
or dword [esp + 0x10], 0x400
push 0x4431f4
lea ecx, [esp + 0x604]
mov byte [esp + 0x878], 0x4b
call fcn.004024f0
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x600]
push ecx
or ebp, 0x800
lea ecx, [esp + 0x850]
mov dword [esp + 0x878], 0x4c
mov dword [esp + 0x14], ebp
call fcn.00422780
mov ecx, ebp
or ecx, 0x1000
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0xcc]
push ecx
lea edx, [esp + 0x528]
push edx
mov ecx, eax
mov dword [esp + 0x880], 0x4d
call fcn.004228a0
test eax, eax
mov ebp, 1
jne 0x40ff57
cmp dword [esp + 0x18], ebp
mov byte [esp + 0x16], 1
je 0x40ff5b
mov byte [esp + 0x16], bl
mov eax, dword [esp + 0x10]
test ah, 0x10
je 0x40ff79
and eax, 0xffffefff
lea ecx, [esp + 0x84c]
mov dword [esp + 0x10], eax
call fcn.00406870
mov eax, dword [esp + 0x10]
test ah, 8
je 0x40ff97
and eax, 0xfffff7ff
lea ecx, [esp + 0x600]
mov dword [esp + 0x10], eax
call fcn.00401ea0
mov eax, dword [esp + 0x10]
test ah, 4
mov dword [esp + 0x874], edi
je 0x40ffbc
and eax, 0xfffffbff
lea ecx, [esp + 0x520]
mov dword [esp + 0x10], eax
call fcn.00401ea0
cmp byte [esp + 0x16], bl
je 0x410029
push 0x4431e4
lea ecx, [esp + 0x6ac]
call fcn.004024f0
mov ecx, dword [esp + 0xcc]
push ecx
push eax
lea edx, [esp + 0x81c]
push edx
mov byte [esp + 0x880], 0x4e
call fcn.00402570
add esp, 0xc
push eax
lea ecx, [esp + 0xb0]
mov byte [esp + 0x878], 0x4f
call fcn.00402530
lea ecx, [esp + 0x814]
call fcn.00401ea0
lea ecx, [esp + 0x6a8]
mov byte [esp + 0x874], 0x4a
call fcn.00401ea0
push 0x442524
lea ecx, [esp + 0x540]
call fcn.004024f0
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x53c]
push eax
lea ecx, [esp + 0x7fc]
or edx, 0x2000
push ecx
mov byte [esp + 0x87c], 0x50
mov dword [esp + 0x18], edx
call fcn.00415770
mov ecx, dword [esp + 0x18]
push eax
lea edx, [esp + 0x67c]
or ecx, 0x4000
push 0x442c08
push edx
mov dword [esp + 0x888], 0x51
mov dword [esp + 0x24], ecx
call fcn.004039f0
mov edx, dword [esp + 0x24]
push 0x4431d0
push eax
lea eax, [esp + 0x7a4]
or edx, 0x8000
push eax
mov dword [esp + 0x894], 0x52
mov dword [esp + 0x30], edx
call fcn.00402570
add esp, 0x20
or dword [esp + 0x10], 0x10000
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0xcc]
push edx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x880], 0x53
call fcn.00422340
test eax, eax
jne 0x4100f9
cmp dword [esp + 0x18], ebp
mov byte [esp + 0x16], 1
je 0x4100fd
mov byte [esp + 0x16], bl
mov eax, dword [esp + 0x10]
test eax, 0x10000
je 0x41011d
and eax, 0xfffeffff
lea ecx, [esp + 0x788]
mov dword [esp + 0x10], eax
call fcn.00401ea0
mov eax, dword [esp + 0x10]
test ah, ah
jns 0x41013a
and eax, 0xffff7fff
lea ecx, [esp + 0x670]
mov dword [esp + 0x10], eax
call fcn.00401ea0
mov eax, dword [esp + 0x10]
test ah, 0x40
je 0x410158
and eax, 0xffffbfff
lea ecx, [esp + 0x7f8]
mov dword [esp + 0x10], eax
call fcn.00401ea0
mov eax, dword [esp + 0x10]
test ah, 0x20
mov dword [esp + 0x874], edi
je 0x41017d
and eax, 0xffffdfff
lea ecx, [esp + 0x53c]
mov dword [esp + 0x10], eax
call fcn.00401ea0
cmp byte [esp + 0x16], bl
je 0x410205
cmp dword [esp + 0xc0], ebx
je 0x41019e
push 0x26
lea ecx, [esp + 0xb0]
call fcn.00407030
push 0x4431bc
lea ecx, [esp + 0x7c4]
call fcn.004024f0
mov ecx, dword [esp + 0xcc]
push ecx
push eax
lea edx, [esp + 0x720]
push edx
mov byte [esp + 0x880], 0x54
call fcn.00402570
add esp, 0xc
push eax
lea ecx, [esp + 0xb0]
mov byte [esp + 0x878], 0x55
call fcn.00402400
lea ecx, [esp + 0x718]
call fcn.00401ea0
lea ecx, [esp + 0x7c0]
mov byte [esp + 0x874], 0x4a
call fcn.00401ea0
push 0x442524
lea ecx, [esp + 0x578]
call fcn.004024f0
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x574]
push eax
lea ecx, [esp + 0x690]
or edx, 0x20000
push ecx
mov byte [esp + 0x87c], 0x56
mov dword [esp + 0x18], edx
call fcn.00415770
mov ecx, dword [esp + 0x18]
push eax
lea edx, [esp + 0x83c]
or ecx, 0x40000
push 0x442c08
push edx
mov dword [esp + 0x888], 0x57
mov dword [esp + 0x24], ecx
call fcn.004039f0
mov edx, dword [esp + 0x24]
push 0x4431a0
push eax
lea eax, [esp + 0x76c]
or edx, 0x80000
push eax
mov dword [esp + 0x894], 0x58
mov dword [esp + 0x30], edx
call fcn.00402570
add esp, 0x20
or dword [esp + 0x10], 0x100000
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0xcc]
push edx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x880], 0x59
call fcn.00422340
test eax, eax
jne 0x4102d5
cmp dword [esp + 0x18], ebp
mov byte [esp + 0x16], 1
je 0x4102d9
mov byte [esp + 0x16], bl
mov eax, dword [esp + 0x10]
test eax, 0x100000
je 0x4102f9
and eax, 0xffefffff
lea ecx, [esp + 0x750]
mov dword [esp + 0x10], eax
call fcn.00401ea0
mov eax, dword [esp + 0x10]
test eax, 0x80000
je 0x410319
and eax, 0xfff7ffff
lea ecx, [esp + 0x830]
mov dword [esp + 0x10], eax
call fcn.00401ea0
mov eax, dword [esp + 0x10]
test eax, 0x40000
je 0x410339
and eax, 0xfffbffff
lea ecx, [esp + 0x68c]
mov dword [esp + 0x10], eax
call fcn.00401ea0
mov eax, dword [esp + 0x10]
test eax, 0x20000
mov dword [esp + 0x874], edi
je 0x410360
and eax, 0xfffdffff
lea ecx, [esp + 0x574]
mov dword [esp + 0x10], eax
call fcn.00401ea0
cmp byte [esp + 0x16], bl
je 0x4103e8
cmp dword [esp + 0xc0], ebx
je 0x410381
push 0x26
lea ecx, [esp + 0xb0]
call fcn.00407030
push 0x443184
lea ecx, [esp + 0x700]
call fcn.004024f0
mov ecx, dword [esp + 0xcc]
push ecx
push eax
lea edx, [esp + 0x6cc]
push edx
mov byte [esp + 0x880], 0x5a
call fcn.00402570
add esp, 0xc
push eax
lea ecx, [esp + 0xb0]
mov byte [esp + 0x878], 0x5b
call fcn.00402400
lea ecx, [esp + 0x6c4]
call fcn.00401ea0
lea ecx, [esp + 0x6fc]
mov byte [esp + 0x874], 0x4a
call fcn.00401ea0
mov ecx, dword [esi + 0xa90]
push ebx
push 0x64
call fcn.00415200
mov ecx, dword [esi + 0xa94]
push ebx
push 0x64
call fcn.00415200
push 0x443150
lea ecx, [esp + 0x5e8]
call fcn.004024f0
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x5e4]
push eax
lea ecx, [esp + 0x738]
or edx, 0x200000
push ecx
mov byte [esp + 0x87c], 0x5c
mov dword [esp + 0x18], edx
call fcn.00415770
add esp, 8
mov edx, dword [esp + 0x10]
mov eax, dword [eax + 0x14]
or edx, 0x400000
cmp eax, ebx
mov dword [esp + 0x874], 0x5d
mov dword [esp + 0x10], edx
je 0x4104ac
push 0x443150
lea ecx, [esp + 0x5b0]
call fcn.004024f0
mov eax, dword [esp + 0x10]
or eax, 0x800000
push 0x24
lea edx, [esp + 0x5b0]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 4]
push edx
push eax
mov dword [esp + 0x880], 0x5e
call fcn.00402620
add esp, 0xc
cmp eax, 6
mov byte [esp + 0x16], 1
je 0x4104b0
mov byte [esp + 0x16], bl
mov eax, dword [esp + 0x10]
test eax, 0x800000
je 0x4104d0
and eax, 0xff7fffff
lea ecx, [esp + 0x5ac]
mov dword [esp + 0x10], eax
call fcn.00401ea0
mov eax, dword [esp + 0x10]
test eax, 0x400000
je 0x4104f0
and eax, 0xffbfffff
lea ecx, [esp + 0x734]
mov dword [esp + 0x10], eax
call fcn.00401ea0
test dword [esp + 0x10], 0x200000
mov dword [esp + 0x874], edi
je 0x41050d
lea ecx, [esp + 0x5e4]
call fcn.00401ea0
cmp byte [esp + 0x16], bl
je 0x410521
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.004089e0
jmp 0x41052d
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.0040d9a0
cmp dword [esp + 0xa4], ebx
je 0x4105a0
push 0x44314c
lea edx, [esp + 0x94]
push edx
lea eax, [esp + 0x7ac]
push eax
call fcn.00402570
lea ecx, [esp + 0xb8]
push ecx
push eax
lea edx, [esp + 0x780]
push edx
mov byte [esp + 0x88c], 0x5f
call fcn.00402450
add esp, 0x18
push ebp
push ebx
push ebx
mov ecx, eax
call fcn.00401cf0
push eax
push 0x44257c
push ebx
call dword [0x44be60]
lea ecx, [esp + 0x76c]
call fcn.00401ea0
lea ecx, [esp + 0x7a4]
call fcn.00401ea0
mov eax, dword [esi + 4]
push ebx
push ebp
push 0x464
push eax
call dword [fcn.0044bd60]
lea ecx, [esp + 0xc8]
mov byte [esp + 0x874], 0x49
call fcn.00422f50
lea ecx, [esp + 0xac]
call fcn.00401ea0
lea ecx, [esp + 0x90]
call fcn.00401ea0
mov ecx, dword [esp + 0x86c]
pop edi
pop esi
pop ebp
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x868
ret 4