; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 01A06977C4180BB7D09B3453CF6150D3 ; File Name : u:\work\01a06977c4180bb7d09b3453cf6150d3_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 400000 ; Section 1. (virtual address 00001000) ; Virtual size : 00110000 (1114112.) ; Section size in file : 00110000 (1114112.) ; Offset to raw data for section: 00001000 ; Flags E0000040: Data Executable Readable Writable ; Alignment : default .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute ___ segment para public 'CODE' use32 assume cs:___ ;org 401000h assume es:nothing, ss:nothing, ds:___, fs:nothing, gs:nothing db 5 dup(0CCh) ; --------------------------------------------------------------------------- jmp near ptr dword_42F630 ; --------------------------------------------------------------------------- jmp near ptr dword_412CB0 ; --------------------------------------------------------------------------- jmp near ptr dword_422050 ; --------------------------------------------------------------------------- jmp near ptr dword_431250 ; --------------------------------------------------------------------------- jmp near ptr dword_420DA0 ; --------------------------------------------------------------------------- jmp near ptr dword_411910 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401023 proc near ; CODE XREF: ___:0040B1BDp ; ___:0040B1CAp ... jmp sub_403C00 sub_401023 endp ; --------------------------------------------------------------------------- jmp loc_40B000 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40102D proc near ; CODE XREF: ___:0040449Dp ; ___:00405289p ... jmp sub_40A030 sub_40102D endp ; --------------------------------------------------------------------------- jmp near ptr dword_42A100 ; --------------------------------------------------------------------------- jmp near ptr dword_4155E0 ; --------------------------------------------------------------------------- jmp near ptr dword_432FE0 ; --------------------------------------------------------------------------- jmp near ptr dword_432E60 ; --------------------------------------------------------------------------- jmp near ptr dword_423940 ; --------------------------------------------------------------------------- jmp loc_40D130 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401050 proc near ; CODE XREF: ___:0040B03Ap ; ___:0040B08Ap jmp near ptr dword_432980 sub_401050 endp ; --------------------------------------------------------------------------- jmp near ptr dword_421C30 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40105A proc near ; CODE XREF: sub_40C0C0+8p jmp sub_40C280 sub_40105A endp ; --------------------------------------------------------------------------- jmp near ptr dword_4318C0 ; --------------------------------------------------------------------------- jmp near ptr dword_41C610 ; --------------------------------------------------------------------------- jmp near ptr dword_41FBD0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40106E proc near ; CODE XREF: sub_40BF60+32p jmp sub_40C120 sub_40106E endp ; --------------------------------------------------------------------------- jmp near ptr dword_418290 ; --------------------------------------------------------------------------- jmp near ptr dword_4161C0 ; --------------------------------------------------------------------------- jmp near ptr dword_421A50 ; --------------------------------------------------------------------------- jmp near ptr dword_41ACE0 ; [00000005 BYTES: COLLAPSED FUNCTION j_nullsub_3. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- jmp near ptr dword_422170 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401091 proc near ; CODE XREF: ___:0040C443p jmp sub_40CAD0 sub_401091 endp ; --------------------------------------------------------------------------- jmp near ptr dword_427FF0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40109B proc near ; CODE XREF: sub_407570+Ap jmp sub_407610 sub_40109B endp ; --------------------------------------------------------------------------- jmp near ptr dword_424500 ; --------------------------------------------------------------------------- jmp near ptr dword_432DF0 ; --------------------------------------------------------------------------- jmp near ptr dword_430990 ; --------------------------------------------------------------------------- jmp near ptr dword_429DC0 ; --------------------------------------------------------------------------- jmp near ptr dword_41E2C0 ; --------------------------------------------------------------------------- jmp near ptr dword_418A20 ; --------------------------------------------------------------------------- jmp near ptr dword_411860 ; --------------------------------------------------------------------------- jmp near ptr dword_430F00 ; --------------------------------------------------------------------------- jmp near ptr dword_4223C0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4010CD proc near ; CODE XREF: sub_40A9F0+58p ; sub_40A9F0+82p ... jmp sub_40ABE0 sub_4010CD endp ; --------------------------------------------------------------------------- jmp near ptr dword_419AE0 ; --------------------------------------------------------------------------- jmp near ptr dword_416640 ; --------------------------------------------------------------------------- jmp near ptr dword_4160C0 ; --------------------------------------------------------------------------- jmp near ptr dword_429AA0 ; --------------------------------------------------------------------------- jmp near ptr dword_421CB0 ; --------------------------------------------------------------------------- jmp near ptr dword_4224D0 ; --------------------------------------------------------------------------- jmp near ptr dword_413D60 ; --------------------------------------------------------------------------- jmp near ptr dword_421F10 ; --------------------------------------------------------------------------- jmp near ptr dword_414400 ; --------------------------------------------------------------------------- jmp near ptr dword_426F50 ; --------------------------------------------------------------------------- jmp near ptr dword_416470 ; --------------------------------------------------------------------------- jmp near ptr dword_433310 ; --------------------------------------------------------------------------- jmp near ptr dword_422150 ; --------------------------------------------------------------------------- jmp near ptr dword_417A60 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401118 proc near ; CODE XREF: ___:00404CDAp ; ___:00404E1Fp ... jmp near ptr dword_412970 sub_401118 endp ; --------------------------------------------------------------------------- jmp near ptr dword_4192C0 ; --------------------------------------------------------------------------- jmp near ptr dword_42F480 ; --------------------------------------------------------------------------- jmp near ptr dword_42E3D0 ; --------------------------------------------------------------------------- jmp near ptr dword_429A30 ; --------------------------------------------------------------------------- jmp near ptr dword_423760 ; --------------------------------------------------------------------------- jmp near ptr dword_431F50 ; --------------------------------------------------------------------------- jmp near ptr dword_415990 ; --------------------------------------------------------------------------- jmp loc_409EA0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401145 proc near ; CODE XREF: sub_409910+Ap jmp sub_409A00 sub_401145 endp ; --------------------------------------------------------------------------- jmp near ptr dword_415770 ; --------------------------------------------------------------------------- jmp near ptr dword_4235F0 ; --------------------------------------------------------------------------- jmp near ptr dword_415520 ; --------------------------------------------------------------------------- jmp near ptr dword_427630 ; --------------------------------------------------------------------------- jmp near ptr dword_4118E0 ; --------------------------------------------------------------------------- jmp near ptr dword_4165F0 ; --------------------------------------------------------------------------- jmp near ptr dword_41D730 ; --------------------------------------------------------------------------- jmp near ptr dword_418E60 ; --------------------------------------------------------------------------- jmp near ptr dword_418CE0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401177 proc near ; CODE XREF: sub_409600+6Ap ; sub_409600+103p jmp sub_4098A0 sub_401177 endp ; --------------------------------------------------------------------------- jmp near ptr dword_432840 ; --------------------------------------------------------------------------- jmp near ptr dword_413B70 ; --------------------------------------------------------------------------- jmp near ptr dword_41AFE0 ; --------------------------------------------------------------------------- jmp near ptr dword_415930 ; --------------------------------------------------------------------------- jmp near ptr dword_4338B0 ; --------------------------------------------------------------------------- jmp loc_40DB10 ; --------------------------------------------------------------------------- jmp near ptr dword_430A50 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40119F proc near ; CODE XREF: sub_4071E0+11p ; sub_407370+1Fp jmp sub_407410 sub_40119F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4011A4 proc near ; CODE XREF: ___:00403A85p ; ___:00403A95p ... jmp sub_403E00 sub_4011A4 endp ; --------------------------------------------------------------------------- jmp near ptr dword_422190 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4011AE proc near ; CODE XREF: sub_40C250+Ap jmp sub_40C310 sub_4011AE endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4011B3 proc near ; CODE XREF: ___:004036EDp ; ___:0040704Fp ... jmp sub_403C70 sub_4011B3 endp ; --------------------------------------------------------------------------- jmp near ptr dword_4153B0 ; --------------------------------------------------------------------------- jmp near ptr dword_42B380 ; --------------------------------------------------------------------------- jmp loc_40AF00 ; --------------------------------------------------------------------------- jmp near ptr dword_414C70 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4011CC proc near ; CODE XREF: sub_407610+7p ; sub_409A00+7p ... jmp sub_407640 sub_4011CC endp ; --------------------------------------------------------------------------- jmp near ptr dword_415600 ; --------------------------------------------------------------------------- jmp near ptr dword_420530 ; --------------------------------------------------------------------------- jmp near ptr dword_4137E0 ; --------------------------------------------------------------------------- jmp near ptr dword_42FD70 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4011E5 proc near ; CODE XREF: sub_4074C0+8p jmp sub_4075A0 sub_4011E5 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4011EA proc near ; CODE XREF: ___:00404D0Fp ; ___:00404EA0p ... jmp sub_40A430 sub_4011EA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4011EF proc near ; CODE XREF: sub_40A790+21p ; sub_40A9F0+A5p jmp sub_40A9D0 sub_4011EF endp ; --------------------------------------------------------------------------- jmp loc_40AF70 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4011F9 proc near ; CODE XREF: sub_40A430+129p ; sub_40A810+4p ... jmp sub_40A7E0 sub_4011F9 endp ; --------------------------------------------------------------------------- jmp near ptr dword_426650 ; --------------------------------------------------------------------------- jmp near ptr dword_42FA70 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401208 proc near ; CODE XREF: sub_4072F0+3p ; sub_407370+4Fp jmp sub_407480 sub_401208 endp ; --------------------------------------------------------------------------- jmp near ptr dword_421870 ; --------------------------------------------------------------------------- jmp near ptr dword_4220E0 ; --------------------------------------------------------------------------- jmp near ptr dword_42B520 ; --------------------------------------------------------------------------- jmp loc_407790 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401221 proc near ; CODE XREF: sub_40C120+5Fp jmp sub_40C2F0 sub_401221 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401226 proc near ; CODE XREF: sub_4034E0+F6p ; sub_4034E0+12Ep ... jmp sub_409C30 sub_401226 endp ; --------------------------------------------------------------------------- jmp near ptr dword_421A30 ; --------------------------------------------------------------------------- jmp near ptr dword_41F860 ; --------------------------------------------------------------------------- jmp near ptr dword_4176B0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40123A proc near ; CODE XREF: ___:0040AECFp jmp near ptr dword_42FF50 sub_40123A endp ; --------------------------------------------------------------------------- jmp near ptr dword_418D80 ; --------------------------------------------------------------------------- jmp near ptr dword_433570 ; --------------------------------------------------------------------------- jmp near ptr dword_416030 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40124E proc near ; CODE XREF: sub_40BCB0+29p ; sub_40BDD0+29p jmp sub_40BF60 sub_40124E endp ; --------------------------------------------------------------------------- jmp near ptr dword_421AF0 ; --------------------------------------------------------------------------- jmp near ptr dword_415210 ; --------------------------------------------------------------------------- jmp near ptr dword_416820 ; --------------------------------------------------------------------------- jmp near ptr dword_416FB0 ; --------------------------------------------------------------------------- jmp near ptr dword_418330 ; --------------------------------------------------------------------------- jmp near ptr dword_416C30 ; --------------------------------------------------------------------------- jmp near ptr dword_417FD0 ; --------------------------------------------------------------------------- jmp near ptr dword_414690 ; --------------------------------------------------------------------------- jmp near ptr dword_42F030 ; --------------------------------------------------------------------------- jmp near ptr dword_41B6E0 ; --------------------------------------------------------------------------- jmp near ptr dword_418180 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40128A proc near ; CODE XREF: sub_409490+8p jmp sub_4094E0 sub_40128A endp ; --------------------------------------------------------------------------- jmp near ptr dword_429A30 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401294 proc near ; CODE XREF: sub_409600+A5p jmp sub_409810 sub_401294 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401299 proc near ; CODE XREF: ___:00404FF5p jmp near ptr dword_41C030 sub_401299 endp ; --------------------------------------------------------------------------- jmp loc_4036D0 ; --------------------------------------------------------------------------- jmp near ptr dword_418FE0 ; --------------------------------------------------------------------------- jmp near ptr dword_424330 ; --------------------------------------------------------------------------- jmp near ptr dword_42F670 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4012B2 proc near ; CODE XREF: ___:00404481p ; ___:004054D0p ... jmp sub_40A290 sub_4012B2 endp ; --------------------------------------------------------------------------- jmp near ptr dword_431490 ; --------------------------------------------------------------------------- jmp near ptr dword_421C80 ; --------------------------------------------------------------------------- jmp near ptr dword_426CE0 ; --------------------------------------------------------------------------- jmp near ptr dword_4246D0 ; --------------------------------------------------------------------------- jmp near ptr dword_4167D0 ; --------------------------------------------------------------------------- jmp near ptr dword_431A80 ; --------------------------------------------------------------------------- jmp near ptr dword_42EB60 ; --------------------------------------------------------------------------- jmp near ptr dword_419BB0 ; --------------------------------------------------------------------------- jmp near ptr dword_41FEF0 ; --------------------------------------------------------------------------- jmp near ptr dword_430270 ; --------------------------------------------------------------------------- jmp near ptr dword_415160 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4012EE proc near ; CODE XREF: ___:004047DFp ; ___:00404852p ... jmp sub_409EF0 sub_4012EE endp ; --------------------------------------------------------------------------- jmp near ptr dword_424E20 ; --------------------------------------------------------------------------- jmp near ptr dword_424E90 ; --------------------------------------------------------------------------- jmp near ptr dword_418080 ; --------------------------------------------------------------------------- jmp near ptr dword_417F10 ; --------------------------------------------------------------------------- jmp near ptr dword_430460 ; --------------------------------------------------------------------------- jmp near ptr dword_426450 ; --------------------------------------------------------------------------- jmp near ptr dword_4189F0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401316 proc near ; CODE XREF: sub_40A0A0+7p jmp sub_40A0C0 sub_401316 endp ; --------------------------------------------------------------------------- jmp near ptr dword_431900 ; --------------------------------------------------------------------------- jmp near ptr dword_4314C0 ; --------------------------------------------------------------------------- jmp near ptr dword_421BD0 ; --------------------------------------------------------------------------- jmp near ptr dword_415030 ; --------------------------------------------------------------------------- jmp near ptr dword_415F30 ; --------------------------------------------------------------------------- jmp near ptr dword_435E00 ; --------------------------------------------------------------------------- jmp near ptr dword_415960 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40133E proc near ; CODE XREF: sub_40B520+62p ; ___:0040B9E8p ... jmp sub_40BE60 sub_40133E endp ; --------------------------------------------------------------------------- jmp near ptr dword_4300C0 ; --------------------------------------------------------------------------- jmp near ptr dword_42EC40 ; --------------------------------------------------------------------------- jmp near ptr dword_42B3A0 ; --------------------------------------------------------------------------- jmp near ptr dword_42B2E0 ; --------------------------------------------------------------------------- jmp near ptr dword_4166B0 ; --------------------------------------------------------------------------- jmp near ptr dword_415910 ; --------------------------------------------------------------------------- jmp near ptr dword_418AB0 ; --------------------------------------------------------------------------- jmp near ptr dword_426A60 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40136B proc near ; CODE XREF: sub_40B520+39p ; sub_40B520+78p ... jmp sub_40BE90 sub_40136B endp ; --------------------------------------------------------------------------- jmp near ptr dword_4256B0 ; --------------------------------------------------------------------------- jmp near ptr dword_41A540 ; --------------------------------------------------------------------------- jmp near ptr dword_429C30 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40137F proc near ; CODE XREF: ___:00408BD9p jmp near ptr dword_414230 sub_40137F endp ; --------------------------------------------------------------------------- jmp loc_406C30 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401389 proc near ; CODE XREF: sub_409D20+7p ; ___:00409E77p ... jmp sub_40A700 sub_401389 endp ; --------------------------------------------------------------------------- jmp near ptr dword_422A40 ; --------------------------------------------------------------------------- jmp near ptr dword_413AE0 ; --------------------------------------------------------------------------- jmp near ptr dword_42B350 ; --------------------------------------------------------------------------- jmp near ptr dword_418C50 ; --------------------------------------------------------------------------- jmp near ptr dword_42A810 ; --------------------------------------------------------------------------- jmp near ptr dword_42B4F0 ; --------------------------------------------------------------------------- jmp near ptr dword_42EBB0 ; --------------------------------------------------------------------------- jmp near ptr dword_414A60 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4013B6 proc near ; CODE XREF: sub_407290+1Fp jmp sub_407370 sub_4013B6 endp ; --------------------------------------------------------------------------- jmp near ptr dword_42E7B0 ; --------------------------------------------------------------------------- jmp near ptr dword_40FDA0 ; --------------------------------------------------------------------------- jmp near ptr dword_425230 ; --------------------------------------------------------------------------- jmp loc_40D2E0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4013CF proc near ; CODE XREF: sub_40A8C0+20p jmp sub_40A9F0 sub_4013CF endp ; --------------------------------------------------------------------------- jmp loc_40AEC0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4013D9 proc near ; CODE XREF: ___:0040555Fp ; ___:00405568p ... jmp sub_40A270 sub_4013D9 endp ; --------------------------------------------------------------------------- jmp near ptr dword_422540 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4013E3 proc near ; CODE XREF: ___:004046C7p jmp sub_40A160 sub_4013E3 endp ; --------------------------------------------------------------------------- jmp near ptr dword_419F50 ; --------------------------------------------------------------------------- jmp near ptr dword_421BA0 ; --------------------------------------------------------------------------- jmp near ptr dword_418FA0 ; --------------------------------------------------------------------------- jmp near ptr dword_416790 ; --------------------------------------------------------------------------- jmp near ptr dword_41B3D0 ; --------------------------------------------------------------------------- jmp near ptr dword_416280 ; --------------------------------------------------------------------------- jmp near ptr dword_4157A0 ; --------------------------------------------------------------------------- jmp near ptr dword_42F0B0 ; --------------------------------------------------------------------------- jmp near ptr dword_42CFC0 ; --------------------------------------------------------------------------- jmp near ptr dword_417E50 ; --------------------------------------------------------------------------- jmp near ptr dword_41B800 ; --------------------------------------------------------------------------- loc_40141F: ; DATA XREF: ___:0040AEC4o jmp loc_40AF90 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401424 proc near ; CODE XREF: sub_4034E0+61p ; sub_403C90+1Dp ... jmp sub_409AE0 sub_401424 endp ; --------------------------------------------------------------------------- jmp near ptr dword_435E40 ; --------------------------------------------------------------------------- jmp near ptr dword_418B10 ; --------------------------------------------------------------------------- jmp near ptr dword_433080 ; --------------------------------------------------------------------------- jmp near ptr dword_432B20 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40143D proc near ; CODE XREF: ___:00406BD3p jmp sub_406C00 sub_40143D endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401442 proc near ; CODE XREF: ___:004049B0p ; ___:loc_4049E5p ... jmp sub_404BE0 sub_401442 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401447 proc near ; CODE XREF: ___:00404EDBp jmp sub_40E7A0 sub_401447 endp ; --------------------------------------------------------------------------- jmp near ptr dword_416440 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401451 proc near ; CODE XREF: sub_40B520+1Dp ; ___:0040B94Dp ... jmp sub_40BD20 sub_401451 endp ; --------------------------------------------------------------------------- jmp loc_40B5F0 ; --------------------------------------------------------------------------- jmp near ptr dword_421B60 ; [00000005 BYTES: COLLAPSED FUNCTION j_nullsub_2. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- jmp near ptr dword_415BE0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40146A proc near ; CODE XREF: ___:00408A2Dp ; ___:00408A56p ... jmp sub_409450 sub_40146A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40146F proc near ; CODE XREF: ___:00404670p ; ___:0040478Bp ... jmp sub_40A6C0 sub_40146F endp ; --------------------------------------------------------------------------- jmp near ptr dword_419790 ; --------------------------------------------------------------------------- jmp near ptr dword_41BC90 ; --------------------------------------------------------------------------- jmp near ptr dword_4151D0 ; --------------------------------------------------------------------------- jmp near ptr dword_425870 ; --------------------------------------------------------------------------- jmp near ptr dword_41A5B0 ; --------------------------------------------------------------------------- jmp near ptr dword_431100 ; --------------------------------------------------------------------------- jmp near ptr dword_42E8E0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401497 proc near ; CODE XREF: sub_40ED70+EAp jmp sub_40EC30 sub_401497 endp ; --------------------------------------------------------------------------- jmp loc_40A6E0 ; --------------------------------------------------------------------------- jmp near ptr dword_40F140 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4014A6 proc near ; CODE XREF: sub_40BD20+16p ; sub_40BD60+Bp ... jmp sub_40C0C0 sub_4014A6 endp ; --------------------------------------------------------------------------- jmp near ptr dword_42B240 ; --------------------------------------------------------------------------- jmp near ptr dword_41D5D0 ; --------------------------------------------------------------------------- jmp near ptr dword_4156C0 ; --------------------------------------------------------------------------- jmp loc_40AE80 ; --------------------------------------------------------------------------- jmp near ptr dword_414D40 ; --------------------------------------------------------------------------- jmp near ptr dword_426560 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4014C9 proc near ; CODE XREF: sub_4034E0+115p ; ___:004047F8p ... jmp sub_409B80 sub_4014C9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4014CE proc near ; CODE XREF: sub_40AC70+7p jmp sub_40AD60 sub_4014CE endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4014D3 proc near ; CODE XREF: sub_404B10+9p ; ___:00404CB5p ... jmp sub_40A740 sub_4014D3 endp ; --------------------------------------------------------------------------- jmp near ptr dword_421960 ; --------------------------------------------------------------------------- jmp near ptr dword_41A500 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4014E2 proc near ; CODE XREF: sub_4070B0+24p jmp sub_407290 sub_4014E2 endp ; --------------------------------------------------------------------------- jmp near ptr dword_42B1D0 ; --------------------------------------------------------------------------- jmp near ptr dword_427600 ; --------------------------------------------------------------------------- jmp near ptr dword_417540 ; --------------------------------------------------------------------------- jmp near ptr dword_416510 ; --------------------------------------------------------------------------- jmp near ptr dword_424760 ; --------------------------------------------------------------------------- jmp loc_409F90 ; --------------------------------------------------------------------------- jmp near ptr dword_4199B0 ; --------------------------------------------------------------------------- jmp near ptr dword_432C30 ; --------------------------------------------------------------------------- jmp near ptr dword_42EC00 ; --------------------------------------------------------------------------- jmp near ptr dword_42EB10 ; --------------------------------------------------------------------------- jmp near ptr dword_4223A0 ; --------------------------------------------------------------------------- jmp near ptr dword_419930 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401523 proc near ; CODE XREF: ___:0040CD91p ; sub_40CF60+143p jmp near ptr dword_419970 sub_401523 endp ; --------------------------------------------------------------------------- jmp near ptr dword_418D00 ; --------------------------------------------------------------------------- jmp near ptr dword_42B540 ; --------------------------------------------------------------------------- jmp near ptr dword_432580 ; --------------------------------------------------------------------------- jmp near ptr dword_414210 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40153C proc near ; CODE XREF: sub_40B520+Bp ; ___:0040B939p jmp sub_40BE20 sub_40153C endp ; --------------------------------------------------------------------------- jmp near ptr dword_42F6B0 ; --------------------------------------------------------------------------- jmp near ptr dword_422350 ; --------------------------------------------------------------------------- jmp near ptr dword_432B60 ; --------------------------------------------------------------------------- jmp near ptr dword_418BC0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401555 proc near ; CODE XREF: ___:0040B1B0p jmp sub_40BCB0 sub_401555 endp ; --------------------------------------------------------------------------- jmp near ptr dword_4303B0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40155F proc near ; CODE XREF: sub_40BFF0+4p jmp sub_40C200 sub_40155F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401564 proc near ; CODE XREF: ___:0040706Cp jmp sub_4071E0 sub_401564 endp ; --------------------------------------------------------------------------- jmp near ptr dword_41BC20 ; --------------------------------------------------------------------------- jmp near ptr dword_415D70 ; --------------------------------------------------------------------------- jmp near ptr dword_418230 ; --------------------------------------------------------------------------- jmp near ptr dword_4150F0 ; --------------------------------------------------------------------------- jmp near ptr dword_417BC0 ; --------------------------------------------------------------------------- jmp near ptr dword_412870 ; --------------------------------------------------------------------------- jmp near ptr dword_4310D0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40158C proc near ; CODE XREF: sub_40A430+16Fp jmp sub_40A790 sub_40158C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401591 proc near ; CODE XREF: ___:00404011p ; ___:00404064p ... jmp sub_4070B0 sub_401591 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401596 proc near ; CODE XREF: ___:00408A4Ap ; ___:00408A73p ... jmp sub_40B680 sub_401596 endp ; --------------------------------------------------------------------------- jmp near ptr dword_431F90 ; --------------------------------------------------------------------------- jmp near ptr dword_41A180 ; --------------------------------------------------------------------------- jmp near ptr dword_416610 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4015AA proc near ; CODE XREF: sub_409850+1Ap ; sub_4098A0+1Ap jmp sub_409910 sub_4015AA endp ; --------------------------------------------------------------------------- jmp near ptr dword_428040 ; --------------------------------------------------------------------------- jmp near ptr dword_4328F0 ; --------------------------------------------------------------------------- jmp near ptr dword_419200 ; --------------------------------------------------------------------------- jmp near ptr dword_4324C0 ; --------------------------------------------------------------------------- jmp near ptr dword_41D760 ; --------------------------------------------------------------------------- jmp near ptr dword_432200 ; --------------------------------------------------------------------------- jmp near ptr dword_415DA0 ; --------------------------------------------------------------------------- jmp near ptr dword_418CC0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4015D7 proc near ; CODE XREF: ___:004055C3p ; ___:00406E5Cp ... jmp sub_409C80 sub_4015D7 endp ; --------------------------------------------------------------------------- jmp loc_406BA0 ; --------------------------------------------------------------------------- jmp near ptr dword_424350 ; --------------------------------------------------------------------------- jmp near ptr dword_416660 ; --------------------------------------------------------------------------- jmp near ptr dword_420CD0 ; --------------------------------------------------------------------------- jmp near ptr dword_42B830 ; --------------------------------------------------------------------------- jmp near ptr dword_428020 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4015FA proc near ; CODE XREF: ___:00405B04p ; ___:00405C57p ... jmp near ptr dword_41FF90 sub_4015FA endp ; --------------------------------------------------------------------------- jmp near ptr dword_433670 ; --------------------------------------------------------------------------- jmp near ptr dword_42FF30 ; --------------------------------------------------------------------------- jmp near ptr dword_425980 ; --------------------------------------------------------------------------- jmp near ptr dword_4167B0 ; --------------------------------------------------------------------------- jmp near ptr dword_41E660 ; --------------------------------------------------------------------------- jmp near ptr dword_41AAA0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40161D proc near ; CODE XREF: ___:loc_40AEA0p jmp near ptr dword_431300 sub_40161D endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401622 proc near ; CODE XREF: sub_4070F0+1Ap jmp sub_407220 sub_401622 endp ; --------------------------------------------------------------------------- jmp near ptr dword_416C90 ; --------------------------------------------------------------------------- jmp near ptr dword_42F070 ; --------------------------------------------------------------------------- jmp near ptr dword_4225E0 ; --------------------------------------------------------------------------- jmp near ptr dword_41B060 ; --------------------------------------------------------------------------- jmp near ptr dword_431560 ; --------------------------------------------------------------------------- jmp near ptr dword_430520 ; --------------------------------------------------------------------------- jmp near ptr dword_417C60 ; --------------------------------------------------------------------------- jmp near ptr dword_4301F0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40164F proc near ; CODE XREF: sub_40A850+8p jmp sub_40A8A0 sub_40164F endp ; --------------------------------------------------------------------------- jmp near ptr dword_4130E0 ; --------------------------------------------------------------------------- jmp near ptr dword_42F4F0 ; --------------------------------------------------------------------------- jmp near ptr dword_42B7C0 ; --------------------------------------------------------------------------- jmp near ptr dword_42B480 ; --------------------------------------------------------------------------- jmp loc_406850 ; --------------------------------------------------------------------------- jmp near ptr dword_42E350 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401672 proc near ; CODE XREF: sub_407370+5Ap jmp sub_407570 sub_401672 endp ; --------------------------------------------------------------------------- jmp near ptr dword_422790 ; --------------------------------------------------------------------------- jmp near ptr dword_41B4B0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401681 proc near ; CODE XREF: sub_4034E0+BBp ; ___:00405BAAp ... jmp sub_4036B0 sub_401681 endp ; --------------------------------------------------------------------------- jmp near ptr dword_432D80 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40168B proc near ; CODE XREF: sub_409490+10p jmp sub_409530 sub_40168B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401690 proc near ; CODE XREF: sub_40A430+4Ap jmp sub_40A760 sub_401690 endp ; --------------------------------------------------------------------------- jmp near ptr dword_40F600 ; --------------------------------------------------------------------------- jmp near ptr dword_4320E0 ; --------------------------------------------------------------------------- jmp near ptr dword_42E650 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4016A4 proc near ; CODE XREF: sub_40BEC0+9p ; sub_40C120+18p jmp sub_40C2A0 sub_4016A4 endp ; --------------------------------------------------------------------------- jmp near ptr dword_42E880 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4016AE proc near ; CODE XREF: sub_4034E0+CCp ; ___:0040472Dp ... jmp sub_40A630 sub_4016AE endp ; --------------------------------------------------------------------------- jmp near ptr dword_417E20 ; --------------------------------------------------------------------------- jmp near ptr dword_4244C0 ; --------------------------------------------------------------------------- jmp loc_409E70 ; --------------------------------------------------------------------------- jmp near ptr dword_42E130 ; --------------------------------------------------------------------------- jmp near ptr dword_42E8B0 ; --------------------------------------------------------------------------- jmp near ptr dword_4159D0 ; --------------------------------------------------------------------------- jmp near ptr dword_426620 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4016D6 proc near ; CODE XREF: sub_409600+58p ; sub_409600+82p ... jmp sub_409850 sub_4016D6 endp ; --------------------------------------------------------------------------- jmp near ptr dword_426F20 ; --------------------------------------------------------------------------- jmp near ptr dword_421AB0 ; --------------------------------------------------------------------------- jmp near ptr dword_41AE50 ; --------------------------------------------------------------------------- jmp near ptr dword_4118E0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4016EF proc near ; CODE XREF: sub_40A850+10p jmp sub_40A8C0 sub_4016EF endp ; --------------------------------------------------------------------------- jmp near ptr dword_4351E0 ; --------------------------------------------------------------------------- jmp near ptr dword_418AE0 ; --------------------------------------------------------------------------- jmp near ptr dword_4149A0 ; --------------------------------------------------------------------------- jmp near ptr dword_421A10 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401708 proc near ; CODE XREF: ___:loc_40AE80p jmp near ptr dword_431280 sub_401708 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40170D proc near ; CODE XREF: sub_409600+91p jmp sub_4097D0 sub_40170D endp ; --------------------------------------------------------------------------- jmp loc_40C400 ; --------------------------------------------------------------------------- jmp loc_40ADE0 ; --------------------------------------------------------------------------- jmp near ptr dword_415070 ; --------------------------------------------------------------------------- jmp near ptr dword_412B90 ; --------------------------------------------------------------------------- jmp loc_40E220 ; --------------------------------------------------------------------------- jmp near ptr dword_415AA0 ; --------------------------------------------------------------------------- jmp near ptr dword_4277C0 ; --------------------------------------------------------------------------- jmp near ptr dword_425410 ; --------------------------------------------------------------------------- jmp near ptr dword_41AEF0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40173F proc near ; CODE XREF: sub_4070F0+48p ; sub_4070F0:loc_407175p jmp sub_4072F0 sub_40173F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401744 proc near ; CODE XREF: sub_40AE10+2Cp jmp sub_40AF40 sub_401744 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401749 proc near ; CODE XREF: ___:00403975p ; ___:00403985p ... jmp sub_403D90 sub_401749 endp ; --------------------------------------------------------------------------- jmp near ptr dword_42A400 ; --------------------------------------------------------------------------- jmp near ptr dword_416530 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401758 proc near ; CODE XREF: sub_40AF40+10p jmp near ptr dword_430180 sub_401758 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40175D proc near ; CODE XREF: ___:0040AF14p jmp near ptr dword_4335B0 sub_40175D endp ; --------------------------------------------------------------------------- jmp near ptr dword_419010 ; --------------------------------------------------------------------------- jmp near ptr dword_418490 ; --------------------------------------------------------------------------- jmp near ptr dword_416CC0 ; --------------------------------------------------------------------------- jmp near ptr dword_420DC0 ; --------------------------------------------------------------------------- jmp near ptr dword_417D30 ; --------------------------------------------------------------------------- jmp near ptr dword_430FE0 ; --------------------------------------------------------------------------- jmp near ptr dword_42E2A0 ; --------------------------------------------------------------------------- jmp near ptr dword_427590 ; --------------------------------------------------------------------------- jmp near ptr dword_425270 ; --------------------------------------------------------------------------- jmp near ptr dword_418260 ; --------------------------------------------------------------------------- jmp near ptr dword_431F10 ; --------------------------------------------------------------------------- jmp near ptr dword_42EEB0 ; --------------------------------------------------------------------------- jmp near ptr dword_427EF0 ; --------------------------------------------------------------------------- jmp near ptr dword_416C60 ; --------------------------------------------------------------------------- jmp near ptr dword_42A100 ; --------------------------------------------------------------------------- jmp near ptr dword_431730 ; --------------------------------------------------------------------------- loc_4017B2: ; CODE XREF: ___:0040AE85j jmp near ptr dword_431380 ; --------------------------------------------------------------------------- jmp near ptr dword_430130 ; --------------------------------------------------------------------------- jmp near ptr dword_4254B0 ; --------------------------------------------------------------------------- loc_4017C1: ; CODE XREF: ___:0040AEA5j jmp near ptr dword_4313A0 ; --------------------------------------------------------------------------- jmp loc_404C70 ; --------------------------------------------------------------------------- jmp near ptr dword_424790 ; --------------------------------------------------------------------------- jmp near ptr dword_417960 ; --------------------------------------------------------------------------- jmp near ptr dword_4166F0 ; --------------------------------------------------------------------------- jmp near ptr dword_4163A0 ; --------------------------------------------------------------------------- jmp near ptr dword_415E70 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4017E4 proc near ; CODE XREF: sub_4034E0+DBp ; ___:00403FFFp ... jmp sub_40A720 sub_4017E4 endp ; --------------------------------------------------------------------------- jmp near ptr dword_422370 ; --------------------------------------------------------------------------- jmp loc_40B210 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4017F3 proc near ; CODE XREF: sub_406890+205p jmp near ptr dword_41B820 sub_4017F3 endp ; --------------------------------------------------------------------------- jmp near ptr dword_419070 ; --------------------------------------------------------------------------- jmp near ptr dword_426A40 ; --------------------------------------------------------------------------- jmp near ptr dword_421A80 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401807 proc near ; CODE XREF: ___:0040A117p ; ___:0040D87Dp jmp sub_40A130 sub_401807 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40180C proc near ; CODE XREF: sub_40B430+76p jmp sub_40B390 sub_40180C endp ; --------------------------------------------------------------------------- jmp near ptr dword_425020 ; --------------------------------------------------------------------------- jmp near ptr dword_4218F0 ; --------------------------------------------------------------------------- jmp near ptr dword_426F20 ; --------------------------------------------------------------------------- jmp near ptr dword_417DF0 ; --------------------------------------------------------------------------- jmp near ptr dword_42EC20 ; --------------------------------------------------------------------------- jmp near ptr dword_421C50 ; --------------------------------------------------------------------------- jmp near ptr dword_426960 ; --------------------------------------------------------------------------- jmp near ptr dword_4243A0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401839 proc near ; CODE XREF: sub_40BE40+3p ; sub_40BEC0+4Fp ... jmp sub_40C080 sub_401839 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40183E proc near ; CODE XREF: sub_4070F0+36p ; sub_4070F0+72p jmp sub_407340 sub_40183E endp ; --------------------------------------------------------------------------- jmp near ptr dword_415680 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401848 proc near ; CODE XREF: ___:0040B9D1p ; ___:0040BA98p ... jmp near ptr dword_412AA0 sub_401848 endp ; --------------------------------------------------------------------------- jmp near ptr dword_431B30 ; --------------------------------------------------------------------------- jmp near ptr dword_431BA0 ; --------------------------------------------------------------------------- jmp near ptr dword_416740 ; --------------------------------------------------------------------------- jmp loc_404C20 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401861 proc near ; CODE XREF: sub_4034E0+7Ap ; sub_4034E0+9Ep ... jmp sub_409B40 sub_401861 endp ; --------------------------------------------------------------------------- jmp near ptr dword_4207A0 ; --------------------------------------------------------------------------- jmp near ptr dword_41B040 ; --------------------------------------------------------------------------- jmp near ptr dword_429D70 ; --------------------------------------------------------------------------- jmp near ptr dword_41C0E0 ; --------------------------------------------------------------------------- jmp near ptr dword_416D10 ; --------------------------------------------------------------------------- jmp near ptr dword_41FD50 ; --------------------------------------------------------------------------- jmp near ptr dword_428160 ; --------------------------------------------------------------------------- jmp near ptr dword_427DC0 ; --------------------------------------------------------------------------- jmp near ptr dword_42A150 ; --------------------------------------------------------------------------- jmp near ptr dword_41AD30 ; --------------------------------------------------------------------------- jmp near ptr dword_432ED0 ; --------------------------------------------------------------------------- jmp near ptr dword_413DA0 ; --------------------------------------------------------------------------- jmp loc_40A110 ; --------------------------------------------------------------------------- jmp near ptr dword_4203D0 ; --------------------------------------------------------------------------- jmp near ptr dword_431D10 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4018B1 proc near ; CODE XREF: sub_40A910+14p jmp sub_40ABC0 sub_4018B1 endp ; --------------------------------------------------------------------------- jmp near ptr dword_415620 ; --------------------------------------------------------------------------- jmp near ptr dword_41AF60 ; --------------------------------------------------------------------------- jmp near ptr dword_430A90 ; --------------------------------------------------------------------------- jmp near ptr dword_419030 ; --------------------------------------------------------------------------- jmp near ptr dword_4178F0 ; --------------------------------------------------------------------------- jmp near ptr dword_419DD0 ; --------------------------------------------------------------------------- jmp near ptr dword_41A0E0 ; --------------------------------------------------------------------------- jmp near ptr dword_4218B0 ; --------------------------------------------------------------------------- jmp near ptr dword_4299C0 ; --------------------------------------------------------------------------- jmp near ptr dword_422520 ; --------------------------------------------------------------------------- jmp near ptr dword_422590 ; --------------------------------------------------------------------------- jmp near ptr dword_422570 ; --------------------------------------------------------------------------- jmp near ptr dword_415730 ; --------------------------------------------------------------------------- jmp near ptr dword_430A10 ; --------------------------------------------------------------------------- jmp near ptr dword_421D50 ; --------------------------------------------------------------------------- jmp near ptr dword_421E80 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401906 proc near ; CODE XREF: sub_40B390+6Dp jmp sub_40BD90 sub_401906 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40190B proc near ; CODE XREF: sub_409450+13p jmp loc_409580 sub_40190B endp ; --------------------------------------------------------------------------- jmp near ptr dword_4365C0 ; --------------------------------------------------------------------------- jmp near ptr dword_41B010 ; --------------------------------------------------------------------------- jmp near ptr dword_416CE0 ; --------------------------------------------------------------------------- jmp near ptr dword_4139B0 ; --------------------------------------------------------------------------- jmp near ptr dword_4154D0 ; --------------------------------------------------------------------------- jmp near ptr dword_417020 ; --------------------------------------------------------------------------- jmp near ptr dword_4310A0 ; --------------------------------------------------------------------------- jmp near ptr dword_4334F0 ; --------------------------------------------------------------------------- jmp near ptr dword_420E10 ; --------------------------------------------------------------------------- jmp loc_40A400 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401942 proc near ; CODE XREF: ___:00404EF3p ; sub_40ED70+D2p jmp loc_40EF90 sub_401942 endp ; --------------------------------------------------------------------------- jmp near ptr dword_421ED0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40194C proc near ; CODE XREF: ___:00405867p jmp sub_4066E0 sub_40194C endp ; --------------------------------------------------------------------------- jmp near ptr dword_432360 ; --------------------------------------------------------------------------- jmp near ptr dword_41FB30 ; --------------------------------------------------------------------------- jmp near ptr dword_41A290 ; --------------------------------------------------------------------------- jmp near ptr dword_41A890 ; --------------------------------------------------------------------------- jmp near ptr dword_419220 ; --------------------------------------------------------------------------- jmp near ptr dword_411A50 ; --------------------------------------------------------------------------- jmp near ptr dword_4219A0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401974 proc near ; CODE XREF: sub_409450+4p ; sub_409600+1Fp ... jmp sub_409500 sub_401974 endp ; --------------------------------------------------------------------------- jmp loc_409A30 ; --------------------------------------------------------------------------- jmp near ptr dword_41FE50 ; --------------------------------------------------------------------------- jmp near ptr dword_415420 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401988 proc near ; CODE XREF: sub_40A430+A8p jmp sub_40A850 sub_401988 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40198D proc near ; CODE XREF: ___:0040CBF1p jmp sub_40CE60 sub_40198D endp ; --------------------------------------------------------------------------- jmp near ptr dword_433160 ; --------------------------------------------------------------------------- jmp near ptr dword_421DF0 ; --------------------------------------------------------------------------- jmp near ptr dword_42ECF0 ; --------------------------------------------------------------------------- jmp near ptr dword_42ECC0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4019A6 proc near ; CODE XREF: sub_40A790+Dp ; sub_40A9F0+91p jmp sub_40A910 sub_4019A6 endp ; --------------------------------------------------------------------------- jmp near ptr dword_4225B0 ; --------------------------------------------------------------------------- jmp near ptr dword_41AB20 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4019B5 proc near ; CODE XREF: ___:00403FECp ; ___:0040403Fp ... jmp sub_4034E0 sub_4019B5 endp ; --------------------------------------------------------------------------- jmp near ptr dword_4227C0 ; --------------------------------------------------------------------------- jmp near ptr dword_416C30 ; --------------------------------------------------------------------------- jmp near ptr dword_40FD70 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4019C9 proc near ; CODE XREF: sub_407410+4p jmp sub_407540 sub_4019C9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4019CE proc near ; CODE XREF: ___:0040B629p ; ___:0040BA46p ... jmp sub_40B520 sub_4019CE endp ; --------------------------------------------------------------------------- jmp near ptr dword_411B10 ; --------------------------------------------------------------------------- jmp near ptr dword_432940 ; --------------------------------------------------------------------------- jmp near ptr dword_414640 ; --------------------------------------------------------------------------- jmp near ptr dword_42B880 ; --------------------------------------------------------------------------- jmp near ptr dword_41D730 ; --------------------------------------------------------------------------- jmp near ptr dword_421F30 ; --------------------------------------------------------------------------- jmp loc_40B0B0 ; --------------------------------------------------------------------------- jmp near ptr dword_4132E0 ; --------------------------------------------------------------------------- jmp near ptr dword_4200F0 ; --------------------------------------------------------------------------- jmp near ptr dword_421850 ; --------------------------------------------------------------------------- jmp near ptr dword_427650 ; --------------------------------------------------------------------------- jmp near ptr dword_411B40 ; --------------------------------------------------------------------------- jmp near ptr dword_430940 ; --------------------------------------------------------------------------- jmp near ptr dword_427FC0 ; --------------------------------------------------------------------------- jmp near ptr dword_426A10 ; --------------------------------------------------------------------------- jmp near ptr dword_422240 ; --------------------------------------------------------------------------- jmp near ptr dword_416C00 ; --------------------------------------------------------------------------- jmp near ptr dword_420D00 ; --------------------------------------------------------------------------- jmp near ptr dword_422620 ; --------------------------------------------------------------------------- jmp loc_404640 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401A37 proc near ; CODE XREF: sub_409450+1Ap ; sub_409530+4p ... jmp sub_4094C0 sub_401A37 endp ; --------------------------------------------------------------------------- jmp near ptr dword_40FD70 ; --------------------------------------------------------------------------- jmp near ptr dword_4266A0 ; --------------------------------------------------------------------------- jmp loc_409D50 ; --------------------------------------------------------------------------- jmp near ptr dword_416550 ; --------------------------------------------------------------------------- jmp near ptr dword_430340 ; --------------------------------------------------------------------------- jmp near ptr dword_433900 ; --------------------------------------------------------------------------- jmp near ptr dword_4149D0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401A5F proc near ; CODE XREF: ___:004081D0p ; ___:00408661p jmp sub_409490 sub_401A5F endp ; --------------------------------------------------------------------------- jmp near ptr dword_4263D0 ; --------------------------------------------------------------------------- jmp near ptr dword_42C810 ; --------------------------------------------------------------------------- jmp near ptr dword_4207C0 ; --------------------------------------------------------------------------- jmp near ptr dword_42EFF0 ; --------------------------------------------------------------------------- jmp near ptr dword_422750 ; --------------------------------------------------------------------------- jmp near ptr dword_418100 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401A82 proc near ; CODE XREF: sub_407220+5p ; sub_407310+6p ... jmp sub_407460 sub_401A82 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401A87 proc near ; CODE XREF: sub_4034E0+90p ; ___:0040507Fp ... jmp sub_40A6A0 sub_401A87 endp ; --------------------------------------------------------------------------- jmp near ptr dword_41FD90 ; --------------------------------------------------------------------------- jmp near ptr dword_42F840 ; --------------------------------------------------------------------------- jmp near ptr dword_415DD0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401A9B proc near ; CODE XREF: sub_4034E0+E5p ; ___:00409E7Fp ... jmp sub_409DA0 sub_401A9B endp ; --------------------------------------------------------------------------- jmp near ptr dword_433710 ; --------------------------------------------------------------------------- jmp near ptr dword_433480 ; --------------------------------------------------------------------------- jmp near ptr dword_4226C0 ; --------------------------------------------------------------------------- jmp near ptr dword_426A10 ; --------------------------------------------------------------------------- jmp near ptr dword_424D40 ; --------------------------------------------------------------------------- jmp near ptr dword_411FE0 ; --------------------------------------------------------------------------- jmp near ptr dword_41FA90 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401AC3 proc near ; CODE XREF: sub_4070F0+Bp jmp sub_4072D0 sub_401AC3 endp ; --------------------------------------------------------------------------- jmp near ptr dword_432BA0 ; --------------------------------------------------------------------------- jmp loc_40B8D0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401AD2 proc near ; CODE XREF: ___:00403F0Bp ; ___:00403F1Bp ... jmp sub_403D10 sub_401AD2 endp ; --------------------------------------------------------------------------- jmp near ptr dword_415650 ; --------------------------------------------------------------------------- jmp near ptr dword_41B780 ; --------------------------------------------------------------------------- jmp near ptr dword_4227F0 ; --------------------------------------------------------------------------- jmp loc_40B170 ; --------------------------------------------------------------------------- jmp near ptr dword_4215D0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401AF0 proc near ; CODE XREF: sub_404BE0+15p jmp sub_4070F0 sub_401AF0 endp ; --------------------------------------------------------------------------- jmp near ptr dword_41A0E0 ; --------------------------------------------------------------------------- jmp near ptr dword_418900 ; --------------------------------------------------------------------------- jmp loc_40CAF0 ; --------------------------------------------------------------------------- jmp near ptr dword_429D70 ; --------------------------------------------------------------------------- jmp near ptr dword_418890 ; --------------------------------------------------------------------------- jmp near ptr dword_431A20 ; --------------------------------------------------------------------------- jmp near ptr dword_4303D0 ; --------------------------------------------------------------------------- jmp loc_40AEA0 ; --------------------------------------------------------------------------- jmp near ptr dword_418F50 ; --------------------------------------------------------------------------- jmp near ptr dword_42B4F0 ; --------------------------------------------------------------------------- jmp near ptr dword_4179D0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401B2C proc near ; CODE XREF: ___:00408706p ; ___:00408727p ... jmp sub_407660 sub_401B2C endp ; --------------------------------------------------------------------------- jmp near ptr dword_414AF0 ; --------------------------------------------------------------------------- jmp near ptr dword_41D540 ; --------------------------------------------------------------------------- jmp near ptr dword_41A8C0 ; --------------------------------------------------------------------------- jmp near ptr dword_421C10 ; --------------------------------------------------------------------------- jmp near ptr dword_414CA0 ; --------------------------------------------------------------------------- jmp near ptr dword_432CA0 ; --------------------------------------------------------------------------- jmp near ptr dword_42F540 ; --------------------------------------------------------------------------- jmp near ptr dword_412BC0 ; --------------------------------------------------------------------------- jmp loc_40D580 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401B5E proc near ; CODE XREF: sub_407660+3Bp ; sub_4076F0+43p jmp sub_40B430 sub_401B5E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401B63 proc near ; CODE XREF: sub_4072D0+3p jmp sub_4074A0 sub_401B63 endp ; --------------------------------------------------------------------------- jmp near ptr dword_4245F0 ; --------------------------------------------------------------------------- jmp near ptr dword_425BD0 ; --------------------------------------------------------------------------- jmp loc_409F60 ; --------------------------------------------------------------------------- jmp near ptr dword_4254E0 ; --------------------------------------------------------------------------- jmp near ptr dword_422410 ; --------------------------------------------------------------------------- jmp near ptr dword_41A6D0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401B86 proc near ; CODE XREF: sub_40BF60+23p ; sub_40C120+11p jmp sub_40C2C0 sub_401B86 endp ; --------------------------------------------------------------------------- jmp near ptr dword_42B860 ; --------------------------------------------------------------------------- jmp near ptr dword_41E140 ; --------------------------------------------------------------------------- jmp near ptr dword_431650 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401B9A proc near ; CODE XREF: sub_409530+20p jmp sub_409600 sub_401B9A endp ; --------------------------------------------------------------------------- jmp near ptr dword_423700 ; --------------------------------------------------------------------------- jmp loc_40CBB0 ; --------------------------------------------------------------------------- jmp near ptr dword_4309D0 ; --------------------------------------------------------------------------- jmp near ptr dword_421FB0 ; --------------------------------------------------------------------------- jmp near ptr dword_4270E0 ; --------------------------------------------------------------------------- jmp near ptr dword_416380 ; --------------------------------------------------------------------------- jmp near ptr dword_4304D0 ; --------------------------------------------------------------------------- jmp near ptr dword_430C00 ; --------------------------------------------------------------------------- jmp near ptr dword_4269A0 ; --------------------------------------------------------------------------- jmp near ptr dword_41B400 ; --------------------------------------------------------------------------- jmp near ptr dword_428250 ; --------------------------------------------------------------------------- jmp near ptr dword_4258E0 ; --------------------------------------------------------------------------- jmp near ptr dword_42DFD0 ; --------------------------------------------------------------------------- jmp near ptr dword_414360 ; --------------------------------------------------------------------------- jmp loc_40C360 ; --------------------------------------------------------------------------- jmp near ptr dword_424840 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401BEF proc near ; CODE XREF: ___:0040B11Ep ; ___:0040B1A4p ... jmp sub_40BDD0 sub_401BEF endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401BF4 proc near ; CODE XREF: ___:0040B10Cp jmp sub_40BC70 sub_401BF4 endp ; --------------------------------------------------------------------------- jmp near ptr dword_4327C0 ; --------------------------------------------------------------------------- jmp near ptr dword_431120 ; --------------------------------------------------------------------------- jmp near ptr dword_430690 ; --------------------------------------------------------------------------- jmp near ptr dword_42ED30 ; --------------------------------------------------------------------------- jmp near ptr dword_4347B0 ; --------------------------------------------------------------------------- jmp near ptr dword_433940 ; --------------------------------------------------------------------------- jmp near ptr dword_42B060 ; --------------------------------------------------------------------------- jmp near ptr dword_42A5F0 ; --------------------------------------------------------------------------- jmp near ptr dword_41B620 ; --------------------------------------------------------------------------- jmp near ptr dword_431AC0 ; --------------------------------------------------------------------------- jmp near ptr dword_427FF0 ; --------------------------------------------------------------------------- jmp near ptr dword_41FC80 ; --------------------------------------------------------------------------- jmp near ptr dword_41A010 ; --------------------------------------------------------------------------- jmp near ptr dword_42A130 ; --------------------------------------------------------------------------- jmp near ptr dword_41AD80 ; --------------------------------------------------------------------------- jmp near ptr dword_416990 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401C49 proc near ; CODE XREF: sub_40BD90+1Fp jmp sub_40BEC0 sub_401C49 endp ; --------------------------------------------------------------------------- jmp near ptr dword_4165D0 ; --------------------------------------------------------------------------- jmp near ptr dword_418F70 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401C58 proc near ; CODE XREF: sub_407370+11p ; sub_407370+27p ... jmp sub_407520 sub_401C58 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401C5D proc near ; CODE XREF: ___:00404D81p ; ___:00405B3Dp ... jmp sub_40A1F0 sub_401C5D endp ; --------------------------------------------------------------------------- jmp near ptr dword_4157E0 ; --------------------------------------------------------------------------- jmp near ptr dword_42E9C0 ; --------------------------------------------------------------------------- jmp near ptr dword_425820 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401C71 proc near ; CODE XREF: sub_40B520+2Fp ; sub_40B520+6Ep ... jmp sub_40BD60 sub_401C71 endp ; --------------------------------------------------------------------------- jmp near ptr dword_432CC0 ; --------------------------------------------------------------------------- jmp near ptr dword_415FC0 ; --------------------------------------------------------------------------- jmp near ptr dword_41D830 ; --------------------------------------------------------------------------- jmp near ptr dword_419910 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401C8A proc near ; CODE XREF: sub_407370+9p jmp sub_4075C0 sub_401C8A endp ; --------------------------------------------------------------------------- jmp near ptr dword_413220 ; --------------------------------------------------------------------------- jmp loc_40B810 ; --------------------------------------------------------------------------- jmp near ptr dword_416C90 ; --------------------------------------------------------------------------- jmp near ptr dword_419090 ; --------------------------------------------------------------------------- jmp near ptr dword_4181B0 ; --------------------------------------------------------------------------- jmp near ptr dword_4165A0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401CAD proc near ; CODE XREF: sub_409600+45p jmp sub_4098E0 sub_401CAD endp ; --------------------------------------------------------------------------- jmp near ptr dword_433140 ; [00000005 BYTES: COLLAPSED FUNCTION j_nullsub_1. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- jmp loc_40A000 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401CC1 proc near ; CODE XREF: ___:00407DD6p ; ___:00407E7Dp ... jmp sub_4076F0 sub_401CC1 endp ; --------------------------------------------------------------------------- jmp near ptr dword_416090 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401CCB proc near ; CODE XREF: sub_409600+144p jmp sub_409970 sub_401CCB endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401CD0 proc near ; CODE XREF: ___:00404802p ; sub_404B10+36p ... jmp near ptr dword_4133D0 sub_401CD0 endp ; --------------------------------------------------------------------------- jmp near ptr dword_415CC0 ; --------------------------------------------------------------------------- jmp loc_409AA0 ; --------------------------------------------------------------------------- jmp near ptr dword_41FC00 ; --------------------------------------------------------------------------- jmp near ptr dword_42E0B0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401CE9 proc near ; CODE XREF: sub_40BE90+5p jmp sub_40C0F0 sub_401CE9 endp ; --------------------------------------------------------------------------- jmp near ptr dword_42F230 ; --------------------------------------------------------------------------- jmp near ptr dword_422300 ; --------------------------------------------------------------------------- jmp near ptr dword_4131F0 ; --------------------------------------------------------------------------- jmp near ptr dword_416120 ; --------------------------------------------------------------------------- jmp near ptr dword_40F590 ; --------------------------------------------------------------------------- jmp near ptr dword_414090 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401D0C proc near ; CODE XREF: ___:00404C43p jmp near ptr dword_412B20 sub_401D0C endp ; --------------------------------------------------------------------------- jmp near ptr dword_418050 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401D16 proc near ; CODE XREF: sub_407540+7p ; sub_40C200+7p jmp sub_4075E0 sub_401D16 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401D1B proc near ; CODE XREF: sub_40A810+1Ap ; sub_40A8C0+4p ... jmp sub_40A880 sub_401D1B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401D20 proc near ; CODE XREF: ___:004048C9p ; ___:004048EDp jmp sub_40A0A0 sub_401D20 endp ; --------------------------------------------------------------------------- jmp near ptr dword_42F2B0 ; --------------------------------------------------------------------------- jmp near ptr dword_4282C0 ; --------------------------------------------------------------------------- jmp near ptr dword_42E680 ; --------------------------------------------------------------------------- jmp loc_403FC0 ; --------------------------------------------------------------------------- jmp near ptr dword_4126B0 ; --------------------------------------------------------------------------- jmp near ptr dword_41B470 ; --------------------------------------------------------------------------- jmp loc_40B790 ; --------------------------------------------------------------------------- jmp near ptr dword_4221E0 ; --------------------------------------------------------------------------- jmp near ptr dword_416690 ; --------------------------------------------------------------------------- jmp near ptr dword_42EA40 ; --------------------------------------------------------------------------- jmp near ptr dword_418E40 ; --------------------------------------------------------------------------- jmp near ptr dword_415340 ; --------------------------------------------------------------------------- jmp near ptr dword_4360A0 ; --------------------------------------------------------------------------- jmp near ptr dword_4163E0 ; --------------------------------------------------------------------------- jmp loc_40B880 ; --------------------------------------------------------------------------- jmp near ptr dword_430660 ; --------------------------------------------------------------------------- jmp near ptr dword_4221B0 ; --------------------------------------------------------------------------- jmp near ptr dword_42C7E0 ; --------------------------------------------------------------------------- jmp near ptr dword_41C390 ; --------------------------------------------------------------------------- jmp near ptr dword_418D20 ; --------------------------------------------------------------------------- jmp near ptr dword_4151A0 ; --------------------------------------------------------------------------- jmp near ptr dword_4258A0 ; --------------------------------------------------------------------------- jmp near ptr dword_4257A0 ; --------------------------------------------------------------------------- jmp near ptr dword_416850 ; --------------------------------------------------------------------------- jmp near ptr dword_427AD0 ; --------------------------------------------------------------------------- jmp near ptr dword_416310 ; --------------------------------------------------------------------------- jmp near ptr dword_415D40 ; --------------------------------------------------------------------------- jmp near ptr dword_4144D0 ; --------------------------------------------------------------------------- jmp near ptr dword_4168F0 ; --------------------------------------------------------------------------- jmp near ptr dword_427520 ; --------------------------------------------------------------------------- jmp near ptr dword_42AEC0 ; --------------------------------------------------------------------------- jmp near ptr dword_414120 ; --------------------------------------------------------------------------- jmp near ptr dword_4317F0 ; --------------------------------------------------------------------------- jmp loc_40B070 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401DCF proc near ; CODE XREF: sub_40A9F0+45p jmp sub_40AC70 sub_401DCF endp ; --------------------------------------------------------------------------- jmp near ptr dword_431990 ; --------------------------------------------------------------------------- jmp near ptr dword_426EB0 ; --------------------------------------------------------------------------- jmp near ptr dword_431A60 ; --------------------------------------------------------------------------- jmp near ptr dword_41EE70 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401DE8 proc near ; CODE XREF: sub_40ACA0+Ap jmp sub_40AD90 sub_401DE8 endp ; --------------------------------------------------------------------------- jmp near ptr dword_417AE0 ; --------------------------------------------------------------------------- jmp near ptr dword_422320 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401DF7 proc near ; CODE XREF: ___:0040C671p jmp near ptr dword_423660 sub_401DF7 endp ; --------------------------------------------------------------------------- jmp near ptr dword_416760 ; --------------------------------------------------------------------------- jmp near ptr dword_4164C0 ; --------------------------------------------------------------------------- jmp near ptr dword_42C790 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401E0B proc near ; CODE XREF: ___:0040445Ep ; ___:004054ABp ... jmp near ptr dword_412900 sub_401E0B endp ; --------------------------------------------------------------------------- jmp near ptr dword_4131F0 ; --------------------------------------------------------------------------- jmp near ptr dword_428220 ; --------------------------------------------------------------------------- jmp near ptr dword_416010 ; --------------------------------------------------------------------------- jmp near ptr dword_4152D0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401E24 proc near ; CODE XREF: ___:0040CD9Ep jmp near ptr dword_425640 sub_401E24 endp ; --------------------------------------------------------------------------- jmp near ptr dword_4163C0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401E2E proc near ; CODE XREF: ___:004046D7p ; ___:00404747p ... jmp sub_40A3C0 sub_401E2E endp ; --------------------------------------------------------------------------- jmp near ptr dword_4168A0 ; --------------------------------------------------------------------------- jmp near ptr dword_423850 ; --------------------------------------------------------------------------- jmp near ptr dword_422210 ; --------------------------------------------------------------------------- jmp near ptr dword_416D30 ; --------------------------------------------------------------------------- jmp near ptr dword_4355E0 ; --------------------------------------------------------------------------- jmp near ptr dword_4356F0 ; --------------------------------------------------------------------------- jmp near ptr dword_42FDB0 ; --------------------------------------------------------------------------- jmp near ptr dword_4167F0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401E5B proc near ; CODE XREF: ___:00404EFDp jmp sub_40DB40 sub_401E5B endp ; --------------------------------------------------------------------------- jmp near ptr dword_422600 ; --------------------------------------------------------------------------- jmp near ptr dword_419E90 ; --------------------------------------------------------------------------- jmp loc_40ADC0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401E6F proc near ; CODE XREF: sub_40A9F0+112p ; sub_40A9F0+153p jmp sub_40ACD0 sub_401E6F endp ; --------------------------------------------------------------------------- jmp near ptr dword_41B010 ; --------------------------------------------------------------------------- jmp near ptr dword_416070 ; --------------------------------------------------------------------------- jmp near ptr dword_426820 ; --------------------------------------------------------------------------- jmp near ptr dword_4175E0 ; --------------------------------------------------------------------------- jmp near ptr dword_431EC0 ; --------------------------------------------------------------------------- jmp near ptr dword_420300 ; --------------------------------------------------------------------------- jmp near ptr dword_426F70 ; --------------------------------------------------------------------------- jmp near ptr dword_432800 ; --------------------------------------------------------------------------- jmp near ptr dword_416710 ; --------------------------------------------------------------------------- jmp near ptr dword_416410 ; --------------------------------------------------------------------------- jmp near ptr dword_4160F0 ; --------------------------------------------------------------------------- jmp near ptr dword_424800 ; --------------------------------------------------------------------------- jmp near ptr dword_417830 ; --------------------------------------------------------------------------- jmp near ptr dword_415D20 ; --------------------------------------------------------------------------- jmp near ptr dword_415C70 ; --------------------------------------------------------------------------- jmp near ptr dword_421F50 ; --------------------------------------------------------------------------- jmp near ptr dword_418860 ; --------------------------------------------------------------------------- jmp near ptr dword_41C250 ; --------------------------------------------------------------------------- jmp near ptr dword_419050 ; --------------------------------------------------------------------------- jmp near ptr dword_4226E0 ; --------------------------------------------------------------------------- jmp near ptr dword_41BC50 ; --------------------------------------------------------------------------- jmp near ptr dword_4328B0 ; --------------------------------------------------------------------------- jmp near ptr dword_417B20 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401EE7 proc near ; CODE XREF: sub_40A810+13p jmp loc_40A950 sub_401EE7 endp ; --------------------------------------------------------------------------- jmp near ptr dword_4198A0 ; --------------------------------------------------------------------------- jmp near ptr dword_415490 ; --------------------------------------------------------------------------- jmp near ptr dword_416360 ; --------------------------------------------------------------------------- jmp near ptr dword_415D00 ; --------------------------------------------------------------------------- jmp near ptr dword_412C10 ; --------------------------------------------------------------------------- jmp near ptr dword_415370 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401F0A proc near ; CODE XREF: sub_4070F0+5Cp jmp sub_407310 sub_401F0A endp ; --------------------------------------------------------------------------- jmp near ptr dword_419170 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401F14 proc near ; CODE XREF: sub_40BEC0+5Ap jmp sub_40C250 sub_401F14 endp ; --------------------------------------------------------------------------- jmp near ptr dword_42ADB0 ; --------------------------------------------------------------------------- jmp near ptr dword_4348A0 ; --------------------------------------------------------------------------- jmp near ptr dword_423C10 ; --------------------------------------------------------------------------- jmp near ptr dword_417A40 ; --------------------------------------------------------------------------- jmp near ptr dword_413D40 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401F32 proc near ; CODE XREF: sub_40B390+3Dp ; ___:0040BB2Dp jmp sub_40B700 sub_401F32 endp ; --------------------------------------------------------------------------- jmp near ptr dword_423720 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401F3C proc near ; CODE XREF: ___:004056AEp jmp sub_406890 sub_401F3C endp ; --------------------------------------------------------------------------- jmp near ptr dword_42B350 ; --------------------------------------------------------------------------- jmp near ptr dword_413670 ; --------------------------------------------------------------------------- jmp near ptr dword_4189B0 ; --------------------------------------------------------------------------- jmp near ptr dword_42EFA0 ; --------------------------------------------------------------------------- jmp near ptr dword_42D2C0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401F5A proc near ; CODE XREF: sub_40B520+4Bp ; sub_40B520:loc_40B5ABp ... jmp sub_40BE40 sub_401F5A endp ; --------------------------------------------------------------------------- jmp near ptr dword_41E400 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401F64 proc near ; CODE XREF: sub_40A430+142p jmp sub_40A810 sub_401F64 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401F69 proc near ; CODE XREF: ___:0040499Dp ; ___:004049DEp jmp sub_404B10 sub_401F69 endp ; --------------------------------------------------------------------------- jmp near ptr dword_4166D0 ; --------------------------------------------------------------------------- jmp near ptr dword_431BE0 ; --------------------------------------------------------------------------- jmp near ptr dword_42AFD0 ; --------------------------------------------------------------------------- jmp near ptr dword_4264C0 ; --------------------------------------------------------------------------- jmp near ptr dword_427E30 ; --------------------------------------------------------------------------- jmp near ptr dword_429DA0 ; --------------------------------------------------------------------------- jmp loc_406BD0 ; --------------------------------------------------------------------------- jmp loc_40D460 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401F96 proc near ; CODE XREF: sub_409600+112p ; sub_409600+153p jmp sub_409940 sub_401F96 endp ; --------------------------------------------------------------------------- jmp near ptr dword_422770 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401FA0 proc near ; CODE XREF: sub_407340+5p jmp sub_4074F0 sub_401FA0 endp ; --------------------------------------------------------------------------- jmp near ptr dword_4152F0 ; --------------------------------------------------------------------------- jmp near ptr dword_42B830 ; --------------------------------------------------------------------------- jmp near ptr dword_415B20 ; --------------------------------------------------------------------------- jmp near ptr dword_40F030 ; --------------------------------------------------------------------------- jmp near ptr dword_412B50 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401FBE proc near ; CODE XREF: ___:00404688p ; ___:0040469Dp ... jmp sub_409D20 sub_401FBE endp ; --------------------------------------------------------------------------- jmp near ptr dword_419950 ; --------------------------------------------------------------------------- jmp near ptr dword_41A110 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401FCD proc near ; CODE XREF: sub_40BCB0+34p ; sub_40C120+67p jmp sub_40C040 sub_401FCD endp ; --------------------------------------------------------------------------- jmp near ptr dword_432690 ; --------------------------------------------------------------------------- jmp near ptr dword_435280 ; --------------------------------------------------------------------------- jmp near ptr dword_40F0B0 ; --------------------------------------------------------------------------- jmp near ptr dword_436300 ; --------------------------------------------------------------------------- jmp near ptr dword_41EDB0 ; --------------------------------------------------------------------------- jmp near ptr dword_41FF40 ; --------------------------------------------------------------------------- jmp near ptr dword_430380 ; --------------------------------------------------------------------------- jmp near ptr dword_417B00 ; --------------------------------------------------------------------------- jmp near ptr dword_413120 ; --------------------------------------------------------------------------- jmp near ptr dword_421F80 ; --------------------------------------------------------------------------- jmp near ptr dword_41BFA0 ; --------------------------------------------------------------------------- jmp loc_406BD0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40200E proc near ; CODE XREF: ___:0040490Ep ; ___:004050E2p ... jmp sub_40A670 sub_40200E endp ; --------------------------------------------------------------------------- jmp near ptr dword_433120 ; --------------------------------------------------------------------------- jmp near ptr dword_41B3D0 ; --------------------------------------------------------------------------- jmp near ptr dword_422650 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402022 proc near ; CODE XREF: ___:00404414p ; ___:0040545Ap jmp near ptr dword_41B950 sub_402022 endp ; --------------------------------------------------------------------------- jmp loc_40ADE0 ; --------------------------------------------------------------------------- jmp near ptr dword_42BE60 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402031 proc near ; CODE XREF: ___:0040ADE3p jmp sub_40AE10 sub_402031 endp ; --------------------------------------------------------------------------- jmp near ptr dword_424720 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40203B proc near ; CODE XREF: sub_4098E0+7p jmp sub_4099D0 sub_40203B endp ; --------------------------------------------------------------------------- jmp near ptr dword_416870 ; --------------------------------------------------------------------------- jmp loc_40CB10 ; --------------------------------------------------------------------------- jmp near ptr dword_433030 ; --------------------------------------------------------------------------- jmp near ptr dword_421EF0 ; --------------------------------------------------------------------------- jmp near ptr dword_411990 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402059 proc near ; CODE XREF: sub_40C040+7p jmp sub_40C230 sub_402059 endp ; --------------------------------------------------------------------------- jmp near ptr dword_418CA0 ; --------------------------------------------------------------------------- jmp loc_409B10 ; --------------------------------------------------------------------------- jmp near ptr dword_427FC0 ; --------------------------------------------------------------------------- jmp loc_403EE0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402072 proc near ; CODE XREF: sub_4097D0+14p jmp sub_409830 sub_402072 endp ; --------------------------------------------------------------------------- jmp near ptr dword_431FD0 ; --------------------------------------------------------------------------- jmp near ptr dword_4279F0 ; --------------------------------------------------------------------------- jmp near ptr dword_426650 ; --------------------------------------------------------------------------- jmp near ptr dword_418A70 ; --------------------------------------------------------------------------- jmp near ptr dword_415CE0 ; --------------------------------------------------------------------------- jmp near ptr dword_426680 ; --------------------------------------------------------------------------- jmp near ptr dword_41B0F0 ; --------------------------------------------------------------------------- jmp near ptr dword_421620 ; --------------------------------------------------------------------------- jmp loc_407030 ; --------------------------------------------------------------------------- jmp near ptr dword_415310 ; --------------------------------------------------------------------------- jmp near ptr dword_41EF30 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4020AE proc near ; CODE XREF: sub_40A9F0+144p jmp sub_40AD00 sub_4020AE endp ; --------------------------------------------------------------------------- jmp near ptr dword_4329F0 ; --------------------------------------------------------------------------- jmp near ptr dword_4223E0 ; --------------------------------------------------------------------------- jmp near ptr dword_4224F0 ; --------------------------------------------------------------------------- jmp near ptr dword_42A440 ; --------------------------------------------------------------------------- jmp near ptr dword_41A2B0 ; --------------------------------------------------------------------------- jmp near ptr dword_4168C0 ; --------------------------------------------------------------------------- jmp near ptr dword_42B2D0 ; --------------------------------------------------------------------------- jmp near ptr dword_416490 ; --------------------------------------------------------------------------- jmp near ptr dword_4337E0 ; --------------------------------------------------------------------------- jmp near ptr dword_418FC0 ; --------------------------------------------------------------------------- jmp near ptr dword_418BA0 ; --------------------------------------------------------------------------- jmp near ptr dword_41A860 ; --------------------------------------------------------------------------- jmp near ptr dword_416570 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4020F4 proc near ; CODE XREF: ___:004050CCp ; sub_4066E0+43p ... jmp sub_409BC0 sub_4020F4 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4020F9 proc near ; CODE XREF: sub_40BD20+5p ; sub_40BE60+6p ... jmp sub_40C060 sub_4020F9 endp ; --------------------------------------------------------------------------- jmp near ptr dword_42F5B0 ; --------------------------------------------------------------------------- jmp near ptr dword_4190B0 ; --------------------------------------------------------------------------- jmp near ptr dword_429A60 ; --------------------------------------------------------------------------- jmp near ptr dword_4147D0 ; --------------------------------------------------------------------------- jmp near ptr dword_413510 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402117 proc near ; CODE XREF: sub_40A130+14p ; sub_40A160+7p ... jmp sub_40A180 sub_402117 endp ; --------------------------------------------------------------------------- jmp near ptr dword_429D00 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402121 proc near ; CODE XREF: sub_40ABE0+1Ap ; sub_40AC30+1Ap jmp sub_40ACA0 sub_402121 endp ; --------------------------------------------------------------------------- jmp near ptr dword_416050 ; --------------------------------------------------------------------------- jmp near ptr dword_40FF60 ; --------------------------------------------------------------------------- jmp near ptr dword_415830 ; --------------------------------------------------------------------------- jmp near ptr dword_41B390 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40213A proc near ; CODE XREF: sub_40BE20+3p jmp sub_40C0A0 sub_40213A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40213F proc near ; CODE XREF: sub_40BEC0+11p ; sub_40BEC0+27p ... jmp sub_40C1E0 sub_40213F endp ; --------------------------------------------------------------------------- jmp near ptr dword_4207E0 ; --------------------------------------------------------------------------- jmp near ptr dword_41C070 ; --------------------------------------------------------------------------- jmp near ptr dword_418E90 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402153 proc near ; CODE XREF: sub_40EC30+ACp jmp sub_40ED70 sub_402153 endp ; --------------------------------------------------------------------------- jmp near ptr dword_433A20 ; --------------------------------------------------------------------------- jmp near ptr dword_415A00 ; --------------------------------------------------------------------------- jmp near ptr dword_4253E0 ; --------------------------------------------------------------------------- jmp near ptr dword_4219D0 ; --------------------------------------------------------------------------- jmp near ptr dword_42A090 ; --------------------------------------------------------------------------- jmp loc_409B10 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402176 proc near ; CODE XREF: sub_40A9F0+6Ap ; sub_40A9F0+103p jmp sub_40AC30 sub_402176 endp ; --------------------------------------------------------------------------- jmp near ptr dword_426620 ; --------------------------------------------------------------------------- jmp near ptr dword_41AC00 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402185 proc near ; CODE XREF: sub_407220+16p ; sub_407260+Bp ... jmp sub_4074C0 sub_402185 endp ; --------------------------------------------------------------------------- jmp near ptr dword_416CE0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40218F proc near ; CODE XREF: ___:0040B01Bp jmp near ptr dword_432AD0 sub_40218F endp ; --------------------------------------------------------------------------- jmp near ptr dword_4164E0 ; --------------------------------------------------------------------------- jmp near ptr dword_430700 ; --------------------------------------------------------------------------- jmp near ptr dword_42EA90 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4021A3 proc near ; CODE XREF: ___:004086AAp ; ___:004086CFp jmp near ptr dword_4198C0 sub_4021A3 endp ; --------------------------------------------------------------------------- jmp near ptr dword_42C710 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4021AD proc near ; CODE XREF: sub_40B520+55p jmp sub_409FD0 sub_4021AD endp ; --------------------------------------------------------------------------- jmp near ptr dword_428220 ; --------------------------------------------------------------------------- jmp near ptr dword_422130 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4021BC proc near ; CODE XREF: sub_4070F0+2Cp ; sub_4070F0+68p ... jmp sub_407260 sub_4021BC endp ; --------------------------------------------------------------------------- jmp near ptr dword_4333F0 ; --------------------------------------------------------------------------- jmp near ptr dword_41D670 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4021CB proc near ; CODE XREF: sub_40BC70+11p ; sub_40BEC0+1Fp jmp sub_40BFF0 sub_4021CB endp ; --------------------------------------------------------------------------- jmp near ptr dword_42F5F0 ; --------------------------------------------------------------------------- jmp near ptr dword_424420 ; --------------------------------------------------------------------------- jmp near ptr dword_418940 ; --------------------------------------------------------------------------- jmp near ptr dword_42BB70 ; --------------------------------------------------------------------------- jmp near ptr dword_42EC80 ; --------------------------------------------------------------------------- jmp near ptr dword_42EE10 ; --------------------------------------------------------------------------- jmp near ptr dword_4331D0 ; --------------------------------------------------------------------------- jmp near ptr dword_42DD50 ; --------------------------------------------------------------------------- jmp loc_4071C0 ; --------------------------------------------------------------------------- jmp near ptr dword_42E2D0 ; --------------------------------------------------------------------------- jmp near ptr dword_418840 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402207 proc near ; CODE XREF: ___:004036F5p ; ___:00403705p ... jmp sub_403C90 sub_402207 endp ; --------------------------------------------------------------------------- jmp near ptr dword_433100 ; --------------------------------------------------------------------------- jmp near ptr dword_418A90 ; --------------------------------------------------------------------------- jmp near ptr dword_417770 ; --------------------------------------------------------------------------- jmp near ptr dword_418D50 ; --------------------------------------------------------------------------- jmp near ptr dword_414670 ; --------------------------------------------------------------------------- jmp near ptr dword_430AD0 ; --------------------------------------------------------------------------- jmp near ptr dword_427600 ; --------------------------------------------------------------------------- jmp near ptr dword_430810 ; --------------------------------------------------------------------------- jmp near ptr dword_415460 ; --------------------------------------------------------------------------- jmp near ptr dword_431410 ; --------------------------------------------------------------------------- jmp near ptr dword_42F170 ; --------------------------------------------------------------------------- jmp near ptr dword_42D0D0 ; --------------------------------------------------------------------------- jmp near ptr dword_42DC70 ; --------------------------------------------------------------------------- jmp near ptr dword_42E1A0 ; --------------------------------------------------------------------------- jmp near ptr dword_4158F0 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402257 proc near ; CODE XREF: ___:0040CD54p ; sub_40CF60+ADp jmp sub_40CF60 sub_402257 endp ; --------------------------------------------------------------------------- jmp near ptr dword_42E220 ; --------------------------------------------------------------------------- jmp near ptr dword_423FA0 ; --------------------------------------------------------------------------- jmp near ptr dword_419A90 ; --------------------------------------------------------------------------- jmp loc_40CEE0 ; --------------------------------------------------------------------------- db 1270h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4034E0 proc near ; CODE XREF: sub_4019B5j var_46C = dword ptr -46Ch var_468 = byte ptr -468h var_450 = byte ptr -450h var_438 = byte ptr -438h var_420 = byte ptr -420h var_408 = dword ptr -408h var_404 = byte ptr -404h var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push 0FFFFFFFFh push offset SEH_4034E0 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 460h mov eax, [esp+46Ch+arg_4] push ebp push esi push edi mov [esp+478h+var_408], eax mov eax, [esp+478h+arg_8] xor edi, edi mov esi, 1 cmp eax, edi mov [esp+478h+var_46C], edi jz short loc_403539 lea edx, [esp+478h+arg_8] lea ecx, [esp+478h+var_404] loc_40352A: ; CODE XREF: sub_4034E0+57j add edx, 4 mov [ecx], eax inc esi add ecx, 4 mov eax, [edx] cmp eax, edi jnz short loc_40352A loc_403539: ; CODE XREF: sub_4034E0+3Dj lea ecx, [esp+478h+var_468] mov [esp+esi*4+478h+var_408], edi call sub_401424 push offset dword_4435EC lea ecx, [esp+47Ch+var_438] mov [esp+47Ch+var_4], 1 call sub_401861 push offset dword_443520 lea ecx, [esp+47Ch+var_468] mov byte ptr [esp+47Ch+var_4], 2 call sub_401A87 push offset dword_446F70 lea ecx, [esp+47Ch+var_450] call sub_401861 mov byte ptr [esp+478h+var_4], 3 xor esi, esi lea edi, [esp+478h+var_408] loc_403591: ; CODE XREF: sub_4034E0+105j mov ebp, [edi] test ebp, ebp jz short loc_4035E7 lea ecx, [esp+478h+var_438] call sub_401681 dec ebp push eax lea ecx, [esp+47Ch+var_420] push ebp push ecx lea ecx, [esp+484h+var_468] call sub_4016AE mov ecx, eax mov byte ptr [esp+478h+var_4], 4 call sub_4017E4 push eax lea ecx, [esp+47Ch+var_450] call sub_401A9B lea ecx, [esp+478h+var_420] mov byte ptr [esp+478h+var_4], 3 call sub_401226 inc esi add edi, 4 cmp esi, 0FFh jb short loc_403591 loc_4035E7: ; CODE XREF: sub_4034E0+B5j mov esi, [esp+478h+arg_0] lea edx, [esp+478h+var_450] push edx mov ecx, esi call sub_4014C9 mov [esp+478h+var_46C], 1 lea ecx, [esp+478h+var_450] mov byte ptr [esp+478h+var_4], 2 call sub_401226 lea ecx, [esp+478h+var_438] mov byte ptr [esp+478h+var_4], 1 call sub_401226 lea ecx, [esp+478h+var_468] mov byte ptr [esp+478h+var_4], 0 call sub_401226 mov ecx, [esp+478h+var_C] mov eax, esi pop edi pop esi pop ebp mov large fs:0, ecx add esp, 46Ch retn sub_4034E0 endp ; --------------------------------------------------------------------------- db 90h db 60h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4036B0 proc near ; CODE XREF: sub_401681j mov eax, [ecx+9] retn sub_4036B0 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_4036D0: ; CODE XREF: ___:0040129Ej push 0FFFFFFFFh push offset dword_437EC0 mov eax, large fs:0 push eax mov large fs:0, esp push ecx push esi mov esi, ecx mov [esp+4], esi call sub_4011B3 lea ecx, [esi+9] call sub_402207 lea ecx, [esi+52h] mov dword ptr [esp+10h], 0 call sub_402207 lea ecx, [esi+9Bh] mov byte ptr [esp+10h], 1 call sub_402207 lea ecx, [esi+0E4h] mov byte ptr [esp+10h], 2 call sub_402207 lea ecx, [esi+12Dh] mov byte ptr [esp+10h], 3 call sub_402207 lea ecx, [esi+176h] mov byte ptr [esp+10h], 4 call sub_402207 lea ecx, [esi+1BFh] mov byte ptr [esp+10h], 5 call sub_402207 lea ecx, [esi+208h] mov byte ptr [esp+10h], 6 call sub_402207 lea ecx, [esi+251h] mov byte ptr [esp+10h], 7 call sub_402207 lea ecx, [esi+29Ah] mov byte ptr [esp+10h], 8 call sub_402207 lea ecx, [esi+2E3h] mov byte ptr [esp+10h], 9 call sub_402207 lea ecx, [esi+32Ch] mov byte ptr [esp+10h], 0Ah call sub_402207 lea ecx, [esi+375h] mov byte ptr [esp+10h], 0Bh call sub_402207 lea ecx, [esi+3BEh] mov byte ptr [esp+10h], 0Ch call sub_402207 lea ecx, [esi+407h] mov byte ptr [esp+10h], 0Dh call sub_402207 lea ecx, [esi+450h] mov byte ptr [esp+10h], 0Eh call sub_402207 lea ecx, [esi+499h] mov byte ptr [esp+10h], 0Fh call sub_402207 lea ecx, [esi+4E2h] mov byte ptr [esp+10h], 10h call sub_402207 lea ecx, [esi+52Bh] mov byte ptr [esp+10h], 11h call sub_402207 mov byte ptr [esp+10h], 12h lea ecx, [esi+574h] call sub_402207 lea ecx, [esi+5BDh] mov byte ptr [esp+10h], 13h call sub_402207 lea ecx, [esi+606h] mov byte ptr [esp+10h], 14h call sub_402207 lea ecx, [esi+64Fh] mov byte ptr [esp+10h], 15h call sub_402207 lea ecx, [esi+698h] mov byte ptr [esp+10h], 16h call sub_402207 lea ecx, [esi+6E1h] mov byte ptr [esp+10h], 17h call sub_402207 lea ecx, [esi+72Ah] mov byte ptr [esp+10h], 18h call sub_402207 lea ecx, [esi+773h] mov byte ptr [esp+10h], 19h call sub_402207 lea ecx, [esi+7BCh] mov byte ptr [esp+10h], 1Ah call sub_402207 lea ecx, [esi+805h] mov byte ptr [esp+10h], 1Bh call sub_402207 lea ecx, [esi+84Eh] mov byte ptr [esp+10h], 1Ch call sub_402207 lea ecx, [esi+897h] mov byte ptr [esp+10h], 1Dh call sub_402207 lea ecx, [esi+8E0h] mov byte ptr [esp+10h], 1Eh call sub_402207 lea ecx, [esi+929h] mov byte ptr [esp+10h], 1Fh call sub_402207 lea ecx, [esi+972h] mov byte ptr [esp+10h], 20h call sub_402207 lea ecx, [esi+9BBh] mov byte ptr [esp+10h], 21h call sub_402207 lea ecx, [esi+0A04h] mov byte ptr [esp+10h], 22h call sub_402207 lea ecx, [esi+0A4Dh] mov byte ptr [esp+10h], 23h call sub_402207 lea ecx, [esi+0A96h] mov byte ptr [esp+10h], 24h call sub_402207 lea ecx, [esi+0ADFh] mov byte ptr [esp+10h], 25h call sub_402207 lea ecx, [esi+0B28h] mov byte ptr [esp+10h], 26h call sub_402207 lea ecx, [esi+0B71h] mov byte ptr [esp+10h], 27h call sub_401749 lea ecx, [esi+0B9Fh] mov byte ptr [esp+10h], 28h call sub_401749 lea ecx, [esi+0BCDh] mov byte ptr [esp+10h], 29h call sub_401749 lea ecx, [esi+0BFBh] mov byte ptr [esp+10h], 2Ah call sub_401749 lea ecx, [esi+0C29h] mov byte ptr [esp+10h], 2Bh call sub_401749 lea ecx, [esi+0C57h] mov byte ptr [esp+10h], 2Ch call sub_401749 lea ecx, [esi+0C85h] mov byte ptr [esp+10h], 2Dh call sub_401749 lea ecx, [esi+0CB3h] mov byte ptr [esp+10h], 2Eh call sub_401749 lea ecx, [esi+0CE1h] mov byte ptr [esp+10h], 2Fh call sub_401749 lea ecx, [esi+0D0Fh] mov byte ptr [esp+10h], 30h call sub_401749 lea ecx, [esi+0D3Dh] mov byte ptr [esp+10h], 31h call sub_401749 lea ecx, [esi+0D6Bh] mov byte ptr [esp+10h], 32h call sub_401749 lea ecx, [esi+0D99h] mov byte ptr [esp+10h], 33h call sub_401749 lea ecx, [esi+0DC7h] mov byte ptr [esp+10h], 34h call sub_401749 lea ecx, [esi+0DF5h] mov byte ptr [esp+10h], 35h call sub_401749 lea ecx, [esi+0E23h] mov byte ptr [esp+10h], 36h call sub_401749 lea ecx, [esi+0E51h] mov byte ptr [esp+10h], 37h call sub_401749 lea ecx, [esi+0E7Fh] mov byte ptr [esp+10h], 38h call sub_4011A4 lea ecx, [esi+10C7h] mov byte ptr [esp+10h], 39h call sub_4011A4 lea ecx, [esi+130Fh] mov byte ptr [esp+10h], 3Ah call sub_4011A4 lea ecx, [esi+1557h] mov byte ptr [esp+10h], 3Bh call sub_4011A4 lea ecx, [esi+179Fh] mov byte ptr [esp+10h], 3Ch call sub_4011A4 mov ecx, [esp+8] mov dword ptr [esi], offset dword_43E000 mov byte ptr [esi+4], 0 mov eax, esi pop esi mov large fs:0, ecx add esp, 10h retn ; --------------------------------------------------------------------------- db 0Ah dup(90h) db 110h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_403C00 proc near ; CODE XREF: sub_401023j var_10 = dword ptr -10h var_C = dword ptr -0Ch var_4 = dword ptr -4 push 0FFFFFFFFh push offset SEH_403C00 mov eax, large fs:0 push eax mov large fs:0, esp push ecx push esi mov esi, ecx mov [esp+14h+var_10], esi lea ecx, [esi+15h] mov [esp+14h+var_4], 0 call sub_401226 mov ecx, esi mov [esp+14h+var_4], 0FFFFFFFFh call sub_401226 mov ecx, [esp+14h+var_C] pop esi mov large fs:0, ecx add esp, 10h retn sub_403C00 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_403C70 proc near ; CODE XREF: sub_4011B3j mov eax, ecx mov dword ptr [eax], offset dword_43E004 retn sub_403C70 endp ; --------------------------------------------------------------------------- db 7 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_403C90 proc near ; CODE XREF: sub_402207j var_10 = dword ptr -10h var_C = dword ptr -0Ch var_4 = dword ptr -4 push 0FFFFFFFFh push offset SEH_403C90 mov eax, large fs:0 push eax mov large fs:0, esp push ecx push esi mov esi, ecx mov [esp+14h+var_10], esi call sub_401424 lea ecx, [esi+1Eh] mov [esp+14h+var_4], 0 call sub_401424 lea ecx, [esi+33h] mov byte ptr [esp+14h+var_4], 1 call sub_401424 mov ecx, [esp+14h+var_C] mov eax, esi pop esi mov large fs:0, ecx add esp, 10h retn sub_403C90 endp ; --------------------------------------------------------------------------- db 0Fh dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_403D10 proc near ; CODE XREF: sub_401AD2j var_10 = dword ptr -10h var_C = dword ptr -0Ch var_4 = dword ptr -4 push 0FFFFFFFFh push offset SEH_403D10 mov eax, large fs:0 push eax mov large fs:0, esp push ecx push esi mov esi, ecx mov [esp+14h+var_10], esi lea ecx, [esi+33h] mov [esp+14h+var_4], 1 call sub_401226 lea ecx, [esi+1Eh] mov byte ptr [esp+14h+var_4], 0 call sub_401226 mov ecx, esi mov [esp+14h+var_4], 0FFFFFFFFh call sub_401226 mov ecx, [esp+14h+var_C] pop esi mov large fs:0, ecx add esp, 10h retn sub_403D10 endp ; --------------------------------------------------------------------------- db 7 dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_403D90 proc near ; CODE XREF: sub_401749j var_10 = dword ptr -10h var_C = dword ptr -0Ch var_4 = dword ptr -4 push 0FFFFFFFFh push offset SEH_403D90 mov eax, large fs:0 push eax mov large fs:0, esp push ecx push esi mov esi, ecx mov [esp+14h+var_10], esi call sub_401424 lea ecx, [esi+15h] mov [esp+14h+var_4], 0 call sub_401424 mov ecx, [esp+14h+var_C] mov eax, esi pop esi mov large fs:0, ecx add esp, 10h retn sub_403D90 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_403E00 proc near ; CODE XREF: sub_4011A4j var_10 = dword ptr -10h var_C = dword ptr -0Ch var_4 = dword ptr -4 push 0FFFFFFFFh push offset SEH_403E00 mov eax, large fs:0 push eax mov large fs:0, esp push ecx push esi mov esi, ecx mov [esp+14h+var_10], esi call sub_402207 lea ecx, [esi+49h] mov [esp+14h+var_4], 0 call sub_402207 lea ecx, [esi+92h] mov byte ptr [esp+14h+var_4], 1 call sub_402207 lea ecx, [esi+0DBh] mov byte ptr [esp+14h+var_4], 2 call sub_402207 lea ecx, [esi+124h] mov byte ptr [esp+14h+var_4], 3 call sub_402207 lea ecx, [esi+16Dh] mov byte ptr [esp+14h+var_4], 4 call sub_402207 lea ecx, [esi+1B6h] mov byte ptr [esp+14h+var_4], 5 call sub_402207 lea ecx, [esi+1FFh] mov byte ptr [esp+14h+var_4], 6 call sub_402207 mov ecx, [esp+14h+var_C] mov eax, esi pop esi mov large fs:0, ecx add esp, 10h retn sub_403E00 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 30h dup(0CCh) ; --------------------------------------------------------------------------- loc_403EE0: ; CODE XREF: ___:0040206Dj push 0FFFFFFFFh push offset byte_438119 mov eax, large fs:0 push eax mov large fs:0, esp push ecx push esi mov esi, ecx mov [esp+4], esi lea ecx, [esi+1FFh] mov dword ptr [esp+10h], 6 call sub_401AD2 lea ecx, [esi+1B6h] mov byte ptr [esp+10h], 5 call sub_401AD2 lea ecx, [esi+16Dh] mov byte ptr [esp+10h], 4 call sub_401AD2 lea ecx, [esi+124h] mov byte ptr [esp+10h], 3 call sub_401AD2 lea ecx, [esi+0DBh] mov byte ptr [esp+10h], 2 call sub_401AD2 lea ecx, [esi+92h] mov byte ptr [esp+10h], 1 call sub_401AD2 lea ecx, [esi+49h] mov byte ptr [esp+10h], 0 call sub_401AD2 mov ecx, esi mov dword ptr [esp+10h], 0FFFFFFFFh call sub_401AD2 mov ecx, [esp+8] pop esi mov large fs:0, ecx add esp, 10h retn ; --------------------------------------------------------------------------- db 4 dup(90h) db 30h dup(0CCh) ; --------------------------------------------------------------------------- loc_403FC0: ; CODE XREF: ___:00401D34j push 0FFFFFFFFh push offset dword_4381C8 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 48h push ebp push esi push edi push 0 push 4 push 9 push 4Fh lea eax, [esp+34h] push 2 mov esi, ecx push eax call sub_4019B5 add esp, 18h push esi mov ecx, eax mov dword ptr [esp+60h], 0 call sub_4017E4 lea ecx, [esi+0C29h] push eax push ecx mov ecx, offset dword_447158 call sub_401591 or edi, 0FFFFFFFFh lea ecx, [esp+24h] mov [esp+5Ch], edi call sub_401226 push 0 push 0Bh push 3 push 9 push 0Eh push 4 push 0Eh push 12h push 4Fh lea edx, [esp+48h] push 2 push edx call sub_4019B5 add esp, 2Ch push esi mov ecx, eax mov dword ptr [esp+60h], 1 call sub_4017E4 push eax lea eax, [esi+0BCDh] push eax mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+24h] mov [esp+5Ch], edi call sub_401226 push 0 push 14h push 15h push 0Fh push 2 push 1 push 4Fh lea ecx, [esp+40h] push 2 push ecx call sub_4019B5 add esp, 24h push esi mov ecx, eax mov dword ptr [esp+60h], 2 call sub_4017E4 lea edx, [esi+0C57h] push eax push edx mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+24h] mov [esp+5Ch], edi call sub_401226 push 0 push 5 push 12h push 15h push 3 push 5 push 13h push 4Fh lea eax, [esp+44h] push 2 push eax call sub_4019B5 add esp, 28h push esi mov ecx, eax mov dword ptr [esp+60h], 3 call sub_4017E4 lea ecx, [esi+0DF5h] push eax push ecx mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+24h] mov [esp+5Ch], edi call sub_401226 push 0 push 0Fh push 6 push 0Eh push 9 push 13h push 19h push 13h push 4Fh lea edx, [esp+48h] push 2 push edx call sub_4019B5 add esp, 2Ch push esi mov ecx, eax mov dword ptr [esp+60h], 4 call sub_4017E4 push eax lea eax, [esi+0C85h] push eax mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+24h] mov [esp+5Ch], edi call sub_401226 push 0 push 5 push 16h push 0Fh push 0Dh push 5 push 12h push 4Fh lea ecx, [esp+44h] push 2 push ecx call sub_4019B5 add esp, 28h push esi mov ecx, eax mov dword ptr [esp+60h], 5 call sub_4017E4 lea edx, [esi+0B71h] push eax push edx mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+24h] mov [esp+5Ch], edi call sub_401226 push 0 push 13h push 0Eh push 4 push 8 push 13h push 15h push 0Ch push 6 push 4Fh lea eax, [esp+4Ch] push 2 push eax call sub_4019B5 add esp, 30h push esi mov ecx, eax mov dword ptr [esp+60h], 6 call sub_4017E4 lea ecx, [esi+0DC7h] push eax push ecx mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+24h] mov [esp+5Ch], edi call sub_401226 push 0 push 0Eh push 5 push 10h push 0Fh push 4Fh lea edx, [esp+3Ch] push 2 push edx call sub_4019B5 add esp, 20h push esi mov ecx, eax mov dword ptr [esp+60h], 7 call sub_4017E4 push eax lea eax, [esi+0D0Fh] push eax mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+24h] mov [esp+5Ch], edi call sub_401226 push 0 push 14h push 9 push 15h push 11h push 4Fh lea ecx, [esp+3Ch] push 2 push ecx call sub_4019B5 add esp, 20h push esi mov ecx, eax mov dword ptr [esp+60h], 8 call sub_4017E4 lea edx, [esi+0D99h] push eax push edx mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+24h] mov [esp+5Ch], edi call sub_401226 push 0 push 4 push 0Dh push 3 push 4Fh lea eax, [esp+38h] push 2 push eax call sub_4019B5 add esp, 1Ch push esi mov ecx, eax mov dword ptr [esp+60h], 9 call sub_4017E4 lea ecx, [esi+0E23h] push eax push ecx mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+24h] mov [esp+5Ch], edi call sub_401226 push 0 push 5 push 18h push 5 push 4Fh lea edx, [esp+38h] push 2 push edx call sub_4019B5 add esp, 1Ch push esi mov ecx, eax mov dword ptr [esp+60h], 0Ah call sub_4017E4 push eax lea eax, [esi+0D6Bh] push eax mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+24h] mov [esp+5Ch], edi call sub_401226 push 0 push 13h push 0Eh push 4 push 4Fh lea ecx, [esp+38h] push 2 push ecx call sub_4019B5 add esp, 1Ch push esi mov ecx, eax mov dword ptr [esp+60h], 0Bh call sub_4017E4 lea edx, [esi+0D3Dh] push eax push edx mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+24h] mov [esp+5Ch], edi call sub_401226 push 0 push 5 push 0Dh push 9 push 14h push 10h push 15h push 0Ch push 4Fh lea eax, [esp+48h] push 2 push eax call sub_4019B5 add esp, 2Ch push esi mov ecx, eax mov dword ptr [esp+60h], 0Ch call sub_4017E4 push eax lea ecx, [esi+0CB3h] push ecx mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+24h] mov [esp+5Ch], edi call sub_401226 push 0 push 0Bh push 3 push 9 push 0Eh push 4Fh lea edx, [esp+3Ch] push 2 push edx call sub_4019B5 add esp, 20h push esi mov ecx, eax mov dword ptr [esp+60h], 0Dh call sub_4017E4 push eax lea eax, [esi+0CE1h] push eax mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+24h] mov [esp+5Ch], edi call sub_401226 lea ecx, [esi+9] call sub_4017E4 lea ecx, [esp+0Ch] push eax push ecx call sub_402022 add esp, 8 push 0 push 25h push 1Dh push 23h lea edx, [esp+34h] push 28h push edx mov dword ptr [esp+74h], 0Eh call sub_4019B5 add esp, 18h mov ebp, eax lea ecx, [esp+0Ch] mov byte ptr [esp+5Ch], 0Fh call sub_4017E4 push eax mov ecx, ebp call sub_4017E4 push eax push offset dword_4435F4 push offset byte_4D60B5 call sub_401E0B add esp, 10h lea ecx, [esp+24h] mov byte ptr [esp+5Ch], 0Eh call sub_401226 push 20h lea eax, [esp+40h] push 0 push eax lea ecx, [esp+18h] call sub_4012B2 mov ecx, eax mov byte ptr [esp+5Ch], 10h call sub_4017E4 push eax push offset dword_4435F0 push offset byte_4E6E85 call sub_40102D add esp, 0Ch mov byte ptr [esp+5Ch], 0Eh lea ecx, [esp+3Ch] call sub_401226 nop call near ptr 27D07BFh mov ecx, eax mov eax, 10624DD3h mul ecx shr edx, 6 lea ecx, [esp+0Ch] mov [esi+5], edx mov [esp+5Ch], edi call sub_401226 mov ecx, [esp+54h] pop edi pop esi pop ebp mov large fs:0, ecx add esp, 54h retn ; --------------------------------------------------------------------------- db 9 dup(90h) db 150h dup(0CCh) ; --------------------------------------------------------------------------- loc_404640: ; CODE XREF: ___:00401A32j push 0FFFFFFFFh push offset byte_43825B mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 7Ch push ebx push ebp push esi mov esi, [esp+98h] mov ebp, ecx push edi lea ebx, [esi+2Ah] push 0 mov ecx, ebx mov [esp+14h], ebp call sub_40146F mov cl, [eax] lea edi, [esi+69h] cmp cl, 23h jnz short loc_404682 push ebx jmp short loc_404686 ; --------------------------------------------------------------------------- loc_404682: ; CODE XREF: ___:0040467Dj lea eax, [esi+15h] push eax loc_404686: ; CODE XREF: ___:00404680j mov ecx, edi call sub_401FBE mov al, [esi+94h] test al, al jz short loc_4046A2 lea ecx, [esi+15h] push ecx mov ecx, edi call sub_401FBE loc_4046A2: ; CODE XREF: ___:00404695j mov al, [esi+95h] test al, al jz short loc_40471F lea ecx, [esp+2Ch] call sub_401424 push offset dword_443604 mov ecx, esi mov dword ptr [esp+98h], 0 call sub_4013E3 add eax, 3 lea edx, [esp+44h] push eax push edx mov ecx, esi call sub_401E2E push eax lea ecx, [esp+30h] mov byte ptr [esp+98h], 1 call sub_401FBE lea ecx, [esp+44h] mov byte ptr [esp+94h], 0 call sub_401226 lea eax, [esp+2Ch] mov ecx, edi push eax call sub_401FBE lea ecx, [esp+2Ch] mov dword ptr [esp+94h], 0FFFFFFFFh call sub_401226 loc_40471F: ; CODE XREF: ___:004046AAj push offset dword_443600 lea ecx, [esp+30h] push 0 push ecx mov ecx, esi call sub_4016AE lea edx, [esp+44h] mov ebx, 2 push 1 push edx mov ecx, eax mov [esp+9Ch], ebx call sub_401E2E lea edi, [esi+7Eh] push eax mov ecx, edi mov byte ptr [esp+98h], 3 call sub_401FBE lea ecx, [esp+44h] mov [esp+94h], bl call sub_401226 lea ecx, [esp+2Ch] mov dword ptr [esp+94h], 0FFFFFFFFh call sub_401226 push 0 lea ecx, [ebp+32Ch] call sub_40146F push 0 mov ecx, esi mov ebp, eax call sub_40146F mov al, [eax] mov cl, [ebp+0] cmp al, cl jnz loc_4049EA push 0 push 14h push 1 push 5 push 10h push 5 push 12h push 4Eh push 14h push 0Fh lea ecx, [esp+6Ch] push ebx push ecx call sub_4019B5 add esp, 30h mov ecx, eax mov dword ptr [esp+94h], 4 call sub_4017E4 push eax mov ecx, edi call sub_4012EE test eax, eax jnz short loc_40480F sub esp, 18h lea edx, [esi+15h] mov ecx, esp mov [esp+0B4h], esp push edx call sub_4014C9 mov ecx, offset word_448C9E call sub_401CD0 test eax, eax jz short loc_40480F mov bl, 1 jmp short loc_404811 ; --------------------------------------------------------------------------- loc_40480F: ; CODE XREF: ___:004047E6j ; ___:00404809j xor bl, bl loc_404811: ; CODE XREF: ___:0040480Dj lea ecx, [esp+44h] mov dword ptr [esp+94h], 0FFFFFFFFh call sub_401226 test bl, bl jz loc_4049CE push offset dword_443600 lea eax, [esp+48h] push 1 push eax mov ecx, esi call sub_4016AE push offset dword_446F70 mov ecx, eax mov dword ptr [esp+98h], 5 call sub_4012EE test eax, eax lea ecx, [esp+44h] mov dword ptr [esp+94h], 0FFFFFFFFh setz bl call sub_401226 test bl, bl jnz loc_4049EA push offset dword_443600 lea ecx, [esp+48h] push 1 push ecx mov ecx, esi call sub_4016AE mov ecx, eax mov dword ptr [esp+94h], 6 call sub_4017E4 push eax nop call near ptr 77C1BF18h add esp, 4 lea ecx, [esp+44h] mov ebp, eax mov dword ptr [esp+94h], 0FFFFFFFFh call sub_401226 test ebp, ebp jz loc_4049EA push 20h mov ecx, esi call sub_401D20 lea edx, [esp+14h] push eax push edx mov ecx, esi call sub_401E2E mov ebx, 7 push 20h lea ecx, [esp+18h] mov [esp+98h], ebx call sub_401D20 push eax lea eax, [esp+48h] push eax lea ecx, [esp+1Ch] call sub_401E2E push eax lea ecx, [esp+18h] mov byte ptr [esp+98h], 8 call sub_40200E lea ecx, [esp+44h] mov [esp+94h], bl call sub_401226 lea ecx, [esp+14h] push ecx mov ecx, esi call sub_401FBE push offset dword_443600 lea edx, [esp+78h] push 0 push edx mov ecx, esi call sub_4016AE lea ecx, [esp+5Ch] push 1 push ecx mov ecx, eax mov byte ptr [esp+9Ch], 9 call sub_401E2E push eax mov ecx, edi mov byte ptr [esp+98h], 0Ah call sub_401FBE lea ecx, [esp+5Ch] mov byte ptr [esp+94h], 9 call sub_401226 lea ecx, [esp+74h] mov [esp+94h], bl call sub_401226 mov al, [esp+0A0h] test al, al jnz short loc_4049A7 test ebp, ebp jle short loc_4049B8 loc_404998: ; CODE XREF: ___:004049A3j mov ecx, [esp+10h] push esi call sub_401F69 dec ebp jnz short loc_404998 jmp short loc_4049B8 ; --------------------------------------------------------------------------- loc_4049A7: ; CODE XREF: ___:00404992j test ebp, ebp jle short loc_4049B8 loc_4049AB: ; CODE XREF: ___:004049B6j mov ecx, [esp+10h] push esi call sub_401442 dec ebp jnz short loc_4049AB loc_4049B8: ; CODE XREF: ___:00404996j ; ___:004049A5j ... lea ecx, [esp+14h] mov dword ptr [esp+94h], 0FFFFFFFFh call sub_401226 jmp short loc_4049EA ; --------------------------------------------------------------------------- loc_4049CE: ; CODE XREF: ___:00404827j mov al, [esp+0A0h] mov ecx, [esp+10h] test al, al push esi jnz short loc_4049E5 call sub_401F69 jmp short loc_4049EA ; --------------------------------------------------------------------------- loc_4049E5: ; CODE XREF: ___:004049DCj call sub_401442 loc_4049EA: ; CODE XREF: ___:004047A2j ; ___:00404872j ... mov ecx, [esp+8Ch] pop edi pop esi pop ebp mov large fs:0, ecx pop ebx add esp, 88h retn 8 ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 100h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_404B10 proc near ; CODE XREF: sub_401F69j arg_0 = dword ptr 4 push esi push edi mov edi, ecx mov ecx, offset word_448CA2 call sub_4014D3 mov esi, [esp+8+arg_0] push eax lea ecx, [esi+7Eh] call sub_4012EE test eax, eax jz short loc_404B56 sub esp, 18h lea eax, [esi+15h] mov ecx, esp mov [esp+20h+arg_0], esp push eax call sub_4014C9 mov ecx, offset word_448C9E call sub_401CD0 test eax, eax jnz short loc_404B56 xor al, al pop edi pop esi retn 4 ; --------------------------------------------------------------------------- loc_404B56: ; CODE XREF: sub_404B10+1Dj ; sub_404B10+3Dj sub esp, 18h lea edx, [esi+15h] mov ecx, esp mov [esp+20h+arg_0], esp push edx call sub_4014C9 mov ecx, offset word_448C9E call sub_401CD0 test eax, eax jnz short loc_404B96 mov al, [edi+469h] test al, al jz short loc_404B96 push 0 lea ecx, [esi+2Ah] call sub_40146F cmp byte ptr [eax], 23h jz short loc_404B96 xor al, al pop edi pop esi retn 4 ; --------------------------------------------------------------------------- loc_404B96: ; CODE XREF: sub_404B10+64j ; sub_404B10+6Ej ... push esi mov ecx, edi call sub_401442 pop edi pop esi retn 4 sub_404B10 endp ; --------------------------------------------------------------------------- db 0Dh dup(90h) db 30h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_404BE0 proc near ; CODE XREF: sub_401442j arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push 1 lea ecx, [esi+7Eh] call sub_4017E4 push eax mov ecx, offset dword_447158 call sub_401AF0 test eax, eax jz short loc_404C0A mov ecx, [eax+2Ah] push esi mov eax, [ecx] call dword ptr [eax] pop esi retn 4 ; --------------------------------------------------------------------------- loc_404C0A: ; CODE XREF: sub_404BE0+1Cj xor al, al pop esi retn 4 sub_404BE0 endp ; --------------------------------------------------------------------------- db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_404C20: ; CODE XREF: ___:0040185Cj push esi push edi mov edi, dword_50F8A4 mov esi, ecx call edi mov edx, dword_4D60D9 mov ecx, [esi+421h] sub eax, edx cmp eax, ecx jbe short loc_404C4F mov ecx, offset byte_4D60B5 call sub_401D0C call edi mov dword_4D60D9, eax loc_404C4F: ; CODE XREF: ___:00404C3Cj pop edi mov al, 1 pop esi retn ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_404C70: ; CODE XREF: ___:004017C6j mov eax, large fs:0 push 0FFFFFFFFh push offset byte_43849B push eax mov large fs:0, esp sub esp, 15Ch push ebx push ebp push esi mov esi, [esp+178h] push edi mov edi, ecx lea ebp, [esi+7Eh] lea ecx, [edi+0C29h] call sub_4017E4 push eax mov ecx, ebp call sub_4012EE test eax, eax jnz short loc_404CE4 lea ecx, [esi+69h] call sub_4014D3 push eax lea ecx, [edi+2E3h] call sub_4014D3 mov cl, [esi+93h] push eax mov al, [esi+94h] push eax push ecx mov ecx, offset byte_4D60B5 call sub_401118 jmp loc_405675 ; --------------------------------------------------------------------------- loc_404CE4: ; CODE XREF: ___:00404CB0j lea ecx, [edi+0D6Bh] call sub_4017E4 push eax mov ecx, ebp call sub_4012EE test eax, eax jnz loc_404E75 push 1 push offset dword_443600 lea edx, [esp+34h] push 2 push edx mov ecx, esi call sub_4011EA push offset dword_443600 lea eax, [esp+7Ch] push 1 push eax mov ecx, esi mov dword ptr [esp+180h], 0 call sub_4016AE mov ecx, eax mov byte ptr [esp+174h], 1 call sub_4017E4 push eax nop call near ptr 77C1BF18h add esp, 4 cmp eax, 1 lea ecx, [esp+78h] mov byte ptr [esp+174h], 0 setz bl call sub_401226 lea ecx, [esp+14h] call sub_401424 push 2000h push 2000h lea ecx, [esp+1Ch] mov byte ptr [esp+17Ch], 2 call sub_401C5D push eax lea ecx, [esp+34h] call sub_4017E4 push eax call near ptr 27F0000h nop lea ecx, [esp+14h] push ecx lea ecx, [esp+30h] call sub_401FBE mov ecx, 11h xor eax, eax lea edi, [esp+0A8h] lea edx, [esp+5Ch] rep stosd lea eax, [esp+0A8h] push edx push eax push 0 neg bl push 0 push 28h sbb ebx, ebx push 1 and ebx, 5 push 0 push 0 lea ecx, [esp+4Ch] mov dword ptr [esp+0C8h], 44h mov [esp+0F8h], bx call sub_4014D3 push eax push 0 call near ptr 27E0000h nop test eax, eax jnz short loc_404E49 lea ecx, [esi+69h] call sub_4014D3 mov cl, [esi+94h] mov dl, [esi+93h] push eax push offset dword_4436FC push ecx push edx mov ecx, offset byte_4D60B5 call sub_401118 lea ecx, [esp+14h] mov byte ptr [esp+174h], 0 call sub_401226 mov dword ptr [esp+174h], 0FFFFFFFFh lea ecx, [esp+2Ch] jmp loc_40566E ; --------------------------------------------------------------------------- loc_404E49: ; CODE XREF: ___:00404DFCj lea ecx, [esp+14h] mov byte ptr [esp+174h], 0 call sub_401226 lea ecx, [esp+2Ch] mov dword ptr [esp+174h], 0FFFFFFFFh call sub_401226 mov al, 1 jmp loc_405675 ; --------------------------------------------------------------------------- loc_404E75: ; CODE XREF: ___:00404CF9j lea ecx, [edi+0B71h] call sub_4014D3 push eax mov ecx, ebp call sub_4012EE test eax, eax jnz loc_404F24 push 1 push offset dword_443600 lea eax, [esp+1Ch] push 1 push eax mov ecx, esi call sub_4011EA mov ecx, offset byte_4E6E85 mov dword ptr [esp+174h], 3 call sub_4017E4 push eax lea ecx, [esp+18h] call sub_4012EE test eax, eax jnz short loc_404F10 mov al, byte_4478D6 test al, al jz short loc_404EE0 push offset dword_447874 mov ecx, offset dword_448DB0 call sub_401447 loc_404EE0: ; CODE XREF: ___:00404ECFj mov al, byte_44791F test al, al jz short loc_404EF8 push offset byte_44794F mov ecx, offset dword_448DB0 call sub_401942 loc_404EF8: ; CODE XREF: ___:00404EE7j mov ecx, offset dword_448DB0 call sub_401E5B mov byte_4D60CC, 0 mov byte_4E6E84, 0 loc_404F10: ; CODE XREF: ___:00404EC6j mov dword ptr [esp+174h], 0FFFFFFFFh lea ecx, [esp+14h] jmp loc_40566E ; --------------------------------------------------------------------------- loc_404F24: ; CODE XREF: ___:00404E8Aj lea ecx, [edi+0C57h] call sub_4017E4 push eax mov ecx, ebp call sub_4012EE test eax, eax jnz short loc_404F6C lea ecx, [esi+69h] call sub_4014D3 push eax mov ecx, offset word_4E6E9A call sub_4014D3 mov cl, [esi+94h] mov dl, [esi+93h] push eax push ecx push edx mov ecx, offset byte_4D60B5 call sub_401118 jmp loc_405675 ; --------------------------------------------------------------------------- loc_404F6C: ; CODE XREF: ___:00404F39j lea ecx, [edi+0DC7h] call sub_4017E4 push eax mov ecx, ebp call sub_4012EE test eax, eax jnz loc_405029 push eax push 13h push 0Eh push 4 push 8 push 13h push 15h push 0Ch push 6 lea eax, [esp+50h] push 50h push eax call sub_4019B5 add esp, 2Ch mov esi, eax push 0 push 5 push 18h push 5 push 4Eh push 7 push 9 push 6 push 0Eh push 0Fh push 3 push 10h lea ecx, [esp+44h] push 9 push ecx mov dword ptr [esp+1ACh], 4 call sub_4019B5 add esp, 38h mov edi, eax mov ecx, esi mov byte ptr [esp+174h], 5 call sub_4017E4 push eax mov ecx, edi call sub_4017E4 push eax call sub_401299 add esp, 8 lea ecx, [esp+14h] mov byte ptr [esp+174h], 4 call sub_401226 lea ecx, [esp+2Ch] mov dword ptr [esp+174h], 0FFFFFFFFh call sub_401226 mov al, 1 jmp loc_405675 ; --------------------------------------------------------------------------- loc_405029: ; CODE XREF: ___:00404F81j lea ecx, [edi+0D0Fh] call sub_4017E4 push eax mov ecx, ebp call sub_4012EE test eax, eax jnz loc_405147 lea ecx, [esp+2Ch] call sub_401424 push offset dword_443600 lea edx, [esp+60h] push 1 push edx mov ecx, esi mov dword ptr [esp+180h], 6 call sub_4016AE mov ecx, eax mov byte ptr [esp+174h], 7 call sub_4017E4 push eax lea ecx, [esp+30h] call sub_401A87 lea ecx, [esp+5Ch] mov byte ptr [esp+174h], 6 call sub_401226 lea ecx, [esp+14h] call sub_401424 push 1 mov bl, 8 push 0 push 0 lea ecx, [esp+38h] mov [esp+180h], bl call sub_4017E4 push eax push offset dword_4436F4 push 0 nop call near ptr 7CA41110h movsx eax, al push eax lea ecx, [esp+60h] call sub_4020F4 lea ecx, [esp+5Ch] mov byte ptr [esp+174h], 9 push ecx lea ecx, [esp+18h] call sub_40200E lea ecx, [esp+5Ch] mov [esp+174h], bl call sub_401226 lea ecx, [esi+69h] call sub_4014D3 push eax lea ecx, [esp+18h] call sub_4014D3 mov dl, [esi+94h] push eax mov al, [esi+93h] push edx push eax mov ecx, offset byte_4D60B5 call sub_401118 lea ecx, [esp+14h] mov byte ptr [esp+174h], 6 call sub_401226 mov dword ptr [esp+174h], 0FFFFFFFFh lea ecx, [esp+2Ch] jmp loc_40566E ; --------------------------------------------------------------------------- loc_405147: ; CODE XREF: ___:0040503Ej lea ecx, [edi+0D99h] call sub_4017E4 push eax mov ecx, ebp call sub_4012EE test eax, eax jnz short loc_40516A mov byte_4D60CC, al mov al, 1 jmp loc_405675 ; --------------------------------------------------------------------------- loc_40516A: ; CODE XREF: ___:0040515Cj lea ecx, [edi+0D3Dh] call sub_4017E4 push eax mov ecx, ebp call sub_4012EE test eax, eax jnz loc_405431 lea ecx, [esp+5Ch] call sub_401424 push offset dword_443600 lea ecx, [esp+18h] push 1 mov ebx, 0Ah push ecx mov ecx, esi mov [esp+180h], ebx call sub_4016AE push offset dword_446F70 mov ecx, eax mov byte ptr [esp+178h], 0Bh call sub_4012EE test eax, eax lea ecx, [esp+14h] mov [esp+174h], bl setz byte ptr [esp+2Bh] call sub_401226 mov al, [esp+2Bh] test al, al jz short loc_4051F4 mov dword ptr [esp+174h], 0FFFFFFFFh lea ecx, [esp+5Ch] jmp loc_40566E ; --------------------------------------------------------------------------- loc_4051F4: ; CODE XREF: ___:004051DEj push offset dword_443600 lea edx, [esp+18h] push 1 push edx mov ecx, esi call sub_4016AE mov ecx, eax mov byte ptr [esp+174h], 0Ch call sub_4017E4 push eax call near ptr 71AB2BF4h nop lea ecx, [esp+14h] mov [esp+74h], eax mov [esp+174h], bl call sub_401226 mov eax, [esp+74h] or ebp, 0FFFFFFFFh cmp eax, ebp jz loc_4052C7 push 2 lea eax, [esp+78h] push 4 push eax nop call near ptr 71ABE479h mov edi, eax test edi, edi jz loc_4053A8 push offset dword_443600 lea ecx, [esp+18h] push 1 push ecx mov ecx, esi call sub_4016AE mov edx, [edi] mov ecx, eax push edx mov byte ptr [esp+178h], 0Dh call sub_4017E4 push eax lea eax, [esp+64h] push offset dword_4436E0 push eax call sub_40102D add esp, 10h lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 lea ecx, [esi+69h] call sub_4014D3 push eax lea ecx, [esp+60h] call sub_4014D3 mov cl, [esi+94h] mov dl, [esi+93h] push eax push ecx push edx jmp loc_40540E ; --------------------------------------------------------------------------- loc_4052C7: ; CODE XREF: ___:0040523Aj push offset dword_443600 lea eax, [esp+18h] push 1 push eax mov ecx, esi call sub_4016AE mov ecx, eax mov byte ptr [esp+174h], 0Eh call sub_4017E4 push eax nop call near ptr 71AB4FD4h lea ecx, [esp+14h] mov edi, eax mov [esp+174h], bl call sub_401226 test edi, edi jz loc_4053A8 mov ecx, [edi+0Ch] push offset dword_443600 lea eax, [esp+18h] push 1 mov edx, [ecx] push eax mov ecx, esi mov edi, [edx] call sub_4016AE mov ebp, eax push edi mov byte ptr [esp+178h], 0Fh nop call near ptr 71AB3F41h push eax mov ecx, ebp call sub_4017E4 push eax lea ecx, [esp+64h] push offset dword_4436D4 push ecx call sub_40102D add esp, 10h lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 lea ecx, [esi+69h] call sub_4014D3 push eax lea ecx, [esp+60h] call sub_4014D3 mov dl, [esi+94h] push eax mov al, [esi+93h] push edx push eax mov ecx, offset byte_4D60B5 call sub_401118 lea ecx, [esp+5Ch] mov bl, al mov dword ptr [esp+174h], 0FFFFFFFFh call sub_401226 mov al, bl jmp loc_405675 ; --------------------------------------------------------------------------- loc_4053A8: ; CODE XREF: ___:00405253j ; ___:00405304j push offset dword_443600 lea ecx, [esp+18h] push 1 push ecx mov ecx, esi call sub_4016AE mov ecx, eax mov byte ptr [esp+174h], 10h call sub_4017E4 push eax lea edx, [esp+60h] push offset dword_4436BC push edx call sub_40102D add esp, 0Ch lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 lea ecx, [esi+69h] call sub_4014D3 push eax lea ecx, [esp+60h] call sub_4014D3 mov cl, [esi+93h] push eax mov al, [esi+94h] push eax push ecx loc_40540E: ; CODE XREF: ___:004052C2j mov ecx, offset byte_4D60B5 call sub_401118 lea ecx, [esp+5Ch] mov bl, al mov [esp+174h], ebp call sub_401226 mov al, bl jmp loc_405675 ; --------------------------------------------------------------------------- loc_405431: ; CODE XREF: ___:0040517Fj lea ecx, [edi+0BCDh] call sub_4017E4 push eax mov ecx, ebp call sub_4012EE test eax, eax jnz loc_405522 lea ecx, [edi+9] call sub_4017E4 lea edx, [esp+14h] push eax push edx call sub_402022 add esp, 8 push 0 push 25h push 1Dh push 23h lea eax, [esp+3Ch] mov ebx, 11h push 28h push eax mov [esp+18Ch], ebx call sub_4019B5 add esp, 18h mov esi, eax lea ecx, [esp+14h] mov byte ptr [esp+174h], 12h call sub_4017E4 push eax mov ecx, esi call sub_4017E4 push eax push offset dword_4435F4 push offset byte_4D60B5 call sub_401E0B add esp, 10h lea ecx, [esp+2Ch] mov [esp+174h], bl call sub_401226 push 20h lea ecx, [esp+30h] push 0 push ecx lea ecx, [esp+20h] call sub_4012B2 mov ecx, eax mov byte ptr [esp+174h], 13h call sub_4017E4 push eax push offset dword_4435F0 push offset byte_4E6E85 call sub_40102D add esp, 0Ch lea ecx, [esp+2Ch] mov [esp+174h], bl call sub_401226 lea ecx, [esp+14h] mov dword ptr [esp+174h], 0FFFFFFFFh call sub_401226 mov al, 1 jmp loc_405675 ; --------------------------------------------------------------------------- loc_405522: ; CODE XREF: ___:00405446j lea ecx, [edi+0E23h] call sub_4017E4 push eax mov ecx, ebp call sub_4012EE test eax, eax jnz loc_405690 push offset dword_443600 lea edx, [esp+60h] push 1 push edx mov ecx, esi call sub_4016AE mov edi, eax mov ecx, ebp mov dword ptr [esp+174h], 14h call sub_4013D9 mov ecx, edi mov ebx, eax call sub_4013D9 mov ecx, esi lea edi, [ebx+eax+3] call sub_4013D9 cmp eax, edi lea ecx, [esp+5Ch] setle bl or edi, 0FFFFFFFFh mov [esp+174h], edi call sub_401226 test bl, bl jnz loc_405673 lea ecx, [esp+2Ch] call sub_401424 mov ecx, ebp mov dword ptr [esp+174h], 15h call sub_4013D9 add eax, 2 mov ecx, esi push eax call sub_40146F push eax lea ecx, [esp+30h] call sub_4015D7 lea ecx, [esp+14h] call sub_401424 lea ecx, [esp+2Ch] mov byte ptr [esp+174h], 16h call sub_4017E4 push eax lea eax, [esp+18h] push offset dword_4436AC push eax call sub_40102D add esp, 0Ch lea ecx, [esp+2Ch] call sub_4017E4 push eax nop call near ptr 77C293C7h add esp, 4 cmp eax, edi lea ecx, [esi+69h] jnz short loc_40562A call sub_4014D3 mov cl, [esi+94h] mov dl, [esi+93h] push eax push offset dword_4436FC push ecx push edx jmp short loc_405648 ; --------------------------------------------------------------------------- loc_40562A: ; CODE XREF: ___:0040560Dj call sub_4014D3 push eax lea ecx, [esp+18h] call sub_4014D3 mov cl, [esi+93h] push eax mov al, [esi+94h] push eax push ecx loc_405648: ; CODE XREF: ___:00405628j mov ecx, offset byte_4D60B5 call sub_401118 lea ecx, [esp+14h] mov byte ptr [esp+174h], 15h call sub_401226 mov [esp+174h], edi lea ecx, [esp+2Ch] loc_40566E: ; CODE XREF: ___:00404E44j ; ___:00404F1Fj ... call sub_401226 loc_405673: ; CODE XREF: ___:00405592j ; ___:004058E0j xor al, al loc_405675: ; CODE XREF: ___:00404CDFj ; ___:00404E70j ... mov ecx, [esp+16Ch] pop edi pop esi pop ebp pop ebx mov large fs:0, ecx add esp, 168h retn 4 ; --------------------------------------------------------------------------- loc_405690: ; CODE XREF: ___:00405537j lea ecx, [edi+0C85h] call sub_4017E4 push eax mov ecx, ebp call sub_4012EE test eax, eax jnz short loc_405706 lea edx, [esp+14h] mov ecx, edi push edx call sub_401F3C mov edi, eax lea ecx, [esi+69h] mov dword ptr [esp+174h], 17h call sub_4014D3 push eax mov ecx, edi call sub_4014D3 mov cl, [esi+93h] push eax mov al, [esi+94h] push eax push ecx mov ecx, offset byte_4D60B5 call sub_401118 lea ecx, [esp+14h] mov bl, al mov dword ptr [esp+174h], 0FFFFFFFFh call sub_401226 mov al, bl jmp loc_405675 ; --------------------------------------------------------------------------- loc_405706: ; CODE XREF: ___:004056A5j lea ecx, [edi+0CE1h] call sub_4017E4 push eax mov ecx, ebp call sub_4012EE test eax, eax jnz loc_4057F7 push 1 push offset dword_443600 lea edx, [esp+34h] push 1 push edx mov ecx, esi call sub_4011EA push 20h lea ecx, [esp+18h] push 0 push ecx mov ecx, eax mov dword ptr [esp+180h], 18h call sub_4012B2 mov ecx, eax mov byte ptr [esp+174h], 19h call sub_4017E4 push eax push offset dword_4435F0 push offset byte_4E6E85 call sub_40102D add esp, 0Ch lea ecx, [esp+14h] mov byte ptr [esp+174h], 18h call sub_401226 or edi, 0FFFFFFFFh lea ecx, [esp+2Ch] mov [esp+174h], edi call sub_401226 push 0 push 25h push 1Dh push 23h lea edx, [esp+24h] push 28h push edx call sub_4019B5 add esp, 18h mov esi, eax mov ecx, offset byte_4E6E85 mov dword ptr [esp+174h], 1Ah call sub_4017E4 push eax mov ecx, esi call sub_4017E4 push eax push offset dword_4435F4 push offset byte_4D60B5 call sub_401E0B add esp, 10h lea ecx, [esp+14h] mov [esp+174h], edi call sub_401226 mov al, 1 jmp loc_405675 ; --------------------------------------------------------------------------- loc_4057F7: ; CODE XREF: ___:0040571Bj lea ecx, [edi+0CB3h] call sub_4017E4 push eax mov ecx, ebp call sub_4012EE test eax, eax jnz loc_4058CB push offset dword_443600 lea eax, [esp+30h] push 1 push eax mov ecx, esi call sub_4016AE mov ecx, eax mov dword ptr [esp+174h], 1Bh call sub_4017E4 push eax call near ptr 77C1BF18h nop or ebp, 0FFFFFFFFh add esp, 4 lea ecx, [esp+2Ch] mov ebx, eax mov [esp+174h], ebp call sub_401226 test ebx, ebx jnz short loc_40585F mov ebx, 7 loc_40585F: ; CODE XREF: ___:00405858j lea ecx, [esp+14h] push ebx push ecx mov ecx, edi call sub_40194C push offset dword_446F70 lea ecx, [esp+18h] mov dword ptr [esp+178h], 1Ch call sub_4012EE test eax, eax jz short loc_4058B4 lea ecx, [esi+69h] call sub_4014D3 push eax lea ecx, [esp+18h] call sub_4014D3 mov dl, [esi+94h] push eax mov al, [esi+93h] push edx push eax mov ecx, offset byte_4D60B5 call sub_401118 loc_4058B4: ; CODE XREF: ___:00405887j lea ecx, [esp+14h] mov [esp+174h], ebp call sub_401226 mov al, 1 jmp loc_405675 ; --------------------------------------------------------------------------- loc_4058CB: ; CODE XREF: ___:0040580Cj lea ecx, [edi+0DF5h] call sub_4017E4 push eax mov ecx, ebp call sub_4012EE test eax, eax jnz loc_405673 lea ecx, [esp+78h] call sub_401424 push 0 push 0Eh push 15h push 2Ch push 50h push 0Eh push 0Fh push 9 push 13h push 12h push 5 push 30h push 14h push 0Eh push 5 push 12h push 12h push 15h push 1Dh push 50h push 13h push 17h push 0Fh push 4 push 0Eh push 9 push 31h push 50h push 14h push 6 push 0Fh push 13h push 0Fh push 12h push 3 push 9 push 27h push 50h push 5 push 12h push 1 push 17h push 14h push 6 push 0Fh lea ecx, [esp+0C8h] push 2Dh push ecx mov dword ptr [esp+230h], 1Dh call sub_4019B5 add esp, 0BCh mov ecx, eax mov byte ptr [esp+174h], 1Eh call sub_4017E4 push eax lea ecx, [esp+7Ch] call sub_401A87 lea ecx, [esp+14h] mov byte ptr [esp+174h], 1Dh call sub_401226 mov edi, offset dword_4436A8 or ecx, 0FFFFFFFFh xor eax, eax lea edx, [esp+0ECh] repne scasb not ecx sub edi, ecx mov dword ptr [esp+10h], 0 mov eax, ecx mov esi, edi mov edi, edx shr ecx, 2 rep movsd mov ecx, eax and ecx, 3 rep movsb lea edi, [esp+0ECh] or ecx, 0FFFFFFFFh xor eax, eax repne scasb not ecx dec ecx mov esi, dword_50F75C mov edi, ecx lea ecx, [esp+10h] push ecx push 20019h push eax push offset dword_44368C push 80000002h call esi push 0 push 27h push 29h push 1Dh push 1Eh push 5 push 0Ch push 2 push 1 push 0Eh lea edx, [esp+3Ch] push 1Fh push edx call sub_4019B5 add esp, 30h lea ecx, [esp+0ECh] push edi push ecx push 1 push 0 mov ecx, eax mov byte ptr [esp+184h], 1Fh call sub_4017E4 mov edx, [esp+20h] push eax push edx call near ptr 2930000h nop lea ecx, [esp+14h] mov byte ptr [esp+174h], 1Dh call sub_401226 mov eax, [esp+10h] mov edi, dword_50F738 push eax call edi lea ecx, [esp+10h] push ecx push 0F003Fh push 0 lea ecx, [esp+84h] call sub_4017E4 push eax push 80000002h call esi push 0 push 5 push 18h push 5 push 4Eh push 5 push 14h push 1 push 13h lea edx, [esp+38h] push 2Dh push edx call sub_4019B5 add esp, 2Ch mov ecx, eax mov byte ptr [esp+174h], 20h call sub_4017E4 mov ebp, dword_50F764 push eax mov eax, [esp+14h] push eax call ebp lea ecx, [esp+14h] mov byte ptr [esp+174h], 1Dh call sub_401226 mov ecx, [esp+10h] push ecx call edi push 0 push 5 push 18h push 5 push 4Eh push 48h push 0Eh push 15h push 12h lea edx, [esp+38h] push 9 push edx call sub_4019B5 add esp, 2Ch mov ecx, eax mov byte ptr [esp+174h], 21h call sub_4017E4 push eax call sub_4015FA add esp, 4 lea ecx, [esp+14h] mov byte ptr [esp+174h], 1Dh call sub_401226 lea ecx, [esp+44h] call sub_401424 mov bl, 22h push 104h push 104h lea ecx, [esp+4Ch] mov [esp+17Ch], bl call sub_401C5D push eax nop call near ptr 27D09BAh push 0 push 5 push 18h push 5 push 4Eh push 48h push 0Eh push 15h push 12h lea eax, [esp+38h] push 9 push eax call sub_4019B5 add esp, 2Ch mov ecx, eax mov byte ptr [esp+174h], 23h call sub_4017E4 push eax lea ecx, [esp+48h] call sub_4017E4 push eax lea ecx, [esp+4Ch] push offset dword_443684 push ecx call sub_40102D add esp, 10h lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 lea ecx, [esp+44h] call sub_401681 push eax nop call near ptr 27D0894h lea edx, [esp+10h] lea ecx, [esp+78h] push edx push 0F003Fh push 0 call sub_4017E4 push eax push 80000002h call esi push 0 push 5 push 18h push 5 push 4Eh push 5 push 14h push 1 lea eax, [esp+34h] push 12h push eax call sub_4019B5 add esp, 28h mov ecx, eax mov byte ptr [esp+174h], 24h call sub_4017E4 mov ecx, [esp+10h] push eax push ecx call ebp lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 mov edx, [esp+10h] push edx call edi push 0 push 5 push 18h push 5 push 4Eh push 48h push 0Eh push 48h push 49h push 12h push 45h push 45h lea eax, [esp+44h] push 9 push eax call sub_4019B5 add esp, 38h mov ecx, eax mov byte ptr [esp+174h], 25h call sub_4017E4 push eax call sub_4015FA add esp, 4 lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 push 104h push 104h lea ecx, [esp+4Ch] call sub_401C5D push eax call near ptr 27D09BAh nop push 0 push 5 push 18h push 5 push 4Eh push 48h push 0Eh push 48h push 49h push 12h push 45h push 45h lea ecx, [esp+44h] push 9 push ecx call sub_4019B5 add esp, 38h mov ecx, eax mov byte ptr [esp+174h], 26h call sub_4017E4 push eax lea ecx, [esp+48h] call sub_4017E4 push eax lea edx, [esp+4Ch] push offset dword_443684 push edx call sub_40102D add esp, 10h lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 lea ecx, [esp+44h] call sub_401681 push eax nop call near ptr 27D0894h lea eax, [esp+10h] lea ecx, [esp+78h] push eax push 0F003Fh push 0 call sub_4017E4 push eax push 80000002h call esi push 0 push 5 push 18h push 5 push 4Eh push 5 push 14h push 1 push 13h lea ecx, [esp+38h] push 13h push ecx call sub_4019B5 add esp, 2Ch mov ecx, eax mov byte ptr [esp+174h], 27h call sub_4017E4 mov edx, [esp+10h] push eax push edx call ebp lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 mov eax, [esp+10h] push eax call edi push 0 push 5 push 18h push 5 push 4Eh push 13h push 19h push 13h push 0Eh push 9 lea ecx, [esp+3Ch] push 17h push ecx call sub_4019B5 add esp, 30h mov ecx, eax mov byte ptr [esp+174h], 28h call sub_4017E4 push eax call sub_4015FA add esp, 4 lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 push 104h push 104h lea ecx, [esp+4Ch] call sub_401C5D push eax nop call near ptr 27D09BAh push 0 push 5 push 18h push 5 push 4Eh push 13h push 19h push 13h push 0Eh push 9 lea edx, [esp+3Ch] push 17h push edx call sub_4019B5 add esp, 30h mov ecx, eax mov byte ptr [esp+174h], 29h call sub_4017E4 push eax lea ecx, [esp+48h] call sub_4017E4 push eax lea eax, [esp+4Ch] push offset dword_443684 push eax call sub_40102D add esp, 10h lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 lea ecx, [esp+44h] call sub_401681 push eax call near ptr 27D0894h nop lea ecx, [esp+10h] push ecx push 0F003Fh push 0 lea ecx, [esp+84h] call sub_4017E4 push eax push 80000002h call esi push 0 push 5 push 18h push 5 push 4Eh push 5 push 14h push 1 push 4 push 10h push 15h push 4 push 47h lea edx, [esp+48h] push 4 push edx call sub_4019B5 add esp, 3Ch mov ecx, eax mov byte ptr [esp+174h], 2Ah call sub_4017E4 push eax mov eax, [esp+14h] push eax call ebp lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 mov ecx, [esp+10h] push ecx call edi push 0 push 5 push 18h push 5 push 4Eh push 5 push 0Ch push 7 push 1 push 5 push 2 lea edx, [esp+40h] push 2 push edx call sub_4019B5 add esp, 34h mov ecx, eax mov byte ptr [esp+174h], 2Bh call sub_4017E4 push eax call sub_4015FA add esp, 4 lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 push 104h push 104h lea ecx, [esp+4Ch] call sub_401C5D push eax call near ptr 27D09BAh nop push 0 push 5 push 18h push 5 push 4Eh push 5 push 0Ch push 7 push 1 push 5 push 2 lea eax, [esp+40h] push 2 push eax call sub_4019B5 add esp, 34h mov ecx, eax mov byte ptr [esp+174h], 2Ch call sub_4017E4 push eax lea ecx, [esp+48h] call sub_4017E4 push eax lea ecx, [esp+4Ch] push offset dword_443684 push ecx call sub_40102D add esp, 10h lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 lea ecx, [esp+44h] call sub_401681 push eax call near ptr 27D0894h nop lea edx, [esp+10h] lea ecx, [esp+78h] push edx push 0F003Fh push 0 call sub_4017E4 push eax push 80000002h call esi push 0 push 0Eh push 0Fh push 27h push 0Bh push 13h push 1 lea eax, [esp+30h] push 2Eh push eax call sub_4019B5 add esp, 24h mov ecx, eax mov byte ptr [esp+174h], 2Dh call sub_4017E4 mov ecx, [esp+10h] push eax push ecx call ebp lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 mov edx, [esp+10h] push edx call edi push 0 push 5 push 18h push 5 push 4Eh push 0Eh push 0Fh push 0Dh push 0Bh push 13h push 1 lea eax, [esp+40h] push 14h push eax call sub_4019B5 add esp, 34h mov ecx, eax mov byte ptr [esp+174h], 2Eh call sub_4017E4 push eax call sub_4015FA add esp, 4 lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 push 104h push 104h lea ecx, [esp+4Ch] call sub_401C5D push eax nop call near ptr 27D09BAh push 0 push 5 push 18h push 5 push 4Eh push 0Eh push 0Fh push 0Dh push 0Bh push 13h push 1 lea ecx, [esp+40h] push 14h push ecx call sub_4019B5 add esp, 34h mov ecx, eax mov byte ptr [esp+174h], 2Fh call sub_4017E4 push eax lea ecx, [esp+48h] call sub_4017E4 push eax push offset dword_443684 lea edx, [esp+50h] push edx call sub_40102D add esp, 10h lea ecx, [esp+14h] mov [esp+174h], bl call sub_401226 lea ecx, [esp+44h] call sub_401681 push eax nop call near ptr 27D0894h lea eax, [esp+10h] lea ecx, [esp+78h] push eax push 0F003Fh push 0 call sub_4017E4 push eax push 80000002h call esi push 0 push 12h push 5 push 12h push 0Fh push 0Ch push 10h push 18h lea ecx, [esp+0B0h] push 1Fh push ecx call sub_4019B5 add esp, 28h mov ecx, eax mov byte ptr [esp+174h], 30h call sub_4017E4 mov edx, [esp+10h] push eax push edx call ebp lea ecx, [esp+90h] mov [esp+174h], bl call sub_401226 mov eax, [esp+10h] push eax call edi mov esi, dword_50FB04 push offset dword_443668 call esi push offset dword_44364C call esi push offset dword_44362C call esi push offset dword_443608 call esi add esp, 10h lea ecx, [esp+44h] mov byte ptr [esp+174h], 1Dh call sub_401226 lea ecx, [esp+78h] mov dword ptr [esp+174h], 0FFFFFFFFh call sub_401226 mov al, 1 jmp loc_405675 ; --------------------------------------------------------------------------- db 4 dup(90h) db 550h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4066E0 proc near ; CODE XREF: sub_40194Cj var_28 = dword ptr -28h var_24 = byte ptr -24h var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 push 0FFFFFFFFh push offset SEH_4066E0 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 1Ch push ebx push ebp push esi xor ebx, ebx push edi lea ecx, [esp+38h+var_24] mov [esp+38h+var_28], ebx call sub_401424 mov esi, [esp+38h+arg_4] mov ebp, 1 cmp esi, ebx mov [esp+38h+var_4], ebp jnz short loc_406731 mov esi, [esp+38h+arg_0] push ebx mov ecx, esi call sub_4020F4 mov [esp+38h+var_28], ebp jmp loc_4067D7 ; --------------------------------------------------------------------------- loc_406731: ; CODE XREF: sub_4066E0+3Aj nop call near ptr 27D07BFh mov ecx, eax mov eax, 10624DD3h mul ecx mov ecx, edx mov eax, 0C22E4507h shr ecx, 6 imul ecx add edx, ecx sar edx, 10h mov eax, edx shr eax, 1Fh add edx, eax mov edi, edx cmp edi, esi jl short loc_4067C3 mov eax, ecx mov ecx, 15180h cdq idiv ecx mov esi, 0E10h mov ecx, edx mov eax, ecx cdq idiv esi mov eax, 88888889h mov esi, edx imul esi add edx, esi sar edx, 5 mov eax, edx shr eax, 1Fh add edx, eax mov eax, 91A2B3C5h push edx imul ecx add edx, ecx sar edx, 0Bh mov ecx, edx shr ecx, 1Fh add edx, ecx push edx push edi lea edx, [esp+44h+var_24] push offset dword_44370C push edx call sub_40102D mov esi, [esp+4Ch+arg_0] add esp, 14h lea eax, [esp+38h+var_24] mov ecx, esi push eax call sub_4014C9 jmp short loc_4067D3 ; --------------------------------------------------------------------------- loc_4067C3: ; CODE XREF: sub_4066E0+7Cj mov esi, [esp+38h+arg_0] push offset dword_446F70 mov ecx, esi call sub_401861 loc_4067D3: ; CODE XREF: sub_4066E0+E1j mov [esp+38h+var_28], ebp loc_4067D7: ; CODE XREF: sub_4066E0+4Cj lea ecx, [esp+38h+var_24] mov byte ptr [esp+38h+var_4], bl call sub_401226 mov ecx, [esp+38h+var_C] mov eax, esi pop edi pop esi pop ebp pop ebx mov large fs:0, ecx add esp, 28h retn 8 sub_4066E0 endp ; --------------------------------------------------------------------------- db 5 dup(90h) db 50h dup(0CCh) ; --------------------------------------------------------------------------- loc_406850: ; CODE XREF: ___:00401668j push ecx push esi mov esi, [esp+0Ch] push offset dword_446F70 mov ecx, esi mov dword ptr [esp+8], 0 call sub_401861 mov eax, esi pop esi pop ecx retn 4 ; --------------------------------------------------------------------------- db 0Fh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_406890 proc near ; CODE XREF: sub_401F3Cj var_198 = dword ptr -198h var_194 = dword ptr -194h var_190 = dword ptr -190h var_18C = byte ptr -18Ch var_174 = byte ptr -174h var_164 = byte ptr -164h var_14C = byte ptr -14Ch var_144 = dword ptr -144h var_140 = dword ptr -140h var_12C = dword ptr -12Ch var_128 = dword ptr -128h var_124 = dword ptr -124h var_120 = dword ptr -120h var_11C = dword ptr -11Ch var_118 = byte ptr -118h var_98 = byte ptr -98h var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 4 push 0FFFFFFFFh push offset SEH_406890 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 18Ch push ebp push esi push edi lea ecx, [esp+1A4h+var_18C] mov [esp+1A4h+var_198], 0 call sub_401424 mov [esp+1A4h+var_4], 1 nop call near ptr 27D07BFh mov ecx, eax mov eax, 10624DD3h mul ecx mov esi, edx lea edx, [esp+1A4h+var_14C] push edx mov [esp+1A8h+var_190], 10h shr esi, 6 mov [esp+1A8h+var_194], 15h call near ptr 2810000h nop lea eax, [esp+1A4h+var_12C] mov [esp+1A4h+var_12C], 94h push eax nop call near ptr 2800000h mov eax, [esp+1A4h+var_128] cmp eax, 4 jnz short loc_40695E mov eax, [esp+1A4h+var_124] test eax, eax jnz short loc_406946 mov eax, [esp+1A4h+var_11C] cmp eax, 1 jnz short loc_406936 mov ebp, offset dword_4437C8 jmp loc_4069D1 ; --------------------------------------------------------------------------- loc_406936: ; CODE XREF: sub_406890+9Aj cmp eax, 2 jnz loc_4069CD mov ebp, offset dword_4437C4 jmp short loc_40699A ; --------------------------------------------------------------------------- loc_406946: ; CODE XREF: sub_406890+8Ej cmp eax, 0Ah jnz short loc_406952 mov ebp, offset dword_4437C0 jmp short loc_406990 ; --------------------------------------------------------------------------- loc_406952: ; CODE XREF: sub_406890+B9j cmp eax, 5Ah jnz short loc_40698B mov ebp, offset dword_4437BC jmp short loc_406990 ; --------------------------------------------------------------------------- loc_40695E: ; CODE XREF: sub_406890+83j cmp eax, 5 jnz short loc_40698B mov eax, [esp+1A4h+var_124] test eax, eax jnz short loc_406975 mov ebp, offset dword_4437B4 jmp short loc_406990 ; --------------------------------------------------------------------------- loc_406975: ; CODE XREF: sub_406890+DCj cmp eax, 1 jnz short loc_406981 mov ebp, offset dword_4437B0 jmp short loc_406990 ; --------------------------------------------------------------------------- loc_406981: ; CODE XREF: sub_406890+E8j cmp eax, 2 mov ebp, offset dword_4437A8 jz short loc_406990 loc_40698B: ; CODE XREF: sub_406890+C5j ; sub_406890+D1j mov ebp, offset dword_4437A4 loc_406990: ; CODE XREF: sub_406890+C0j ; sub_406890+CCj ... cmp [esp+1A4h+var_11C], 2 jnz short loc_4069D1 loc_40699A: ; CODE XREF: sub_406890+B4j mov al, [esp+1A4h+var_118] test al, al jz short loc_4069D1 lea ecx, [esp+1A4h+var_118] lea edx, [esp+1A4h+var_98] push ecx push ebp push offset dword_443798 push edx call near ptr byte_5EE1E5 nop add esp, 10h lea ebp, [esp+1A4h+var_98] jmp short loc_4069D1 ; --------------------------------------------------------------------------- loc_4069CD: ; CODE XREF: sub_406890+A9j mov ebp, [esp+1A4h+var_198] loc_4069D1: ; CODE XREF: sub_406890+A1j ; sub_406890+108j ... lea eax, [esp+1A4h+var_190] lea ecx, [esp+1A4h+var_174] push eax push ecx nop call near ptr 27F11C9h lea edx, [esp+1A4h+var_194] lea eax, [esp+1A4h+var_164] push edx push eax call near ptr 2910DB9h nop mov eax, esi mov ecx, 15180h cdq idiv ecx lea eax, [esp+1A4h+var_174] mov edi, 0E10h mov ecx, edx lea edx, [esp+1A4h+var_164] push edx push eax mov eax, ecx cdq idiv edi mov eax, 88888889h mov edi, edx imul edi add edx, edi sar edx, 5 mov eax, edx shr eax, 1Fh add edx, eax mov eax, 91A2B3C5h push edx imul ecx add edx, ecx mov eax, 0C22E4507h sar edx, 0Bh mov ecx, edx shr ecx, 1Fh add edx, ecx mov ecx, [esp+1B0h+var_120] push edx imul esi add edx, esi sar edx, 10h mov eax, edx shr eax, 1Fh add edx, eax mov eax, [esp+1B4h+var_128] push edx mov edx, [esp+1B8h+var_124] push ecx mov ecx, [esp+1BCh+var_144] push edx push eax mov eax, 804021h push ebp mul ecx sub ecx, edx mov eax, 804021h shr ecx, 1 add ecx, edx shr ecx, 13h push ecx mov ecx, [esp+1CCh+var_140] mul ecx sub ecx, edx shr ecx, 1 add ecx, edx shr ecx, 13h push ecx call sub_4017F3 push eax lea ecx, [esp+1D4h+var_18C] push offset dword_443720 push ecx call sub_40102D mov esi, [esp+1DCh+arg_0] add esp, 38h lea edx, [esp+1A4h+var_18C] push edx mov ecx, esi call sub_4014C9 mov [esp+1A4h+var_198], 1 lea ecx, [esp+1A4h+var_18C] mov byte ptr [esp+1A4h+var_4], 0 call sub_401226 mov ecx, [esp+1A4h+var_C] mov eax, esi pop edi pop esi pop ebp mov large fs:0, ecx add esp, 198h retn 4 sub_406890 endp ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 0A0h dup(0CCh) ; --------------------------------------------------------------------------- loc_406BA0: ; CODE XREF: ___:004015DCj mov eax, ecx mov dword ptr [eax], offset dword_43E008 mov dword ptr [eax+110h], 0 retn ; --------------------------------------------------------------------------- db 0Dh dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_406BD0: ; CODE XREF: ___:00401F8Cj ; ___:00402009j push esi mov esi, ecx call sub_40143D test byte ptr [esp+8], 1 jz short loc_406BE8 push esi call near ptr word_4367E2 add esp, 4 loc_406BE8: ; CODE XREF: ___:00406BDDj mov eax, esi pop esi retn 4 ; --------------------------------------------------------------------------- db 2 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_406C00 proc near ; CODE XREF: sub_40143Dj mov dword ptr [ecx], offset dword_43E008 mov ecx, [ecx+110h] test ecx, ecx jz short locret_406C17 push ecx call near ptr word_4367E2 pop ecx locret_406C17: ; CODE XREF: sub_406C00+Ej retn sub_406C00 endp ; --------------------------------------------------------------------------- db 8 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_406C30: ; CODE XREF: ___:00401384j mov eax, large fs:0 push 0FFFFFFFFh push offset byte_4385D1 push eax mov large fs:0, esp sub esp, 448h push ebx mov ebx, ecx mov eax, [ebx+110h] test eax, eax jz short loc_406C61 push eax call near ptr word_4367E2 add esp, 4 loc_406C61: ; CODE XREF: ___:00406C56j push ebp push esi mov esi, [esp+464h] push edi mov edi, esi or ecx, 0FFFFFFFFh xor eax, eax repne scasb not ecx push ecx call near ptr word_4367FA mov edx, eax mov edi, esi or ecx, 0FFFFFFFFh xor eax, eax mov [ebx+110h], edx repne scasb not ecx sub edi, ecx mov eax, ecx mov esi, edi mov edi, edx shr ecx, 2 rep movsd mov ecx, eax xor eax, eax and ecx, 3 rep movsb mov edi, [ebx+110h] or ecx, 0FFFFFFFFh mov byte ptr [ebx+4], 0 mov dword ptr [ebx+5], 0 mov byte ptr [ebx+9], 0 mov byte ptr [ebx+0Ah], 0 mov byte ptr [ebx+0Bh], 0 repne scasb not ecx push ecx call near ptr word_4367FA mov edi, [ebx+110h] mov edx, eax or ecx, 0FFFFFFFFh xor eax, eax repne scasb not ecx sub edi, ecx mov ebp, dword_50FAF4 mov eax, ecx mov esi, edi mov edi, edx push offset dword_443600 shr ecx, 2 rep movsd mov ecx, eax push edx and ecx, 3 rep movsb call ebp add esp, 10h mov [esp+58h], eax lea esi, [esp+5Ch] mov edi, 0FFh loc_406D12: ; CODE XREF: ___:00406D24j push offset dword_443600 push 0 call ebp mov [esi], eax add esp, 8 add esi, 4 dec edi jnz short loc_406D12 mov eax, [esp+58h] xor ecx, ecx cmp eax, ecx jz loc_406F18 lea ebp, [esp+58h] loc_406D38: ; CODE XREF: ___:00406F10j mov edi, [ebp+0] mov esi, offset dword_4437EC mov eax, edi loc_406D42: ; CODE XREF: ___:00406D60j mov dl, [eax] mov cl, dl cmp dl, [esi] jnz short loc_406D66 test cl, cl jz short loc_406D62 mov dl, [eax+1] mov cl, dl cmp dl, [esi+1] jnz short loc_406D66 add eax, 2 add esi, 2 test cl, cl jnz short loc_406D42 loc_406D62: ; CODE XREF: ___:00406D4Cj xor eax, eax jmp short loc_406D6B ; --------------------------------------------------------------------------- loc_406D66: ; CODE XREF: ___:00406D48j ; ___:00406D56j sbb eax, eax sbb eax, 0FFFFFFFFh loc_406D6B: ; CODE XREF: ___:00406D64j test eax, eax jz loc_406F08 mov esi, offset dword_4437E0 mov eax, edi loc_406D7A: ; CODE XREF: ___:00406D98j mov dl, [eax] mov cl, dl cmp dl, [esi] jnz short loc_406D9E test cl, cl jz short loc_406D9A mov dl, [eax+1] mov cl, dl cmp dl, [esi+1] jnz short loc_406D9E add eax, 2 add esi, 2 test cl, cl jnz short loc_406D7A loc_406D9A: ; CODE XREF: ___:00406D84j xor eax, eax jmp short loc_406DA3 ; --------------------------------------------------------------------------- loc_406D9E: ; CODE XREF: ___:00406D80j ; ___:00406D8Ej sbb eax, eax sbb eax, 0FFFFFFFFh loc_406DA3: ; CODE XREF: ___:00406D9Cj test eax, eax jnz short loc_406DB0 mov byte ptr [ebx+9], 1 jmp loc_406F08 ; --------------------------------------------------------------------------- loc_406DB0: ; CODE XREF: ___:00406DA5j mov esi, offset dword_4437D4 mov eax, edi loc_406DB7: ; CODE XREF: ___:00406DD5j mov dl, [eax] mov cl, dl cmp dl, [esi] jnz short loc_406DDB test cl, cl jz short loc_406DD7 mov dl, [eax+1] mov cl, dl cmp dl, [esi+1] jnz short loc_406DDB add eax, 2 add esi, 2 test cl, cl jnz short loc_406DB7 loc_406DD7: ; CODE XREF: ___:00406DC1j xor eax, eax jmp short loc_406DE0 ; --------------------------------------------------------------------------- loc_406DDB: ; CODE XREF: ___:00406DBDj ; ___:00406DCBj sbb eax, eax sbb eax, 0FFFFFFFFh loc_406DE0: ; CODE XREF: ___:00406DD9j test eax, eax jnz short loc_406DED mov byte ptr [ebx+0Ah], 1 jmp loc_406F08 ; --------------------------------------------------------------------------- loc_406DED: ; CODE XREF: ___:00406DE2j mov esi, offset dword_4437CC mov eax, edi loc_406DF4: ; CODE XREF: ___:00406E12j mov dl, [eax] mov cl, dl cmp dl, [esi] jnz short loc_406E18 test cl, cl jz short loc_406E14 mov dl, [eax+1] mov cl, dl cmp dl, [esi+1] jnz short loc_406E18 add eax, 2 add esi, 2 test cl, cl jnz short loc_406DF4 loc_406E14: ; CODE XREF: ___:00406DFEj xor eax, eax jmp short loc_406E1D ; --------------------------------------------------------------------------- loc_406E18: ; CODE XREF: ___:00406DFAj ; ___:00406E08j sbb eax, eax sbb eax, 0FFFFFFFFh loc_406E1D: ; CODE XREF: ___:00406E16j test eax, eax jnz loc_406F08 lea ecx, [esp+10h] call sub_401424 mov eax, [esp+468h] push offset dword_4437CC push eax mov dword ptr [esp+468h], 0 call near ptr 77C47C60h nop add esp, 8 test eax, eax jz loc_406EF4 push eax lea ecx, [esp+14h] call sub_4015D7 push 1 push offset dword_443600 lea ecx, [esp+30h] push 1 push ecx lea ecx, [esp+20h] call sub_4011EA push offset dword_446F70 mov ecx, eax mov byte ptr [esp+464h], 1 call sub_4012EE lea ecx, [esp+28h] mov esi, eax mov byte ptr [esp+460h], 0 call sub_401226 test esi, esi jz short loc_406EF4 push 1 push offset dword_443600 lea edx, [esp+48h] push 1 push edx lea ecx, [esp+20h] mov byte ptr [ebx+0Bh], 1 call sub_4011EA push 104h mov ecx, eax mov byte ptr [esp+464h], 2 call sub_401681 push eax lea eax, [ebx+0Ch] push eax nop call near ptr 77C47A90h add esp, 0Ch lea ecx, [esp+40h] mov byte ptr [esp+460h], 0 call sub_401226 add ebp, 4 loc_406EF4: ; CODE XREF: ___:00406E51j ; ___:00406EA1j lea ecx, [esp+10h] mov dword ptr [esp+460h], 0FFFFFFFFh call sub_401226 loc_406F08: ; CODE XREF: ___:00406D6Dj ; ___:00406DABj ... mov eax, [ebp+4] add ebp, 4 test eax, eax jnz loc_406D38 xor ecx, ecx loc_406F18: ; CODE XREF: ___:00406D2Ej mov al, [ebx+4] pop edi pop esi pop ebp test al, al jnz short loc_406F25 mov [ebx+5], ecx loc_406F25: ; CODE XREF: ___:00406F20j cmp [ebx+5], ecx jnz short loc_406F35 test al, al jz short loc_406F35 mov dword ptr [ebx+5], 0Ah loc_406F35: ; CODE XREF: ___:00406F28j ; ___:00406F2Cj mov [ebx+5], ecx mov ecx, [esp+44Ch] mov byte ptr [ebx+4], 0 pop ebx mov large fs:0, ecx add esp, 454h retn 4 ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 0D0h dup(0CCh) ; --------------------------------------------------------------------------- loc_407030: ; CODE XREF: ___:0040209Fj push 0FFFFFFFFh push offset byte_4385FB mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 8 push esi mov esi, ecx mov [esp+8], esi call sub_4011B3 lea ecx, [esi+4] call sub_401749 lea eax, [esp+7] lea ecx, [esi+32h] push eax mov dword ptr [esp+18h], 0 call sub_401564 mov ecx, [esp+0Ch] mov dword ptr [esi], offset dword_43E00C mov eax, esi pop esi mov large fs:0, ecx add esp, 14h retn ; --------------------------------------------------------------------------- db 7 dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4070B0 proc near ; CODE XREF: sub_401591j arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch mov eax, [esp+arg_4] push esi mov esi, ecx push eax mov ecx, [esp+8+arg_0] call sub_4015D7 mov edx, [esp+4+arg_0] mov ecx, [esp+4+arg_8] lea eax, [esp+4+arg_0] mov [edx+2Ah], ecx push eax lea ecx, [esi+32h] call sub_4014E2 pop esi retn 0Ch sub_4070B0 endp ; --------------------------------------------------------------------------- db 3 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4070F0 proc near ; CODE XREF: sub_401AF0j var_8 = dword ptr -8 var_4 = byte ptr -4 arg_0 = dword ptr 4 sub esp, 8 push esi mov esi, ecx push edi lea ecx, [esp+10h+var_8] call sub_401AC3 add esi, 32h lea eax, [esp+10h+var_4] push eax mov ecx, esi call sub_401622 mov ecx, [eax] lea edx, [esp+10h+var_4] mov [esp+10h+var_8], ecx push edx mov ecx, esi call sub_4021BC push eax lea ecx, [esp+14h+var_8] call sub_40183E test al, al jz short loc_40716B mov edi, [esp+10h+arg_0] loc_407133: ; CODE XREF: sub_4070F0+79j push edi lea ecx, [esp+14h+var_8] call sub_40173F mov ecx, [eax] call sub_4012EE test eax, eax lea ecx, [esp+10h+var_8] jz short loc_407175 call sub_401F0A lea eax, [esp+10h+var_4] mov ecx, esi push eax call sub_4021BC push eax lea ecx, [esp+14h+var_8] call sub_40183E test al, al jnz short loc_407133 loc_40716B: ; CODE XREF: sub_4070F0+3Dj pop edi xor eax, eax pop esi add esp, 8 retn 8 ; --------------------------------------------------------------------------- loc_407175: ; CODE XREF: sub_4070F0+5Aj call sub_40173F mov eax, [eax] pop edi pop esi add esp, 8 retn 8 sub_4070F0 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 30h dup(0CCh) ; --------------------------------------------------------------------------- loc_4071C0: ; CODE XREF: ___:004021F8j xor al, al retn 4 ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4071E0 proc near ; CODE XREF: sub_401564j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push esi mov esi, ecx push 0 mov cl, [eax] push 0 mov [esi], cl mov ecx, esi call sub_40119F mov [esi+4], eax mov dword ptr [esi+8], 0 mov eax, esi pop esi retn 4 sub_4071E0 endp ; --------------------------------------------------------------------------- db 0Ah dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_407220 proc near ; CODE XREF: sub_401622j arg_0 = dword ptr 4 mov eax, [ecx+4] push esi push eax call sub_401A82 mov ecx, [eax] mov esi, [esp+8+arg_0] add esp, 4 push ecx mov ecx, esi call sub_402185 mov eax, esi pop esi retn 4 sub_407220 endp ; --------------------------------------------------------------------------- db 0Fh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_407260 proc near ; CODE XREF: sub_4021BCj arg_0 = dword ptr 4 mov eax, [ecx+4] push esi mov esi, [esp+4+arg_0] push eax mov ecx, esi call sub_402185 mov eax, esi pop esi retn 4 sub_407260 endp ; --------------------------------------------------------------------------- db 0Ah dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_407290 proc near ; CODE XREF: sub_4014E2j var_4 = byte ptr -4 arg_0 = dword ptr 4 push ecx mov eax, [esp+4+arg_0] push esi mov esi, ecx push eax lea ecx, [esp+0Ch+arg_0] push ecx mov ecx, esi call sub_4021BC mov edx, [eax] lea eax, [esp+0Ch+var_4] push edx push eax mov ecx, esi call sub_4013B6 pop esi pop ecx retn 4 sub_407290 endp ; --------------------------------------------------------------------------- db 7 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4072D0 proc near ; CODE XREF: sub_401AC3j push esi mov esi, ecx call sub_401B63 mov eax, esi pop esi retn sub_4072D0 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4072F0 proc near ; CODE XREF: sub_40173Fj mov eax, [ecx] push eax call sub_401208 add esp, 4 retn sub_4072F0 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_407310 proc near ; CODE XREF: sub_401F0Aj push esi mov esi, ecx mov eax, [esi] push eax call sub_401A82 mov ecx, [eax] add esp, 4 mov [esi], ecx mov eax, esi pop esi retn sub_407310 endp ; --------------------------------------------------------------------------- db 0Ah dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_407340 proc near ; CODE XREF: sub_40183Ej arg_0 = dword ptr 4 mov eax, [esp+arg_0] push eax call sub_401FA0 neg al sbb eax, eax inc eax retn 4 sub_407340 endp ; --------------------------------------------------------------------------- db 0Eh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_407370 proc near ; CODE XREF: sub_4013B6j arg_0 = dword ptr 4 arg_4 = byte ptr 8 arg_8 = dword ptr 0Ch push ebx push esi mov esi, ecx push edi lea ecx, [esp+0Ch+arg_4] call sub_401C8A mov edi, eax push edi call sub_401C58 mov eax, [eax] add esp, 4 mov ecx, esi push eax push edi call sub_40119F push edi mov ebx, eax call sub_401C58 push edi mov [eax], ebx call sub_401C58 mov edi, [eax] push edi call sub_401C58 mov ecx, [eax] push ecx call sub_401A82 mov edx, [esp+1Ch+arg_8] add esp, 10h mov [eax], edi push edx push edi call sub_401208 add esp, 4 mov ecx, esi push eax call sub_401672 mov ecx, [esi+8] push edi inc ecx mov [esi+8], ecx mov esi, [esp+10h+arg_0] mov ecx, esi call sub_402185 mov eax, esi pop edi pop esi pop ebx retn 0Ch sub_407370 endp ; --------------------------------------------------------------------------- db 6 dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_407410 proc near ; CODE XREF: sub_40119Fj arg_0 = dword ptr 4 arg_4 = dword ptr 8 push esi push edi push 0Ch call sub_4019C9 mov edi, [esp+8+arg_0] mov esi, eax test edi, edi jnz short loc_407425 mov edi, esi loc_407425: ; CODE XREF: sub_407410+11j push esi call sub_401A82 mov [eax], edi mov edi, [esp+0Ch+arg_4] add esp, 4 test edi, edi jnz short loc_40743A mov edi, esi loc_40743A: ; CODE XREF: sub_407410+26j push esi call sub_401C58 add esp, 4 mov [eax], edi mov eax, esi pop edi pop esi retn 8 sub_407410 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_407460 proc near ; CODE XREF: sub_401A82j arg_0 = dword ptr 4 mov eax, [esp+arg_0] retn sub_407460 endp ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_407480 proc near ; CODE XREF: sub_401208j arg_0 = dword ptr 4 mov eax, [esp+arg_0] add eax, 8 retn sub_407480 endp ; --------------------------------------------------------------------------- db 8 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4074A0 proc near ; CODE XREF: sub_401B63j mov eax, ecx retn sub_4074A0 endp ; --------------------------------------------------------------------------- db 0Dh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4074C0 proc near ; CODE XREF: sub_402185j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push esi mov esi, ecx push eax call sub_4011E5 mov eax, esi pop esi retn 4 sub_4074C0 endp ; --------------------------------------------------------------------------- db 0Dh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4074F0 proc near ; CODE XREF: sub_401FA0j arg_0 = dword ptr 4 mov edx, [esp+arg_0] mov eax, [ecx] push esi xor ecx, ecx mov esi, [edx] cmp eax, esi pop esi setz cl mov al, cl retn 4 sub_4074F0 endp ; --------------------------------------------------------------------------- db 0Ah dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_407520 proc near ; CODE XREF: sub_401C58j arg_0 = dword ptr 4 mov eax, [esp+arg_0] add eax, 4 retn sub_407520 endp ; --------------------------------------------------------------------------- db 8 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_407540 proc near ; CODE XREF: sub_4019C9j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push 0 push eax call sub_401D16 add esp, 8 retn 4 sub_407540 endp ; --------------------------------------------------------------------------- db 0Eh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_407570 proc near ; CODE XREF: sub_401672j arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_4] mov ecx, [esp+arg_0] push eax push ecx call sub_40109B add esp, 8 retn 8 sub_407570 endp ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4075A0 proc near ; CODE XREF: sub_4011E5j arg_0 = dword ptr 4 mov eax, ecx mov ecx, [esp+arg_0] mov [eax], ecx retn 4 sub_4075A0 endp ; --------------------------------------------------------------------------- db 5 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4075C0 proc near ; CODE XREF: sub_401C8Aj mov eax, [ecx] retn sub_4075C0 endp ; --------------------------------------------------------------------------- db 0Dh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4075E0 proc near ; CODE XREF: sub_401D16j arg_0 = dword ptr 4 mov eax, [esp+arg_0] test eax, eax jge short loc_4075EA xor eax, eax loc_4075EA: ; CODE XREF: sub_4075E0+6j push eax call near ptr word_4367FA add esp, 4 retn sub_4075E0 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_407610 proc near ; CODE XREF: sub_40109Bj arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_0] push eax push 4 call sub_4011CC add esp, 8 test eax, eax jz short locret_40762B mov ecx, [esp+arg_4] mov edx, [ecx] mov [eax], edx locret_40762B: ; CODE XREF: sub_407610+11j retn sub_407610 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_407640 proc near ; CODE XREF: sub_4011CCj arg_4 = dword ptr 8 mov eax, [esp+arg_4] retn sub_407640 endp ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_407660 proc near ; CODE XREF: sub_401B2Cj var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = byte ptr 8 mov eax, large fs:0 push 0FFFFFFFFh push offset SEH_407660 push eax mov large fs:0, esp push 0 push 0 push 0 push 0 lea ecx, [esp+1Ch+arg_4] mov [esp+1Ch+var_4], 0 call sub_4017E4 push eax mov eax, [esp+20h+arg_0] push 0 push eax mov ecx, offset word_448D16 call sub_401B5E lea ecx, [esp+0Ch+arg_4] mov [esp+0Ch+var_4], 0FFFFFFFFh call sub_401226 mov ecx, [esp+0Ch+var_C] mov large fs:0, ecx add esp, 0Ch retn 1Ch sub_407660 endp ; --------------------------------------------------------------------------- db 0Eh dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4076F0 proc near ; CODE XREF: sub_401CC1j var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = byte ptr 8 arg_1C = byte ptr 20h mov eax, large fs:0 push 0FFFFFFFFh push offset SEH_4076F0 push eax mov large fs:0, esp push 0 push 0 push 0 push 0 lea ecx, [esp+1Ch+arg_1C] mov [esp+1Ch+var_4], 1 call sub_4017E4 push eax lea ecx, [esp+20h+arg_4] call sub_4017E4 push eax mov eax, [esp+24h+arg_0] push eax mov ecx, offset word_448D16 call sub_401B5E lea ecx, [esp+0Ch+arg_4] mov byte ptr [esp+0Ch+var_4], 0 call sub_401226 lea ecx, [esp+0Ch+arg_1C] mov [esp+0Ch+var_4], 0FFFFFFFFh call sub_401226 mov ecx, [esp+0Ch+var_C] mov large fs:0, ecx add esp, 0Ch retn 34h sub_4076F0 endp ; --------------------------------------------------------------------------- db 8 dup(90h) db 20h dup(0CCh) ; --------------------------------------------------------------------------- loc_407790: ; CODE XREF: ___:0040121Cj push 0FFFFFFFFh push offset dword_43895C mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 344h push ebx push esi mov esi, ecx push edi lea ecx, [esp+1E8h] call sub_401424 lea ecx, [esp+1B8h] mov dword ptr [esp+358h], 0 call sub_401424 lea ecx, [esp+188h] mov byte ptr [esp+358h], 1 call sub_401424 lea ecx, [esp+158h] mov byte ptr [esp+358h], 2 call sub_401424 lea ecx, [esp+80h] mov byte ptr [esp+358h], 3 call sub_401424 lea ecx, [esp+98h] mov byte ptr [esp+358h], 4 call sub_401424 lea ecx, [esp+128h] mov byte ptr [esp+358h], 5 call sub_401424 lea ecx, [esp+0F8h] mov byte ptr [esp+358h], 6 call sub_401424 lea ecx, [esp+68h] mov byte ptr [esp+358h], 7 call sub_401424 lea ecx, [esp+338h] mov byte ptr [esp+358h], 8 call sub_401424 lea ecx, [esp+308h] mov byte ptr [esp+358h], 9 call sub_401424 lea ecx, [esp+2D8h] mov byte ptr [esp+358h], 0Ah call sub_401424 lea ecx, [esp+320h] mov byte ptr [esp+358h], 0Bh call sub_401424 lea ecx, [esp+2F0h] mov byte ptr [esp+358h], 0Ch call sub_401424 lea ecx, [esp+0C8h] mov byte ptr [esp+358h], 0Dh call sub_401424 lea ecx, [esp+200h] mov byte ptr [esp+358h], 0Eh call sub_401424 lea ecx, [esp+248h] mov byte ptr [esp+358h], 0Fh call sub_401424 lea ecx, [esp+1D0h] mov byte ptr [esp+358h], 10h call sub_401424 lea ecx, [esp+218h] mov byte ptr [esp+358h], 11h call sub_401424 mov byte ptr [esp+358h], 12h lea ecx, [esp+1A0h] call sub_401424 lea ecx, [esp+0B0h] mov byte ptr [esp+358h], 13h call sub_401424 lea ecx, [esp+170h] mov byte ptr [esp+358h], 14h call sub_401424 lea ecx, [esp+290h] mov byte ptr [esp+358h], 15h call sub_401424 lea ecx, [esp+140h] mov byte ptr [esp+358h], 16h call sub_401424 lea ecx, [esp+2A8h] mov byte ptr [esp+358h], 17h call sub_401424 lea ecx, [esp+110h] mov byte ptr [esp+358h], 18h call sub_401424 lea ecx, [esp+278h] mov byte ptr [esp+358h], 19h call sub_401424 lea ecx, [esp+2C0h] mov byte ptr [esp+358h], 1Ah call sub_401424 lea ecx, [esp+0E0h] mov byte ptr [esp+358h], 1Bh call sub_401424 lea ecx, [esp+2Ch] mov byte ptr [esp+358h], 1Ch call sub_401424 lea ecx, [esp+44h] mov byte ptr [esp+358h], 1Dh call sub_401424 mov bl, 1Eh push offset dword_4438A4 lea ecx, [esp+1ECh] mov [esp+35Ch], bl call sub_401A87 push offset dword_44389C lea ecx, [esp+1BCh] call sub_401A87 push offset dword_443894 lea ecx, [esp+0B4h] call sub_401A87 push offset dword_4438A4 lea ecx, [esp+18Ch] call sub_401A87 push offset dword_44389C lea ecx, [esp+15Ch] call sub_401A87 push offset dword_443894 lea ecx, [esp+174h] call sub_401A87 push offset dword_44388C lea ecx, [esp+84h] call sub_401A87 push offset dword_443888 lea ecx, [esp+0E4h] call sub_401A87 push offset dword_443880 lea ecx, [esp+9Ch] call sub_401A87 push offset dword_44386C lea ecx, [esp+12Ch] call sub_401A87 push offset dword_443860 lea ecx, [esp+0FCh] call sub_401A87 push offset dword_443858 lea ecx, [esp+6Ch] call sub_401A87 push offset dword_44384C lea ecx, [esp+0CCh] call sub_401A87 push offset dword_443824 lea ecx, [esp+204h] call sub_401A87 push offset dword_443818 lea ecx, [esp+24Ch] call sub_401A87 push offset dword_443804 lea ecx, [esp+1D4h] call sub_401A87 push offset dword_4437FC lea ecx, [esp+21Ch] call sub_401A87 push offset dword_4437F8 lea ecx, [esp+294h] call sub_401A87 push 0 push 4Bh push 48h push 4Ah push 47h push 4Ch push 48h push 4Bh push 48h push 45h lea eax, [esp+3Ch] push 46h push eax call sub_4019B5 add esp, 30h push eax lea ecx, [esp+1A4h] mov byte ptr [esp+35Ch], 1Fh call sub_40200E lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 push 0 push 14h push 6 push 0Fh push 13h push 0Fh push 12h push 3 push 9 push 0Dh push 4Fh push 18h push 9 push 6 push 14h push 0Fh lea ecx, [esp+54h] push 8 push ecx call sub_4019B5 add esp, 48h push eax lea ecx, [esp+144h] mov byte ptr [esp+35Ch], 20h call sub_40200E lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 push 0 push 48h push 46h push 44h lea edx, [esp+24h] push 45h push edx call sub_4019B5 add esp, 18h push eax lea ecx, [esp+2ACh] mov byte ptr [esp+35Ch], 21h call sub_40200E lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 push 0 push 48h push 46h push 44h lea eax, [esp+24h] push 45h push eax call sub_4019B5 add esp, 18h push eax lea ecx, [esp+27Ch] mov byte ptr [esp+35Ch], 22h call sub_40200E lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 push 0 push 44h push 49h lea ecx, [esp+20h] push 46h push ecx call sub_4019B5 add esp, 14h push eax lea ecx, [esp+114h] mov byte ptr [esp+35Ch], 23h call sub_40200E lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 push 0 push 48h push 46h push 44h lea edx, [esp+24h] push 45h push edx call sub_4019B5 add esp, 18h push eax lea ecx, [esp+2C4h] mov byte ptr [esp+35Ch], 24h call sub_40200E lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 push 0 push 5 push 15h push 12h lea eax, [esp+24h] push 14h push eax call sub_4019B5 add esp, 18h push eax lea ecx, [esp+30h] mov byte ptr [esp+35Ch], 25h call sub_40200E lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 push 0 push 5 push 13h push 0Ch push 1 lea ecx, [esp+28h] push 6 push ecx call sub_4019B5 add esp, 1Ch push eax lea ecx, [esp+48h] mov byte ptr [esp+35Ch], 26h call sub_40200E lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 lea ecx, [esp+98h] call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+28h], esp push eax call sub_401861 push 0 push 13h push 13h push 1 push 10h push 0Eh push 1 push 8 push 3 push 4Eh push 14h push 0Fh push 0Fh push 12h push 3Fh push 12h push 5 push 16h push 12h push 5 push 13h push 3Fh push 9 lea edx, [esp+88h] push 13h push edx mov byte ptr [esp+3D4h], 27h call sub_4019B5 add esp, 64h mov ecx, eax mov byte ptr [esp+370h], 28h call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+3Ch], esp push eax call sub_401861 lea eax, [esi+0FECh] mov ecx, esi push eax mov byte ptr [esp+38Ch], 29h call sub_401CC1 lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 lea ecx, [esp+80h] call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+24h], esp push eax call sub_401861 push 0 push 0Eh push 1 mov byte ptr [esp+37Ch], 2Ah push 8 push 3 push 0Eh push 9 push 1 push 0Dh push 4Eh push 14h push 0Fh push 0Fh push 12h push 3Fh push 12h push 5 push 16h push 12h push 5 push 13h push 3Fh push 9 lea ecx, [esp+88h] push 13h push ecx call sub_4019B5 add esp, 64h mov ecx, eax mov byte ptr [esp+370h], 2Bh call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+40h], esp push eax call sub_401861 lea edx, [esi+1035h] mov ecx, esi push edx mov byte ptr [esp+38Ch], 2Ch call sub_401CC1 lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 lea ecx, [esp+1B8h] call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+24h], esp push eax call sub_401861 push 0 push 14h push 12h push 0Fh push 10h push 4Eh push 14h push 0Fh push 0Fh push 12h push 3Fh push 12h push 5 push 16h push 12h push 5 push 13h push 3Fh push 9 lea eax, [esp+78h] push 13h push eax mov byte ptr [esp+3C4h], 2Dh call sub_4019B5 add esp, 54h mov ecx, eax mov byte ptr [esp+370h], 2Eh call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+40h], esp push eax call sub_401861 lea ecx, [esi+0FA3h] mov byte ptr [esp+388h], 2Fh push ecx mov ecx, esi call sub_401CC1 lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 lea ecx, [esp+1E8h] call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+24h], esp push eax call sub_401861 push 0 push 12h push 5 push 16h push 12h push 5 push 13h push 4Eh push 14h push 0Fh push 0Fh push 12h push 3Fh push 12h push 5 push 16h push 12h push 5 push 13h push 3Fh push 9 lea edx, [esp+80h] push 13h push edx mov byte ptr [esp+3CCh], 30h call sub_4019B5 add esp, 5Ch mov ecx, eax mov byte ptr [esp+370h], 31h call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+40h], esp push eax call sub_401861 lea eax, [esi+0F5Ah] mov ecx, esi push eax mov byte ptr [esp+38Ch], 32h call sub_401CC1 lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 lea ecx, [esp+68h] call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+24h], esp push eax call sub_401861 push 0 push 18h push 9 push 6 push 5 push 12h mov byte ptr [esp+388h], 33h push 10h push 0Bh push 3 push 9 push 0Eh push 4Eh push 14h push 0Fh push 0Fh push 12h push 3Fh push 12h push 5 push 16h push 12h push 5 push 13h push 3Fh push 9 lea ecx, [esp+90h] push 13h push ecx call sub_4019B5 add esp, 6Ch mov ecx, eax mov byte ptr [esp+370h], 34h call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+40h], esp push eax call sub_401861 lea edi, [esi+0E7Fh] mov ecx, esi push edi mov byte ptr [esp+38Ch], 35h call sub_401CC1 lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 lea ecx, [esp+0B0h] call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+24h], esp push eax call sub_401861 push 0 push 13h push 13h push 1 push 10h push 16h push 12h push 5 push 13h push 4Eh push 14h push 0Fh push 0Fh push 12h push 3Fh push 12h push 5 push 16h push 12h push 5 push 13h push 3Fh push 9 lea edx, [esp+88h] push 13h push edx mov byte ptr [esp+3D4h], 36h call sub_4019B5 add esp, 64h mov byte ptr [esp+370h], 37h mov ecx, eax call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+40h], esp push eax call sub_401861 lea eax, [esi+0F11h] mov ecx, esi push eax mov byte ptr [esp+38Ch], 38h call sub_401CC1 lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 lea ecx, [esp+44h] call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+24h], esp push eax call sub_401861 push 0 push 0Ch push 13h push 13h push 3Fh push 5 push 13h push 15h push 4Eh push 14h push 0Fh push 0Fh push 12h push 3Fh push 12h push 5 push 16h push 12h push 5 push 13h push 3Fh push 9 lea ecx, [esp+84h] push 13h push ecx mov byte ptr [esp+3D0h], 39h call sub_4019B5 add esp, 60h mov ecx, eax mov byte ptr [esp+370h], 3Ah call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+40h], esp push eax call sub_401861 lea edx, [esi+107Eh] mov ecx, esi push edx mov byte ptr [esp+38Ch], 3Bh call sub_401CC1 lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 lea eax, [esp+10h] mov ecx, offset byte_4D638F push eax mov [esp+14h], edi call sub_401A5F lea ecx, [esp+98h] call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+24h], esp push eax call sub_401861 push 0 push 13h push 13h push 1 push 10h push 0Eh push 1 push 8 push 3 push 4Eh push 14h push 0Fh push 0Fh push 12h push 3Fh push 12h push 5 push 16h push 12h push 5 push 13h push 3Fh push 9 lea ecx, [esp+88h] push 13h push ecx mov byte ptr [esp+3D4h], 3Ch call sub_4019B5 add esp, 64h mov ecx, eax mov byte ptr [esp+370h], 3Dh call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+40h], esp push eax call sub_401861 lea edx, [esi+1234h] mov ecx, esi push edx mov byte ptr [esp+38Ch], 3Eh call sub_401CC1 lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 lea ecx, [esp+80h] call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+24h], esp push eax call sub_401861 push 0 push 0Eh push 1 push 8 push 3 push 0Eh push 9 push 1 push 0Dh push 4Eh push 14h push 0Fh push 0Fh push 12h push 3Fh push 12h push 5 push 16h push 12h push 5 push 13h push 3Fh push 9 mov byte ptr [esp+3CCh], 3Fh push 13h lea eax, [esp+8Ch] push eax call sub_4019B5 add esp, 64h mov ecx, eax mov byte ptr [esp+370h], 40h call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+40h], esp push eax call sub_401861 lea ecx, [esi+127Dh] mov byte ptr [esp+388h], 41h push ecx mov ecx, esi call sub_401CC1 lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 lea ecx, [esp+158h] call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+24h], esp push eax call sub_401861 push 0 push 14h push 12h push 0Fh push 10h push 4Eh push 14h push 0Fh push 0Fh push 12h push 3Fh push 12h push 5 push 16h push 12h push 5 push 13h push 3Fh push 9 lea edx, [esp+78h] push 13h push edx mov byte ptr [esp+3C4h], 42h call sub_4019B5 add esp, 54h mov ecx, eax mov byte ptr [esp+370h], 43h call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+40h], esp push eax call sub_401861 lea eax, [esi+11EBh] mov ecx, esi push eax mov byte ptr [esp+38Ch], 44h call sub_401CC1 lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 lea ecx, [esp+188h] call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+24h], esp push eax call sub_401861 push 0 push 12h push 5 push 16h push 12h push 5 push 13h push 4Eh push 14h push 0Fh push 0Fh push 12h push 3Fh push 12h push 5 push 16h push 12h push 5 push 13h push 3Fh push 9 lea ecx, [esp+80h] push 13h push ecx mov byte ptr [esp+3CCh], 45h call sub_4019B5 add esp, 5Ch mov ecx, eax mov byte ptr [esp+370h], 46h call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+40h], esp push eax call sub_401861 lea edx, [esi+11A2h] mov ecx, esi push edx mov byte ptr [esp+38Ch], 47h call sub_401CC1 lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 lea ecx, [esp+68h] call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+24h], esp push eax call sub_401861 push 0 push 18h push 9 push 6 push 5 push 12h push 10h push 0Bh push 3 push 9 push 0Eh push 4Eh push 14h push 0Fh push 0Fh push 12h push 3Fh push 12h push 5 push 16h push 12h push 5 push 13h push 3Fh push 9 mov byte ptr [esp+3D4h], 48h push 13h lea eax, [esp+94h] push eax call sub_4019B5 add esp, 6Ch mov ecx, eax mov byte ptr [esp+370h], 49h call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+40h], esp push eax call sub_401861 lea edi, [esi+10C7h] mov ecx, esi push edi mov byte ptr [esp+38Ch], 4Ah call sub_401CC1 lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 lea ecx, [esp+170h] call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+24h], esp push eax call sub_401861 push 0 push 13h push 13h push 1 push 10h push 16h push 12h push 5 push 13h push 4Eh push 14h push 0Fh push 0Fh push 12h push 3Fh push 12h push 5 push 16h push 12h push 5 push 13h push 3Fh push 9 lea ecx, [esp+88h] push 13h push ecx mov byte ptr [esp+3D4h], 4Bh call sub_4019B5 add esp, 64h mov ecx, eax mov byte ptr [esp+370h], 4Ch call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+40h], esp push eax call sub_401861 lea edx, [esi+1159h] mov ecx, esi push edx mov byte ptr [esp+38Ch], 4Dh call sub_401CC1 lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 lea ecx, [esp+44h] call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+24h], esp push eax call sub_401861 push 0 push 0Ch push 13h push 13h push 3Fh push 5 push 13h push 15h push 4Eh push 14h push 0Fh push 0Fh push 12h push 3Fh push 12h push 5 push 16h push 12h push 5 push 13h push 3Fh push 9 lea eax, [esp+84h] push 13h push eax mov byte ptr [esp+3D0h], 4Eh call sub_4019B5 add esp, 60h mov ecx, eax mov byte ptr [esp+370h], 4Fh call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+40h], esp push eax call sub_401861 lea ecx, [esi+12C6h] mov byte ptr [esp+388h], 50h push ecx mov ecx, esi call sub_401CC1 lea ecx, [esp+14h] mov [esp+358h], bl call sub_401226 lea edx, [esp+10h] mov ecx, offset byte_4D638F push edx mov [esp+14h], edi call sub_401A5F push offset dword_446F70 push offset word_4E6E9A call sub_40102D add esp, 8 lea ecx, [esp+230h] call sub_401424 lea ecx, [esp+260h] mov byte ptr [esp+358h], 51h call sub_401424 push 56D2h push 539h mov byte ptr [esp+360h], 52h call sub_4021A3 add esp, 8 push eax lea eax, [esp+234h] push offset dword_4437F4 push eax call sub_40102D push 56D2h push 539h call sub_4021A3 add esp, 14h push eax push offset dword_4437F4 lea ecx, [esp+268h] push ecx call sub_40102D sub esp, 0Ch lea edx, [esp+44h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+606h] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+44h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+64Fh] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+44h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+805h] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+44h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+84Eh] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+44h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+897h] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+44h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+450h] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+5Ch] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+499h] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+44h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+52Bh] push eax mov ecx, esi call sub_401B2C sub esp, 18h lea edx, [esp+44h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+574h] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+44h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+0B28h] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+5Ch] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+8E0h] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+278h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+3BEh] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+1B8h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+407h] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+230h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+5BDh] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+158h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+698h] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+128h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+72Ah] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+0F8h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+6E1h] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+290h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+773h] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+2C0h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+7BCh] mov ecx, esi push eax call sub_401B2C sub esp, 18h mov ecx, esp mov [esp+24h], esp push offset word_4E6E9A call sub_4014C9 lea ecx, [esi+251h] push ecx mov ecx, esi call sub_401B2C sub esp, 18h lea edx, [esp+140h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+29Ah] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+110h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+2E3h] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+2A8h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+32Ch] mov ecx, esi push eax call sub_401B2C sub esp, 18h lea edx, [esp+248h] mov ecx, esp mov [esp+24h], esp push edx call sub_4014C9 lea eax, [esi+375h] mov ecx, esi push eax call sub_401B2C push 0 mov ecx, offset byte_4D638F call sub_40146A mov ecx, [eax] add ecx, 16Dh call sub_4017E4 push eax push offset byte_44742D mov ecx, offset word_448D16 call sub_401596 push 0 mov ecx, offset byte_4D638F call sub_40146A mov ecx, [eax] add ecx, 1B6h call sub_4017E4 push eax push offset dword_4473E4 mov ecx, offset word_448D16 call sub_401596 push 0 mov ecx, offset byte_4D638F call sub_40146A mov ecx, [eax] call sub_4017E4 push eax push offset dword_4472C0 mov ecx, offset word_448D16 call sub_401596 push 0 mov ecx, offset byte_4D638F call sub_40146A mov ecx, [eax] add ecx, 124h call sub_4017E4 push eax push offset word_447352 mov ecx, offset word_448D16 call sub_401596 push 0 mov ecx, offset byte_4D638F call sub_40146A mov ecx, [eax] add ecx, 0DBh call sub_4017E4 push eax push offset byte_447309 mov ecx, offset word_448D16 call sub_401596 push 0 mov ecx, offset byte_4D638F call sub_40146A mov ecx, [eax] add ecx, 92h call sub_4017E4 push eax push offset byte_44739B mov ecx, offset word_448D16 call sub_401596 push 0 mov ecx, offset byte_4D638F call sub_40146A mov ecx, [eax] add ecx, 1FFh call sub_4017E4 push eax push offset byte_4474BF mov ecx, offset word_448D16 call sub_401596 lea ecx, [esp+1D0h] call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+24h], esp push eax call sub_401861 lea ecx, [esp+260h] mov byte ptr [esp+370h], 53h call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+8Ch], esp push eax call sub_401861 lea ecx, [esp+230h] mov byte ptr [esp+388h], 54h call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+0A8h], esp push eax call sub_401861 lea ecx, [esp+110h] mov byte ptr [esp+3A0h], 55h call sub_4017E4 sub esp, 18h mov ecx, esp mov [esp+0C4h], esp push eax call sub_401861 mov ecx, offset word_448C9E mov byte ptr [esp+3B8h], 52h call sub_40137F lea ecx, [esp+260h] mov byte ptr [esp+358h], 51h call sub_401226 lea ecx, [esp+230h] mov [esp+358h], bl call sub_401226 lea ecx, [esp+44h] mov byte ptr [esp+358h], 1Dh call sub_401226 lea ecx, [esp+2Ch] mov byte ptr [esp+358h], 1Ch call sub_401226 lea ecx, [esp+0E0h] mov byte ptr [esp+358h], 1Bh call sub_401226 lea ecx, [esp+2C0h] mov byte ptr [esp+358h], 1Ah call sub_401226 lea ecx, [esp+278h] mov byte ptr [esp+358h], 19h call sub_401226 lea ecx, [esp+110h] mov byte ptr [esp+358h], 18h call sub_401226 lea ecx, [esp+2A8h] mov byte ptr [esp+358h], 17h call sub_401226 lea ecx, [esp+140h] mov byte ptr [esp+358h], 16h call sub_401226 lea ecx, [esp+290h] mov byte ptr [esp+358h], 15h call sub_401226 lea ecx, [esp+170h] mov byte ptr [esp+358h], 14h call sub_401226 lea ecx, [esp+0B0h] mov byte ptr [esp+358h], 13h call sub_401226 lea ecx, [esp+1A0h] mov byte ptr [esp+358h], 12h call sub_401226 lea ecx, [esp+218h] mov byte ptr [esp+358h], 11h call sub_401226 lea ecx, [esp+1D0h] mov byte ptr [esp+358h], 10h call sub_401226 lea ecx, [esp+248h] mov byte ptr [esp+358h], 0Fh call sub_401226 lea ecx, [esp+200h] mov byte ptr [esp+358h], 0Eh call sub_401226 lea ecx, [esp+0C8h] mov byte ptr [esp+358h], 0Dh call sub_401226 lea ecx, [esp+2F0h] mov byte ptr [esp+358h], 0Ch call sub_401226 lea ecx, [esp+320h] mov byte ptr [esp+358h], 0Bh call sub_401226 lea ecx, [esp+2D8h] mov byte ptr [esp+358h], 0Ah call sub_401226 lea ecx, [esp+308h] mov byte ptr [esp+358h], 9 call sub_401226 lea ecx, [esp+338h] mov byte ptr [esp+358h], 8 call sub_401226 lea ecx, [esp+68h] mov byte ptr [esp+358h], 7 call sub_401226 lea ecx, [esp+0F8h] mov byte ptr [esp+358h], 6 call sub_401226 lea ecx, [esp+128h] mov byte ptr [esp+358h], 5 call sub_401226 lea ecx, [esp+98h] mov byte ptr [esp+358h], 4 call sub_401226 lea ecx, [esp+80h] mov byte ptr [esp+358h], 3 call sub_401226 lea ecx, [esp+158h] mov byte ptr [esp+358h], 2 call sub_401226 lea ecx, [esp+188h] mov byte ptr [esp+358h], 1 call sub_401226 lea ecx, [esp+1B8h] mov byte ptr [esp+358h], 0 call sub_401226 lea ecx, [esp+1E8h] mov dword ptr [esp+358h], 0FFFFFFFFh call sub_401226 mov ecx, [esp+350h] pop edi pop esi mov large fs:0, ecx pop ebx add esp, 350h retn ; --------------------------------------------------------------------------- db 0Dh dup(90h) db 5C0h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409450 proc near ; CODE XREF: sub_40146Aj arg_0 = dword ptr 4 push esi push edi mov esi, ecx call sub_401974 mov edi, [esp+8+arg_0] cmp eax, edi ja short loc_409468 mov ecx, esi call sub_40190B loc_409468: ; CODE XREF: sub_409450+Fj mov ecx, esi call sub_401A37 lea eax, [eax+edi*4] pop edi pop esi retn 4 sub_409450 endp ; --------------------------------------------------------------------------- db 9 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409490 proc near ; CODE XREF: sub_401A5Fj arg_0 = dword ptr 4 mov eax, [esp+arg_0] push esi mov esi, ecx push eax call sub_40128A push eax mov ecx, esi call sub_40168B pop esi retn 4 sub_409490 endp ; --------------------------------------------------------------------------- db 7 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4094C0 proc near ; CODE XREF: sub_401A37j mov eax, [ecx+4] retn sub_4094C0 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4094E0 proc near ; CODE XREF: sub_40128Aj mov eax, [ecx+8] retn sub_4094E0 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409500 proc near ; CODE XREF: sub_401974j mov edx, [ecx+4] test edx, edx jnz short loc_40950A xor eax, eax retn ; --------------------------------------------------------------------------- loc_40950A: ; CODE XREF: sub_409500+5j mov eax, [ecx+8] sub eax, edx sar eax, 2 retn sub_409500 endp ; --------------------------------------------------------------------------- db 0Dh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409530 proc near ; CODE XREF: sub_40168Bj arg_0 = dword ptr 4 arg_4 = dword ptr 8 push esi push edi mov edi, ecx call sub_401A37 mov edx, [esp+8+arg_4] mov ecx, eax mov eax, [esp+8+arg_0] push edx mov esi, eax push 1 sub esi, ecx push eax mov ecx, edi sar esi, 2 call sub_401B9A mov ecx, edi call sub_401A37 lea eax, [eax+esi*4] pop edi pop esi retn 8 sub_409530 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_409580: ; CODE XREF: sub_40190Bj push 0FFFFFFFFh push offset byte_438A39 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 30h lea eax, [esp+3] lea ecx, [esp+4] push eax push offset dword_443930 nop call near ptr 76081F67h lea ecx, [esp+4] mov dword ptr [esp+38h], 0 push ecx lea ecx, [esp+18h] nop call near ptr 760A0430h lea edx, [esp+14h] push offset dword_43F080 push edx call near ptr word_436832 nop nop nop nop nop nop nop nop nop nop nop nop nop nop ; --------------------------------------------------------------------------- db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409600 proc near ; CODE XREF: sub_401B9Aj arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebx push ebp push esi mov esi, ecx push edi mov edi, [esp+10h+arg_4] mov eax, [esi+8] mov ecx, [esi+0Ch] sub ecx, eax sar ecx, 2 cmp ecx, edi jnb loc_4096CB mov ecx, esi call sub_401974 cmp edi, eax jnb short loc_409633 mov ecx, esi call sub_401974 mov ebp, eax jmp short loc_409635 ; --------------------------------------------------------------------------- loc_409633: ; CODE XREF: sub_409600+26j mov ebp, edi loc_409635: ; CODE XREF: sub_409600+31j mov ecx, esi call sub_401974 mov ebx, eax push 0 add ebx, ebp mov ecx, esi push ebx call sub_401CAD mov edx, [esp+10h+arg_0] mov ebp, eax mov eax, [esi+4] push ebp push edx push eax mov ecx, esi call sub_4016D6 mov ecx, [esp+10h+arg_8] mov [esp+10h+arg_4], eax push ecx push edi push eax mov ecx, esi call sub_401177 mov edx, [esp+10h+arg_4] mov ecx, [esi+8] lea eax, [edx+edi*4] mov edx, [esp+10h+arg_0] push eax push ecx push edx mov ecx, esi call sub_4016D6 mov eax, [esi+8] mov ecx, [esi+4] push eax push ecx mov ecx, esi call sub_40170D mov eax, [esi+4] mov edx, [esi+0Ch] sub edx, eax mov ecx, esi sar edx, 2 push edx push eax call sub_401294 lea eax, [ebp+ebx*4+0] mov ecx, esi mov [esi+0Ch], eax call sub_401974 add eax, edi mov [esi+4], ebp pop edi lea ecx, [ebp+eax*4+0] mov [esi+8], ecx pop esi pop ebp pop ebx retn 0Ch ; --------------------------------------------------------------------------- loc_4096CB: ; CODE XREF: sub_409600+17j mov ebx, [esp+10h+arg_0] mov edx, eax sub edx, ebx sar edx, 2 cmp edx, edi jnb short loc_409729 lea ebp, ds:0[edi*4] lea ecx, [ebx+ebp] push ecx push eax push ebx mov ecx, esi call sub_4016D6 mov eax, [esi+8] mov edx, [esp+10h+arg_8] mov ecx, eax push edx sub ecx, ebx sar ecx, 2 sub edi, ecx mov ecx, esi push edi push eax call sub_401177 mov edx, [esp+10h+arg_8] mov eax, [esi+8] push edx push eax push ebx call sub_401F96 mov eax, [esi+8] add esp, 0Ch add eax, ebp mov [esi+8], eax pop edi pop esi pop ebp pop ebx retn 0Ch ; --------------------------------------------------------------------------- loc_409729: ; CODE XREF: sub_409600+D8j test edi, edi jbe short loc_409763 shl edi, 2 push eax push eax sub eax, edi mov ecx, esi push eax call sub_4016D6 mov eax, [esi+8] push eax sub eax, edi push eax push ebx call sub_401CCB mov ecx, [esp+1Ch+arg_8] lea edx, [edi+ebx] push ecx push edx push ebx call sub_401F96 mov eax, [esi+8] add esp, 18h add eax, edi mov [esi+8], eax loc_409763: ; CODE XREF: sub_409600+12Bj pop edi pop esi pop ebp pop ebx retn 0Ch sub_409600 endp ; --------------------------------------------------------------------------- db 6 dup(90h) db 60h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4097D0 proc near ; CODE XREF: sub_40170Dj arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx mov ebx, [esp+4+arg_4] push esi mov esi, [esp+8+arg_0] push edi cmp esi, ebx mov edi, ecx jz short loc_4097F0 loc_4097E1: ; CODE XREF: sub_4097D0+1Ej push esi mov ecx, edi call sub_402072 add esi, 4 cmp esi, ebx jnz short loc_4097E1 loc_4097F0: ; CODE XREF: sub_4097D0+Fj pop edi pop esi pop ebx retn 8 sub_4097D0 endp ; --------------------------------------------------------------------------- db 0Ah dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409810 proc near ; CODE XREF: sub_401294j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push eax call near ptr word_4367E2 pop ecx retn 8 sub_409810 endp ; --------------------------------------------------------------------------- db 2 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409830 proc near ; CODE XREF: sub_402072j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push eax call j_nullsub_3 pop ecx retn 4 sub_409830 endp ; --------------------------------------------------------------------------- db 2 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409850 proc near ; CODE XREF: sub_4016D6j arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebx push ebp mov ebp, [esp+8+arg_4] push esi mov esi, [esp+0Ch+arg_0] mov ebx, ecx cmp esi, ebp jz short loc_409882 push edi mov edi, [esp+10h+arg_8] loc_409866: ; CODE XREF: sub_409850+27j push esi push edi mov ecx, ebx call sub_4015AA add esi, 4 add edi, 4 cmp esi, ebp jnz short loc_409866 mov eax, edi pop edi pop esi pop ebp pop ebx retn 0Ch ; --------------------------------------------------------------------------- loc_409882: ; CODE XREF: sub_409850+Fj mov eax, [esp+0Ch+arg_8] pop esi pop ebp pop ebx retn 0Ch sub_409850 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4098A0 proc near ; CODE XREF: sub_401177j arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebp push edi mov edi, [esp+8+arg_4] mov ebp, ecx test edi, edi jbe short loc_4098C7 push ebx mov ebx, [esp+0Ch+arg_8] push esi mov esi, [esp+10h+arg_0] loc_4098B6: ; CODE XREF: sub_4098A0+23j push ebx push esi mov ecx, ebp call sub_4015AA add esi, 4 dec edi jnz short loc_4098B6 pop esi pop ebx loc_4098C7: ; CODE XREF: sub_4098A0+Aj pop edi pop ebp retn 0Ch sub_4098A0 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4098E0 proc near ; CODE XREF: sub_401CADj arg_0 = dword ptr 4 mov eax, [esp+arg_0] push 0 push eax call sub_40203B add esp, 8 retn 8 sub_4098E0 endp ; --------------------------------------------------------------------------- db 0Eh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409910 proc near ; CODE XREF: sub_4015AAj arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_4] mov ecx, [esp+arg_0] push eax push ecx call sub_401145 add esp, 8 retn 8 sub_409910 endp ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409940 proc near ; CODE XREF: sub_401F96j arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch mov eax, [esp+arg_0] mov ecx, [esp+arg_4] cmp eax, ecx jz short locret_40995D mov edx, [esp+arg_8] push esi loc_409951: ; CODE XREF: sub_409940+1Aj mov esi, [edx] mov [eax], esi add eax, 4 cmp eax, ecx jnz short loc_409951 pop esi locret_40995D: ; CODE XREF: sub_409940+Aj retn sub_409940 endp ; --------------------------------------------------------------------------- db 2 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409970 proc near ; CODE XREF: sub_401CCBj arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch mov edx, [esp+arg_0] mov ecx, [esp+arg_4] cmp edx, ecx jz short loc_409992 mov eax, [esp+arg_8] push esi loc_409981: ; CODE XREF: sub_409970+1Ej mov esi, [ecx-4] sub ecx, 4 sub eax, 4 cmp ecx, edx mov [eax], esi jnz short loc_409981 pop esi retn ; --------------------------------------------------------------------------- loc_409992: ; CODE XREF: sub_409970+Aj mov eax, [esp+arg_8] retn sub_409970 endp ; --------------------------------------------------------------------------- db 9 dup(90h) db 10h dup(0CCh) ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_3. PRESS KEYPAD "+" TO EXPAND] db 0Fh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_4099D0 proc near ; CODE XREF: sub_40203Bj arg_0 = dword ptr 4 mov eax, [esp+arg_0] test eax, eax jge short loc_4099DA xor eax, eax loc_4099DA: ; CODE XREF: sub_4099D0+6j shl eax, 2 push eax call near ptr word_4367FA add esp, 4 retn sub_4099D0 endp ; --------------------------------------------------------------------------- db 9 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409A00 proc near ; CODE XREF: sub_401145j arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_0] push eax push 4 call sub_4011CC add esp, 8 test eax, eax jz short locret_409A1B mov ecx, [esp+arg_4] mov edx, [ecx] mov [eax], edx locret_409A1B: ; CODE XREF: sub_409A00+11j retn sub_409A00 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_409A30: ; CODE XREF: ___:00401979j mov al, byte_44719A push esi test al, al mov esi, ecx jz short loc_409A66 push edi call near ptr 28118AFh nop mov edi, dword_50F8C4 push 0FFFFFFF5h call edi push 0FFFFFFF4h mov [esi], eax call edi mov [esi+4], eax mov eax, [esp+0Ch] mov byte ptr [esi+8], 1 mov [esi+9], eax pop edi pop esi retn 4 ; --------------------------------------------------------------------------- loc_409A66: ; CODE XREF: ___:00409A3Aj mov ecx, [esp+8] mov byte ptr [esi+8], 1 mov [esi+9], ecx pop esi retn 4 ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 20h dup(0CCh) ; --------------------------------------------------------------------------- loc_409AA0: ; CODE XREF: ___:00401CDAj mov al, byte_44719A push esi test al, al mov esi, ecx jz short loc_409ABF nop call near ptr 2820000h mov dword ptr [esi], 0FFFFFFFFh mov dword ptr [esi+4], 0FFFFFFFFh loc_409ABF: ; CODE XREF: ___:00409AAAj mov byte ptr [esi+8], 0 pop esi retn ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409AE0 proc near ; CODE XREF: sub_401424j mov eax, ecx xor ecx, ecx mov dword ptr [eax], offset dword_43E010 mov [eax+9], ecx mov [eax+11h], ecx mov [eax+4], cl mov [eax+0Dh], ecx retn sub_409AE0 endp ; --------------------------------------------------------------------------- db 9 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_409B10: ; CODE XREF: ___:00402063j ; ___:00402171j push esi mov esi, ecx call sub_401226 test byte ptr [esp+8], 1 jz short loc_409B28 push esi call near ptr word_4367E2 add esp, 4 loc_409B28: ; CODE XREF: ___:00409B1Dj mov eax, esi pop esi retn 4 ; --------------------------------------------------------------------------- db 2 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409B40 proc near ; CODE XREF: sub_401861j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push ebx push esi mov esi, ecx xor ebx, ebx push eax mov dword ptr [esi], offset dword_43E010 mov [esi+9], ebx mov [esi+11h], ebx call sub_4015D7 mov [esi+4], bl mov [esi+0Dh], ebx mov eax, esi pop esi pop ebx retn 4 sub_409B40 endp ; --------------------------------------------------------------------------- db 7 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409B80 proc near ; CODE XREF: sub_4014C9j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push ebx push esi mov esi, ecx xor ebx, ebx push eax mov dword ptr [esi], offset dword_43E010 mov [esi+9], ebx mov [esi+11h], ebx call sub_401FBE mov [esi+4], bl mov [esi+0Dh], ebx mov eax, esi pop esi pop ebx retn 4 sub_409B80 endp ; --------------------------------------------------------------------------- db 7 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409BC0 proc near ; CODE XREF: sub_4020F4j var_10 = byte ptr -10h arg_0 = dword ptr 4 mov eax, [esp+arg_0] sub esp, 10h push ebx push esi mov esi, ecx push eax lea ecx, [esp+1Ch+var_10] push offset dword_4437F4 push ecx mov dword ptr [esi], offset dword_43E010 call near ptr byte_5EE1E5 nop add esp, 0Ch lea edx, [esp+18h+var_10] xor ebx, ebx mov ecx, esi push edx mov [esi+9], ebx mov [esi+11h], ebx call sub_4015D7 mov [esi+4], bl mov [esi+0Dh], ebx mov eax, esi pop esi pop ebx add esp, 10h retn 4 sub_409BC0 endp ; --------------------------------------------------------------------------- db 7 dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409C30 proc near ; CODE XREF: sub_401226j push esi mov esi, ecx push edi xor edi, edi mov eax, [esi+9] mov dword ptr [esi], offset dword_43E010 cmp eax, edi jz short loc_409C4C push eax call near ptr word_4367E2 add esp, 4 loc_409C4C: ; CODE XREF: sub_409C30+11j mov eax, [esi+0Dh] mov [esi+9], edi cmp eax, edi jz short loc_409C5F push eax call near ptr word_4367E2 add esp, 4 loc_409C5F: ; CODE XREF: sub_409C30+24j mov [esi+0Dh], edi mov [esi+11h], edi pop edi pop esi retn sub_409C30 endp ; --------------------------------------------------------------------------- db 8 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409C80 proc near ; CODE XREF: sub_4015D7j arg_0 = dword ptr 4 push ebx push ebp push esi push edi mov edi, [esp+10h+arg_0] mov esi, ecx test edi, edi jz short loc_409CEA or ecx, 0FFFFFFFFh xor eax, eax repne scasb mov eax, [esi+9] not ecx dec ecx test eax, eax mov ebp, ecx jz short loc_409CAA push eax call near ptr word_4367E2 add esp, 4 loc_409CAA: ; CODE XREF: sub_409C80+1Fj lea ebx, [ebp+2] push ebx call near ptr word_4367FA mov edi, eax add esp, 4 test edi, edi mov [esi+9], edi jz short loc_409CEA mov ecx, ebx xor eax, eax mov edx, ecx mov [esi+11h], ebp shr ecx, 2 rep stosd mov ecx, edx and ecx, 3 rep stosb mov eax, [esi+11h] mov ecx, [esp+10h+arg_0] mov edx, [esi+9] push eax push ecx push edx nop call near ptr 77C47A90h add esp, 0Ch loc_409CEA: ; CODE XREF: sub_409C80+Cj ; sub_409C80+3Dj pop edi pop esi pop ebp pop ebx retn 4 sub_409C80 endp ; --------------------------------------------------------------------------- db 0Fh dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409D20 proc near ; CODE XREF: sub_401FBEj arg_0 = dword ptr 4 push esi mov esi, ecx mov ecx, [esp+4+arg_0] call sub_401389 push eax mov ecx, esi call sub_4015D7 pop esi retn 4 sub_409D20 endp ; --------------------------------------------------------------------------- db 8 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_409D50: ; CODE XREF: ___:00401A46j mov eax, [esp+4] sub esp, 10h push esi mov esi, ecx push eax lea ecx, [esp+8] push offset dword_4437F4 push ecx call near ptr byte_5EE1E5 nop add esp, 0Ch lea edx, [esp+4] mov ecx, esi push edx call sub_4015D7 pop esi add esp, 10h retn 4 ; --------------------------------------------------------------------------- db 0Fh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409DA0 proc near ; CODE XREF: sub_401A9Bj arg_0 = dword ptr 4 push ebx push ebp push esi push edi mov edi, [esp+10h+arg_0] mov ebx, ecx test edi, edi jz loc_409E32 or ecx, 0FFFFFFFFh xor eax, eax repne scasb mov edi, [ebx+11h] not ecx dec ecx mov esi, ecx add esi, edi lea eax, [esi+1] push eax call near ptr word_4367FA mov edi, [ebx+9] add esp, 4 test edi, edi mov ebp, eax jz short loc_409E32 or ecx, 0FFFFFFFFh xor eax, eax mov [ebx+11h], esi repne scasb not ecx sub edi, ecx mov edx, ecx mov esi, edi mov edi, ebp shr ecx, 2 rep movsd mov ecx, edx and ecx, 3 rep movsb mov edi, [esp+10h+arg_0] or ecx, 0FFFFFFFFh repne scasb not ecx sub edi, ecx mov esi, edi mov edx, ecx mov edi, ebp or ecx, 0FFFFFFFFh repne scasb mov ecx, edx dec edi shr ecx, 2 rep movsd mov ecx, edx and ecx, 3 rep movsb mov eax, [ebx+9] test eax, eax jz short loc_409E2F push eax call near ptr word_4367E2 add esp, 4 loc_409E2F: ; CODE XREF: sub_409DA0+84j mov [ebx+9], ebp loc_409E32: ; CODE XREF: sub_409DA0+Cj ; sub_409DA0+36j pop edi pop esi pop ebp pop ebx retn 4 sub_409DA0 endp ; --------------------------------------------------------------------------- db 7 dup(90h) db 30h dup(0CCh) ; --------------------------------------------------------------------------- loc_409E70: ; CODE XREF: ___:004016BDj push esi mov esi, ecx mov ecx, [esp+8] call sub_401389 push eax mov ecx, esi call sub_401A9B pop esi retn 4 ; --------------------------------------------------------------------------- db 8 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_409EA0: ; CODE XREF: ___:00401140j mov eax, [esp+4] sub esp, 10h push esi mov esi, ecx push eax lea ecx, [esp+8] push offset dword_4437F4 push ecx call near ptr byte_5EE1E5 nop add esp, 0Ch lea edx, [esp+4] mov ecx, esi push edx call sub_401A9B pop esi add esp, 10h retn 4 ; --------------------------------------------------------------------------- db 0Fh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409EF0 proc near ; CODE XREF: sub_4012EEj arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] test esi, esi jnz short loc_409F07 mov edx, [ecx+9] xor eax, eax test edx, edx setnz al pop esi retn 4 ; --------------------------------------------------------------------------- loc_409F07: ; CODE XREF: sub_409EF0+7j mov eax, [ecx+9] push ebx loc_409F0B: ; CODE XREF: sub_409EF0+3Dj mov dl, [eax] mov bl, [esi] mov cl, dl cmp dl, bl jnz short loc_409F36 test cl, cl jz short loc_409F2F mov dl, [eax+1] mov bl, [esi+1] mov cl, dl cmp dl, bl jnz short loc_409F36 add eax, 2 add esi, 2 test cl, cl jnz short loc_409F0B loc_409F2F: ; CODE XREF: sub_409EF0+27j pop ebx xor eax, eax pop esi retn 4 ; --------------------------------------------------------------------------- loc_409F36: ; CODE XREF: sub_409EF0+23j ; sub_409EF0+33j sbb eax, eax pop ebx sbb eax, 0FFFFFFFFh pop esi retn 4 sub_409EF0 endp ; --------------------------------------------------------------------------- db 20h dup(0CCh) ; --------------------------------------------------------------------------- loc_409F60: ; CODE XREF: ___:00401B72j push esi mov esi, ecx mov ecx, [esp+8] call sub_401389 push eax mov ecx, esi call sub_4012EE pop esi retn 4 ; --------------------------------------------------------------------------- db 8 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_409F90: ; CODE XREF: ___:00401500j mov eax, [esp+4] test eax, eax jnz short loc_409FA3 mov edx, [ecx+9] test edx, edx setnz al retn 4 ; --------------------------------------------------------------------------- loc_409FA3: ; CODE XREF: ___:00409F96j push eax mov eax, [ecx+9] push eax call near ptr 77C4624Eh nop add esp, 8 retn 4 ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_409FD0 proc near ; CODE XREF: sub_4021ADj arg_0 = dword ptr 4 push esi mov esi, ecx mov ecx, [esp+4+arg_0] call sub_401389 push eax mov ecx, esi call sub_4012EE pop esi retn 4 sub_409FD0 endp ; --------------------------------------------------------------------------- db 8 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40A000: ; CODE XREF: ___:00401CBCj push esi mov esi, ecx mov eax, [esi+9] test eax, eax jz short loc_40A013 push eax call near ptr word_4367E2 add esp, 4 loc_40A013: ; CODE XREF: ___:0040A008j mov dword ptr [esi+9], 0 pop esi retn ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A030 proc near ; CODE XREF: sub_40102Dj arg_2000 = dword ptr 2004h arg_2004 = dword ptr 2008h arg_2008 = byte ptr 200Ch mov eax, 2000h call near ptr dword_436840 mov eax, [esp+arg_2004] test eax, eax jz short loc_40A072 lea ecx, [esp+arg_2008] lea edx, [esp+0] push ecx push eax push 2000h push edx nop call near ptr 77C3FF8Ah mov ecx, [esp+10h+arg_2000] add esp, 10h lea eax, [esp+0] push eax call sub_4015D7 loc_40A072: ; CODE XREF: sub_40A030+13j add esp, 2000h retn sub_40A030 endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 7 dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A0A0 proc near ; CODE XREF: sub_401D20j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push 0 push eax call sub_401316 retn 4 sub_40A0A0 endp ; --------------------------------------------------------------------------- db 90h db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A0C0 proc near ; CODE XREF: sub_401316j arg_0 = byte ptr 4 push ebx mov ebx, dword_50FAE0 push esi push edi movsx edi, [esp+0Ch+arg_0] mov esi, ecx push edi mov eax, [esi+9] push eax call ebx add esp, 8 test eax, eax jnz short loc_40A0E4 pop edi pop esi pop ebx retn 8 ; --------------------------------------------------------------------------- loc_40A0E4: ; CODE XREF: sub_40A0C0+1Cj mov ecx, [esi+9] push edi push ecx call ebx mov edi, [esi+9] add esp, 8 mov edx, 1 sub edx, edi pop edi pop esi add eax, edx pop ebx retn 8 sub_40A0C0 endp ; --------------------------------------------------------------------------- db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40A110: ; CODE XREF: ___:004018A2j mov eax, [esp+4] push 0 push eax call sub_401807 retn 4 ; --------------------------------------------------------------------------- db 90h db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A130 proc near ; CODE XREF: sub_401807j arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_4] push esi mov esi, ecx push eax mov ecx, [esp+8+arg_0] call sub_401389 push eax mov ecx, esi call sub_402117 pop esi retn 8 sub_40A130 endp ; --------------------------------------------------------------------------- db 3 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A160 proc near ; CODE XREF: sub_4013E3j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push 0 push eax call sub_402117 retn 4 sub_40A160 endp ; --------------------------------------------------------------------------- db 90h db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A180 proc near ; CODE XREF: sub_402117j arg_0 = dword ptr 4 push ebx push esi push edi mov edi, [esp+0Ch+arg_0] test edi, edi mov esi, ecx jnz short loc_40A195 pop edi pop esi xor eax, eax pop ebx retn 8 ; --------------------------------------------------------------------------- loc_40A195: ; CODE XREF: sub_40A180+Bj mov eax, [esi+9] mov ebx, dword_50FAF8 push edi push eax call ebx add esp, 8 test eax, eax jnz short loc_40A1AF pop edi pop esi pop ebx retn 8 ; --------------------------------------------------------------------------- loc_40A1AF: ; CODE XREF: sub_40A180+27j mov ecx, [esi+9] push edi push ecx call ebx mov edi, [esi+9] add esp, 8 mov edx, 1 sub edx, edi pop edi pop esi add eax, edx pop ebx retn 8 sub_40A180 endp ; --------------------------------------------------------------------------- db 5 dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A1F0 proc near ; CODE XREF: sub_401C5Dj arg_0 = dword ptr 4 push esi push edi mov edi, [esp+8+arg_0] mov esi, ecx test edi, edi jnz short loc_40A203 pop edi xor eax, eax pop esi retn 4 ; --------------------------------------------------------------------------- loc_40A203: ; CODE XREF: sub_40A1F0+Aj mov eax, [esi+9] mov [esi+11h], edi test eax, eax jz short loc_40A216 push eax call near ptr word_4367E2 add esp, 4 loc_40A216: ; CODE XREF: sub_40A1F0+1Bj push ebx lea ebx, [edi+1] push ebx call near ptr word_4367FA mov ecx, ebx mov edi, eax mov edx, ecx xor eax, eax shr ecx, 2 mov [esi+9], edi add esp, 4 rep stosd mov ecx, edx pop ebx and ecx, 3 rep stosb mov eax, [esi+9] pop edi pop esi retn 4 sub_40A1F0 endp ; --------------------------------------------------------------------------- db 0Dh dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A270 proc near ; CODE XREF: sub_4013D9j mov eax, [ecx+11h] retn sub_40A270 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A290 proc near ; CODE XREF: sub_4012B2j var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = byte ptr -24h var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push 0FFFFFFFFh push offset SEH_40A290 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 20h push ebp mov ebp, [esp+30h+arg_8] push esi xor esi, esi cmp ebp, 1 mov [esp+34h+var_2C], ecx mov [esp+34h+var_28], esi jge short loc_40A2E2 mov esi, [esp+34h+arg_0] push offset dword_446F70 mov ecx, esi call sub_401861 mov eax, esi pop esi pop ebp mov ecx, [esp+2Ch+var_C] mov large fs:0, ecx add esp, 2Ch retn 0Ch ; --------------------------------------------------------------------------- loc_40A2E2: ; CODE XREF: sub_40A290+2Bj push ebx push edi lea ecx, [esp+3Ch+var_24] call sub_401424 mov [esp+3Ch+var_4], esi lea esi, [ebp+1] push esi call near ptr word_4367FA mov ecx, esi mov ebx, eax mov edx, ecx xor eax, eax mov edi, ebx add esp, 4 shr ecx, 2 rep stosd mov ecx, edx mov edx, [esp+3Ch+arg_4] and ecx, 3 push ebx rep stosb mov eax, [esp+40h+var_2C] mov ecx, ebp mov edi, ebx mov esi, [eax+9] add esi, edx mov edx, ecx shr ecx, 2 rep movsd mov ecx, edx and ecx, 3 rep movsb lea ecx, [esp+40h+var_24] call sub_4015D7 push ebx call near ptr word_4367E2 mov esi, [esp+40h+arg_0] add esp, 4 lea eax, [esp+3Ch+var_24] mov ecx, esi push eax call sub_4014C9 lea ecx, [esp+3Ch+var_24] call sub_401226 mov ecx, [esp+3Ch+var_C] pop edi mov eax, esi pop ebx pop esi pop ebp mov large fs:0, ecx add esp, 2Ch retn 0Ch sub_40A290 endp ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 40h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A3C0 proc near ; CODE XREF: sub_401E2Ej var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ecx push esi push edi mov esi, ecx mov [esp+0Ch+var_4], 0 call sub_4013D9 mov ecx, [esp+0Ch+arg_4] mov edi, [esp+0Ch+arg_0] sub eax, ecx push eax push ecx push edi mov ecx, esi call sub_4012B2 mov eax, edi pop edi pop esi pop ecx retn 8 sub_40A3C0 endp ; --------------------------------------------------------------------------- db 2 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40A400: ; CODE XREF: ___:0040193Dj push ecx push esi mov esi, [esp+0Ch] push 1 mov ecx, esi mov dword ptr [esp+8], 0 call sub_4020F4 mov eax, esi pop esi pop ecx retn 4 ; --------------------------------------------------------------------------- db 2 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A430 proc near ; CODE XREF: sub_4011EAj var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = byte ptr -34h var_24 = byte ptr -24h var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push 0FFFFFFFFh push offset SEH_40A430 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 30h push esi push edi mov edi, [esp+44h+arg_8] mov esi, ecx test edi, edi mov [esp+44h+var_38], 0 jnz short loc_40A471 mov esi, [esp+44h+arg_0] push offset dword_446F70 mov ecx, esi call sub_401861 jmp loc_40A5A4 ; --------------------------------------------------------------------------- loc_40A471: ; CODE XREF: sub_40A430+2Aj lea eax, [esp+44h+arg_8] lea ecx, [esp+44h+var_34] push eax call sub_401690 mov ecx, [esi+9] mov [esp+44h+var_4], 1 push ecx lea ecx, [esp+48h+var_24] call sub_401861 lea ecx, [esp+44h+var_24] mov byte ptr [esp+44h+var_4], 2 call sub_4014D3 mov [esp+44h+var_3C], eax mov cl, [eax] test cl, cl jz loc_40A555 push ebx loc_40A4B1: ; CODE XREF: sub_40A430+11Ej mov dl, [edi] cmp cl, dl jnz short loc_40A4C0 loc_40A4B7: ; CODE XREF: sub_40A430+8Ej inc eax mov [esp+48h+var_3C], eax cmp [eax], dl jz short loc_40A4B7 loc_40A4C0: ; CODE XREF: sub_40A430+85j cmp byte ptr [eax], 22h setz bl test bl, bl jz short loc_40A4CF inc eax mov [esp+48h+var_3C], eax loc_40A4CF: ; CODE XREF: sub_40A430+98j lea edx, [esp+48h+var_3C] lea ecx, [esp+48h+var_34] push edx call sub_401988 mov eax, [esp+48h+var_3C] test bl, bl mov cl, [eax] jz short loc_40A51F test cl, cl jz short loc_40A507 loc_40A4EB: ; CODE XREF: sub_40A430+D5j cmp cl, 22h jnz short loc_40A4FC mov cl, [eax+1] cmp cl, 20h jz short loc_40A507 test cl, cl jz short loc_40A507 loc_40A4FC: ; CODE XREF: sub_40A430+BEj inc eax mov [esp+48h+var_3C], eax mov cl, [eax] test cl, cl jnz short loc_40A4EB loc_40A507: ; CODE XREF: sub_40A430+B9j ; sub_40A430+C6j ... cmp byte ptr [eax], 0 jz short loc_40A54A mov byte ptr [eax], 0 mov eax, [esp+48h+var_3C] mov cl, [eax+1] test cl, cl jz short loc_40A54A add eax, 2 jmp short loc_40A546 ; --------------------------------------------------------------------------- loc_40A51F: ; CODE XREF: sub_40A430+B5j test cl, cl jz short loc_40A534 mov dl, [edi] loc_40A525: ; CODE XREF: sub_40A430+102j cmp cl, dl jz short loc_40A534 inc eax mov [esp+48h+var_3C], eax mov cl, [eax] test cl, cl jnz short loc_40A525 loc_40A534: ; CODE XREF: sub_40A430+F1j ; sub_40A430+F7j mov cl, [eax] test cl, cl jz short loc_40A54A cmp cl, [edi] jnz short loc_40A54A mov byte ptr [eax], 0 mov eax, [esp+48h+var_3C] inc eax loc_40A546: ; CODE XREF: sub_40A430+EDj mov [esp+48h+var_3C], eax loc_40A54A: ; CODE XREF: sub_40A430+DAj ; sub_40A430+E8j ... mov cl, [eax] test cl, cl jnz loc_40A4B1 pop ebx loc_40A555: ; CODE XREF: sub_40A430+7Aj lea ecx, [esp+44h+var_34] call sub_4011F9 mov ecx, [esp+44h+arg_4] cmp ecx, eax jb short loc_40A56D push offset dword_446F70 jmp short loc_40A57A ; --------------------------------------------------------------------------- loc_40A56D: ; CODE XREF: sub_40A430+134j push ecx lea ecx, [esp+48h+var_34] call sub_401F64 mov eax, [eax] push eax loc_40A57A: ; CODE XREF: sub_40A430+13Bj mov esi, [esp+48h+arg_0] mov ecx, esi call sub_401861 lea ecx, [esp+44h+var_24] mov [esp+44h+var_38], 1 call sub_401226 lea ecx, [esp+44h+var_34] mov byte ptr [esp+44h+var_4], 0 call sub_40158C loc_40A5A4: ; CODE XREF: sub_40A430+3Cj mov ecx, [esp+44h+var_C] mov eax, esi pop edi pop esi mov large fs:0, ecx add esp, 3Ch retn 10h sub_40A430 endp ; --------------------------------------------------------------------------- db 7 dup(90h) db 70h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A630 proc near ; CODE XREF: sub_4016AEj var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ecx mov eax, [esp+4+arg_8] mov edx, [esp+4+arg_4] push esi mov esi, [esp+8+arg_0] push 0 push eax push edx push esi mov [esp+18h+var_4], 0 call sub_4011EA mov eax, esi pop esi pop ecx retn 0Ch sub_40A630 endp ; --------------------------------------------------------------------------- db 9 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A670 proc near ; CODE XREF: sub_40200Ej arg_0 = dword ptr 4 push esi mov esi, ecx mov ecx, [esp+4+arg_0] call sub_401389 push eax mov ecx, esi call sub_4015D7 pop esi retn 4 sub_40A670 endp ; --------------------------------------------------------------------------- db 8 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A6A0 proc near ; CODE XREF: sub_401A87j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push eax call sub_4015D7 retn 4 sub_40A6A0 endp ; --------------------------------------------------------------------------- db 3 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A6C0 proc near ; CODE XREF: sub_40146Fj arg_0 = dword ptr 4 mov eax, [ecx+9] mov ecx, [esp+arg_0] add eax, ecx retn 4 sub_40A6C0 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40A6E0: ; CODE XREF: ___:0040149Cj mov eax, [ecx+9] mov ecx, [esp+4] add eax, ecx retn 4 ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A700 proc near ; CODE XREF: sub_401389j mov eax, [ecx+9] retn sub_40A700 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A720 proc near ; CODE XREF: sub_4017E4j mov eax, [ecx+9] retn sub_40A720 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A740 proc near ; CODE XREF: sub_4014D3j mov eax, [ecx+9] retn sub_40A740 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A760 proc near ; CODE XREF: sub_401690j arg_0 = dword ptr 4 mov eax, ecx mov ecx, [esp+arg_0] mov dl, [ecx] xor ecx, ecx mov [eax], dl mov [eax+4], ecx mov [eax+8], ecx mov [eax+0Ch], ecx retn 4 sub_40A760 endp ; --------------------------------------------------------------------------- db 8 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A790 proc near ; CODE XREF: sub_40158Cj push esi mov esi, ecx mov eax, [esi+8] mov ecx, [esi+4] push eax push ecx mov ecx, esi call sub_4019A6 mov eax, [esi+4] mov edx, [esi+0Ch] sub edx, eax mov ecx, esi sar edx, 2 push edx push eax call sub_4011EF xor eax, eax mov [esi+4], eax mov [esi+8], eax mov [esi+0Ch], eax pop esi retn sub_40A790 endp ; --------------------------------------------------------------------------- db 0Dh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A7E0 proc near ; CODE XREF: sub_4011F9j mov edx, [ecx+4] test edx, edx jnz short loc_40A7EA xor eax, eax retn ; --------------------------------------------------------------------------- loc_40A7EA: ; CODE XREF: sub_40A7E0+5j mov eax, [ecx+8] sub eax, edx sar eax, 2 retn sub_40A7E0 endp ; --------------------------------------------------------------------------- db 0Dh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A810 proc near ; CODE XREF: sub_401F64j arg_0 = dword ptr 4 push esi push edi mov esi, ecx call sub_4011F9 mov edi, [esp+8+arg_0] cmp eax, edi ja short loc_40A828 mov ecx, esi call sub_401EE7 loc_40A828: ; CODE XREF: sub_40A810+Fj mov ecx, esi call sub_401D1B lea eax, [eax+edi*4] pop edi pop esi retn 4 sub_40A810 endp ; --------------------------------------------------------------------------- db 9 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A850 proc near ; CODE XREF: sub_401988j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push esi mov esi, ecx push eax call sub_40164F push eax mov ecx, esi call sub_4016EF pop esi retn 4 sub_40A850 endp ; --------------------------------------------------------------------------- db 7 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A880 proc near ; CODE XREF: sub_401D1Bj mov eax, [ecx+4] retn sub_40A880 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A8A0 proc near ; CODE XREF: sub_40164Fj mov eax, [ecx+8] retn sub_40A8A0 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A8C0 proc near ; CODE XREF: sub_4016EFj arg_0 = dword ptr 4 arg_4 = dword ptr 8 push esi push edi mov edi, ecx call sub_401D1B mov edx, [esp+8+arg_4] mov ecx, eax mov eax, [esp+8+arg_0] push edx mov esi, eax push 1 sub esi, ecx push eax mov ecx, edi sar esi, 2 call sub_4013CF mov ecx, edi call sub_401D1B lea eax, [eax+esi*4] pop edi pop esi retn 8 sub_40A8C0 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A910 proc near ; CODE XREF: sub_4019A6j arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx mov ebx, [esp+4+arg_4] push esi mov esi, [esp+8+arg_0] push edi cmp esi, ebx mov edi, ecx jz short loc_40A930 loc_40A921: ; CODE XREF: sub_40A910+1Ej push esi mov ecx, edi call sub_4018B1 add esi, 4 cmp esi, ebx jnz short loc_40A921 loc_40A930: ; CODE XREF: sub_40A910+Fj pop edi pop esi pop ebx retn 8 sub_40A910 endp ; --------------------------------------------------------------------------- db 0Ah dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40A950: ; CODE XREF: sub_401EE7j push 0FFFFFFFFh push offset byte_438AB9 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 30h lea eax, [esp+3] lea ecx, [esp+4] push eax push offset dword_443930 nop call near ptr 76081F67h lea ecx, [esp+4] mov dword ptr [esp+38h], 0 push ecx lea ecx, [esp+18h] nop call near ptr 760A0430h lea edx, [esp+14h] push offset dword_43F080 push edx call near ptr word_436832 nop nop nop nop nop nop nop nop nop nop nop nop nop nop ; --------------------------------------------------------------------------- db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A9D0 proc near ; CODE XREF: sub_4011EFj arg_0 = dword ptr 4 mov eax, [esp+arg_0] push eax call near ptr word_4367E2 pop ecx retn 8 sub_40A9D0 endp ; --------------------------------------------------------------------------- db 2 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40A9F0 proc near ; CODE XREF: sub_4013CFj arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebx push ebp push esi mov esi, ecx push edi mov edi, [esp+10h+arg_4] mov eax, [esi+8] mov ecx, [esi+0Ch] sub ecx, eax sar ecx, 2 cmp ecx, edi jnb loc_40AABB mov ecx, esi call sub_4011F9 cmp edi, eax jnb short loc_40AA23 mov ecx, esi call sub_4011F9 mov ebp, eax jmp short loc_40AA25 ; --------------------------------------------------------------------------- loc_40AA23: ; CODE XREF: sub_40A9F0+26j mov ebp, edi loc_40AA25: ; CODE XREF: sub_40A9F0+31j mov ecx, esi call sub_4011F9 mov ebx, eax push 0 add ebx, ebp mov ecx, esi push ebx call sub_401DCF mov edx, [esp+10h+arg_0] mov ebp, eax mov eax, [esi+4] push ebp push edx push eax mov ecx, esi call sub_4010CD mov ecx, [esp+10h+arg_8] mov [esp+10h+arg_4], eax push ecx push edi push eax mov ecx, esi call sub_402176 mov edx, [esp+10h+arg_4] mov ecx, [esi+8] lea eax, [edx+edi*4] mov edx, [esp+10h+arg_0] push eax push ecx push edx mov ecx, esi call sub_4010CD mov eax, [esi+8] mov ecx, [esi+4] push eax push ecx mov ecx, esi call sub_4019A6 mov eax, [esi+4] mov edx, [esi+0Ch] sub edx, eax mov ecx, esi sar edx, 2 push edx push eax call sub_4011EF lea eax, [ebp+ebx*4+0] mov ecx, esi mov [esi+0Ch], eax call sub_4011F9 add eax, edi mov [esi+4], ebp pop edi lea ecx, [ebp+eax*4+0] mov [esi+8], ecx pop esi pop ebp pop ebx retn 0Ch ; --------------------------------------------------------------------------- loc_40AABB: ; CODE XREF: sub_40A9F0+17j mov ebx, [esp+10h+arg_0] mov edx, eax sub edx, ebx sar edx, 2 cmp edx, edi jnb short loc_40AB19 lea ebp, ds:0[edi*4] lea ecx, [ebx+ebp] push ecx push eax push ebx mov ecx, esi call sub_4010CD mov eax, [esi+8] mov edx, [esp+10h+arg_8] mov ecx, eax push edx sub ecx, ebx sar ecx, 2 sub edi, ecx mov ecx, esi push edi push eax call sub_402176 mov edx, [esp+10h+arg_8] mov eax, [esi+8] push edx push eax push ebx call sub_401E6F mov eax, [esi+8] add esp, 0Ch add eax, ebp mov [esi+8], eax pop edi pop esi pop ebp pop ebx retn 0Ch ; --------------------------------------------------------------------------- loc_40AB19: ; CODE XREF: sub_40A9F0+D8j test edi, edi jbe short loc_40AB53 shl edi, 2 push eax push eax sub eax, edi mov ecx, esi push eax call sub_4010CD mov eax, [esi+8] push eax sub eax, edi push eax push ebx call sub_4020AE mov ecx, [esp+1Ch+arg_8] lea edx, [edi+ebx] push ecx push edx push ebx call sub_401E6F mov eax, [esi+8] add esp, 18h add eax, edi mov [esi+8], eax loc_40AB53: ; CODE XREF: sub_40A9F0+12Bj pop edi pop esi pop ebp pop ebx retn 0Ch sub_40A9F0 endp ; --------------------------------------------------------------------------- db 6 dup(90h) db 60h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40ABC0 proc near ; CODE XREF: sub_4018B1j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push eax call j_nullsub_1 pop ecx retn 4 sub_40ABC0 endp ; --------------------------------------------------------------------------- db 2 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40ABE0 proc near ; CODE XREF: sub_4010CDj arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebx push ebp mov ebp, [esp+8+arg_4] push esi mov esi, [esp+0Ch+arg_0] mov ebx, ecx cmp esi, ebp jz short loc_40AC12 push edi mov edi, [esp+10h+arg_8] loc_40ABF6: ; CODE XREF: sub_40ABE0+27j push esi push edi mov ecx, ebx call sub_402121 add esi, 4 add edi, 4 cmp esi, ebp jnz short loc_40ABF6 mov eax, edi pop edi pop esi pop ebp pop ebx retn 0Ch ; --------------------------------------------------------------------------- loc_40AC12: ; CODE XREF: sub_40ABE0+Fj mov eax, [esp+0Ch+arg_8] pop esi pop ebp pop ebx retn 0Ch sub_40ABE0 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40AC30 proc near ; CODE XREF: sub_402176j arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebp push edi mov edi, [esp+8+arg_4] mov ebp, ecx test edi, edi jbe short loc_40AC57 push ebx mov ebx, [esp+0Ch+arg_8] push esi mov esi, [esp+10h+arg_0] loc_40AC46: ; CODE XREF: sub_40AC30+23j push ebx push esi mov ecx, ebp call sub_402121 add esi, 4 dec edi jnz short loc_40AC46 pop esi pop ebx loc_40AC57: ; CODE XREF: sub_40AC30+Aj pop edi pop ebp retn 0Ch sub_40AC30 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40AC70 proc near ; CODE XREF: sub_401DCFj arg_0 = dword ptr 4 mov eax, [esp+arg_0] push 0 push eax call sub_4014CE add esp, 8 retn 8 sub_40AC70 endp ; --------------------------------------------------------------------------- db 0Eh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40ACA0 proc near ; CODE XREF: sub_402121j arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_4] mov ecx, [esp+arg_0] push eax push ecx call sub_401DE8 add esp, 8 retn 8 sub_40ACA0 endp ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40ACD0 proc near ; CODE XREF: sub_401E6Fj arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch mov eax, [esp+arg_0] mov ecx, [esp+arg_4] cmp eax, ecx jz short locret_40ACED mov edx, [esp+arg_8] push esi loc_40ACE1: ; CODE XREF: sub_40ACD0+1Aj mov esi, [edx] mov [eax], esi add eax, 4 cmp eax, ecx jnz short loc_40ACE1 pop esi locret_40ACED: ; CODE XREF: sub_40ACD0+Aj retn sub_40ACD0 endp ; --------------------------------------------------------------------------- db 2 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40AD00 proc near ; CODE XREF: sub_4020AEj arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch mov edx, [esp+arg_0] mov ecx, [esp+arg_4] cmp edx, ecx jz short loc_40AD22 mov eax, [esp+arg_8] push esi loc_40AD11: ; CODE XREF: sub_40AD00+1Ej mov esi, [ecx-4] sub ecx, 4 sub eax, 4 cmp ecx, edx mov [eax], esi jnz short loc_40AD11 pop esi retn ; --------------------------------------------------------------------------- loc_40AD22: ; CODE XREF: sub_40AD00+Aj mov eax, [esp+arg_8] retn sub_40AD00 endp ; --------------------------------------------------------------------------- db 9 dup(90h) db 10h dup(0CCh) ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] db 0Fh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40AD60 proc near ; CODE XREF: sub_4014CEj arg_0 = dword ptr 4 mov eax, [esp+arg_0] test eax, eax jge short loc_40AD6A xor eax, eax loc_40AD6A: ; CODE XREF: sub_40AD60+6j shl eax, 2 push eax call near ptr word_4367FA add esp, 4 retn sub_40AD60 endp ; --------------------------------------------------------------------------- db 9 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40AD90 proc near ; CODE XREF: sub_401DE8j arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_0] push eax push 4 call sub_4011CC add esp, 8 test eax, eax jz short locret_40ADAB mov ecx, [esp+arg_4] mov edx, [ecx] mov [eax], edx locret_40ADAB: ; CODE XREF: sub_40AD90+11j retn sub_40AD90 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40ADC0: ; CODE XREF: ___:00401E6Aj mov eax, ecx mov dword ptr [eax], offset dword_43E014 retn ; --------------------------------------------------------------------------- db 7 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40ADE0: ; CODE XREF: ___:00401717j ; ___:00402027j push esi mov esi, ecx call sub_402031 test byte ptr [esp+8], 1 jz short loc_40ADF8 push esi call near ptr word_4367E2 add esp, 4 loc_40ADF8: ; CODE XREF: ___:0040ADEDj mov eax, esi pop esi retn 4 ; --------------------------------------------------------------------------- db 2 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40AE10 proc near ; CODE XREF: sub_402031j var_10 = dword ptr -10h var_C = dword ptr -0Ch var_4 = dword ptr -4 push ebp mov ebp, esp push 0FFFFFFFFh push offset SEH_40AE10 mov eax, large fs:0 push eax mov large fs:0, esp push ecx push ebx push esi push edi mov dword ptr [ecx], offset dword_43E014 mov [ebp+var_10], esp mov [ebp+var_4], 0 call sub_401744 loc_40AE41: ; DATA XREF: ___:0040AE52o mov ecx, [ebp+var_C] pop edi pop esi mov large fs:0, ecx pop ebx mov esp, ebp pop ebp retn sub_40AE10 endp ; --------------------------------------------------------------------------- mov eax, offset loc_40AE41 retn ; --------------------------------------------------------------------------- db 8 dup(90h) db 20h dup(0CCh) ; --------------------------------------------------------------------------- loc_40AE80: ; CODE XREF: ___:004014BAj call sub_401708 jmp loc_4017B2 ; --------------------------------------------------------------------------- db 6 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40AEA0: ; CODE XREF: ___:00401B18j call sub_40161D jmp loc_4017C1 ; --------------------------------------------------------------------------- db 6 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40AEC0: ; CODE XREF: ___:004013D4j push esi mov esi, ecx push esi push offset loc_40141F lea eax, [esi+0Ch] push 0 push eax call sub_40123A add esp, 10h test eax, eax jnz short loc_40AEE2 mov al, 1 mov [esi+10h], al pop esi retn ; --------------------------------------------------------------------------- loc_40AEE2: ; CODE XREF: ___:0040AED9j mov byte ptr [esi+10h], 0 xor al, al pop esi retn ; --------------------------------------------------------------------------- db 6 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40AF00: ; CODE XREF: ___:004011C2j push ecx push esi mov esi, ecx mov al, [esi+10h] test al, al jz short loc_40AF27 mov ecx, [esi+0Ch] lea eax, [esp+4] push eax push ecx call sub_40175D mov eax, [esp+0Ch] add esp, 8 mov byte ptr [esi+10h], 0 pop esi pop ecx retn ; --------------------------------------------------------------------------- loc_40AF27: ; CODE XREF: ___:0040AF09j xor eax, eax pop esi pop ecx retn ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40AF40 proc near ; CODE XREF: sub_401744j push esi mov esi, ecx mov al, [esi+10h] test al, al jz short loc_40AF5C mov eax, [esi+0Ch] push 0Fh push eax call sub_401758 add esp, 8 mov byte ptr [esi+10h], 0 loc_40AF5C: ; CODE XREF: sub_40AF40+8j pop esi retn sub_40AF40 endp ; --------------------------------------------------------------------------- db 2 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40AF70: ; CODE XREF: ___:004011F4j mov eax, [ecx+0Ch] retn ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40AF90: ; CODE XREF: ___:loc_40141Fj push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_438AE0 mov eax, large fs:0 push eax mov large fs:0, esp push ecx mov ecx, [ebp+8] push ebx push esi push edi mov eax, [ecx] mov [ebp-10h], esp mov dword ptr [ebp-4], 0 call dword ptr [eax+4] loc_40AFBE: ; DATA XREF: ___:0040AFD1o mov ecx, [ebp-0Ch] pop edi pop esi xor eax, eax mov large fs:0, ecx pop ebx mov esp, ebp pop ebp retn ; --------------------------------------------------------------------------- mov eax, offset loc_40AFBE retn ; --------------------------------------------------------------------------- db 9 dup(90h) db 20h dup(0CCh) ; --------------------------------------------------------------------------- loc_40B000: ; CODE XREF: ___:00401028j sub esp, 8 push esi mov esi, ecx mov al, [esi+10h] test al, al jz short loc_40B042 mov edx, [esi+0Ch] lea eax, [esp+4] lea ecx, [esp+8] push eax push ecx push edx call sub_40218F mov edx, [esi+0Ch] mov eax, [esp+10h] lea ecx, [esp+10h] mov [esi+8], eax push ecx push 1 push edx mov dword ptr [esp+1Ch], 0 call sub_401050 add esp, 18h loc_40B042: ; CODE XREF: ___:0040B00Bj pop esi add esp, 8 retn ; --------------------------------------------------------------------------- db 9 dup(90h) db 20h dup(0CCh) ; --------------------------------------------------------------------------- loc_40B070: ; CODE XREF: ___:00401DCAj push ecx mov al, [ecx+10h] test al, al jz short loc_40B092 mov eax, [ecx+8] lea edx, [esp+0] mov [esp+0], eax mov eax, [ecx+0Ch] push edx push 1 push eax call sub_401050 add esp, 0Ch loc_40B092: ; CODE XREF: ___:0040B076j pop ecx retn ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40B0B0: ; CODE XREF: ___:004019F1j push 0FFFFFFFFh push offset byte_438B1F mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 8 push esi mov esi, ecx push edi mov [esp+0Ch], esi call sub_4011B3 lea ecx, [esi+4] call sub_401749 lea ecx, [esi+32h] mov dword ptr [esp+18h], 0 call sub_401749 lea ecx, [esi+60h] mov byte ptr [esp+18h], 1 call sub_401749 lea edi, [esi+8Eh] lea eax, [esp+0Bh] push eax mov ecx, edi mov byte ptr [esp+1Ch], 2 call sub_401BF4 mov ecx, edi mov byte ptr [esp+18h], 3 mov dword ptr [esi], offset dword_43E020 call sub_401BEF mov ecx, [esp+10h] mov eax, esi pop edi pop esi mov large fs:0, ecx add esp, 14h retn ; --------------------------------------------------------------------------- db 0Ah dup(90h) db 30h dup(0CCh) ; --------------------------------------------------------------------------- loc_40B170: ; CODE XREF: ___:00401AE6j push 0FFFFFFFFh push offset byte_438B6F mov eax, large fs:0 push eax mov large fs:0, esp push ecx push esi mov esi, ecx push edi mov [esp+8], esi mov dword ptr [esi], offset dword_43E020 lea edi, [esi+8Eh] mov dword ptr [esp+14h], 3 mov ecx, edi call sub_401BEF mov ecx, edi mov byte ptr [esp+14h], 2 call sub_401555 lea ecx, [esi+60h] mov byte ptr [esp+14h], 1 call sub_401023 lea ecx, [esi+32h] mov byte ptr [esp+14h], 0 call sub_401023 lea ecx, [esi+4] mov dword ptr [esp+14h], 0FFFFFFFFh call sub_401023 mov ecx, [esp+0Ch] pop edi pop esi mov large fs:0, ecx add esp, 10h retn ; --------------------------------------------------------------------------- db 20h dup(0CCh) ; --------------------------------------------------------------------------- loc_40B210: ; CODE XREF: ___:004017EEj push 0FFFFFFFFh push offset dword_438BA8 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 30h push esi mov esi, ecx lea ecx, [esi+8Eh] call sub_401BEF push 0 push 14h push 13h push 9 push 0Ch push 4Eh push 12h push 1 push 16h lea eax, [esp+28h] push 3 push eax call sub_4019B5 add esp, 2Ch push esi mov ecx, eax mov dword ptr [esp+40h], 0 call sub_4017E4 lea ecx, [esi+4] push eax push ecx mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+4] mov dword ptr [esp+3Ch], 0FFFFFFFFh call sub_401226 push 0 push 14h push 5 push 7 push 4Fh push 12h push 1 push 16h lea edx, [esp+24h] push 3 push edx call sub_4019B5 add esp, 28h push esi mov ecx, eax mov dword ptr [esp+40h], 1 call sub_4017E4 push eax lea eax, [esi+32h] push eax mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+4] mov dword ptr [esp+3Ch], 0FFFFFFFFh call sub_401226 push 0 push 14h push 5 push 13h push 4Eh push 12h push 1 push 16h lea ecx, [esp+3Ch] push 3 push ecx call sub_4019B5 add esp, 28h push esi mov ecx, eax mov dword ptr [esp+40h], 2 call sub_4017E4 add esi, 60h push eax push esi mov ecx, offset dword_447158 call sub_401591 mov dword ptr [esp+3Ch], 0FFFFFFFFh lea ecx, [esp+1Ch] call sub_401226 mov ecx, [esp+34h] pop esi mov large fs:0, ecx add esp, 3Ch retn ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 50h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40B390 proc near ; CODE XREF: sub_40180Cj arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h arg_10 = byte ptr 14h arg_14 = byte ptr 18h arg_18 = dword ptr 1Ch mov eax, [esp+arg_4] push esi mov esi, ecx push edi mov ecx, [esp+8+arg_0] push eax add ecx, 1Eh call sub_401FBE mov eax, [esp+8+arg_0] mov edx, [esp+8+arg_C] push edx lea ecx, [eax+33h] call sub_401FBE mov ecx, [esp+8+arg_0] mov dl, [esp+8+arg_10] mov edi, [esp+8+arg_8] mov [ecx+48h], dl mov eax, [esp+8+arg_0] push edi push eax mov ecx, esi call sub_401F32 mov ecx, [esp+8+arg_0] mov dl, [esp+8+arg_14] push edi mov [ecx+4], dl mov eax, [esp+0Ch+arg_0] mov ecx, [esp+0Ch+arg_18] mov [eax+5], ecx mov ecx, [esp+0Ch+arg_0] call sub_401FBE lea edx, [esp+8+arg_0] lea ecx, [esi+8Eh] push edx call sub_401906 pop edi pop esi retn 1Ch sub_40B390 endp ; --------------------------------------------------------------------------- db 9 dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40B430 proc near ; CODE XREF: sub_401B5Ej var_54 = byte ptr -54h var_3C = byte ptr -3Ch var_24 = byte ptr -24h var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h arg_10 = dword ptr 14h arg_14 = dword ptr 18h arg_18 = dword ptr 1Ch push 0FFFFFFFFh push offset SEH_40B430 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 48h mov eax, [esp+54h+arg_C] push ebp push esi mov esi, ecx push edi push eax lea ecx, [esp+64h+var_24] call sub_401861 mov edi, eax mov ecx, [esp+60h+arg_8] mov [esp+60h+var_4], 0 push ecx lea ecx, [esp+64h+var_3C] call sub_401861 mov ebp, eax mov edx, [esp+60h+arg_4] lea ecx, [esp+60h+var_54] push edx mov byte ptr [esp+64h+var_4], 1 call sub_401861 mov ecx, [esp+60h+arg_18] mov edx, [esp+60h+arg_14] push ecx mov ecx, [esp+64h+arg_10] push edx mov edx, [esp+68h+arg_0] push ecx push edi push ebp push eax push edx mov ecx, esi mov byte ptr [esp+7Ch+var_4], 2 call sub_40180C lea ecx, [esp+60h+var_54] mov byte ptr [esp+60h+var_4], 1 call sub_401226 lea ecx, [esp+60h+var_3C] mov byte ptr [esp+60h+var_4], 0 call sub_401226 lea ecx, [esp+60h+var_24] mov [esp+60h+var_4], 0FFFFFFFFh call sub_401226 mov ecx, [esp+60h+var_C] pop edi pop esi pop ebp mov large fs:0, ecx add esp, 54h retn 1Ch sub_40B430 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 30h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40B520 proc near ; CODE XREF: sub_4019CEj var_8 = dword ptr -8 var_4 = byte ptr -4 arg_0 = dword ptr 4 sub esp, 8 push esi mov esi, ecx push edi lea ecx, [esp+10h+var_8] call sub_40153C add esi, 8Eh lea eax, [esp+10h+var_4] push eax mov ecx, esi call sub_401451 mov ecx, [eax] lea edx, [esp+10h+var_4] mov [esp+10h+var_8], ecx push edx mov ecx, esi call sub_401C71 push eax lea ecx, [esp+14h+var_8] call sub_40136B test al, al jz short loc_40B5A1 mov edi, [esp+10h+arg_0] loc_40B566: ; CODE XREF: sub_40B520+7Fj push edi lea ecx, [esp+14h+var_8] call sub_401F5A mov ecx, [eax] add ecx, 1Eh call sub_4021AD test eax, eax lea ecx, [esp+10h+var_8] jz short loc_40B5AB call sub_40133E lea eax, [esp+10h+var_4] mov ecx, esi push eax call sub_401C71 push eax lea ecx, [esp+14h+var_8] call sub_40136B test al, al jnz short loc_40B566 loc_40B5A1: ; CODE XREF: sub_40B520+40j pop edi xor eax, eax pop esi add esp, 8 retn 8 ; --------------------------------------------------------------------------- loc_40B5AB: ; CODE XREF: sub_40B520+60j call sub_401F5A mov eax, [eax] pop edi pop esi add esp, 8 retn 8 sub_40B520 endp ; --------------------------------------------------------------------------- db 6 dup(90h) db 30h dup(0CCh) ; --------------------------------------------------------------------------- loc_40B5F0: ; CODE XREF: ___:00401456j push 0FFFFFFFFh push offset dword_438BF8 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 18h mov eax, [esp+28h] push esi mov esi, ecx push eax lea ecx, [esp+8] call sub_401861 mov ecx, [esp+30h] mov dword ptr [esp+24h], 0 push ecx push eax mov ecx, esi call sub_4019CE lea ecx, [esp+4] mov esi, eax mov dword ptr [esp+24h], 0FFFFFFFFh call sub_401226 mov ecx, [esp+1Ch] mov eax, esi pop esi mov large fs:0, ecx add esp, 24h retn 8 ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40B680 proc near ; CODE XREF: sub_401596j arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_4] push esi mov esi, [esp+4+arg_0] push eax mov ecx, esi call sub_4015D7 mov ecx, esi call sub_4017E4 push eax nop call near ptr 77C1CF90h fstp dword ptr [esi+15h] add esp, 4 mov ecx, esi call sub_4017E4 push eax call near ptr 77C1BF18h nop add esp, 4 mov ecx, esi mov [esi+1Ah], eax mov byte ptr [esi+19h], 0 push offset dword_443954 call sub_4012EE test eax, eax jnz short loc_40B6D1 mov byte ptr [esi+19h], 1 loc_40B6D1: ; CODE XREF: sub_40B680+4Bj pop esi retn 8 sub_40B680 endp ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40B700 proc near ; CODE XREF: sub_401F32j arg_0 = dword ptr 4 arg_4 = dword ptr 8 push esi mov esi, [esp+4+arg_0] push edi mov edi, [esp+8+arg_4] mov ecx, esi mov eax, [edi+9] push eax call sub_4015D7 mov ecx, esi call sub_4017E4 push eax call near ptr 77C1CF90h nop fstp dword ptr [esi+15h] add esp, 4 mov ecx, esi call sub_4017E4 push eax nop call near ptr 77C1BF18h add esp, 4 mov ecx, esi mov [esi+1Ah], eax mov byte ptr [esi+19h], 0 push offset dword_443954 call sub_4012EE test eax, eax jnz short loc_40B755 mov byte ptr [esi+19h], 1 loc_40B755: ; CODE XREF: sub_40B700+4Fj mov cl, [edi+4] mov [esi+4], cl mov edx, [edi+5] mov [esi+5], edx pop edi pop esi retn 8 sub_40B700 endp ; --------------------------------------------------------------------------- db 0Ah dup(90h) db 20h dup(0CCh) ; --------------------------------------------------------------------------- loc_40B790: ; CODE XREF: ___:00401D43j fld dword ptr [esp+8] push esi mov esi, [esp+8] sub esp, 8 fstp qword ptr [esp] push offset dword_44395C push esi call sub_40102D mov eax, [esp+1Ch] add esp, 10h mov ecx, esi mov [esi+15h], eax call sub_4017E4 push eax nop call near ptr 77C1BF18h fld dword ptr [esp+10h] fcomp flt_43E024 mov [esi+1Ah], eax add esp, 4 mov byte ptr [esi+19h], 0 fnstsw ax test ah, 1 jnz short loc_40B7E1 mov byte ptr [esi+19h], 1 loc_40B7E1: ; CODE XREF: ___:0040B7DBj pop esi retn 8 ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 20h dup(0CCh) ; --------------------------------------------------------------------------- loc_40B810: ; CODE XREF: ___:00401C94j push ebx mov bl, [esp+0Ch] test bl, bl push esi jz short loc_40B840 mov esi, [esp+0Ch] push offset dword_443954 mov ecx, esi call sub_4015D7 mov dword ptr [esi+15h], 3F800000h mov dword ptr [esi+1Ah], 1 mov [esi+19h], bl pop esi pop ebx retn 8 ; --------------------------------------------------------------------------- loc_40B840: ; CODE XREF: ___:0040B818j mov esi, [esp+0Ch] push offset dword_443960 mov ecx, esi call sub_4015D7 xor eax, eax mov [esi+19h], bl mov [esi+15h], eax mov [esi+1Ah], eax pop esi pop ebx retn 8 ; --------------------------------------------------------------------------- db 20h dup(0CCh) ; --------------------------------------------------------------------------- loc_40B880: ; CODE XREF: ___:00401D6Bj push esi mov esi, [esp+8] push edi mov edi, [esp+10h] push edi push offset dword_4437F4 push esi call sub_40102D fild dword ptr [esp+1Ch] add esp, 0Ch cmp edi, 1 mov [esi+1Ah], edi mov byte ptr [esi+19h], 0 fstp dword ptr [esi+15h] jl short loc_40B8B0 mov byte ptr [esi+19h], 1 loc_40B8B0: ; CODE XREF: ___:0040B8AAj pop edi pop esi retn 8 ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40B8D0: ; CODE XREF: ___:00401ACDj mov eax, large fs:0 push 0FFFFFFFFh push offset dword_438C30 push eax mov large fs:0, esp sub esp, 4Ch push ebx push ebp push esi mov esi, [esp+68h] mov ebp, ecx push edi lea edi, [esi+7Eh] lea ecx, [ebp+4] call sub_4014D3 push eax mov ecx, edi call sub_4012EE test eax, eax jnz loc_40BA12 lea ebx, [esi+69h] mov ecx, ebx call sub_4014D3 mov cl, [esi+93h] push eax mov al, [esi+94h] push offset dword_4439AC push eax push ecx mov ecx, offset byte_4D60B5 call sub_401118 lea ecx, [esp+6Ch] call sub_40153C add ebp, 8Eh lea edx, [esp+10h] push edx mov ecx, ebp xor edi, edi call sub_401451 mov eax, [eax] lea ecx, [esp+10h] push ecx mov ecx, ebp mov [esp+70h], eax call sub_401C71 push eax lea ecx, [esp+70h] call sub_40136B test al, al jz loc_40BA0B loc_40B976: ; CODE XREF: ___:0040BA05j lea ecx, [esp+6Ch] inc edi call sub_401F5A mov ecx, [eax] add ecx, 33h call sub_4017E4 push eax lea ecx, [esp+70h] call sub_401F5A mov ecx, [eax] call sub_4017E4 push eax lea ecx, [esp+74h] call sub_401F5A mov ecx, [eax] add ecx, 1Eh call sub_4017E4 push eax push edi push offset dword_443990 mov ecx, ebx call sub_4014D3 mov dl, [esi+94h] push eax mov al, [esi+93h] push edx push eax push offset byte_4D60B5 call sub_401848 add esp, 24h push 5DCh nop call near ptr 28203C3h lea ecx, [esp+6Ch] call sub_40133E lea ecx, [esp+10h] push ecx mov ecx, ebp call sub_401C71 push eax lea ecx, [esp+70h] call sub_40136B test al, al jnz loc_40B976 loc_40BA0B: ; CODE XREF: ___:0040B970j mov al, 1 jmp loc_40BB9A ; --------------------------------------------------------------------------- loc_40BA12: ; CODE XREF: ___:0040B907j lea ecx, [ebp+32h] call sub_4017E4 push eax mov ecx, edi call sub_4012EE test eax, eax jnz short loc_40BAA5 push offset dword_443600 lea edx, [esp+30h] push 1 push edx mov ecx, esi call sub_4016AE push 1 push eax mov ecx, ebp mov dword ptr [esp+6Ch], 0 call sub_4019CE lea ecx, [esp+2Ch] mov edi, eax mov dword ptr [esp+64h], 0FFFFFFFFh call sub_401226 test edi, edi jz loc_40BB98 mov ecx, edi call sub_4017E4 push eax lea ecx, [edi+1Eh] call sub_4017E4 push eax push offset dword_443984 lea ecx, [esi+69h] call sub_4014D3 mov cl, [esi+93h] push eax mov al, [esi+94h] push eax push ecx push offset byte_4D60B5 call sub_401848 add esp, 1Ch jmp loc_40BB9A ; --------------------------------------------------------------------------- loc_40BAA5: ; CODE XREF: ___:0040BA24j lea ecx, [ebp+60h] call sub_4014D3 push eax mov ecx, edi call sub_4012EE test eax, eax jnz loc_40BB98 push offset dword_443600 lea edx, [esp+30h] push 1 push edx mov ecx, esi call sub_4016AE push 1 push eax mov ecx, ebp mov dword ptr [esp+6Ch], 1 call sub_4019CE lea ecx, [esp+2Ch] mov edi, eax mov dword ptr [esp+64h], 0FFFFFFFFh call sub_401226 test edi, edi jz loc_40BB98 push edi lea ecx, [esp+18h] call sub_4014C9 mov ebx, 2 push 1 push offset dword_443600 lea eax, [esp+4Ch] push ebx push eax mov ecx, esi mov [esp+74h], ebx call sub_4011EA push eax push edi mov ecx, ebp mov byte ptr [esp+6Ch], 3 call sub_401F32 lea ecx, [esp+44h] mov [esp+64h], bl call sub_401226 lea ecx, [esp+14h] call sub_4017E4 push eax mov ecx, edi call sub_4017E4 push eax lea ecx, [edi+1Eh] call sub_4017E4 push eax push offset dword_443968 lea ecx, [esi+69h] call sub_4014D3 mov cl, [esi+94h] mov dl, [esi+93h] push eax push ecx push edx push offset byte_4D60B5 call sub_401848 add esp, 20h lea ecx, [esp+14h] mov dword ptr [esp+64h], 0FFFFFFFFh call sub_401226 mov al, 1 jmp short loc_40BB9A ; --------------------------------------------------------------------------- loc_40BB98: ; CODE XREF: ___:0040BA60j ; ___:0040BAB7j ... xor al, al loc_40BB9A: ; CODE XREF: ___:0040BA0Dj ; ___:0040BAA0j ... mov ecx, [esp+5Ch] pop edi pop esi pop ebp pop ebx mov large fs:0, ecx add esp, 58h retn 4 ; --------------------------------------------------------------------------- db 90h db 0C0h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40BC70 proc near ; CODE XREF: sub_401BF4j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push esi mov esi, ecx push 0 mov cl, [eax] push 0 mov [esi], cl mov ecx, esi call sub_4021CB mov [esi+4], eax mov dword ptr [esi+8], 0 mov eax, esi pop esi retn 4 sub_40BC70 endp ; --------------------------------------------------------------------------- db 0Ah dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40BCB0 proc near ; CODE XREF: sub_401555j var_C = byte ptr -0Ch var_8 = byte ptr -8 var_4 = byte ptr -4 sub esp, 0Ch lea eax, [esp+0Ch+var_C] push esi mov esi, ecx push eax call sub_401C71 mov ecx, [eax] lea edx, [esp+10h+var_8] push ecx push edx mov ecx, esi call sub_401451 mov eax, [eax] lea ecx, [esp+14h+var_4] push eax push ecx mov ecx, esi call sub_40124E mov edx, [esi+4] mov ecx, esi push edx call sub_401FCD xor eax, eax mov [esi+4], eax mov [esi+8], eax pop esi add esp, 0Ch retn sub_40BCB0 endp ; --------------------------------------------------------------------------- db 0Ah dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40BD20 proc near ; CODE XREF: sub_401451j arg_0 = dword ptr 4 mov eax, [ecx+4] push esi push eax call sub_4020F9 mov ecx, [eax] mov esi, [esp+8+arg_0] add esp, 4 push ecx mov ecx, esi call sub_4014A6 mov eax, esi pop esi retn 4 sub_40BD20 endp ; --------------------------------------------------------------------------- db 0Fh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40BD60 proc near ; CODE XREF: sub_401C71j arg_0 = dword ptr 4 mov eax, [ecx+4] push esi mov esi, [esp+4+arg_0] push eax mov ecx, esi call sub_4014A6 mov eax, esi pop esi retn 4 sub_40BD60 endp ; --------------------------------------------------------------------------- db 0Ah dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40BD90 proc near ; CODE XREF: sub_401906j var_4 = byte ptr -4 arg_0 = dword ptr 4 push ecx mov eax, [esp+4+arg_0] push esi mov esi, ecx push eax lea ecx, [esp+0Ch+arg_0] push ecx mov ecx, esi call sub_401C71 mov edx, [eax] lea eax, [esp+0Ch+var_4] push edx push eax mov ecx, esi call sub_401C49 pop esi pop ecx retn 4 sub_40BD90 endp ; --------------------------------------------------------------------------- db 7 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40BDD0 proc near ; CODE XREF: sub_401BEFj var_C = byte ptr -0Ch var_8 = byte ptr -8 var_4 = byte ptr -4 sub esp, 0Ch lea eax, [esp+0Ch+var_C] push esi mov esi, ecx push eax call sub_401C71 mov ecx, [eax] lea edx, [esp+10h+var_8] push ecx push edx mov ecx, esi call sub_401451 mov eax, [eax] lea ecx, [esp+14h+var_4] push eax push ecx mov ecx, esi call sub_40124E pop esi add esp, 0Ch retn sub_40BDD0 endp ; --------------------------------------------------------------------------- db 0Dh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40BE20 proc near ; CODE XREF: sub_40153Cj push esi mov esi, ecx call sub_40213A mov eax, esi pop esi retn sub_40BE20 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40BE40 proc near ; CODE XREF: sub_401F5Aj mov eax, [ecx] push eax call sub_401839 add esp, 4 retn sub_40BE40 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40BE60 proc near ; CODE XREF: sub_40133Ej push esi mov esi, ecx mov eax, [esi] push eax call sub_4020F9 mov ecx, [eax] add esp, 4 mov [esi], ecx mov eax, esi pop esi retn sub_40BE60 endp ; --------------------------------------------------------------------------- db 0Ah dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40BE90 proc near ; CODE XREF: sub_40136Bj arg_0 = dword ptr 4 mov eax, [esp+arg_0] push eax call sub_401CE9 neg al sbb eax, eax inc eax retn 4 sub_40BE90 endp ; --------------------------------------------------------------------------- db 0Eh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40BEC0 proc near ; CODE XREF: sub_401C49j arg_0 = dword ptr 4 arg_4 = byte ptr 8 arg_8 = dword ptr 0Ch push ebx push esi mov esi, ecx push edi lea ecx, [esp+0Ch+arg_4] call sub_4016A4 mov edi, eax push edi call sub_40213F mov eax, [eax] add esp, 4 mov ecx, esi push eax push edi call sub_4021CB push edi mov ebx, eax call sub_40213F push edi mov [eax], ebx call sub_40213F mov edi, [eax] push edi call sub_40213F mov ecx, [eax] push ecx call sub_4020F9 mov edx, [esp+1Ch+arg_8] add esp, 10h mov [eax], edi push edx push edi call sub_401839 add esp, 4 mov ecx, esi push eax call sub_401F14 mov ecx, [esi+8] push edi inc ecx mov [esi+8], ecx mov esi, [esp+10h+arg_0] mov ecx, esi call sub_4014A6 mov eax, esi pop edi pop esi pop ebx retn 0Ch sub_40BEC0 endp ; --------------------------------------------------------------------------- db 6 dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40BF60 proc near ; CODE XREF: sub_40124Ej var_8 = byte ptr -8 var_4 = byte ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = byte ptr 0Ch sub esp, 8 lea eax, [esp+8+arg_8] push esi mov esi, ecx push eax lea ecx, [esp+10h+arg_4] call sub_40136B test al, al jz short loc_40BFBA loc_40BF78: ; CODE XREF: sub_40BF60+47j lea ecx, [esp+0Ch+var_8] push 0 push ecx lea ecx, [esp+14h+arg_4] call sub_401B86 mov edx, [eax] lea eax, [esp+0Ch+var_4] push edx push eax mov ecx, esi call sub_40106E lea ecx, [esp+0Ch+arg_8] push ecx lea ecx, [esp+10h+arg_4] call sub_40136B test al, al jnz short loc_40BF78 mov eax, [esp+0Ch+arg_0] mov edx, [esp+0Ch+arg_4] pop esi mov [eax], edx add esp, 8 retn 0Ch ; --------------------------------------------------------------------------- loc_40BFBA: ; CODE XREF: sub_40BF60+16j mov eax, [esp+0Ch+arg_0] mov ecx, [esp+0Ch+arg_4] pop esi mov [eax], ecx add esp, 8 retn 0Ch sub_40BF60 endp ; --------------------------------------------------------------------------- db 5 dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40BFF0 proc near ; CODE XREF: sub_4021CBj arg_0 = dword ptr 4 arg_4 = dword ptr 8 push esi push edi push 0Ch call sub_40155F mov edi, [esp+8+arg_0] mov esi, eax test edi, edi jnz short loc_40C005 mov edi, esi loc_40C005: ; CODE XREF: sub_40BFF0+11j push esi call sub_4020F9 mov [eax], edi mov edi, [esp+0Ch+arg_4] add esp, 4 test edi, edi jnz short loc_40C01A mov edi, esi loc_40C01A: ; CODE XREF: sub_40BFF0+26j push esi call sub_40213F add esp, 4 mov [eax], edi mov eax, esi pop edi pop esi retn 8 sub_40BFF0 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C040 proc near ; CODE XREF: sub_401FCDj arg_0 = dword ptr 4 mov eax, [esp+arg_0] push 1 push eax call sub_402059 retn 4 sub_40C040 endp ; --------------------------------------------------------------------------- db 90h db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C060 proc near ; CODE XREF: sub_4020F9j arg_0 = dword ptr 4 mov eax, [esp+arg_0] retn sub_40C060 endp ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C080 proc near ; CODE XREF: sub_401839j arg_0 = dword ptr 4 mov eax, [esp+arg_0] add eax, 8 retn sub_40C080 endp ; --------------------------------------------------------------------------- db 8 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C0A0 proc near ; CODE XREF: sub_40213Aj mov eax, ecx retn sub_40C0A0 endp ; --------------------------------------------------------------------------- db 0Dh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C0C0 proc near ; CODE XREF: sub_4014A6j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push esi mov esi, ecx push eax call sub_40105A mov eax, esi pop esi retn 4 sub_40C0C0 endp ; --------------------------------------------------------------------------- db 0Dh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C0F0 proc near ; CODE XREF: sub_401CE9j arg_0 = dword ptr 4 mov edx, [esp+arg_0] mov eax, [ecx] push esi xor ecx, ecx mov esi, [edx] cmp eax, esi pop esi setz cl mov al, cl retn 4 sub_40C0F0 endp ; --------------------------------------------------------------------------- db 0Ah dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C120 proc near ; CODE XREF: sub_40106Ej var_4 = byte ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ecx push ebx push esi push edi mov edi, ecx lea eax, [esp+10h+var_4] push 0 push eax lea ecx, [esp+18h+arg_4] call sub_401B86 mov ecx, eax call sub_4016A4 mov esi, eax push esi call sub_4020F9 push esi mov ebx, eax call sub_40213F mov ecx, [eax] push ecx call sub_4020F9 mov edx, [ebx] push esi mov [eax], edx call sub_40213F push esi mov ebx, eax call sub_4020F9 mov eax, [eax] push eax call sub_40213F mov ecx, [ebx] push esi mov [eax], ecx call sub_401839 add esp, 1Ch mov ecx, edi push eax call sub_401221 push esi mov ecx, edi call sub_401FCD mov eax, [edi+8] mov edx, [esp+10h+arg_4] dec eax mov [edi+8], eax mov eax, [esp+10h+arg_0] pop edi pop esi mov [eax], edx pop ebx pop ecx retn 8 sub_40C120 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 30h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C1E0 proc near ; CODE XREF: sub_40213Fj arg_0 = dword ptr 4 mov eax, [esp+arg_0] add eax, 4 retn sub_40C1E0 endp ; --------------------------------------------------------------------------- db 8 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C200 proc near ; CODE XREF: sub_40155Fj arg_0 = dword ptr 4 mov eax, [esp+arg_0] push 0 push eax call sub_401D16 add esp, 8 retn 4 sub_40C200 endp ; --------------------------------------------------------------------------- db 0Eh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C230 proc near ; CODE XREF: sub_402059j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push eax call near ptr word_4367E2 pop ecx retn 8 sub_40C230 endp ; --------------------------------------------------------------------------- db 2 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C250 proc near ; CODE XREF: sub_401F14j arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_4] mov ecx, [esp+arg_0] push eax push ecx call sub_4011AE add esp, 8 retn 8 sub_40C250 endp ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C280 proc near ; CODE XREF: sub_40105Aj arg_0 = dword ptr 4 mov eax, ecx mov ecx, [esp+arg_0] mov [eax], ecx retn 4 sub_40C280 endp ; --------------------------------------------------------------------------- db 5 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C2A0 proc near ; CODE XREF: sub_4016A4j mov eax, [ecx] retn sub_40C2A0 endp ; --------------------------------------------------------------------------- db 0Dh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C2C0 proc near ; CODE XREF: sub_401B86j arg_0 = dword ptr 4 push esi mov esi, [ecx] call sub_40133E mov eax, [esp+4+arg_0] mov [eax], esi pop esi retn 8 sub_40C2C0 endp ; --------------------------------------------------------------------------- db 0Eh dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C2F0 proc near ; CODE XREF: sub_401221j arg_0 = dword ptr 4 mov eax, [esp+arg_0] push eax call j_nullsub_2 pop ecx retn 4 sub_40C2F0 endp ; --------------------------------------------------------------------------- db 2 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40C310 proc near ; CODE XREF: sub_4011AEj arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_0] push eax push 4 call sub_4011CC add esp, 8 test eax, eax jz short locret_40C32B mov ecx, [esp+arg_4] mov edx, [ecx] mov [eax], edx locret_40C32B: ; CODE XREF: sub_40C310+11j retn sub_40C310 endp ; --------------------------------------------------------------------------- db 4 dup(90h) db 10h dup(0CCh) ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND] db 0Fh dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40C360: ; CODE XREF: ___:00401BE5j push 0FFFFFFFFh push offset dword_438C58 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 18h push esi push 0 push 4 push 0Eh push 5 push 13h push 4Fh push 3 push 3 lea eax, [esp+24h] push 4 mov esi, ecx push eax call sub_4019B5 add esp, 28h push esi mov ecx, eax mov dword ptr [esp+28h], 0 call sub_401681 add esi, 4 push eax push esi mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+4] mov dword ptr [esp+24h], 0FFFFFFFFh call sub_401226 mov ecx, [esp+1Ch] pop esi mov large fs:0, ecx add esp, 24h retn ; --------------------------------------------------------------------------- db 6 dup(90h) db 20h dup(0CCh) ; --------------------------------------------------------------------------- loc_40C400: ; CODE XREF: ___:00401712j mov eax, large fs:0 push 0FFFFFFFFh push offset dword_438C9C push eax mov large fs:0, esp sub esp, 0AA0h add ecx, 4 push ebx push ebp push esi push edi call sub_4014D3 mov ebp, [esp+0AC0h] push eax lea ecx, [ebp+7Eh] call sub_4012EE test eax, eax jnz loc_40C94E lea ecx, [esp+44h] call sub_401091 push 1 push offset dword_443600 lea eax, [esp+88h] xor esi, esi push 1 push eax mov ecx, ebp mov [esp+0AC8h], esi call sub_4011EA push eax lea ecx, [esp+50h] mov byte ptr [esp+0ABCh], 1 call sub_40200E lea ecx, [esp+80h] mov byte ptr [esp+0AB8h], 0 call sub_401226 push esi push 1 push 2 mov [esp+20h], esi mov [esp+24h], esi mov [esp+38h], esi call near ptr 71AB3B91h nop mov ebx, eax cmp ebx, 0FFFFFFFFh mov [esp+10h], ebx jnz short loc_40C4CC lea ecx, [esp+3ACh] push offset dword_443AC8 push ecx nop call near ptr byte_5EE1E5 add esp, 8 jmp loc_40C8F5 ; --------------------------------------------------------------------------- loc_40C4CC: ; CODE XREF: ___:0040C4AFj xor edx, edx push esi mov [esp+20h], edx mov word ptr [esp+20h], 2 mov [esp+24h], edx mov [esp+28h], edx mov [esp+2Ch], edx call near ptr 71AB2B66h nop mov [esp+1Eh], ax lea eax, [esp+1Ch] push 10h push eax push ebx mov [esp+2Ch], esi nop call near ptr 71AB3E00h test eax, eax jz short loc_40C51A lea ecx, [ebp+69h] call sub_4014D3 push eax push offset dword_443AA8 jmp loc_40C5C0 ; --------------------------------------------------------------------------- loc_40C51A: ; CODE XREF: ___:0040C505j lea eax, [esp+34h] lea ecx, [esp+1Ch] push eax push ecx push ebx mov dword ptr [esp+40h], 10h call near ptr 71AB951Eh nop mov edx, [esp+1Eh] push edx call near ptr 71AB2B66h nop lea ecx, [esp+4Ch] mov [esp+30h], eax call sub_4014D3 mov edi, eax or ecx, 0FFFFFFFFh xor eax, eax lea edx, [esp+1ACh] repne scasb not ecx sub edi, ecx mov eax, ecx mov esi, edi mov edi, edx shr ecx, 2 rep movsd mov ecx, eax and ecx, 3 xor edx, edx rep movsb loc_40C573: ; CODE XREF: ___:0040C5A3j mov al, [esp+edx+1ACh] cmp al, 20h jnz short loc_40C585 mov eax, 5Fh jmp short loc_40C588 ; --------------------------------------------------------------------------- loc_40C585: ; CODE XREF: ___:0040C57Cj movsx eax, al loc_40C588: ; CODE XREF: ___:0040C583j mov [esp+edx+5ACh], al lea edi, [esp+1ACh] or ecx, 0FFFFFFFFh xor eax, eax inc edx repne scasb not ecx dec ecx cmp edx, ecx jbe short loc_40C573 push 1 push ebx nop call near ptr 71AB88D3h test eax, eax jz short loc_40C5DD lea ecx, [ebp+69h] call sub_4014D3 push eax push offset dword_443A88 loc_40C5C0: ; CODE XREF: ___:0040C515j mov cl, [ebp+94h] mov dl, [ebp+93h] push ecx push edx mov ecx, offset byte_4D60B5 call sub_401118 jmp loc_40C8EF ; --------------------------------------------------------------------------- loc_40C5DD: ; CODE XREF: ___:0040C5B0j push 0 push 0 push 3 push 0 push 1 push 80000000h lea ecx, [esp+64h] call sub_4017E4 push eax nop call near ptr 2850000h mov esi, eax cmp esi, 0FFFFFFFFh jnz short loc_40C644 lea ecx, [ebp+69h] call sub_4014D3 mov cl, [ebp+93h] push eax mov al, [ebp+94h] push offset dword_443A6C push eax push ecx mov ecx, offset byte_4D60B5 call sub_401118 lea edx, [esp+3ACh] push offset dword_443A4C push edx call near ptr byte_5EE1E5 nop add esp, 8 jmp loc_40C8EF ; --------------------------------------------------------------------------- loc_40C644: ; CODE XREF: ___:0040C601j push 0 push esi call near ptr 2840B44h nop lea ecx, [esp+68h] mov ebx, eax call sub_401424 mov eax, [esp+30h] push ebx and eax, 0FFFFh mov byte ptr [esp+0ABCh], 2 push eax mov eax, dword_4D60CD push eax call sub_401DF7 add esp, 4 push eax nop call near ptr 71AB2BF4h push eax nop call near ptr 71AB2BC0h push eax lea ecx, [esp+58h] call sub_4017E4 push eax lea ecx, [esp+78h] push offset dword_443A30 push ecx call sub_40102D add esp, 18h lea ecx, [ebp+15h] call sub_401681 push eax lea ecx, [esp+6Ch] call sub_4014D3 mov dl, [ebp+94h] push eax mov al, [ebp+93h] push edx push eax mov ecx, offset byte_4D60B5 call sub_401118 mov edi, [esp+10h] lea ecx, [esp+3Ch] push ecx push 0 lea edx, [esp+0B0h] push 0 push edx push 0 mov dword ptr [esp+50h], 3Ch mov dword ptr [esp+54h], 0 mov [esp+0C0h], edi mov dword ptr [esp+0BCh], 1 nop call near ptr 71AB2DC0h test eax, eax jg short loc_40C73D lea ecx, [ebp+69h] call sub_4014D3 mov cl, [ebp+93h] push eax mov al, [ebp+94h] push offset dword_443A20 push eax push ecx mov ecx, offset byte_4D60B5 call sub_401118 jmp loc_40C8DA ; --------------------------------------------------------------------------- loc_40C73D: ; CODE XREF: ___:0040C710j lea edx, [esp+38h] lea eax, [esp+98h] push edx push eax push edi mov dword ptr [esp+44h], 10h nop call near ptr 71AC1028h cmp eax, 0FFFFFFFFh mov [esp+48h], eax jnz short loc_40C78D lea ecx, [ebp+69h] call sub_4014D3 mov cl, [ebp+94h] mov dl, [ebp+93h] push eax push offset dword_443A00 push ecx push edx mov ecx, offset byte_4D60B5 call sub_401118 jmp loc_40C8DA ; --------------------------------------------------------------------------- loc_40C78D: ; CODE XREF: ___:0040C760j push edi nop call near ptr 71AB9639h test ebx, ebx jz loc_40C845 loc_40C79C: ; CODE XREF: ___:0040C838j mov ebp, 400h cmp ebx, ebp jge short loc_40C7A7 mov ebp, ebx loc_40C7A7: ; CODE XREF: ___:0040C7A3j mov edx, ebx xor eax, eax neg edx push 2 mov ecx, 100h lea edi, [esp+6B4h] push eax push edx push esi rep stosd call near ptr 2840000h nop lea eax, [esp+2Ch] push 0 push eax lea ecx, [esp+6B8h] push ebp push ecx push esi call near ptr 2830492h nop mov eax, [esp+48h] push 0 lea edx, [esp+6B4h] push ebp push edx push eax nop call near ptr 71AB428Ah mov ecx, [esp+14h] mov ebp, [esp+18h] mov edi, eax push 0 cdq add ecx, eax push 400h mov [esp+1Ch], ecx lea ecx, [esp+6B8h] adc ebp, edx mov edx, [esp+50h] push ecx push edx mov [esp+28h], ebp nop call near ptr 71AB615Ah cmp eax, 1 jl loc_40C90E cmp edi, 1 jl loc_40C90E sub ebx, edi jnz loc_40C79C mov ebp, [esp+0AC0h] loc_40C845: ; CODE XREF: ___:0040C796j push esi call near ptr 2830000h nop lea ecx, [esp+80h] call sub_401424 mov eax, [esp+18h] mov ecx, [esp+14h] push eax push ecx lea ecx, [esp+54h] mov byte ptr [esp+0AC0h], 3 call sub_4014D3 mov edx, [esp+0A4h] push eax push edx call near ptr 71AB3F41h nop push eax lea eax, [esp+90h] push offset dword_4439CC push eax call sub_40102D add esp, 18h lea ecx, [ebp+69h] call sub_4014D3 push eax lea ecx, [esp+84h] call sub_4014D3 mov cl, [ebp+94h] mov dl, [ebp+93h] push eax push ecx push edx mov ecx, offset byte_4D60B5 call sub_401118 lea ecx, [esp+80h] mov byte ptr [esp+0AB8h], 2 call sub_401226 loc_40C8DA: ; CODE XREF: ___:0040C738j ; ___:0040C788j lea ecx, [esp+68h] mov byte ptr [esp+0AB8h], 0 call sub_401226 mov ebx, [esp+10h] loc_40C8EF: ; CODE XREF: ___:0040C5D8j ; ___:0040C63Fj xor esi, esi cmp ebx, esi jbe short loc_40C8FC loc_40C8F5: ; CODE XREF: ___:0040C4C7j push ebx nop call near ptr 71AB9639h loc_40C8FC: ; CODE XREF: ___:0040C8F3j mov eax, [esp+48h] push eax call near ptr 71AB9639h nop push esi call near ptr 2820557h nop loc_40C90E: ; CODE XREF: ___:0040C827j ; ___:0040C830j mov esi, [esp+0AC0h] lea ecx, [esi+69h] call sub_4014D3 mov cl, [esi+93h] push eax mov al, [esi+94h] push offset dword_4439B4 push eax push ecx mov ecx, offset byte_4D60B5 call sub_401118 mov edx, [esp+48h] push edx call near ptr 71AB9639h nop push 1 nop call near ptr 2820557h loc_40C94E: ; CODE XREF: ___:0040C439j mov ecx, [esp+0AB0h] pop edi pop esi pop ebp xor al, al pop ebx mov large fs:0, ecx add esp, 0AACh retn 4 ; --------------------------------------------------------------------------- db 5 dup(90h) db 160h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40CAD0 proc near ; CODE XREF: sub_401091j push esi mov esi, ecx lea ecx, [esi+8] call sub_401424 mov eax, esi pop esi retn sub_40CAD0 endp ; --------------------------------------------------------------------------- db 90h db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40CAF0: ; CODE XREF: ___:00401AFFj add ecx, 8 jmp sub_401226 ; --------------------------------------------------------------------------- db 8 dup(90h) db 10h dup(0CCh) ; --------------------------------------------------------------------------- loc_40CB10: ; CODE XREF: ___:00402045j push 0FFFFFFFFh push offset dword_438CC8 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 18h push esi push 0 push 5 push 0Ch push 9 lea eax, [esp+14h] push 6 mov esi, ecx push eax call sub_4019B5 add esp, 18h push esi mov ecx, eax mov dword ptr [esp+28h], 0 call sub_4017E4 add esi, 4 push eax push esi mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+4] mov dword ptr [esp+24h], 0FFFFFFFFh call sub_401226 mov ecx, [esp+1Ch] pop esi mov large fs:0, ecx add esp, 24h retn ; --------------------------------------------------------------------------- db 0Eh dup(90h) db 20h dup(0CCh) ; --------------------------------------------------------------------------- loc_40CBB0: ; CODE XREF: ___:00401BA4j mov eax, large fs:0 push 0FFFFFFFFh push offset byte_438D17 push eax mov large fs:0, esp sub esp, 270h add ecx, 4 push esi call sub_4014D3 mov esi, [esp+284h] push eax lea ecx, [esi+7Eh] call sub_4012EE test eax, eax jnz loc_40CDAE push ebx lea ecx, [esp+24h] call sub_40198D lea eax, [esi+2Ah] xor ebx, ebx push eax lea ecx, [esp+2Ch] mov [esp+284h], ebx mov [esp+28h], ebx call sub_40200E push 1 push offset dword_443600 lea ecx, [esp+14h] push 2 push ecx mov ecx, esi call sub_4011EA mov ecx, eax mov byte ptr [esp+280h], 1 call sub_4017E4 push eax lea ecx, [esp+41h] call sub_401A87 lea ecx, [esp+0Ch] mov [esp+280h], bl call sub_401226 push 1 push offset dword_443600 lea edx, [esp+14h] push 3 push edx mov ecx, esi call sub_4011EA mov ecx, eax mov byte ptr [esp+280h], 2 call sub_4017E4 push eax lea ecx, [esp+56h] call sub_401A87 lea ecx, [esp+0Ch] mov [esp+280h], bl call sub_401226 mov edx, [esp+63h] xor eax, eax mov al, [esi+94h] xor ecx, ecx mov cl, [esi+93h] mov [esp+6Bh], eax lea eax, [esp+0Ch] mov [esp+6Fh], ecx push edx push eax lea ecx, [esp+5Ah] mov [esp+6Fh], ebx mov dword ptr [esp+7Bh], 1 call sub_401E2E push offset dword_443B04 mov ecx, eax mov byte ptr [esp+284h], 3 call sub_4012EE test eax, eax lea ecx, [esp+0Ch] mov [esp+280h], bl setz byte ptr [esp+0Bh] call sub_401226 cmp [esp+0Bh], bl jz short loc_40CD2B mov ecx, [esp+63h] lea edx, [esp+0Ch] push ecx push edx lea ecx, [esp+5Ah] call sub_401E2E push offset dword_446F74 mov ecx, eax mov byte ptr [esp+284h], 4 call sub_401A87 lea ecx, [esp+0Ch] mov [esp+280h], bl call sub_401226 loc_40CD2B: ; CODE XREF: ___:0040CCF2j push ebx lea ecx, [esp+56h] call sub_4014D3 push eax lea ecx, [esp+45h] call sub_4014D3 push eax mov eax, [esp+77h] push eax lea ecx, [esp+38h] call sub_401681 mov ecx, [esp+34h] push eax push ecx call sub_402257 add esp, 18h lea edx, [esp+78h] push eax push offset dword_443AF0 push edx nop call near ptr byte_5EE1E5 mov eax, [esp+7Bh] add esp, 0Ch cmp eax, ebx jnz short loc_40CD99 mov eax, [esp+6Bh] lea ecx, [esp+78h] push eax push ecx lea ecx, [esp+30h] call sub_401681 mov edx, [esp+2Ch] push eax push edx call sub_401523 add esp, 10h loc_40CD99: ; CODE XREF: ___:0040CD76j mov eax, [esp+67h] push eax call sub_401E24 add esp, 4 push ebx nop call near ptr 2820557h pop ebx loc_40CDAE: ; CODE XREF: ___:0040CBE6j mov ecx, [esp+274h] mov al, 1 pop esi mov large fs:0, ecx add esp, 27Ch retn 4 ; --------------------------------------------------------------------------- db 8 dup(90h) db 90h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40CE60 proc near ; CODE XREF: sub_40198Dj var_10 = dword ptr -10h var_C = dword ptr -0Ch var_4 = dword ptr -4 push 0FFFFFFFFh push offset SEH_40CE60 mov eax, large fs:0 push eax mov large fs:0, esp push ecx push esi mov esi, ecx mov [esp+14h+var_10], esi lea ecx, [esi+4] call sub_401424 lea ecx, [esi+19h] mov [esp+14h+var_4], 0 call sub_401424 lea ecx, [esi+2Eh] mov byte ptr [esp+14h+var_4], 1 call sub_401424 mov ecx, [esp+14h+var_C] mov eax, esi pop esi mov large fs:0, ecx add esp, 10h retn sub_40CE60 endp ; --------------------------------------------------------------------------- db 0Ch dup(90h) db 20h dup(0CCh) ; --------------------------------------------------------------------------- loc_40CEE0: ; CODE XREF: ___:0040226Bj push 0FFFFFFFFh push offset word_438D86 mov eax, large fs:0 push eax mov large fs:0, esp push ecx push esi mov esi, ecx mov [esp+4], esi lea ecx, [esi+2Eh] mov dword ptr [esp+10h], 1 call sub_401226 lea ecx, [esi+19h] mov byte ptr [esp+10h], 0 call sub_401226 lea ecx, [esi+4] mov dword ptr [esp+10h], 0FFFFFFFFh call sub_401226 mov ecx, [esp+8] pop esi mov large fs:0, ecx add esp, 10h retn ; --------------------------------------------------------------------------- db 6 dup(90h) db 20h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40CF60 proc near ; CODE XREF: sub_402257j var_548 = byte ptr -548h var_51C = byte ptr -51Ch var_51B = byte ptr -51Bh var_408 = byte ptr -408h var_304 = byte ptr -304h var_200 = byte ptr -200h arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h arg_10 = dword ptr 14h arg_14 = dword ptr 18h sub esp, 548h lea eax, [esp+548h+var_408] push ebx push ebp push esi mov esi, [esp+554h+arg_10] push edi mov edi, dword_50FAD8 push esi push offset dword_443B18 push 104h push eax call edi add esp, 10h lea ecx, [esp+558h+var_548] lea edx, [esp+558h+var_408] push ecx push edx nop call near ptr 2870000h mov ebp, [esp+558h+arg_14] mov ebx, eax cmp ebx, 0FFFFFFFFh jz short loc_40D027 loc_40CFB0: ; CODE XREF: sub_40CF60+C5j test [esp+558h+var_548], 10h jz short loc_40D017 cmp [esp+558h+var_51C], 2Eh jnz short loc_40CFCA mov al, [esp+558h+var_51B] test al, al jz short loc_40D017 cmp al, 2Eh jz short loc_40D017 loc_40CFCA: ; CODE XREF: sub_40CF60+5Cj lea eax, [esp+558h+var_51C] lea ecx, [esp+558h+var_304] push eax push esi push offset dword_443684 push 104h push ecx call edi mov eax, [esp+56Ch+arg_C] mov ecx, [esp+56Ch+arg_8] lea edx, [esp+56Ch+var_304] push ebp push edx mov edx, [esp+574h+arg_4] push eax mov eax, [esp+578h+arg_0] push ecx push edx push eax call sub_402257 add esp, 2Ch mov ebp, eax loc_40D017: ; CODE XREF: sub_40CF60+55j ; sub_40CF60+64j ... lea ecx, [esp+558h+var_548] push ecx push ebx nop call near ptr 2860000h test eax, eax jnz short loc_40CFB0 loc_40D027: ; CODE XREF: sub_40CF60+4Ej push ebx call near ptr 28502A8h nop mov edx, [esp+558h+arg_C] lea eax, [esp+558h+var_408] push edx push esi push offset dword_443684 push 104h push eax call edi add esp, 14h lea ecx, [esp+558h+var_548] lea edx, [esp+558h+var_408] push ecx push edx nop call near ptr 2870000h mov ebx, eax cmp ebx, 0FFFFFFFFh jz short loc_40D0BB loc_40D068: ; CODE XREF: sub_40CF60+159j lea eax, [esp+558h+var_51C] lea ecx, [esp+558h+var_200] push eax push esi push offset dword_443B08 push 200h push ecx inc ebp call edi mov edx, [esp+56Ch+arg_8] mov ecx, [esp+56Ch+arg_4] lea eax, [esp+56Ch+var_200] push edx mov edx, [esp+570h+arg_0] push eax push ecx push edx call sub_401523 add esp, 24h lea eax, [esp+558h+var_548] push eax push ebx call near ptr 2860000h nop test eax, eax jnz short loc_40D068 loc_40D0BB: ; CODE XREF: sub_40CF60+106j push ebx call near ptr 28502A8h nop pop edi mov eax, ebp pop esi pop ebp pop ebx add esp, 548h retn sub_40CF60 endp ; --------------------------------------------------------------------------- db 90h db 60h dup(0CCh) ; --------------------------------------------------------------------------- loc_40D130: ; CODE XREF: ___:0040104Bj push 0FFFFFFFFh push offset dword_438DC0 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 30h push esi push edi push 0 push 4 push 4 push 1 push 13h lea eax, [esp+1Ch] push 1 mov esi, ecx push eax call sub_4019B5 add esp, 1Ch push esi mov ecx, eax mov dword ptr [esp+44h], 0 call sub_4017E4 lea ecx, [esi+19h] push eax push ecx mov ecx, offset dword_447158 call sub_401591 or edi, 0FFFFFFFFh lea ecx, [esp+8] mov [esp+40h], edi call sub_401226 push 0 push 0Ch push 5 push 4 push 13h lea edx, [esp+1Ch] push 1 push edx call sub_4019B5 add esp, 1Ch push esi mov ecx, eax mov dword ptr [esp+44h], 1 call sub_4017E4 push eax lea eax, [esi+47h] push eax mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+8] mov [esp+40h], edi call sub_401226 push 0 push 4 push 4 push 1 push 3 push 16h lea ecx, [esp+20h] push 13h push ecx call sub_4019B5 add esp, 20h push esi mov ecx, eax mov dword ptr [esp+44h], 2 call sub_4017E4 lea edx, [esi+75h] push eax push edx mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+8] mov [esp+40h], edi call sub_401226 push 0 push 0Ch push 5 push 4 push 3 push 16h push 13h lea eax, [esp+3Ch] push eax call sub_4019B5 add esp, 20h push esi mov ecx, eax mov dword ptr [esp+44h], 3 call sub_4017E4 add esi, 0A3h push eax push esi mov ecx, offset dword_447158 call sub_401591 lea ecx, [esp+20h] mov [esp+40h], edi call sub_401226 mov ecx, [esp+38h] pop edi pop esi mov large fs:0, ecx add esp, 3Ch retn ; --------------------------------------------------------------------------- db 5 dup(90h) db 60h dup(0CCh) ; --------------------------------------------------------------------------- loc_40D2E0: ; CODE XREF: ___:004013CAj sub esp, 104h lea eax, [esp+0] push 104h push eax push 0 call near ptr 2871AFBh nop push eax nop call near ptr 2871062h mov eax, dword_4470B0 test eax, eax jz loc_40D403 mov ecx, dword_4470AC test ecx, ecx jz loc_40D403 mov ecx, dword_446F78 test ecx, ecx jz loc_40D403 push 0 push 2 call eax cmp eax, 0FFFFFFFFh mov dword_4470A8, eax jz loc_40D403 push ebp push offset dword_446F80 push eax xor ebp, ebp mov dword_446F80, 128h call dword_4470AC test eax, eax jz loc_40D3EC push ebx mov ebx, [esp+110h] push esi mov esi, dword_50FAD4 push edi loc_40D36D: ; CODE XREF: ___:0040D3E7j mov edi, offset dword_446FA4 or ecx, 0FFFFFFFFh xor eax, eax lea edx, [esp+10h] repne scasb not ecx dec ecx mov edi, offset dword_446FA4 push ecx or ecx, 0FFFFFFFFh repne scasb not ecx dec ecx lea edi, [esp+14h] sub edx, ecx or ecx, 0FFFFFFFFh repne scasb not ecx dec ecx push offset dword_446FA4 add edx, ecx push edx call esi add esp, 0Ch test eax, eax jz short loc_40D3D3 mov edi, offset dword_446FA4 or ecx, 0FFFFFFFFh xor eax, eax repne scasb not ecx dec ecx push ecx push offset dword_446FA4 mov ecx, ebx call sub_401681 push eax call esi add esp, 0Ch test eax, eax jnz short loc_40D3D4 loc_40D3D3: ; CODE XREF: ___:0040D3ABj inc ebp loc_40D3D4: ; CODE XREF: ___:0040D3D1j mov eax, dword_4470A8 push offset dword_446F80 push eax call dword_446F78 test eax, eax jnz short loc_40D36D pop edi pop esi pop ebx loc_40D3EC: ; CODE XREF: ___:0040D357j mov ecx, dword_4470A8 push ecx nop call near ptr 2830000h mov eax, ebp pop ebp add esp, 104h retn ; --------------------------------------------------------------------------- loc_40D403: ; CODE XREF: ___:0040D306j ; ___:0040D314j ... xor eax, eax add esp, 104h retn ; --------------------------------------------------------------------------- db 4 dup(90h) db 50h dup(0CCh) ; --------------------------------------------------------------------------- loc_40D460: ; CODE XREF: ___:00401F91j sub esp, 11Ch lea eax, [esp+18h] push ebx push esi push edi push 104h push eax call near ptr 2880B59h nop mov edi, offset dword_443B20 or ecx, 0FFFFFFFFh xor eax, eax lea edx, [esp+24h] repne scasb not ecx sub edi, ecx push eax mov esi, edi mov ebx, ecx mov edi, edx or ecx, 0FFFFFFFFh repne scasb mov ecx, ebx dec edi shr ecx, 2 rep movsd mov ecx, ebx push 80h and ecx, 3 push 3 push eax push 1 rep movsb mov edi, dword_50F8E8 lea eax, [esp+38h] push 80000000h push eax call edi mov esi, eax cmp esi, 0FFFFFFFFh jz short loc_40D526 lea ecx, [esp+1Ch] lea edx, [esp+0Ch] push ecx lea eax, [esp+18h] push edx push eax push esi nop call near ptr 28807BAh mov ebx, dword_50F8D8 push esi call ebx mov ecx, [esp+12Ch] push 0 push 80h push 3 push 0 push 2 push 40000000h push ecx call edi mov esi, eax cmp esi, 0FFFFFFFFh jz short loc_40D526 lea edx, [esp+1Ch] lea eax, [esp+0Ch] push edx lea ecx, [esp+18h] push eax push ecx push esi nop call near ptr 2880000h push esi call ebx loc_40D526: ; CODE XREF: ___:0040D4C9j ; ___:0040D50Bj pop edi pop esi pop ebx add esp, 11Ch retn 4 ; --------------------------------------------------------------------------- db 0Eh dup(90h) db 40h dup(0CCh) ; --------------------------------------------------------------------------- loc_40D580: ; CODE XREF: ___:00401B59j push 0FFFFFFFFh push offset dword_438E38 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 190h push ebx push esi mov esi, ecx push edi lea ecx, [esp+3Ch] call sub_401424 push 104h push 104h lea ecx, [esp+44h] mov dword ptr [esp+1ACh], 0 call sub_401C5D push eax nop call near ptr 27D09BAh lea ecx, [esp+3Ch] call sub_4017E4 push eax lea ecx, [esi+4] call sub_4015D7 lea ecx, [esp+24h] call sub_401424 mov ebx, 1 push 104h push 104h lea ecx, [esp+2Ch] mov [esp+1ACh], bl call sub_401C5D push eax push 0 nop call near ptr 2871AFBh push eax nop call near ptr 2871062h push offset dword_443BA0 nop call near ptr 27C0A4Eh mov esi, eax test esi, esi jz short loc_40D671 mov edi, dword_50F8A0 push offset dword_443B84 push esi call edi push offset dword_443B64 push esi mov dword_4470B4, eax call edi push offset dword_443B50 push esi mov dword_4470B0, eax call edi push offset dword_443B40 push esi mov dword_4470AC, eax call edi mov dword_446F78, eax mov eax, dword_4470B4 test eax, eax jz short loc_40D671 push ebx push 0 call eax loc_40D671: ; CODE XREF: ___:0040D627j ; ___:0040D66Aj mov esi, [esp+1ACh] push 0 mov ecx, esi call sub_4017E4 push eax lea ecx, [esp+2Ch] call sub_402117 test eax, eax jnz short loc_40D6A8 mov al, byte_44719F test al, al jz short loc_40D6A8 mov ecx, esi call sub_4017E4 push eax call sub_4015FA add esp, 4 loc_40D6A8: ; CODE XREF: ___:0040D68Dj ; ___:0040D696j push 0 push 5 push 18h push 5 push 4Eh push 46h push 47h push 12h push 10h push 10h push 0Eh push 9 lea eax, [esp+3Ch] push 17h push eax call sub_4019B5 add esp, 38h mov ecx, eax mov byte ptr [esp+1A4h], 2 call sub_4017E4 push eax call sub_4015FA add esp, 4 lea ecx, [esp+0Ch] mov [esp+1A4h], bl call sub_401226 push 0 push 5 push 18h push 5 push 4Eh push 14h push 13h push 0Fh push 8 push 0Ch push 0Ch lea ecx, [esp+38h] push 4 push ecx call sub_4019B5 add esp, 34h mov ecx, eax mov byte ptr [esp+1A4h], 3 call sub_4017E4 push eax call sub_4015FA add esp, 4 lea ecx, [esp+0Ch] mov [esp+1A4h], bl call sub_401226 push 0 push 5 push 18h push 5 push 4Eh push 4 push 10h push 14h push 6 lea edx, [esp+30h] push 14h push edx call sub_4019B5 add esp, 2Ch mov ecx, eax mov byte ptr [esp+1A4h], 4 call sub_4017E4 push eax call sub_4015FA add esp, 4 lea ecx, [esp+0Ch] mov [esp+1A4h], bl call sub_401226 push 0 push 5 push 18h push 5 push 4Eh push 14h push 13h push ebx push 0Ch push 2 push 13h lea eax, [esp+38h] push 0Dh push eax call sub_4019B5 add esp, 34h mov ecx, eax mov byte ptr [esp+1A4h], 5 call sub_4017E4 push eax call sub_4015FA add esp, 4 lea ecx, [esp+0Ch] mov [esp+1A4h], bl call sub_401226 push 0 push 5 push 18h push 5 push 4Eh push 46h push 47h push 13h push 9 push 0Eh push 5 lea ecx, [esp+38h] push 10h push ecx call sub_4019B5 add esp, 34h mov ecx, eax mov byte ptr [esp+1A4h], 6 call sub_4017E4 push eax call sub_4015FA add esp, 4 lea ecx, [esp+0Ch] mov [esp+1A4h], bl call sub_401226 push 0 push 5 push 18h push 5 push 4Eh push 8 push 3 push 14h push ebx push 10h push 13h lea edx, [esp+38h] push 0Dh push edx call sub_4019B5 add esp, 34h mov ecx, eax mov byte ptr [esp+1A4h], 7 call sub_4017E4 push eax call sub_4015FA add esp, 4 lea ecx, [esp+0Ch] mov [esp+1A4h], bl call sub_401226 lea eax, [esp+3Ch] push 0 push eax lea ecx, [esp+2Ch] call sub_401807 test eax, eax jnz loc_40D9A0 push ebp mov ecx, esi call sub_4017E4 push eax push 5Ch lea ecx, [esp+48h] call sub_4017E4 push eax lea ecx, [esp+0A8h] push offset dword_443B38 push ecx nop call near ptr byte_5EE1E5 mov edi, dword_50F8A4 add esp, 14h call edi lea edx, [esp+9Ch] push 0 push edx lea ecx, [esp+30h] mov ebp, eax call sub_401681 mov esi, dword_50F90C push eax call esi test eax, eax jnz short loc_40D90F loc_40D8DF: ; CODE XREF: ___:0040D90Dj call edi sub eax, ebp cmp eax, 61A8h jnb short loc_40D90F push 7D0h call near ptr 28203C3h nop lea eax, [esp+9Ch] push 0 push eax lea ecx, [esp+30h] call sub_401681 push eax call esi test eax, eax jz short loc_40D8DF loc_40D90F: ; CODE XREF: ___:0040D8DDj ; ___:0040D8E8j mov al, byte_4477FB pop ebp test al, al jz short loc_40D952 mov esi, dword_50FACC push 104h lea ecx, [esp+9Ch] push offset dword_443B30 push ecx call esi add esp, 0Ch lea ecx, [esp+24h] push 104h call sub_4017E4 lea edx, [esp+9Ch] push eax push edx call esi add esp, 0Ch loc_40D952: ; CODE XREF: ___:0040D917j mov ecx, 11h xor eax, eax lea edi, [esp+54h] lea edx, [esp+98h] rep stosd mov [esp+84h], ax lea eax, [esp+0Ch] lea ecx, [esp+54h] push eax push ecx push 0 push 0 push 28h push ebx push 0 push 0 push edx push 0 mov dword ptr [esp+7Ch], 44h call near ptr 27E0000h nop test eax, eax jz short loc_40D9A0 push 0 nop call near ptr 77C39E7Eh loc_40D9A0: ; CODE XREF: ___:0040D884j ; ___:0040D996j lea ecx, [esp+24h] mov byte ptr [esp+1A4h], 0 call sub_401226 lea ecx, [esp+3Ch] mov dword ptr [esp+1A4h], 0FFFFFFFFh call sub_401226 mov ecx, [esp+19Ch] pop edi mov al, bl pop esi pop ebx mov large fs:0, ecx add esp, 19Ch retn 4 ; --------------------------------------------------------------------------- db 0Fh dup(90h) db 120h dup(0CCh) ; --------------------------------------------------------------------------- loc_40DB10: ; CODE XREF: ___:00401195j mov al, byte_4471A1 test al, al jz short loc_40DB24 push offset word_4471A2 nop call near ptr 27D0894h loc_40DB24: ; CODE XREF: ___:0040DB17j mov al, 1 retn ; --------------------------------------------------------------------------- db 9 dup(90h) db 10h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40DB40 proc near ; CODE XREF: sub_401E5Bj var_6D0 = dword ptr -6D0h var_6CC = dword ptr -6CCh var_6C8 = dword ptr -6C8h var_6C4 = dword ptr -6C4h var_6C0 = dword ptr -6C0h var_6BC = dword ptr -6BCh var_6B8 = dword ptr -6B8h var_6B4 = dword ptr -6B4h var_6B0 = byte ptr -6B0h var_6AC = byte ptr -6ACh var_694 = byte ptr -694h var_67C = byte ptr -67Ch var_664 = byte ptr -664h var_64C = byte ptr -64Ch var_634 = byte ptr -634h var_61C = byte ptr -61Ch var_604 = byte ptr -604h var_5EC = byte ptr -5ECh var_5D4 = byte ptr -5D4h var_5BC = byte ptr -5BCh var_5A4 = byte ptr -5A4h var_58C = byte ptr -58Ch var_574 = byte ptr -574h var_564 = dword ptr -564h var_534 = word ptr -534h var_520 = byte ptr -520h var_41C = byte ptr -41Ch var_318 = byte ptr -318h var_214 = byte ptr -214h var_110 = byte ptr -110h var_C = dword ptr -0Ch var_4 = dword ptr -4 push 0FFFFFFFFh push offset SEH_40DB40 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 6C4h push esi lea eax, [esp+6D4h+var_41C] push 104h push eax push 0 nop call near ptr 2871AFBh push eax nop call near ptr 2871062h lea ecx, [esp+6D4h+var_318] push ecx push 104h call near ptr 27B0000h nop push 0 push 14h push 1 push 2 push 4Fh push 0Fh push 12h push 6 lea edx, [esp+6F4h+var_5EC] push 1 push edx call sub_4019B5 add esp, 28h mov ecx, eax mov [esp+6D4h+var_4], 0 call sub_4017E4 push eax lea eax, [esp+6D8h+var_318] push eax lea ecx, [esp+6DCh+var_520] push offset dword_443684 push ecx nop call near ptr byte_5EE1E5 add esp, 10h lea ecx, [esp+6D4h+var_5EC] mov [esp+6D4h+var_4], 0FFFFFFFFh call sub_401226 push 0 push 0 push 2 push 0 push 0 lea edx, [esp+6E8h+var_520] push 40000000h push edx call near ptr 2850000h nop mov esi, eax test esi, esi jbe loc_40E0A1 push ebx push ebp push edi lea ecx, [esp+6E0h+var_6AC] call sub_401424 push 0 push 14h push 1 push 2 lea eax, [esp+6F0h+var_604] push 4Fh push eax mov [esp+6F8h+var_4], 1 call sub_4019B5 add esp, 18h mov edi, eax push 0 push 39h push 10h push 0Dh push 5 push 14h push 39h push 4Eh push 0Ch push 5 lea ecx, [esp+708h+var_634] push 4 push ecx mov byte ptr [esp+710h+var_4], 2 call sub_4019B5 add esp, 30h mov ebp, eax push 0 push 14h push 1 push 2 lea edx, [esp+6F0h+var_664] push 4Fh push edx mov byte ptr [esp+6F8h+var_4], 3 call sub_4019B5 add esp, 18h mov ebx, eax push 0 push 39h push 10h push 0Dh push 5 push 14h push 39h push 4Eh push 20h push 52h push 4Eh push 0Ch push 5 lea eax, [esp+714h+var_67C] push 4 push eax mov byte ptr [esp+71Ch+var_4], 4 call sub_4019B5 add esp, 3Ch mov [esp+6E0h+var_6B4], eax push 0 push 5 push 0Eh push 0Fh push 4 lea ecx, [esp+6F4h+var_61C] push 53h push ecx mov byte ptr [esp+6FCh+var_4], 5 call sub_4019B5 add esp, 1Ch mov [esp+6E0h+var_6C8], eax push 0 push 14h push 12h push 1 push 14h push 13h push 4Eh push 0Fh push 14h push 0Fh lea edx, [esp+708h+var_5D4] push 7 push edx mov byte ptr [esp+710h+var_4], 6 call sub_4019B5 add esp, 30h mov [esp+6E0h+var_6B8], eax push 0 push 54h push 54h push 45h push 39h push 54h push 54h push 4Eh push 0Ch push 5 lea eax, [esp+708h+var_5A4] push 4 push eax mov byte ptr [esp+710h+var_4], 7 call sub_4019B5 add esp, 30h mov [esp+6E0h+var_6C0], eax push 0 push 54h push 54h push 45h push 39h push 54h push 54h push 4Eh push 20h push 52h push 4Eh push 0Ch push 5 lea ecx, [esp+714h+var_58C] push 4 push ecx mov byte ptr [esp+71Ch+var_4], 8 call sub_4019B5 add esp, 3Ch mov [esp+6E0h+var_6D0], eax push 0 push 5 push 0Eh push 0Fh push 4 push 4Eh push 0Fh push 14h push 0Fh push 7 push 4Eh push 54h push 54h push 45h push 39h push 54h push 54h push 4Eh push 14h push 13h push 9 mov byte ptr [esp+734h+var_4], 9 push 18h push 5 push 4Eh push 14h push 0Fh push 0Eh push 4Eh push 6 lea edx, [esp+754h+var_694] push 9 push edx call sub_4019B5 add esp, 7Ch mov [esp+6E0h+var_6CC], eax push 0 push 14h push 12h push 1 push 14h push 13h lea eax, [esp+6F8h+var_5BC] push 53h push eax mov byte ptr [esp+700h+var_4], 0Ah call sub_4019B5 add esp, 20h mov [esp+6E0h+var_6C4], eax push 0 push 6 push 6 push 0Fh push 4Eh push 0Fh push 8 push 3 push 5 lea ecx, [esp+704h+var_64C] push 56h push ecx mov byte ptr [esp+70Ch+var_4], 0Bh call sub_4019B5 add esp, 2Ch mov [esp+6E0h+var_6BC], eax mov ecx, edi mov byte ptr [esp+6E0h+var_4], 0Ch call sub_4017E4 push eax mov ecx, ebp call sub_4017E4 push eax mov ecx, ebx call sub_4017E4 mov ecx, [esp+6E8h+var_6B4] push eax call sub_4017E4 mov ecx, [esp+6ECh+var_6C8] push eax call sub_4017E4 mov ecx, [esp+6F0h+var_6B8] push eax call sub_4017E4 mov ecx, [esp+6F4h+var_6C0] push eax call sub_4017E4 mov ecx, [esp+6F8h+var_6D0] push eax call sub_4017E4 mov ecx, [esp+6FCh+var_6CC] push eax call sub_4017E4 mov ecx, [esp+700h+var_6C4] push eax call sub_4017E4 mov ecx, [esp+704h+var_6BC] push eax call sub_4017E4 push eax push offset dword_443BCC lea edx, [esp+710h+var_6AC] push edx call sub_40102D add esp, 34h lea ecx, [esp+6E0h+var_64C] mov byte ptr [esp+6E0h+var_4], 0Bh call sub_401226 lea ecx, [esp+6E0h+var_5BC] mov byte ptr [esp+6E0h+var_4], 0Ah call sub_401226 lea ecx, [esp+6E0h+var_694] mov byte ptr [esp+6E0h+var_4], 9 call sub_401226 lea ecx, [esp+6E0h+var_58C] mov byte ptr [esp+6E0h+var_4], 8 call sub_401226 lea ecx, [esp+6E0h+var_5A4] mov byte ptr [esp+6E0h+var_4], 7 call sub_401226 lea ecx, [esp+6E0h+var_5D4] mov byte ptr [esp+6E0h+var_4], 6 call sub_401226 lea ecx, [esp+6E0h+var_61C] mov byte ptr [esp+6E0h+var_4], 5 call sub_401226 lea ecx, [esp+6E0h+var_67C] mov byte ptr [esp+6E0h+var_4], 4 call sub_401226 lea ecx, [esp+6E0h+var_664] mov byte ptr [esp+6E0h+var_4], 3 call sub_401226 lea ecx, [esp+6E0h+var_634] mov byte ptr [esp+6E0h+var_4], 2 call sub_401226 lea ecx, [esp+6E0h+var_604] mov byte ptr [esp+6E0h+var_4], 1 call sub_401226 lea eax, [esp+6E0h+var_6B0] push 0 push eax push 69h lea ecx, [esp+6ECh+var_6AC] call sub_4017E4 push eax push esi call near ptr 27C0000h nop push esi call near ptr 2830000h nop mov ecx, 11h xor eax, eax lea edi, [esp+6E0h+var_564] push 104h rep stosd lea ecx, [esp+6E4h+var_41C] mov [esp+6E4h+var_564], 44h push ecx push eax mov [esp+6ECh+var_534], ax call near ptr 2871AFBh nop push eax nop call near ptr 2871062h lea edx, [esp+6E0h+var_41C] lea eax, [esp+6E0h+var_520] push edx push eax lea ecx, [esp+6E8h+var_214] push offset dword_443BB0 push ecx nop call near ptr byte_5EE1E5 add esp, 10h lea edx, [esp+6E0h+var_110] lea eax, [esp+6E0h+var_214] push 104h push edx push eax call near ptr 27F0000h nop lea ecx, [esp+6E0h+var_574] lea edx, [esp+6E0h+var_564] push ecx push edx push 0 push 0 push 28h push 1 push 0 lea eax, [esp+6FCh+var_110] push 0 push eax push 0 call near ptr 27E0000h nop lea ecx, [esp+6E0h+var_6AC] mov [esp+6E0h+var_4], 0FFFFFFFFh call sub_401226 pop edi pop ebp pop ebx mov al, 1 pop esi mov ecx, [esp+6D0h+var_C] mov large fs:0, ecx add esp, 6D0h retn ; --------------------------------------------------------------------------- loc_40E0A1: ; CODE XREF: sub_40DB40+D6j mov ecx, [esp+6D4h+var_C] mov al, 1 pop esi mov large fs:0, ecx add esp, 6D0h retn sub_40DB40 endp ; --------------------------------------------------------------------------- db 7 dup(90h) db 160h dup(0CCh) ; --------------------------------------------------------------------------- loc_40E220: ; CODE XREF: ___:00401726j push 0FFFFFFFFh push offset dword_438F50 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 64h push ebx push ebp push esi push edi lea ecx, [esp+2Ch] call sub_401424 lea ecx, [esp+14h] mov dword ptr [esp+7Ch], 0 call sub_401424 lea ecx, [esp+44h] mov byte ptr [esp+7Ch], 1 call sub_401424 push 0 push 5 push 3 push 0Eh push 29h push 0Eh push 15h push 2Ch push 50h push 0Eh push 0Fh push 9 push 13h push 12h push 5 push 30h push 14h push 0Eh push 5 push 12h push 12h push 15h push 1Dh push 50h push 13h push 17h push 0Fh push 4 push 0Eh push 9 push 31h push 50h push 14h push 6 push 0Fh push 13h push 0Fh push 12h push 3 push 9 push 27h push 50h push 5 push 12h push 1 push 17h push 14h push 6 push 0Fh lea eax, [esp+120h] mov bl, 2 push 2Dh push eax mov [esp+148h], bl call sub_4019B5 add esp, 0CCh push eax lea ecx, [esp+18h] mov byte ptr [esp+80h], 3 call sub_40200E lea ecx, [esp+5Ch] mov [esp+7Ch], bl call sub_401226 push 0 push 13h push 5 push 3 push 9 push 16h push 12h push 5 push 2Dh push 0Eh push 15h push 2Ch push 50h push 0Eh push 0Fh push 9 push 13h push 12h push 5 push 30h push 14h push 0Eh push 5 push 12h push 12h push 15h push 1Dh push 50h push 13h push 17h push 0Fh push 4 push 0Eh push 9 push 31h push 50h push 14h push 6 push 0Fh push 13h push 0Fh push 12h push 3 push 9 push 27h push 50h push 5 push 12h push 1 push 17h push 14h push 6 push 0Fh lea ecx, [esp+130h] push 2Dh push ecx call sub_4019B5 add esp, 0DCh push eax lea ecx, [esp+48h] mov byte ptr [esp+80h], 4 call sub_40200E lea ecx, [esp+5Ch] mov [esp+7Ch], bl call sub_401226 push 0 push 0Eh push 15h push 2Ch push 50h push 0Eh push 0Fh push 9 push 13h push 12h push 5 push 30h push 14h push 0Eh push 5 push 12h push 12h push 15h push 1Dh push 50h push 13h push 17h push 0Fh push 4 push 0Eh push 9 push 31h push 50h push 14h push 6 push 0Fh push 13h push 0Fh push 12h push 3 push 9 push 27h push 50h push 5 push 12h push 1 push 17h push 14h push 6 push 0Fh lea edx, [esp+110h] push 2Dh push edx call sub_4019B5 add esp, 0BCh push eax lea ecx, [esp+30h] mov byte ptr [esp+80h], 5 call sub_40200E lea ecx, [esp+5Ch] mov [esp+7Ch], bl call sub_401226 lea eax, [esp+10h] push 0 push eax push 0 push 0F003Fh push 0 push 0 push 0 lea ecx, [esp+48h] call sub_4017E4 mov ebp, dword_50F754 push eax push 80000002h call ebp mov esi, [esp+88h] mov ecx, esi call sub_401681 mov edi, eax or ecx, 0FFFFFFFFh xor eax, eax repne scasb not ecx dec ecx push ecx mov ecx, esi call sub_401681 mov ebx, [esp+88h] push eax push 1 push 0 mov ecx, ebx call sub_401681 mov ecx, [esp+20h] push eax push ecx nop call near ptr 2930000h mov edx, [esp+10h] push edx call near ptr 28F0000h nop push 0 lea eax, [esp+14h] lea ecx, [esp+18h] push eax push 0 push 0F003Fh push 0 push 0 push 0 call sub_4017E4 push eax push 80000002h call ebp mov ecx, esi call sub_401681 mov edi, eax or ecx, 0FFFFFFFFh xor eax, eax repne scasb not ecx dec ecx push ecx mov ecx, esi call sub_401681 push eax push 1 push 0 mov ecx, ebx call sub_401681 mov ecx, [esp+20h] push eax push ecx nop call near ptr 2930000h mov edx, [esp+10h] push edx nop call near ptr 28F0000h lea eax, [esp+10h] push 0 push eax push 0 push 0F003Fh push 0 push 0 push 0 lea ecx, [esp+48h] call sub_4017E4 push eax push 80000001h call ebp mov ecx, esi call sub_401681 mov edi, eax or ecx, 0FFFFFFFFh xor eax, eax repne scasb not ecx dec ecx push ecx mov ecx, esi call sub_401681 push eax push 1 push 0 mov ecx, ebx call sub_401681 mov ecx, [esp+20h] push eax push ecx call near ptr 2930000h nop mov edx, [esp+10h] push edx call near ptr 28F0000h nop lea eax, [esp+10h] push 0 push eax push 0 push 0F003Fh push 0 push 0 push 0 lea ecx, [esp+30h] call sub_4017E4 push eax push 80000001h call ebp mov ecx, esi call sub_401681 mov edi, eax or ecx, 0FFFFFFFFh xor eax, eax repne scasb not ecx dec ecx push ecx mov ecx, esi call sub_401681 push eax push 1 push 0 mov ecx, ebx call sub_401681 mov ecx, [esp+20h] push eax push ecx nop call near ptr 2930000h mov edx, [esp+10h] push edx nop call near ptr 28F0000h lea eax, [esp+10h] push 0 push eax push 0 push 0F003Fh push 0 push 0 push 0 lea ecx, [esp+60h] call sub_4017E4 push eax push 80000002h call ebp mov ecx, esi call sub_401681 mov edi, eax or ecx, 0FFFFFFFFh xor eax, eax repne scasb not ecx dec ecx push ecx mov ecx, esi call sub_401681 push eax push 1 push 0 mov ecx, ebx call sub_401681 mov ecx, [esp+20h] push eax push ecx nop call near ptr 2930000h mov edx, [esp+10h] push edx nop call near ptr 28F0000h lea ecx, [esp+44h] mov byte ptr [esp+7Ch], 1 call sub_401226 lea ecx, [esp+14h] mov byte ptr [esp+7Ch], 0 call sub_401226 lea ecx, [esp+2Ch] mov dword ptr [esp+7Ch], 0FFFFFFFFh call sub_401226 mov ecx, [esp+74h] pop edi pop esi pop ebp mov al, 1 pop ebx mov large fs:0, ecx add esp, 70h retn 8 ; --------------------------------------------------------------------------- db 0Ah dup(90h) db 120h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40E7A0 proc near ; CODE XREF: sub_401447j var_70 = dword ptr -70h var_6C = byte ptr -6Ch var_54 = byte ptr -54h var_3C = byte ptr -3Ch var_24 = byte ptr -24h var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 4 push 0FFFFFFFFh push offset SEH_40E7A0 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 64h push ebx push ebp push esi push edi lea ecx, [esp+80h+var_6C] call sub_401424 lea ecx, [esp+80h+var_3C] mov [esp+80h+var_4], 0 call sub_401424 lea ecx, [esp+80h+var_54] mov byte ptr [esp+80h+var_4], 1 call sub_401424 push 0 push 5 push 3 push 0Eh push 29h push 0Eh push 15h push 2Ch push 50h push 0Eh push 0Fh push 9 push 13h push 12h push 5 push 30h push 14h push 0Eh push 5 push 12h push 12h push 15h push 1Dh push 50h push 13h push 17h push 0Fh push 4 push 0Eh push 9 push 31h push 50h push 14h push 6 push 0Fh push 13h push 0Fh push 12h push 3 push 9 push 27h push 50h push 5 push 12h push 1 push 17h push 14h push 6 push 0Fh lea eax, [esp+144h+var_24] mov bl, 2 push 2Dh push eax mov byte ptr [esp+14Ch+var_4], bl call sub_4019B5 add esp, 0CCh push eax lea ecx, [esp+84h+var_3C] mov byte ptr [esp+84h+var_4], 3 call sub_40200E lea ecx, [esp+80h+var_24] mov byte ptr [esp+80h+var_4], bl call sub_401226 push 0 push 13h push 5 push 3 push 9 push 16h push 12h push 5 push 2Dh push 0Eh push 15h push 2Ch push 50h push 0Eh push 0Fh push 9 push 13h push 12h push 5 push 30h push 14h push 0Eh push 5 push 12h push 12h push 15h push 1Dh push 50h push 13h push 17h push 0Fh push 4 push 0Eh push 9 push 31h push 50h push 14h push 6 push 0Fh push 13h push 0Fh push 12h push 3 push 9 push 27h push 50h push 5 push 12h push 1 push 17h push 14h push 6 push 0Fh lea ecx, [esp+154h+var_24] push 2Dh push ecx call sub_4019B5 add esp, 0DCh push eax lea ecx, [esp+84h+var_54] mov byte ptr [esp+84h+var_4], 4 call sub_40200E lea ecx, [esp+80h+var_24] mov byte ptr [esp+80h+var_4], bl call sub_401226 push 0 push 0Eh push 15h push 2Ch push 50h push 0Eh push 0Fh push 9 push 13h push 12h push 5 push 30h push 14h push 0Eh push 5 push 12h push 12h push 15h push 1Dh push 50h push 13h push 17h push 0Fh push 4 push 0Eh push 9 push 31h push 50h push 14h push 6 push 0Fh push 13h push 0Fh push 12h push 3 push 9 push 27h push 50h push 5 push 12h push 1 push 17h push 14h push 6 push 0Fh lea edx, [esp+134h+var_24] push 2Dh push edx call sub_4019B5 add esp, 0BCh push eax lea ecx, [esp+84h+var_6C] mov byte ptr [esp+84h+var_4], 5 call sub_40200E lea ecx, [esp+80h+var_24] mov byte ptr [esp+80h+var_4], bl call sub_401226 lea eax, [esp+80h+var_70] push 0 push eax push 0 push 0F003Fh push 0 push 0 push 0 lea ecx, [esp+9Ch+var_6C] call sub_4017E4 mov esi, dword_50F754 push eax push 80000002h call esi mov edi, [esp+80h+arg_0] mov ecx, edi call sub_401681 mov ecx, [esp+80h+var_70] mov ebp, dword_50F764 push eax push ecx call ebp mov edx, [esp+80h+var_70] mov ebx, dword_50F738 push edx call ebx lea eax, [esp+80h+var_70] push 0 push eax push 0 push 0F003Fh push 0 push 0 push 0 lea ecx, [esp+9Ch+var_54] call sub_4017E4 push eax push 80000002h call esi mov ecx, edi call sub_401681 mov ecx, [esp+80h+var_70] push eax push ecx call ebp mov edx, [esp+80h+var_70] push edx call ebx lea eax, [esp+80h+var_70] push 0 push eax push 0 push 0F003Fh push 0 push 0 push 0 lea ecx, [esp+9Ch+var_6C] call sub_4017E4 push eax push 80000002h call esi mov ecx, edi call sub_401681 mov ecx, [esp+80h+var_70] push eax push ecx call ebp mov edx, [esp+80h+var_70] push edx call ebx lea eax, [esp+80h+var_70] push 0 push eax push 0 push 0F003Fh push 0 push 0 push 0 lea ecx, [esp+9Ch+var_6C] call sub_4017E4 push eax push 80000001h call esi mov ecx, edi call sub_401681 mov ecx, [esp+80h+var_70] push eax push ecx call ebp mov edx, [esp+80h+var_70] push edx call ebx lea eax, [esp+80h+var_70] push 0 push eax push 0 push 0F003Fh push 0 push 0 push 0 lea ecx, [esp+9Ch+var_3C] call sub_4017E4 push eax push 80000001h call esi mov ecx, edi call sub_401681 mov ecx, [esp+80h+var_70] push eax push ecx call ebp mov edx, [esp+80h+var_70] push edx call ebx lea ecx, [esp+80h+var_54] mov byte ptr [esp+80h+var_4], 1 call sub_401226 lea ecx, [esp+80h+var_3C] mov byte ptr [esp+80h+var_4], 0 call sub_401226 mov [esp+80h+var_4], 0FFFFFFFFh lea ecx, [esp+80h+var_6C] call sub_401226 mov ecx, [esp+80h+var_C] pop edi pop esi pop ebp mov al, 1 pop ebx mov large fs:0, ecx add esp, 70h retn 4 sub_40E7A0 endp ; --------------------------------------------------------------------------- db 0Dh dup(90h) db 0F0h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40EC30 proc near ; CODE XREF: sub_401497j var_54 = byte ptr -54h var_3C = byte ptr -3Ch var_24 = byte ptr -24h var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 push 0FFFFFFFFh push offset SEH_40EC30 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 48h push ebx push esi mov esi, ecx lea ecx, [esp+5Ch+var_24] call sub_401424 push 104h push 104h lea ecx, [esp+64h+var_24] mov [esp+64h+var_4], 0 call sub_401C5D push eax nop call near ptr 27D09BAh lea ecx, [esp+5Ch+var_3C] call sub_401424 mov ecx, [esp+5Ch+arg_4] mov byte ptr [esp+5Ch+var_4], 1 call sub_4017E4 push eax lea ecx, [esp+60h+var_24] call sub_4017E4 push eax lea eax, [esp+64h+var_3C] push offset dword_443684 push eax call sub_40102D add esp, 10h lea ecx, [esp+5Ch+var_54] call sub_401424 lea ecx, [esp+5Ch+var_54] push offset dword_4437D4 push ecx mov byte ptr [esp+64h+var_4], 2 call sub_40102D mov ecx, [esp+64h+arg_0] add esp, 8 lea edx, [esp+5Ch+var_54] lea eax, [esp+5Ch+var_3C] push edx push eax push ecx mov ecx, esi call sub_402153 lea ecx, [esp+5Ch+var_54] mov bl, al mov byte ptr [esp+5Ch+var_4], 1 call sub_401226 lea ecx, [esp+5Ch+var_3C] mov byte ptr [esp+5Ch+var_4], 0 call sub_401226 lea ecx, [esp+5Ch+var_24] mov [esp+5Ch+var_4], 0FFFFFFFFh call sub_401226 mov ecx, [esp+5Ch+var_C] mov al, bl pop esi pop ebx mov large fs:0, ecx add esp, 54h retn 8 sub_40EC30 endp ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 40h dup(0CCh) ; =============== S U B R O U T I N E ======================================= sub_40ED70 proc near ; CODE XREF: sub_402153j var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = byte ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = byte ptr -24h var_C = dword ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push 0FFFFFFFFh push offset SEH_40ED70 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 38h push ebx push ebp push esi push edi push 0F003Fh push offset dword_443C08 mov [esp+5Ch+var_44], ecx push 0 nop call near ptr 28F0921h mov edi, eax test edi, edi jnz short loc_40EDAF xor al, al jmp loc_40EF00 ; --------------------------------------------------------------------------- loc_40EDAF: ; CODE XREF: sub_40ED70+36j lea ecx, [esp+54h+var_24] call sub_401424 mov ecx, [esp+54h+arg_8] mov [esp+54h+var_4], 0 call sub_4017E4 mov ebx, [esp+54h+arg_4] push eax mov ecx, ebx call sub_4017E4 push eax lea eax, [esp+5Ch+var_24] push offset dword_443BFC push eax call sub_40102D add esp, 10h lea ecx, [esp+54h+var_24] push 0 push 0 push 0 push 0 push 0 call sub_4017E4 push eax push 1 push 2 push 20h push 0F01FFh mov ecx, offset dword_447874 call sub_4017E4 mov ebp, [esp+7Ch+arg_0] push eax mov ecx, ebp call sub_4017E4 push eax push edi nop call near ptr 28F0C36h mov esi, eax xor ecx, ecx cmp esi, ecx jnz short loc_40EE95 call near ptr 27A0829h nop cmp eax, 431h jnz short loc_40EE79 mov ecx, [esp+54h+var_44] push ebp call sub_401942 mov esi, dword_50F74C push 0 call esi push edi call esi mov ecx, [esp+54h+var_44] push ebx push ebp call sub_401497 lea ecx, [esp+54h+var_24] mov bl, al mov [esp+54h+var_4], 0FFFFFFFFh call sub_401226 mov al, bl jmp loc_40EF00 ; --------------------------------------------------------------------------- loc_40EE79: ; CODE XREF: sub_40ED70+CBj push edi nop call near ptr 2900000h lea ecx, [esp+54h+var_24] mov [esp+54h+var_4], 0FFFFFFFFh call sub_401226 xor al, al jmp short loc_40EF00 ; --------------------------------------------------------------------------- loc_40EE95: ; CODE XREF: sub_40ED70+BEj lea edx, [esp+54h+var_38] mov [esp+54h+var_34], ecx mov dword ptr [esp+54h+var_30], ecx push edx mov eax, 1 or ebx, 0FFFFFFFFh lea ecx, [esp+58h+var_40] push 2 push esi mov [esp+60h+var_3C], eax mov [esp+60h+var_40], eax mov [esp+60h+var_38], ebx mov [esp+60h+var_2C], eax mov [esp+60h+var_28], ecx nop call near ptr 2900273h test eax, eax push esi mov esi, dword_50F74C jnz short loc_40EEEC call esi push edi call esi lea ecx, [esp+54h+var_24] mov [esp+54h+var_4], ebx call sub_401226 xor al, al jmp short loc_40EF00 ; --------------------------------------------------------------------------- loc_40EEEC: ; CODE XREF: sub_40ED70+164j call esi push edi call esi lea ecx, [esp+54h+var_24] mov [esp+54h+var_4], ebx call sub_401226 mov al, 1 loc_40EF00: ; CODE XREF: sub_40ED70+3Aj ; sub_40ED70+104j ... mov ecx, [esp+54h+var_C] pop edi pop esi pop ebp pop ebx mov large fs:0, ecx add esp, 44h retn 0Ch sub_40ED70 endp ; --------------------------------------------------------------------------- db 0Bh dup(90h) db 70h dup(0CCh) ; --------------------------------------------------------------------------- loc_40EF90: ; CODE XREF: sub_401942j sub esp, 1Ch push esi push edi push 0F003Fh push offset dword_443C08 push 0 nop call near ptr 28F0921h mov edi, eax test edi, edi jnz short loc_40EFB7 pop edi xor al, al pop esi add esp, 1Ch retn 4 ; --------------------------------------------------------------------------- loc_40EFB7: ; CODE XREF: ___:0040EFABj mov ecx, [esp+28h] push 0F01FFh call sub_4017E4 push eax push edi nop call near ptr 2890365h mov esi, eax test esi, esi jnz short loc_40EFE4 push edi nop call near ptr 2900000h pop edi xor al, al pop esi add esp, 1Ch retn 4 ; --------------------------------------------------------------------------- loc_40EFE4: ; CODE XREF: ___:0040EFD1j lea eax, [esp+8] push eax push 1 push esi nop call near ptr 28F055Bh push esi nop call near ptr 28F0804h push esi mov esi, dword_50F74C ; --------------------------------------------------------------------------- dd 0Ch dup(0) dword_40F030 dd 20h dup(0) dword_40F0B0 dd 24h dup(0) dword_40F140 dd 114h dup(0) dword_40F590 dd 1Ch dup(0) dword_40F600 dd 1DCh dup(0) dword_40FD70 dd 0Ch dup(0) ; ___:00401A3Cj dword_40FDA0 dd 70h dup(0) dword_40FF60 dd 640h dup(0) dword_411860 dd 20h dup(0) dword_4118E0 dd 0Ch dup(0) ; ___:004016EAj dword_411910 dd 20h dup(0) dword_411990 dd 30h dup(0) dword_411A50 dd 30h dup(0) dword_411B10 dd 0Ch dup(0) dword_411B40 dd 128h dup(0) dword_411FE0 dd 1B4h dup(0) dword_4126B0 dd 70h dup(0) dword_412870 dd 24h dup(0) dword_412900 dd 1Ch dup(0) dword_412970 dd 4Ch dup(0) dword_412AA0 dd 20h dup(0) dword_412B20 dd 0Ch dup(0) dword_412B50 dd 10h dup(0) dword_412B90 dd 0Ch dup(0) dword_412BC0 dd 14h dup(0) dword_412C10 dd 28h dup(0) dword_412CB0 dd 10Ch dup(0) dword_4130E0 dd 10h dup(0) dword_413120 dd 34h dup(0) dword_4131F0 dd 0Ch dup(0) ; ___:00401E10j dword_413220 dd 30h dup(0) dword_4132E0 dd 3Ch dup(0) dword_4133D0 dd 50h dup(0) dword_413510 dd 58h dup(0) dword_413670 dd 5Ch dup(0) dword_4137E0 dd 74h dup(0) dword_4139B0 dd 4Ch dup(0) dword_413AE0 dd 24h dup(0) dword_413B70 dd 74h dup(0) dword_413D40 dd 8 dup(0) dword_413D60 dd 10h dup(0) dword_413DA0 dd 0BCh dup(0) dword_414090 dd 24h dup(0) dword_414120 dd 3Ch dup(0) dword_414210 dd 8 dup(0) dword_414230 dd 4Ch dup(0) dword_414360 dd 28h dup(0) dword_414400 dd 34h dup(0) dword_4144D0 dd 5Ch dup(0) dword_414640 dd 0Ch dup(0) dword_414670 dd 8 dup(0) dword_414690 dd 50h dup(0) dword_4147D0 dd 74h dup(0) dword_4149A0 dd 0Ch dup(0) dword_4149D0 dd 24h dup(0) dword_414A60 dd 24h dup(0) dword_414AF0 dd 60h dup(0) dword_414C70 dd 0Ch dup(0) dword_414CA0 dd 28h dup(0) dword_414D40 dd 0BCh dup(0) dword_415030 dd 10h dup(0) dword_415070 dd 20h dup(0) dword_4150F0 dd 1Ch dup(0) dword_415160 dd 10h dup(0) dword_4151A0 dd 0Ch dup(0) dword_4151D0 dd 10h dup(0) dword_415210 dd 30h dup(0) dword_4152D0 dd 8 dup(0) dword_4152F0 dd 8 dup(0) dword_415310 dd 0Ch dup(0) dword_415340 dd 0Ch dup(0) dword_415370 dd 10h dup(0) dword_4153B0 dd 1Ch dup(0) dword_415420 dd 10h dup(0) dword_415460 dd 0Ch dup(0) dword_415490 dd 10h dup(0) dword_4154D0 dd 14h dup(0) dword_415520 dd 30h dup(0) dword_4155E0 dd 8 dup(0) dword_415600 dd 8 dup(0) dword_415620 dd 0Ch dup(0) dword_415650 dd 0Ch dup(0) dword_415680 dd 10h dup(0) dword_4156C0 dd 1Ch dup(0) dword_415730 dd 10h dup(0) dword_415770 dd 0Ch dup(0) dword_4157A0 dd 10h dup(0) dword_4157E0 dd 14h dup(0) dword_415830 dd 30h dup(0) dword_4158F0 dd 8 dup(0) dword_415910 dd 8 dup(0) dword_415930 dd 0Ch dup(0) dword_415960 dd 0Ch dup(0) dword_415990 dd 10h dup(0) dword_4159D0 dd 0Ch dup(0) dword_415A00 dd 28h dup(0) dword_415AA0 dd 20h dup(0) dword_415B20 dd 30h dup(0) dword_415BE0 dd 24h dup(0) dword_415C70 dd 14h dup(0) dword_415CC0 dd 8 dup(0) dword_415CE0 dd 8 dup(0) dword_415D00 dd 8 dup(0) dword_415D20 dd 8 dup(0) dword_415D40 dd 0Ch dup(0) dword_415D70 dd 0Ch dup(0) dword_415DA0 dd 0Ch dup(0) dword_415DD0 dd 28h dup(0) dword_415E70 dd 30h dup(0) dword_415F30 dd 24h dup(0) dword_415FC0 dd 14h dup(0) dword_416010 dd 8 dup(0) dword_416030 dd 8 dup(0) dword_416050 dd 8 dup(0) dword_416070 dd 8 dup(0) dword_416090 dd 0Ch dup(0) dword_4160C0 dd 0Ch dup(0) dword_4160F0 dd 0Ch dup(0) dword_416120 dd 28h dup(0) dword_4161C0 dd 30h dup(0) dword_416280 dd 24h dup(0) dword_416310 dd 14h dup(0) dword_416360 dd 8 dup(0) dword_416380 dd 8 dup(0) dword_4163A0 dd 8 dup(0) dword_4163C0 dd 8 dup(0) dword_4163E0 dd 0Ch dup(0) dword_416410 dd 0Ch dup(0) dword_416440 dd 0Ch dup(0) dword_416470 dd 8 dup(0) dword_416490 dd 0Ch dup(0) dword_4164C0 dd 8 dup(0) dword_4164E0 dd 0Ch dup(0) dword_416510 dd 8 dup(0) dword_416530 dd 8 dup(0) dword_416550 dd 8 dup(0) dword_416570 dd 0Ch dup(0) dword_4165A0 dd 0Ch dup(0) dword_4165D0 dd 8 dup(0) dword_4165F0 dd 8 dup(0) dword_416610 dd 0Ch dup(0) dword_416640 dd 8 dup(0) dword_416660 dd 0Ch dup(0) dword_416690 dd 8 dup(0) dword_4166B0 dd 8 dup(0) dword_4166D0 dd 8 dup(0) dword_4166F0 dd 8 dup(0) dword_416710 dd 0Ch dup(0) dword_416740 dd 8 dup(0) dword_416760 dd 0Ch dup(0) dword_416790 dd 8 dup(0) dword_4167B0 dd 8 dup(0) dword_4167D0 dd 8 dup(0) dword_4167F0 dd 0Ch dup(0) dword_416820 dd 0Ch dup(0) dword_416850 dd 8 dup(0) dword_416870 dd 0Ch dup(0) dword_4168A0 dd 8 dup(0) dword_4168C0 dd 0Ch dup(0) dword_4168F0 dd 28h dup(0) dword_416990 dd 9Ch dup(0) dword_416C00 dd 0Ch dup(0) dword_416C30 dd 0Ch dup(0) ; ___:004019BFj dword_416C60 dd 0Ch dup(0) dword_416C90 dd 0Ch dup(0) ; ___:00401C99j dword_416CC0 dd 8 dup(0) dword_416CE0 dd 0Ch dup(0) ; ___:0040218Aj dword_416D10 dd 8 dup(0) dword_416D30 dd 0A0h dup(0) dword_416FB0 dd 1Ch dup(0) dword_417020 dd 148h dup(0) dword_417540 dd 28h dup(0) dword_4175E0 dd 34h dup(0) dword_4176B0 dd 30h dup(0) dword_417770 dd 30h dup(0) dword_417830 dd 30h dup(0) dword_4178F0 dd 1Ch dup(0) dword_417960 dd 1Ch dup(0) dword_4179D0 dd 1Ch dup(0) dword_417A40 dd 8 dup(0) dword_417A60 dd 20h dup(0) dword_417AE0 dd 8 dup(0) dword_417B00 dd 8 dup(0) dword_417B20 dd 28h dup(0) dword_417BC0 dd 28h dup(0) dword_417C60 dd 34h dup(0) dword_417D30 dd 30h dup(0) dword_417DF0 dd 0Ch dup(0) dword_417E20 dd 0Ch dup(0) dword_417E50 dd 30h dup(0) dword_417F10 dd 30h dup(0) dword_417FD0 dd 20h dup(0) dword_418050 dd 0Ch dup(0) dword_418080 dd 20h dup(0) dword_418100 dd 20h dup(0) dword_418180 dd 0Ch dup(0) dword_4181B0 dd 20h dup(0) dword_418230 dd 0Ch dup(0) dword_418260 dd 0Ch dup(0) dword_418290 dd 28h dup(0) dword_418330 dd 58h dup(0) dword_418490 dd 0ECh dup(0) dword_418840 dd 8 dup(0) dword_418860 dd 0Ch dup(0) dword_418890 dd 1Ch dup(0) dword_418900 dd 10h dup(0) dword_418940 dd 1Ch dup(0) dword_4189B0 dd 10h dup(0) dword_4189F0 dd 0Ch dup(0) dword_418A20 dd 14h dup(0) dword_418A70 dd 8 dup(0) dword_418A90 dd 8 dup(0) dword_418AB0 dd 0Ch dup(0) dword_418AE0 dd 0Ch dup(0) dword_418B10 dd 24h dup(0) dword_418BA0 dd 8 dup(0) dword_418BC0 dd 24h dup(0) dword_418C50 dd 14h dup(0) dword_418CA0 dd 8 dup(0) dword_418CC0 dd 8 dup(0) dword_418CE0 dd 8 dup(0) dword_418D00 dd 8 dup(0) dword_418D20 dd 0Ch dup(0) dword_418D50 dd 0Ch dup(0) dword_418D80 dd 30h dup(0) dword_418E40 dd 8 dup(0) dword_418E60 dd 0Ch dup(0) dword_418E90 dd 30h dup(0) dword_418F50 dd 8 dup(0) dword_418F70 dd 0Ch dup(0) dword_418FA0 dd 8 dup(0) dword_418FC0 dd 8 dup(0) dword_418FE0 dd 0Ch dup(0) dword_419010 dd 8 dup(0) dword_419030 dd 8 dup(0) dword_419050 dd 8 dup(0) dword_419070 dd 8 dup(0) dword_419090 dd 8 dup(0) dword_4190B0 dd 30h dup(0) dword_419170 dd 24h dup(0) dword_419200 dd 8 dup(0) dword_419220 dd 28h dup(0) dword_4192C0 dd 134h dup(0) dword_419790 dd 44h dup(0) dword_4198A0 dd 8 dup(0) dword_4198C0 dd 14h dup(0) dword_419910 dd 8 dup(0) dword_419930 dd 8 dup(0) dword_419950 dd 8 dup(0) dword_419970 dd 10h dup(0) dword_4199B0 dd 38h dup(0) dword_419A90 dd 14h dup(0) dword_419AE0 dd 34h dup(0) dword_419BB0 dd 88h dup(0) dword_419DD0 dd 30h dup(0) dword_419E90 dd 30h dup(0) dword_419F50 dd 30h dup(0) dword_41A010 dd 34h dup(0) dword_41A0E0 dd 0Ch dup(0) ; ___:00401AF5j dword_41A110 dd 1Ch dup(0) dword_41A180 dd 44h dup(0) dword_41A290 dd 8 dup(0) dword_41A2B0 dd 94h dup(0) dword_41A500 dd 10h dup(0) dword_41A540 dd 1Ch dup(0) dword_41A5B0 dd 48h dup(0) dword_41A6D0 dd 64h dup(0) dword_41A860 dd 0Ch dup(0) dword_41A890 dd 0Ch dup(0) dword_41A8C0 dd 78h dup(0) dword_41AAA0 dd 20h dup(0) dword_41AB20 dd 38h dup(0) dword_41AC00 dd 38h dup(0) dword_41ACE0 dd 14h dup(0) dword_41AD30 dd 14h dup(0) dword_41AD80 dd 34h dup(0) dword_41AE50 dd 28h dup(0) dword_41AEF0 dd 1Ch dup(0) dword_41AF60 dd 20h dup(0) dword_41AFE0 dd 0Ch dup(0) dword_41B010 dd 0Ch dup(0) ; ___:00401E74j dword_41B040 dd 8 dup(0) dword_41B060 dd 24h dup(0) dword_41B0F0 dd 0A8h dup(0) dword_41B390 dd 10h dup(0) dword_41B3D0 dd 0Ch dup(0) ; ___:00402018j dword_41B400 dd 1Ch dup(0) dword_41B470 dd 10h dup(0) dword_41B4B0 dd 5Ch dup(0) dword_41B620 dd 30h dup(0) dword_41B6E0 dd 28h dup(0) dword_41B780 dd 20h dup(0) dword_41B800 dd 8 dup(0) dword_41B820 dd 4Ch dup(0) dword_41B950 dd 0B4h dup(0) dword_41BC20 dd 0Ch dup(0) dword_41BC50 dd 10h dup(0) dword_41BC90 dd 0C4h dup(0) dword_41BFA0 dd 24h dup(0) dword_41C030 dd 10h dup(0) dword_41C070 dd 1Ch dup(0) dword_41C0E0 dd 5Ch dup(0) dword_41C250 dd 50h dup(0) dword_41C390 dd 0A0h dup(0) dword_41C610 dd 3CCh dup(0) dword_41D540 dd 24h dup(0) dword_41D5D0 dd 28h dup(0) dword_41D670 dd 30h dup(0) dword_41D730 dd 0Ch dup(0) ; ___:004019E7j dword_41D760 dd 34h dup(0) dword_41D830 dd 244h dup(0) dword_41E140 dd 60h dup(0) dword_41E2C0 dd 50h dup(0) dword_41E400 dd 98h dup(0) dword_41E660 dd 1D4h dup(0) dword_41EDB0 dd 30h dup(0) dword_41EE70 dd 30h dup(0) dword_41EF30 dd 24Ch dup(0) dword_41F860 dd 8Ch dup(0) dword_41FA90 dd 28h dup(0) dword_41FB30 dd 28h dup(0) dword_41FBD0 dd 0Ch dup(0) dword_41FC00 dd 20h dup(0) dword_41FC80 dd 34h dup(0) dword_41FD50 dd 10h dup(0) dword_41FD90 dd 30h dup(0) dword_41FE50 dd 28h dup(0) dword_41FEF0 dd 14h dup(0) dword_41FF40 dd 14h dup(0) dword_41FF90 dd 58h dup(0) dword_4200F0 dd 84h dup(0) dword_420300 dd 34h dup(0) dword_4203D0 dd 58h dup(0) dword_420530 dd 9Ch dup(0) dword_4207A0 dd 8 dup(0) dword_4207C0 dd 8 dup(0) dword_4207E0 dd 13Ch dup(0) dword_420CD0 dd 0Ch dup(0) dword_420D00 dd 28h dup(0) dword_420DA0 dd 8 dup(0) dword_420DC0 dd 14h dup(0) dword_420E10 dd 1F0h dup(0) dword_4215D0 dd 14h dup(0) dword_421620 dd 8Ch dup(0) dword_421850 dd 8 dup(0) dword_421870 dd 10h dup(0) dword_4218B0 dd 10h dup(0) dword_4218F0 dd 1Ch dup(0) dword_421960 dd 10h dup(0) dword_4219A0 dd 0Ch dup(0) dword_4219D0 dd 10h dup(0) dword_421A10 dd 8 dup(0) dword_421A30 dd 8 dup(0) dword_421A50 dd 0Ch dup(0) dword_421A80 dd 0Ch dup(0) dword_421AB0 dd 10h dup(0) dword_421AF0 dd 1Ch dup(0) dword_421B60 dd 10h dup(0) dword_421BA0 dd 0Ch dup(0) dword_421BD0 dd 10h dup(0) dword_421C10 dd 8 dup(0) dword_421C30 dd 8 dup(0) dword_421C50 dd 0Ch dup(0) dword_421C80 dd 0Ch dup(0) dword_421CB0 dd 28h dup(0) dword_421D50 dd 28h dup(0) dword_421DF0 dd 24h dup(0) dword_421E80 dd 14h dup(0) dword_421ED0 dd 8 dup(0) dword_421EF0 dd 8 dup(0) dword_421F10 dd 8 dup(0) dword_421F30 dd 8 dup(0) dword_421F50 dd 0Ch dup(0) dword_421F80 dd 0Ch dup(0) dword_421FB0 dd 28h dup(0) dword_422050 dd 24h dup(0) dword_4220E0 dd 14h dup(0) dword_422130 dd 8 dup(0) dword_422150 dd 8 dup(0) dword_422170 dd 8 dup(0) dword_422190 dd 8 dup(0) dword_4221B0 dd 0Ch dup(0) dword_4221E0 dd 0Ch dup(0) dword_422210 dd 0Ch dup(0) dword_422240 dd 30h dup(0) dword_422300 dd 8 dup(0) dword_422320 dd 0Ch dup(0) dword_422350 dd 8 dup(0) dword_422370 dd 0Ch dup(0) dword_4223A0 dd 8 dup(0) dword_4223C0 dd 8 dup(0) dword_4223E0 dd 0Ch dup(0) dword_422410 dd 30h dup(0) dword_4224D0 dd 8 dup(0) dword_4224F0 dd 0Ch dup(0) dword_422520 dd 8 dup(0) dword_422540 dd 0Ch dup(0) dword_422570 dd 8 dup(0) dword_422590 dd 8 dup(0) dword_4225B0 dd 0Ch dup(0) dword_4225E0 dd 8 dup(0) dword_422600 dd 8 dup(0) dword_422620 dd 0Ch dup(0) dword_422650 dd 1Ch dup(0) dword_4226C0 dd 8 dup(0) dword_4226E0 dd 1Ch dup(0) dword_422750 dd 8 dup(0) dword_422770 dd 8 dup(0) dword_422790 dd 0Ch dup(0) dword_4227C0 dd 0Ch dup(0) dword_4227F0 dd 94h dup(0) dword_422A40 dd 2ECh dup(0) dword_4235F0 dd 1Ch dup(0) dword_423660 dd 28h dup(0) dword_423700 dd 8 dup(0) dword_423720 dd 10h dup(0) dword_423760 dd 3Ch dup(0) dword_423850 dd 3Ch dup(0) dword_423940 dd 0B4h dup(0) dword_423C10 dd 0E4h dup(0) dword_423FA0 dd 0E4h dup(0) dword_424330 dd 8 dup(0) dword_424350 dd 14h dup(0) dword_4243A0 dd 20h dup(0) dword_424420 dd 28h dup(0) dword_4244C0 dd 10h dup(0) dword_424500 dd 3Ch dup(0) dword_4245F0 dd 38h dup(0) dword_4246D0 dd 14h dup(0) dword_424720 dd 10h dup(0) dword_424760 dd 0Ch dup(0) dword_424790 dd 1Ch dup(0) dword_424800 dd 10h dup(0) dword_424840 dd 140h dup(0) dword_424D40 dd 38h dup(0) dword_424E20 dd 1Ch dup(0) dword_424E90 dd 64h dup(0) dword_425020 dd 84h dup(0) dword_425230 dd 10h dup(0) dword_425270 dd 5Ch dup(0) dword_4253E0 dd 0Ch dup(0) dword_425410 dd 28h dup(0) dword_4254B0 dd 0Ch dup(0) dword_4254E0 dd 58h dup(0) dword_425640 dd 1Ch dup(0) dword_4256B0 dd 3Ch dup(0) dword_4257A0 dd 20h dup(0) dword_425820 dd 14h dup(0) dword_425870 dd 0Ch dup(0) dword_4258A0 dd 10h dup(0) dword_4258E0 dd 28h dup(0) dword_425980 dd 94h dup(0) dword_425BD0 dd 200h dup(0) dword_4263D0 dd 20h dup(0) dword_426450 dd 1Ch dup(0) dword_4264C0 dd 28h dup(0) dword_426560 dd 30h dup(0) dword_426620 dd 0Ch dup(0) ; ___:0040217Bj dword_426650 dd 0Ch dup(0) ; ___:00402081j dword_426680 dd 8 dup(0) dword_4266A0 dd 60h dup(0) dword_426820 dd 50h dup(0) dword_426960 dd 10h dup(0) dword_4269A0 dd 1Ch dup(0) dword_426A10 dd 0Ch dup(0) ; ___:00401AAFj dword_426A40 dd 8 dup(0) dword_426A60 dd 0A0h dup(0) dword_426CE0 dd 74h dup(0) dword_426EB0 dd 1Ch dup(0) dword_426F20 dd 0Ch dup(0) ; ___:0040181Bj dword_426F50 dd 8 dup(0) dword_426F70 dd 5Ch dup(0) dword_4270E0 dd 110h dup(0) dword_427520 dd 1Ch dup(0) dword_427590 dd 1Ch dup(0) dword_427600 dd 0Ch dup(0) ; ___:0040222Aj dword_427630 dd 8 dup(0) dword_427650 dd 5Ch dup(0) dword_4277C0 dd 8Ch dup(0) dword_4279F0 dd 38h dup(0) dword_427AD0 dd 0BCh dup(0) dword_427DC0 dd 1Ch dup(0) dword_427E30 dd 30h dup(0) dword_427EF0 dd 34h dup(0) dword_427FC0 dd 0Ch dup(0) ; ___:00402068j dword_427FF0 dd 0Ch dup(0) ; ___:00401C2Bj dword_428020 dd 8 dup(0) dword_428040 dd 48h dup(0) dword_428160 dd 30h dup(0) dword_428220 dd 0Ch dup(0) ; ___:004021B2j dword_428250 dd 1Ch dup(0) dword_4282C0 dd 5C0h dup(0) dword_4299C0 dd 1Ch dup(0) dword_429A30 dd 0Ch dup(0) ; ___:0040128Fj dword_429A60 dd 10h dup(0) dword_429AA0 dd 64h dup(0) dword_429C30 dd 34h dup(0) dword_429D00 dd 1Ch dup(0) dword_429D70 dd 0Ch dup(0) ; ___:00401B04j dword_429DA0 dd 8 dup(0) dword_429DC0 dd 0B4h dup(0) dword_42A090 dd 1Ch dup(0) dword_42A100 dd 0Ch dup(0) ; ___:004017A8j dword_42A130 dd 8 dup(0) dword_42A150 dd 0ACh dup(0) dword_42A400 dd 10h dup(0) dword_42A440 dd 6Ch dup(0) dword_42A5F0 dd 88h dup(0) dword_42A810 dd 168h dup(0) dword_42ADB0 dd 44h dup(0) dword_42AEC0 dd 44h dup(0) dword_42AFD0 dd 24h dup(0) dword_42B060 dd 5Ch dup(0) dword_42B1D0 dd 1Ch dup(0) dword_42B240 dd 24h dup(0) dword_42B2D0 dd 4 dup(0) dword_42B2E0 dd 1Ch dup(0) dword_42B350 dd 0Ch dup(0) ; ___:00401F41j dword_42B380 dd 8 dup(0) dword_42B3A0 dd 38h dup(0) dword_42B480 dd 1Ch dup(0) dword_42B4F0 dd 0Ch dup(0) ; ___:00401B22j dword_42B520 dd 8 dup(0) dword_42B540 dd 0A0h dup(0) dword_42B7C0 dd 1Ch dup(0) dword_42B830 dd 0Ch dup(0) ; ___:00401FAAj dword_42B860 dd 8 dup(0) dword_42B880 dd 0BCh dup(0) dword_42BB70 dd 0BCh dup(0) dword_42BE60 dd 22Ch dup(0) dword_42C710 dd 20h dup(0) dword_42C790 dd 14h dup(0) dword_42C7E0 dd 0Ch dup(0) dword_42C810 dd 1ECh dup(0) dword_42CFC0 dd 44h dup(0) dword_42D0D0 dd 7Ch dup(0) dword_42D2C0 dd 26Ch dup(0) dword_42DC70 dd 38h dup(0) dword_42DD50 dd 0A0h dup(0) dword_42DFD0 dd 38h dup(0) dword_42E0B0 dd 20h dup(0) dword_42E130 dd 1Ch dup(0) dword_42E1A0 dd 20h dup(0) dword_42E220 dd 20h dup(0) dword_42E2A0 dd 0Ch dup(0) dword_42E2D0 dd 20h dup(0) dword_42E350 dd 20h dup(0) dword_42E3D0 dd 0A0h dup(0) dword_42E650 dd 0Ch dup(0) dword_42E680 dd 4Ch dup(0) dword_42E7B0 dd 34h dup(0) dword_42E880 dd 0Ch dup(0) dword_42E8B0 dd 0Ch dup(0) dword_42E8E0 dd 38h dup(0) dword_42E9C0 dd 20h dup(0) dword_42EA40 dd 14h dup(0) dword_42EA90 dd 20h dup(0) dword_42EB10 dd 14h dup(0) dword_42EB60 dd 14h dup(0) dword_42EBB0 dd 14h dup(0) dword_42EC00 dd 8 dup(0) dword_42EC20 dd 8 dup(0) dword_42EC40 dd 10h dup(0) dword_42EC80 dd 10h dup(0) dword_42ECC0 dd 0Ch dup(0) dword_42ECF0 dd 10h dup(0) dword_42ED30 dd 38h dup(0) dword_42EE10 dd 28h dup(0) dword_42EEB0 dd 3Ch dup(0) dword_42EFA0 dd 14h dup(0) dword_42EFF0 dd 10h dup(0) dword_42F030 dd 10h dup(0) dword_42F070 dd 10h dup(0) dword_42F0B0 dd 30h dup(0) dword_42F170 dd 30h dup(0) dword_42F230 dd 20h dup(0) dword_42F2B0 dd 74h dup(0) dword_42F480 dd 1Ch dup(0) dword_42F4F0 dd 14h dup(0) dword_42F540 dd 1Ch dup(0) dword_42F5B0 dd 10h dup(0) dword_42F5F0 dd 10h dup(0) dword_42F630 dd 10h dup(0) dword_42F670 dd 10h dup(0) dword_42F6B0 dd 64h dup(0) dword_42F840 dd 8Ch dup(0) dword_42FA70 dd 0C0h dup(0) dword_42FD70 dd 10h dup(0) dword_42FDB0 dd 60h dup(0) dword_42FF30 dd 8 dup(0) dword_42FF50 dd 5Ch dup(0) dword_4300C0 dd 1Ch dup(0) dword_430130 dd 14h dup(0) dword_430180 dd 1Ch dup(0) dword_4301F0 dd 20h dup(0) dword_430270 dd 34h dup(0) dword_430340 dd 10h dup(0) dword_430380 dd 0Ch dup(0) dword_4303B0 dd 8 dup(0) dword_4303D0 dd 24h dup(0) dword_430460 dd 1Ch dup(0) dword_4304D0 dd 14h dup(0) dword_430520 dd 50h dup(0) dword_430660 dd 0Ch dup(0) dword_430690 dd 1Ch dup(0) dword_430700 dd 44h dup(0) dword_430810 dd 4Ch dup(0) dword_430940 dd 14h dup(0) dword_430990 dd 10h dup(0) dword_4309D0 dd 10h dup(0) dword_430A10 dd 10h dup(0) dword_430A50 dd 10h dup(0) dword_430A90 dd 10h dup(0) dword_430AD0 dd 4Ch dup(0) dword_430C00 dd 0C0h dup(0) dword_430F00 dd 38h dup(0) dword_430FE0 dd 30h dup(0) dword_4310A0 dd 0Ch dup(0) dword_4310D0 dd 0Ch dup(0) dword_431100 dd 8 dup(0) dword_431120 dd 4Ch dup(0) dword_431250 dd 0Ch dup(0) dword_431280 dd 20h dup(0) dword_431300 dd 20h dup(0) dword_431380 dd 8 dup(0) dword_4313A0 dd 1Ch dup(0) dword_431410 dd 20h dup(0) dword_431490 dd 0Ch dup(0) dword_4314C0 dd 28h dup(0) dword_431560 dd 3Ch dup(0) dword_431650 dd 38h dup(0) dword_431730 dd 30h dup(0) dword_4317F0 dd 34h dup(0) dword_4318C0 dd 10h dup(0) dword_431900 dd 24h dup(0) dword_431990 dd 24h dup(0) dword_431A20 dd 10h dup(0) dword_431A60 dd 8 dup(0) dword_431A80 dd 10h dup(0) dword_431AC0 dd 1Ch dup(0) dword_431B30 dd 1Ch dup(0) dword_431BA0 dd 10h dup(0) dword_431BE0 dd 4Ch dup(0) dword_431D10 dd 6Ch dup(0) dword_431EC0 dd 14h dup(0) dword_431F10 dd 10h dup(0) dword_431F50 dd 10h dup(0) dword_431F90 dd 10h dup(0) dword_431FD0 dd 44h dup(0) dword_4320E0 dd 48h dup(0) dword_432200 dd 58h dup(0) dword_432360 dd 58h dup(0) dword_4324C0 dd 30h dup(0) dword_432580 dd 44h dup(0) dword_432690 dd 4Ch dup(0) dword_4327C0 dd 10h dup(0) dword_432800 dd 10h dup(0) dword_432840 dd 1Ch dup(0) dword_4328B0 dd 10h dup(0) dword_4328F0 dd 14h dup(0) dword_432940 dd 10h dup(0) dword_432980 dd 1Ch dup(0) dword_4329F0 dd 38h dup(0) dword_432AD0 dd 14h dup(0) dword_432B20 dd 10h dup(0) dword_432B60 dd 10h dup(0) dword_432BA0 dd 24h dup(0) dword_432C30 dd 1Ch dup(0) dword_432CA0 dd 8 dup(0) dword_432CC0 dd 30h dup(0) dword_432D80 dd 1Ch dup(0) dword_432DF0 dd 1Ch dup(0) dword_432E60 dd 1Ch dup(0) dword_432ED0 dd 44h dup(0) dword_432FE0 dd 14h dup(0) dword_433030 dd 14h dup(0) dword_433080 dd 20h dup(0) dword_433100 dd 8 dup(0) dword_433120 dd 8 dup(0) dword_433140 dd 8 dup(0) dword_433160 dd 1Ch dup(0) dword_4331D0 dd 50h dup(0) dword_433310 dd 38h dup(0) dword_4333F0 dd 24h dup(0) dword_433480 dd 1Ch dup(0) dword_4334F0 dd 20h dup(0) dword_433570 dd 10h dup(0) dword_4335B0 dd 30h dup(0) dword_433670 dd 28h dup(0) dword_433710 dd 34h dup(0) dword_4337E0 dd 34h dup(0) dword_4338B0 dd 14h dup(0) dword_433900 dd 10h dup(0) dword_433940 dd 38h dup(0) dword_433A20 dd 364h dup(0) dword_4347B0 dd 3Ch dup(0) dword_4348A0 dd 250h dup(0) dword_4351E0 dd 28h dup(0) dword_435280 dd 0D8h dup(0) dword_4355E0 dd 44h dup(0) dword_4356F0 dd 1C4h dup(0) dword_435E00 dd 10h dup(0) dword_435E40 dd 98h dup(0) dword_4360A0 dd 98h dup(0) dword_436300 dd 0B0h dup(0) dword_4365C0 dd 88h dup(0) db 2 dup(0) word_4367E2 dw 0 ; CODE XREF: ___:00406BE0p ; sub_406C00+11p ... dd 5 dup(0) db 2 dup(0) word_4367FA dw 0 ; CODE XREF: ___:00406C77p ; ___:00406CCAp ... dd 0Dh dup(0) db 2 dup(0) word_436832 dw 0 ; CODE XREF: ___:004095CDp ; ___:0040A99Dp align 10h dword_436840 dd 4C1h dup(0) db 2 dup(0) SEH_4034E0 dw 0 ; DATA XREF: sub_4034E0+2o dd 0DEh dup(0) dword_437EC0 dd 3Ah dup(0) SEH_403C00 dd 0Ah dup(0) ; DATA XREF: sub_403C00+2o db 3 dup(0) SEH_403C90 db 0 ; DATA XREF: sub_403C90+2o dd 0Bh dup(0) db 3 dup(0) SEH_403D10 db 0 ; DATA XREF: sub_403D10+2o dd 9 dup(0) SEH_403D90 dd 1Ch dup(0) ; DATA XREF: sub_403D90+2o db 0 SEH_403E00 db 3 dup(0) ; DATA XREF: sub_403E00+2o dd 1Fh dup(0) db 0 byte_438119 db 3 dup(0) ; DATA XREF: ___:00403EE2o dd 2Bh dup(0) dword_4381C8 dd 24h dup(0) db 3 dup(0) byte_43825B db 0 ; DATA XREF: ___:00404642o dd 8Fh dup(0) db 3 dup(0) byte_43849B db 0 ; DATA XREF: ___:00404C78o dd 2Ch dup(0) db 3 dup(0) SEH_4066E0 db 0 ; DATA XREF: sub_4066E0+2o dd 11h dup(0) db 0 SEH_406890 db 3 dup(0) ; DATA XREF: sub_406890+2o dd 0Eh dup(0) db 0 byte_4385D1 db 3 dup(0) ; DATA XREF: ___:00406C38o dd 9 dup(0) db 3 dup(0) byte_4385FB db 0 ; DATA XREF: ___:00407032o dd 7 dup(0) SEH_407660 dd 0Ah dup(0) ; DATA XREF: sub_407660+8o SEH_4076F0 dd 0C7h dup(0) ; DATA XREF: sub_4076F0+8o dword_43895C dd 37h dup(0) db 0 byte_438A39 db 3 dup(0) ; DATA XREF: ___:00409582o dd 7 dup(0) SEH_40A290 dd 0Fh dup(0) ; DATA XREF: sub_40A290+2o db 3 dup(0) SEH_40A430 db 0 ; DATA XREF: sub_40A430+2o dd 8 dup(0) db 0 byte_438AB9 db 3 dup(0) ; DATA XREF: ___:0040A952o dd 5 dup(0) SEH_40AE10 dd 4 dup(0) ; DATA XREF: sub_40AE10+5o dword_438AE0 dd 0Fh dup(0) db 3 dup(0) byte_438B1F db 0 ; DATA XREF: ___:0040B0B2o dd 13h dup(0) db 3 dup(0) byte_438B6F db 0 ; DATA XREF: ___:0040B172o dd 0Eh dup(0) dword_438BA8 dd 0Ch dup(0) SEH_40B430 dd 8 dup(0) ; DATA XREF: sub_40B430+2o dword_438BF8 dd 0Eh dup(0) dword_438C30 dd 0Ah dup(0) dword_438C58 dd 11h dup(0) dword_438C9C dd 0Bh dup(0) dword_438CC8 dd 13h dup(0) db 3 dup(0) byte_438D17 db 0 ; DATA XREF: ___:0040CBB8o dd 0Fh dup(0) db 2 dup(0) SEH_40CE60 dw 0 ; DATA XREF: sub_40CE60+2o dd 0Bh dup(0) db 2 dup(0) word_438D86 dw 0 ; DATA XREF: ___:0040CEE2o dd 0Eh dup(0) dword_438DC0 dd 1Eh dup(0) dword_438E38 dd 2Dh dup(0) db 3 dup(0) SEH_40DB40 db 0 ; DATA XREF: sub_40DB40+2o dd 18h dup(0) dword_438F50 dd 14h dup(0) SEH_40E7A0 dd 0Eh dup(0) ; DATA XREF: sub_40E7A0+2o SEH_40EC30 dd 8 dup(0) ; DATA XREF: sub_40EC30+2o SEH_40ED70 dd 1402h dup(0) ; DATA XREF: sub_40ED70+2o dword_43E000 dd 0 dword_43E004 dd 0 dword_43E008 dd 0 dword_43E00C dd 0 dword_43E010 dd 0 ; sub_409B40+Bo ... dword_43E014 dd 3 dup(0) ; sub_40AE10+1Co dword_43E020 dd 0 ; ___:0040B18Eo flt_43E024 dd 0.0 ; DATA XREF: ___:0040B7C6r dd 416h dup(0) dword_43F080 dd 1128h dup(0) ; ___:0040A997o dword_443520 dd 33h dup(0) dword_4435EC dd 0 dword_4435F0 dd 0 ; ___:004054E5o ... dword_4435F4 dd 3 dup(0) ; ___:004054A1o ... dword_443600 dd 0 ; ___:0040482Do ... dword_443604 dd 0 dword_443608 dd 9 dup(0) dword_44362C dd 8 dup(0) dword_44364C dd 7 dup(0) dword_443668 dd 7 dup(0) dword_443684 dd 2 dup(0) ; ___:00405CCEo ... dword_44368C dd 7 dup(0) dword_4436A8 dd 0 dword_4436AC dd 4 dup(0) dword_4436BC dd 6 dup(0) dword_4436D4 dd 3 dup(0) dword_4436E0 dd 5 dup(0) dword_4436F4 dd 2 dup(0) dword_4436FC dd 4 dup(0) ; ___:00405621o dword_44370C dd 5 dup(0) dword_443720 dd 1Eh dup(0) dword_443798 dd 3 dup(0) dword_4437A4 dd 0 dword_4437A8 dd 2 dup(0) dword_4437B0 dd 0 dword_4437B4 dd 2 dup(0) dword_4437BC dd 0 dword_4437C0 dd 0 dword_4437C4 dd 0 dword_4437C8 dd 0 dword_4437CC dd 2 dup(0) ; ___:00406E35o dword_4437D4 dd 3 dup(0) ; sub_40EC30+88o dword_4437E0 dd 3 dup(0) dword_4437EC dd 2 dup(0) dword_4437F4 dd 0 ; ___:004086D8o ... dword_4437F8 dd 0 dword_4437FC dd 2 dup(0) dword_443804 dd 5 dup(0) dword_443818 dd 3 dup(0) dword_443824 dd 0Ah dup(0) dword_44384C dd 3 dup(0) dword_443858 dd 2 dup(0) dword_443860 dd 3 dup(0) dword_44386C dd 5 dup(0) dword_443880 dd 2 dup(0) dword_443888 dd 0 dword_44388C dd 2 dup(0) dword_443894 dd 2 dup(0) ; ___:00407A6Co dword_44389C dd 2 dup(0) ; ___:00407A5Bo dword_4438A4 dd 23h dup(0) ; ___:00407A4Ao dword_443930 dd 9 dup(0) ; ___:0040A971o dword_443954 dd 2 dup(0) ; sub_40B700+43o ... dword_44395C dd 0 dword_443960 dd 2 dup(0) dword_443968 dd 7 dup(0) dword_443984 dd 3 dup(0) dword_443990 dd 7 dup(0) dword_4439AC dd 2 dup(0) dword_4439B4 dd 6 dup(0) dword_4439CC dd 0Dh dup(0) dword_443A00 dd 8 dup(0) dword_443A20 dd 4 dup(0) dword_443A30 dd 7 dup(0) dword_443A4C dd 8 dup(0) dword_443A6C dd 7 dup(0) dword_443A88 dd 8 dup(0) dword_443AA8 dd 8 dup(0) dword_443AC8 dd 0Ah dup(0) dword_443AF0 dd 5 dup(0) dword_443B04 dd 0 dword_443B08 dd 4 dup(0) dword_443B18 dd 2 dup(0) dword_443B20 dd 4 dup(0) dword_443B30 dd 2 dup(0) dword_443B38 dd 2 dup(0) dword_443B40 dd 4 dup(0) dword_443B50 dd 5 dup(0) dword_443B64 dd 8 dup(0) dword_443B84 dd 7 dup(0) dword_443BA0 dd 4 dup(0) dword_443BB0 dd 7 dup(0) dword_443BCC dd 0Ch dup(0) dword_443BFC dd 3 dup(0) dword_443C08 dd 0CDAh dup(0) ; ___:0040EF9Ao dword_446F70 dd 0 ; ___:00404840o ... dword_446F74 dd 0 dword_446F78 dd 0 ; ___:0040D3DFr ... align 10h dword_446F80 dd 0 ; ___:0040D345w ... dd 8 dup(0) dword_446FA4 dd 41h dup(0) ; ___:0040D380o ... dword_4470A8 dd 0 ; ___:loc_40D3D4r ... dword_4470AC dd 0 ; ___:0040D34Fr ... dword_4470B0 dd 0 ; ___:0040D64Aw dword_4470B4 dd 0 ; ___:0040D663r dd 28h dup(0) dword_447158 dd 10h dup(0) ; ___:0040405Fo ... db 2 dup(0) byte_44719A db 0 ; DATA XREF: ___:loc_409A30r ; ___:loc_409AA0r align 4 db 3 dup(0) byte_44719F db 0 ; DATA XREF: ___:0040D68Fr db 0 byte_4471A1 db 0 ; DATA XREF: ___:loc_40DB10r word_4471A2 dw 0 ; DATA XREF: ___:0040DB19o dd 47h dup(0) dword_4472C0 dd 12h dup(0) db 0 byte_447309 db 3 dup(0) ; DATA XREF: ___:00408ADEo dd 11h dup(0) db 2 dup(0) word_447352 dw 0 ; DATA XREF: ___:00408AB5o dd 11h dup(0) db 3 dup(0) byte_44739B db 0 ; DATA XREF: ___:00408B07o dd 12h dup(0) dword_4473E4 dd 12h dup(0) db 0 byte_44742D db 3 dup(0) ; DATA XREF: ___:00408A40o dd 23h dup(0) db 3 dup(0) byte_4474BF db 0 ; DATA XREF: ___:00408B30o dd 0CEh dup(0) db 3 dup(0) byte_4477FB db 0 ; DATA XREF: ___:loc_40D90Fr dd 1Eh dup(0) dword_447874 dd 18h dup(0) ; sub_40ED70+97o db 2 dup(0) byte_4478D6 db 0 ; DATA XREF: ___:00404EC8r align 4 dd 11h dup(0) db 3 dup(0) byte_44791F db 0 ; DATA XREF: ___:loc_404EE0r dd 0Bh dup(0) db 3 dup(0) byte_44794F db 0 ; DATA XREF: ___:00404EE9o dd 4D3h dup(0) db 2 dup(0) word_448C9E dw 0 ; DATA XREF: ___:004047FDo ; sub_404B10+31o ... db 2 dup(0) word_448CA2 dw 0 ; DATA XREF: sub_404B10+4o dd 1Ch dup(0) db 2 dup(0) word_448D16 dw 0 ; DATA XREF: sub_407660+36o ; sub_4076F0+3Eo ... dd 26h dup(0) dword_448DB0 dd 234C1h dup(0) ; ___:00404EEEo ... db 0 byte_4D60B5 db 3 dup(0) ; DATA XREF: ___:00404459o ; ___:00404C3Eo ... dd 5 dup(0) byte_4D60CC db 0 ; DATA XREF: ___:00404F02w ; ___:0040515Ew dword_4D60CD dd 0 align 4 dd 0 db 0 dword_4D60D9 dd 0 ; ___:00404C4Aw align 10h dd 0ABh dup(0) db 3 dup(0) byte_4D638F db 0 ; DATA XREF: ___:004081C6o ; ___:00408657o ... dd 42BDh dup(0) byte_4E6E84 db 0 ; DATA XREF: ___:00404F09w byte_4E6E85 db 3 dup(0) ; DATA XREF: ___:00404498o ; ___:00404EA5o ... dd 4 dup(0) db 2 dup(0) word_4E6E9A dw 0 ; DATA XREF: ___:00404F44o ; ___:0040866Bo ... dd 0A227h dup(0) dword_50F738 dd 0 ; sub_40E7A0+25Ar dd 4 dup(0) dword_50F74C dd 0 ; sub_40ED70+15Er ... dd 0 dword_50F754 dd 0 ; sub_40E7A0+22Cr dd 0 dword_50F75C dd 0 dd 0 dword_50F764 dd 0 ; sub_40E7A0+24Cr dd 4Eh dup(0) dword_50F8A0 dd 0 dword_50F8A4 dd 0 ; ___:0040D8B2r dd 7 dup(0) dword_50F8C4 dd 0 dd 4 dup(0) dword_50F8D8 dd 0 dd 3 dup(0) dword_50F8E8 dd 0 dd 8 dup(0) dword_50F90C dd 0 dd 6Fh dup(0) dword_50FACC dd 0 dd 0 dword_50FAD4 dd 0 dword_50FAD8 dd 0 align 10h dword_50FAE0 dd 0 dd 4 dup(0) dword_50FAF4 dd 0 dword_50FAF8 dd 0 dd 2 dup(0) dword_50FB04 dd 0 dd 53Eh dup(0) ___ ends ; Section 2. (virtual address 00111000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00001000 ( 4096.) ; Offset to raw data for section: 00111000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _rsrc___ segment para public 'DATA' use32 assume cs:_rsrc___ ;org 511000h align 2000h _rsrc___ ends ; Section 3. (virtual address 00112000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00001000 ( 4096.) ; Offset to raw data for section: 00112000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata__ segment para public 'DATA' use32 assume cs:_idata__ ;org 512000h dd 400h dup(0) _idata__ ends ; Section 4. (virtual address 00113000) ; Virtual size : 000F8000 (1015808.) ; Section size in file : 000F8000 (1015808.) ; Offset to raw data for section: 00113000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write Themida_ segment para public 'DATA' use32 assume cs:Themida_ ;org 513000h dd 5 dup(0) public start start dd 36C74h dup(0) db 0 byte_5EE1E5 db 3 dup(0) ; CODE XREF: sub_406890+12Bp ; sub_409BC0+1Cp ... dd 7386h dup(0) Themida_ ends ; Section 5. (virtual address 0020B000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 0020B000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 60B000h align 2000h _idata2 ends end start