regshot.asm
lawlrenz_crumble/crumble/examples/regshot.asm

_SCOPETABLE_ENTRY struc	; (sizeof=0xC) ; XREF: ...
EnclosingLevel dd ?
FilterFunc dd ?		; offset
HandlerFunc dd ?	; offset
_SCOPETABLE_ENTRY ends


CPPEH_RECORD struc ; (sizeof=0x18) ; XREF: ...
old_esp	dd ?		; XREF:	...
exc_ptr	dd ?		; XREF:	... ; offset
registration _EH3_EXCEPTION_REGISTRATION ? ; XREF: ...
CPPEH_RECORD ends


_EH3_EXCEPTION_REGISTRATION struc ; (sizeof=0x10, standard type) ; XREF: ...
Next dd	?		; XREF:	... ; offset
ExceptionHandler dd ?	; offset
ScopeTable dd ?		; offset
TryLevel dd ?		; XREF:	...
_EH3_EXCEPTION_REGISTRATION ends


_WIN32_FIND_DATAA struc	; (sizeof=0x140, standard type)	; XREF:	...
dwFileAttributes dd ?
ftCreationTime FILETIME	?
ftLastAccessTime FILETIME ?
ftLastWriteTime	FILETIME ?
nFileSizeHigh dd ?
nFileSizeLow dd	?
dwReserved0 dd ?
dwReserved1 dd ?
cFileName db 260 dup(?)
cAlternateFileName db 14 dup(?)
_padding db 2 dup(?)
_WIN32_FIND_DATAA ends


FILETIME struc ; (sizeof=0x8, standard type) ; XREF: ...
dwLowDateTime dd ?
dwHighDateTime dd ?
FILETIME ends


tagMSG struc ; (sizeof=0x1C, standard type) ; XREF: ...
hwnd dd	?		; offset
message	dd ?
wParam dd ?
lParam dd ?
time dd	?
pt POINT ?
tagMSG ends


POINT struc ; (sizeof=0x8, standard type) ; XREF: ...
x dd ?
y dd ?
POINT ends


_FILETIME struc	; (sizeof=0x8, standard	type) ;	XREF: ...
dwLowDateTime dd ?
dwHighDateTime dd ?
_FILETIME ends


tagOFNA	struc ;	(sizeof=0x4C, standard type) ; XREF: ...
lStructSize dd ?
hwndOwner dd ?		; offset
hInstance dd ?		; offset
lpstrFilter dd ?	; offset
lpstrCustomFilter dd ?	; offset
nMaxCustFilter dd ?
nFilterIndex dd	?
lpstrFile dd ?		; offset
nMaxFile dd ?
lpstrFileTitle dd ?	; offset
nMaxFileTitle dd ?
lpstrInitialDir	dd ?	; offset
lpstrTitle dd ?		; offset
Flags dd ?
nFileOffset dw ?
nFileExtension dw ?
lpstrDefExt dd ?	; offset
lCustData dd ?
lpfnHook dd ?		; offset
lpTemplateName dd ?	; offset
tagOFNA	ends


tagRECT	struc ;	(sizeof=0x10, standard type) ; XREF: ...
left dd	?
top dd ?
right dd ?
bottom dd ?
tagRECT	ends


_browseinfoA struc ; (sizeof=0x20, standard type) ; XREF: ...
hwndOwner dd ?		; offset
pidlRoot dd ?		; offset
pszDisplayName dd ?	; offset
lpszTitle dd ?		; offset
ulFlags	dd ?
lpfn dd	?		; offset
lParam dd ?
iImage dd ?
_browseinfoA ends


_STARTUPINFOA struc ; (sizeof=0x44, standard type) ; XREF: ...
cb dd ?
lpReserved dd ?		; offset
lpDesktop dd ?		; offset
lpTitle	dd ?		; offset
dwX dd ?
dwY dd ?
dwXSize	dd ?
dwYSize	dd ?
dwXCountChars dd ?
dwYCountChars dd ?
dwFillAttribute	dd ?
dwFlags	dd ?		; XREF:	...
wShowWindow dw ?	; XREF:	...
cbReserved2 dw ?	; XREF:	...
lpReserved2 dd ?	; XREF:	... ; offset
hStdInput dd ?		; offset
hStdOutput dd ?		; offset
hStdError dd ?		; offset
_STARTUPINFOA ends


_OSVERSIONINFOA	struc ;	(sizeof=0x94, standard type) ; XREF: ...
dwOSVersionInfoSize dd ?
dwMajorVersion dd ?
dwMinorVersion dd ?
dwBuildNumber dd ?
dwPlatformId dd	?
szCSDVersion db	128 dup(?)
_OSVERSIONINFOA	ends


_cpinfo	struc ;	(sizeof=0x14, standard type) ; XREF: ...
MaxCharSize dd ?
DefaultChar db 2 dup(?)
LeadByte db 12 dup(?)
_padding db 2 dup(?)
_cpinfo	ends


FILE struc ; (sizeof=0x20, standard type) ; XREF: ...
_ptr dd	?		; offset
_cnt dd	?
_base dd ?		; offset
_flag dd ?
_file dd ?
_charbuf dd ?
_bufsiz	dd ?
_tmpfname dd ?		; offset
FILE ends


;
; +-------------------------------------------------------------------------+
; |   This file	has been generated by The Interactive Disassembler (IDA)    |
; |	      Copyright	(c) 2013 Hex-Rays, <support@hex-rays.com>	    |
; |			 License info: 48-3215-7394-8A			    |
; |  Universitaet Bonn/	Institut fuer Informatik Abteilung fuer	Informati   |
; +-------------------------------------------------------------------------+
;
; Input	MD5   :	AAA8FFBCACE9C4999A77D63E0FA80F85
; Input	CRC32 :	FF9C6868

; File Name   :	Y:\binaries\regshot.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	400000
; Section 1. (virtual address 00001000)
; Virtual size			: 0000A477 (  42103.)
; Section size in file		: 0000B000 (  45056.)
; Offset to raw	data for section: 00001000
; Flags	60000020: Text Executable Readable
; Alignment	: default
; OS type	  :  MS	Windows
; Application type:  Executable	32bit

include	uni.inc	; see unicode subdir of	ida for	info on	unicode

.686p
.mmx
.model flat


; Segment type:	Pure code
; Segment permissions: Read/Execute
_text segment para public 'CODE' use32
assume cs:_text
;org 401000h
assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing



sub_401000 proc	near

arg_0= dword ptr  4

push	ebx
mov	ebx, [esp+4+arg_0]
push	ebp
push	esi
xor	esi, esi
push	edi
test	ebx, ebx
mov	edx, ebx
jz	short loc_40102B

loc_401010:
mov	edi, [edx]
or	ecx, 0FFFFFFFFh
xor	eax, eax
mov	edx, [edx+24h]
repne scasb
not	ecx
dec	ecx
test	edx, edx
lea	esi, [esi+ecx+1]
jnz	short loc_401010
test	esi, esi
jnz	short loc_401030

loc_40102B:
mov	esi, 1

loc_401030:
mov	eax, hHeap
push	esi		; dwBytes
push	1		; dwFlags
push	eax		; hHeap
call	ds:HeapAlloc
mov	ebp, eax
test	ebx, ebx
lea	edx, [esi+ebp-1]
mov	byte ptr [edx],	0
jz	short loc_40107B

loc_40104C:
mov	esi, [ebx]
or	ecx, 0FFFFFFFFh
mov	edi, esi
xor	eax, eax
repne scasb
not	ecx
dec	ecx
sub	edx, ecx
mov	eax, ecx
mov	edi, edx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
cmp	edx, ebp
rep movsb
jbe	short loc_401074
dec	edx
mov	byte ptr [edx],	5Ch

loc_401074:
mov	ebx, [ebx+24h]
test	ebx, ebx
jnz	short loc_40104C

loc_40107B:
pop	edi
mov	eax, ebp
pop	esi
pop	ebp
pop	ebx
retn
sub_401000 endp

align 10h



sub_401090 proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch
arg_C= dword ptr  10h
arg_10=	dword ptr  14h
arg_14=	dword ptr  18h

push	ebx
mov	ebx, [esp+4+arg_8]
push	ebp
mov	ebp, [esp+8+arg_C]
push	esi
mov	esi, [esp+0Ch+arg_14]
push	edi
mov	edi, [esp+10h+arg_10]

loc_4010A4:
test	byte ptr [esi+14h], 10h
jz	short loc_4010CB
mov	ecx, [esi]
mov	ax, [ecx]
cmp	ax, 2Eh
jz	short loc_4010D6
cmp	ax, 2E2Eh
jnz	short loc_4010C2
mov	al, [ecx+2]
test	al, al
jz	short loc_4010D6

loc_4010C2:
mov	eax, [esp+10h+arg_4]
push	esi
push	ebp
push	eax
jmp	short loc_4010CE

loc_4010CB:
push	esi
push	edi
push	ebx

loc_4010CE:
call	sub_402AA0
add	esp, 0Ch

loc_4010D6:
mov	eax, [esi+1Ch]
test	eax, eax
jz	short loc_4010F0
mov	ecx, [esp+10h+arg_4]
push	eax
push	edi
push	ebp
push	ebx
push	ecx
push	1
call	sub_401090
add	esp, 18h

loc_4010F0:
mov	ecx, [esp+10h+arg_0]
mov	eax, 1
cmp	ecx, eax
jnz	short loc_40110A
mov	esi, [esi+20h]
test	esi, esi
jz	short loc_40110A
mov	[esp+10h+arg_0], eax
jmp	short loc_4010A4

loc_40110A:
pop	edi
pop	esi
pop	ebp
pop	ebx
retn
sub_401090 endp

align 10h



sub_401110 proc	near

lpMem= dword ptr -148h
hFindFile= dword ptr -144h
FindFileData= _WIN32_FIND_DATAA	ptr -140h
arg_0= dword ptr  4

sub	esp, 148h
mov	eax, [esp+148h+arg_0]
push	ebx
push	ebp
push	esi
push	edi
push	eax
call	sub_401000
mov	esi, eax
or	ecx, 0FFFFFFFFh
mov	edi, esi
xor	eax, eax
add	esp, 4
mov	ebx, ds:HeapAlloc
repne scasb
not	ecx
add	ecx, 4
mov	[esp+158h+lpMem], esi
push	ecx		; dwBytes
mov	ecx, hHeap
push	1		; dwFlags
push	ecx		; hHeap
call	ebx ; HeapAlloc
mov	ebp, eax
mov	edi, esi
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
not	ecx
sub	edi, ecx
mov	edx, ecx
mov	esi, edi
mov	edi, ebp
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	edi, offset a_	; "\\*.*"
or	ecx, 0FFFFFFFFh
repne scasb
not	ecx
sub	edi, ecx
mov	esi, edi
mov	edx, ecx
mov	edi, ebp
or	ecx, 0FFFFFFFFh
repne scasb
mov	ecx, edx
dec	edi
shr	ecx, 2
rep movsd
mov	eax, [esp+158h+lpMem]
mov	ecx, edx
and	ecx, 3
push	eax		; lpMem
rep movsb
mov	ecx, hHeap
mov	esi, ds:HeapFree
push	1		; dwFlags
push	ecx		; hHeap
call	esi ; HeapFree
lea	edx, [esp+158h+FindFileData]
push	edx		; lpFindFileData
push	ebp		; lpFileName
call	ds:FindFirstFileA
mov	edi, eax
mov	eax, hHeap
push	ebp		; lpMem
push	1		; dwFlags
push	eax		; hHeap
mov	[esp+164h+hFindFile], edi
call	esi ; HeapFree
cmp	edi, 0FFFFFFFFh
jz	loc_4013FB
mov	ecx, hHeap
push	2Ch		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
call	ebx ; HeapAlloc
mov	ebp, eax
lea	edi, [esp+158h+FindFileData.cFileName]
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	edx, hHeap
not	ecx
push	ecx		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
call	ebx ; HeapAlloc
mov	edx, eax
lea	edi, [esp+158h+FindFileData.cFileName]
or	ecx, 0FFFFFFFFh
xor	eax, eax
mov	[ebp+0], edx
mov	[esp+158h+lpMem], ebp
repne scasb
not	ecx
sub	edi, ecx
mov	eax, ecx
mov	esi, edi
mov	edi, edx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	ecx, [esp+158h+FindFileData.ftLastWriteTime.dwLowDateTime]
mov	[ebp+4], ecx
mov	edx, [esp+158h+FindFileData.ftLastWriteTime.dwHighDateTime]
mov	[ebp+8], edx
mov	eax, [esp+158h+FindFileData.nFileSizeLow]
mov	[ebp+0Ch], eax
mov	ecx, [esp+158h+FindFileData.nFileSizeHigh]
mov	eax, [esp+158h+arg_0]
mov	[ebp+10h], ecx
mov	edx, [esp+158h+FindFileData.dwFileAttributes]
mov	[ebp+24h], eax
mov	[ebp+14h], edx
mov	[eax+1Ch], ebp
test	byte ptr [ebp+14h], 10h
jz	short loc_4012A4
mov	ax, word ptr [esp+158h+FindFileData.cFileName]
cmp	ax, 2Eh
jz	short loc_4012AA
cmp	ax, 2E2Eh
jnz	short loc_401276
mov	al, [esp+158h+FindFileData.cFileName+2]
test	al, al
jz	short loc_4012AA

loc_401276:
mov	eax, dword_4106B4
mov	ecx, [ebp+0]
push	eax		; int
push	ecx		; char *
call	sub_405060
add	esp, 8
test	eax, eax
jnz	short loc_4012AA
mov	edx, dword_4104F8
push	ebp
inc	edx
mov	dword_4104F8, edx
call	sub_401110
add	esp, 4
jmp	short loc_4012AA

loc_4012A4:
inc	dword_4104FC

loc_4012AA:
mov	eax, [esp+158h+hFindFile]
lea	edx, [esp+158h+FindFileData]
push	edx		; lpFindFileData
push	eax		; hFindFile
call	ds:FindNextFileA
test	eax, eax
jz	loc_4013B5

loc_4012C2:
mov	ecx, hHeap
push	2Ch		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
call	ebx ; HeapAlloc
mov	ebp, eax
lea	edi, [esp+158h+FindFileData.cFileName]
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	edx, hHeap
not	ecx
push	ecx		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
call	ebx ; HeapAlloc
mov	edx, eax
lea	edi, [esp+158h+FindFileData.cFileName]
or	ecx, 0FFFFFFFFh
xor	eax, eax
mov	[ebp+0], edx
repne scasb
not	ecx
sub	edi, ecx
mov	eax, ecx
mov	esi, edi
mov	edi, edx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	ecx, [esp+158h+FindFileData.ftLastWriteTime.dwLowDateTime]
mov	[ebp+4], ecx
mov	edx, [esp+158h+FindFileData.ftLastWriteTime.dwHighDateTime]
mov	[ebp+8], edx
mov	eax, [esp+158h+FindFileData.nFileSizeLow]
mov	[ebp+0Ch], eax
mov	ecx, [esp+158h+FindFileData.nFileSizeHigh]
mov	eax, [esp+158h+arg_0]
mov	[ebp+10h], ecx
mov	edx, [esp+158h+FindFileData.dwFileAttributes]
mov	ecx, [esp+158h+lpMem]
mov	[ebp+14h], edx
mov	[ebp+24h], eax
mov	[ecx+20h], ebp
mov	al, [ebp+14h]
test	al, 10h
mov	[esp+158h+lpMem], ebp
jz	short loc_401397
mov	ax, word ptr [esp+158h+FindFileData.cFileName]
cmp	ax, 2Eh
jz	short loc_40139D
cmp	ax, 2E2Eh
jnz	short loc_401368
mov	al, [esp+158h+FindFileData.cFileName+2]
test	al, al
jz	short loc_40139D

loc_401368:
mov	edx, dword_4106B4
mov	eax, [ebp+0]
push	edx		; int
push	eax		; char *
call	sub_405060
add	esp, 8
test	eax, eax
jnz	short loc_40139D
mov	edx, dword_4104F8
push	ebp
inc	edx
mov	dword_4104F8, edx
call	sub_401110
add	esp, 4
jmp	short loc_40139D

loc_401397:
inc	dword_4104FC

loc_40139D:
mov	edx, [esp+158h+hFindFile]
lea	ecx, [esp+158h+FindFileData]
push	ecx		; lpFindFileData
push	edx		; hFindFile
call	ds:FindNextFileA
test	eax, eax
jnz	loc_4012C2

loc_4013B5:
mov	eax, [esp+158h+hFindFile]
push	eax		; hFindFile
call	ds:FindClose
call	ds:GetTickCount
mov	edx, dword_4104E4
mov	dword_4104B0, eax
sub	eax, edx
cmp	eax, 6Eh
jbe	short loc_4013FB
mov	ecx, dword_4104FC
mov	edx, dword_4104F8
mov	eax, dword_4104A4
push	ecx
mov	ecx, dword_410450
push	edx
push	eax
push	ecx
call	sub_4051B0
add	esp, 10h

loc_4013FB:
pop	edi
pop	esi
pop	ebp
pop	ebx
add	esp, 148h
retn
sub_401110 endp

align 10h



sub_401410 proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	ebp
mov	ebp, [esp+4+arg_0]
test	ebp, ebp
push	esi
jz	loc_40159E
push	edi

loc_40141F:
mov	esi, [esp+0Ch+arg_4]
test	esi, esi
jz	loc_401566

loc_40142B:
mov	al, [esi+28h]
test	al, al
jnz	short loc_401464
mov	edi, [esi]
mov	eax, [ebp+0]

loc_401437:
mov	dl, [eax]
mov	cl, dl
cmp	dl, [edi]
jnz	short loc_40145B
test	cl, cl
jz	short loc_401457
mov	dl, [eax+1]
mov	cl, dl
cmp	dl, [edi+1]
jnz	short loc_40145B
add	eax, 2
add	edi, 2
test	cl, cl
jnz	short loc_401437

loc_401457:
xor	eax, eax
jmp	short loc_401460

loc_40145B:
sbb	eax, eax
sbb	eax, 0FFFFFFFFh

loc_401460:
test	eax, eax
jz	short loc_401470

loc_401464:
mov	esi, [esi+20h]
test	esi, esi
jnz	short loc_40142B
jmp	loc_401566

loc_401470:
mov	edx, [ebp+14h]
mov	eax, edx
and	eax, 10h
jnz	short loc_4014D0
mov	ecx, [esi+14h]
test	cl, 10h
jnz	short loc_4014D0
mov	eax, [ebp+4]
mov	edi, [esi+4]
cmp	eax, edi
jnz	short loc_4014B7
mov	eax, [ebp+8]
mov	edi, [esi+8]
cmp	eax, edi
jnz	short loc_4014B7
mov	eax, [ebp+0Ch]
mov	edi, [esi+0Ch]
cmp	eax, edi
jnz	short loc_4014B7
mov	eax, [ebp+10h]
mov	edi, [esi+10h]
cmp	eax, edi
jnz	short loc_4014B7
cmp	edx, ecx
jnz	short loc_4014B7
mov	byte ptr [esi+28h], 1
jmp	loc_401562

loc_4014B7:
push	ebp
push	offset dword_4104B4
push	8
mov	byte ptr [esi+28h], 4
call	sub_402AA0
add	esp, 0Ch
jmp	loc_401562

loc_4014D0:
test	eax, eax
jz	short loc_401510
mov	ecx, [esi+14h]
test	cl, 10h
jz	short loc_40150C
cmp	edx, ecx
jnz	short loc_4014F6
mov	ecx, [esi+1Ch]
mov	byte ptr [esi+28h], 1
mov	edx, [ebp+1Ch]
push	ecx
push	edx
call	sub_401410
add	esp, 8
jmp	short loc_401562

loc_4014F6:
push	ebp
push	offset dword_410654
push	0Bh
mov	byte ptr [esi+28h], 4
call	sub_402AA0
add	esp, 0Ch
jmp	short loc_401562

loc_40150C:
test	eax, eax
jnz	short loc_401538

loc_401510:
test	byte ptr [esi+14h], 10h
jz	short loc_401538
push	ebp
push	offset dword_4106C4
push	7
mov	byte ptr [ebp+28h], 2
call	sub_402AA0
push	esi
push	offset dword_4106B0
push	offset dword_4105C0
push	6
push	9
jmp	short loc_401558

loc_401538:
push	esi
push	offset dword_4106B0
push	6
mov	byte ptr [esi+28h], 3
call	sub_402AA0
push	ebp
push	offset dword_4106C4
push	offset dword_410658
push	7
push	0Ah

loc_401558:
push	0
call	sub_401090
add	esp, 24h

loc_401562:
test	esi, esi
jnz	short loc_401592

loc_401566:
mov	al, [ebp+14h]
push	ebp
test	al, 10h
push	offset dword_4106C4
jz	short loc_401588
push	offset dword_410658
push	7
push	0Ah
push	0
call	sub_401090
add	esp, 18h
jmp	short loc_401592

loc_401588:
push	7
call	sub_402AA0
add	esp, 0Ch

loc_401592:
mov	ebp, [ebp+20h]
test	ebp, ebp
jnz	loc_40141F
pop	edi

loc_40159E:
mov	esi, [esp+8+arg_4]
test	esi, esi
jz	short loc_4015ED

loc_4015A6:
mov	ecx, dword_41059C
inc	ecx
mov	dword_41059C, ecx
mov	al, [esi+28h]
test	al, al
jnz	short loc_4015E6
mov	al, [esi+14h]
push	esi
test	al, 10h
push	offset dword_4106B0
jz	short loc_4015DC
push	offset dword_4105C0
push	6
push	9
push	0
call	sub_401090
add	esp, 18h
jmp	short loc_4015E6

loc_4015DC:
push	6
call	sub_402AA0
add	esp, 0Ch

loc_4015E6:
mov	esi, [esi+20h]
test	esi, esi
jnz	short loc_4015A6

loc_4015ED:
mov	ecx, dword_4104FC
pop	esi
test	ecx, ecx
pop	ebp
jz	short locret_40162E
mov	eax, dword_41059C
xor	edx, edx
div	ecx
cmp	edx, dword_4106F8
jbe	short locret_40162E
mov	eax, hDlg
push	0		; lParam
push	0		; wParam
push	405h		; Msg
push	400h		; nIDDlgItem
push	eax		; hDlg
mov	dword_41059C, 0
call	ds:SendDlgItemMessageA

locret_40162E:
retn
sub_401410 endp

align 10h



; int __cdecl sub_401630(LPVOID	lpMem)
sub_401630 proc	near

lpMem= dword ptr  4

push	esi
mov	esi, [esp+4+lpMem]
test	esi, esi
jz	short loc_40166F
mov	eax, [esi+1Ch]
push	edi
push	eax		; lpMem
call	sub_401630
mov	ecx, [esi+20h]
push	ecx		; lpMem
call	sub_401630
mov	edx, [esi]
mov	eax, hHeap
mov	edi, ds:HeapFree
add	esp, 8
push	edx		; lpMem
push	1		; dwFlags
push	eax		; hHeap
call	edi ; HeapFree
mov	ecx, hHeap
push	esi		; lpMem
push	1		; dwFlags
push	ecx		; hHeap
call	edi ; HeapFree
pop	edi

loc_40166F:
pop	esi
retn
sub_401630 endp

align 10h



; int __cdecl sub_401680(LPVOID	lpMem)
sub_401680 proc	near

lpMem= dword ptr  4

push	esi
mov	esi, [esp+4+lpMem]
test	esi, esi
jz	short loc_4016AD
mov	eax, [esi]
push	eax		; lpMem
call	sub_401680
mov	ecx, [esi+4]
push	ecx		; lpMem
call	sub_401630
mov	edx, hHeap
add	esp, 8
push	esi		; lpMem
push	1		; dwFlags
push	edx		; hHeap
call	ds:HeapFree

loc_4016AD:
pop	esi
retn
sub_401680 endp

align 10h



; int __cdecl sub_4016B0(int Buffer, int, LONG lDistanceToMove)
sub_4016B0 proc	near

var_4= dword ptr -4
Buffer=	dword ptr  4
arg_4= dword ptr  8
lDistanceToMove= dword ptr  0Ch

push	ecx
push	ebx
mov	ebx, [esp+8+Buffer]
push	ebp
push	esi
push	edi
mov	edi, [ebx]
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
not	ecx
push	1		; dwMoveMethod
push	eax		; lpDistanceToMoveHigh
dec	ecx
push	eax		; lDistanceToMove
mov	eax, hFile
mov	edi, ecx
push	eax		; hFile
inc	edi
call	ds:SetFilePointer
mov	edx, hFile
mov	esi, ds:WriteFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	ecx, [esp+1Ch+Buffer]
mov	[esp+1Ch+var_4], eax
push	4		; nNumberOfBytesToWrite
add	eax, 29h
push	ecx		; lpBuffer
push	edx		; hFile
mov	[esp+28h+Buffer], eax
call	esi ; WriteFile
mov	ecx, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	eax, [ebx+4]
push	18h		; nNumberOfBytesToWrite
push	eax		; lpBuffer
push	ecx		; hFile
call	esi ; WriteFile
mov	edx, hFile
push	0		; lpOverlapped
lea	ebp, [ebx+1Ch]
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	8		; nNumberOfBytesToWrite
push	ebp		; lpBuffer
push	edx		; hFile
call	esi ; WriteFile
mov	ecx, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	eax, [esp+1Ch+arg_4]
push	4		; nNumberOfBytesToWrite
push	eax		; lpBuffer
push	ecx		; hFile
call	esi ; WriteFile
mov	eax, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	edx, [esp+1Ch+Buffer]
push	1		; nNumberOfBytesToWrite
push	edx		; lpBuffer
push	eax		; hFile
mov	[esp+28h+Buffer], 0
call	esi ; WriteFile
mov	ecx, [ebx]
mov	edx, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	edi		; nNumberOfBytesToWrite
push	ecx		; lpBuffer
push	edx		; hFile
call	esi ; WriteFile
mov	ebp, [ebp+0]
test	ebp, ebp
jz	short loc_40178E
mov	eax, [esp+14h+var_4]
lea	ecx, [eax+1Ch]
push	ecx		; lDistanceToMove
push	eax		; int
push	ebp		; Buffer
call	sub_4016B0
add	esp, 0Ch

loc_40178E:
mov	ebx, [ebx+20h]
test	ebx, ebx
jz	short loc_4017AB
mov	edx, [esp+14h+var_4]
mov	eax, [esp+14h+arg_4]
add	edx, 20h
push	edx		; lDistanceToMove
push	eax		; int
push	ebx		; Buffer
call	sub_4016B0
add	esp, 0Ch

loc_4017AB:
mov	ebp, [esp+14h+lDistanceToMove]
test	ebp, ebp
jbe	short loc_4017FD
mov	ecx, hFile
mov	edi, ds:SetFilePointer
push	1		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	0		; lDistanceToMove
push	ecx		; hFile
call	edi ; SetFilePointer
mov	edx, hFile
push	0		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	ebp		; lDistanceToMove
push	edx		; hFile
mov	ebx, eax
call	edi ; SetFilePointer
mov	ecx, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	eax, [esp+1Ch+var_4]
push	4		; nNumberOfBytesToWrite
push	eax		; lpBuffer
push	ecx		; hFile
call	esi ; WriteFile
mov	edx, hFile
push	0		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	ebx		; lDistanceToMove
push	edx		; hFile
call	edi ; SetFilePointer

loc_4017FD:
mov	ecx, dword_410510
pop	edi
inc	ecx
pop	esi
mov	dword_410510, ecx
mov	ecx, dword_4104FC
pop	ebp
pop	ebx
test	ecx, ecx
jz	short loc_401872
mov	eax, dword_410510
xor	edx, edx
div	ecx
cmp	edx, dword_4106F8
jbe	short loc_401872
mov	eax, hDlg
push	0		; lParam
push	0		; wParam
push	405h		; Msg
push	400h		; nIDDlgItem
push	eax		; hDlg
mov	dword_410510, 0
call	ds:SendDlgItemMessageA
mov	ecx, hDlg
push	ecx		; hWnd
call	ds:UpdateWindow
mov	edx, hDlg
push	1		; wRemoveMsg
push	6		; wMsgFilterMax
push	6		; wMsgFilterMin
push	edx		; hWnd
push	offset Msg	; lpMsg
call	ds:PeekMessageA

loc_401872:
pop	ecx
retn
sub_4016B0 endp

align 10h



sub_401880 proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	esi
mov	esi, [esp+4+arg_4]
push	edi
mov	edi, [esp+8+arg_0]

loc_40188A:
mov	eax, [edi]
test	eax, eax
jz	short loc_401894
add	eax, esi
mov	[edi], eax

loc_401894:
lea	edx, [edi+1Ch]
mov	eax, edx
mov	ecx, [eax]
test	ecx, ecx
jz	short loc_4018A3
add	ecx, esi
mov	[eax], ecx

loc_4018A3:
mov	ecx, [eax+4]
add	eax, 4
test	ecx, ecx
jz	short loc_4018B1
add	ecx, esi
mov	[eax], ecx

loc_4018B1:
mov	ecx, [eax+4]
add	eax, 4
test	ecx, ecx
jz	short loc_4018BF
add	ecx, esi
mov	[eax], ecx

loc_4018BF:
mov	eax, dword_4104FC
inc	eax
mov	dword_4104FC, eax
mov	eax, [edx]
test	eax, eax
jz	short loc_4018DA
push	esi
push	eax
call	sub_401880
add	esp, 8

loc_4018DA:
mov	eax, [edi+20h]
test	eax, eax
jz	short loc_4018E5
mov	edi, eax
jmp	short loc_40188A

loc_4018E5:
pop	edi
pop	esi
retn
sub_401880 endp

align 10h



sub_4018F0 proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	esi
mov	esi, [esp+4+arg_0]
test	esi, esi
jz	short loc_40192C
push	edi
mov	edi, [esp+8+arg_4]

loc_4018FE:
mov	eax, [esi]
test	eax, eax
jz	short loc_401908
add	eax, edi
mov	[esi], eax

loc_401908:
mov	eax, [esi+4]
test	eax, eax
jz	short loc_401914
add	eax, edi
mov	[esi+4], eax

loc_401914:
mov	eax, [esi+4]
test	eax, eax
jz	short loc_401925
push	edi
push	eax
call	sub_401880
add	esp, 8

loc_401925:
mov	esi, [esi]
test	esi, esi
jnz	short loc_4018FE
pop	edi

loc_40192C:
pop	esi
retn
sub_4018F0 endp

align 10h



; int __cdecl sub_401930(char *, int)
sub_401930 proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	esi
push	edi
mov	edi, [esp+8+arg_0]
test	edi, edi
jz	short loc_401963
mov	esi, [esp+8+arg_4]
test	esi, esi
jz	short loc_401963

loc_401942:
mov	eax, [esi+4]
test	eax, eax
jz	short loc_40195D
mov	eax, [eax]
test	eax, eax
jz	short loc_40195D
push	eax		; char *
push	edi		; char *
call	__strcmpi
add	esp, 8
test	eax, eax
jz	short loc_401968

loc_40195D:
mov	esi, [esi]
test	esi, esi
jnz	short loc_401942

loc_401963:
pop	edi
xor	eax, eax
pop	esi
retn

loc_401968:
mov	eax, [esi+4]
pop	edi
pop	esi
retn
sub_401930 endp

align 10h



sub_401970 proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

mov	eax, [esp+arg_0]
push	ebx
push	ebp
mov	ebp, [esp+8+arg_4]
xor	ebx, ebx
mov	[esp+8+arg_4], eax
test	eax, eax
mov	byte ptr [ebp+0], 0
jz	loc_401A0E
push	esi
push	edi

loc_40198E:
mov	eax, [esp+10h+arg_4]
mov	eax, [eax+4]
test	eax, eax
jz	short loc_4019FE
cmp	ebx, [esp+10h+arg_8]
jge	short loc_4019FE
mov	edx, [eax]
or	ecx, 0FFFFFFFFh
mov	edi, edx
xor	eax, eax
repne scasb
not	ecx
dec	ecx
mov	edi, edx
lea	ebx, [ebx+ecx+1]
or	ecx, 0FFFFFFFFh
repne scasb
not	ecx
sub	edi, ecx
mov	esi, edi
mov	edx, ecx
mov	edi, ebp
or	ecx, 0FFFFFFFFh
repne scasb
mov	ecx, edx
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	edi, offset asc_40D038 ; ";"
or	ecx, 0FFFFFFFFh
repne scasb
not	ecx
sub	edi, ecx
mov	esi, edi
mov	edx, ecx
mov	edi, ebp
or	ecx, 0FFFFFFFFh
repne scasb
mov	ecx, edx
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb

loc_4019FE:
mov	eax, [esp+10h+arg_4]
mov	eax, [eax]
test	eax, eax
mov	[esp+10h+arg_4], eax
jnz	short loc_40198E
pop	edi
pop	esi

loc_401A0E:
pop	ebp
pop	ebx
retn
sub_401970 endp

align 10h



sub_401A20 proc	near

var_620= byte ptr -620h
var_310= byte ptr -310h
arg_0= dword ptr  4
arg_4= dword ptr  8

sub	esp, 620h
mov	ecx, 0C3h
xor	eax, eax
push	edi
lea	edi, [esp+624h+var_310]
rep stosd
stosw
mov	ecx, 0C3h
xor	eax, eax
lea	edi, [esp+624h+var_620]
push	30Ch
rep stosd
mov	ecx, [esp+628h+arg_0]
stosw
lea	eax, [esp+628h+var_310]
push	eax
push	ecx
call	sub_401970
mov	eax, [esp+630h+arg_4]
lea	edx, [esp+630h+var_620]
push	30Ch
push	edx
push	eax
call	sub_401970
lea	ecx, [esp+63Ch+var_620]
lea	edx, [esp+63Ch+var_310]
push	ecx		; char *
push	edx		; char *
call	__strcmpi
add	esp, 20h
neg	eax
sbb	eax, eax
pop	edi
inc	eax
add	esp, 620h
retn
sub_401A20 endp

align 10h



; int __cdecl sub_401AA0(HWND hDlg)
sub_401AA0 proc	near

var_4= dword ptr -4
hDlg= dword ptr	 4

push	ecx
mov	eax, hHeap
push	ebx
push	ebp
push	esi
push	edi
push	800h		; dwBytes
push	9		; dwFlags
push	eax		; hHeap
call	ds:HeapAlloc
mov	ecx, lpFileName
mov	esi, eax
push	ecx		; lpFileName
push	800h		; nSize
push	esi		; lpszReturnBuffer
mov	[esp+20h+var_4], esi
call	ds:GetPrivateProfileSectionNamesA
cmp	eax, 1
jbe	loc_401B7E
mov	al, [esi]
mov	ebx, [esp+14h+hDlg]
mov	ebp, ds:SendDlgItemMessageA
test	al, al
jz	short loc_401B2A

loc_401AEA:
mov	edx, lpAppName
push	edx		; char *
push	esi		; char *
call	__strcmpi
add	esp, 8
test	eax, eax
jz	short loc_401B0E
push	esi		; lParam
push	0		; wParam
push	143h		; Msg
push	409h		; nIDDlgItem
push	ebx		; hDlg
call	ebp ; SendDlgItemMessageA

loc_401B0E:
mov	edi, esi
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
not	ecx
dec	ecx
mov	al, [esi+ecx+1]
lea	esi, [esi+ecx+1]
test	al, al
jnz	short loc_401AEA
mov	esi, [esp+14h+var_4]

loc_401B2A:
mov	eax, lpFileName
mov	ecx, lpReturnedString
mov	edx, lpDefault
push	eax		; lpFileName
mov	eax, lpAppName
push	10h		; nSize
push	ecx		; lpReturnedString
push	edx		; lpDefault
push	eax		; lpKeyName
push	eax		; lpAppName
call	ds:GetPrivateProfileStringA
mov	eax, lpReturnedString
push	eax		; lParam
push	0		; wParam
push	158h		; Msg
push	409h		; nIDDlgItem
push	ebx		; hDlg
call	ebp ; SendDlgItemMessageA
cmp	eax, 0FFFFFFFFh
jz	short loc_401B7E
push	0		; lParam
push	eax		; wParam
push	14Eh		; Msg
push	409h		; nIDDlgItem
push	ebx		; hDlg
mov	edi, 1
call	ebp ; SendDlgItemMessageA
jmp	short loc_401B80

loc_401B7E:
xor	edi, edi

loc_401B80:
mov	ecx, hHeap
push	esi		; lpMem
push	1		; dwFlags
push	ecx		; hHeap
call	ds:HeapFree
mov	eax, edi
pop	edi
pop	esi
pop	ebp
pop	ebx
pop	ecx
retn
sub_401AA0 endp

align 10h
; [0000014B BYTES: COLLAPSED FUNCTION __cfltcvt_init. PRESS KEYPAD CTRL-"+" TO EXPAND]
align 10h



sub_401CF0 proc	near
mov	eax, dword_4106D8
mov	ecx, [eax]
add	eax, 4
mov	dword_41046C, ecx
mov	edx, [eax]
add	eax, 4
mov	dword_41042C, edx
mov	ecx, [eax]
add	eax, 4
mov	dword_410450, ecx
mov	edx, [eax]
add	eax, 4
mov	dword_4104A4, edx
mov	ecx, [eax]
add	eax, 4
mov	dword_410490, ecx
mov	edx, [eax]
add	eax, 4
mov	dword_410454, edx
mov	ecx, [eax]
add	eax, 4
mov	dword_410484, ecx
mov	edx, [eax]
add	eax, 4
mov	dword_410458, edx
mov	ecx, [eax]
add	eax, 4
mov	dword_41048C, ecx
mov	edx, [eax]
add	eax, 4
mov	dword_410434, edx
mov	ecx, [eax]
add	eax, 4
mov	dword_410498, ecx
mov	edx, [eax]
add	eax, 4
mov	dword_410424, edx
mov	ecx, [eax]
add	eax, 4
mov	dword_410438, ecx
mov	edx, [eax]
add	eax, 4
mov	dword_410494, edx
mov	ecx, [eax]
add	eax, 4
mov	dword_410478, ecx
mov	edx, [eax]
add	eax, 4
mov	dword_410448, edx
mov	ecx, [eax]
add	eax, 4
mov	dword_410460, ecx
mov	edx, [eax]
add	eax, 4
mov	dword_410444, edx
mov	ecx, [eax]
add	eax, 4
mov	dword_41044C, ecx
mov	edx, [eax]
add	eax, 4
mov	dword_410464, edx
mov	ecx, [eax]
add	eax, 4
mov	dword_410440, ecx
mov	edx, [eax]
add	eax, 4
mov	dword_410468, edx
mov	ecx, [eax]
add	eax, 4
mov	lpCaption, ecx
mov	edx, [eax]
add	eax, 4
mov	dword_410474, edx
mov	ecx, [eax]
add	eax, 4
mov	lpText,	ecx
mov	edx, [eax]
add	eax, 4
mov	dword_41043C, edx
mov	ecx, [eax]
mov	dword_410480, ecx
mov	edx, [eax+38h]
add	eax, 38h
add	eax, 4
mov	lpNewItem, edx
mov	ecx, [eax]
add	eax, 4
mov	dword_410428, ecx
mov	edx, [eax]
add	eax, 4
mov	dword_410430, edx
mov	ecx, [eax]
add	eax, 4
mov	dword_410470, ecx
mov	edx, [eax]
mov	dword_4104A0, edx
mov	eax, [eax+4]
mov	dword_41049C, eax
retn
sub_401CF0 endp

align 10h



; int __cdecl sub_401E60(HWND hDlg)
sub_401E60 proc	near

var_8= byte ptr	-8
hDlg= dword ptr	 4

sub	esp, 8
push	ebp
mov	ebp, [esp+0Ch+hDlg]
push	esi
mov	esi, ds:SendDlgItemMessageA
push	0		; lParam
push	0		; wParam
push	147h		; Msg
push	409h		; nIDDlgItem
push	ebp		; hDlg
call	esi ; SendDlgItemMessageA
cmp	eax, 0FFFFFFFFh
jz	loc_401FBB
mov	ecx, lpReturnedString
push	ebx
push	edi
push	ecx		; lParam
push	eax		; wParam
push	148h		; Msg
push	409h		; nIDDlgItem
push	ebp		; hDlg
call	esi ; SendDlgItemMessageA
mov	edx, lpFileName
mov	eax, lpReturnedString
push	edx		; lpFileName
push	eax		; lpString
mov	eax, lpAppName
push	eax		; lpKeyName
push	eax		; lpAppName
call	ds:WritePrivateProfileStringA
mov	edi, dword_4106DC
mov	ecx, 1000h
xor	eax, eax
rep stosd
mov	ecx, lpFileName
mov	edx, dword_4106DC
mov	eax, lpReturnedString
push	ecx		; lpFileName
push	4000h		; nSize
push	edx		; lpReturnedString
push	eax		; lpAppName
call	ds:GetPrivateProfileSectionA
mov	ebx, dword_4106D8
mov	edi, 1
mov	esi, offset aValues ; "Values:"

loc_401EF8:		; "="
push	offset asc_40D470
push	edi
lea	ecx, [esp+20h+var_8]
push	offset aDS	; "%d%s"
push	ecx		; char *
call	_sprintf
mov	eax, dword_4106DC
lea	edx, [esp+28h+var_8]
push	4000h
push	edx
push	eax
call	sub_402070
add	esp, 1Ch
test	eax, eax
jz	short loc_401F2D
mov	[ebx], eax
jmp	short loc_401F32

loc_401F2D:
lea	ecx, [esi-16h]
mov	[ebx], ecx

loc_401F32:		; "&2nd	shot"
cmp	esi, offset a2ndShot
jb	short loc_401F5B
cmp	esi, offset aShotAndSaVe___ ; "Shot and	Sa&ve..."
jnb	short loc_401F5B
cmp	esi, offset aCompareLogsSav ; "Compare logs save as:"
jz	short loc_401F5B
mov	edx, [ebx]
lea	eax, [edi+3CFh]
push	edx		; lpString
push	eax		; nIDDlgItem
push	ebp		; hDlg
call	ds:SetDlgItemTextA

loc_401F5B:
add	esi, 16h
inc	edi
add	ebx, 4
cmp	esi, offset aAnslator ;	"anslator"
jb	short loc_401EF8
mov	ecx, off_40D040
mov	edx, dword_4106DC
push	4000h
push	ecx
push	edx
call	sub_402070
add	esp, 0Ch
test	eax, eax
pop	edi
pop	ebx
jz	short loc_401FA1
inc	eax
mov	dword_4106E8, eax
call	sub_401CF0
pop	esi
mov	eax, 1
pop	ebp
add	esp, 8
retn

loc_401FA1:
mov	eax, off_40D048
mov	dword_4106E8, eax
call	sub_401CF0
pop	esi
mov	eax, 1
pop	ebp
add	esp, 8
retn

loc_401FBB:
pop	esi
xor	eax, eax
pop	ebp
add	esp, 8
retn
sub_401E60 endp

align 10h



; int __cdecl sub_401FD0(LPCSTR	lpText)
sub_401FD0 proc	near

lpText=	dword ptr  4

mov	eax, lpCaption
mov	ecx, [esp+lpText]
mov	edx, hDlg
push	10h		; uType
push	eax		; lpCaption
push	ecx		; lpText
push	edx		; hWnd
call	ds:MessageBoxA
retn
sub_401FD0 endp

align 10h



sub_401FF0 proc	near

var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= word ptr	-4
arg_0= dword ptr  4

sub	esp, 0Ch
mov	eax, dword_40D474
mov	ecx, dword_40D478
push	ebx
mov	ebx, [esp+10h+arg_0]
push	ebp
push	edi
mov	[esp+18h+var_C], eax
mov	[esp+18h+var_8], ecx
mov	edi, ebx
or	ecx, 0FFFFFFFFh
xor	eax, eax
xor	ebp, ebp
mov	dx, word_40D47C
repne scasb
not	ecx
mov	[esp+18h+var_4], dx
dec	ecx
mov	edx, eax
jz	short loc_40205F
push	esi

loc_40202C:
xor	esi, esi

loc_40202E:
mov	al, [edx+ebx]
cmp	al, byte ptr [esp+esi+1Ch+var_C]
jnz	short loc_40203D
mov	byte ptr [edx+ebx], 2Dh
jmp	short loc_40204A

loc_40203D:
cmp	al, 20h
jz	short loc_40204A
cmp	al, 9
jz	short loc_40204A
mov	ebp, 1

loc_40204A:
inc	esi
cmp	esi, 9
jb	short loc_40202E
inc	edx
cmp	edx, ecx
jb	short loc_40202C
pop	esi
mov	eax, ebp
pop	edi
pop	ebp
pop	ebx
add	esp, 0Ch
retn

loc_40205F:
mov	eax, ebp
pop	edi
pop	ebp
pop	ebx
add	esp, 0Ch
retn
sub_401FF0 endp

align 10h



sub_402070 proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

push	ebx
push	ebp
mov	ebp, [esp+8+arg_4]
push	esi
push	edi
mov	edi, ebp
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	eax, [esp+10h+arg_8]
not	ecx
dec	ecx
cmp	eax, ecx
jbe	short loc_4020BB
cmp	ecx, 1
jb	short loc_4020BB
mov	edx, eax
xor	edi, edi
sub	edx, ecx
jz	short loc_4020BB

loc_402099:
xor	eax, eax
test	ecx, ecx
jbe	short loc_4020B2
mov	esi, [esp+10h+arg_0]
add	esi, edi

loc_4020A5:
mov	bl, [eax+ebp]
cmp	bl, [esi+eax]
jnz	short loc_4020B2
inc	eax
cmp	eax, ecx
jb	short loc_4020A5

loc_4020B2:
cmp	eax, ecx
jz	short loc_4020C2
inc	edi
cmp	edi, edx
jb	short loc_402099

loc_4020BB:
pop	edi
pop	esi
pop	ebp
xor	eax, eax
pop	ebx
retn

loc_4020C2:
lea	eax, [edi+ecx]
mov	ecx, [esp+10h+arg_0]
pop	edi
pop	esi
pop	ebp
add	eax, ecx
pop	ebx
retn
sub_402070 endp




; int __cdecl sub_4020D0(LPCVOID lpBuffer, int,	int)
sub_4020D0 proc	near

Buffer=	byte ptr -8
lpBuffer= dword	ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

mov	eax, [esp+arg_4]
sub	esp, 8
lea	ecx, [esp+8+Buffer]
push	ebx
push	esi
push	edi
push	eax
push	offset aD	; "%d"
push	ecx		; char *
call	_sprintf
mov	ebx, [esp+20h+arg_8]
add	esp, 0Ch
cmp	ebx, 1
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
jnz	short loc_402140
mov	edx, dword_410584
mov	esi, ds:WriteFile
push	4		; nNumberOfBytesToWrite
push	offset aBr	; "<BR>"
push	edx		; hFile
call	esi ; WriteFile
mov	eax, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	1Ch		; nNumberOfBytesToWrite
push	offset aTableBorder0Wi ; "<TABLE BORDER=0 WIDTH=480>\r\n"
push	eax		; hFile
call	esi ; WriteFile
mov	ecx, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	37h
push	offset aTrTdBgcolor669 ; "<TR><TD BGCOLOR=669999 ALIGN=LEFT><FONT"...
push	ecx
jmp	short loc_402154

loc_402140:
mov	edx, dword_410584
mov	esi, ds:WriteFile
push	26h		; nNumberOfBytesToWrite
push	offset asc_40D484 ; "\r\n----------------------------------\"...
push	edx		; hFile

loc_402154:
call	esi ; WriteFile
mov	edx, [esp+14h+lpBuffer]
or	ecx, 0FFFFFFFFh
mov	edi, edx
xor	eax, eax
repne scasb
mov	eax, dword_410584
push	0		; lpOverlapped
not	ecx
dec	ecx
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	ecx		; nNumberOfBytesToWrite
push	edx		; lpBuffer
push	eax		; hFile
call	esi ; WriteFile
lea	edi, [esp+14h+Buffer]
or	ecx, 0FFFFFFFFh
xor	eax, eax
mov	edx, dword_410584
repne scasb
not	ecx
push	0		; lpOverlapped
dec	ecx
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	ecx		; nNumberOfBytesToWrite
lea	ecx, [esp+20h+Buffer]
push	ecx		; lpBuffer
push	edx		; hFile
call	esi ; WriteFile
cmp	ebx, 1
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
jnz	short loc_4021D4
mov	eax, dword_410584
push	17h		; nNumberOfBytesToWrite
push	offset aBFontTdTr ; "</B></FONT></TD></TR>\r\n"
push	eax		; hFile
call	esi ; WriteFile
mov	ecx, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	0Ah		; nNumberOfBytesToWrite
push	offset aTable	; "</TABLE>\r\n"
push	ecx		; hFile
call	esi ; WriteFile
pop	edi
pop	esi
pop	ebx
add	esp, 8
retn

loc_4021D4:
mov	edx, dword_410584
push	26h		; nNumberOfBytesToWrite
push	offset asc_40D484 ; "\r\n----------------------------------\"...
push	edx		; hFile
call	esi ; WriteFile
pop	edi
pop	esi
pop	ebx
add	esp, 8
retn
sub_4020D0 endp

align 10h



sub_4021F0 proc	near

var_4= dword ptr -4
arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

push	ecx
push	ebp
mov	ebp, ds:WriteFile
push	esi
mov	esi, [esp+0Ch+arg_4]
test	esi, esi
jz	short loc_40222E
mov	eax, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	1Ch		; nNumberOfBytesToWrite
push	offset aTableBorder0Wi ; "<TABLE BORDER=0 WIDTH=480>\r\n"
push	eax		; hFile
call	ebp ; WriteFile
mov	ecx, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	21h		; nNumberOfBytesToWrite
push	offset aTrTdNowrapFont ; "<TR><TD NOWRAP><FONT COLOR=BLACK>"
push	ecx		; hFile
call	ebp ; WriteFile

loc_40222E:
mov	eax, [esp+0Ch+arg_0]
mov	[esp+0Ch+var_4], 0
test	eax, eax
mov	[esp+0Ch+arg_0], eax
jz	loc_402345
push	ebx
push	edi

loc_402248:
mov	edx, [esp+14h+arg_0]
or	ecx, 0FFFFFFFFh
xor	eax, eax
mov	edx, [edx]
mov	edi, edx
mov	ebx, edx
repne scasb
not	ecx
dec	ecx
test	esi, esi
mov	edi, ecx
jz	short loc_40229E
mov	eax, [esp+14h+arg_8]
test	eax, eax
jz	short loc_402287
test	byte ptr [esp+14h+var_4], 1
jnz	short loc_402287
mov	eax, dword_410584
push	0
push	offset NumberOfBytesWritten
push	0Eh
push	offset aSpanClassO ; "<span class=o>"
push	eax
jmp	short loc_40229C

loc_402287:
mov	ecx, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	0Eh		; nNumberOfBytesToWrite
push	offset aSpanClassN ; "<span class=n>"
push	ecx		; hFile

loc_40229C:
call	ebp ; WriteFile

loc_40229E:
test	edi, edi
jbe	short loc_4022ED

loc_4022A2:
cmp	edi, 3E8h
mov	esi, edi
jb	short loc_4022B1
mov	esi, 3E8h

loc_4022B1:
mov	edx, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	esi		; nNumberOfBytesToWrite
push	ebx		; lpBuffer
push	edx		; hFile
call	ebp ; WriteFile
mov	eax, [esp+14h+arg_4]
add	ebx, esi
sub	edi, esi
test	eax, eax
jz	short loc_4022E5
mov	eax, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	4		; nNumberOfBytesToWrite
push	offset aBr	; "<BR>"
push	eax		; hFile
call	ebp ; WriteFile

loc_4022E5:
test	edi, edi
ja	short loc_4022A2
mov	esi, [esp+14h+arg_4]

loc_4022ED:
test	esi, esi
jz	short loc_402310
mov	eax, [esp+14h+arg_8]
test	eax, eax
jz	short loc_402327
mov	ecx, dword_410584
push	0
push	offset NumberOfBytesWritten
push	9
push	offset aSpan	; "</span>\r\n"
push	ecx
jmp	short loc_402325

loc_402310:
mov	edx, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	2		; nNumberOfBytesToWrite
push	offset unk_40D480 ; lpBuffer
push	edx		; hFile

loc_402325:
call	ebp ; WriteFile

loc_402327:
mov	eax, [esp+14h+arg_0]
mov	edx, [esp+14h+var_4]
inc	edx
mov	eax, [eax+4]
mov	[esp+14h+var_4], edx
test	eax, eax
mov	[esp+14h+arg_0], eax
jnz	loc_402248
pop	edi
pop	ebx

loc_402345:
test	esi, esi
jz	short loc_402377
mov	ecx, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	13h		; nNumberOfBytesToWrite
push	offset aFontTdTr ; "</FONT></TD></TR>\r\n"
push	ecx		; hFile
call	ebp ; WriteFile
mov	edx, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	0Ah		; nNumberOfBytesToWrite
push	offset aTable	; "</TABLE>\r\n"
push	edx		; hFile
call	ebp ; WriteFile

loc_402377:
pop	esi
pop	ebp
pop	ecx
retn
sub_4021F0 endp

align 10h



; int __cdecl sub_402380(LPCVOID lpBuffer, int,	int)
sub_402380 proc	near

lpBuffer= dword	ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

push	ebx
mov	ebx, [esp+4+arg_8]
push	esi
mov	esi, ds:WriteFile
test	ebx, ebx
push	edi
jz	short loc_4023BE
mov	eax, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	1Ch		; nNumberOfBytesToWrite
push	offset aTableBorder0Wi ; "<TABLE BORDER=0 WIDTH=480>\r\n"
push	eax		; hFile
call	esi ; WriteFile
mov	ecx, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	37h		; nNumberOfBytesToWrite
push	offset aTrTdBgcolor669 ; "<TR><TD BGCOLOR=669999 ALIGN=LEFT><FONT"...
push	ecx		; hFile
call	esi ; WriteFile

loc_4023BE:
mov	edx, [esp+0Ch+lpBuffer]
or	ecx, 0FFFFFFFFh
mov	edi, edx
xor	eax, eax
repne scasb
not	ecx
push	0		; lpOverlapped
dec	ecx
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	ecx		; nNumberOfBytesToWrite
push	edx		; lpBuffer
mov	edx, dword_410584
push	edx		; hFile
call	esi ; WriteFile
mov	edx, [esp+0Ch+arg_4]
or	ecx, 0FFFFFFFFh
mov	edi, edx
xor	eax, eax
repne scasb
mov	eax, dword_410584
push	0		; lpOverlapped
not	ecx
dec	ecx
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	ecx		; nNumberOfBytesToWrite
push	edx		; lpBuffer
push	eax		; hFile
call	esi ; WriteFile
test	ebx, ebx
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
jz	short loc_402437
mov	ecx, dword_410584
push	17h		; nNumberOfBytesToWrite
push	offset aBFontTdTr ; "</B></FONT></TD></TR>\r\n"
push	ecx		; hFile
call	esi ; WriteFile
mov	edx, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	0Ah		; nNumberOfBytesToWrite
push	offset aTable	; "</TABLE>\r\n"
push	edx		; hFile
call	esi ; WriteFile
pop	edi
pop	esi
pop	ebx
retn

loc_402437:
mov	eax, dword_410584
push	2		; nNumberOfBytesToWrite
push	offset unk_40D480 ; lpBuffer
push	eax		; hFile
call	esi ; WriteFile
pop	edi
pop	esi
pop	ebx
retn
sub_402380 endp

align 10h



sub_402450 proc	near
mov	eax, dword_410584
push	esi
mov	esi, ds:WriteFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	8		; nNumberOfBytesToWrite
push	offset aHtml	; "<HTML>\r\n"
push	eax		; hFile
call	esi ; WriteFile
mov	ecx, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	8		; nNumberOfBytesToWrite
push	offset aHead	; "<HEAD>\r\n"
push	ecx		; hFile
call	esi ; WriteFile
mov	edx, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	97h		; nNumberOfBytesToWrite
push	offset aStyleTypeTextC ; "<STYLE TYPE=\"text/css\">td{font-family"...
push	edx		; hFile
call	esi ; WriteFile
mov	eax, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	9		; nNumberOfBytesToWrite
push	offset aHead_0	; "</HEAD>\r\n"
push	eax		; hFile
call	esi ; WriteFile
mov	ecx, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	2Fh		; nNumberOfBytesToWrite
push	offset aBodyBgcolorFff ; "<BODY	BGCOLOR=FFFFFF TEXT=000000 LINK=C"...
push	ecx		; hFile
call	esi ; WriteFile
pop	esi
retn
sub_402450 endp

align 10h



sub_4024D0 proc	near
mov	eax, dword_410584
push	esi
mov	esi, ds:WriteFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	9		; nNumberOfBytesToWrite
push	offset aBody	; "</BODY>\r\n"
push	eax		; hFile
call	esi ; WriteFile
mov	ecx, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	7		; nNumberOfBytesToWrite
push	offset aHtml_0	; "</HTML>"
push	ecx		; hFile
call	esi ; WriteFile
pop	esi
retn
sub_4024D0 endp

align 10h



sub_402510 proc	near
mov	eax, dword_410584
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	4		; nNumberOfBytesToWrite
push	offset aBr	; "<BR>"
push	eax		; hFile
call	ds:WriteFile
retn
sub_402510 endp

align 10h



sub_402530 proc	near

arg_0= dword ptr  4

push	ebx
mov	ebx, [esp+4+arg_0]
push	ebp
push	esi
xor	esi, esi
push	edi
test	ebx, ebx
mov	edx, ebx
jz	short loc_40255B

loc_402540:
mov	edi, [edx]
or	ecx, 0FFFFFFFFh
xor	eax, eax
mov	edx, [edx+10h]
repne scasb
not	ecx
dec	ecx
test	edx, edx
lea	esi, [esi+ecx+1]
jnz	short loc_402540
test	esi, esi
jnz	short loc_402560

loc_40255B:
mov	esi, 1

loc_402560:
mov	eax, hHeap
push	esi		; dwBytes
push	1		; dwFlags
push	eax		; hHeap
call	ds:HeapAlloc
mov	ebp, eax
test	ebx, ebx
lea	edx, [esi+ebp-1]
mov	byte ptr [edx],	0
jz	short loc_4025AB

loc_40257C:
mov	esi, [ebx]
or	ecx, 0FFFFFFFFh
mov	edi, esi
xor	eax, eax
repne scasb
not	ecx
dec	ecx
sub	edx, ecx
mov	eax, ecx
mov	edi, edx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
cmp	edx, ebp
rep movsb
jbe	short loc_4025A4
dec	edx
mov	byte ptr [edx],	5Ch

loc_4025A4:
mov	ebx, [ebx+10h]
test	ebx, ebx
jnz	short loc_40257C

loc_4025AB:
pop	edi
mov	eax, ebp
pop	esi
pop	ebp
pop	ebx
retn
sub_402530 endp

align 10h



sub_4025C0 proc	near

arg_0= dword ptr  4

push	ebx
mov	ebx, [esp+4+arg_0]
push	ebp
push	esi
push	edi
mov	edi, [ebx+8]
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	edx, [ebx+14h]
not	ecx
dec	ecx
mov	edi, ecx
test	edx, edx
mov	[esp+10h+arg_0], edi
lea	esi, [edi+1]
jz	short loc_402600

loc_4025E5:
mov	edi, [edx]
or	ecx, 0FFFFFFFFh
xor	eax, eax
mov	edx, [edx+10h]
repne scasb
not	ecx
dec	ecx
test	edx, edx
lea	esi, [esi+ecx+1]
jnz	short loc_4025E5
mov	edi, [esp+10h+arg_0]

loc_402600:
mov	eax, hHeap
push	esi		; dwBytes
push	1		; dwFlags
push	eax		; hHeap
call	ds:HeapAlloc
mov	ebp, eax
xor	eax, eax
mov	ecx, ebp
sub	ecx, edi
mov	edi, [ebx+8]
lea	edx, [ecx+esi-1]
or	ecx, 0FFFFFFFFh
repne scasb
not	ecx
sub	edi, ecx
mov	eax, ecx
mov	esi, edi
mov	edi, edx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
dec	edx
rep movsb
mov	byte ptr [edx],	5Ch
mov	ebx, [ebx+14h]
test	ebx, ebx
jz	short loc_402673

loc_402644:
mov	esi, [ebx]
or	ecx, 0FFFFFFFFh
mov	edi, esi
xor	eax, eax
repne scasb
not	ecx
dec	ecx
sub	edx, ecx
mov	eax, ecx
mov	edi, edx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
cmp	edx, ebp
rep movsb
jbe	short loc_40266C
dec	edx
mov	byte ptr [edx],	5Ch

loc_40266C:
mov	ebx, [ebx+10h]
test	ebx, ebx
jnz	short loc_402644

loc_402673:
pop	edi
mov	eax, ebp
pop	esi
pop	ebp
pop	ebx
retn
sub_4025C0 endp

align 10h



sub_402680 proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8

mov	eax, [esp+arg_4]
push	ebx
push	ebp
mov	ebp, [esp+8+arg_0]
push	esi
push	edi
mov	edi, [ebp+4]
dec	eax
jz	loc_402795
sub	eax, 3
jz	loc_402762
sub	eax, 3
jz	short loc_4026F4
mov	ecx, hHeap
lea	eax, [edi+edi*2+3]
push	eax		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
call	ds:HeapAlloc
xor	esi, esi
mov	[esp+10h+arg_0], eax
test	edi, edi
mov	byte ptr [eax],	3Ah
jbe	loc_402809
lea	ebx, [eax+1]

loc_4026CC:
mov	edx, [ebp+0Ch]
xor	eax, eax
mov	al, [edx+esi]
push	eax
push	offset a02x	; " %02X"
push	ebx		; char *
call	_sprintf
add	esp, 0Ch
inc	esi
add	ebx, 3
cmp	esi, edi
jb	short loc_4026CC
mov	eax, [esp+10h+arg_0]
pop	edi
pop	esi
pop	ebp
pop	ebx
retn

loc_4026F4:
mov	edx, hHeap
lea	ecx, [edi+5]
push	ecx		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
call	ds:HeapAlloc
xor	ecx, ecx
mov	edx, eax
test	edi, edi
jbe	short loc_402728

loc_40270F:
mov	eax, [ebp+0Ch]
add	eax, ecx
cmp	byte ptr [eax],	0
jnz	short loc_402723
mov	bl, [eax+1]
test	bl, bl
jz	short loc_402728
mov	byte ptr [eax],	20h

loc_402723:
inc	ecx
cmp	ecx, edi
jb	short loc_40270F

loc_402728:
mov	ecx, dword_40D6FC
xor	eax, eax
mov	[edx], ecx
mov	edi, [ebp+0Ch]
or	ecx, 0FFFFFFFFh
repne scasb
not	ecx
sub	edi, ecx
mov	esi, edi
mov	ebx, ecx
mov	edi, edx
or	ecx, 0FFFFFFFFh
repne scasb
mov	ecx, ebx
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, ebx
and	ecx, 3
rep movsb
mov	edi, offset asc_40D6F8 ; "'"
jmp	loc_4027E2

loc_402762:
mov	edx, hHeap
push	0Dh		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
call	ds:HeapAlloc
mov	esi, eax
mov	eax, [ebp+0Ch]
mov	ecx, [eax]
push	ecx
push	offset a0x	; ": 0x"
push	offset aS08x	; "%s%08X"
push	esi		; char *
call	_sprintf
add	esp, 10h
mov	eax, esi
pop	edi
pop	esi
pop	ebp
pop	ebx
retn

loc_402795:
mov	edx, hHeap
add	edi, 5
push	edi		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
call	ds:HeapAlloc
mov	edx, eax
mov	eax, dword_40D6E4
mov	[edx], eax
mov	edi, [ebp+0Ch]
test	edi, edi
jz	short loc_4027DD
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
not	ecx
sub	edi, ecx
mov	esi, edi
mov	ebx, ecx
mov	edi, edx
or	ecx, 0FFFFFFFFh
repne scasb
mov	ecx, ebx
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, ebx
and	ecx, 3
rep movsb

loc_4027DD:		; "\""
mov	edi, offset asc_40D6E0

loc_4027E2:
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
not	ecx
sub	edi, ecx
mov	esi, edi
mov	ebx, ecx
mov	edi, edx
or	ecx, 0FFFFFFFFh
repne scasb
mov	ecx, ebx
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, ebx
mov	eax, edx
and	ecx, 3
rep movsb

loc_402809:
pop	edi
pop	esi
pop	ebp
pop	ebx
retn
sub_402680 endp

align 10h



sub_402810 proc	near

arg_0= dword ptr  4

mov	edx, [esp+arg_0]
push	esi
push	edi
mov	eax, [edx]
mov	esi, [edx+4]
dec	eax
cmp	eax, 6		; switch 7 cases
ja	short loc_402888 ; jumptable 00402821 default case
jmp	ds:off_402898[eax*4] ; switch jump

loc_402828:		; jumptable 00402821 cases 0,1
mov	edi, [edx+0Ch]
test	edi, edi
jz	short loc_40283C
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
not	ecx
cmp	esi, ecx
jnz	short loc_402888 ; jumptable 00402821 default case

loc_40283C:
push	1
push	edx
call	sub_402680
add	esp, 8
pop	edi
pop	esi
retn

loc_40284A:		; jumptable 00402821 case 6
mov	ecx, [edx+0Ch]
cmp	byte ptr [ecx],	0
jz	short loc_402888 ; jumptable 00402821 default case
xor	eax, eax
cmp	[ecx], ax
jz	short loc_402861

loc_402859:
inc	eax
cmp	word ptr [ecx+eax], 0
jnz	short loc_402859

loc_402861:
add	eax, 2
cmp	esi, eax
jnz	short loc_402888 ; jumptable 00402821 default case
push	7
push	edx
call	sub_402680
add	esp, 8
pop	edi
pop	esi
retn

loc_402876:		; jumptable 00402821 cases 3,4
cmp	esi, 4
jnz	short loc_402888 ; jumptable 00402821 default case
push	esi
push	edx
call	sub_402680
add	esp, 8
pop	edi
pop	esi
retn

loc_402888:		; jumptable 00402821 default case
push	3
push	edx
call	sub_402680
add	esp, 8
pop	edi
pop	esi
retn
sub_402810 endp

align 4
off_402898 dd offset loc_402828	; jump table for switch	statement
dd offset loc_402828
dd offset loc_402888
dd offset loc_402876
dd offset loc_402876
dd offset loc_402888
dd offset loc_40284A
align 10h



sub_4028C0 proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

mov	eax, hHeap
push	8		; dwBytes
push	9		; dwFlags
push	eax		; hHeap
call	ds:HeapAlloc
mov	ecx, [esp+arg_8]
mov	edx, [esp+arg_0]
mov	[eax], ecx
lea	ecx, [edx-1]
mov	edx, [esp+arg_4]
cmp	ecx, 0Ah	; switch 11 cases
ja	loc_402A6F	; jumptable 004028EA default case
jmp	ds:off_402A74[ecx*4] ; switch jump

loc_4028F1:		; jumptable 004028EA case 0
cmp	dword ptr [edx], 0
jnz	short loc_402903
mov	dword_4106A0, eax
mov	dword_4105B4, eax
inc	dword ptr [edx]
retn

loc_402903:
mov	ecx, dword_4105B4
mov	[ecx+4], eax
mov	dword_4105B4, eax
inc	dword ptr [edx]
retn

loc_402914:		; jumptable 004028EA case 1
cmp	dword ptr [edx], 0
jnz	short loc_402926
mov	dword_4105B8, eax
mov	dword_410638, eax
inc	dword ptr [edx]
retn

loc_402926:
mov	ecx, dword_410638
mov	[ecx+4], eax
mov	dword_410638, eax
inc	dword ptr [edx]
retn

loc_402937:		; jumptable 004028EA case 2
cmp	dword ptr [edx], 0
jnz	short loc_402949
mov	dword_41050C, eax
mov	dword_410688, eax
inc	dword ptr [edx]
retn

loc_402949:
mov	ecx, dword_410688
mov	[ecx+4], eax
mov	dword_410688, eax
inc	dword ptr [edx]
retn

loc_40295A:		; jumptable 004028EA case 3
cmp	dword ptr [edx], 0
jnz	short loc_40296C
mov	dword_410590, eax
mov	dword_410694, eax
inc	dword ptr [edx]
retn

loc_40296C:
mov	ecx, dword_410694
mov	[ecx+4], eax
mov	dword_410694, eax
inc	dword ptr [edx]
retn

loc_40297D:		; jumptable 004028EA case 4
cmp	dword ptr [edx], 0
jnz	short loc_40298F
mov	dword_410560, eax
mov	dword_410634, eax
inc	dword ptr [edx]
retn

loc_40298F:
mov	ecx, dword_410634
mov	[ecx+4], eax
mov	dword_410634, eax
inc	dword ptr [edx]
retn

loc_4029A0:		; jumptable 004028EA case 5
cmp	dword ptr [edx], 0
jnz	short loc_4029B2
mov	dword_410570, eax
mov	dword_4104DC, eax
inc	dword ptr [edx]
retn

loc_4029B2:
mov	ecx, dword_4104DC
mov	[ecx+4], eax
mov	dword_4104DC, eax
inc	dword ptr [edx]
retn

loc_4029C3:		; jumptable 004028EA case 6
cmp	dword ptr [edx], 0
jnz	short loc_4029D5
mov	dword_410500, eax
mov	dword_41057C, eax
inc	dword ptr [edx]
retn

loc_4029D5:
mov	ecx, dword_41057C
mov	[ecx+4], eax
mov	dword_41057C, eax
inc	dword ptr [edx]
retn

loc_4029E6:		; jumptable 004028EA case 7
cmp	dword ptr [edx], 0
jnz	short loc_4029F8
mov	dword_4104BC, eax
mov	dword_4104EC, eax
inc	dword ptr [edx]
retn

loc_4029F8:
mov	ecx, dword_4104EC
mov	[ecx+4], eax
mov	dword_4104EC, eax
inc	dword ptr [edx]
retn

loc_402A09:		; jumptable 004028EA case 8
cmp	dword ptr [edx], 0
jnz	short loc_402A1B
mov	dword_410684, eax
mov	dword_41058C, eax
inc	dword ptr [edx]
retn

loc_402A1B:
mov	ecx, dword_41058C
mov	[ecx+4], eax
mov	dword_41058C, eax
inc	dword ptr [edx]
retn

loc_402A2C:		; jumptable 004028EA case 9
cmp	dword ptr [edx], 0
jnz	short loc_402A3E
mov	dword_41056C, eax
mov	dword_4105A8, eax
inc	dword ptr [edx]
retn

loc_402A3E:
mov	ecx, dword_4105A8
mov	[ecx+4], eax
mov	dword_4105A8, eax
inc	dword ptr [edx]
retn

loc_402A4F:		; jumptable 004028EA case 10
cmp	dword ptr [edx], 0
jnz	short loc_402A61
mov	dword_4104B8, eax
mov	dword_4104F4, eax
inc	dword ptr [edx]
retn

loc_402A61:
mov	ecx, dword_4104F4
mov	[ecx+4], eax
mov	dword_4104F4, eax

loc_402A6F:		; jumptable 004028EA default case
inc	dword ptr [edx]
retn
sub_4028C0 endp

align 4
off_402A74 dd offset loc_4028F1	; jump table for switch	statement
dd offset loc_402914
dd offset loc_402937
dd offset loc_40295A
dd offset loc_40297D
dd offset loc_4029A0
dd offset loc_4029C3
dd offset loc_4029E6
dd offset loc_402A09
dd offset loc_402A2C
dd offset loc_402A4F



sub_402AA0 proc	near

var_4= dword ptr -4
arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

push	ecx
push	esi
mov	esi, [esp+8+arg_0]
cmp	esi, 1
jz	loc_402BB3
cmp	esi, 2
jz	loc_402BB3
cmp	esi, 3
jz	short loc_402AE3
cmp	esi, 4
jz	short loc_402AE3
cmp	esi, 5
jz	short loc_402AE3
mov	eax, [esp+8+arg_8]
push	eax
call	sub_401000
mov	ecx, [esp+0Ch+arg_4]
push	eax
push	ecx
push	esi
call	sub_4028C0
add	esp, 10h
pop	esi
pop	ecx
retn

loc_402AE3:
mov	esi, [esp+8+arg_8]
push	ebx
push	ebp
push	edi
push	esi
call	sub_4025C0
push	esi
mov	ebx, eax
call	sub_402810
mov	ebp, eax
or	ecx, 0FFFFFFFFh
mov	edi, ebp
xor	eax, eax
add	esp, 8
repne scasb
not	ecx
dec	ecx
mov	edi, ebx
mov	edx, ecx
or	ecx, 0FFFFFFFFh
repne scasb
not	ecx
dec	ecx
lea	eax, [edx+ecx+2]
mov	ecx, hHeap
push	eax		; dwBytes
push	1		; dwFlags
push	ecx		; hHeap
call	ds:HeapAlloc
mov	edx, eax
mov	edi, ebx
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
not	ecx
sub	edi, ecx
mov	[esp+14h+var_4], edx
mov	eax, ecx
mov	esi, edi
mov	edi, edx
push	ebx		; lpMem
shr	ecx, 2
rep movsd
mov	ecx, eax
xor	eax, eax
and	ecx, 3
push	1		; dwFlags
rep movsb
mov	edi, ebp
or	ecx, 0FFFFFFFFh
repne scasb
not	ecx
sub	edi, ecx
mov	eax, ecx
mov	esi, edi
mov	edi, edx
mov	edx, eax
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	ecx, edx
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	eax, hHeap
mov	esi, ds:HeapFree
push	eax		; hHeap
call	esi ; HeapFree
mov	ecx, hHeap
push	ebp		; lpMem
push	1		; dwFlags
push	ecx		; hHeap
call	esi ; HeapFree
mov	edx, [esp+14h+var_4]
mov	eax, [esp+14h+arg_4]
push	edx
push	eax
mov	ecx, [esp+1Ch+arg_0]
push	ecx
call	sub_4028C0
add	esp, 0Ch
pop	edi
pop	ebp
pop	ebx
pop	esi
pop	ecx
retn

loc_402BB3:
mov	edx, [esp+8+arg_8]
push	edx
call	sub_402530
push	eax
mov	eax, [esp+10h+arg_4]
push	eax
push	esi
call	sub_4028C0
add	esp, 10h
pop	esi
pop	ecx
retn
sub_402AA0 endp

align 10h



sub_402BD0 proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch
arg_C= dword ptr  10h
arg_10=	dword ptr  14h
arg_14=	dword ptr  18h

push	ebx
mov	ebx, [esp+4+arg_14]
push	ebp
push	esi
mov	esi, [esp+0Ch+arg_C]
push	edi
mov	edi, [esp+10h+arg_4]
push	ebx
push	esi
push	edi
call	sub_402AA0
mov	eax, [ebx+8]
mov	ebx, [esp+1Ch+arg_10]
mov	ebp, [esp+1Ch+arg_8]
add	esp, 0Ch
test	eax, eax
jz	short loc_402C09
push	eax
push	ebx
push	esi
push	ebp
push	edi
push	1
call	sub_402BD0
add	esp, 18h

loc_402C09:
cmp	[esp+10h+arg_0], 1
jnz	short loc_402C2A
mov	eax, [esp+10h+arg_14]
mov	eax, [eax+0Ch]
test	eax, eax
jz	short loc_402C2A
push	eax
push	ebx
push	esi
push	ebp
push	edi
push	1
call	sub_402BD0
add	esp, 18h

loc_402C2A:
mov	ecx, [esp+10h+arg_14]
mov	esi, [ecx+4]
test	esi, esi
jz	short loc_402C47

loc_402C35:
push	esi
push	ebx
push	ebp
call	sub_402AA0
mov	esi, [esi+10h]
add	esp, 0Ch
test	esi, esi
jnz	short loc_402C35

loc_402C47:
pop	edi
pop	esi
pop	ebp
pop	ebx
retn
sub_402BD0 endp

align 10h



sub_402C50 proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

mov	eax, [esp+arg_8]
push	esi
mov	esi, [eax+4]
test	esi, esi
jz	short loc_402C7A
push	ebx
mov	ebx, [esp+8+arg_0]
push	edi
mov	edi, [esp+0Ch+arg_4]

loc_402C66:
push	esi
push	edi
push	ebx
call	sub_402AA0
mov	esi, [esi+10h]
add	esp, 0Ch
test	esi, esi
jnz	short loc_402C66
pop	edi
pop	ebx

loc_402C7A:
pop	esi
retn
sub_402C50 endp

align 10h



; int __cdecl sub_402C80(LPVOID	lpMem)
sub_402C80 proc	near

lpMem= dword ptr  4

push	esi
mov	esi, [esp+4+lpMem]
test	esi, esi
jz	short loc_402CB7
push	edi
mov	edi, ds:HeapFree

loc_402C90:
mov	eax, [esi]
test	eax, eax
jz	short loc_402CA1
push	eax		; lpMem
mov	eax, hHeap
push	1		; dwFlags
push	eax		; hHeap
call	edi ; HeapFree

loc_402CA1:
mov	ecx, hHeap
mov	eax, esi
mov	esi, [esi+4]
push	eax		; lpMem
push	1		; dwFlags
push	ecx		; hHeap
call	edi ; HeapFree
test	esi, esi
jnz	short loc_402C90
pop	edi

loc_402CB7:
pop	esi
retn
sub_402C80 endp

align 10h



; int __cdecl sub_402CC0(LPVOID	lpMem)
sub_402CC0 proc	near

lpMem= dword ptr  4

push	ebx
mov	ebx, [esp+4+lpMem]
test	ebx, ebx
jz	short loc_402D3F
mov	eax, [ebx+8]
push	esi
push	edi
push	eax		; lpMem
call	sub_402CC0
mov	ecx, [ebx+0Ch]
push	ecx		; lpMem
call	sub_402CC0
mov	esi, [ebx+4]
mov	edi, ds:HeapFree
add	esp, 8
test	esi, esi
jz	short loc_402D23

loc_402CED:
mov	edx, [esi+8]
mov	eax, hHeap
push	edx		; lpMem
push	1		; dwFlags
push	eax		; hHeap
call	edi ; HeapFree
mov	eax, [esi+0Ch]
test	eax, eax
jz	short loc_402D0E
mov	ecx, hHeap
push	eax		; lpMem
push	1		; dwFlags
push	ecx		; hHeap
call	edi ; HeapFree

loc_402D0E:
mov	edx, hHeap
mov	eax, esi
mov	esi, [esi+10h]
push	eax		; lpMem
push	1		; dwFlags
push	edx		; hHeap
call	edi ; HeapFree
test	esi, esi
jnz	short loc_402CED

loc_402D23:
mov	eax, [ebx]
mov	ecx, hHeap
push	eax		; lpMem
push	1		; dwFlags
push	ecx		; hHeap
call	edi ; HeapFree
mov	edx, hHeap
push	ebx		; lpMem
push	1		; dwFlags
push	edx		; hHeap
call	edi ; HeapFree
pop	edi
pop	esi

loc_402D3F:
pop	ebx
retn
sub_402CC0 endp

align 10h



sub_402D50 proc	near

arg_0= dword ptr  4

push	ebx
push	esi
mov	esi, [esp+8+arg_0]
xor	ebx, ebx
cmp	esi, ebx
jz	short loc_402D83

loc_402D5C:
mov	eax, [esi+4]
mov	[esi+14h], bl
cmp	eax, ebx
jz	short loc_402D70

loc_402D66:
mov	[eax+18h], bl
mov	eax, [eax+10h]
cmp	eax, ebx
jnz	short loc_402D66

loc_402D70:
mov	eax, [esi+8]
push	eax
call	sub_402D50
mov	esi, [esi+0Ch]
add	esp, 4
cmp	esi, ebx
jnz	short loc_402D5C

loc_402D83:
pop	esi
pop	ebx
retn
sub_402D50 endp

align 10h



sub_402D90 proc	near

arg_0= dword ptr  4

push	esi
mov	esi, [esp+4+arg_0]
test	esi, esi
jz	short loc_402DB0

loc_402D99:
mov	eax, [esi+1Ch]
mov	byte ptr [esi+28h], 0
push	eax
call	sub_402D90
mov	esi, [esi+20h]
add	esp, 4
test	esi, esi
jnz	short loc_402D99

loc_402DB0:
pop	esi
retn
sub_402D90 endp

align 10h



sub_402DC0 proc	near

arg_0= dword ptr  4

push	esi
mov	esi, [esp+4+arg_0]
test	esi, esi
jz	short loc_402DDB

loc_402DC9:
mov	eax, [esi+4]
push	eax
call	sub_402D90
mov	esi, [esi]
add	esp, 4
test	esi, esi
jnz	short loc_402DC9

loc_402DDB:
pop	esi
retn
sub_402DC0 endp

align 10h



sub_402DE0 proc	near
mov	eax, dword_4106C0
push	ebx
xor	ebx, ebx
cmp	eax, ebx
jz	short loc_402E0F
mov	eax, lpMem
mov	ecx, hHeap
push	eax		; lpMem
push	1		; dwFlags
push	ecx		; hHeap
call	ds:HeapFree
mov	lpMem, ebx
mov	dword_4104C8, ebx
jmp	short loc_402E29

loc_402E0F:
mov	edx, dword_4106A4
push	edx		; lpMem
call	sub_402CC0
mov	eax, dword_4106D0
push	eax		; lpMem
call	sub_402CC0
add	esp, 8

loc_402E29:
mov	ecx, dword_4104C4
mov	dword_4106A4, ebx
mov	dword_4106D0, ebx
mov	[ecx], bl
mov	edx, dword_4106BC
mov	[edx], bl
pop	ebx
retn
sub_402DE0 endp

align 10h



sub_402E50 proc	near
mov	eax, dword_4105A4
push	ebx
xor	ebx, ebx
cmp	eax, ebx
jz	short loc_402E7F
mov	eax, dword_4105B0
mov	ecx, hHeap
push	eax		; lpMem
push	1		; dwFlags
push	ecx		; hHeap
call	ds:HeapFree
mov	dword_4105B0, ebx
mov	dword_4104E8, ebx
jmp	short loc_402E99

loc_402E7F:
mov	edx, dword_4106A8
push	edx		; lpMem
call	sub_402CC0
mov	eax, dword_4106CC
push	eax		; lpMem
call	sub_402CC0
add	esp, 8

loc_402E99:
mov	ecx, dword_4104CC
mov	dword_4106A8, ebx
mov	dword_4106CC, ebx
mov	[ecx], bl
mov	edx, dword_4106B8
mov	[edx], bl
pop	ebx
retn
sub_402E50 endp

align 10h



sub_402EC0 proc	near
mov	eax, dword_4106A0
push	eax		; lpMem
call	sub_402C80
mov	ecx, dword_4105B8
push	ecx		; lpMem
call	sub_402C80
mov	edx, dword_41050C
push	edx		; lpMem
call	sub_402C80
mov	eax, dword_410590
push	eax		; lpMem
call	sub_402C80
mov	ecx, dword_410560
push	ecx		; lpMem
call	sub_402C80
mov	edx, dword_410570
push	edx		; lpMem
call	sub_402C80
mov	eax, dword_410500
push	eax		; lpMem
call	sub_402C80
mov	ecx, dword_4104BC
push	ecx		; lpMem
call	sub_402C80
mov	edx, dword_410684
push	edx		; lpMem
call	sub_402C80
mov	eax, dword_41056C
push	eax		; lpMem
call	sub_402C80
mov	ecx, dword_4104B8
push	ecx		; lpMem
call	sub_402C80
xor	eax, eax
add	esp, 2Ch
mov	dword_410564, eax
mov	dword_410588, eax
mov	dword_410594, eax
mov	dword_4105A0, eax
mov	dword_410514, eax
mov	dword_4106B0, eax
mov	dword_4106C4, eax
mov	dword_4104B4, eax
mov	dword_4105C0, eax
mov	dword_410658, eax
mov	dword_410654, eax
mov	dword_4106A0, eax
mov	dword_4105B8, eax
mov	dword_41050C, eax
mov	dword_410590, eax
mov	dword_410560, eax
mov	dword_410570, eax
mov	dword_410500, eax
mov	dword_4104BC, eax
mov	dword_410684, eax
mov	dword_41056C, eax
mov	dword_4104B8, eax
retn
sub_402EC0 endp

align 10h



sub_402FC0 proc	near

var_4= dword ptr -4
arg_0= dword ptr  4
arg_4= dword ptr  8

push	ecx
mov	eax, [esp+4+arg_0]
push	ebx
push	ebp
mov	ebp, eax
test	eax, eax
push	esi
mov	[esp+10h+var_4], ebp
jz	loc_40321B
push	edi
jmp	short loc_402FDD

loc_402FD9:
mov	ebp, [esp+14h+var_4]

loc_402FDD:
mov	ebx, [esp+14h+arg_4]
mov	edi, ebx
test	ebx, ebx
mov	[esp+14h+arg_0], edi
jz	loc_4031F0
jmp	short loc_402FF5

loc_402FF1:
mov	edi, [esp+14h+arg_0]

loc_402FF5:
mov	al, [edi+14h]
test	al, al
jnz	short loc_40302E
mov	esi, [edi]
mov	eax, [ebp+0]

loc_403001:
mov	dl, [eax]
mov	cl, dl
cmp	dl, [esi]
jnz	short loc_403025
test	cl, cl
jz	short loc_403021
mov	dl, [eax+1]
mov	cl, dl
cmp	dl, [esi+1]
jnz	short loc_403025
add	eax, 2
add	esi, 2
test	cl, cl
jnz	short loc_403001

loc_403021:
xor	eax, eax
jmp	short loc_40302A

loc_403025:
sbb	eax, eax
sbb	eax, 0FFFFFFFFh

loc_40302A:
test	eax, eax
jz	short loc_40303E

loc_40302E:
mov	eax, [edi+0Ch]
test	eax, eax
mov	[esp+14h+arg_0], eax
jnz	short loc_402FF1
jmp	loc_4031F0

loc_40303E:
mov	byte ptr [edi+14h], 1
mov	eax, [ebp+4]
test	eax, eax
jnz	short loc_403069
mov	ecx, [edi+4]
test	ecx, ecx
jz	short loc_403065
push	edi
push	offset dword_410594
push	3
call	sub_402C50
add	esp, 0Ch
jmp	loc_403186

loc_403065:
test	eax, eax
jz	short loc_403085

loc_403069:
mov	ecx, [edi+4]
test	ecx, ecx
jnz	short loc_403085
push	ebp
push	offset dword_4105A0
push	4
call	sub_402C50
add	esp, 0Ch
jmp	loc_403186

loc_403085:
mov	ebx, eax
test	ebx, ebx
jz	loc_403159

loc_40308F:
mov	ebp, [edi+4]
test	ebp, ebp
jz	loc_40313A

loc_40309A:
mov	al, [ebp+18h]
test	al, al
jnz	short loc_4030E1
mov	eax, [ebx]
mov	ecx, [ebp+0]
cmp	eax, ecx
jnz	short loc_4030E1
mov	esi, [ebp+8]
mov	eax, [ebx+8]

loc_4030B0:
mov	dl, [eax]
mov	cl, dl
cmp	dl, [esi]
jnz	short loc_4030D4
test	cl, cl
jz	short loc_4030D0
mov	dl, [eax+1]
mov	cl, dl
cmp	dl, [esi+1]
jnz	short loc_4030D4
add	eax, 2
add	esi, 2
test	cl, cl
jnz	short loc_4030B0

loc_4030D0:
xor	eax, eax
jmp	short loc_4030D9

loc_4030D4:
sbb	eax, eax
sbb	eax, 0FFFFFFFFh

loc_4030D9:
test	eax, eax
jz	short loc_4030EA
mov	edi, [esp+14h+arg_0]

loc_4030E1:
mov	ebp, [ebp+10h]
test	ebp, ebp
jnz	short loc_40309A
jmp	short loc_40313A

loc_4030EA:
mov	ecx, [ebx+4]
mov	eax, [ebp+4]
cmp	ecx, eax
jnz	short loc_403106
mov	edi, [ebp+0Ch]
mov	esi, [ebx+0Ch]
xor	eax, eax
repe cmpsb
jnz	short loc_403106
mov	byte ptr [ebp+18h], 1
jmp	short loc_403132

loc_403106:
push	ebx
push	offset dword_410514
push	5
mov	byte ptr [ebp+18h], 4
call	sub_402AA0
push	ebp
push	offset dword_410514
push	5
call	sub_402AA0
mov	eax, dword_410514
add	esp, 18h
dec	eax
mov	dword_410514, eax

loc_403132:
mov	edi, [esp+14h+arg_0]
test	ebp, ebp
jnz	short loc_40314A

loc_40313A:
push	ebx
push	offset dword_4105A0
push	4
call	sub_402AA0
add	esp, 0Ch

loc_40314A:
mov	ebx, [ebx+10h]
test	ebx, ebx
jnz	loc_40308F
mov	ebp, [esp+14h+var_4]

loc_403159:
mov	esi, [edi+4]
test	esi, esi
jz	short loc_403182

loc_403160:
mov	al, [esi+18h]
cmp	al, 1
jz	short loc_40317B
cmp	al, 4
jz	short loc_40317B
push	esi
push	offset dword_410594
push	3
call	sub_402AA0
add	esp, 0Ch

loc_40317B:
mov	esi, [esi+10h]
test	esi, esi
jnz	short loc_403160

loc_403182:
mov	ebx, [esp+14h+arg_4]

loc_403186:
mov	eax, [ebp+8]
test	eax, eax
jnz	short loc_4031AD
mov	eax, [edi+8]
test	eax, eax
jz	short loc_4031AD
push	eax
push	offset dword_410594
push	offset dword_410564
push	3
push	1
push	1
call	sub_402BD0
add	esp, 18h

loc_4031AD:
mov	eax, [ebp+8]
test	eax, eax
jz	short loc_4031D4
mov	ecx, [edi+8]
test	ecx, ecx
jnz	short loc_4031D4
push	eax
push	offset dword_4105A0
push	offset dword_410588
push	4
push	2
push	1
call	sub_402BD0
add	esp, 18h

loc_4031D4:
mov	ecx, [ebp+8]
test	ecx, ecx
jz	short loc_4031EC
mov	eax, [edi+8]
test	eax, eax
jz	short loc_4031EC
push	eax
push	ecx
call	sub_402FC0
add	esp, 8

loc_4031EC:
test	edi, edi
jnz	short loc_403209

loc_4031F0:
push	ebp
push	offset dword_4105A0
push	offset dword_410588
push	4
push	2
push	0
call	sub_402BD0
add	esp, 18h

loc_403209:
mov	eax, [ebp+0Ch]
test	eax, eax
mov	[esp+14h+var_4], eax
jnz	loc_402FD9
pop	edi
jmp	short loc_40321F

loc_40321B:
mov	ebx, [esp+10h+arg_4]

loc_40321F:
test	ebx, ebx
mov	esi, ebx
jz	short loc_403259

loc_403225:
mov	ecx, dword_41059C
inc	ecx
mov	dword_41059C, ecx
mov	al, [esi+14h]
test	al, al
jnz	short loc_403252
push	esi
push	offset dword_410594
push	offset dword_410564
push	3
push	1
push	0
call	sub_402BD0
add	esp, 18h

loc_403252:
mov	esi, [esi+0Ch]
test	esi, esi
jnz	short loc_403225

loc_403259:
mov	ecx, dword_4104A8
pop	esi
pop	ebp
pop	ebx
test	ecx, ecx
jz	short loc_40329C
mov	eax, dword_41059C
xor	edx, edx
div	ecx
cmp	edx, dword_4104F0
jbe	short loc_40329C
mov	ecx, hDlg
push	0		; lParam
push	0		; wParam
push	405h		; Msg
push	400h		; nIDDlgItem
push	ecx		; hDlg
mov	dword_41059C, 0
call	ds:SendDlgItemMessageA

loc_40329C:
xor	eax, eax
pop	ecx
retn
sub_402FC0 endp




sub_4032A0 proc	near

lpMem= dword ptr -24h
var_20=	dword ptr -20h
var_1C=	dword ptr -1Ch
var_18=	dword ptr -18h
var_14=	dword ptr -14h
FileTime2= FILETIME ptr	-10h
FileTime= _FILETIME ptr	-8

mov	eax, dword_4104E8
mov	ecx, dword_4104C8
sub	esp, 24h
push	eax
push	ecx
call	sub_401A20
add	esp, 8
test	eax, eax
jnz	short loc_4032D5
mov	edx, hDlg
push	30h		; uType
push	offset Caption	; "Warning"
push	offset Text	; "Found two shots with	different DIR chai"...
push	edx		; hWnd
call	ds:MessageBoxA

loc_4032D5:
push	ebx
push	ebp
push	esi
push	edi
call	sub_405100
mov	ecx, lpSystemTime
mov	esi, ds:SystemTimeToFileTime
lea	eax, [esp+34h+FileTime]
push	eax		; lpFileTime
push	ecx		; lpSystemTime
call	esi ; SystemTimeToFileTime
mov	eax, dword_410574
lea	edx, [esp+34h+FileTime2]
push	edx		; lpFileTime
push	eax		; lpSystemTime
call	esi ; SystemTimeToFileTime
lea	ecx, [esp+34h+FileTime2]
lea	edx, [esp+34h+FileTime]
push	ecx		; lpFileTime2
push	edx		; lpFileTime1
call	ds:CompareFileTime
xor	ecx, ecx
test	eax, eax
setle	cl
mov	ebp, ecx
test	ebp, ebp
jz	short loc_40333E
mov	edx, dword_4106A8
mov	eax, dword_4106A4
push	edx
push	eax
call	sub_402FC0
mov	ecx, dword_4106CC
mov	edx, dword_4106D0
push	ecx
push	edx
jmp	short loc_40335D

loc_40333E:
mov	eax, dword_4106A4
mov	ecx, dword_4106A8
push	eax
push	ecx
call	sub_402FC0
mov	edx, dword_4106D0
mov	eax, dword_4106CC
push	edx
push	eax

loc_40335D:
call	sub_402FC0
mov	ecx, hDlg
add	esp, 10h
push	0		; lParam
push	0		; wParam
push	402h		; Msg
push	400h		; nIDDlgItem
push	ecx		; hDlg
call	ds:SendDlgItemMessageA
test	ebp, ebp
jz	short loc_403395
mov	ecx, dword_4104C8
mov	eax, dword_4104E8
mov	edi, ecx
mov	ebx, eax
jmp	short loc_4033A4

loc_403395:
mov	eax, dword_4104E8
mov	ecx, dword_4104C8
mov	edi, eax
mov	ebx, ecx

loc_4033A4:
test	edi, edi
jz	short loc_4033F5

loc_4033A8:
mov	esi, [edi+4]
test	esi, esi
jz	short loc_4033E4
mov	edx, [esi]
push	ebx		; int
push	edx		; char *
call	sub_401930
add	esp, 8
test	eax, eax
jz	short loc_4033CB
push	eax
push	esi
call	sub_401410
add	esp, 8
jmp	short loc_4033E4

loc_4033CB:
push	esi
push	offset dword_4106C4
push	offset dword_410658
push	7
push	0Ah
push	0
call	sub_401090
add	esp, 18h

loc_4033E4:
mov	edi, [edi]
test	edi, edi
jnz	short loc_4033A8
mov	ecx, dword_4104C8
mov	eax, dword_4104E8

loc_4033F5:
test	ebp, ebp
jz	short loc_4033FF
mov	ebx, ecx
mov	edi, eax
jmp	short loc_403403

loc_4033FF:
mov	ebx, eax
mov	edi, ecx

loc_403403:
test	edi, edi
jz	short loc_40343C

loc_403407:
mov	esi, [edi+4]
test	esi, esi
jz	short loc_403436
mov	eax, [esi]
push	ebx		; int
push	eax		; char *
call	sub_401930
add	esp, 8
test	eax, eax
jnz	short loc_403436
push	esi
push	offset dword_4106B0
push	offset dword_4105C0
push	6
push	9
push	eax
call	sub_401090
add	esp, 18h

loc_403436:
mov	edi, [edi]
test	edi, edi
jnz	short loc_403407

loc_40343C:
mov	ecx, hDlg
push	0		; lParam
push	64h		; wParam
push	402h		; Msg
push	400h		; nIDDlgItem
push	ecx		; hDlg
call	ds:SendDlgItemMessageA
mov	edx, hDlg
push	0		; lParam
push	0		; wParam
push	0F0h		; Msg
push	3F5h		; nIDDlgItem
push	edx		; hDlg
call	ds:GetDlgItem
push	eax		; hWnd
call	ds:SendMessageA
cmp	eax, 1
jnz	short loc_40348A
xor	ebp, ebp
mov	[esp+34h+var_1C], offset a_txt ; ".txt"
jmp	short loc_403497

loc_40348A:
mov	ebp, 1
mov	[esp+34h+var_1C], offset a_htm ; ".htm"

loc_403497:
mov	eax, hHeap
mov	esi, ds:HeapAlloc
push	208h		; dwBytes
push	9		; dwFlags
push	eax		; hHeap
call	esi ; HeapAlloc
mov	ecx, hHeap
push	800h		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
mov	[esp+40h+lpMem], eax
call	esi ; HeapAlloc
mov	edx, hDlg
mov	esi, ds:GetDlgItemTextA
mov	ebx, eax
push	32h		; cchMax
push	ebx		; lpString
push	401h		; nIDDlgItem
push	edx		; hDlg
call	esi ; GetDlgItemTextA
mov	eax, lpString
mov	ecx, hDlg
push	104h		; cchMax
push	eax		; lpString
push	402h		; nIDDlgItem
push	ecx		; hDlg
call	esi ; GetDlgItemTextA
mov	edx, lpString
or	ecx, 0FFFFFFFFh
mov	edi, edx
xor	eax, eax
repne scasb
not	ecx
dec	ecx
jz	short loc_403522
cmp	byte ptr [edx+ecx-1], 5Ch
jz	short loc_403522
mov	byte ptr [edx+ecx], 5Ch
mov	edx, lpString
mov	byte ptr [edx+ecx+1], 0
mov	edx, lpString

loc_403522:
mov	edi, edx
or	ecx, 0FFFFFFFFh
xor	eax, eax
push	ebx
repne scasb
not	ecx
sub	edi, ecx
mov	eax, ecx
mov	esi, edi
mov	edi, [esp+38h+lpMem]
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
call	sub_401FF0
add	esp, 4
mov	edi, ebx
test	eax, eax
jnz	short loc_403557
mov	edi, offset aRes ; "~res"

loc_403557:
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
not	ecx
sub	edi, ecx
push	0		; hTemplateFile
mov	esi, edi
mov	edi, [esp+38h+lpMem]
mov	edx, ecx
or	ecx, 0FFFFFFFFh
repne scasb
mov	ecx, edx
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, edx
mov	edx, [esp+38h+lpMem]
and	ecx, 3
push	80h		; dwFlagsAndAttributes
rep movsb
mov	edi, edx
or	ecx, 0FFFFFFFFh
repne scasb
mov	edi, [esp+3Ch+var_1C]
push	1		; dwCreationDisposition
not	ecx
dec	ecx
push	0		; lpSecurityAttributes
mov	[esp+44h+var_14], ecx
or	ecx, 0FFFFFFFFh
repne scasb
not	ecx
sub	edi, ecx
push	3		; dwShareMode
mov	eax, ecx
mov	esi, edi
mov	[esp+48h+var_18], eax
mov	edi, edx
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	eax, [esp+48h+var_18]
dec	edi
mov	ecx, eax
push	0C0000000h	; dwDesiredAccess
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, edx
push	esi		; lpFileName
call	ds:CreateFileA
mov	edx, eax
cmp	edx, 0FFFFFFFFh
mov	dword_410584, edx
jnz	loc_4036C2
mov	ecx, [esp+34h+var_14]
mov	[esp+34h+var_20], 0
add	ecx, esi
mov	[esp+34h+var_18], ecx

loc_4035FF:
mov	edx, [esp+34h+var_20]
mov	eax, [esp+34h+var_18]
push	edx
push	offset a04d	; "%04d"
push	eax		; char *
call	_sprintf
mov	edi, [esp+40h+var_1C]
or	ecx, 0FFFFFFFFh
xor	eax, eax
add	esp, 0Ch
repne scasb
mov	eax, [esp+34h+var_18]
push	0		; hTemplateFile
not	ecx
sub	edi, ecx
push	80h		; dwFlagsAndAttributes
mov	edx, ecx
mov	esi, edi
lea	edi, [eax+4]
push	1		; dwCreationDisposition
shr	ecx, 2
rep movsd
mov	ecx, edx
push	0		; lpSecurityAttributes
and	ecx, 3
push	3		; dwShareMode
rep movsb
mov	ecx, [esp+48h+lpMem]
push	0C0000000h	; dwDesiredAccess
push	ecx		; lpFileName
call	ds:CreateFileA
mov	edx, eax
cmp	edx, 0FFFFFFFFh
mov	dword_410584, edx
jnz	short loc_4036A0
call	ds:GetLastError
cmp	eax, 50h
jnz	short loc_403687
mov	eax, [esp+34h+var_20]
inc	eax
cmp	eax, 2710h
mov	[esp+34h+var_20], eax
jb	loc_4035FF
jmp	short loc_4036AA

loc_403687:
mov	edx, lpText
push	edx		; lpText
call	sub_401FD0
add	esp, 4
xor	eax, eax
pop	edi
pop	esi
pop	ebp
pop	ebx
add	esp, 24h
retn

loc_4036A0:
cmp	[esp+34h+var_20], 2710h
jb	short loc_4036C2

loc_4036AA:
mov	eax, lpText
push	eax		; lpText
call	sub_401FD0
add	esp, 4
xor	eax, eax
pop	edi
pop	esi
pop	ebp
pop	ebx
add	esp, 24h
retn

loc_4036C2:
cmp	ebp, 1
jnz	short loc_4036D2
call	sub_402450
mov	edx, dword_410584

loc_4036D2:
mov	esi, lpBuffer
or	ecx, 0FFFFFFFFh
mov	edi, esi
xor	eax, eax
repne scasb
not	ecx
push	0		; lpOverlapped
dec	ecx
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	ecx		; nNumberOfBytesToWrite
push	esi		; lpBuffer
mov	esi, ds:WriteFile
push	edx		; hFile
call	esi ; WriteFile
mov	edi, offset unk_40D480
or	ecx, 0FFFFFFFFh
xor	eax, eax
push	0		; lpOverlapped
repne scasb
not	ecx
dec	ecx
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	ecx		; nNumberOfBytesToWrite
mov	ecx, dword_410584
push	offset unk_40D480 ; lpBuffer
push	ecx		; hFile
call	esi ; WriteFile
mov	edx, hDlg
push	32h		; cchMax
push	ebx		; lpString
push	401h		; nIDDlgItem
push	edx		; hDlg
call	ds:GetDlgItemTextA
mov	eax, dword_410444
push	ebp		; int
push	ebx		; int
push	eax		; lpBuffer
call	sub_402380
mov	eax, dword_410574
xor	ecx, ecx
xor	edx, edx
mov	cx, [eax+0Ch]
mov	dx, [eax+0Ah]
push	ecx
push	offset asc_40D754 ; ":"
push	edx
xor	ecx, ecx
mov	cx, [eax+8]
xor	edx, edx
mov	dx, [eax+6]
push	offset asc_40D754 ; ":"
push	ecx
push	edx
xor	ecx, ecx
xor	edx, edx
mov	cx, [eax+2]
mov	dx, [eax]
mov	eax, lpSystemTime
push	offset asc_40D750 ; "/"
push	ecx
xor	ecx, ecx
mov	cx, [eax+0Ch]
push	offset asc_40D750 ; "/"
push	edx
push	offset asc_40D74C ; " ,	"
xor	edx, edx
push	ecx
mov	dx, [eax+0Ah]
xor	ecx, ecx
mov	cx, [eax+8]
push	offset asc_40D754 ; ":"
push	edx
push	offset asc_40D754 ; ":"
xor	edx, edx
push	ecx
mov	dx, [eax+6]
xor	ecx, ecx
mov	cx, [eax+2]
push	edx
push	offset asc_40D750 ; "/"
push	ecx
xor	edx, edx
push	offset asc_40D750 ; "/"
mov	dx, [eax]
push	edx
push	offset aDSDSD02dS02dS0 ; "%d%s%d%s%d %02d%s%02d%s%02d %s %d%s%d%s"...
push	ebx		; char *
call	_sprintf
mov	eax, dword_41044C
add	esp, 68h
push	ebp		; int
push	ebx		; int
push	eax		; lpBuffer
call	sub_402380
mov	byte ptr [ebx],	0
mov	edi, dword_4104C4
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
not	ecx
sub	edi, ecx
push	ebp		; int
mov	edx, ecx
mov	esi, edi
mov	edi, ebx
push	ebx		; int
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	edi, offset asc_40D74C ; " , "
or	ecx, 0FFFFFFFFh
repne scasb
not	ecx
sub	edi, ecx
mov	esi, edi
mov	edx, ecx
mov	edi, ebx
or	ecx, 0FFFFFFFFh
repne scasb
mov	ecx, edx
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	edi, dword_4104CC
or	ecx, 0FFFFFFFFh
repne scasb
not	ecx
sub	edi, ecx
mov	esi, edi
mov	edx, ecx
mov	edi, ebx
or	ecx, 0FFFFFFFFh
repne scasb
mov	ecx, edx
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	eax, dword_410464
push	eax		; lpBuffer
call	sub_402380
mov	byte ptr [ebx],	0
mov	edi, dword_4106BC
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
not	ecx
sub	edi, ecx
mov	edx, ecx
mov	esi, edi
mov	edi, ebx
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	edi, offset asc_40D74C ; " , "
or	ecx, 0FFFFFFFFh
repne scasb
not	ecx
sub	edi, ecx
push	ebp		; int
mov	esi, edi
mov	edx, ecx
mov	edi, ebx
or	ecx, 0FFFFFFFFh
repne scasb
mov	ecx, edx
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, edx
push	ebx		; int
and	ecx, 3
rep movsb
mov	edi, dword_4106B8
or	ecx, 0FFFFFFFFh
repne scasb
not	ecx
sub	edi, ecx
mov	esi, edi
mov	edx, ecx
mov	edi, ebx
or	ecx, 0FFFFFFFFh
repne scasb
mov	ecx, edx
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	eax, dword_410440
push	eax		; lpBuffer
call	sub_402380
mov	ecx, hHeap
mov	edi, ds:HeapFree
add	esp, 24h
push	ebx		; lpMem
push	1		; dwFlags
push	ecx		; hHeap
call	edi ; HeapFree
mov	eax, dword_410588
test	eax, eax
jz	short loc_403926
mov	edx, dword_410484
push	ebp		; int
push	eax		; int
push	edx		; lpBuffer
call	sub_4020D0
mov	eax, dword_4105B8
push	0
push	ebp
push	eax
call	sub_4021F0
add	esp, 18h

loc_403926:
mov	eax, dword_410564
test	eax, eax
jz	short loc_40394F
mov	ecx, dword_410454
push	ebp		; int
push	eax		; int
push	ecx		; lpBuffer
call	sub_4020D0
mov	edx, dword_4106A0
push	0
push	ebp
push	edx
call	sub_4021F0
add	esp, 18h

loc_40394F:
mov	eax, dword_4105A0
test	eax, eax
jz	short loc_403977
push	ebp		; int
push	eax		; int
mov	eax, dword_41048C
push	eax		; lpBuffer
call	sub_4020D0
mov	ecx, dword_410590
push	0
push	ebp
push	ecx
call	sub_4021F0
add	esp, 18h

loc_403977:
mov	eax, dword_410594
test	eax, eax
jz	short loc_40399F
mov	edx, dword_410458
push	ebp		; int
push	eax		; int
push	edx		; lpBuffer
call	sub_4020D0
mov	eax, dword_41050C
push	0
push	ebp
push	eax
call	sub_4021F0
add	esp, 18h

loc_40399F:
mov	eax, dword_410514
test	eax, eax
jz	short loc_4039C8
mov	ecx, dword_410434
push	ebp		; int
push	eax		; int
push	ecx		; lpBuffer
call	sub_4020D0
mov	edx, dword_410560
push	1
push	ebp
push	edx
call	sub_4021F0
add	esp, 18h

loc_4039C8:
mov	eax, dword_4106B0
test	eax, eax
jz	short loc_4039F0
push	ebp		; int
push	eax		; int
mov	eax, dword_410498
push	eax		; lpBuffer
call	sub_4020D0
mov	ecx, dword_410570
push	0
push	ebp
push	ecx
call	sub_4021F0
add	esp, 18h

loc_4039F0:
mov	eax, dword_4106C4
test	eax, eax
jz	short loc_403A18
mov	edx, dword_410424
push	ebp		; int
push	eax		; int
push	edx		; lpBuffer
call	sub_4020D0
mov	eax, dword_410500
push	0
push	ebp
push	eax
call	sub_4021F0
add	esp, 18h

loc_403A18:
mov	eax, dword_4104B4
test	eax, eax
jz	short loc_403A41
mov	ecx, dword_410438
push	ebp		; int
push	eax		; int
push	ecx		; lpBuffer
call	sub_4020D0
mov	edx, dword_4104BC
push	0
push	ebp
push	edx
call	sub_4021F0
add	esp, 18h

loc_403A41:
mov	eax, dword_4105C0
test	eax, eax
jz	short loc_403A69
push	ebp		; int
push	eax		; int
mov	eax, dword_410494
push	eax		; lpBuffer
call	sub_4020D0
mov	ecx, dword_410684
push	0
push	ebp
push	ecx
call	sub_4021F0
add	esp, 18h

loc_403A69:
mov	eax, dword_410658
test	eax, eax
jz	short loc_403A91
mov	edx, dword_410478
push	ebp		; int
push	eax		; int
push	edx		; lpBuffer
call	sub_4020D0
mov	eax, dword_41056C
push	0
push	ebp
push	eax
call	sub_4021F0
add	esp, 18h

loc_403A91:
mov	eax, dword_410654
test	eax, eax
jz	short loc_403ABF
mov	ecx, dword_410448
push	ebp		; int
push	eax		; int
push	ecx		; lpBuffer
call	sub_4020D0
mov	edx, dword_4104B8
push	0
push	ebp
push	edx
call	sub_4021F0
mov	eax, dword_410654
add	esp, 18h

loc_403ABF:
mov	ecx, dword_4104B4
mov	ebx, dword_4105A0
mov	edx, dword_410564
lea	esi, [eax+ecx]
mov	ecx, dword_410514
mov	eax, dword_410594
add	esi, ecx
mov	ecx, dword_410588
add	esi, eax
mov	eax, dword_4105C0
add	esi, ebx
mov	ebx, dword_4106B0
add	esi, edx
mov	edx, dword_410658
add	esi, ecx
mov	ecx, dword_4106C4
add	esi, eax
add	esi, ebx
add	esi, edx
add	esi, ecx
cmp	ebp, 1
jnz	short loc_403B18
call	sub_402510

loc_403B18:
mov	edx, dword_410460
push	ebp		; int
push	esi		; int
push	edx		; lpBuffer
call	sub_4020D0
add	esp, 0Ch
cmp	ebp, 1
jnz	short loc_403B33
call	sub_4024D0

loc_403B33:
mov	eax, dword_410584
push	eax		; hObject
call	ds:CloseHandle
mov	esi, [esp+34h+lpMem]
mov	ecx, hDlg
push	5		; nShowCmd
push	0		; lpDirectory
push	0		; lpParameters
push	esi		; lpFile
push	offset Operation ; "open"
push	ecx		; hwnd
call	ds:ShellExecuteA
cmp	eax, 20h
ja	short loc_403B70
mov	edx, dword_410474
push	edx		; lpText
call	sub_401FD0
add	esp, 4

loc_403B70:
mov	eax, hHeap
push	esi		; lpMem
push	1		; dwFlags
push	eax		; hHeap
call	edi ; HeapFree
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
add	esp, 24h
retn
sub_4032A0 endp

align 10h



; int __cdecl sub_403B90(HKEY hKey, int)
sub_403B90 proc	near

cbData=	dword ptr -2Ch
dwBytes= dword ptr -28h
var_24=	dword ptr -24h
cbMaxValueNameLen= dword ptr -20h
cbMaxSubKeyLen=	dword ptr -1Ch
cchValueName= dword ptr	-18h
phkResult= dword ptr -14h
cchName= dword ptr -10h
var_C= dword ptr -0Ch
Type= dword ptr	-8
var_4= dword ptr -4
hKey= dword ptr	 4
arg_4= dword ptr  8

sub	esp, 2Ch
lea	eax, [esp+2Ch+dwBytes]
lea	ecx, [esp+2Ch+cbMaxValueNameLen]
lea	edx, [esp+2Ch+cbMaxSubKeyLen]
push	ebx
push	0		; lpftLastWriteTime
push	0		; lpcbSecurityDescriptor
mov	ebx, [esp+38h+hKey]
push	eax		; lpcbMaxValueLen
push	ecx		; lpcbMaxValueNameLen
push	0		; lpcValues
push	0		; lpcbMaxClassLen
push	edx		; lpcbMaxSubKeyLen
push	0		; lpcSubKeys
push	0		; lpReserved
push	0		; lpcchClass
push	0		; lpClass
push	ebx		; hKey
call	ds:RegQueryInfoKeyA
test	eax, eax
jnz	loc_403F35
mov	eax, [esp+30h+cbMaxSubKeyLen]
mov	edx, [esp+30h+cbMaxValueNameLen]
push	ebp
push	esi
mov	esi, ds:HeapAlloc
lea	ecx, [eax+eax+3]
lea	eax, [edx+edx+3]
mov	edx, [esp+38h+dwBytes]
push	edi
mov	[esp+3Ch+cbMaxValueNameLen], eax
push	eax		; dwBytes
mov	eax, hHeap
inc	edx
push	1		; dwFlags
push	eax		; hHeap
mov	[esp+48h+cbMaxSubKeyLen], ecx
mov	[esp+48h+dwBytes], edx
call	esi ; HeapAlloc
mov	ecx, [esp+3Ch+dwBytes]
mov	edx, hHeap
push	ecx		; dwBytes
push	1		; dwFlags
push	edx		; hHeap
mov	ebp, eax
call	esi ; HeapAlloc
mov	edi, eax
mov	byte ptr [ebp+0], 0
lea	edx, [esp+3Ch+cbData]
mov	[esp+3Ch+var_C], edi
mov	byte ptr [edi],	0
mov	eax, [esp+3Ch+cbMaxValueNameLen]
mov	ecx, [esp+3Ch+dwBytes]
mov	[esp+3Ch+cchValueName],	eax
push	edx		; lpcbData
lea	eax, [esp+40h+Type]
mov	[esp+40h+cbData], ecx
push	edi		; lpData
push	eax		; lpType
lea	ecx, [esp+48h+cchValueName]
push	0		; lpReserved
push	ecx		; lpcchValueName
push	ebp		; lpValueName
push	0		; dwIndex
push	ebx		; hKey
mov	[esp+5Ch+var_24], 0
call	ds:RegEnumValueA
cmp	eax, 103h
jz	loc_403D68

loc_403C59:
test	eax, eax
jnz	loc_403D22
mov	edx, hHeap
push	1Ch		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
call	esi ; HeapAlloc
mov	ebx, eax
mov	eax, [esp+3Ch+arg_4]
mov	ecx, [eax+4]
test	ecx, ecx
jnz	short loc_403C80
mov	[eax+4], ebx
jmp	short loc_403C87

loc_403C80:
mov	ecx, [esp+3Ch+var_4]
mov	[ecx+10h], ebx

loc_403C87:
mov	edx, [esp+3Ch+Type]
mov	edi, ebp
mov	[ebx], edx
mov	ecx, [esp+3Ch+cbData]
mov	[ebx+4], ecx
mov	[ebx+14h], eax
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	edx, hHeap
mov	[esp+3Ch+var_4], ebx
not	ecx
push	ecx		; dwBytes
push	1		; dwFlags
push	edx		; hHeap
call	esi ; HeapAlloc
mov	edx, eax
mov	edi, ebp
or	ecx, 0FFFFFFFFh
xor	eax, eax
mov	[ebx+8], edx
repne scasb
not	ecx
sub	edi, ecx
mov	eax, ecx
mov	esi, edi
mov	edi, edx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [esp+3Ch+cbData]
test	eax, eax
jz	short loc_403D09
mov	ecx, hHeap
push	eax		; dwBytes
push	1		; dwFlags
push	ecx		; hHeap
call	ds:HeapAlloc
mov	esi, [esp+3Ch+var_C]
mov	[ebx+0Ch], eax
mov	ecx, [esp+3Ch+cbData]
mov	edi, eax
mov	edx, ecx
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb

loc_403D09:
mov	eax, dword_4104E0
mov	edi, [esp+3Ch+var_C]
mov	esi, ds:HeapAlloc
mov	ebx, [esp+3Ch+hKey]
inc	eax
mov	dword_4104E0, eax

loc_403D22:
mov	byte ptr [ebp+0], 0
mov	eax, [esp+3Ch+var_24]
mov	byte ptr [edi],	0
mov	ecx, [esp+3Ch+cbMaxValueNameLen]
mov	edx, [esp+3Ch+dwBytes]
mov	[esp+3Ch+cchValueName],	ecx
lea	ecx, [esp+3Ch+cbData]
mov	[esp+3Ch+cbData], edx
push	ecx		; lpcbData
lea	edx, [esp+40h+Type]
push	edi		; lpData
push	edx		; lpType
lea	ecx, [esp+48h+cchValueName]
push	0		; lpReserved
inc	eax
push	ecx		; lpcchValueName
push	ebp		; lpValueName
push	eax		; dwIndex
push	ebx		; hKey
mov	[esp+5Ch+var_24], eax
call	ds:RegEnumValueA
cmp	eax, 103h
jnz	loc_403C59

loc_403D68:
mov	edx, hHeap
mov	ebx, ds:HeapFree
push	ebp		; lpMem
push	1		; dwFlags
push	edx		; hHeap
call	ebx ; HeapFree
mov	eax, hHeap
push	edi		; lpMem
push	1		; dwFlags
push	eax		; hHeap
call	ebx ; HeapFree
mov	ecx, [esp+3Ch+cbMaxSubKeyLen]
mov	edx, lpName
push	offset ftLastWriteTime ; lpftLastWriteTime
mov	[esp+40h+cchName], ecx
push	0		; lpcchClass
mov	byte ptr [edx],	0
mov	ecx, lpName
mov	edx, [esp+44h+hKey]
push	0		; lpClass
lea	eax, [esp+48h+cchName]
push	0		; lpReserved
push	eax		; lpcchName
push	ecx		; lpName
push	0		; dwIndex
push	edx		; hKey
mov	[esp+5Ch+var_24], 0
call	ds:RegEnumKeyExA
cmp	eax, 103h
jz	loc_403EF7

loc_403DCD:
test	eax, eax
jnz	loc_403EAF
mov	eax, hHeap
push	18h		; dwBytes
push	9		; dwFlags
push	eax		; hHeap
call	esi ; HeapAlloc
mov	ebp, [esp+3Ch+arg_4]
mov	ebx, eax
mov	eax, [ebp+8]
test	eax, eax
jnz	short loc_403DF3
mov	[ebp+8], ebx
jmp	short loc_403DFA

loc_403DF3:
mov	ecx, [esp+3Ch+var_4]
mov	[ecx+0Ch], ebx

loc_403DFA:
mov	edi, lpName
or	ecx, 0FFFFFFFFh
xor	eax, eax
mov	edx, hHeap
repne scasb
not	ecx
push	ecx		; dwBytes
push	1		; dwFlags
push	edx		; hHeap
mov	[esp+48h+var_4], ebx
call	esi ; HeapAlloc
mov	edx, eax
or	ecx, 0FFFFFFFFh
mov	[ebx], edx
mov	edi, lpName
xor	eax, eax
repne scasb
not	ecx
sub	edi, ecx
mov	eax, ecx
mov	esi, edi
mov	edi, edx
shr	ecx, 2
rep movsd
mov	ecx, eax
mov	eax, [esp+3Ch+hKey]
and	ecx, 3
rep movsb
mov	[ebx+10h], ebp
mov	ecx, dword_4104A8
mov	edx, lpName
inc	ecx
mov	dword_4104A8, ecx
lea	ecx, [esp+3Ch+phkResult]
push	ecx		; phkResult
push	9		; samDesired
push	0		; ulOptions
push	edx		; lpSubKey
push	eax		; hKey
call	ds:RegOpenKeyExA
test	eax, eax
jnz	short loc_403EA9
mov	ecx, dword_410524
mov	edx, lpName
push	ecx		; int
push	edx		; char *
call	sub_405060
add	esp, 8
test	eax, eax
jz	short loc_403E90
mov	eax, [esp+3Ch+phkResult]
push	eax
jmp	short loc_403EA3

loc_403E90:
mov	ecx, [esp+3Ch+phkResult]
push	ebx		; int
push	ecx		; hKey
call	sub_403B90
mov	edx, [esp+44h+phkResult]
add	esp, 8
push	edx		; hKey

loc_403EA3:
call	ds:RegCloseKey

loc_403EA9:
mov	esi, ds:HeapAlloc

loc_403EAF:
mov	ecx, [esp+3Ch+cbMaxSubKeyLen]
mov	edx, lpName
mov	eax, [esp+3Ch+var_24]
push	offset ftLastWriteTime ; lpftLastWriteTime
mov	[esp+40h+cchName], ecx
push	0		; lpcchClass
mov	byte ptr [edx],	0
mov	edx, lpName
push	0		; lpClass
lea	ecx, [esp+48h+cchName]
push	0		; lpReserved
inc	eax
push	ecx		; lpcchName
push	edx		; lpName
mov	[esp+54h+var_24], eax
push	eax		; dwIndex
mov	eax, [esp+58h+hKey]
push	eax		; hKey
call	ds:RegEnumKeyExA
cmp	eax, 103h
jnz	loc_403DCD

loc_403EF7:
call	ds:GetTickCount
mov	edx, dword_4104E4
mov	dword_4104B0, eax
sub	eax, edx
pop	edi
pop	esi
cmp	eax, 6Eh
pop	ebp
jbe	short loc_403F35
mov	ecx, dword_4104E0
mov	edx, dword_4104A8
mov	eax, dword_41042C
push	ecx
mov	ecx, dword_41046C
push	edx
push	eax
push	ecx
call	sub_4051B0
add	esp, 10h

loc_403F35:
pop	ebx
add	esp, 2Ch
retn
sub_403B90 endp

align 10h



; int __cdecl sub_403F40(int, int, LONG	lDistanceToMove)
sub_403F40 proc	near

Buffer=	dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  4
arg_4= dword ptr  8
lDistanceToMove= dword ptr  0Ch

sub	esp, 8
push	ebx
push	ebp
mov	ebp, [esp+10h+arg_0]
push	esi
push	edi
or	ecx, 0FFFFFFFFh
mov	edi, [ebp+0]
xor	eax, eax
repne scasb
mov	edi, ds:SetFilePointer
push	1		; dwMoveMethod
not	ecx
push	eax		; lpDistanceToMoveHigh
dec	ecx
push	eax		; lDistanceToMove
mov	eax, hFile
mov	esi, ecx
push	eax		; hFile
inc	esi
call	edi ; SetFilePointer
mov	edx, hFile
mov	ebx, ds:WriteFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	ecx, [esp+20h+Buffer]
mov	[esp+20h+var_4], eax
push	4		; nNumberOfBytesToWrite
add	eax, 15h
push	ecx		; lpBuffer
push	edx		; hFile
mov	[esp+2Ch+Buffer], eax
call	ebx ; WriteFile
mov	eax, [ebp+4]
test	eax, eax
jz	short loc_403FAA
mov	eax, [esp+18h+var_4]
lea	ecx, [eax+esi+15h]
mov	[esp+18h+Buffer], ecx
jmp	short loc_403FB2

loc_403FAA:
mov	[esp+18h+Buffer], 0

loc_403FB2:
mov	eax, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	edx, [esp+20h+Buffer]
push	4		; nNumberOfBytesToWrite
push	edx		; lpBuffer
push	eax		; hFile
call	ebx ; WriteFile
mov	ecx, hFile
push	0		; lpOverlapped
lea	eax, [ebp+8]
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	8		; nNumberOfBytesToWrite
push	eax		; lpBuffer
push	ecx		; hFile
call	ebx ; WriteFile
mov	eax, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	edx, [esp+20h+arg_4]
push	4		; nNumberOfBytesToWrite
push	edx		; lpBuffer
push	eax		; hFile
call	ebx ; WriteFile
mov	edx, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	ecx, [esp+20h+Buffer]
push	1		; nNumberOfBytesToWrite
push	ecx		; lpBuffer
push	edx		; hFile
mov	[esp+2Ch+Buffer], 0
call	ebx ; WriteFile
mov	eax, [ebp+0]
mov	ecx, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	esi		; nNumberOfBytesToWrite
push	eax		; lpBuffer
push	ecx		; hFile
call	ebx ; WriteFile
mov	esi, [ebp+4]
test	esi, esi
jz	loc_404168

loc_404033:
mov	edi, [esi+8]
or	ecx, 0FFFFFFFFh
xor	eax, eax
mov	edx, hFile
repne scasb
not	ecx
dec	ecx
push	1		; dwMoveMethod
push	eax		; lpDistanceToMoveHigh
mov	edi, ecx
push	eax		; lDistanceToMove
push	edx		; hFile
inc	edi
call	ds:SetFilePointer
push	0		; lpOverlapped
mov	ebp, eax
mov	eax, hFile
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	8		; nNumberOfBytesToWrite
push	esi		; lpBuffer
push	eax		; hFile
call	ebx ; WriteFile
mov	eax, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	edx, [esp+20h+Buffer]
push	4		; nNumberOfBytesToWrite
lea	ecx, [ebp+19h]
push	edx		; lpBuffer
push	eax		; hFile
mov	[esp+2Ch+Buffer], ecx
call	ebx ; WriteFile
mov	eax, [esi+4]
test	eax, eax
jbe	short loc_404096
lea	ecx, [edi+ebp+19h]
mov	[esp+18h+Buffer], ecx
jmp	short loc_40409E

loc_404096:
mov	[esp+18h+Buffer], 0

loc_40409E:
mov	eax, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	edx, [esp+20h+Buffer]
push	4		; nNumberOfBytesToWrite
push	edx		; lpBuffer
push	eax		; hFile
call	ebx ; WriteFile
mov	eax, [esi+10h]
test	eax, eax
jz	short loc_4040CA
mov	ecx, [esi+4]
add	ecx, ebp
lea	edx, [ecx+edi+19h]
mov	[esp+18h+Buffer], edx
jmp	short loc_4040D2

loc_4040CA:
mov	[esp+18h+Buffer], 0

loc_4040D2:
mov	ecx, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	eax, [esp+20h+Buffer]
push	4		; nNumberOfBytesToWrite
push	eax		; lpBuffer
push	ecx		; hFile
call	ebx ; WriteFile
mov	ecx, hFile
mov	edx, [esp+18h+var_4]
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	eax, [esp+20h+Buffer]
push	4		; nNumberOfBytesToWrite
push	eax		; lpBuffer
push	ecx		; hFile
mov	[esp+2Ch+Buffer], edx
call	ebx ; WriteFile
mov	eax, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	edx, [esp+20h+Buffer]
push	1		; nNumberOfBytesToWrite
push	edx		; lpBuffer
push	eax		; hFile
mov	[esp+2Ch+Buffer], 0
call	ebx ; WriteFile
mov	ecx, [esi+8]
mov	edx, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	edi		; nNumberOfBytesToWrite
push	ecx		; lpBuffer
push	edx		; hFile
call	ebx ; WriteFile
mov	eax, [esi+4]
mov	ecx, [esi+0Ch]
mov	edx, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	eax		; nNumberOfBytesToWrite
push	ecx		; lpBuffer
push	edx		; hFile
call	ebx ; WriteFile
mov	esi, [esi+10h]
test	esi, esi
jnz	loc_404033
mov	ebp, [esp+18h+arg_0]
mov	edi, ds:SetFilePointer

loc_404168:
mov	eax, [ebp+8]
test	eax, eax
jz	short loc_404181
mov	ecx, [esp+18h+var_4]
lea	edx, [ecx+8]
push	edx		; lDistanceToMove
push	ecx		; int
push	eax		; int
call	sub_403F40
add	esp, 0Ch

loc_404181:
mov	ebp, [ebp+0Ch]
test	ebp, ebp
jz	short loc_40419E
mov	eax, [esp+18h+var_4]
mov	ecx, [esp+18h+arg_4]
add	eax, 0Ch
push	eax		; lDistanceToMove
push	ecx		; int
push	ebp		; int
call	sub_403F40
add	esp, 0Ch

loc_40419E:
mov	ebp, [esp+18h+lDistanceToMove]
test	ebp, ebp
jbe	short loc_4041E8
mov	edx, hFile
push	1		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	0		; lDistanceToMove
push	edx		; hFile
call	edi ; SetFilePointer
mov	esi, eax
mov	eax, hFile
push	0		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	ebp		; lDistanceToMove
push	eax		; hFile
call	edi ; SetFilePointer
mov	edx, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	ecx, [esp+20h+var_4]
push	4		; nNumberOfBytesToWrite
push	ecx		; lpBuffer
push	edx		; hFile
call	ebx ; WriteFile
mov	eax, hFile
push	0		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	esi		; lDistanceToMove
push	eax		; hFile
call	edi ; SetFilePointer

loc_4041E8:
mov	ecx, dword_4106E4
pop	edi
inc	ecx
pop	esi
mov	dword_4106E4, ecx
mov	ecx, dword_4104A8
pop	ebp
pop	ebx
test	ecx, ecx
jz	short loc_40425D
mov	eax, dword_4106E4
xor	edx, edx
div	ecx
cmp	edx, dword_4104F0
jbe	short loc_40425D
mov	ecx, hDlg
push	0		; lParam
push	0		; wParam
push	405h		; Msg
push	400h		; nIDDlgItem
push	ecx		; hDlg
mov	dword_4106E4, 0
call	ds:SendDlgItemMessageA
mov	edx, hDlg
push	edx		; hWnd
call	ds:UpdateWindow
mov	eax, hDlg
push	1		; wRemoveMsg
push	6		; wMsgFilterMax
push	6		; wMsgFilterMin
push	eax		; hWnd
push	offset Msg	; lpMsg
call	ds:PeekMessageA

loc_40425D:
add	esp, 8
retn
sub_403F40 endp

align 10h



; int __cdecl sub_404270(int Buffer, int, int, LPCVOID lpBuffer, int, int)
sub_404270 proc	near

Buffer=	dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch
lpBuffer= dword	ptr  10h
arg_10=	dword ptr  14h
arg_14=	dword ptr  18h

push	ebp
mov	ebp, [esp+4+arg_4]
push	edi
mov	edi, [esp+8+Buffer]
test	edi, edi
jnz	short loc_404286
test	ebp, ebp
jz	loc_404641

loc_404286:
mov	ecx, hHeap
mov	eax, hDlg
push	esi
push	105h		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
mov	stru_4105E0.lStructSize, 4Ch
mov	stru_4105E0.hwndOwner, eax
mov	stru_4105E0.lpstrFilter, offset	aRegshotHiveFil	; "Regshot hive	files [*.hiv]"
call	ds:HeapAlloc
mov	edx, dword_4106D4
push	offset stru_4105E0 ; LPOPENFILENAMEA
mov	stru_4105E0.lpstrFile, eax
mov	stru_4105E0.nMaxFile, 208h
mov	stru_4105E0.lpstrInitialDir, edx
mov	stru_4105E0.lpstrDefExt, offset	aHiv ; "hiv"
mov	stru_4105E0.Flags, 6
call	GetSaveFileNameA
test	eax, eax
jz	loc_4045EF
mov	eax, stru_4105E0.lpstrFile
push	0		; hTemplateFile
push	80h		; dwFlagsAndAttributes
push	2		; dwCreationDisposition
push	0		; lpSecurityAttributes
push	0		; dwShareMode
push	40000000h	; dwDesiredAccess
push	eax		; lpFileName
call	ds:CreateFileA
cmp	eax, 0FFFFFFFFh
mov	hFile, eax
jz	loc_4045E0
push	ebx
call	sub_405400
call	sub_405100
mov	ecx, hFile
mov	ebx, ds:WriteFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	0Bh		; nNumberOfBytesToWrite
push	offset aRegshothive ; "REGSHOTHIVE"
push	ecx		; hFile
call	ebx ; WriteFile
mov	edx, hFile
mov	esi, ds:SetFilePointer
push	0		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	10h		; lDistanceToMove
push	edx		; hFile
mov	[esp+20h+Buffer], 200h
call	esi ; SetFilePointer
mov	ecx, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	eax, [esp+18h+Buffer]
push	4		; nNumberOfBytesToWrite
push	eax		; lpBuffer
push	ecx		; hFile
call	ebx ; WriteFile
mov	edx, hFile
push	0		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	200h		; lDistanceToMove
push	edx		; hFile
call	esi ; SetFilePointer
test	edi, edi
jz	short loc_4043A5
push	0		; lDistanceToMove
push	0		; int
push	edi		; int
call	sub_403F40
add	esp, 0Ch

loc_4043A5:
mov	eax, hFile
push	1		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	0		; lDistanceToMove
push	eax		; hFile
call	esi ; SetFilePointer
mov	ecx, hFile
push	0		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	14h		; lDistanceToMove
push	ecx		; hFile
mov	[esp+20h+Buffer], eax
call	esi ; SetFilePointer
mov	eax, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	edx, [esp+18h+Buffer]
push	4		; nNumberOfBytesToWrite
push	edx		; lpBuffer
push	eax		; hFile
call	ebx ; WriteFile
mov	ecx, [esp+10h+Buffer]
mov	edx, hFile
push	0		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	ecx		; lDistanceToMove
push	edx		; hFile
call	esi ; SetFilePointer
test	ebp, ebp
jz	short loc_4043FF
push	0		; lDistanceToMove
push	0		; int
push	ebp		; int
call	sub_403F40
add	esp, 0Ch

loc_4043FF:
mov	edi, [esp+10h+arg_8]
test	edi, edi
jz	loc_40451B
mov	eax, hFile
push	1		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	0		; lDistanceToMove
push	eax		; hFile
call	esi ; SetFilePointer
mov	ecx, hFile
push	0		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	18h		; lDistanceToMove
push	ecx		; hFile
mov	[esp+20h+Buffer], eax
call	esi ; SetFilePointer
mov	eax, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	edx, [esp+18h+Buffer]
push	4		; nNumberOfBytesToWrite
push	edx		; lpBuffer
push	eax		; hFile
call	ebx ; WriteFile
mov	ecx, [esp+10h+Buffer]
mov	edx, hFile
push	0		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	ecx		; lDistanceToMove
push	edx		; hFile

loc_404452:
call	esi ; SetFilePointer
mov	eax, hFile
push	1		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	0		; lDistanceToMove
push	eax		; hFile
call	esi ; SetFilePointer
mov	ecx, hFile
push	1		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	4		; lDistanceToMove
push	ecx		; hFile
mov	[esp+20h+Buffer], eax
call	esi ; SetFilePointer
mov	edx, [esp+10h+Buffer]
mov	ecx, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	eax, [esp+18h+arg_4]
push	4		; nNumberOfBytesToWrite
add	edx, 8
push	eax		; lpBuffer
push	ecx		; hFile
mov	[esp+24h+arg_4], edx
call	ebx ; WriteFile
mov	edx, [edi+4]
push	0		; lDistanceToMove
push	0		; int
push	edx		; Buffer
call	sub_4016B0
mov	eax, hFile
add	esp, 0Ch
push	1		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	0		; lDistanceToMove
push	eax		; hFile
call	esi ; SetFilePointer
mov	ecx, [esp+10h+Buffer]
mov	edx, hFile
push	0		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	ecx		; lDistanceToMove
push	edx		; hFile
mov	[esp+20h+arg_4], eax
call	esi ; SetFilePointer
mov	edi, [edi]
test	edi, edi
jz	short loc_4044FC
mov	ecx, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	eax, [esp+18h+arg_4]
push	4		; nNumberOfBytesToWrite
push	eax		; lpBuffer
push	ecx		; hFile
call	ebx ; WriteFile
mov	edx, [esp+10h+arg_4]
mov	eax, hFile
push	0
push	0
push	edx
push	eax
jmp	loc_404452

loc_4044FC:
mov	edx, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
lea	ecx, [esp+18h+arg_4]
push	4		; nNumberOfBytesToWrite
push	ecx		; lpBuffer
push	edx		; hFile
mov	[esp+24h+arg_4], 0
call	ebx ; WriteFile

loc_40451B:
mov	eax, hFile
push	0		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	20h		; lDistanceToMove
push	eax		; hFile
call	esi ; SetFilePointer
mov	edx, [esp+10h+lpBuffer]
or	ecx, 0FFFFFFFFh
mov	edi, edx
xor	eax, eax
repne scasb
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
not	ecx
push	ecx		; nNumberOfBytesToWrite
mov	ecx, hFile
push	edx		; lpBuffer
push	ecx		; hFile
call	ebx ; WriteFile
mov	edx, hFile
push	0		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	60h		; lDistanceToMove
push	edx		; hFile
call	esi ; SetFilePointer
mov	edx, [esp+10h+arg_10]
or	ecx, 0FFFFFFFFh
mov	edi, edx
xor	eax, eax
repne scasb
mov	eax, hFile
push	0		; lpOverlapped
not	ecx
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	ecx		; nNumberOfBytesToWrite
push	edx		; lpBuffer
push	eax		; hFile
call	ebx ; WriteFile
mov	ecx, hFile
push	0		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	0A0h		; lDistanceToMove
push	ecx		; hFile
call	esi ; SetFilePointer
mov	edx, [esp+10h+arg_14]
mov	eax, hFile
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesWritten
push	10h		; nNumberOfBytesToWrite
push	edx		; lpBuffer
push	eax		; hFile
call	ebx ; WriteFile
mov	ecx, hDlg
push	0		; nCmdShow
push	400h		; nIDDlgItem
push	ecx		; hDlg
call	ds:GetDlgItem
push	eax		; hWnd
call	ds:ShowWindow
mov	edx, hCursor
push	edx		; hCursor
call	ds:SetCursor
push	0FFFFFFFFh	; uType
call	ds:MessageBeep
mov	eax, hFile
push	eax		; hObject
call	ds:CloseHandle
pop	ebx
jmp	short loc_4045EF

loc_4045E0:
mov	ecx, lpText
push	ecx		; lpText
call	sub_401FD0
add	esp, 4

loc_4045EF:
mov	edx, dword ptr stru_4105E0.nFileOffset
mov	eax, stru_4105E0.lpstrFile
and	edx, 0FFFFh
or	ecx, 0FFFFFFFFh
mov	byte ptr [edx+eax], 0
mov	edi, stru_4105E0.lpstrFile
xor	eax, eax
repne scasb
not	ecx
sub	edi, ecx
mov	edx, ecx
mov	esi, edi
mov	edi, dword_4106D4
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	eax, stru_4105E0.lpstrFile
mov	ecx, hHeap
push	eax		; lpMem
push	1		; dwFlags
push	ecx		; hHeap
call	ds:HeapFree
pop	esi

loc_404641:
pop	edi
pop	ebp
retn
sub_404270 endp

align 10h



sub_404650 proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	esi
mov	esi, [esp+4+arg_4]
push	edi
mov	edi, [esp+8+arg_0]

loc_40465A:
mov	eax, [edi]
test	eax, eax
jz	short loc_404664
add	eax, esi
mov	[edi], eax

loc_404664:
lea	edx, [edi+4]
mov	eax, edx
mov	ecx, [eax]
test	ecx, ecx
jz	short loc_404673
add	ecx, esi
mov	[eax], ecx

loc_404673:
mov	ecx, [eax+4]
add	eax, 4
test	ecx, ecx
jz	short loc_404681
add	ecx, esi
mov	[eax], ecx

loc_404681:
mov	ecx, [eax+4]
add	eax, 4
test	ecx, ecx
jz	short loc_40468F
add	ecx, esi
mov	[eax], ecx

loc_40468F:
mov	ecx, [eax+4]
add	eax, 4
test	ecx, ecx
jz	short loc_40469D
add	ecx, esi
mov	[eax], ecx

loc_40469D:
mov	ecx, dword_4104A8
inc	ecx
mov	dword_4104A8, ecx
mov	edx, [edx]
test	edx, edx
jz	short loc_4046EF

loc_4046B0:
mov	ecx, [edx+8]
lea	eax, [edx+8]
test	ecx, ecx
jz	short loc_4046BE
add	ecx, esi
mov	[eax], ecx

loc_4046BE:
mov	ecx, [eax+4]
add	eax, 4
test	ecx, ecx
jz	short loc_4046CC
add	ecx, esi
mov	[eax], ecx

loc_4046CC:
mov	ecx, [eax+4]
add	eax, 4
test	ecx, ecx
jz	short loc_4046DA
add	ecx, esi
mov	[eax], ecx

loc_4046DA:
mov	ecx, [eax+4]
add	eax, 4
test	ecx, ecx
jz	short loc_4046E8
add	ecx, esi
mov	[eax], ecx

loc_4046E8:
mov	edx, [edx+10h]
test	edx, edx
jnz	short loc_4046B0

loc_4046EF:
mov	eax, [edi+8]
test	eax, eax
jz	short loc_404700
push	esi
push	eax
call	sub_404650
add	esp, 8

loc_404700:
mov	eax, [edi+0Ch]
test	eax, eax
jz	short loc_40470E
mov	edi, eax
jmp	loc_40465A

loc_40470E:
pop	edi
pop	esi
retn
sub_404650 endp

align 10h



sub_404720 proc	near

Buffer=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch
arg_C= dword ptr  10h

sub	esp, 10h
mov	ecx, hHeap
mov	eax, hDlg
push	ebx
push	esi
mov	esi, ds:HeapAlloc
push	edi
push	105h		; dwBytes
xor	ebx, ebx
push	9		; dwFlags
push	ecx		; hHeap
mov	[esp+28h+Buffer], ebx
mov	stru_4105E0.lStructSize, 4Ch
mov	stru_4105E0.hwndOwner, eax
mov	stru_4105E0.lpstrFilter, offset	aRegshotHiveFil	; "Regshot hive	files [*.hiv]"
call	esi ; HeapAlloc
mov	edx, dword_4106E0
push	offset stru_4105E0 ; LPOPENFILENAMEA
mov	stru_4105E0.lpstrFile, eax
mov	stru_4105E0.nMaxFile, 208h
mov	stru_4105E0.lpstrInitialDir, edx
mov	stru_4105E0.Flags, 1004h
mov	stru_4105E0.lpstrDefExt, offset	aHiv ; "hiv"
call	GetOpenFileNameA
test	eax, eax
jz	loc_404BA7
mov	eax, stru_4105E0.lpstrFile
push	ebx		; hTemplateFile
push	80h		; dwFlagsAndAttributes
push	3		; dwCreationDisposition
push	ebx		; lpSecurityAttributes
push	1		; dwShareMode
push	80000000h	; dwDesiredAccess
push	eax		; lpFileName
call	ds:CreateFileA
cmp	eax, 0FFFFFFFFh
mov	hFile, eax
jz	loc_404B98
mov	ecx, hHeap
push	ebp
push	10h		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
call	esi ; HeapAlloc
mov	ebp, [esp+20h+arg_C]
push	ebx		; lpOverlapped
mov	ebx, ds:ReadFile
push	offset NumberOfBytesWritten ; lpNumberOfBytesRead
mov	[ebp+0], eax
mov	edx, hFile
push	10h		; nNumberOfBytesToRead
push	eax		; lpBuffer
push	edx		; hFile
call	ebx ; ReadFile
mov	esi, [ebp+0]
mov	eax, offset aRegshothive ; "REGSHOTHIVE"

loc_404800:
mov	dl, [eax]
mov	cl, dl
cmp	dl, [esi]
jnz	short loc_404824
test	cl, cl
jz	short loc_404820
mov	dl, [eax+1]
mov	cl, dl
cmp	dl, [esi+1]
jnz	short loc_404824
add	eax, 2
add	esi, 2
test	cl, cl
jnz	short loc_404800

loc_404820:
xor	eax, eax
jmp	short loc_404829

loc_404824:
sbb	eax, eax
sbb	eax, 0FFFFFFFFh

loc_404829:
xor	esi, esi
cmp	eax, esi
jz	short loc_404851
push	offset aItIsNotAValidR ; "It is	not a valid Regshot hive file!"
call	sub_401FD0
mov	ecx, hFile
add	esp, 4
xor	ebx, ebx
push	ecx		; hObject
call	ds:CloseHandle
pop	ebp
jmp	loc_404BA7

loc_404851:
mov	eax, dword_410504
mov	dword_4104A8, esi
cmp	eax, esi
mov	dword_4104FC, esi
jz	short loc_40486D
push	3EBh
jmp	short loc_404872

loc_40486D:		; nIDDlgItem
push	3ECh

loc_404872:
call	sub_4052B0
mov	eax, hFile
add	esp, 4
push	esi		; lpFileSizeHigh
push	eax		; hFile
call	ds:GetFileSize
mov	ecx, [ebp+0]
mov	edx, hHeap
push	ecx		; lpMem
push	1		; dwFlags
push	edx		; hHeap
mov	edi, eax
call	ds:HeapFree
mov	eax, hHeap
push	edi		; dwBytes
push	1		; dwFlags
push	eax		; hHeap
call	ds:HeapAlloc
mov	esi, eax
push	0		; lpOverlapped
mov	[ebp+0], esi
mov	edx, hFile
push	offset NumberOfBytesWritten ; lpNumberOfBytesRead
lea	ecx, [esp+28h+Buffer]
push	4		; nNumberOfBytesToRead
push	ecx		; lpBuffer
push	edx		; hFile
call	ebx ; ReadFile
mov	eax, [esp+20h+Buffer]
mov	edx, [esp+20h+arg_0]
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesRead
lea	ecx, [esi+eax]
lea	eax, [esp+28h+Buffer]
mov	[edx], ecx
mov	ecx, hFile
push	4		; nNumberOfBytesToRead
push	eax		; lpBuffer
push	ecx		; hFile
call	ebx ; ReadFile
mov	edx, [esp+20h+Buffer]
mov	ecx, [esp+20h+arg_4]
push	0		; lpOverlapped
push	offset NumberOfBytesWritten ; lpNumberOfBytesRead
lea	eax, [esi+edx]
lea	edx, [esp+28h+Buffer]
mov	[ecx], eax
mov	eax, hFile
push	4		; nNumberOfBytesToRead
push	edx		; lpBuffer
push	eax		; hFile
call	ebx ; ReadFile
mov	eax, [esp+20h+Buffer]
test	eax, eax
jnz	short loc_40491E
mov	ecx, [esp+20h+arg_8]
mov	[ecx], eax
jmp	short loc_404927

loc_40491E:
lea	edx, [esi+eax]
mov	eax, [esp+20h+arg_8]
mov	[eax], edx

loc_404927:
mov	ecx, hFile
push	0		; dwMoveMethod
push	0		; lpDistanceToMoveHigh
push	0		; lDistanceToMove
push	ecx		; hFile
call	ds:SetFilePointer
call	sub_405100
mov	ecx, edi
mov	eax, 51EB851Fh
shr	ecx, 0Dh
mul	ecx
shr	edx, 5
mov	[esp+20h+var_4], ecx
mov	dword_4106F8, edx
mov	[esp+20h+var_C], 0
xor	ebx, ebx
mov	[esp+20h+var_8], edi

loc_404966:
cmp	edi, 2000h
mov	ebp, 2000h
jnb	short loc_404975
mov	ebp, edi

loc_404975:
mov	edi, [esp+20h+arg_C]
mov	ecx, [esp+20h+var_C]
mov	eax, hFile
push	0		; lpOverlapped
mov	edx, [edi]
push	offset NumberOfBytesWritten ; lpNumberOfBytesRead
add	edx, ecx
push	ebp		; nNumberOfBytesToRead
push	edx		; lpBuffer
push	eax		; hFile
call	ds:ReadFile
cmp	NumberOfBytesWritten, ebp
jnz	short loc_404A11
mov	eax, [esp+20h+var_8]
sub	eax, ebp
mov	[esp+20h+var_8], eax
jz	short loc_404A1E
mov	eax, ebx
xor	edx, edx
div	[esp+20h+var_4]
cmp	edx, dword_4106F8
jbe	short loc_4049F9
mov	ecx, hDlg
xor	ebx, ebx
push	ebx		; lParam
push	ebx		; wParam
push	405h		; Msg
push	400h		; nIDDlgItem
push	ecx		; hDlg
call	ds:SendDlgItemMessageA
mov	edx, hDlg
push	edx		; hWnd
call	ds:UpdateWindow
mov	eax, hDlg
push	1		; wRemoveMsg
push	6		; wMsgFilterMax
push	6		; wMsgFilterMin
push	eax		; hWnd
push	offset Msg	; lpMsg
call	ds:PeekMessageA

loc_4049F9:
mov	ecx, [esp+20h+var_C]
mov	edi, [esp+20h+var_8]
add	ecx, 2000h
inc	ebx
mov	[esp+20h+var_C], ecx
jmp	loc_404966

loc_404A11:		; "Reading ERROR!"
push	offset aReadingError
call	sub_401FD0
add	esp, 4

loc_404A1E:
mov	ecx, hDlg
mov	ebp, ds:GetDlgItem
push	0		; nCmdShow
push	400h		; nIDDlgItem
push	ecx		; hDlg
call	ebp ; GetDlgItem
push	eax		; hWnd
call	ds:ShowWindow
mov	edx, [esp+20h+arg_0]
push	esi
mov	eax, [edx]
push	eax
call	sub_404650
mov	ecx, [esp+28h+arg_4]
push	esi
mov	edx, [ecx]
push	edx
call	sub_404650
mov	ebx, [esp+30h+arg_8]
add	esp, 10h
cmp	dword ptr [ebx], 0
jz	short loc_404AC8
mov	eax, hDlg
push	0		; lParam
push	1		; wParam
push	0F1h		; Msg
push	3F7h		; nIDDlgItem
push	eax		; hDlg
call	ebp ; GetDlgItem
mov	ebp, ds:SendMessageA
push	eax		; hWnd
call	ebp ; SendMessageA
mov	ecx, hDlg
push	0		; lParam
push	3F7h		; wParam
push	111h		; Msg
push	ecx		; hWnd
call	ebp ; SendMessageA
mov	edx, [ebx]
push	esi
push	edx
call	sub_4018F0
mov	eax, dword_4105BC
mov	ecx, [ebx]
push	30Ch
push	eax
push	ecx
call	sub_401970
mov	edx, dword_4105BC
mov	eax, hDlg
add	esp, 14h
push	edx
push	403h
push	eax
jmp	short loc_404AD9

loc_404AC8:
mov	ecx, hDlg
push	offset String	; lpString
push	403h		; nIDDlgItem
push	ecx		; hDlg

loc_404AD9:
call	ds:SetDlgItemTextA
mov	eax, dword_410504
mov	esi, [edi]
test	eax, eax
jz	short loc_404B35
mov	edi, dword_4104C4
mov	eax, [esp+20h+arg_C]
add	esi, 20h
mov	ecx, 10h
rep movsd
mov	esi, [eax]
mov	edi, dword_4106BC
add	esi, 60h
mov	ecx, 10h
rep movsd
mov	edx, [eax]
mov	eax, lpSystemTime
add	edx, 0A0h
mov	ecx, [edx]
mov	[eax], ecx
mov	ecx, [edx+4]
mov	[eax+4], ecx
mov	ecx, [edx+8]
mov	[eax+8], ecx
mov	edx, [edx+0Ch]
mov	[eax+0Ch], edx
jmp	short loc_404B7E

loc_404B35:
mov	edi, dword_4104CC
mov	eax, [esp+20h+arg_C]
add	esi, 20h
mov	ecx, 10h
rep movsd
mov	esi, [eax]
mov	edi, dword_4106B8
add	esi, 60h
mov	ecx, 10h
rep movsd
mov	eax, [eax]
mov	ecx, dword_410574
add	eax, 0A0h
mov	edx, [eax]
mov	[ecx], edx
mov	edx, [eax+4]
mov	[ecx+4], edx
mov	edx, [eax+8]
mov	[ecx+8], edx
mov	eax, [eax+0Ch]
mov	[ecx+0Ch], eax

loc_404B7E:
call	sub_405360
mov	ecx, hFile
mov	ebx, 1
push	ecx		; hObject
call	ds:CloseHandle
pop	ebp
jmp	short loc_404BA7

loc_404B98:
mov	edx, dword_41043C
push	edx		; lpText
call	sub_401FD0
add	esp, 4

loc_404BA7:
mov	eax, dword ptr stru_4105E0.nFileOffset
mov	ecx, stru_4105E0.lpstrFile
and	eax, 0FFFFh
mov	byte ptr [eax+ecx], 0
mov	edi, stru_4105E0.lpstrFile
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
not	ecx
sub	edi, ecx
mov	edx, ecx
mov	esi, edi
mov	edi, dword_4106E0
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	eax, stru_4105E0.lpstrFile
mov	ecx, hHeap
push	eax		; lpMem
push	1		; dwFlags
push	ecx		; hHeap
call	ds:HeapFree
pop	edi
mov	eax, ebx
pop	esi
pop	ebx
add	esp, 10h
retn
sub_404720 endp




; int __cdecl sub_404C00(HWND hWnd)
sub_404C00 proc	near

var_4= dword ptr -4
hWnd= dword ptr	 4

push	ecx
mov	eax, hHeap
push	ebx
push	ebp
push	esi
mov	esi, ds:HeapAlloc
push	edi
push	14h		; dwBytes
push	1		; dwFlags
push	eax		; hHeap
call	esi ; HeapAlloc
mov	ecx, hHeap
push	190h		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
mov	dword_410568, eax
call	esi ; HeapAlloc
mov	edx, hHeap
push	0FFFFh		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
mov	dword_410524, eax
call	esi ; HeapAlloc
mov	ecx, dword_410508
mov	edx, off_40D844
mov	ebx, ds:GetPrivateProfileSectionA
push	ecx		; lpFileName
push	0FFFFh		; nSize
push	eax		; lpReturnedString
push	edx		; lpAppName
mov	dword_4106AC, eax
call	ebx ; GetPrivateProfileSectionA
test	eax, eax
jbe	short loc_404CB2
xor	edi, edi

loc_404C68:
mov	eax, dword_410568
push	offset asc_40D470 ; "="
push	edi
push	offset aDS	; "%d%s"
push	eax		; char *
call	_sprintf
mov	ecx, dword_410568
mov	edx, dword_4106AC
push	0FFFFh
push	ecx
push	edx
call	sub_402070
add	esp, 1Ch
mov	dword_4104AC, eax
test	eax, eax
jz	short loc_404CB2
mov	ecx, dword_410524
inc	edi
cmp	edi, 63h
mov	[ecx+edi*4-4], eax
jl	short loc_404C68

loc_404CB2:
mov	edx, hHeap
push	190h		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
call	esi ; HeapAlloc
mov	dword_4106B4, eax
mov	eax, hHeap
push	0FFFFh		; dwBytes
push	9		; dwFlags
push	eax		; hHeap
call	esi ; HeapAlloc
mov	ecx, dword_410508
mov	edx, off_40D848
push	ecx		; lpFileName
push	0FFFFh		; nSize
push	eax		; lpReturnedString
push	edx		; lpAppName
mov	dword_41055C, eax
call	ebx ; GetPrivateProfileSectionA
test	eax, eax
jz	short loc_404D41
xor	esi, esi

loc_404CF7:
mov	eax, dword_410568
push	offset asc_40D470 ; "="
push	esi
push	offset aDS	; "%d%s"
push	eax		; char *
call	_sprintf
mov	ecx, dword_410568
mov	edx, dword_41055C
push	0FFFFh
push	ecx
push	edx
call	sub_402070
add	esp, 1Ch
mov	dword_4104AC, eax
test	eax, eax
jz	short loc_404D41
mov	ecx, dword_4106B4
inc	esi
cmp	esi, 63h
mov	[ecx+esi*4-4], eax
jl	short loc_404CF7

loc_404D41:
mov	edx, dword_410508
mov	eax, lpKeyName
mov	ecx, off_40D834
push	edx		; lpFileName
push	1		; nDefault
push	eax		; lpKeyName
push	ecx		; lpAppName
call	ds:GetPrivateProfileIntA
mov	bl, al
mov	edi, [esp+14h+hWnd]
mov	byte ptr [esp+14h+var_4], bl
mov	ebp, ds:GetDlgItem
mov	esi, [esp+14h+var_4]
push	0		; lParam
and	esi, 0FFh
mov	edx, esi
and	edx, 1
push	edx		; wParam
push	0F1h		; Msg
push	3F5h		; nIDDlgItem
push	edi		; hDlg
call	ebp ; GetDlgItem
push	eax		; hWnd
call	ds:SendMessageA
not	bl
and	ebx, 1
push	0		; lParam
push	ebx		; wParam
push	0F1h		; Msg
push	3F6h		; nIDDlgItem
push	edi		; hDlg
call	ebp ; GetDlgItem
mov	ebx, ds:SendMessageA
push	eax		; hWnd
call	ebx ; SendMessageA
shr	esi, 1
and	esi, 1
push	0		; lParam
push	esi		; wParam
push	0F1h		; Msg
push	3F7h		; nIDDlgItem
push	edi		; hDlg
call	ebp ; GetDlgItem
push	eax		; hWnd
call	ebx ; SendMessageA
mov	eax, dword_410508
mov	ecx, off_40D84C
mov	edx, off_40D834
push	eax		; lpFileName
push	0		; nDefault
push	ecx		; lpKeyName
push	edx		; lpAppName
call	ds:GetPrivateProfileIntA
neg	eax
mov	ecx, dword_4105BC
mov	edx, off_40D83C
sbb	eax, eax
mov	esi, ds:GetPrivateProfileStringA
neg	eax
mov	dword_410520, eax
mov	eax, dword_410508
push	eax		; lpFileName
mov	eax, off_40D834
push	104h		; nSize
push	ecx		; lpReturnedString
push	0		; lpDefault
push	edx		; lpKeyName
push	eax		; lpAppName
call	esi ; GetPrivateProfileStringA
test	eax, eax
jz	short loc_404E26
mov	ecx, dword_4105BC
push	ecx
jmp	short loc_404E2D

loc_404E26:
mov	edx, dword_41069C
push	edx		; lpString

loc_404E2D:
mov	ebp, ds:SetDlgItemTextA
push	403h		; nIDDlgItem
push	edi		; hDlg
call	ebp ; SetDlgItemTextA
mov	eax, dword_410508
mov	ecx, lpString
mov	edx, off_40D840
push	eax		; lpFileName
mov	eax, off_40D834
push	104h		; nSize
push	ecx		; lpReturnedString
push	0		; lpDefault
push	edx		; lpKeyName
push	eax		; lpAppName
call	esi ; GetPrivateProfileStringA
test	eax, eax
jz	short loc_404E6B
mov	ecx, lpString
push	ecx
jmp	short loc_404E72

loc_404E6B:
mov	edx, dword_410630
push	edx		; lpString

loc_404E72:		; nIDDlgItem
push	402h
push	edi		; hDlg
call	ebp ; SetDlgItemTextA
push	0		; lParam
push	3F7h		; wParam
push	111h		; Msg
push	edi		; hWnd
call	ebx ; SendMessageA
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
pop	ecx
retn
sub_404C00 endp

align 10h



; int __cdecl sub_404EA0(HWND hDlg)
sub_404EA0 proc	near

hDlg= dword ptr	 4

mov	eax, dword_410508
push	0		; hTemplateFile
push	80h		; dwFlagsAndAttributes
push	3		; dwCreationDisposition
push	0		; lpSecurityAttributes
push	3		; dwShareMode
push	0C0000000h	; dwDesiredAccess
push	eax		; lpFileName
call	ds:CreateFileA
cmp	eax, 0FFFFFFFFh
jnz	short loc_404EC6
xor	eax, eax
retn

loc_404EC6:
push	ebx
push	ebp
push	esi
push	edi
push	eax		; hObject
call	ds:CloseHandle
mov	edi, [esp+10h+hDlg]
mov	esi, ds:GetDlgItem
push	0		; lParam
push	0		; wParam
push	0F0h		; Msg
push	3F7h		; nIDDlgItem
push	edi		; hDlg
call	esi ; GetDlgItem
mov	ebp, ds:SendMessageA
push	eax		; hWnd
call	ebp ; SendMessageA
push	0		; lParam
push	0		; wParam
push	0F0h		; Msg
mov	ebx, eax
push	3F5h		; nIDDlgItem
push	edi		; hDlg
shl	bl, 1
call	esi ; GetDlgItem
push	eax		; hWnd
call	ebp ; SendMessageA
mov	ecx, hHeap
push	30Eh		; dwBytes
or	bl, al
push	9		; dwFlags
push	ecx		; hHeap
mov	byte ptr [esp+1Ch+hDlg], bl
call	ds:HeapAlloc
mov	edx, [esp+10h+hDlg]
mov	esi, eax
and	edx, 0FFh
push	edx
push	offset aD	; "%d"
push	esi		; char *
call	_sprintf
mov	eax, dword_410508
mov	ecx, lpKeyName
mov	edx, off_40D834
mov	ebx, ds:WritePrivateProfileStringA
add	esp, 0Ch
push	eax		; lpFileName
push	esi		; lpString
push	ecx		; lpKeyName
push	edx		; lpAppName
call	ebx ; WritePrivateProfileStringA
mov	eax, dword_410520
push	eax
push	offset aD	; "%d"
push	esi		; char *
call	_sprintf
mov	ecx, dword_410508
mov	edx, off_40D84C
mov	eax, off_40D834
add	esp, 0Ch
push	ecx		; lpFileName
push	esi		; lpString
push	edx		; lpKeyName
push	eax		; lpAppName
call	ebx ; WritePrivateProfileStringA
mov	ebp, ds:GetDlgItemTextA
push	30Eh		; cchMax
push	esi		; lpString
push	403h		; nIDDlgItem
push	edi		; hDlg
call	ebp ; GetDlgItemTextA
test	eax, eax
jz	short loc_404FB9
mov	ecx, dword_410508
mov	edx, off_40D83C
mov	eax, off_40D834
push	ecx		; lpFileName
push	esi		; lpString
push	edx		; lpKeyName
push	eax		; lpAppName
call	ebx ; WritePrivateProfileStringA

loc_404FB9:		; cchMax
push	104h
push	esi		; lpString
push	402h		; nIDDlgItem
push	edi		; hDlg
call	ebp ; GetDlgItemTextA
test	eax, eax
jz	short loc_404FE2
mov	ecx, dword_410508
mov	edx, off_40D840
mov	eax, off_40D834
push	ecx		; lpFileName
push	esi		; lpString
push	edx		; lpKeyName
push	eax		; lpAppName
call	ebx ; WritePrivateProfileStringA

loc_404FE2:
mov	ecx, hHeap
push	esi		; lpMem
mov	esi, ds:HeapFree
push	1		; dwFlags
push	ecx		; hHeap
call	esi ; HeapFree
mov	edx, dword_410508
mov	eax, hHeap
push	edx		; lpMem
push	1		; dwFlags
push	eax		; hHeap
call	esi ; HeapFree
mov	ecx, dword_4106AC
mov	edx, hHeap
push	ecx		; lpMem
push	1		; dwFlags
push	edx		; hHeap
call	esi ; HeapFree
mov	eax, dword_41055C
mov	ecx, hHeap
push	eax		; lpMem
push	1		; dwFlags
push	ecx		; hHeap
call	esi ; HeapFree
mov	edx, dword_410568
mov	eax, hHeap
push	edx		; lpMem
push	1		; dwFlags
push	eax		; hHeap
call	esi ; HeapFree
mov	ecx, dword_4104AC
mov	edx, hHeap
push	ecx		; lpMem
push	1		; dwFlags
push	edx		; hHeap
call	esi ; HeapFree
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn
sub_404EA0 endp

align 10h



; int __cdecl sub_405060(char *, int)
sub_405060 proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	ebx
push	esi
mov	esi, [esp+8+arg_4]
push	edi
xor	edi, edi
cmp	dword ptr [esi], 0
jz	short loc_405092
mov	ebx, [esp+0Ch+arg_0]

loc_405072:
cmp	edi, 63h
jg	short loc_405092
mov	eax, [esi]
push	eax		; char *
push	ebx		; char *
call	__strcmpi
add	esp, 8
test	eax, eax
jz	short loc_405098
mov	eax, [esi+4]
add	esi, 4
inc	edi
test	eax, eax
jnz	short loc_405072

loc_405092:
pop	edi
pop	esi
xor	eax, eax
pop	ebx
retn

loc_405098:
pop	edi
pop	esi
mov	eax, 1
pop	ebx
retn
sub_405060 endp

align 10h



; int __cdecl sub_4050B0(int nCmdShow)
sub_4050B0 proc	near

nCmdShow= dword	ptr  4

mov	eax, hDlg
push	ebx
push	esi
mov	esi, [esp+8+nCmdShow]
push	edi
mov	edi, ds:GetDlgItem
push	esi		; nCmdShow
push	404h		; nIDDlgItem
push	eax		; hDlg
call	edi ; GetDlgItem
mov	ebx, ds:ShowWindow
push	eax		; hWnd
call	ebx ; ShowWindow
mov	ecx, hDlg
push	esi		; nCmdShow
push	405h		; nIDDlgItem
push	ecx		; hDlg
call	edi ; GetDlgItem
push	eax		; hWnd
call	ebx ; ShowWindow
mov	edx, hDlg
push	esi		; nCmdShow
push	406h		; nIDDlgItem
push	edx		; hDlg
call	edi ; GetDlgItem
push	eax		; hWnd
call	ebx ; ShowWindow
pop	edi
pop	esi
pop	ebx
retn
sub_4050B0 endp

align 10h



sub_405100 proc	near
mov	eax, 51EB851Fh
push	esi
mul	dword_4104A8
shr	edx, 5
mov	eax, 51EB851Fh
mov	dword_4104F0, edx
mul	dword_4104FC
shr	edx, 5
push	0		; nCmdShow
mov	dword_4106E4, 0
mov	dword_41059C, 0
mov	dword_4106F8, edx
call	sub_4050B0
mov	eax, hDlg
mov	esi, ds:SendDlgItemMessageA
add	esp, 4
push	640000h		; lParam
push	0		; wParam
push	401h		; Msg
push	400h		; nIDDlgItem
push	eax		; hDlg
call	esi ; SendDlgItemMessageA
mov	ecx, hDlg
push	0		; lParam
push	0		; wParam
push	402h		; Msg
push	400h		; nIDDlgItem
push	ecx		; hDlg
call	esi ; SendDlgItemMessageA
mov	edx, hDlg
push	0		; lParam
push	1		; wParam
push	404h		; Msg
push	400h		; nIDDlgItem
push	edx		; hDlg
call	esi ; SendDlgItemMessageA
mov	eax, hDlg
push	5		; nCmdShow
push	400h		; nIDDlgItem
push	eax		; hDlg
call	ds:GetDlgItem
push	eax		; hWnd
call	ds:ShowWindow
pop	esi
retn
sub_405100 endp




sub_4051B0 proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch
arg_C= dword ptr  10h

mov	ecx, dword_4104B0
mov	edx, dword_4104D8
mov	dword_4104E4, ecx
sub	ecx, edx
push	esi
mov	eax, ecx
xor	edx, edx
mov	esi, 3E8h
div	esi
push	offset aMs	; "ms"
mov	eax, 10624DD3h
push	edx
mul	ecx
mov	eax, dword_410490
mov	ecx, lParam
shr	edx, 6
push	offset aS	; "s"
push	edx
push	eax
push	offset aSDSDS	; "%s%d%s%d%s"
push	ecx		; char *
call	_sprintf
mov	edx, lParam
mov	eax, hDlg
mov	esi, ds:SendDlgItemMessageA
add	esp, 1Ch
push	edx		; lParam
push	0		; wParam
push	0Ch		; Msg
push	406h		; nIDDlgItem
push	eax		; hDlg
call	esi ; SendDlgItemMessageA
mov	ecx, [esp+4+arg_8]
mov	edx, [esp+4+arg_0]
mov	eax, lParam
push	ecx
push	edx
push	offset aSD	; "%s%d"
push	eax		; char *
call	_sprintf
mov	ecx, lParam
mov	edx, hDlg
add	esp, 10h
push	ecx		; lParam
push	0		; wParam
push	0Ch		; Msg
push	404h		; nIDDlgItem
push	edx		; hDlg
call	esi ; SendDlgItemMessageA
mov	eax, [esp+4+arg_C]
mov	ecx, [esp+4+arg_4]
mov	edx, lParam
push	eax
push	ecx
push	offset aSD	; "%s%d"
push	edx		; char *
call	_sprintf
mov	eax, lParam
mov	ecx, hDlg
add	esp, 10h
push	eax		; lParam
push	0		; wParam
push	0Ch		; Msg
push	405h		; nIDDlgItem
push	ecx		; hDlg
call	esi ; SendDlgItemMessageA
mov	edx, hDlg
push	edx		; hWnd
call	ds:UpdateWindow
mov	eax, hDlg
push	1		; wRemoveMsg
push	6		; wMsgFilterMax
push	6		; wMsgFilterMin
push	eax		; hWnd
push	offset Msg	; lpMsg
call	ds:PeekMessageA
pop	esi
retn
sub_4051B0 endp




; int __cdecl sub_4052B0(int nIDDlgItem)
sub_4052B0 proc	near

nIDDlgItem= dword ptr  4

push	esi
push	7F02h		; lpCursorName
push	0		; hInstance
call	ds:LoadCursorA
push	eax		; hCursor
mov	dword_4104D0, eax
call	ds:SetCursor
mov	ecx, hDlg
mov	hCursor, eax
mov	eax, [esp+4+nIDDlgItem]
push	0		; bEnable
push	eax		; nIDDlgItem
push	ecx		; hDlg
call	ds:GetDlgItem
push	eax		; hWnd
call	ds:EnableWindow
mov	edx, lParam
mov	ax, word_40D8DC
mov	esi, ds:SendDlgItemMessageA
mov	[edx], ax
mov	ecx, lParam
mov	edx, hDlg
push	ecx		; lParam
push	0		; wParam
push	0Ch		; Msg
push	404h		; nIDDlgItem
push	edx		; hDlg
call	esi ; SendDlgItemMessageA
mov	eax, lParam
mov	ecx, hDlg
push	eax		; lParam
push	0		; wParam
push	0Ch		; Msg
push	405h		; nIDDlgItem
push	ecx		; hDlg
call	esi ; SendDlgItemMessageA
mov	edx, lParam
mov	eax, hDlg
push	edx		; lParam
push	0		; wParam
push	0Ch		; Msg
push	406h		; nIDDlgItem
push	eax		; hDlg
call	esi ; SendDlgItemMessageA
push	5		; nCmdShow
call	sub_4050B0
add	esp, 4
pop	esi
retn
sub_4052B0 endp

align 10h



sub_405360 proc	near
mov	eax, dword_4106A4
push	ebx
push	esi
push	edi
test	eax, eax
jnz	short loc_405373
mov	esi, 3EBh
jmp	short loc_405387

loc_405373:
mov	edx, dword_4106A8
xor	eax, eax
test	edx, edx
setnz	al
add	eax, 3ECh
mov	esi, eax

loc_405387:
mov	ecx, hDlg
mov	edi, ds:GetDlgItem
push	1		; bEnable
push	3EEh		; nIDDlgItem
push	ecx		; hDlg
call	edi ; GetDlgItem
mov	ebx, ds:EnableWindow
push	eax		; hWnd
call	ebx ; EnableWindow
mov	edx, hDlg
push	1		; bEnable
push	esi		; nIDDlgItem
push	edx		; hDlg
call	edi ; GetDlgItem
push	eax		; hWnd
call	ebx ; EnableWindow
mov	eax, hDlg
push	0		; lParam
push	esi		; wParam
push	401h		; Msg
push	eax		; hWnd
call	ds:SendMessageA
mov	ecx, hDlg
push	esi		; nIDDlgItem
push	ecx		; hDlg
call	edi ; GetDlgItem
push	eax		; hWnd
call	ds:SetFocus
mov	edx, hCursor
push	edx		; hCursor
call	ds:SetCursor
push	0FFFFFFFFh	; uType
call	ds:MessageBeep
pop	edi
pop	esi
pop	ebx
retn
sub_405360 endp

align 10h



sub_405400 proc	near
push	7F02h		; lpCursorName
push	0		; hInstance
call	ds:LoadCursorA
push	eax		; hCursor
mov	dword_4104D0, eax
call	ds:SetCursor
push	0		; nCmdShow
mov	hCursor, eax
call	sub_4050B0
mov	eax, hDlg
add	esp, 4
push	eax		; hWnd
call	ds:UpdateWindow
retn
sub_405400 endp

align 10h



sub_405440 proc	near
mov	eax, dword_4106A4
push	ebx
xor	ebx, ebx
push	esi
test	eax, eax
push	edi
jnz	short loc_405455
mov	ebx, 3EBh
jmp	short loc_405463

loc_405455:
mov	eax, dword_4106A8
test	eax, eax
jnz	short loc_405463
mov	ebx, 3ECh

loc_405463:
mov	eax, hDlg
mov	esi, ds:GetDlgItem
push	1		; bEnable
push	ebx		; nIDDlgItem
push	eax		; hDlg
call	esi ; GetDlgItem
mov	edi, ds:EnableWindow
push	eax		; hWnd
call	edi ; EnableWindow
mov	ecx, hDlg
push	0		; bEnable
push	3EDh		; nIDDlgItem
push	ecx		; hDlg
call	esi ; GetDlgItem
push	eax		; hWnd
call	edi ; EnableWindow
mov	eax, dword_4106A4
test	eax, eax
jnz	short loc_4054C7
mov	eax, dword_4106A8
test	eax, eax
jnz	short loc_4054C7
mov	edx, hDlg
push	0		; bEnable
push	3ECh		; nIDDlgItem
push	edx		; hDlg
call	esi ; GetDlgItem
push	eax		; hWnd
call	edi ; EnableWindow
mov	eax, hDlg
push	0		; bEnable
push	3EEh		; nIDDlgItem
push	eax		; hDlg
call	esi ; GetDlgItem
push	eax		; hWnd
call	edi ; EnableWindow

loc_4054C7:
mov	ecx, hDlg
push	ebx		; nIDDlgItem
push	ecx		; hDlg
call	esi ; GetDlgItem
push	eax		; hWnd
call	ds:SetFocus
mov	edx, hDlg
push	0		; lParam
push	ebx		; wParam
push	401h		; Msg
push	edx		; hWnd
call	ds:SendMessageA
mov	eax, hCursor
push	eax		; hCursor
call	ds:SetCursor
push	0FFFFFFFFh	; uType
call	ds:MessageBeep
pop	edi
pop	esi
pop	ebx
retn
sub_405440 endp

align 10h



sub_405510 proc	near

var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4

mov	eax, hHeap
sub	esp, 0Ch
push	ebx
mov	ebx, ds:HeapAlloc
push	ebp
push	esi
push	edi
push	18h		; dwBytes
push	9		; dwFlags
push	eax		; hHeap
call	ebx ; HeapAlloc
mov	ecx, hHeap
push	18h		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
mov	dword_4106A4, eax
call	ebx ; HeapAlloc
mov	dword_4106D0, eax
mov	eax, dword_410520
xor	ebp, ebp
cmp	eax, ebp
jz	short loc_4055A3
mov	edx, hHeap
push	13h		; dwBytes
push	1		; dwFlags
push	edx		; hHeap
call	ebx ; HeapAlloc
mov	ecx, dword_4106A4
push	0Bh		; dwBytes
push	1		; dwFlags
mov	[ecx], eax
mov	edx, hHeap
push	edx		; hHeap
call	ebx ; HeapAlloc
mov	ecx, dword_4106D0
mov	edi, offset aHkey_local_mac ; "HKEY_LOCAL_MACHINE"
mov	[ecx], eax
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	eax, dword_4106A4
not	ecx
sub	edi, ecx
mov	edx, ecx
mov	esi, edi
mov	edi, [eax]
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	edi, offset aHkey_users	; "HKEY_USERS"
jmp	short loc_4055F8

loc_4055A3:
mov	ecx, hHeap
push	5		; dwBytes
push	1		; dwFlags
push	ecx		; hHeap
call	ebx ; HeapAlloc
mov	edx, dword_4106A4
push	4		; dwBytes
push	1		; dwFlags
mov	[edx], eax
mov	eax, hHeap
push	eax		; hHeap
call	ebx ; HeapAlloc
mov	ecx, dword_4106D0
mov	edi, offset aHklm ; "HKLM"
mov	[ecx], eax
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	eax, dword_4106A4
not	ecx
sub	edi, ecx
mov	edx, ecx
mov	esi, edi
mov	edi, [eax]
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	edi, offset aHku ; "HKU"

loc_4055F8:
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	eax, dword_4106D0
not	ecx
sub	edi, ecx
mov	edx, ecx
mov	esi, edi
mov	edi, [eax]
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	esi, ds:GetTickCount
mov	dword_4104A8, 2
mov	dword_4104E0, ebp
mov	dword_4104B0, ebp
mov	dword_4104FC, ebp
mov	dword_4104F8, ebp
call	esi ; GetTickCount
push	3EBh		; nIDDlgItem
mov	dword_4104D8, eax
mov	dword_4104E4, eax
call	sub_4052B0
mov	ecx, dword_4106A4
push	ecx		; int
push	80000002h	; hKey
call	sub_403B90
mov	edx, dword_4106D0
push	edx		; int
push	80000003h	; hKey
call	sub_403B90
add	esp, 14h
call	esi ; GetTickCount
mov	ecx, dword_4104A8
mov	edx, dword_41042C
mov	dword_4104B0, eax
mov	eax, dword_4104E0
push	eax
mov	eax, dword_41046C
push	ecx
push	edx
push	eax
call	sub_4051B0
mov	ecx, hDlg
add	esp, 10h
push	ebp		; lParam
push	ebp		; wParam
push	0F0h		; Msg
push	3F7h		; nIDDlgItem
push	ecx		; hDlg
call	ds:GetDlgItem
push	eax		; hWnd
call	ds:SendMessageA
cmp	eax, 1
jnz	loc_405826
mov	edx, dword_4105BC
mov	eax, hDlg
push	30Eh		; cchMax
push	edx		; lpString
push	403h		; nIDDlgItem
push	eax		; hDlg
call	ds:GetDlgItemTextA
mov	ebp, dword_4105BC
or	ecx, 0FFFFFFFFh
mov	edi, ebp
xor	eax, eax
repne scasb
mov	edi, dword_4104C8
mov	esi, ebp
not	ecx
dec	ecx
mov	[esp+1Ch+var_4], ecx
jz	loc_405826
mov	[esp+1Ch+var_C], eax

loc_405714:
mov	cl, [eax+ebp]
cmp	cl, 3Bh
jz	short loc_405724
test	cl, cl
jnz	loc_405815

loc_405724:
mov	byte ptr [eax+ebp], 0
mov	ebp, dword_4105BC
cmp	byte ptr [eax+ebp-1], 5Ch
jnz	short loc_405744
test	eax, eax
jbe	short loc_405744
mov	byte ptr [eax+ebp-1], 0
mov	ebp, dword_4105BC

loc_405744:
cmp	byte ptr [esi],	0
jz	loc_405811
mov	ecx, hHeap
push	8		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
call	ebx ; HeapAlloc
mov	ebp, eax
mov	eax, dword_4104C8
test	eax, eax
jnz	short loc_40576D
mov	dword_4104C8, ebp
jmp	short loc_40576F

loc_40576D:
mov	[edi], ebp

loc_40576F:
mov	edx, hHeap
push	2Ch		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
mov	[esp+28h+var_8], ebp
call	ebx ; HeapAlloc
mov	[ebp+4], eax
mov	edi, esi
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	eax, hHeap
not	ecx
push	ecx		; dwBytes
push	1		; dwFlags
push	eax		; hHeap
call	ebx ; HeapAlloc
mov	ecx, [ebp+4]
mov	edi, esi
mov	[ecx], eax
or	ecx, 0FFFFFFFFh
xor	eax, eax
mov	edx, [ebp+4]
repne scasb
not	ecx
sub	edi, ecx
mov	eax, ecx
mov	esi, edi
mov	edi, [edx]
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	ecx, [ebp+4]
mov	dword ptr [ecx+14h], 10h
mov	edx, [ebp+4]
push	edx
call	sub_401110
add	esp, 4
call	ds:GetTickCount
mov	ecx, dword_4104F8
mov	edx, dword_4104A4
mov	dword_4104B0, eax
mov	eax, dword_4104FC
push	eax
mov	eax, dword_410450
push	ecx
push	edx
push	eax
call	sub_4051B0
mov	ebp, dword_4105BC
mov	edi, [esp+2Ch+var_8]
mov	eax, [esp+2Ch+var_C]
add	esp, 10h

loc_405811:
lea	esi, [eax+ebp+1]

loc_405815:
mov	ecx, [esp+1Ch+var_4]
inc	eax
cmp	eax, ecx
mov	[esp+1Ch+var_C], eax
jbe	loc_405714

loc_405826:
mov	ecx, lpSystemTime
mov	NumberOfBytesWritten, 40h
push	ecx		; lpSystemTime
call	ds:GetSystemTime
mov	edx, dword_4104C4
push	offset NumberOfBytesWritten ; nSize
push	edx		; lpBuffer
call	ds:GetComputerNameA
mov	eax, dword_4106BC
push	offset NumberOfBytesWritten ; pcbBuffer
push	eax		; lpBuffer
call	ds:GetUserNameA
call	sub_405360
pop	edi
pop	esi
pop	ebp
pop	ebx
add	esp, 0Ch
retn
sub_405510 endp

align 10h



sub_405870 proc	near

var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4

mov	eax, hHeap
sub	esp, 0Ch
push	ebx
mov	ebx, ds:HeapAlloc
push	ebp
push	esi
push	edi
push	18h		; dwBytes
push	9		; dwFlags
push	eax		; hHeap
call	ebx ; HeapAlloc
mov	ecx, hHeap
push	18h		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
mov	dword_4106A8, eax
call	ebx ; HeapAlloc
mov	dword_4106CC, eax
mov	eax, dword_410520
xor	ebp, ebp
cmp	eax, ebp
jz	short loc_405903
mov	edx, hHeap
push	13h		; dwBytes
push	1		; dwFlags
push	edx		; hHeap
call	ebx ; HeapAlloc
mov	ecx, dword_4106A8
push	0Bh		; dwBytes
push	1		; dwFlags
mov	[ecx], eax
mov	edx, hHeap
push	edx		; hHeap
call	ebx ; HeapAlloc
mov	ecx, dword_4106CC
mov	edi, offset aHkey_local_mac ; "HKEY_LOCAL_MACHINE"
mov	[ecx], eax
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	eax, dword_4106A8
not	ecx
sub	edi, ecx
mov	edx, ecx
mov	esi, edi
mov	edi, [eax]
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	edi, offset aHkey_users	; "HKEY_USERS"
jmp	short loc_405958

loc_405903:
mov	ecx, hHeap
push	5		; dwBytes
push	1		; dwFlags
push	ecx		; hHeap
call	ebx ; HeapAlloc
mov	edx, dword_4106A8
push	4		; dwBytes
push	1		; dwFlags
mov	[edx], eax
mov	eax, hHeap
push	eax		; hHeap
call	ebx ; HeapAlloc
mov	ecx, dword_4106CC
mov	edi, offset aHklm ; "HKLM"
mov	[ecx], eax
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	eax, dword_4106A8
not	ecx
sub	edi, ecx
mov	edx, ecx
mov	esi, edi
mov	edi, [eax]
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	edi, offset aHku ; "HKU"

loc_405958:
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	eax, dword_4106CC
not	ecx
sub	edi, ecx
mov	edx, ecx
mov	esi, edi
mov	edi, [eax]
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	esi, ds:GetTickCount
mov	dword_4104A8, 2
mov	dword_4104E0, ebp
mov	dword_4104B0, ebp
mov	dword_4104FC, ebp
mov	dword_4104F8, ebp
call	esi ; GetTickCount
push	3ECh		; nIDDlgItem
mov	dword_4104D8, eax
mov	dword_4104E4, eax
call	sub_4052B0
mov	ecx, dword_4106A8
push	ecx		; int
push	80000002h	; hKey
call	sub_403B90
mov	edx, dword_4106CC
push	edx		; int
push	80000003h	; hKey
call	sub_403B90
add	esp, 14h
call	esi ; GetTickCount
mov	ecx, dword_4104A8
mov	edx, dword_41042C
mov	dword_4104B0, eax
mov	eax, dword_4104E0
push	eax
mov	eax, dword_41046C
push	ecx
push	edx
push	eax
call	sub_4051B0
mov	ecx, hDlg
add	esp, 10h
push	ebp		; lParam
push	ebp		; wParam
push	0F0h		; Msg
push	3F7h		; nIDDlgItem
push	ecx		; hDlg
call	ds:GetDlgItem
push	eax		; hWnd
call	ds:SendMessageA
cmp	eax, 1
jnz	loc_405B86
mov	edx, dword_4105BC
mov	eax, hDlg
push	30Eh		; cchMax
push	edx		; lpString
push	403h		; nIDDlgItem
push	eax		; hDlg
call	ds:GetDlgItemTextA
mov	ebp, dword_4105BC
or	ecx, 0FFFFFFFFh
mov	edi, ebp
xor	eax, eax
repne scasb
mov	edi, dword_4104C8
mov	esi, ebp
not	ecx
dec	ecx
mov	[esp+1Ch+var_4], ecx
jz	loc_405B86
mov	[esp+1Ch+var_C], eax

loc_405A74:
mov	cl, [eax+ebp]
cmp	cl, 3Bh
jz	short loc_405A84
test	cl, cl
jnz	loc_405B75

loc_405A84:
mov	byte ptr [eax+ebp], 0
mov	ebp, dword_4105BC
cmp	byte ptr [eax+ebp-1], 5Ch
jnz	short loc_405AA4
test	eax, eax
jbe	short loc_405AA4
mov	byte ptr [eax+ebp-1], 0
mov	ebp, dword_4105BC

loc_405AA4:
cmp	byte ptr [esi],	0
jz	loc_405B71
mov	ecx, hHeap
push	8		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
call	ebx ; HeapAlloc
mov	ebp, eax
mov	eax, dword_4104E8
test	eax, eax
jnz	short loc_405ACD
mov	dword_4104E8, ebp
jmp	short loc_405ACF

loc_405ACD:
mov	[edi], ebp

loc_405ACF:
mov	edx, hHeap
push	2Ch		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
mov	[esp+28h+var_8], ebp
call	ebx ; HeapAlloc
mov	[ebp+4], eax
mov	edi, esi
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	eax, hHeap
not	ecx
push	ecx		; dwBytes
push	1		; dwFlags
push	eax		; hHeap
call	ebx ; HeapAlloc
mov	ecx, [ebp+4]
mov	edi, esi
mov	[ecx], eax
or	ecx, 0FFFFFFFFh
xor	eax, eax
mov	edx, [ebp+4]
repne scasb
not	ecx
sub	edi, ecx
mov	eax, ecx
mov	esi, edi
mov	edi, [edx]
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	ecx, [ebp+4]
mov	dword ptr [ecx+14h], 10h
mov	edx, [ebp+4]
push	edx
call	sub_401110
add	esp, 4
call	ds:GetTickCount
mov	ecx, dword_4104F8
mov	edx, dword_4104A4
mov	dword_4104B0, eax
mov	eax, dword_4104FC
push	eax
mov	eax, dword_410450
push	ecx
push	edx
push	eax
call	sub_4051B0
mov	ebp, dword_4105BC
mov	edi, [esp+2Ch+var_8]
mov	eax, [esp+2Ch+var_C]
add	esp, 10h

loc_405B71:
lea	esi, [eax+ebp+1]

loc_405B75:
mov	ecx, [esp+1Ch+var_4]
inc	eax
cmp	eax, ecx
mov	[esp+1Ch+var_C], eax
jbe	loc_405A74

loc_405B86:
mov	ecx, dword_410574
mov	NumberOfBytesWritten, 40h
push	ecx		; lpSystemTime
call	ds:GetSystemTime
mov	edx, dword_4104CC
push	offset NumberOfBytesWritten ; nSize
push	edx		; lpBuffer
call	ds:GetComputerNameA
mov	eax, dword_4106B8
push	offset NumberOfBytesWritten ; pcbBuffer
push	eax		; lpBuffer
call	ds:GetUserNameA
call	sub_405360
pop	edi
pop	esi
pop	ebp
pop	ebx
add	esp, 0Ch
retn
sub_405870 endp

align 10h



sub_405BD0 proc	near
push	esi
call	ds:CreatePopupMenu
mov	ecx, lpNewItem
mov	esi, ds:AppendMenuA
push	ecx		; lpNewItem
push	418h		; uIDNewItem
push	0		; uFlags
push	eax		; hMenu
mov	hMenu, eax
call	esi ; AppendMenuA
mov	edx, dword_410428
mov	eax, hMenu
push	edx		; lpNewItem
push	419h		; uIDNewItem
push	0		; uFlags
push	eax		; hMenu
call	esi ; AppendMenuA
mov	ecx, hMenu
push	0		; lpNewItem
push	41Bh		; uIDNewItem
push	800h		; uFlags
push	ecx		; hMenu
call	esi ; AppendMenuA
mov	edx, dword_410430
mov	eax, hMenu
push	edx		; lpNewItem
push	41Ah		; uIDNewItem
push	0		; uFlags
push	eax		; hMenu
call	esi ; AppendMenuA
mov	ecx, hMenu
push	0		; fByPos
push	418h		; uItem
push	ecx		; hMenu
call	ds:SetMenuDefaultItem
pop	esi
retn
sub_405BD0 endp

align 10h

loc_405C50:
cmp	dword ptr [esp+8], 1
jnz	short loc_405C6E
mov	eax, [esp+10h]
mov	ecx, [esp+4]
push	eax
push	1
push	466h
push	ecx
call	ds:SendMessageA

loc_405C6E:
xor	eax, eax
retn	10h
align 10h



; BOOL __stdcall DialogFunc(HWND, UINT,	WPARAM,	LPARAM)
DialogFunc proc	near

hWnd= dword ptr	 4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

mov	eax, [esp+arg_4]
push	ebx
push	ebp
push	esi
sub	eax, 110h
push	edi
jz	loc_406545
dec	eax
jnz	loc_40653C	; jumptable 00406218 default case
mov	eax, [esp+10h+arg_8]
and	eax, 0FFFFh
cmp	eax, 407h
jg	loc_406202
jz	loc_4060B6
cmp	eax, 3EEh
jg	loc_405F70
jz	loc_405E4A
cmp	eax, 3ECh
jg	loc_405DBB
jz	short loc_405D50
sub	eax, 2
jz	loc_406095
sub	eax, 3E9h
jnz	loc_40653C	; jumptable 00406218 default case
call	sub_405BD0
mov	esi, [esp+10h+hWnd]
push	offset Rect	; lpRect
push	3EBh		; nIDDlgItem
push	esi		; hDlg
mov	dword_410504, 1
call	ds:GetDlgItem
push	eax		; hWnd
call	ds:GetWindowRect
mov	eax, Rect.top
mov	ecx, Rect.left
mov	edx, hMenu
push	0		; prcRect
push	esi		; hWnd
add	eax, 0Ah
push	0		; nReserved
add	ecx, 0Ah
push	eax		; y
push	ecx		; x
push	0		; uFlags
push	edx		; hMenu
call	ds:TrackPopupMenu
mov	eax, hMenu
push	eax		; hMenu
call	ds:DestroyMenu
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn	10h

loc_405D50:
call	sub_405BD0
mov	esi, [esp+10h+hWnd]
push	offset Rect	; lpRect
push	3ECh		; nIDDlgItem
push	esi		; hDlg
mov	dword_410504, 0
call	ds:GetDlgItem
push	eax		; hWnd
call	ds:GetWindowRect
mov	ecx, Rect.top
mov	edx, Rect.left
mov	eax, hMenu
push	0		; prcRect
push	esi		; hWnd
add	ecx, 0Ah
push	0		; nReserved
add	edx, 0Ah
push	ecx		; y
push	edx		; x
push	0		; uFlags
push	eax		; hMenu
call	ds:TrackPopupMenu
mov	ecx, hMenu
push	ecx		; hMenu
call	ds:DestroyMenu
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn	10h

loc_405DBB:
cmp	eax, 3EDh
jnz	loc_40653C	; jumptable 00406218 default case
mov	esi, [esp+10h+hWnd]
mov	edi, ds:GetDlgItem
push	0		; bEnable
push	eax		; nIDDlgItem
push	esi		; hDlg
call	edi ; GetDlgItem
mov	ebx, ds:EnableWindow
push	eax		; hWnd
call	ebx ; EnableWindow
call	sub_405400
call	sub_4032A0
push	0		; nCmdShow
push	400h		; nIDDlgItem
push	esi		; hDlg
call	edi ; GetDlgItem
push	eax		; hWnd
call	ds:ShowWindow
push	1		; bEnable
push	3EEh		; nIDDlgItem
push	esi		; hDlg
call	edi ; GetDlgItem
push	eax		; hWnd
call	ebx ; EnableWindow
push	3EEh		; nIDDlgItem
push	esi		; hDlg
call	edi ; GetDlgItem
push	eax		; hWnd
call	ds:SetFocus
push	0		; lParam
push	3EEh		; wParam
push	401h		; Msg
push	esi		; hWnd
call	ds:SendMessageA
mov	edx, hCursor
push	edx		; hCursor
call	ds:SetCursor
push	0FFFFFFFFh	; uType
call	ds:MessageBeep
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn	10h

loc_405E4A:
call	ds:CreatePopupMenu
mov	ecx, dword_410470
mov	esi, ds:AppendMenuA
push	ecx		; lpNewItem
push	41Ch		; uIDNewItem
push	0		; uFlags
push	eax		; hMenu
mov	dword_410680, eax
call	esi ; AppendMenuA
mov	edx, dword_410680
push	0		; lpNewItem
push	41Bh		; uIDNewItem
push	20h		; uFlags
push	edx		; hMenu
call	esi ; AppendMenuA
mov	eax, dword_4104A0
mov	ecx, dword_410680
push	eax		; lpNewItem
push	41Dh		; uIDNewItem
push	0		; uFlags
push	ecx		; hMenu
call	esi ; AppendMenuA
mov	edx, dword_41049C
mov	eax, dword_410680
push	edx		; lpNewItem
push	41Eh		; uIDNewItem
push	0		; uFlags
push	eax		; hMenu
call	esi ; AppendMenuA
mov	ecx, dword_410680
push	0		; fByPos
push	41Ch		; uItem
push	ecx		; hMenu
call	ds:SetMenuDefaultItem
mov	eax, dword_4106A4
test	eax, eax
jz	short loc_405ED7
mov	edx, dword_410680
push	0
push	41Dh
push	edx
jmp	short loc_405EE4

loc_405ED7:
mov	eax, dword_410680
push	1		; uEnable
push	41Dh		; uIDEnableItem
push	eax		; hMenu

loc_405EE4:
mov	esi, ds:EnableMenuItem
call	esi ; EnableMenuItem
mov	eax, dword_4106A8
test	eax, eax
jz	short loc_405F05
mov	ecx, dword_410680
push	0
push	41Eh
push	ecx
jmp	short loc_405F13

loc_405F05:
mov	edx, dword_410680
push	1		; uEnable
push	41Eh		; uIDEnableItem
push	edx		; hMenu

loc_405F13:
call	esi ; EnableMenuItem
push	offset Rect	; lpRect
push	3EEh		; nIDDlgItem
mov	esi, [esp+18h+hWnd]
push	esi		; hDlg
call	ds:GetDlgItem
push	eax		; hWnd
call	ds:GetWindowRect
mov	eax, Rect.top
mov	ecx, Rect.left
mov	edx, dword_410680
push	0		; prcRect
push	esi		; hWnd
add	eax, 0Ah
push	0		; nReserved
add	ecx, 0Ah
push	eax		; y
push	ecx		; x
push	0		; uFlags
push	edx		; hMenu
call	ds:TrackPopupMenu
mov	eax, dword_410680
push	eax		; hMenu
call	ds:DestroyMenu
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn	10h

loc_405F70:
sub	eax, 3EFh
jz	loc_406095
dec	eax
jz	loc_406009
sub	eax, 7
jnz	loc_40653C	; jumptable 00406218 default case
mov	esi, [esp+10h+hWnd]
mov	edi, ds:GetDlgItem
push	0		; lParam
push	0		; wParam
push	0F0h		; Msg
push	3F7h		; nIDDlgItem
push	esi		; hDlg
call	edi ; GetDlgItem
push	eax		; hWnd
call	ds:SendMessageA
cmp	eax, 1
jnz	short loc_405FDD
push	eax		; bEnable
push	403h		; nIDDlgItem
push	esi		; hDlg
call	edi ; GetDlgItem
mov	ebx, ds:EnableWindow
push	eax		; hWnd
call	ebx ; EnableWindow
push	1		; bEnable
push	407h		; nIDDlgItem
push	esi		; hDlg
call	edi ; GetDlgItem
push	eax		; hWnd
call	ebx ; EnableWindow
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn	10h

loc_405FDD:		; bEnable
push	0
push	403h		; nIDDlgItem
push	esi		; hDlg
call	edi ; GetDlgItem
mov	ebx, ds:EnableWindow
push	eax		; hWnd
call	ebx ; EnableWindow
push	0		; bEnable
push	407h		; nIDDlgItem
push	esi		; hDlg
call	edi ; GetDlgItem
push	eax		; hWnd
call	ebx ; EnableWindow
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn	10h

loc_406009:
mov	ecx, hHeap
push	800h		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
call	ds:HeapAlloc
mov	edx, lpReturnedString
mov	esi, eax
mov	edi, edx
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	eax, lpDefault
not	ecx
dec	ecx
jz	short loc_40603A
mov	eax, edx

loc_40603A:
mov	edx, dword_4106E8
push	edx
push	offset aBy	; " by:"
push	offset asc_40D9B0 ; "]"
push	eax
mov	eax, off_40D8E4
push	offset asc_40D9AC ; "["
push	eax
push	offset aSSSSSS	; "%s%s%s%s%s%s"
push	esi		; char *
call	_sprintf
mov	ecx, dword_410468
mov	edx, [esp+30h+hWnd]
add	esp, 20h
push	0		; uType
push	ecx		; lpCaption
push	esi		; lpText
push	edx		; hWnd
call	ds:MessageBoxA
mov	eax, hHeap
push	esi		; lpMem
push	1		; dwFlags
push	eax		; hHeap
call	ds:HeapFree
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn	10h

loc_406095:
mov	ecx, [esp+10h+hWnd]
push	ecx		; hDlg
call	sub_404EA0
add	esp, 4
push	0		; nExitCode
call	ds:PostQuitMessage
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn	10h

loc_4060B6:
mov	edx, hHeap
mov	ebp, [esp+10h+hWnd]
push	105h		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
mov	bi.hwndOwner, ebp
call	ds:HeapAlloc
xor	esi, esi
push	offset bi	; lpbi
mov	bi.pszDisplayName, eax
mov	bi.ulFlags, esi
mov	bi.lpfn, esi
mov	bi.lParam, esi
call	ds:SHBrowseForFolderA
mov	ebx, eax
cmp	ebx, esi
jz	loc_4061E1
mov	eax, bi.pszDisplayName
push	eax		; pszPath
push	ebx		; pidl
call	ds:SHGetPathFromIDListA
mov	ecx, dword_4105BC
push	30Eh		; cchMax
push	ecx		; lpString
push	403h		; nIDDlgItem
push	ebp		; hDlg
call	ds:GetDlgItemTextA
mov	esi, bi.pszDisplayName
mov	edx, eax
mov	edi, esi
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
not	ecx
dec	ecx
add	ecx, edx
cmp	ecx, 30Dh
jnb	short loc_40619B
mov	edi, offset asc_40D038 ; ";"
or	ecx, 0FFFFFFFFh
repne scasb
not	ecx
sub	edi, ecx
mov	esi, edi
mov	edi, dword_4105BC
mov	edx, ecx
or	ecx, 0FFFFFFFFh
repne scasb
mov	ecx, edx
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	edi, bi.pszDisplayName
or	ecx, 0FFFFFFFFh
repne scasb
not	ecx
sub	edi, ecx
mov	esi, edi
mov	edi, dword_4105BC
mov	edx, ecx
or	ecx, 0FFFFFFFFh
repne scasb
mov	ecx, edx
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, edx
jmp	short loc_4061B9

loc_40619B:
mov	edi, esi
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
not	ecx
sub	edi, ecx
mov	eax, ecx
mov	esi, edi
mov	edi, dword_4105BC
shr	ecx, 2
rep movsd
mov	ecx, eax

loc_4061B9:
and	ecx, 3
rep movsb
mov	ecx, dword_4105BC
push	ecx		; lpString
push	403h		; nIDDlgItem
push	ebp		; hDlg
call	ds:SetDlgItemTextA
mov	edx, hHeap
push	ebx		; lpMem
push	1		; dwFlags
push	edx		; hHeap
call	ds:HeapFree

loc_4061E1:
mov	eax, bi.pszDisplayName
mov	ecx, hHeap
push	eax		; lpMem
push	1		; dwFlags
push	ecx		; hHeap
call	ds:HeapFree
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn	10h

loc_406202:
add	eax, 0FFFFFBF8h
cmp	eax, 16h	; switch 23 cases
ja	loc_40653C	; jumptable 00406218 default case
xor	edx, edx
mov	dl, ds:byte_406908[eax]
jmp	ds:off_4068E4[edx*4] ; switch jump

loc_40621F:		; jumptable 00406218 case 16
mov	ecx, dword_410504
xor	eax, eax
cmp	ecx, eax
jz	short loc_406241
mov	dword_4106C0, eax
call	sub_405510
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn	10h

loc_406241:
mov	dword_4105A4, eax
call	sub_405870
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn	10h

loc_406257:		; jumptable 00406218 case 17
mov	ecx, dword_410504
xor	eax, eax
cmp	ecx, eax
jz	short loc_4062A9
mov	dword_4106C0, eax
call	sub_405510
mov	eax, lpSystemTime
mov	ecx, dword_4106BC
mov	edx, dword_4104C4
push	eax		; int
mov	eax, dword_4104C8
push	ecx		; int
mov	ecx, dword_4106D0
push	edx		; lpBuffer
mov	edx, dword_4106A4
push	eax		; int
push	ecx		; int
push	edx		; Buffer
call	sub_404270
add	esp, 18h
mov	eax, 1
pop	edi
pop	esi
pop	ebp
pop	ebx
retn	10h

loc_4062A9:
mov	dword_4105A4, eax
call	sub_405870
mov	eax, dword_410574
mov	ecx, dword_4106B8
mov	edx, dword_4104CC
push	eax		; int
mov	eax, dword_4104E8
push	ecx		; int
mov	ecx, dword_4106CC
push	edx		; lpBuffer
mov	edx, dword_4106A8
push	eax		; int
push	ecx		; int
push	edx		; Buffer
call	sub_404270
add	esp, 18h
mov	eax, 1
pop	edi
pop	esi
pop	ebp
pop	ebx
retn	10h

loc_4062EF:		; jumptable 00406218 case 18
mov	eax, dword_410504
test	eax, eax
jz	short loc_406325
push	offset lpMem
push	offset dword_4104C8
push	offset dword_4106D0
push	offset dword_4106A4
call	sub_404720
add	esp, 10h
mov	dword_4106C0, eax
mov	eax, 1
pop	edi
pop	esi
pop	ebp
pop	ebx
retn	10h

loc_406325:
push	offset dword_4105B0
push	offset dword_4104E8
push	offset dword_4106CC
push	offset dword_4106A8
call	sub_404720
add	esp, 10h
mov	dword_4105A4, eax
mov	eax, 1
pop	edi
pop	esi
pop	ebp
pop	ebx
retn	10h

loc_406352:		; jumptable 00406218 case 20
call	sub_405400
call	sub_402DE0
call	sub_402E50
call	sub_402EC0
mov	eax, dword_4104C8
push	eax		; lpMem
call	sub_401680
mov	ecx, dword_4104E8
push	ecx		; lpMem
call	sub_401680
xor	esi, esi
add	esp, 8
mov	dword_4104C8, esi
mov	dword_4104E8, esi
call	sub_405440
mov	edx, hDlg
push	esi		; bEnable
push	3EEh		; nIDDlgItem
push	edx		; hDlg
call	ds:GetDlgItem
push	eax		; hWnd
call	ds:EnableWindow
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn	10h

loc_4063B9:		; jumptable 00406218 case 21
call	sub_405400
call	sub_402DE0
call	sub_402EC0
mov	eax, dword_4104C8
push	eax		; lpMem
call	sub_401680
mov	ecx, dword_4106A8
mov	dword_4104C8, 0
push	ecx
call	sub_402D50
mov	edx, dword_4106CC
push	edx
call	sub_402D50
mov	eax, dword_4104E8
push	eax
call	sub_402DC0
add	esp, 10h
call	sub_405440
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn	10h

loc_406414:		; jumptable 00406218 case 22
call	sub_405400
call	sub_402E50
call	sub_402EC0
mov	ecx, dword_4104E8
push	ecx		; lpMem
call	sub_401680
mov	edx, dword_4106A4
mov	dword_4104E8, 0
push	edx
call	sub_402D50
mov	eax, dword_4106D0
push	eax
call	sub_402D50
mov	ecx, dword_4104C8
push	ecx
call	sub_402DC0
add	esp, 10h
call	sub_405440
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn	10h

loc_406470:		; jumptable 00406218 case 0
mov	edx, hHeap
mov	edi, [esp+10h+hWnd]
push	105h		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
mov	bi.hwndOwner, edi
call	ds:HeapAlloc
mov	ecx, bi.ulFlags
push	104h		; cchMax
push	eax		; lpString
or	ecx, 40h
push	402h		; nIDDlgItem
push	edi		; hDlg
mov	bi.pszDisplayName, eax
mov	bi.ulFlags, ecx
mov	bi.lpfn, offset	loc_405C50
mov	bi.lParam, eax
call	ds:GetDlgItemTextA
push	offset bi	; lpbi
call	ds:SHBrowseForFolderA
mov	ebx, ds:HeapFree
mov	esi, eax
test	esi, esi
jz	short loc_406506
mov	eax, bi.pszDisplayName
push	eax		; pszPath
push	esi		; pidl
call	ds:SHGetPathFromIDListA
mov	ecx, bi.pszDisplayName
push	ecx		; lpString
push	402h		; nIDDlgItem
push	edi		; hDlg
call	ds:SetDlgItemTextA
mov	edx, hHeap
push	esi		; lpMem
push	1		; dwFlags
push	edx		; hHeap
call	ebx ; HeapFree

loc_406506:
mov	eax, bi.pszDisplayName
mov	ecx, hHeap
push	eax		; lpMem
push	1		; dwFlags
push	ecx		; hHeap
call	ebx ; HeapFree
pop	edi
pop	esi
pop	ebp
mov	eax, 1
pop	ebx
retn	10h

loc_406523:		; jumptable 00406218 case 1
mov	edx, [esp+10h+hWnd]
push	edx		; hDlg
call	sub_401E60
add	esp, 4
mov	eax, 1
pop	edi
pop	esi
pop	ebp
pop	ebx
retn	10h

loc_40653C:		; jumptable 00406218 default case
pop	edi
pop	esi
pop	ebp
xor	eax, eax
pop	ebx
retn	10h

loc_406545:
mov	ebx, [esp+10h+hWnd]
mov	esi, ds:SendDlgItemMessageA
push	0		; lParam
push	32h		; wParam
push	0C5h		; Msg
push	401h		; nIDDlgItem
push	ebx		; hDlg
call	esi ; SendDlgItemMessageA
push	0		; lParam
push	104h		; wParam
push	0C5h		; Msg
push	402h		; nIDDlgItem
push	ebx		; hDlg
call	esi ; SendDlgItemMessageA
push	0		; lParam
push	30Ch		; wParam
push	0C5h		; Msg
push	403h		; nIDDlgItem
push	ebx		; hDlg
call	esi ; SendDlgItemMessageA
mov	eax, hHeap
mov	ebp, ds:HeapAlloc
push	30Eh		; dwBytes
push	9		; dwFlags
push	eax		; hHeap
call	ebp ; HeapAlloc
mov	ecx, hHeap
push	109h		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
mov	dword_4105BC, eax
call	ebp ; HeapAlloc
mov	edx, hHeap
push	40h		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
mov	lpString, eax
call	ebp ; HeapAlloc
mov	lpReturnedString, eax
mov	eax, hHeap
push	105h		; dwBytes
push	9		; dwFlags
push	eax		; hHeap
call	ebp ; HeapAlloc
mov	ecx, hHeap
push	80h		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
mov	lpName,	eax
call	ebp ; HeapAlloc
mov	edx, hHeap
push	105h		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
mov	lParam,	eax
call	ebp ; HeapAlloc
mov	dword_41062C, eax
mov	eax, hHeap
push	109h		; dwBytes
push	9		; dwFlags
push	eax		; hHeap
call	ebp ; HeapAlloc
mov	ecx, hHeap
push	106h		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
mov	dword_41069C, eax
call	ebp ; HeapAlloc
mov	edx, hHeap
push	40h		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
mov	dword_410630, eax
call	ebp ; HeapAlloc
mov	dword_4104C4, eax
mov	eax, hHeap
push	40h		; dwBytes
push	9		; dwFlags
push	eax		; hHeap
call	ebp ; HeapAlloc
mov	dword_4104CC, eax
mov	ecx, hHeap
push	40h		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
call	ebp ; HeapAlloc
mov	edx, hHeap
push	40h		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
mov	dword_4106BC, eax
call	ebp ; HeapAlloc
mov	dword_4106B8, eax
mov	eax, hHeap
push	10h		; dwBytes
push	9		; dwFlags
push	eax		; hHeap
call	ebp ; HeapAlloc
mov	ecx, hHeap
push	10h		; dwBytes
push	9		; dwFlags
push	ecx		; hHeap
mov	lpSystemTime, eax
call	ebp ; HeapAlloc
mov	edx, off_40D048
mov	dword_410574, eax
mov	eax, dword_41069C
push	104h		; uSize
push	eax		; lpBuffer
mov	dword_4106E8, edx
call	ds:GetWindowsDirectoryA
mov	edx, dword_41069C
or	ecx, 0FFFFFFFFh
mov	edi, edx
xor	eax, eax
repne scasb
not	ecx
dec	ecx
jz	short loc_4066D7
cmp	byte ptr [edx+ecx-1], 5Ch
jnz	short loc_4066D7
mov	byte ptr [edx+ecx-1], 0

loc_4066D7:
mov	ecx, dword_410630
push	ecx		; lpBuffer
push	104h		; nBufferLength
call	ds:GetTempPathA
mov	edx, dword_41062C
push	edx		; lpBuffer
push	104h		; nBufferLength
call	ds:GetCurrentDirectoryA
mov	eax, hHeap
push	208h		; dwBytes
push	9		; dwFlags
push	eax		; hHeap
call	ebp ; HeapAlloc
mov	edi, dword_41062C
mov	edx, eax
or	ecx, 0FFFFFFFFh
xor	eax, eax
mov	lpFileName, edx
repne scasb
not	ecx
sub	edi, ecx
mov	eax, ecx
mov	esi, edi
mov	edi, edx
shr	ecx, 2
rep movsd
mov	ecx, eax
xor	eax, eax
and	ecx, 3
rep movsb
mov	edx, lpFileName
or	ecx, 0FFFFFFFFh
mov	edi, edx
repne scasb
not	ecx
dec	ecx
cmp	byte ptr [ecx+edx-1], 5Ch
jz	short loc_406782
mov	edi, offset asc_40D998 ; "\\"
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
not	ecx
sub	edi, ecx
mov	eax, ecx
mov	esi, edi
mov	edi, edx
mov	edx, eax
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	ecx, edx
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	edx, lpFileName

loc_406782:
mov	edi, off_40D8EC
or	ecx, 0FFFFFFFFh
xor	eax, eax
push	4000h		; dwBytes
repne scasb
not	ecx
sub	edi, ecx
push	1		; dwFlags
mov	eax, ecx
mov	esi, edi
mov	[esp+18h+hWnd],	eax
mov	edi, edx
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
mov	eax, [esp+18h+hWnd]
dec	edi
mov	ecx, eax
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	ecx, hHeap
push	ecx		; hHeap
call	ebp ; HeapAlloc
mov	edx, hHeap
push	0F0h		; dwBytes
push	9		; dwFlags
push	edx		; hHeap
mov	dword_4106DC, eax
call	ebp ; HeapAlloc
push	ebx		; hDlg
mov	dword_4106D8, eax
call	sub_401AA0
add	esp, 4
test	eax, eax
jz	short loc_4067F9
push	ebx		; hDlg
call	sub_401E60
add	esp, 4
jmp	short loc_4067FE

loc_4067F9:
call	__cfltcvt_init

loc_4067FE:		; lParam
push	0
push	3F7h		; wParam
push	111h		; Msg
push	ebx		; hWnd
call	ds:SendMessageA
mov	eax, lpString
push	30Ch		; dwBytes
mov	dword_4106D4, eax
mov	dword_4106E0, eax
mov	eax, hHeap
push	9		; dwFlags
push	eax		; hHeap
call	ebp ; HeapAlloc
mov	edi, dword_41062C
mov	edx, eax
or	ecx, 0FFFFFFFFh
xor	eax, eax
mov	dword_410508, edx
repne scasb
not	ecx
sub	edi, ecx
mov	eax, ecx
mov	esi, edi
mov	edi, edx
shr	ecx, 2
rep movsd
mov	ecx, eax
xor	eax, eax
and	ecx, 3
rep movsb
mov	edx, dword_410508
or	ecx, 0FFFFFFFFh
mov	edi, edx
repne scasb
not	ecx
dec	ecx
cmp	byte ptr [ecx+edx-1], 5Ch
jz	short loc_4068A3
mov	edi, offset asc_40D998 ; "\\"
or	ecx, 0FFFFFFFFh
xor	eax, eax
repne scasb
not	ecx
sub	edi, ecx
mov	esi, edi
mov	ebp, ecx
mov	edi, edx
or	ecx, 0FFFFFFFFh
repne scasb
mov	ecx, ebp
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, ebp
and	ecx, 3
rep movsb
mov	edx, dword_410508

loc_4068A3:
mov	edi, off_40D8E8
or	ecx, 0FFFFFFFFh
xor	eax, eax
push	ebx		; hWnd
repne scasb
not	ecx
sub	edi, ecx
mov	esi, edi
mov	ebp, ecx
mov	edi, edx
or	ecx, 0FFFFFFFFh
repne scasb
mov	ecx, ebp
dec	edi
shr	ecx, 2
rep movsd
mov	ecx, ebp
and	ecx, 3
rep movsb
call	sub_404C00
add	esp, 4
mov	eax, 1
pop	edi
pop	esi
pop	ebp
pop	ebx
retn	10h
DialogFunc endp

align 4
off_4068E4 dd offset loc_406470	; jump table for switch	statement
dd offset loc_406523
dd offset loc_40621F
dd offset loc_406257
dd offset loc_4062EF
dd offset loc_406352
dd offset loc_4063B9
dd offset loc_406414
dd offset loc_40653C
byte_406908 db	    0,	   1,	  8,	 8 ; indirect table for	switch statement
db	8,     8,     8,     8
db	8,     8,     8,     8
db	8,     8,     8,     8
db	2,     3,     4,     8
db	5,     6,     7
align 10h



; int __stdcall	WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
_WinMain@16 proc near

hInstance= dword ptr  4
hPrevInstance= dword ptr  8
lpCmdLine= dword ptr  0Ch
nShowCmd= dword	ptr  10h

push	esi
call	ds:GetProcessHeap
mov	esi, [esp+4+hInstance]
push	0		; dwInitParam
push	offset DialogFunc ; lpDialogFunc
push	0		; hWndParent
push	64h		; lpTemplateName
push	esi		; hInstance
mov	hHeap, eax
call	ds:CreateDialogParamA
push	6Fh		; lpIconName
push	esi		; hInstance
mov	hDlg, eax
call	ds:LoadIconA
push	eax		; dwNewLong
mov	eax, hDlg
push	0FFFFFFF2h	; nIndex
push	eax		; hWnd
call	ds:SetClassLongA
mov	ecx, lpBuffer
mov	edx, hDlg
push	ecx		; lpString
push	edx		; hWnd
call	ds:SetWindowTextA
mov	ecx, hDlg
mov	eax, [esp+4+nShowCmd]
push	eax		; nCmdShow
push	ecx		; hWnd
call	ds:ShowWindow
mov	edx, hDlg
push	edx		; hWnd
call	ds:UpdateWindow
mov	esi, ds:GetMessageA
push	0		; wMsgFilterMax
push	0		; wMsgFilterMin
push	0		; hWnd
push	offset Msg	; lpMsg
call	esi ; GetMessageA
test	eax, eax
jz	short loc_4069FA
push	ebx
mov	ebx, ds:DispatchMessageA
push	ebp
mov	ebp, ds:IsDialogMessageA
push	edi
mov	edi, ds:TranslateMessage

loc_4069BE:
mov	eax, hDlg
push	offset Msg	; lpMsg
push	eax		; hDlg
call	ebp ; IsDialogMessageA
test	eax, eax
jnz	short loc_4069DD
push	offset Msg	; lpMsg
call	edi ; TranslateMessage
push	offset Msg	; lpMsg
call	ebx ; DispatchMessageA

loc_4069DD:		; wMsgFilterMax
push	0
push	0		; wMsgFilterMin
push	0		; hWnd
push	offset Msg	; lpMsg
call	esi ; GetMessageA
test	eax, eax
jnz	short loc_4069BE
mov	eax, Msg.wParam
pop	edi
pop	ebp
pop	ebx
pop	esi
retn	10h

loc_4069FA:
mov	eax, Msg.wParam
pop	esi
retn	10h
_WinMain@16 endp

align 10h
; [00000006 BYTES: COLLAPSED FUNCTION GetSaveFileNameA.	PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION GetOpenFileNameA.	PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000052 BYTES: COLLAPSED FUNCTION _sprintf.	PRESS KEYPAD CTRL-"+" TO EXPAND]
; [000000F6 BYTES: COLLAPSED FUNCTION start. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000022 BYTES: COLLAPSED FUNCTION __amsg_exit. PRESS KEYPAD	CTRL-"+" TO EXPAND]
pop	ecx
pop	ecx
retn
; [00000023 BYTES: COLLAPSED FUNCTION _fast_error_exit.	PRESS KEYPAD CTRL-"+" TO EXPAND]
retn
; [00000115 BYTES: COLLAPSED FUNCTION __flsbuf.	PRESS KEYPAD CTRL-"+" TO EXPAND]


; Attributes: bp-based frame

; int __cdecl sub_406CC2(FILE *, int, int)
sub_406CC2 proc	near

var_24C= byte ptr -24Ch
var_4D=	byte ptr -4Dh
var_4C=	dword ptr -4Ch
var_48=	dword ptr -48h
var_44=	byte ptr -44h
var_40=	dword ptr -40h
var_3C=	dword ptr -3Ch
var_38=	dword ptr -38h
var_34=	dword ptr -34h
lpMem= dword ptr -30h
var_2C=	dword ptr -2Ch
var_28=	dword ptr -28h
var_24=	dword ptr -24h
var_20=	dword ptr -20h
var_1C=	dword ptr -1Ch
var_16=	dword ptr -16h
var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
sub	esp, 24Ch
push	ebx
push	esi
mov	esi, [ebp+arg_4]
xor	ecx, ecx
push	edi
mov	[ebp+var_10], ecx
mov	bl, [esi]
inc	esi
test	bl, bl
mov	[ebp+var_16+2],	ecx
mov	[ebp+lpMem], ecx
mov	[ebp+arg_4], esi
jz	loc_407438
mov	edi, 800h
mov	edx, 200h
jmp	short loc_406D03

loc_406CF6:
mov	ecx, [ebp+var_3C]
mov	edx, 200h
mov	edi, 800h

loc_406D03:
cmp	[ebp+var_16+2],	0
jl	loc_407438
cmp	bl, 20h
jl	short loc_406D25
cmp	bl, 78h
jg	short loc_406D25
movsx	eax, bl
mov	al, ds:byte_40C1A4[eax]
and	eax, 0Fh
jmp	short loc_406D27

loc_406D25:
xor	eax, eax

loc_406D27:
movsx	eax, ds:byte_40C1C4[ecx+eax*8]
sar	eax, 4
cmp	eax, 7		; switch 8 cases
mov	[ebp+var_3C], eax
ja	loc_407427	; jumptable 00406D3E default case
jmp	ds:off_407440[eax*4] ; switch jump

loc_406D45:		; jumptable 00406D3E case 1
xor	eax, eax
or	[ebp+var_8], 0FFFFFFFFh
mov	[ebp+var_40], eax
mov	[ebp+var_38], eax
mov	[ebp+var_28], eax
mov	[ebp+var_24], eax
mov	[ebp+var_4], eax
mov	[ebp+var_2C], eax
jmp	loc_407427	; jumptable 00406D3E default case

loc_406D62:		; jumptable 00406D3E case 2
movsx	eax, bl
sub	eax, 20h
jz	short loc_406DA5
sub	eax, 3
jz	short loc_406D9C
sub	eax, 8
jz	short loc_406D93
dec	eax
dec	eax
jz	short loc_406D8A
sub	eax, 3
jnz	loc_407427	; jumptable 00406D3E default case
or	[ebp+var_4], 8
jmp	loc_407427	; jumptable 00406D3E default case

loc_406D8A:
or	[ebp+var_4], 4
jmp	loc_407427	; jumptable 00406D3E default case

loc_406D93:
or	[ebp+var_4], 1
jmp	loc_407427	; jumptable 00406D3E default case

loc_406D9C:
or	byte ptr [ebp+var_4], 80h
jmp	loc_407427	; jumptable 00406D3E default case

loc_406DA5:
or	[ebp+var_4], 2
jmp	loc_407427	; jumptable 00406D3E default case

loc_406DAE:		; jumptable 00406D3E case 3
cmp	bl, 2Ah
jnz	short loc_406DD6
lea	eax, [ebp+arg_8]
push	eax
call	_get_int_arg
test	eax, eax
pop	ecx
mov	[ebp+var_28], eax
jge	loc_407427	; jumptable 00406D3E default case
or	[ebp+var_4], 4
neg	eax

loc_406DCE:
mov	[ebp+var_28], eax
jmp	loc_407427	; jumptable 00406D3E default case

loc_406DD6:
mov	eax, [ebp+var_28]
movsx	ecx, bl
lea	eax, [eax+eax*4]
lea	eax, [ecx+eax*2-30h]
jmp	short loc_406DCE

loc_406DE5:		; jumptable 00406D3E case 4
and	[ebp+var_8], 0
jmp	loc_407427	; jumptable 00406D3E default case

loc_406DEE:		; jumptable 00406D3E case 5
cmp	bl, 2Ah
jnz	short loc_406E11
lea	eax, [ebp+arg_8]
push	eax
call	_get_int_arg
test	eax, eax
pop	ecx
mov	[ebp+var_8], eax
jge	loc_407427	; jumptable 00406D3E default case
or	[ebp+var_8], 0FFFFFFFFh
jmp	loc_407427	; jumptable 00406D3E default case

loc_406E11:
mov	eax, [ebp+var_8]
movsx	ecx, bl
lea	eax, [eax+eax*4]
lea	eax, [ecx+eax*2-30h]
mov	[ebp+var_8], eax
jmp	loc_407427	; jumptable 00406D3E default case

loc_406E26:		; jumptable 00406D3E case 6
cmp	bl, 49h
jz	short loc_406E58
cmp	bl, 68h
jz	short loc_406E4F
cmp	bl, 6Ch
jz	short loc_406E46
cmp	bl, 77h
jnz	loc_407427	; jumptable 00406D3E default case
or	[ebp+var_4], edi
jmp	loc_407427	; jumptable 00406D3E default case

loc_406E46:
or	[ebp+var_4], 10h
jmp	loc_407427	; jumptable 00406D3E default case

loc_406E4F:
or	[ebp+var_4], 20h
jmp	loc_407427	; jumptable 00406D3E default case

loc_406E58:
cmp	byte ptr [esi],	36h
jnz	short loc_406E71
cmp	byte ptr [esi+1], 34h
jnz	short loc_406E71
inc	esi
inc	esi
or	byte ptr [ebp+var_4+1],	80h
mov	[ebp+arg_4], esi
jmp	loc_407427	; jumptable 00406D3E default case

loc_406E71:
and	[ebp+var_3C], 0

loc_406E75:		; jumptable 00406D3E case 0
mov	ecx, off_40DDA8
and	[ebp+var_2C], 0
movzx	eax, bl
test	byte ptr [ecx+eax*2+1],	80h
jz	short loc_406EA2
lea	eax, [ebp+var_16+2]
push	eax		; int
push	[ebp+arg_0]	; FILE *
movsx	eax, bl
push	eax		; int
call	_write_char
mov	bl, [esi]
add	esp, 0Ch
inc	esi
mov	[ebp+arg_4], esi

loc_406EA2:
lea	eax, [ebp+var_16+2]
push	eax		; int
push	[ebp+arg_0]	; FILE *
movsx	eax, bl
push	eax		; int
call	_write_char
add	esp, 0Ch
jmp	loc_407427	; jumptable 00406D3E default case

loc_406EBA:		; jumptable 00406D3E case 7
movsx	eax, bl
cmp	eax, 67h
jg	loc_4070FE
cmp	eax, 65h
jge	loc_406F65
cmp	eax, 58h
jg	loc_406FC4
jz	loc_407172
sub	eax, 43h
jz	loc_406F88
dec	eax
dec	eax
jz	short loc_406F5B
dec	eax
dec	eax
jz	short loc_406F5B
sub	eax, 0Ch
jnz	loc_407316
test	word ptr [ebp+var_4], 830h
jnz	short loc_406F03
or	[ebp+var_4], edi

loc_406F03:
cmp	[ebp+var_8], 0FFFFFFFFh
mov	esi, 7FFFFFFFh
jz	short loc_406F11
mov	esi, [ebp+var_8]

loc_406F11:
lea	eax, [ebp+arg_8]
push	eax
call	_get_int_arg
test	word ptr [ebp+var_4], 810h
pop	ecx
mov	ecx, eax
mov	[ebp+var_C], ecx
jz	loc_407146
test	ecx, ecx
jnz	short loc_406F39
mov	ecx, off_40D9C8
mov	[ebp+var_C], ecx

loc_406F39:
mov	[ebp+var_2C], 1
mov	eax, ecx

loc_406F42:
mov	edx, esi
dec	esi
test	edx, edx
jz	loc_40713D
cmp	word ptr [eax],	0
jz	loc_40713D
inc	eax
inc	eax
jmp	short loc_406F42

loc_406F5B:
mov	[ebp+var_40], 1
add	bl, 20h

loc_406F65:
or	[ebp+var_4], 40h
cmp	[ebp+var_8], 0
lea	edi, [ebp+var_24C]
mov	[ebp+var_C], edi
jge	loc_407049
mov	[ebp+var_8], 6
jmp	loc_40708E

loc_406F88:
test	word ptr [ebp+var_4], 830h
jnz	short loc_406F93
or	[ebp+var_4], edi

loc_406F93:
test	word ptr [ebp+var_4], 810h
lea	eax, [ebp+arg_8]
push	eax
jz	short loc_406FDA
call	_get_short_arg
push	eax		; wchar_t
lea	eax, [ebp+var_24C]
push	eax		; char *
call	_wctomb
add	esp, 0Ch
mov	[ebp+var_10], eax
test	eax, eax
jge	short loc_406FED
mov	[ebp+var_38], 1
jmp	short loc_406FED

loc_406FC4:
sub	eax, 5Ah
jz	short loc_406FFB
sub	eax, 9
jz	short loc_406F93
dec	eax
jz	loc_4071D7
jmp	loc_407316

loc_406FDA:
call	_get_int_arg
pop	ecx
mov	[ebp+var_24C], al
mov	[ebp+var_10], 1

loc_406FED:
lea	eax, [ebp+var_24C]
mov	[ebp+var_C], eax
jmp	loc_407316

loc_406FFB:
lea	eax, [ebp+arg_8]
push	eax
call	_get_int_arg
test	eax, eax
pop	ecx
jz	short loc_40703B
mov	ecx, [eax+4]
test	ecx, ecx
jz	short loc_40703B
test	[ebp+var_4], edi
jz	short loc_40702C
movsx	eax, word ptr [eax]
shr	eax, 1
mov	[ebp+var_C], ecx
mov	[ebp+var_10], eax
mov	[ebp+var_2C], 1
jmp	loc_407316

loc_40702C:
and	[ebp+var_2C], 0
mov	[ebp+var_C], ecx
movsx	eax, word ptr [eax]
jmp	loc_407313

loc_40703B:
mov	eax, off_40D9C4
mov	[ebp+var_C], eax
push	eax
jmp	loc_4070F3

loc_407049:
jnz	short loc_407059
cmp	bl, 67h
jnz	short loc_40708E
mov	[ebp+var_8], 1
jmp	short loc_40708E

loc_407059:
cmp	[ebp+var_8], edx
jle	short loc_407061
mov	[ebp+var_8], edx

loc_407061:
cmp	[ebp+var_8], 0A3h
jle	short loc_40708E
mov	eax, [ebp+var_8]
add	eax, 15Dh
push	eax		; size_t
call	_malloc
test	eax, eax
pop	ecx
mov	[ebp+lpMem], eax
jz	short loc_407087
mov	edi, eax
mov	[ebp+var_C], edi
jmp	short loc_40708E

loc_407087:
mov	[ebp+var_8], 0A3h

loc_40708E:
mov	eax, [ebp+arg_8]
push	[ebp+var_40]	; char *
add	eax, 8
mov	[ebp+arg_8], eax
push	[ebp+var_8]
mov	ecx, [eax-8]
mov	[ebp+var_4C], ecx
mov	eax, [eax-4]
mov	[ebp+var_48], eax
movsx	eax, bl
push	eax
lea	eax, [ebp+var_4C]
push	edi
push	eax
call	off_40DD90
mov	esi, [ebp+var_4]
add	esp, 14h
and	esi, 80h
jz	short loc_4070D4
cmp	[ebp+var_8], 0
jnz	short loc_4070D4
push	edi
call	off_40DD9C
pop	ecx

loc_4070D4:
cmp	bl, 67h
jnz	short loc_4070E5
test	esi, esi
jnz	short loc_4070E5
push	edi
call	off_40DD94
pop	ecx

loc_4070E5:
cmp	byte ptr [edi],	2Dh
jnz	short loc_4070F2
or	byte ptr [ebp+var_4+1],	1
inc	edi
mov	[ebp+var_C], edi

loc_4070F2:		; char *
push	edi

loc_4070F3:
call	_strlen
pop	ecx
jmp	loc_407313

loc_4070FE:
sub	eax, 69h
jz	loc_4071D7
sub	eax, 5
jz	loc_4071AD
dec	eax
jz	loc_40719B
dec	eax
jz	short loc_40716B
sub	eax, 3
jz	loc_406F03
dec	eax
dec	eax
jz	loc_4071DB
sub	eax, 3
jnz	loc_407316
mov	[ebp+var_34], 27h
jmp	short loc_407179

loc_40713D:
sub	eax, ecx
sar	eax, 1
jmp	loc_407313

loc_407146:
test	ecx, ecx
jnz	short loc_407153
mov	ecx, off_40D9C4
mov	[ebp+var_C], ecx

loc_407153:
mov	eax, ecx

loc_407155:
mov	edx, esi
dec	esi
test	edx, edx
jz	short loc_407164
cmp	byte ptr [eax],	0
jz	short loc_407164
inc	eax
jmp	short loc_407155

loc_407164:
sub	eax, ecx
jmp	loc_407313

loc_40716B:
mov	[ebp+var_8], 8

loc_407172:
mov	[ebp+var_34], 7

loc_407179:
test	byte ptr [ebp+var_4], 80h
mov	[ebp+var_10], 10h
jz	short loc_4071E2
mov	al, byte ptr [ebp+var_34]
mov	byte ptr [ebp+var_16], 30h
add	al, 51h
mov	[ebp+var_24], 2
mov	byte ptr [ebp+var_16+1], al
jmp	short loc_4071E2

loc_40719B:
test	byte ptr [ebp+var_4], 80h
mov	[ebp+var_10], 8
jz	short loc_4071E2
or	[ebp+var_4], edx
jmp	short loc_4071E2

loc_4071AD:
lea	eax, [ebp+arg_8]
push	eax
call	_get_int_arg
test	byte ptr [ebp+var_4], 20h
pop	ecx
jz	short loc_4071C6
mov	cx, word ptr [ebp+var_16+2]
mov	[eax], cx
jmp	short loc_4071CB

loc_4071C6:
mov	ecx, [ebp+var_16+2]
mov	[eax], ecx

loc_4071CB:
mov	[ebp+var_38], 1
jmp	loc_407414

loc_4071D7:
or	[ebp+var_4], 40h

loc_4071DB:
mov	[ebp+var_10], 0Ah

loc_4071E2:
test	byte ptr [ebp+var_4+1],	80h
jz	short loc_4071F4
lea	eax, [ebp+arg_8]
push	eax
call	_get_int64_arg
pop	ecx
jmp	short loc_407235

loc_4071F4:
test	byte ptr [ebp+var_4], 20h
jz	short loc_40721B
test	byte ptr [ebp+var_4], 40h
lea	eax, [ebp+arg_8]
push	eax
jz	short loc_407210
call	_get_int_arg
pop	ecx
movsx	eax, ax

loc_40720D:
cdq
jmp	short loc_407235

loc_407210:
call	_get_int_arg
pop	ecx
movzx	eax, ax
jmp	short loc_40720D

loc_40721B:
test	byte ptr [ebp+var_4], 40h
lea	eax, [ebp+arg_8]
push	eax
jz	short loc_40722D
call	_get_int_arg
pop	ecx
jmp	short loc_40720D

loc_40722D:
call	_get_int_arg
pop	ecx
xor	edx, edx

loc_407235:
test	byte ptr [ebp+var_4], 40h
jz	short loc_407258
test	edx, edx
jg	short loc_407258
jl	short loc_407245
test	eax, eax
jnb	short loc_407258

loc_407245:
neg	eax
adc	edx, 0
mov	[ebp+var_20], eax
neg	edx
or	byte ptr [ebp+var_4+1],	1
mov	[ebp+var_1C], edx
jmp	short loc_40725E

loc_407258:
mov	[ebp+var_20], eax
mov	[ebp+var_1C], edx

loc_40725E:
test	byte ptr [ebp+var_4+1],	80h
jnz	short loc_407268
and	[ebp+var_1C], 0

loc_407268:
cmp	[ebp+var_8], 0
jge	short loc_407277
mov	[ebp+var_8], 1
jmp	short loc_407288

loc_407277:
and	[ebp+var_4], 0FFFFFFF7h
mov	eax, 200h
cmp	[ebp+var_8], eax
jle	short loc_407288
mov	[ebp+var_8], eax

loc_407288:
mov	eax, [ebp+var_20]
or	eax, [ebp+var_1C]
jnz	short loc_407294
and	[ebp+var_24], 0

loc_407294:
lea	eax, [ebp+var_4D]
mov	[ebp+var_C], eax

loc_40729A:
mov	eax, [ebp+var_8]
dec	[ebp+var_8]
test	eax, eax
jg	short loc_4072AC
mov	eax, [ebp+var_20]
or	eax, [ebp+var_1C]
jz	short loc_4072EB

loc_4072AC:
mov	eax, [ebp+var_10]
cdq
mov	edi, edx
mov	esi, eax
push	edi
push	esi
push	[ebp+var_1C]
push	[ebp+var_20]
call	__aullrem
push	edi
push	esi
push	[ebp+var_1C]
mov	ebx, eax
add	ebx, 30h
push	[ebp+var_20]
call	__aulldiv
cmp	ebx, 39h
mov	[ebp+var_20], eax
mov	[ebp+var_1C], edx
jle	short loc_4072E1
add	ebx, [ebp+var_34]

loc_4072E1:
mov	eax, [ebp+var_C]
dec	[ebp+var_C]
mov	[eax], bl
jmp	short loc_40729A

loc_4072EB:
lea	eax, [ebp+var_4D]
sub	eax, [ebp+var_C]
inc	[ebp+var_C]
test	byte ptr [ebp+var_4+1],	2
mov	[ebp+var_10], eax
jz	short loc_407316
mov	ecx, [ebp+var_C]
cmp	byte ptr [ecx],	30h
jnz	short loc_407309
test	eax, eax
jnz	short loc_407316

loc_407309:
dec	[ebp+var_C]
inc	eax
mov	ecx, [ebp+var_C]
mov	byte ptr [ecx],	30h

loc_407313:
mov	[ebp+var_10], eax

loc_407316:
cmp	[ebp+var_38], 0
jnz	loc_407414
mov	ebx, [ebp+var_4]
test	bl, 40h
jz	short loc_40734E
test	bh, 1
jz	short loc_407333
mov	byte ptr [ebp+var_16], 2Dh
jmp	short loc_407347

loc_407333:
test	bl, 1
jz	short loc_40733E
mov	byte ptr [ebp+var_16], 2Bh
jmp	short loc_407347

loc_40733E:
test	bl, 2
jz	short loc_40734E
mov	byte ptr [ebp+var_16], 20h

loc_407347:
mov	[ebp+var_24], 1

loc_40734E:
mov	esi, [ebp+var_28]
sub	esi, [ebp+var_24]
sub	esi, [ebp+var_10]
test	bl, 0Ch
jnz	short loc_40736E
lea	eax, [ebp+var_16+2]
push	eax		; int
push	[ebp+arg_0]	; FILE *
push	esi		; int
push	20h		; int
call	_write_multi_char
add	esp, 10h

loc_40736E:
lea	eax, [ebp+var_16+2]
push	eax		; int
lea	eax, [ebp+var_16]
push	[ebp+arg_0]	; FILE *
push	[ebp+var_24]	; int
push	eax		; int
call	_write_string
add	esp, 10h
test	bl, 8
jz	short loc_4073A0
test	bl, 4
jnz	short loc_4073A0
lea	eax, [ebp+var_16+2]
push	eax		; int
push	[ebp+arg_0]	; FILE *
push	esi		; int
push	30h		; int
call	_write_multi_char
add	esp, 10h

loc_4073A0:
cmp	[ebp+var_2C], 0
jz	short loc_4073E7
cmp	[ebp+var_10], 0
jle	short loc_4073E7
mov	eax, [ebp+var_10]
mov	ebx, [ebp+var_C]
lea	edi, [eax-1]

loc_4073B5:
mov	ax, [ebx]
inc	ebx
push	eax		; wchar_t
lea	eax, [ebp+var_44]
push	eax		; char *
inc	ebx
call	_wctomb
pop	ecx
test	eax, eax
pop	ecx
jle	short loc_4073FC
lea	ecx, [ebp+var_16+2]
push	ecx		; int
push	[ebp+arg_0]	; FILE *
push	eax		; int
lea	eax, [ebp+var_44]
push	eax		; int
call	_write_string
add	esp, 10h
mov	eax, edi
dec	edi
test	eax, eax
jnz	short loc_4073B5
jmp	short loc_4073FC

loc_4073E7:
lea	eax, [ebp+var_16+2]
push	eax		; int
push	[ebp+arg_0]	; FILE *
push	[ebp+var_10]	; int
push	[ebp+var_C]	; int
call	_write_string
add	esp, 10h

loc_4073FC:
test	byte ptr [ebp+var_4], 4
jz	short loc_407414
lea	eax, [ebp+var_16+2]
push	eax		; int
push	[ebp+arg_0]	; FILE *
push	esi		; int
push	20h		; int
call	_write_multi_char
add	esp, 10h

loc_407414:
cmp	[ebp+lpMem], 0
jz	short loc_407427 ; jumptable 00406D3E default case
push	[ebp+lpMem]	; lpMem
call	sub_408682
and	[ebp+lpMem], 0
pop	ecx

loc_407427:		; jumptable 00406D3E default case
mov	esi, [ebp+arg_4]
mov	bl, [esi]
inc	esi
test	bl, bl
mov	[ebp+arg_4], esi
jnz	loc_406CF6

loc_407438:
mov	eax, [ebp+var_16+2]
pop	edi
pop	esi
pop	ebx
leave
retn
sub_406CC2 endp

off_407440 dd offset loc_406E75	; jump table for switch	statement
dd offset loc_406D45
dd offset loc_406D62
dd offset loc_406DAE
dd offset loc_406DE5
dd offset loc_406DEE
dd offset loc_406E26
dd offset loc_406EBA
; [00000035 BYTES: COLLAPSED FUNCTION _write_char. PRESS KEYPAD	CTRL-"+" TO EXPAND]
; [00000031 BYTES: COLLAPSED FUNCTION _write_multi_char. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000038 BYTES: COLLAPSED FUNCTION _write_string. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [0000000D BYTES: COLLAPSED FUNCTION _get_int_arg. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000010 BYTES: COLLAPSED FUNCTION _get_int64_arg. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [0000000E BYTES: COLLAPSED FUNCTION _get_short_arg. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [0000002D BYTES: COLLAPSED FUNCTION __cinit. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION _exit. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __exit. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000099 BYTES: COLLAPSED FUNCTION _doexit. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [0000001A BYTES: COLLAPSED FUNCTION __initterm. PRESS	KEYPAD CTRL-"+"	TO EXPAND]
; [00000141 BYTES: COLLAPSED FUNCTION __XcptFilter. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000043 BYTES: COLLAPSED FUNCTION _xcptlookup. PRESS KEYPAD	CTRL-"+" TO EXPAND]
; [00000058 BYTES: COLLAPSED FUNCTION __wincmdln. PRESS	KEYPAD CTRL-"+"	TO EXPAND]
; [000000B9 BYTES: COLLAPSED FUNCTION __setenvp. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000099 BYTES: COLLAPSED FUNCTION __setargv. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [000001B4 BYTES: COLLAPSED FUNCTION _parse_cmdline. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000132 BYTES: COLLAPSED FUNCTION ___crtGetEnvironmentStringsA. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [000001AB BYTES: COLLAPSED FUNCTION __ioinit.	PRESS KEYPAD CTRL-"+" TO EXPAND]



sub_407DEA proc	near

arg_0= dword ptr  4

push	esi
mov	esi, [esp+4+arg_0]
push	0		; lpModuleName
and	dword ptr [esi], 0
call	ds:GetModuleHandleA
cmp	word ptr [eax],	5A4Dh
jnz	short loc_407E15
mov	ecx, [eax+3Ch]
test	ecx, ecx
jz	short loc_407E15
add	eax, ecx
mov	cl, [eax+1Ah]
mov	[esi], cl
mov	al, [eax+1Bh]
mov	[esi+1], al

loc_407E15:
pop	esi
retn
sub_407DEA endp



; Attributes: bp-based frame

sub_407E17 proc	near

Buffer=	byte ptr -122Ch
Filename= byte ptr -19Ch
VersionInformation= _OSVERSIONINFOA ptr	-98h
var_4= byte ptr	-4

push	ebp
mov	ebp, esp
mov	eax, 122Ch
call	__alloca_probe
lea	eax, [ebp+VersionInformation]
push	ebx
push	eax		; lpVersionInformation
mov	[ebp+VersionInformation.dwOSVersionInfoSize], 94h
call	ds:GetVersionExA
test	eax, eax
jz	short loc_407E5A
cmp	[ebp+VersionInformation.dwPlatformId], 2
jnz	short loc_407E5A
cmp	[ebp+VersionInformation.dwMajorVersion], 5
jb	short loc_407E5A
push	1
pop	eax
jmp	loc_407F5C

loc_407E5A:
lea	eax, [ebp+Buffer]
push	1090h		; nSize
push	eax		; lpBuffer
push	offset Name	; "__MSVCRT_HEAP_SELECT"
call	ds:GetEnvironmentVariableA
test	eax, eax
jz	loc_407F49
xor	ebx, ebx
lea	ecx, [ebp+Buffer]
cmp	[ebp+Buffer], bl
jz	short loc_407E9C

loc_407E89:
mov	al, [ecx]
cmp	al, 61h
jl	short loc_407E97
cmp	al, 7Ah
jg	short loc_407E97
sub	al, 20h
mov	[ecx], al

loc_407E97:
inc	ecx
cmp	[ecx], bl
jnz	short loc_407E89

loc_407E9C:
lea	eax, [ebp+Buffer]
push	16h		; size_t
push	eax		; char *
push	offset a__global_heap_ ; "__GLOBAL_HEAP_SELECTED"
call	_strncmp
add	esp, 0Ch
test	eax, eax
jnz	short loc_407EBE
lea	eax, [ebp+Buffer]
jmp	short loc_407F07

loc_407EBE:
lea	eax, [ebp+Filename]
push	104h		; nSize
push	eax		; lpFilename
push	ebx		; hModule
call	ds:GetModuleFileNameA
cmp	[ebp+Filename],	bl
lea	ecx, [ebp+Filename]
jz	short loc_407EF2

loc_407EDF:
mov	al, [ecx]
cmp	al, 61h
jl	short loc_407EED
cmp	al, 7Ah
jg	short loc_407EED
sub	al, 20h
mov	[ecx], al

loc_407EED:
inc	ecx
cmp	[ecx], bl
jnz	short loc_407EDF

loc_407EF2:
lea	eax, [ebp+Filename]
push	eax		; char *
lea	eax, [ebp+Buffer]
push	eax		; char *
call	_strstr
pop	ecx
pop	ecx

loc_407F07:
cmp	eax, ebx
jz	short loc_407F49
push	2Ch		; int
push	eax		; char *
call	_strchr
pop	ecx
cmp	eax, ebx
pop	ecx
jz	short loc_407F49
inc	eax
mov	ecx, eax
cmp	[eax], bl
jz	short loc_407F2E

loc_407F20:
cmp	byte ptr [ecx],	3Bh
jnz	short loc_407F29
mov	[ecx], bl
jmp	short loc_407F2A

loc_407F29:
inc	ecx

loc_407F2A:
cmp	[ecx], bl
jnz	short loc_407F20

loc_407F2E:		; int
push	0Ah
push	ebx		; char **
push	eax		; char *
call	_strtol
add	esp, 0Ch
cmp	eax, 2
jz	short loc_407F5C
cmp	eax, 3
jz	short loc_407F5C
cmp	eax, 1
jz	short loc_407F5C

loc_407F49:
lea	eax, [ebp+var_4]
push	eax
call	sub_407DEA
cmp	[ebp+var_4], 6
pop	ecx
sbb	eax, eax
add	eax, 3

loc_407F5C:
pop	ebx
leave
retn
sub_407E17 endp




sub_407F5F proc	near

arg_0= dword ptr  4

xor	eax, eax
push	0		; dwMaximumSize
cmp	[esp+4+arg_0], eax
push	1000h		; dwInitialSize
setz	al
push	eax		; flOptions
call	ds:HeapCreate
test	eax, eax
mov	dword_411964, eax
jz	short loc_407FB5
call	sub_407E17
cmp	eax, 3
mov	dword_411968, eax
jnz	short loc_407F9B
push	3F8h
call	___sbh_heap_init
pop	ecx
jmp	short loc_407FA5

loc_407F9B:
cmp	eax, 2
jnz	short loc_407FB8
call	sub_409E00

loc_407FA5:
test	eax, eax
jnz	short loc_407FB8
push	dword_411964	; hHeap
call	ds:HeapDestroy

loc_407FB5:
xor	eax, eax
retn

loc_407FB8:
push	1
pop	eax
retn
sub_407F5F endp

; [00000020 BYTES: COLLAPSED FUNCTION __global_unwind2.	PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000022 BYTES: COLLAPSED FUNCTION __unwind_handler.	PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000068 BYTES: COLLAPSED FUNCTION __local_unwind2. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [00000023 BYTES: COLLAPSED FUNCTION __abnormal_termination. PRESS KEYPAD CTRL-"+" TO EXPAND]

__NLG_Notify1:
push	ebx
push	ecx
mov	ebx, offset unk_40DA64
jmp	short __NLG_Go
; [00000018 BYTES: COLLAPSED FUNCTION __NLG_Notify. PRESS KEYPAD CTRL-"+" TO EXPAND]
align 4
push	esi
inc	ebx
xor	dh, [eax]
pop	eax
inc	ebx
xor	[eax], dh
; [000000BD BYTES: COLLAPSED FUNCTION __except_handler3. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [0000001B BYTES: COLLAPSED FUNCTION _seh_longjmp_unwind(x). PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000039 BYTES: COLLAPSED FUNCTION __FF_MSGBANNER. PRESS KEYPAD CTRL-"+" TO EXPAND]


; Attributes: bp-based frame

; int __cdecl sub_4081C5(DWORD NumberOfBytesWritten)
sub_4081C5 proc	near

Filename= byte ptr -1A4h
var_A0=	byte ptr -0A0h
NumberOfBytesWritten= dword ptr	 8

push	ebp
mov	ebp, esp
sub	esp, 1A4h
mov	edx, [ebp+NumberOfBytesWritten]
xor	ecx, ecx
mov	eax, offset dword_40DA78

loc_4081D8:
cmp	edx, [eax]
jz	short loc_4081E7
add	eax, 8
inc	ecx
cmp	eax, offset off_40DB08
jb	short loc_4081D8

loc_4081E7:
push	esi
mov	esi, ecx
shl	esi, 3
cmp	edx, dword_40DA78[esi]
jnz	loc_408315
mov	eax, dword_41027C
cmp	eax, 1
jz	loc_4082EF
test	eax, eax
jnz	short loc_408218
cmp	dword_40D9C0, 1
jz	loc_4082EF

loc_408218:
cmp	edx, 0FCh
jz	loc_408315
lea	eax, [ebp+Filename]
push	104h		; nSize
push	eax		; lpFilename
push	0		; hModule
call	ds:GetModuleFileNameA
test	eax, eax
jnz	short loc_40824F
lea	eax, [ebp+Filename]
push	offset aProgramNameUnk ; "<program name	unknown>"
push	eax		; char *
call	_strcpy
pop	ecx
pop	ecx

loc_40824F:
lea	eax, [ebp+Filename]
push	edi
push	eax		; char *
lea	edi, [ebp+Filename]
call	_strlen
inc	eax
pop	ecx
cmp	eax, 3Ch
jbe	short loc_408292
lea	eax, [ebp+Filename]
push	eax		; char *
call	_strlen
mov	edi, eax
lea	eax, [ebp+Filename]
sub	eax, 3Bh
push	3		; size_t
add	edi, eax
push	offset a___	; "..."
push	edi		; char *
call	_strncpy
add	esp, 10h

loc_408292:
lea	eax, [ebp+var_A0]
push	offset aRuntimeErrorPr ; "Runtime Error!\n\nProgram: "
push	eax		; char *
call	_strcpy
lea	eax, [ebp+var_A0]
push	edi		; char *
push	eax		; char *
call	_strcat
lea	eax, [ebp+var_A0]
push	offset asc_40C51C ; "\n\n"
push	eax		; char *
call	_strcat
push	off_40DA7C[esi]	; char *
lea	eax, [ebp+var_A0]
push	eax		; char *
call	_strcat
push	12010h
lea	eax, [ebp+var_A0]
push	offset aMicrosoftVisua ; "Microsoft Visual C++ Runtime Library"
push	eax
call	___crtMessageBoxA
add	esp, 2Ch
pop	edi
jmp	short loc_408315

loc_4082EF:
lea	eax, [ebp+NumberOfBytesWritten]
lea	esi, off_40DA7C[esi]
push	0		; lpOverlapped
push	eax		; lpNumberOfBytesWritten
push	dword ptr [esi]	; char *
call	_strlen
pop	ecx
push	eax		; nNumberOfBytesToWrite
push	dword ptr [esi]	; lpBuffer
push	0FFFFFFF4h	; nStdHandle
call	ds:GetStdHandle
push	eax		; hFile
call	ds:WriteFile

loc_408315:
pop	esi
leave
retn
sub_4081C5 endp

; [0000009A BYTES: COLLAPSED FUNCTION __lseek. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [000001AD BYTES: COLLAPSED FUNCTION __write. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [00000044 BYTES: COLLAPSED FUNCTION __getbuf.	PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000026 BYTES: COLLAPSED FUNCTION __isatty.	PRESS KEYPAD CTRL-"+" TO EXPAND]

___initstdio:
mov	eax, dword_411960
push	esi
push	14h
test	eax, eax
pop	esi
jnz	short loc_4085DD
mov	eax, 200h
jmp	short loc_4085E3

loc_4085DD:
cmp	eax, esi
jge	short loc_4085E8
mov	eax, esi

loc_4085E3:
mov	dword_411960, eax

loc_4085E8:
push	4
push	eax
call	sub_40A6CC
pop	ecx
mov	dword_410948, eax
test	eax, eax
pop	ecx
jnz	short loc_40861C
push	4
push	esi
mov	dword_411960, esi
call	sub_40A6CC
pop	ecx
mov	dword_410948, eax
test	eax, eax
pop	ecx
jnz	short loc_40861C
push	1Ah
call	__amsg_exit
db  59h	; Y

loc_40861C:
xor	ecx, ecx
mov	eax, offset off_40DB08

loc_408623:
mov	edx, dword_410948
mov	[ecx+edx], eax
add	eax, 20h
add	ecx, 4
cmp	eax, offset unk_40DD88
jl	short loc_408623
xor	edx, edx
mov	ecx, offset unk_40DB18

loc_408640:
mov	eax, edx
mov	esi, edx
sar	eax, 5
and	esi, 1Fh
mov	eax, dword_411980[eax*4]
mov	eax, [eax+esi*8]
cmp	eax, 0FFFFFFFFh
jz	short loc_40865D
test	eax, eax
jnz	short loc_408660

loc_40865D:
or	dword ptr [ecx], 0FFFFFFFFh

loc_408660:
add	ecx, 20h
inc	edx
cmp	ecx, offset unk_40DB78
jl	short loc_408640
pop	esi
retn

___endstdio:
call	sub_40A86C
cmp	byte_4102C0, 0
jz	short locret_408681
jmp	__fcloseall

locret_408681:
retn


; Attributes: bp-based frame

; int __cdecl sub_408682(LPVOID	lpMem)
sub_408682 proc	near

var_4= dword ptr -4
lpMem= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	esi
mov	esi, [ebp+lpMem]
test	esi, esi
jz	short loc_4086E8
mov	eax, dword_411968
cmp	eax, 3
jnz	short loc_4086AE
push	esi
call	___sbh_find_block
pop	ecx
test	eax, eax
push	esi
jz	short loc_4086DA
push	eax
call	sub_409622
pop	ecx
pop	ecx
jmp	short loc_4086E8

loc_4086AE:
cmp	eax, 2
jnz	short loc_4086D9
lea	eax, [ebp+lpMem]
push	eax
lea	eax, [ebp+var_4]
push	eax
push	esi
call	sub_40A05C
add	esp, 0Ch
test	eax, eax
jz	short loc_4086D9
push	eax
push	[ebp+lpMem]
push	[ebp+var_4]
call	sub_40A0B3
add	esp, 0Ch
jmp	short loc_4086E8

loc_4086D9:		; lpMem
push	esi

loc_4086DA:		; dwFlags
push	0
push	dword_411964	; hHeap
call	ds:HeapFree

loc_4086E8:
pop	esi
leave
retn
sub_408682 endp

align 10h
; [0000007B BYTES: COLLAPSED FUNCTION _strlen. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [00000012 BYTES: COLLAPSED FUNCTION _malloc. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [0000002C BYTES: COLLAPSED FUNCTION __nh_malloc. PRESS KEYPAD	CTRL-"+" TO EXPAND]



sub_4087A9 proc	near

arg_0= dword ptr  4

mov	eax, dword_411968
push	esi
mov	esi, [esp+4+arg_0]
cmp	eax, 3
jnz	short loc_4087CD
cmp	esi, dword_410714
ja	short loc_4087FF
push	esi
call	___sbh_alloc_block
test	eax, eax
pop	ecx
jz	short loc_4087FF
pop	esi
retn

loc_4087CD:
cmp	eax, 2
jnz	short loc_4087FF
mov	eax, [esp+4+arg_0]
test	eax, eax
jz	short loc_4087E2
lea	esi, [eax+0Fh]
and	esi, 0FFFFFFF0h
jmp	short loc_4087E5

loc_4087E2:
push	10h
pop	esi

loc_4087E5:
cmp	esi, dword_4100E4
ja	short loc_40880C
mov	eax, esi
shr	eax, 4
push	eax
call	sub_40A0F8
test	eax, eax
pop	ecx
jnz	short loc_40881B
jmp	short loc_40880C

loc_4087FF:
test	esi, esi
jnz	short loc_408806
push	1
pop	esi

loc_408806:
add	esi, 0Fh
and	esi, 0FFFFFFF0h

loc_40880C:		; dwBytes
push	esi
push	0		; dwFlags
push	dword_411964	; hHeap
call	ds:HeapAlloc

loc_40881B:
pop	esi
retn
sub_4087A9 endp

; [00000068 BYTES: COLLAPSED FUNCTION _wctomb. PRESS KEYPAD CTRL-"+" TO	EXPAND]
align 10h
; [00000068 BYTES: COLLAPSED FUNCTION __aulldiv. PRESS KEYPAD CTRL-"+" TO EXPAND]
align 10h
; [00000075 BYTES: COLLAPSED FUNCTION __aullrem. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __ismbblead. PRESS KEYPAD	CTRL-"+" TO EXPAND]
; [00000031 BYTES: COLLAPSED FUNCTION _x_ismbbtype. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000199 BYTES: COLLAPSED FUNCTION __setmbcp. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [0000004A BYTES: COLLAPSED FUNCTION _getSystemCP. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000033 BYTES: COLLAPSED FUNCTION _CPtoLCID. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000029 BYTES: COLLAPSED FUNCTION _setSBCS.	PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000185 BYTES: COLLAPSED FUNCTION _setSBUpLow. PRESS KEYPAD	CTRL-"+" TO EXPAND]
; [0000001C BYTES: COLLAPSED FUNCTION ___initmbctable. PRESS KEYPAD CTRL-"+" TO	EXPAND]
align 10h
; [00000007 BYTES: COLLAPSED FUNCTION _strcpy. PRESS KEYPAD CTRL-"+" TO	EXPAND]
align 10h
; [000000E0 BYTES: COLLAPSED FUNCTION _strcat. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [00000335 BYTES: COLLAPSED FUNCTION _memcpy. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [00000017 BYTES: COLLAPSED FUNCTION _strtol. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [00000208 BYTES: COLLAPSED FUNCTION _strtoxl.	PRESS KEYPAD CTRL-"+" TO EXPAND]
align 10h
; [00000005 BYTES: COLLAPSED CHUNK OF FUNCTION _strchr.	PRESS KEYPAD CTRL-"+" TO EXPAND]
align 10h
; [000000BC BYTES: COLLAPSED FUNCTION _strchr. PRESS KEYPAD CTRL-"+" TO	EXPAND]
align 10h
; [00000080 BYTES: COLLAPSED FUNCTION _strstr. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [00000038 BYTES: COLLAPSED FUNCTION _strncmp.	PRESS KEYPAD CTRL-"+" TO EXPAND]
align 10h
; [0000002F BYTES: COLLAPSED FUNCTION __alloca_probe. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000048 BYTES: COLLAPSED FUNCTION ___sbh_heap_init.	PRESS KEYPAD CTRL-"+" TO EXPAND]
; [0000002B BYTES: COLLAPSED FUNCTION ___sbh_find_block. PRESS KEYPAD CTRL-"+" TO EXPAND]


; Attributes: bp-based frame

sub_409622 proc	near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
sub	esp, 10h
mov	ecx, [ebp+arg_0]
push	ebx
push	esi
mov	esi, [ebp+arg_4]
mov	eax, [ecx+10h]
push	edi
mov	edi, esi
add	esi, 0FFFFFFFCh
sub	edi, [ecx+0Ch]
shr	edi, 0Fh
mov	ecx, edi
imul	ecx, 204h
lea	ecx, [ecx+eax+144h]
mov	[ebp+var_10], ecx
mov	ecx, [esi]
dec	ecx
test	cl, 1
mov	[ebp+var_4], ecx
jnz	loc_409946
mov	edx, [ecx+esi]
lea	ebx, [ecx+esi]
mov	[ebp+var_C], edx
mov	edx, [esi-4]
mov	[ebp+var_8], edx
mov	edx, [ebp+var_C]
test	dl, 1
mov	[ebp+arg_4], ebx
jnz	short loc_4096F8
sar	edx, 4
dec	edx
cmp	edx, 3Fh
jbe	short loc_409686
push	3Fh
pop	edx

loc_409686:
mov	ecx, [ebx+4]
cmp	ecx, [ebx+8]
jnz	short loc_4096DA
cmp	edx, 20h
jnb	short loc_4096B1
mov	ebx, 80000000h
mov	ecx, edx
shr	ebx, cl
lea	ecx, [edx+eax+4]
not	ebx
and	[eax+edi*4+44h], ebx
dec	byte ptr [ecx]
jnz	short loc_4096D2
mov	ecx, [ebp+arg_0]
and	[ecx], ebx
jmp	short loc_4096D2

loc_4096B1:
lea	ecx, [edx-20h]
mov	ebx, 80000000h
shr	ebx, cl
lea	ecx, [edx+eax+4]
not	ebx
and	[eax+edi*4+0C4h], ebx
dec	byte ptr [ecx]
jnz	short loc_4096D2
mov	ecx, [ebp+arg_0]
and	[ecx+4], ebx

loc_4096D2:
mov	ecx, [ebp+var_4]
mov	ebx, [ebp+arg_4]
jmp	short loc_4096DD

loc_4096DA:
mov	ecx, [ebp+var_4]

loc_4096DD:
mov	edx, [ebx+8]
mov	ebx, [ebx+4]
add	ecx, [ebp+var_C]
mov	[edx+4], ebx
mov	edx, [ebp+arg_4]
mov	[ebp+var_4], ecx
mov	ebx, [edx+4]
mov	edx, [edx+8]
mov	[ebx+8], edx

loc_4096F8:
mov	edx, ecx
sar	edx, 4
dec	edx
cmp	edx, 3Fh
jbe	short loc_409706
push	3Fh
pop	edx

loc_409706:
mov	ebx, [ebp+var_8]
and	ebx, 1
mov	[ebp+var_C], ebx
jnz	loc_4097A9
sub	esi, [ebp+var_8]
mov	ebx, [ebp+var_8]
sar	ebx, 4
push	3Fh
mov	[ebp+arg_4], esi
dec	ebx
pop	esi
cmp	ebx, esi
jbe	short loc_40972B
mov	ebx, esi

loc_40972B:
add	ecx, [ebp+var_8]
mov	edx, ecx
mov	[ebp+var_4], ecx
sar	edx, 4
dec	edx
cmp	edx, esi
jbe	short loc_40973D
mov	edx, esi

loc_40973D:
cmp	ebx, edx
jz	short loc_4097A4
mov	ecx, [ebp+arg_4]
mov	esi, [ecx+4]
cmp	esi, [ecx+8]
jnz	short loc_40978C
cmp	ebx, 20h
jnb	short loc_40976D
mov	esi, 80000000h
mov	ecx, ebx
shr	esi, cl
not	esi
and	[eax+edi*4+44h], esi
dec	byte ptr [ebx+eax+4]
jnz	short loc_40978C
mov	ecx, [ebp+arg_0]
and	[ecx], esi
jmp	short loc_40978C

loc_40976D:
lea	ecx, [ebx-20h]
mov	esi, 80000000h
shr	esi, cl
not	esi
and	[eax+edi*4+0C4h], esi
dec	byte ptr [ebx+eax+4]
jnz	short loc_40978C
mov	ecx, [ebp+arg_0]
and	[ecx+4], esi

loc_40978C:
mov	ecx, [ebp+arg_4]
mov	esi, [ecx+8]
mov	ecx, [ecx+4]
mov	[esi+4], ecx
mov	ecx, [ebp+arg_4]
mov	esi, [ecx+4]
mov	ecx, [ecx+8]
mov	[esi+8], ecx

loc_4097A4:
mov	esi, [ebp+arg_4]
jmp	short loc_4097AC

loc_4097A9:
mov	ebx, [ebp+arg_0]

loc_4097AC:
cmp	[ebp+var_C], 0
jnz	short loc_4097BA
cmp	ebx, edx
jz	loc_40983B

loc_4097BA:
mov	ecx, [ebp+var_10]
mov	ebx, [ecx+edx*8+4]
lea	ecx, [ecx+edx*8]
mov	[esi+4], ebx
mov	[esi+8], ecx
mov	[ecx+4], esi
mov	ecx, [esi+4]
mov	[ecx+8], esi
mov	ecx, [esi+4]
cmp	ecx, [esi+8]
jnz	short loc_40983B
mov	cl, [edx+eax+4]
cmp	edx, 20h
mov	byte ptr [ebp+arg_4+3],	cl
inc	cl
mov	[edx+eax+4], cl
jnb	short loc_409812
cmp	byte ptr [ebp+arg_4+3],	0
jnz	short loc_409801
mov	ebx, 80000000h
mov	ecx, edx
shr	ebx, cl
mov	ecx, [ebp+arg_0]
or	[ecx], ebx

loc_409801:
mov	ebx, 80000000h
mov	ecx, edx
shr	ebx, cl
lea	eax, [eax+edi*4+44h]
or	[eax], ebx
jmp	short loc_40983B

loc_409812:
cmp	byte ptr [ebp+arg_4+3],	0
jnz	short loc_409828
lea	ecx, [edx-20h]
mov	ebx, 80000000h
shr	ebx, cl
mov	ecx, [ebp+arg_0]
or	[ecx+4], ebx

loc_409828:
lea	ecx, [edx-20h]
mov	edx, 80000000h
shr	edx, cl
lea	eax, [eax+edi*4+0C4h]
or	[eax], edx

loc_40983B:
mov	eax, [ebp+var_4]
mov	[esi], eax
mov	[eax+esi-4], eax
mov	eax, [ebp+var_10]
dec	dword ptr [eax]
jnz	loc_409946
mov	eax, dword_410708
test	eax, eax
jz	loc_409938
mov	ecx, dword_410700
mov	esi, ds:VirtualFree
shl	ecx, 0Fh
add	ecx, [eax+0Ch]
mov	ebx, 8000h
push	4000h		; dwFreeType
push	ebx		; dwSize
push	ecx		; lpAddress
call	esi ; VirtualFree
mov	ecx, dword_410700
mov	eax, dword_410708
mov	edx, 80000000h
shr	edx, cl
or	[eax+8], edx
mov	eax, dword_410708
mov	ecx, dword_410700
mov	eax, [eax+10h]
and	dword ptr [eax+ecx*4+0C4h], 0
mov	eax, dword_410708
mov	eax, [eax+10h]
dec	byte ptr [eax+43h]
mov	eax, dword_410708
mov	ecx, [eax+10h]
cmp	byte ptr [ecx+43h], 0
jnz	short loc_4098C9
and	dword ptr [eax+4], 0FFFFFFFEh
mov	eax, dword_410708

loc_4098C9:
cmp	dword ptr [eax+8], 0FFFFFFFFh
jnz	short loc_409938
push	ebx		; dwFreeType
push	0		; dwSize
push	dword ptr [eax+0Ch] ; lpAddress
call	esi ; VirtualFree
mov	eax, dword_410708
push	dword ptr [eax+10h] ; lpMem
push	0		; dwFlags
push	dword_411964	; hHeap
call	ds:HeapFree
mov	eax, dword_41070C
mov	edx, dword_410710
lea	eax, [eax+eax*4]
shl	eax, 2
mov	ecx, eax
mov	eax, dword_410708
sub	ecx, eax
lea	ecx, [ecx+edx-14h]
push	ecx		; size_t
lea	ecx, [eax+14h]
push	ecx		; void *
push	eax		; void *
call	_memcpy_0
mov	eax, [ebp+arg_0]
add	esp, 0Ch
dec	dword_41070C
cmp	eax, dword_410708
jbe	short loc_40992E
sub	[ebp+arg_0], 14h

loc_40992E:
mov	eax, dword_410710
mov	dword_410704, eax

loc_409938:
mov	eax, [ebp+arg_0]
mov	dword_410700, edi
mov	dword_410708, eax

loc_409946:
pop	edi
pop	esi
pop	ebx
leave
retn
sub_409622 endp

; [00000309 BYTES: COLLAPSED FUNCTION ___sbh_alloc_block. PRESS	KEYPAD CTRL-"+"	TO EXPAND]
; [000000B1 BYTES: COLLAPSED FUNCTION ___sbh_alloc_new_region. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [000000FB BYTES: COLLAPSED FUNCTION ___sbh_alloc_new_group. PRESS KEYPAD CTRL-"+" TO EXPAND]



sub_409E00 proc	near
cmp	dword_40E0D0, 0FFFFFFFFh
push	ebx
push	ebp
push	esi
push	edi
jnz	short loc_409E14
mov	esi, offset off_40E0C0
jmp	short loc_409E31

loc_409E14:		; dwBytes
push	2020h
push	0		; dwFlags
push	dword_411964	; hHeap
call	ds:HeapAlloc
mov	esi, eax
test	esi, esi
jz	loc_409F3D

loc_409E31:
mov	ebp, ds:VirtualAlloc
push	4		; flProtect
push	2000h		; flAllocationType
push	400000h		; dwSize
push	0		; lpAddress
call	ebp ; VirtualAlloc
mov	edi, eax
test	edi, edi
jz	loc_409F26
push	4		; flProtect
mov	ebx, 10000h
push	1000h		; flAllocationType
push	ebx		; dwSize
push	edi		; lpAddress
call	ebp ; VirtualAlloc
test	eax, eax
jz	loc_409F18
mov	eax, offset off_40E0C0
cmp	esi, eax
jnz	short loc_409E90
cmp	off_40E0C0, 0
jnz	short loc_409E80
mov	off_40E0C0, eax

loc_409E80:
cmp	off_40E0C4, 0
jnz	short loc_409EA5
mov	off_40E0C4, eax
jmp	short loc_409EA5

loc_409E90:
mov	[esi], eax
mov	eax, off_40E0C4
mov	[esi+4], eax
mov	off_40E0C4, esi
mov	eax, [esi+4]
mov	[eax], esi

loc_409EA5:
lea	eax, [edi+400000h]
lea	ecx, [esi+98h]
mov	[esi+14h], eax
lea	eax, [esi+18h]
mov	[esi+0Ch], ecx
mov	[esi+10h], edi
mov	[esi+8], eax
xor	ebp, ebp
mov	ecx, 0F1h

loc_409EC7:
xor	edx, edx
cmp	ebp, 10h
setnl	dl
dec	edx
and	edx, ecx
dec	edx
inc	ebp
mov	[eax], edx
mov	[eax+4], ecx
add	eax, 8
cmp	ebp, 400h
jl	short loc_409EC7
push	ebx		; size_t
push	0		; int
push	edi		; void *
call	_memset
add	esp, 0Ch

loc_409EF0:
mov	eax, [esi+10h]
add	eax, ebx
cmp	edi, eax
jnb	short loc_409F14
or	byte ptr [edi+0F8h], 0FFh
lea	eax, [edi+8]
mov	[edi], eax
mov	dword ptr [edi+4], 0F0h
add	edi, 1000h
jmp	short loc_409EF0

loc_409F14:
mov	eax, esi
jmp	short loc_409F3F

loc_409F18:		; dwFreeType
push	8000h
push	0		; dwSize
push	edi		; lpAddress
call	ds:VirtualFree

loc_409F26:
cmp	esi, offset off_40E0C0
jz	short loc_409F3D
push	esi		; lpMem
push	0		; dwFlags
push	dword_411964	; hHeap
call	ds:HeapFree

loc_409F3D:
xor	eax, eax

loc_409F3F:
pop	edi
pop	esi
pop	ebp
pop	ebx
retn
sub_409E00 endp




; int __cdecl sub_409F44(LPVOID	lpMem)
sub_409F44 proc	near

lpMem= dword ptr  4

push	esi
mov	esi, [esp+4+lpMem]
push	8000h		; dwFreeType
push	0		; dwSize
push	dword ptr [esi+10h] ; lpAddress
call	ds:VirtualFree
cmp	off_4100E0, esi
jnz	short loc_409F69
mov	eax, [esi+4]
mov	off_4100E0, eax

loc_409F69:
cmp	esi, offset off_40E0C0
jz	short loc_409F91
mov	eax, [esi+4]
mov	ecx, [esi]
push	esi		; lpMem
push	0		; dwFlags
mov	[eax], ecx
mov	eax, [esi]
mov	ecx, [esi+4]
mov	[eax+4], ecx
push	dword_411964	; hHeap
call	ds:HeapFree
pop	esi
retn

loc_409F91:
or	dword_40E0D0, 0FFFFFFFFh
pop	esi
retn
sub_409F44 endp



; Attributes: bp-based frame

sub_409F9A proc	near

var_4= dword ptr -4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
mov	esi, off_40E0C4
push	edi

loc_409FA7:
cmp	dword ptr [esi+10h], 0FFFFFFFFh
jz	loc_40A045
and	[ebp+var_4], 0
lea	edi, [esi+2010h]
mov	ebx, 3FF000h

loc_409FC0:
cmp	dword ptr [edi], 0F0h
jnz	short loc_40A001
mov	eax, ebx
push	4000h		; dwFreeType
add	eax, [esi+10h]
push	1000h		; dwSize
push	eax		; lpAddress
call	ds:VirtualFree
test	eax, eax
jz	short loc_40A001
or	dword ptr [edi], 0FFFFFFFFh
dec	dword_4103E4
mov	eax, [esi+0Ch]
test	eax, eax
jz	short loc_409FF6
cmp	eax, edi
jbe	short loc_409FF9

loc_409FF6:
mov	[esi+0Ch], edi

loc_409FF9:
inc	[ebp+var_4]
dec	[ebp+arg_0]
jz	short loc_40A00E

loc_40A001:
sub	ebx, 1000h
sub	edi, 8
test	ebx, ebx
jge	short loc_409FC0

loc_40A00E:
cmp	[ebp+var_4], 0
mov	ecx, esi
mov	esi, [esi+4]
jz	short loc_40A045
cmp	dword ptr [ecx+18h], 0FFFFFFFFh
jnz	short loc_40A045
push	1
lea	eax, [ecx+20h]
pop	edx

loc_40A025:
cmp	dword ptr [eax], 0FFFFFFFFh
jnz	short loc_40A036
inc	edx
add	eax, 8
cmp	edx, 400h
jl	short loc_40A025

loc_40A036:
cmp	edx, 400h
jnz	short loc_40A045
push	ecx		; lpMem
call	sub_409F44
pop	ecx

loc_40A045:
cmp	esi, off_40E0C4
jz	short loc_40A057
cmp	[ebp+arg_0], 0
jg	loc_409FA7

loc_40A057:
pop	edi
pop	esi
pop	ebx
leave
retn
sub_409F9A endp




sub_40A05C proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

mov	eax, [esp+arg_0]
mov	edx, offset off_40E0C0
push	esi
mov	ecx, edx

loc_40A068:
cmp	eax, [ecx+10h]
jbe	short loc_40A072
cmp	eax, [ecx+14h]
jb	short loc_40A07A

loc_40A072:
mov	ecx, [ecx]
cmp	ecx, edx
jz	short loc_40A0AF
jmp	short loc_40A068

loc_40A07A:
test	al, 0Fh
jnz	short loc_40A0AF
mov	esi, eax
mov	edx, 100h
and	esi, 0FFFh
cmp	esi, edx
jb	short loc_40A0AF
mov	esi, [esp+4+arg_4]
mov	[esi], ecx
mov	esi, [esp+4+arg_8]
mov	ecx, eax
and	cx, 0F000h
sub	eax, ecx
mov	[esi], ecx
sub	eax, edx
pop	esi
sar	eax, 4
lea	eax, [eax+ecx+8]
retn

loc_40A0AF:
xor	eax, eax
pop	esi
retn
sub_40A05C endp




sub_40A0B3 proc	near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

mov	eax, [esp+arg_0]
mov	ecx, [esp+arg_4]
sub	ecx, [eax+10h]
sar	ecx, 0Ch
lea	eax, [eax+ecx*8+18h]
mov	ecx, [esp+arg_8]
movzx	edx, byte ptr [ecx]
add	[eax], edx
and	byte ptr [ecx],	0
cmp	dword ptr [eax], 0F0h
mov	dword ptr [eax+4], 0F1h
jnz	short locret_40A0F7
inc	dword_4103E4
cmp	dword_4103E4, 20h
jnz	short locret_40A0F7
push	10h
call	sub_409F9A
pop	ecx

locret_40A0F7:
retn
sub_40A0B3 endp



; Attributes: bp-based frame

sub_40A0F8 proc	near

var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ecx
push	ebx
push	esi
mov	esi, off_4100E0
push	edi

loc_40A106:
mov	edx, [esi+10h]
cmp	edx, 0FFFFFFFFh
jz	loc_40A1B1
mov	edi, [esi+8]
lea	ecx, [esi+2018h]
mov	eax, edi
sub	eax, esi
sub	eax, 18h
sar	eax, 3
shl	eax, 0Ch
add	eax, edx
cmp	edi, ecx
mov	[ebp+var_4], eax
jnb	short loc_40A16B

loc_40A131:
mov	ecx, [edi]
mov	ebx, [ebp+arg_0]
cmp	ecx, ebx
jl	short loc_40A154
cmp	[edi+4], ebx
jbe	short loc_40A154
push	ebx
push	ecx
push	eax
call	sub_40A300
add	esp, 0Ch
test	eax, eax
jnz	short loc_40A1C3
mov	eax, [ebp+var_4]
mov	[edi+4], ebx

loc_40A154:
add	edi, 8
lea	ecx, [esi+2018h]
add	eax, 1000h
cmp	edi, ecx
mov	[ebp+var_4], eax
jb	short loc_40A131
jmp	short loc_40A16E

loc_40A16B:
mov	ebx, [ebp+arg_0]

loc_40A16E:
mov	eax, [esi+8]
mov	ecx, [esi+10h]
lea	edi, [esi+18h]
mov	[ebp+var_8], eax
cmp	edi, eax
mov	[ebp+var_4], ecx
jnb	short loc_40A1B4

loc_40A181:
mov	eax, [edi]
cmp	eax, ebx
jl	short loc_40A1A0
cmp	[edi+4], ebx
jbe	short loc_40A1A0
push	ebx
push	eax
push	[ebp+var_4]
call	sub_40A300
add	esp, 0Ch
test	eax, eax
jnz	short loc_40A1C3
mov	[edi+4], ebx

loc_40A1A0:
add	[ebp+var_4], 1000h
add	edi, 8
cmp	edi, [ebp+var_8]
jb	short loc_40A181
jmp	short loc_40A1B4

loc_40A1B1:
mov	ebx, [ebp+arg_0]

loc_40A1B4:
mov	esi, [esi]
cmp	esi, off_4100E0
jz	short loc_40A1D3
jmp	loc_40A106

loc_40A1C3:
mov	off_4100E0, esi
sub	[edi], ebx
mov	[esi+8], edi
jmp	loc_40A2FB

loc_40A1D3:
mov	eax, offset off_40E0C0
mov	edi, eax

loc_40A1DA:
cmp	dword ptr [edi+10h], 0FFFFFFFFh
jz	short loc_40A1E6
cmp	dword ptr [edi+0Ch], 0
jnz	short loc_40A1F2

loc_40A1E6:
mov	edi, [edi]
cmp	edi, eax
jz	loc_40A2C7
jmp	short loc_40A1DA

loc_40A1F2:
mov	ebx, [edi+0Ch]
and	[ebp+var_4], 0
mov	esi, ebx
mov	eax, ebx
sub	esi, edi
sub	esi, 18h
sar	esi, 3
shl	esi, 0Ch
add	esi, [edi+10h]
cmp	dword ptr [ebx], 0FFFFFFFFh
jnz	short loc_40A221

loc_40A210:
cmp	[ebp+var_4], 10h
jge	short loc_40A221
add	eax, 8
inc	[ebp+var_4]
cmp	dword ptr [eax], 0FFFFFFFFh
jz	short loc_40A210

loc_40A221:
mov	eax, [ebp+var_4]
push	4		; flProtect
shl	eax, 0Ch
push	1000h		; flAllocationType
push	eax		; dwSize
push	esi		; lpAddress
mov	[ebp+var_8], eax
call	ds:VirtualAlloc
cmp	eax, esi
jnz	loc_40A2F9
push	0		; size_t
push	[ebp+var_8]	; int
push	esi		; void *
call	_memset
mov	edx, [ebp+var_4]
add	esp, 0Ch
test	edx, edx
mov	ecx, ebx
jle	short loc_40A288
lea	eax, [esi+4]
mov	[ebp+var_4], edx

loc_40A25E:
or	byte ptr [eax+0F4h], 0FFh
lea	edx, [eax+4]
mov	[eax-4], edx
mov	edx, 0F0h
mov	[eax], edx
mov	[ecx], edx
mov	dword ptr [ecx+4], 0F1h
add	eax, 1000h
add	ecx, 8
dec	[ebp+var_4]
jnz	short loc_40A25E

loc_40A288:
mov	off_4100E0, edi
lea	eax, [edi+2018h]

loc_40A294:
cmp	ecx, eax
jnb	short loc_40A2A4
cmp	dword ptr [ecx], 0FFFFFFFFh
jz	short loc_40A2A2
add	ecx, 8
jmp	short loc_40A294

loc_40A2A2:
cmp	ecx, eax

loc_40A2A4:
sbb	eax, eax
and	eax, ecx
mov	[edi+0Ch], eax
mov	eax, [ebp+arg_0]
mov	[esi+8], al
mov	[edi+8], ebx
sub	[ebx], eax
sub	[esi+4], eax
lea	ecx, [esi+eax+8]
lea	eax, [esi+100h]
mov	[esi], ecx
jmp	short loc_40A2FB

loc_40A2C7:
call	sub_409E00
test	eax, eax
jz	short loc_40A2F9
mov	ecx, [eax+10h]
mov	[ecx+8], bl
lea	edx, [ecx+ebx+8]
mov	off_4100E0, eax
mov	[ecx], edx
mov	edx, 0F0h
sub	edx, ebx
mov	[ecx+4], edx
movzx	edx, bl
sub	[eax+18h], edx
lea	eax, [ecx+100h]
jmp	short loc_40A2FB

loc_40A2F9:
xor	eax, eax

loc_40A2FB:
pop	edi
pop	esi
pop	ebx
leave
retn
sub_40A0F8 endp



; Attributes: bp-based frame

sub_40A300 proc	near

var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
push	ecx
mov	ecx, [ebp+arg_0]
mov	edx, [ebp+arg_8]
push	ebx
push	esi
mov	esi, [ecx+4]
push	edi
mov	edi, [ecx]
lea	ebx, [ecx+0F8h]
cmp	esi, edx
mov	[ebp+var_4], edi
mov	eax, edi
mov	[ebp+arg_0], ebx
jb	short loc_40A345
lea	eax, [edi+edx]
mov	[edi], dl
cmp	eax, ebx
jnb	short loc_40A334
add	[ecx], edx
sub	[ecx+4], edx
jmp	short loc_40A33D

loc_40A334:
and	dword ptr [ecx+4], 0
lea	eax, [ecx+8]
mov	[ecx], eax

loc_40A33D:
lea	eax, [edi+8]
jmp	loc_40A413

loc_40A345:
add	esi, edi
cmp	byte ptr [esi],	0
jz	short loc_40A34E
mov	eax, esi

loc_40A34E:
lea	esi, [eax+edx]
cmp	esi, ebx
jnb	short loc_40A398

loc_40A355:
mov	bl, [eax]
test	bl, bl
jnz	short loc_40A38B
push	1
lea	ebx, [eax+1]
pop	esi

loc_40A361:
cmp	byte ptr [ebx],	0
jnz	short loc_40A36A
inc	ebx
inc	esi
jmp	short loc_40A361

loc_40A36A:
cmp	esi, edx
jnb	short loc_40A3BC
cmp	eax, [ebp+var_4]
jnz	short loc_40A378
mov	[ecx+4], esi
jmp	short loc_40A384

loc_40A378:
sub	[ebp+arg_4], esi
cmp	[ebp+arg_4], edx
jb	loc_40A41D

loc_40A384:
mov	edi, [ebp+var_4]
mov	eax, ebx
jmp	short loc_40A390

loc_40A38B:
movzx	esi, bl
add	eax, esi

loc_40A390:
lea	esi, [eax+edx]
cmp	esi, [ebp+arg_0]
jb	short loc_40A355

loc_40A398:
lea	esi, [ecx+8]

loc_40A39B:
cmp	esi, edi
jnb	short loc_40A41D
lea	eax, [esi+edx]
cmp	eax, [ebp+arg_0]
jnb	short loc_40A41D
mov	al, [esi]
test	al, al
jnz	short loc_40A3ED
push	1
lea	ebx, [esi+1]
pop	eax

loc_40A3B3:
cmp	byte ptr [ebx],	0
jnz	short loc_40A3DD
inc	ebx
inc	eax
jmp	short loc_40A3B3

loc_40A3BC:
lea	ebx, [eax+edx]
cmp	ebx, [ebp+arg_0]
jnb	short loc_40A3CD
sub	esi, edx
mov	[ecx], ebx
mov	[ecx+4], esi
jmp	short loc_40A3D6

loc_40A3CD:
and	dword ptr [ecx+4], 0
lea	esi, [ecx+8]
mov	[ecx], esi

loc_40A3D6:
mov	[eax], dl
add	eax, 8
jmp	short loc_40A413

loc_40A3DD:
cmp	eax, edx
jnb	short loc_40A3F4
sub	[ebp+arg_4], eax
cmp	[ebp+arg_4], edx
jb	short loc_40A41D
mov	esi, ebx
jmp	short loc_40A39B

loc_40A3ED:
movzx	eax, al
add	esi, eax
jmp	short loc_40A39B

loc_40A3F4:
lea	ebx, [esi+edx]
cmp	ebx, [ebp+arg_0]
jnb	short loc_40A405
sub	eax, edx
mov	[ecx], ebx
mov	[ecx+4], eax
jmp	short loc_40A40E

loc_40A405:
and	dword ptr [ecx+4], 0
lea	eax, [ecx+8]
mov	[ecx], eax

loc_40A40E:
mov	[esi], dl
lea	eax, [esi+8]

loc_40A413:
imul	ecx, 0Fh
shl	eax, 4
sub	eax, ecx
jmp	short loc_40A41F

loc_40A41D:
xor	eax, eax

loc_40A41F:
pop	edi
pop	esi
pop	ebx
leave
retn
sub_40A300 endp

; [00000089 BYTES: COLLAPSED FUNCTION ___crtMessageBoxA. PRESS KEYPAD CTRL-"+" TO EXPAND]
align 10h
; [000000FE BYTES: COLLAPSED FUNCTION _strncpy.	PRESS KEYPAD CTRL-"+" TO EXPAND]



sub_40A5AE proc	near

arg_0= dword ptr  4

mov	ecx, [esp+arg_0]
xor	edx, edx
mov	dword_410284, ecx
mov	eax, offset unk_4100F0

loc_40A5BF:
cmp	ecx, [eax]
jz	short loc_40A5E3
add	eax, 8
inc	edx
cmp	eax, offset cbMultiByte
jb	short loc_40A5BF
cmp	ecx, 13h
jb	short loc_40A5F0
cmp	ecx, 24h
ja	short loc_40A5F0
mov	dword_410280, 0Dh
retn

loc_40A5E3:
mov	eax, dword_4100F4[edx*8]
mov	dword_410280, eax
retn

loc_40A5F0:
cmp	ecx, 0BCh
jb	short loc_40A60A
cmp	ecx, 0CAh
mov	dword_410280, 8
jbe	short locret_40A614

loc_40A60A:
mov	dword_410280, 16h

locret_40A614:
retn
sub_40A5AE endp

; [0000007A BYTES: COLLAPSED FUNCTION __free_osfhnd. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [0000003D BYTES: COLLAPSED FUNCTION __get_osfhandle. PRESS KEYPAD CTRL-"+" TO	EXPAND]


; Attributes: bp-based frame

; int __cdecl sub_40A6CC(size_t, int)
sub_40A6CC proc	near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	esi
mov	esi, [ebp+arg_0]
imul	esi, [ebp+arg_4]
cmp	esi, 0FFFFFFE0h
push	edi
mov	[ebp+arg_0], esi
ja	short loc_40A6ED
test	esi, esi
jnz	short loc_40A6E7
push	1
pop	esi

loc_40A6E7:
add	esi, 0Fh
and	esi, 0FFFFFFF0h

loc_40A6ED:
xor	edi, edi
cmp	esi, 0FFFFFFE0h
ja	short loc_40A74C
mov	eax, dword_411968
cmp	eax, 3
jnz	short loc_40A718
mov	eax, [ebp+arg_0]
cmp	eax, dword_410714
ja	short loc_40A737
push	eax
call	___sbh_alloc_block
mov	edi, eax
pop	ecx
test	edi, edi
jnz	short loc_40A762
jmp	short loc_40A737

loc_40A718:
cmp	eax, 2
jnz	short loc_40A737
cmp	esi, dword_4100E4
ja	short loc_40A737
mov	eax, esi
shr	eax, 4
push	eax
call	sub_40A0F8
mov	edi, eax
pop	ecx
test	edi, edi
jnz	short loc_40A776

loc_40A737:		; dwBytes
push	esi
push	8		; dwFlags
push	dword_411964	; hHeap
call	ds:HeapAlloc
mov	edi, eax
test	edi, edi
jnz	short loc_40A770

loc_40A74C:
cmp	dword_4103F4, 0
jz	short loc_40A770
push	esi
call	__callnewh
test	eax, eax
pop	ecx
jz	short loc_40A779
jmp	short loc_40A6ED

loc_40A762:		; size_t
push	[ebp+arg_0]

loc_40A765:		; int
push	0
push	edi		; void *
call	_memset
add	esp, 0Ch

loc_40A770:
mov	eax, edi

loc_40A772:
pop	edi
pop	esi
pop	ebp
retn

loc_40A776:
push	esi
jmp	short loc_40A765

loc_40A779:
xor	eax, eax
jmp	short loc_40A772
sub_40A6CC endp

; [00000058 BYTES: COLLAPSED FUNCTION __fcloseall. PRESS KEYPAD	CTRL-"+" TO EXPAND]
; [0000003B BYTES: COLLAPSED FUNCTION _fflush. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [0000005C BYTES: COLLAPSED FUNCTION __flush. PRESS KEYPAD CTRL-"+" TO	EXPAND]



sub_40A86C proc	near
push	1
call	_flsall
pop	ecx
retn
sub_40A86C endp

; [0000006D BYTES: COLLAPSED FUNCTION _flsall. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [00000007 BYTES: COLLAPSED FUNCTION __fptrap.	PRESS KEYPAD CTRL-"+" TO EXPAND]
db  59h	; Y
db 0C3h	; √
; [0000001B BYTES: COLLAPSED FUNCTION __callnewh. PRESS	KEYPAD CTRL-"+"	TO EXPAND]
; [00000224 BYTES: COLLAPSED FUNCTION ___crtLCMapStringA. PRESS	KEYPAD CTRL-"+"	TO EXPAND]
; [0000002B BYTES: COLLAPSED FUNCTION _strncnt.	PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000149 BYTES: COLLAPSED FUNCTION ___crtGetStringTypeA. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [000000CC BYTES: COLLAPSED FUNCTION _toupper.	PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000075 BYTES: COLLAPSED FUNCTION __isctype. PRESS KEYPAD CTRL-"+" TO EXPAND]
align 10h
; [00000335 BYTES: COLLAPSED FUNCTION _memcpy_0. PRESS KEYPAD CTRL-"+" TO EXPAND]
align 10h
; [00000058 BYTES: COLLAPSED FUNCTION _memset. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [00000056 BYTES: COLLAPSED FUNCTION _fclose. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [00000057 BYTES: COLLAPSED FUNCTION __commit.	PRESS KEYPAD CTRL-"+" TO EXPAND]
; [000000B3 BYTES: COLLAPSED FUNCTION __close. PRESS KEYPAD CTRL-"+" TO	EXPAND]
; [0000002B BYTES: COLLAPSED FUNCTION __freebuf. PRESS KEYPAD CTRL-"+" TO EXPAND]
align 10h
; [00000006 BYTES: COLLAPSED FUNCTION RtlUnwind. PRESS KEYPAD CTRL-"+" TO EXPAND]
align 10h
; [0000008C BYTES: COLLAPSED FUNCTION __strcmpi. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [000000CB BYTES: COLLAPSED FUNCTION _tolower.	PRESS KEYPAD CTRL-"+" TO EXPAND]
align 1000h
_text ends

; Section 2. (virtual address 0000C000)
; Virtual size			: 00000F6E (   3950.)
; Section size in file		: 00001000 (   4096.)
; Offset to raw	data for section: 0000C000
; Flags	40000040: Data Readable
; Alignment	: default
;
; Imports from ADVAPI32.dll
;

; Segment type:	Externs
; _idata
; LSTATUS __stdcall RegQueryInfoKeyA(HKEY hKey,	LPSTR lpClass, LPDWORD lpcchClass, LPDWORD lpReserved, LPDWORD lpcSubKeys, LPDWORD lpcbMaxSubKeyLen, LPDWORD lpcbMaxClassLen, LPDWORD lpcValues, LPDWORD lpcbMaxValueNameLen, LPDWORD lpcbMaxValueLen, LPDWORD lpcbSecurityDescriptor, PFILETIME lpftLastWriteTime)
extrn RegQueryInfoKeyA:dword
; LSTATUS __stdcall RegEnumValueA(HKEY hKey, DWORD dwIndex, LPSTR lpValueName, LPDWORD lpcchValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)
extrn RegEnumValueA:dword
; LSTATUS __stdcall RegEnumKeyExA(HKEY hKey, DWORD dwIndex, LPSTR lpName, LPDWORD lpcchName, LPDWORD lpReserved, LPSTR lpClass,	LPDWORD	lpcchClass, PFILETIME lpftLastWriteTime)
extrn RegEnumKeyExA:dword
; LSTATUS __stdcall RegOpenKeyExA(HKEY hKey, LPCSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY	phkResult)
extrn RegOpenKeyExA:dword
; LSTATUS __stdcall RegCloseKey(HKEY hKey)
extrn RegCloseKey:dword
; BOOL __stdcall GetUserNameA(LPSTR lpBuffer, LPDWORD pcbBuffer)
extrn GetUserNameA:dword

;
; Imports from KERNEL32.dll
;
; DWORD	__stdcall SetFilePointer(HANDLE	hFile, LONG lDistanceToMove, PLONG lpDistanceToMoveHigh, DWORD dwMoveMethod)
extrn SetFilePointer:dword
; DWORD	__stdcall GetPrivateProfileStringA(LPCSTR lpAppName, LPCSTR lpKeyName, LPCSTR lpDefault, LPSTR lpReturnedString, DWORD nSize, LPCSTR lpFileName)
extrn GetPrivateProfileStringA:dword
; DWORD	__stdcall GetPrivateProfileSectionNamesA(LPSTR lpszReturnBuffer, DWORD nSize, LPCSTR lpFileName)
extrn GetPrivateProfileSectionNamesA:dword
; DWORD	__stdcall GetPrivateProfileSectionA(LPCSTR lpAppName, LPSTR lpReturnedString, DWORD nSize, LPCSTR lpFileName)
extrn GetPrivateProfileSectionA:dword
; BOOL __stdcall WritePrivateProfileStringA(LPCSTR lpAppName, LPCSTR lpKeyName,	LPCSTR lpString, LPCSTR	lpFileName)
extrn WritePrivateProfileStringA:dword
; BOOL __stdcall CloseHandle(HANDLE hObject)
extrn CloseHandle:dword
; DWORD	__stdcall GetLastError()
extrn GetLastError:dword
; HANDLE __stdcall CreateFileA(LPCSTR lpFileName, DWORD	dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes,	DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE	hTemplateFile)
extrn CreateFileA:dword
; LONG __stdcall CompareFileTime(const FILETIME	*lpFileTime1, const FILETIME *lpFileTime2)
extrn CompareFileTime:dword
; BOOL __stdcall SystemTimeToFileTime(const SYSTEMTIME *lpSystemTime, LPFILETIME lpFileTime)
extrn SystemTimeToFileTime:dword
; DWORD	__stdcall GetFileSize(HANDLE hFile, LPDWORD lpFileSizeHigh)
extrn GetFileSize:dword
; BOOL __stdcall ReadFile(HANDLE hFile,	LPVOID lpBuffer, DWORD nNumberOfBytesToRead, LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped)
extrn ReadFile:dword
; UINT __stdcall GetPrivateProfileIntA(LPCSTR lpAppName, LPCSTR	lpKeyName, INT nDefault, LPCSTR	lpFileName)
extrn GetPrivateProfileIntA:dword
; BOOL __stdcall GetComputerNameA(LPSTR	lpBuffer, LPDWORD nSize)
extrn GetComputerNameA:dword
; void __stdcall GetSystemTime(LPSYSTEMTIME lpSystemTime)
extrn GetSystemTime:dword
; DWORD	__stdcall GetCurrentDirectoryA(DWORD nBufferLength, LPSTR lpBuffer)
extrn GetCurrentDirectoryA:dword
; DWORD	__stdcall GetTempPathA(DWORD nBufferLength, LPSTR lpBuffer)
extrn GetTempPathA:dword
; UINT __stdcall GetWindowsDirectoryA(LPSTR lpBuffer, UINT uSize)
extrn GetWindowsDirectoryA:dword
; HANDLE __stdcall GetProcessHeap()
extrn GetProcessHeap:dword
; BOOL __stdcall GetStringTypeW(DWORD dwInfoType, LPCWSTR lpSrcStr, int	cchSrc,	LPWORD lpCharType)
extrn GetStringTypeW:dword
; BOOL __stdcall GetStringTypeA(LCID Locale, DWORD dwInfoType, LPCSTR lpSrcStr,	int cchSrc, LPWORD lpCharType)
extrn GetStringTypeA:dword
; int __stdcall	LCMapStringW(LCID Locale, DWORD	dwMapFlags, LPCWSTR lpSrcStr, int cchSrc, LPWSTR lpDestStr, int	cchDest)
extrn LCMapStringW:dword
; int __stdcall	LCMapStringA(LCID Locale, DWORD	dwMapFlags, LPCSTR lpSrcStr, int cchSrc, LPSTR lpDestStr, int cchDest)
extrn LCMapStringA:dword
; int __stdcall	MultiByteToWideChar(UINT CodePage, DWORD dwFlags, LPCSTR lpMultiByteStr, int cbMultiByte, LPWSTR lpWideCharStr,	int cchWideChar)
extrn MultiByteToWideChar:dword
; BOOL __stdcall SetStdHandle(DWORD nStdHandle,	HANDLE hHandle)
extrn SetStdHandle:dword
; BOOL __stdcall WriteFile(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite,	LPDWORD	lpNumberOfBytesWritten,	LPOVERLAPPED lpOverlapped)
extrn WriteFile:dword
; FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)
extrn GetProcAddress:dword
; LPVOID __stdcall HeapReAlloc(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem, SIZE_T dwBytes)
extrn HeapReAlloc:dword
; LPVOID __stdcall VirtualAlloc(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect)
extrn VirtualAlloc:dword
; UINT __stdcall GetOEMCP()
extrn GetOEMCP:dword
; UINT __stdcall GetACP()
extrn GetACP:dword
; BOOL __stdcall GetCPInfo(UINT	CodePage, LPCPINFO lpCPInfo)
extrn GetCPInfo:dword
; void __stdcall RtlUnwind(PVOID TargetFrame, PVOID TargetIp, PEXCEPTION_RECORD	ExceptionRecord, PVOID ReturnValue)
extrn __imp_RtlUnwind:dword
; BOOL __stdcall VirtualFree(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType)
extrn VirtualFree:dword
; HANDLE __stdcall HeapCreate(DWORD flOptions, SIZE_T dwInitialSize, SIZE_T dwMaximumSize)
extrn HeapCreate:dword
; BOOL __stdcall HeapDestroy(HANDLE hHeap)
extrn HeapDestroy:dword
; BOOL __stdcall GetVersionExA(LPOSVERSIONINFOA	lpVersionInformation)
extrn GetVersionExA:dword
; DWORD	__stdcall GetEnvironmentVariableA(LPCSTR lpName, LPSTR lpBuffer, DWORD nSize)
extrn GetEnvironmentVariableA:dword
; DWORD	__stdcall GetFileType(HANDLE hFile)
extrn GetFileType:dword
; HANDLE __stdcall GetStdHandle(DWORD nStdHandle)
extrn GetStdHandle:dword
; UINT __stdcall SetHandleCount(UINT uNumber)
extrn SetHandleCount:dword
; LPWCH	__stdcall GetEnvironmentStringsW()
extrn GetEnvironmentStringsW:dword
; LPCH __stdcall GetEnvironmentStrings()
extrn GetEnvironmentStrings:dword
; int __stdcall	WideCharToMultiByte(UINT CodePage, DWORD dwFlags, LPCWSTR lpWideCharStr, int cchWideChar, LPSTR	lpMultiByteStr,	int cbMultiByte, LPCSTR	lpDefaultChar, LPBOOL lpUsedDefaultChar)
extrn WideCharToMultiByte:dword
; BOOL __stdcall FreeEnvironmentStringsW(LPWCH)
extrn FreeEnvironmentStringsW:dword
; BOOL __stdcall FreeEnvironmentStringsA(LPCH)
extrn FreeEnvironmentStringsA:dword
; BOOL __stdcall FlushFileBuffers(HANDLE hFile)
extrn FlushFileBuffers:dword
; DWORD	__stdcall GetModuleFileNameA(HMODULE hModule, LPSTR lpFilename,	DWORD nSize)
extrn GetModuleFileNameA:dword
; LONG __stdcall UnhandledExceptionFilter(struct _EXCEPTION_POINTERS *ExceptionInfo)
extrn UnhandledExceptionFilter:dword
; HANDLE __stdcall GetCurrentProcess()
extrn GetCurrentProcess:dword
; BOOL __stdcall TerminateProcess(HANDLE hProcess, UINT	uExitCode)
extrn TerminateProcess:dword
; void __stdcall ExitProcess(UINT uExitCode)
extrn ExitProcess:dword
; BOOL __stdcall HeapFree(HANDLE hHeap,	DWORD dwFlags, LPVOID lpMem)
extrn HeapFree:dword
; HANDLE __stdcall FindFirstFileA(LPCSTR lpFileName, LPWIN32_FIND_DATAA	lpFindFileData)
extrn FindFirstFileA:dword
; BOOL __stdcall FindNextFileA(HANDLE hFindFile, LPWIN32_FIND_DATAA lpFindFileData)
extrn FindNextFileA:dword
; BOOL __stdcall FindClose(HANDLE hFindFile)
extrn FindClose:dword
; DWORD	__stdcall GetTickCount()
extrn GetTickCount:dword
; HMODULE __stdcall LoadLibraryA(LPCSTR	lpLibFileName)
extrn LoadLibraryA:dword
; LPVOID __stdcall HeapAlloc(HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes)
extrn HeapAlloc:dword
; DWORD	__stdcall GetVersion()
extrn GetVersion:dword
; LPSTR	__stdcall GetCommandLineA()
extrn GetCommandLineA:dword
; void __stdcall GetStartupInfoA(LPSTARTUPINFOA	lpStartupInfo)
extrn GetStartupInfoA:dword
; HMODULE __stdcall GetModuleHandleA(LPCSTR lpModuleName)
extrn GetModuleHandleA:dword

;
; Imports from SHELL32.dll
;
; LPITEMIDLIST __stdcall SHBrowseForFolderA(LPBROWSEINFOA lpbi)
extrn SHBrowseForFolderA:dword
; BOOL __stdcall SHGetPathFromIDListA(LPCITEMIDLIST pidl, LPSTR	pszPath)
extrn SHGetPathFromIDListA:dword
; HINSTANCE __stdcall ShellExecuteA(HWND hwnd, LPCSTR lpOperation, LPCSTR lpFile, LPCSTR lpParameters, LPCSTR lpDirectory, INT nShowCmd)
extrn ShellExecuteA:dword

;
; Imports from USER32.dll
;
; LRESULT __stdcall SendDlgItemMessageA(HWND hDlg, int nIDDlgItem, UINT	Msg, WPARAM wParam, LPARAM lParam)
extrn SendDlgItemMessageA:dword
; BOOL __stdcall PeekMessageA(LPMSG lpMsg, HWND	hWnd, UINT wMsgFilterMin, UINT wMsgFilterMax, UINT wRemoveMsg)
extrn PeekMessageA:dword
; BOOL __stdcall UpdateWindow(HWND hWnd)
extrn UpdateWindow:dword
; HWND __stdcall CreateDialogParamA(HINSTANCE hInstance, LPCSTR	lpTemplateName,	HWND hWndParent, DLGPROC lpDialogFunc, LPARAM dwInitParam)
extrn CreateDialogParamA:dword
; DWORD	__stdcall SetClassLongA(HWND hWnd, int nIndex, LONG dwNewLong)
extrn SetClassLongA:dword
; BOOL __stdcall SetWindowTextA(HWND hWnd, LPCSTR lpString)
extrn SetWindowTextA:dword
; BOOL __stdcall GetMessageA(LPMSG lpMsg, HWND hWnd, UINT wMsgFilterMin, UINT wMsgFilterMax)
extrn GetMessageA:dword
; LRESULT __stdcall DispatchMessageA(const MSG *lpMsg)
extrn DispatchMessageA:dword
; BOOL __stdcall IsDialogMessageA(HWND hDlg, LPMSG lpMsg)
extrn IsDialogMessageA:dword
; BOOL __stdcall TranslateMessage(const	MSG *lpMsg)
extrn TranslateMessage:dword
; BOOL __stdcall GetWindowRect(HWND hWnd, LPRECT lpRect)
extrn GetWindowRect:dword
; BOOL __stdcall TrackPopupMenu(HMENU hMenu, UINT uFlags, int x, int y,	int nReserved, HWND hWnd, const	RECT *prcRect)
extrn TrackPopupMenu:dword
; BOOL __stdcall DestroyMenu(HMENU hMenu)
extrn DestroyMenu:dword
; BOOL __stdcall EnableMenuItem(HMENU hMenu, UINT uIDEnableItem, UINT uEnable)
extrn EnableMenuItem:dword
; void __stdcall PostQuitMessage(int nExitCode)
extrn PostQuitMessage:dword
; HMENU	__stdcall CreatePopupMenu()
extrn CreatePopupMenu:dword
; BOOL __stdcall AppendMenuA(HMENU hMenu, UINT uFlags, UINT_PTR	uIDNewItem, LPCSTR lpNewItem)
extrn AppendMenuA:dword
; BOOL __stdcall SetMenuDefaultItem(HMENU hMenu, UINT uItem, UINT fByPos)
extrn SetMenuDefaultItem:dword
; HWND __stdcall SetFocus(HWND hWnd)
extrn SetFocus:dword
; HCURSOR __stdcall LoadCursorA(HINSTANCE hInstance, LPCSTR lpCursorName)
extrn LoadCursorA:dword
; BOOL __stdcall EnableWindow(HWND hWnd, BOOL bEnable)
extrn EnableWindow:dword
; BOOL __stdcall ShowWindow(HWND hWnd, int nCmdShow)
extrn ShowWindow:dword
; HCURSOR __stdcall SetCursor(HCURSOR hCursor)
extrn SetCursor:dword
; BOOL __stdcall MessageBeep(UINT uType)
extrn MessageBeep:dword
; HWND __stdcall GetDlgItem(HWND hDlg, int nIDDlgItem)
extrn GetDlgItem:dword
; LRESULT __stdcall SendMessageA(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
extrn SendMessageA:dword
; UINT __stdcall GetDlgItemTextA(HWND hDlg, int	nIDDlgItem, LPSTR lpString, int	cchMax)
extrn GetDlgItemTextA:dword
; int __stdcall	MessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption,	UINT uType)
extrn MessageBoxA:dword
; BOOL __stdcall SetDlgItemTextA(HWND hDlg, int	nIDDlgItem, LPCSTR lpString)
extrn SetDlgItemTextA:dword
; HICON	__stdcall LoadIconA(HINSTANCE hInstance, LPCSTR	lpIconName)
extrn LoadIconA:dword
extrn byte_40C1A4:byte:4
;
; Imports from comdlg32.dll
;
; BOOL __stdcall GetOpenFileNameA(LPOPENFILENAMEA)
extrn __imp_GetOpenFileNameA:dword
; BOOL __stdcall GetSaveFileNameA(LPOPENFILENAMEA)
extrn __imp_GetSaveFileNameA:dword



; Segment type:	Pure data
; Segment permissions: Read
_rdata segment para public 'DATA' use32
assume cs:_rdata
;org 40C1B4h
align 8
stru_40C1B8 _SCOPETABLE_ENTRY <0FFFFFFFFh, \ ; SEH scope table for function 406A6E
		   offset loc_406B45, \
		   offset loc_406B59>
byte_40C1C4 db 6
db    0
db    0
db    6
db    0
db    1
db    0
db    0
db  10h
db    0
db    3
db    6
db    0
db    6
db    2
db  10h
db    4
db  45h	; E
db  45h	; E
db  45h	; E
db    5
db    5
db    5
db    5
db    5
db  35h	; 5
db  30h	; 0
db    0
db  50h	; P
db    0
db    0
db    0
db    0
db  20h
db  28h	; (
db  38h	; 8
db  50h	; P
db  58h	; X
db    7
db    8
db    0
db  37h	; 7
db  30h	; 0
db  30h	; 0
db  57h	; W
db  50h	; P
db    7
db    0
db    0
db  20h
db  20h
db    8
db    0
db    0
db    0
db    0
db    8
db  60h	; `
db  68h	; h
db  60h	; `
db  60h	; `
db  60h	; `
db  60h	; `
db    0
db    0
db  70h	; p
db  70h	; p
db  78h	; x
db  78h	; x
db  78h	; x
db  78h	; x
db    8
db    7
db    8
db    0
db    0
db    7
db    0
db    8
db    8
db    8
db    0
db    0
db    8
db    0
db    8
db    0
db    7
db    8
db    0
db    0
db    0
aNull_0:
unicode	0, <(null)>,0
align 10h
aNull db '(null)',0
align 4
; char a__global_heap_[]
a__global_heap_	db '__GLOBAL_HEAP_SELECTED',0
align 10h
; char Name[]
Name db	'__MSVCRT_HEAP_SELECT',0
align 4
aRuntimeError db 'runtime error ',0
align 4
db 0Dh,0Ah,0
align 4
aTlossError db 'TLOSS error',0Dh,0Ah,0
align 4
aSingError db 'SING error',0Dh,0Ah,0
align 4
aDomainError db	'DOMAIN error',0Dh,0Ah,0
align 4
aR6028UnableToI	db 'R6028',0Dh,0Ah
db '- unable to initialize heap',0Dh,0Ah,0
align 4
aR6027NotEnough	db 'R6027',0Dh,0Ah
db '- not enough space for lowio initia'
db 'lization',0Dh,0Ah,0
align 4
aR6026NotEnough	db 'R6026',0Dh,0Ah
db '- not enough space for stdio initia'
db 'lization',0Dh,0Ah,0
align 4
aR6025PureVirtu	db 'R6025',0Dh,0Ah
db '- pure virtual function call',0Dh,0Ah,0
align 4
aR6024NotEnough	db 'R6024',0Dh,0Ah
db '- not enough space for _onexit/atex'
db 'it table',0Dh,0Ah,0
align 4
aR6019UnableToO	db 'R6019',0Dh,0Ah
db '- unable to open console device',0Dh,0Ah,0
align 10h
aR6018Unexpecte	db 'R6018',0Dh,0Ah
db '- unexpected heap error',0Dh,0Ah,0
align 4
aR6017Unexpecte	db 'R6017',0Dh,0Ah
db '- unexpected multithread lock error'
db 0Dh,0Ah,0
align 4
aR6016NotEnough	db 'R6016',0Dh,0Ah
db '- not enough space for thread data',0Dh
db 0Ah,0
aAbnormalProgra	db 0Dh,0Ah
db 'abnormal program termination',0Dh,0Ah,0
align 4
aR6009NotEnough	db 'R6009',0Dh,0Ah
db '- not enough space for environment',0Dh
db 0Ah,0
aR6008NotEnough	db 'R6008',0Dh,0Ah
db '- not enough space for arguments',0Dh,0Ah
db 0
align 4
aR6002FloatingP	db 'R6002',0Dh,0Ah
db '- floating point not loaded',0Dh,0Ah,0
align 4
aMicrosoftVisua	db 'Microsoft Visual C++ Runtime Librar'
db 'y',0
align 4
; char asc_40C51C[]
asc_40C51C db 0Ah
db 0Ah,0
align 10h
; char aRuntimeErrorPr[]
aRuntimeErrorPr	db 'Runtime Error!',0Ah
db 0Ah
db 'Program: ',0
align 4
; char a___[]
a___ db	'...',0
; char aProgramNameUnk[]
aProgramNameUnk	db '<program name unknown>',0
align 4
; char aGetlastactivep[]
aGetlastactivep	db 'GetLastActivePopup',0
align 4
; char aGetactivewindo[]
aGetactivewindo	db 'GetActiveWindow',0
; char ProcName[]
ProcName db 'MessageBoxA',0
; char LibFileName[]
LibFileName db 'user32.dll',0
align 4
; char byte_40C594[]
byte_40C594 db 4 dup(0)
; const	WCHAR SrcStr
SrcStr dw 0
align 10h
stru_40C5A0 _SCOPETABLE_ENTRY <0FFFFFFFFh, \ ; SEH scope table for function 40A906
		   offset loc_40AA16, \
		   offset loc_40AA1A>
_SCOPETABLE_ENTRY <0FFFFFFFFh, \
		   offset loc_40AACA, \
		   offset loc_40AACE>
stru_40C5B8 _SCOPETABLE_ENTRY <0FFFFFFFFh, \ ; SEH scope table for function 40AB55
		   offset loc_40AC4E, \
		   offset loc_40AC52>
__IMPORT_DESCRIPTOR_KERNEL32 dd	rva off_40C658 ; Import	Name Table
dd 0			; Time stamp
dd 0			; Forwarder Chain
dd rva aKernel32_dll	; DLL Name
dd rva SetFilePointer	; Import Address Table
__IMPORT_DESCRIPTOR_USER32 dd rva off_40C768 ; Import Name Table
dd 0			; Time stamp
dd 0			; Forwarder Chain
dd rva aUser32_dll	; DLL Name
dd rva SendDlgItemMessageA ; Import Address Table
__IMPORT_DESCRIPTOR_comdlg32 dd	rva off_40C7E4 ; Import	Name Table
dd 0			; Time stamp
dd 0			; Forwarder Chain
dd rva aComdlg32_dll	; DLL Name
dd rva __imp_GetOpenFileNameA ;	Import Address Table
__IMPORT_DESCRIPTOR_ADVAPI32 dd	rva off_40C63C ; Import	Name Table
dd 0			; Time stamp
dd 0			; Forwarder Chain
dd rva aAdvapi32_dll	; DLL Name
dd rva RegQueryInfoKeyA	; Import Address Table
__IMPORT_DESCRIPTOR_SHELL32 dd rva off_40C758 ;	Import Name Table
dd 0			; Time stamp
dd 0			; Forwarder Chain
dd rva aShell32_dll	; DLL Name
dd rva SHBrowseForFolderA ; Import Address Table
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
;
; Import names for ADVAPI32.dll
;
off_40C63C dd rva word_40CC58
dd rva word_40CC48
dd rva word_40CC38
dd rva word_40CC28
dd rva word_40CC1A
dd rva word_40CC6C
dd 0
;
; Import names for KERNEL32.dll
;
off_40C658 dd rva word_40C852
dd rva word_40C864
dd rva word_40C880
dd rva word_40C8A2
dd rva word_40C8BE
dd rva word_40C8DC
dd rva word_40C8EA
dd rva word_40C8FA
dd rva word_40C908
dd rva word_40C91A
dd rva word_40C932
dd rva word_40C940
dd rva word_40C94C
dd rva word_40C964
dd rva word_40C978
dd rva word_40C988
dd rva word_40C9A0
dd rva word_40C9B0
dd rva word_40C9C8
dd rva word_40CF48
dd rva word_40CF36
dd rva word_40CF26
dd rva word_40CF16
dd rva word_40CF00
dd rva word_40CEF0
dd rva word_40C846
dd rva word_40CECE
dd rva word_40CEC0
dd rva word_40CEB0
dd rva word_40CEA4
dd rva word_40CE9A
dd rva word_40CE8E
dd rva word_40CE82
dd rva word_40CE74
dd rva word_40CE66
dd rva word_40CE58
dd rva word_40CE48
dd rva word_40CE2E
dd rva word_40CE20
dd rva word_40CE10
dd rva word_40CDFE
dd rva word_40CDE4
dd rva word_40CDCC
dd rva word_40CDB6
dd rva word_40CD9C
dd rva word_40CD82
dd rva word_40CF5A
dd rva word_40CD6C
dd rva word_40CD50
dd rva word_40CD3C
dd rva word_40CD28
dd rva word_40CD1A
dd rva word_40C83A
dd rva word_40C828
dd rva word_40C818
dd rva word_40C80C
dd rva word_40C7FC
dd rva word_40CEE0
dd rva word_40C7F0
dd rva word_40CD0C
dd rva word_40CCFA
dd rva word_40CCE8
dd rva word_40CCD4
dd 0
;
; Import names for SHELL32.dll
;
off_40C758 dd rva word_40CCB2
dd rva word_40CC9A
dd rva word_40CC8A
dd 0
;
; Import names for USER32.dll
;
off_40C768 dd rva word_40C9E8
dd rva word_40C9FE
dd rva word_40CA0E
dd rva word_40CBC2
dd rva word_40CBA6
dd rva word_40CB94
dd rva word_40CB86
dd rva word_40CB72
dd rva word_40CB5E
dd rva word_40CB4A
dd rva word_40CB3A
dd rva word_40CB28
dd rva word_40CB1A
dd rva word_40CB08
dd rva word_40CAF6
dd rva word_40CAE4
dd rva word_40CAD6
dd rva word_40CAC0
dd rva word_40CAB4
dd rva word_40CAA6
dd rva word_40CA96
dd rva word_40CA88
dd rva word_40CA7C
dd rva word_40CA6E
dd rva word_40CA60
dd rva word_40CA50
dd rva word_40CA3E
dd rva word_40CA30
dd rva word_40CA1E
dd rva word_40CBB6
dd 0
;
; Import names for comdlg32.dll
;
off_40C7E4 dd rva word_40CBF8
dd rva word_40CBE4
dd 0
word_40C7F0 dw 199h
db 'HeapAlloc',0
word_40C7FC dw 16Dh
db 'GetTickCount',0
align 4
word_40C80C dw 90h
db 'FindClose',0
word_40C818 dw 9Dh
db 'FindNextFileA',0
word_40C828 dw 94h
db 'FindFirstFileA',0
align 2
word_40C83A dw 19Fh
db 'HeapFree',0
align 2
word_40C846 dw 2DFh
db 'WriteFile',0
word_40C852 dw 26Ah
db 'SetFilePointer',0
align 4
word_40C864 dw 13Ah
db 'GetPrivateProfileStringA',0
align 10h
word_40C880 dw 137h
db 'GetPrivateProfileSectionNamesA',0
align 2
word_40C8A2 dw 136h
db 'GetPrivateProfileSectionA',0
word_40C8BE dw 2E5h
db 'WritePrivateProfileStringA',0
align 4
word_40C8DC dw 1Bh
db 'CloseHandle',0
word_40C8EA dw 11Ah
db 'GetLastError',0
align 2
word_40C8FA dw 34h
db 'CreateFileA',0
word_40C908 dw 20h
db 'CompareFileTime',0
word_40C91A dw 29Bh
db 'SystemTimeToFileTime',0
align 2
word_40C932 dw 112h
db 'GetFileSize',0
word_40C940 dw 218h
db 'ReadFile',0
align 4
word_40C94C dw 134h
db 'GetPrivateProfileIntA',0
word_40C964 dw 0CEh
db 'GetComputerNameA',0
align 4
word_40C978 dw 15Dh
db 'GetSystemTime',0
word_40C988 dw 0F5h
db 'GetCurrentDirectoryA',0
align 10h
word_40C9A0 dw 165h
db 'GetTempPathA',0
align 10h
word_40C9B0 dw 17Dh
db 'GetWindowsDirectoryA',0
align 4
word_40C9C8 dw 140h
db 'GetProcessHeap',0
align 2
aKernel32_dll db 'KERNEL32.dll',0
align 4
word_40C9E8 dw 20Fh
db 'SendDlgItemMessageA',0
word_40C9FE dw 1DCh
db 'PeekMessageA',0
align 2
word_40CA0E dw 291h
db 'UpdateWindow',0
align 2
word_40CA1E dw 22Ch
db 'SetDlgItemTextA',0
word_40CA30 dw 1BEh
db 'MessageBoxA',0
word_40CA3E dw 104h
db 'GetDlgItemTextA',0
word_40CA50 dw 214h
db 'SendMessageA',0
align 10h
word_40CA60 dw 102h
db 'GetDlgItem',0
align 2
word_40CA6E dw 1BDh
db 'MessageBeep',0
word_40CA7C dw 226h
db 'SetCursor',0
word_40CA88 dw 26Ah
db 'ShowWindow',0
align 2
word_40CA96 dw 0B7h
db 'EnableWindow',0
align 2
word_40CAA6 dw 19Ah
db 'LoadCursorA',0
word_40CAB4 dw 22Fh
db 'SetFocus',0
align 10h
word_40CAC0 dw 237h
db 'SetMenuDefaultItem',0
align 2
word_40CAD6 dw 7
db 'AppendMenuA',0
word_40CAE4 dw 58h
db 'CreatePopupMenu',0
word_40CAF6 dw 1E0h
db 'PostQuitMessage',0
word_40CB08 dw 0B5h
db 'EnableMenuItem',0
align 2
word_40CB1A dw 8Dh
db 'DestroyMenu',0
word_40CB28 dw 27Ch
db 'TrackPopupMenu',0
align 2
word_40CB3A dw 15Ch
db 'GetWindowRect',0
word_40CB4A dw 282h
db 'TranslateMessage',0
align 2
word_40CB5E dw 188h
db 'IsDialogMessageA',0
align 2
word_40CB72 dw 95h
db 'DispatchMessageA',0
align 2
word_40CB86 dw 12Ah
db 'GetMessageA',0
word_40CB94 dw 25Eh
db 'SetWindowTextA',0
align 2
word_40CBA6 dw 220h
db 'SetClassLongA',0
word_40CBB6 dw 19Eh
db 'LoadIconA',0
word_40CBC2 dw 4Fh
db 'CreateDialogParamA',0
align 4
aUser32_dll db 'USER32.dll',0
align 4
word_40CBE4 dw 0Bh
db 'GetSaveFileNameA',0
align 4
word_40CBF8 dw 9
db 'GetOpenFileNameA',0
align 4
aComdlg32_dll db 'comdlg32.dll',0
align 2
word_40CC1A dw 15Bh
db 'RegCloseKey',0
word_40CC28 dw 172h
db 'RegOpenKeyExA',0
word_40CC38 dw 167h
db 'RegEnumKeyExA',0
word_40CC48 dw 16Ah
db 'RegEnumValueA',0
word_40CC58 dw 176h
db 'RegQueryInfoKeyA',0
align 4
word_40CC6C dw 0D7h
db 'GetUserNameA',0
align 4
aAdvapi32_dll db 'ADVAPI32.dll',0
align 2
word_40CC8A dw 72h
db 'ShellExecuteA',0
word_40CC9A dw 50h
db 'SHGetPathFromIDListA',0
align 2
word_40CCB2 dw 39h
db 'SHBrowseForFolderA',0
align 4
aShell32_dll db	'SHELL32.dll',0
word_40CCD4 dw 126h
db 'GetModuleHandleA',0
align 4
word_40CCE8 dw 150h
db 'GetStartupInfoA',0
word_40CCFA dw 0CAh
db 'GetCommandLineA',0
word_40CD0C dw 174h
db 'GetVersion',0
align 2
word_40CD1A dw 7Dh
db 'ExitProcess',0
word_40CD28 dw 29Eh
db 'TerminateProcess',0
align 4
word_40CD3C dw 0F7h
db 'GetCurrentProcess',0
word_40CD50 dw 2ADh
db 'UnhandledExceptionFilter',0
align 4
word_40CD6C dw 124h
db 'GetModuleFileNameA',0
align 2
word_40CD82 dw 0B2h
db 'FreeEnvironmentStringsA',0
word_40CD9C dw 0B3h
db 'FreeEnvironmentStringsW',0
word_40CDB6 dw 2D2h
db 'WideCharToMultiByte',0
word_40CDCC dw 106h
db 'GetEnvironmentStrings',0
word_40CDE4 dw 108h
db 'GetEnvironmentStringsW',0
align 2
word_40CDFE dw 26Dh
db 'SetHandleCount',0
align 10h
word_40CE10 dw 152h
db 'GetStdHandle',0
align 10h
word_40CE20 dw 115h
db 'GetFileType',0
word_40CE2E dw 109h
db 'GetEnvironmentVariableA',0
word_40CE48 dw 175h
db 'GetVersionExA',0
word_40CE58 dw 19Dh
db 'HeapDestroy',0
word_40CE66 dw 19Bh
db 'HeapCreate',0
align 4
word_40CE74 dw 2BFh
db 'VirtualFree',0
word_40CE82 dw 22Fh
db 'RtlUnwind',0
word_40CE8E dw 0BFh
db 'GetCPInfo',0
word_40CE9A dw 0B9h
db 'GetACP',0
align 4
word_40CEA4 dw 131h
db 'GetOEMCP',0
align 10h
word_40CEB0 dw 2BBh
db 'VirtualAlloc',0
align 10h
word_40CEC0 dw 1A2h
db 'HeapReAlloc',0
word_40CECE dw 13Eh
db 'GetProcAddress',0
align 10h
word_40CEE0 dw 1C2h
db 'LoadLibraryA',0
align 10h
word_40CEF0 dw 27Ch
db 'SetStdHandle',0
align 10h
word_40CF00 dw 1E4h
db 'MultiByteToWideChar',0
word_40CF16 dw 1BFh
db 'LCMapStringA',0
align 2
word_40CF26 dw 1C0h
db 'LCMapStringW',0
align 2
word_40CF36 dw 153h
db 'GetStringTypeA',0
align 4
word_40CF48 dw 156h
db 'GetStringTypeW',0
align 2
word_40CF5A dw 0AAh
db 'FlushFileBuffers',0
align 100h
_rdata ends

; Section 3. (virtual address 0000D000)
; Virtual size			: 00004A9C (  19100.)
; Section size in file		: 00004000 (  16384.)
; Offset to raw	data for section: 0000D000
; Flags	C0000040: Data Readable	Writable
; Alignment	: default

; Segment type:	Pure data
; Segment permissions: Read/Write
_data segment para public 'DATA' use32
assume cs:_data
;org 40D000h
unk_40D000 db	 0
db    0
db    0
db    0
unk_40D004 db	 0
db    0
db    0
db    0
unk_40D008 db	 0
db    0
db    0
db    0
db 0C9h	; …
db  85h	; Ö
db  40h	; @
db    0
db  7Bh	; {
db  8Dh	; ç
db  40h	; @
db    0
unk_40D014 db	 0
db    0
db    0
db    0
unk_40D018 db	 0
db    0
db    0
db    0
db  6Eh	; n
db  86h	; Ü
db  40h	; @
db    0
unk_40D020 db	 0
db    0
db    0
db    0
unk_40D024 db	 0
db    0
db    0
db    0
unk_40D028 db	 0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
a_ db '\*.*',0
align 4
asc_40D038 db ';',0
align 4
; LPCSTR lpDefault
lpDefault dd offset aEnglish ; "English"
off_40D040 dd offset unk_40D454
; LPCSTR lpAppName
lpAppName dd offset aCurrent ; "CURRENT"
off_40D048 dd offset aOriginal ; "[Original]"
aKeys db 'Keys:',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aValues	db 'Values:',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aDirs db 'Dirs:',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aFiles db 'Files:',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aTime db 'Time:',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aKeysAdded db 'Keys added:',0
align 10h
aKeysDeleted db	'Keys deleted:',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aValuesAdded db	'Values added:',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aValuesDeleted db 'Values deleted:',0
db    0
db    0
db    0
db    0
db    0
db    0
aValuesModified	db 'Values modified:',0
align 8
aFilesAdded db 'Files added:',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aFilesDeleted db 'Files deleted:',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aFilesAttrModif	db 'Files[attr]modified:',0
align 2
aFoldersAdded db 'Folders added:',0
align 10h
aFoldersDeleted	db 'Folders deleted:',0
db    0
db    0
db    0
db    0
db    0
aFoldersAttrCha	db 'Folders[attr]changed:',0
aTotalChanges db 'Total changes:',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aComments db 'Comments:',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aDatetime db 'Datetime:',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aComputer db 'Computer:',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aUsername db 'Username:',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aAbout db 'About',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aError db 'Error',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aErrorCallExVie	db 'Error call ex-viewer',0
align 4
aErrorCreateFil	db 'Error create file',0
db    0
db    0
db    0
db    0
aErrorOpenFile db 'Error open file',0
align 8
aErrorMoveFp db	'Error move fp',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  26h	; &
db  31h	; 1
db  73h	; s
db  74h	; t
db  20h
db  73h	; s
db  68h	; h
db  6Fh	; o
db  74h	; t
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
a2ndShot db '&2nd shot',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  63h	; c
db  26h	; &
db  4Fh	; O
db  6Dh	; m
db  70h	; p
db  61h	; a
db  72h	; r
db  65h	; e
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  26h	; &
db  43h	; C
db  6Ch	; l
db  65h	; e
db  61h	; a
db  72h	; r
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  26h	; &
db  51h	; Q
db  75h	; u
db  69h	; i
db  74h	; t
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  26h	; &
db  41h	; A
db  62h	; b
db  6Fh	; o
db  75h	; u
db  74h	; t
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  26h	; &
db  4Dh	; M
db  6Fh	; o
db  6Eh	; n
db  69h	; i
db  74h	; t
db  6Fh	; o
db  72h	; r
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aCompareLogsSav	db 'Compare logs save as:',0
aOutputPath db 'Output path:',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  41h	; A
db  64h	; d
db  64h	; d
db  20h
db  63h	; c
db  6Fh	; o
db  6Dh	; m
db  6Dh	; m
db  65h	; e
db  6Eh	; n
db  74h	; t
db  20h
db  69h	; i
db  6Eh	; n
db  74h	; t
db  6Fh	; o
db  20h
db  6Ch	; l
db  6Fh	; o
db  67h	; g
db  3Ah	; :
db    0
db  50h	; P
db  6Ch	; l
db  61h	; a
db  69h	; i
db  6Eh	; n
db  20h
db  26h	; &
db  54h	; T
db  58h	; X
db  54h	; T
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  26h	; &
db  48h	; H
db  54h	; T
db  4Dh	; M
db  4Ch	; L
db  20h
db  64h	; d
db  6Fh	; o
db  63h	; c
db  75h	; u
db  6Dh	; m
db  65h	; e
db  6Eh	; n
db  74h	; t
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  26h	; &
db  53h	; S
db  63h	; c
db  61h	; a
db  6Eh	; n
db  20h
db  64h	; d
db  69h	; i
db  72h	; r
db  31h	; 1
db  5Bh	; [
db  3Bh	; ;
db  64h	; d
db  69h	; i
db  72h	; r
db  32h	; 2
db  3Bh	; ;
db  2Eh	; .
db  2Eh	; .
db  2Eh	; .
db  5Dh	; ]
db    0
aShot db '&Shot',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aShotAndSaVe___	db 'Shot and Sa&ve...',0
align 8
aLoaD___ db 'Loa&d...',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aClearAll db '&Clear All',0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
aClear1stShot db 'Clear &1st shot',0
db    0
db    0
db    0
db    0
db    0
db    0
aClear2ndShot db 'Clear &2nd shot',0
align 10h
aOriginal db '[Original]',0
align 4
aCurrent db 'CURRENT',0
unk_40D454 db  54h ; T
db  72h	; r
aAnslator db 'anslator',0
align 10h
aEnglish db 'English',0
; char aDS[]
aDS db '%d%s',0
align 10h
asc_40D470 db '=',0
align 4
dword_40D474 dd	2A3A2F5Ch
dword_40D478 dd	3E3C223Fh
word_40D47C dw 7Ch
align 10h
unk_40D480 db  0Dh
db  0Ah
db    0
db    0
asc_40D484 db 0Dh,0Ah
db '----------------------------------',0Dh
db 0Ah,0
align 4
aBr db '<BR>',0
align 4
aHtml db '<HTML>',0Dh,0Ah,0
align 10h
aHtml_0	db '</HTML>',0
aHead db '<HEAD>',0Dh,0Ah,0
align 4
aHead_0	db '</HEAD>',0Dh,0Ah,0
align 10h
aTrTdBgcolor669	db '<TR><TD BGCOLOR=669999 ALIGN=LEFT><'
db 'FONT COLOR=WHITE><B>',0
aTrTdNowrapFont	db '<TR><TD NOWRAP><FONT COLOR=BLACK>',0
align 4
aBFontTdTr db '</B></FONT></TD></TR>',0Dh,0Ah,0
aFontTdTr db '</FONT></TD></TR>',0Dh,0Ah,0
aStyleTypeTextC	db '<STYLE TYPE="text/css">td{font-fami'
db 'ly:"Tahoma";font-size:9pt}tr{font-s'
db 'ize:9pt}body{font-size:9pt}.o{backg'
db 'round:#E0F0E0}.n{background:#FFFFFF'
db '}</STYLE>',0Dh,0Ah,0
aBodyBgcolorFff	db '<BODY BGCOLOR=FFFFFF TEXT=000000 LI'
db 'NK=C8C8C8>',0Dh,0Ah,0
aBody db '</BODY>',0Dh,0Ah,0
align 4
aTableBorder0Wi	db '<TABLE BORDER=0 WIDTH=480>',0Dh,0Ah,0
align 4
aTable db '</TABLE>',0Dh,0Ah,0
align 4
aSpanClassO db '<span class=o>',0
align 4
aSpanClassN db '<span class=n>',0
align 4
aSpan db '</span>',0Dh,0Ah,0
align 4
; char aD[]
aD db '%d',0
align 4
aRes db	'~res',0
align 10h
aRegshotHiveFil	db 'Regshot hive files [*.hiv]',0
a_hiv db '*.hiv',0
aAllFiles db 'All files',0
a__0 db	'*.*',0
db    0
db    0
db    0
db    0
db    0
aRegshothive db	'REGSHOTHIVE',0
asc_40D6E0 db '"',0
align 4
dword_40D6E4 dd	22203Ah
; char aS08x[]
aS08x db '%s%08X',0
align 10h
a0x db ': 0x',0
align 4
asc_40D6F8 db 27h,0
align 4
dword_40D6FC dd	27203Ah
; char a02x[]
a02x db	' %02X',0
align 4
; char Operation[]
Operation db 'open',0
align 10h
; char aDSDSD02dS02dS0[]
aDSDSD02dS02dS0	db '%d%s%d%s%d %02d%s%02d%s%02d %s %d%s'
db '%d%s%d %02d%s%02d%s%02d',0
align 4
asc_40D74C db ' , ',0
asc_40D750 db '/',0
align 4
asc_40D754 db ':',0
align 4
; char a04d[]
a04d db	'%04d',0
align 10h
a_htm db '.htm',0
align 4
a_txt db '.txt',0
align 10h
; char Text[]
Text db	'Found two shots with different DIR '
db 'chain!(or with different order)',0Dh,0Ah
db 'You can continue,but file compare r'
db 'esult would be abnormal!',0
; char Caption[]
Caption	db 'Warning',0
aHiv db	'hiv',0
; char aReadingError[]
aReadingError db 'Reading ERROR!',0
align 4
; char aItIsNotAValidR[]
aItIsNotAValidR	db 'It is not a valid Regshot hive file'
db '!',0
align 4
; LPCSTR off_40D834
off_40D834 dd offset aSetup ; "Setup"
; LPCSTR lpKeyName
lpKeyName dd offset aFlag ; "Flag"
; LPCSTR off_40D83C
off_40D83C dd offset aExtdir ; "ExtDir"
; LPCSTR off_40D840
off_40D840 dd offset aOutdir ; "OutDir"
; LPCSTR off_40D844
off_40D844 dd offset aSkipregkey ; "SkipRegKey"
; LPCSTR off_40D848
off_40D848 dd offset aSkipdir ;	"SkipDir"
; LPCSTR off_40D84C
off_40D84C dd offset aUselongreghead ; "UseLongRegHead"
aUselongreghead	db 'UseLongRegHead',0
align 10h
aSkipdir db 'SkipDir',0
aSkipregkey db 'SkipRegKey',0
align 4
aOutdir	db 'OutDir',0
align 4
aExtdir	db 'ExtDir',0
align 4
aFlag db 'Flag',0
align 4
aSetup db 'Setup',0
align 4
aHkey_users db 'HKEY_USERS',0
align 10h
aHkey_local_mac	db 'HKEY_LOCAL_MACHINE',0
align 4
aHku db	'HKU',0
aHklm db 'HKLM',0
align 10h
; char aSD[]
aSD db '%s%d',0
align 4
; char aSDSDS[]
aSDSDS db '%s%d%s%d%s',0
align 4
aS db 's',0
align 4
aMs db 'ms',0
align 4
word_40D8DC dw 20h
align 10h
; LPCVOID lpBuffer
lpBuffer dd offset aRegshot1_8_2 ; "Regshot 1.8.2"
off_40D8E4 dd offset aRegshotIsAFree ; "Regshot	is a free and opensource regist"...
off_40D8E8 dd offset aRegshot_ini ; "regshot.ini"
off_40D8EC dd offset aLanguage_ini ; "language.ini"
aLanguage_ini db 'language.ini',0
align 10h
aRegshot_ini db	'regshot.ini',0
aRegshotIsAFree	db 'Regshot is a free and opensource re'
db 'gistry compare utility.',0Ah
db 0Ah
db 'http://regshot.yeah.net/',0Ah
db 'http://regshot.blog.googlepages.com'
db '/',0Ah
db 0Ah,0
aRegshot1_8_2 db 'Regshot 1.8.2',0
align 4
asc_40D998 db '\',0
align 4
; char aSSSSSS[]
aSSSSSS	db '%s%s%s%s%s%s',0
align 4
asc_40D9AC db '[',0
align 10h
asc_40D9B0 db ']',0
align 4
aBy db ' by:',0
align 4
off_40D9BC dd offset __exit
dword_40D9C0 dd	2
off_40D9C4 dd offset aNull ; "(null)"
off_40D9C8 dd offset aNull_0 ; "(null)"
align 10h
dword_40D9D0 dd	0C0000005h
db  0Bh
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  1Dh
db    0
db    0
db 0C0h	; ¿
db    4
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  96h	; ñ
db    0
db    0
db 0C0h	; ¿
db    4
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  8Dh	; ç
db    0
db    0
db 0C0h	; ¿
db    8
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  8Eh	; é
db    0
db    0
db 0C0h	; ¿
db    8
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  8Fh	; è
db    0
db    0
db 0C0h	; ¿
db    8
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  90h	; ê
db    0
db    0
db 0C0h	; ¿
db    8
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  91h	; ë
db    0
db    0
db 0C0h	; ¿
db    8
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  92h	; í
db    0
db    0
db 0C0h	; ¿
db    8
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  93h	; ì
db    0
db    0
db 0C0h	; ¿
db    8
db    0
db    0
db    0
db    0
db    0
db    0
db    0
dword_40DA48 dd	3
dword_40DA4C dd	7
dword_40DA50 dd	0Ah
dword_40DA54 dd	8Ch
unk_40DA58 db 0FFh
db 0FFh
db 0FFh
db 0FFh
db    0
db  0Ah
db    0
db    0
db  10h
db    0
db    0
db    0
unk_40DA64 db  20h
db    5
db  93h	; ì
db  19h
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
dword_40DA78 dd	2
off_40DA7C dd offset aR6002FloatingP ; "R6002\r\n- floating point not loaded\r\"...
db    8
db    0
db    0
db    0
db 0A0h	; †
db 0C4h	; ƒ
db  40h	; @
db    0
db    9
db    0
db    0
db    0
db  74h	; t
db 0C4h	; ƒ
db  40h	; @
db    0
db  0Ah
db    0
db    0
db    0
db  50h	; P
db 0C4h	; ƒ
db  40h	; @
db    0
db  10h
db    0
db    0
db    0
db  24h	; $
db 0C4h	; ƒ
db  40h	; @
db    0
db  11h
db    0
db    0
db    0
db 0F4h	; Ù
db 0C3h	; √
db  40h	; @
db    0
db  12h
db    0
db    0
db    0
db 0D0h	; –
db 0C3h	; √
db  40h	; @
db    0
db  13h
db    0
db    0
db    0
db 0A4h	; §
db 0C3h	; √
db  40h	; @
db    0
db  18h
db    0
db    0
db    0
db  6Ch	; l
db 0C3h	; √
db  40h	; @
db    0
db  19h
db    0
db    0
db    0
db  44h	; D
db 0C3h	; √
db  40h	; @
db    0
db  1Ah
db    0
db    0
db    0
db  0Ch
db 0C3h	; √
db  40h	; @
db    0
db  1Bh
db    0
db    0
db    0
db 0D4h	; ‘
db 0C2h	; ¬
db  40h	; @
db    0
db  1Ch
db    0
db    0
db    0
db 0ACh	; ¨
db 0C2h	; ¬
db  40h	; @
db    0
db  78h	; x
db    0
db    0
db    0
db  9Ch	; ú
db 0C2h	; ¬
db  40h	; @
db    0
db  79h	; y
db    0
db    0
db    0
db  8Ch	; å
db 0C2h	; ¬
db  40h	; @
db    0
db  7Ah	; z
db    0
db    0
db    0
db  7Ch	; |
db 0C2h	; ¬
db  40h	; @
db    0
db 0FCh	; ¸
db    0
db    0
db    0
db  78h	; x
db 0C2h	; ¬
db  40h	; @
db    0
db 0FFh
db    0
db    0
db    0
db  68h	; h
db 0C2h	; ¬
db  40h	; @
db    0
off_40DB08 dd offset unk_410960
align 10h
dd offset unk_410960
db    1
db    1
db    0
db    0
unk_40DB18 db	 0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  10h
db    0
db    0
db    0
db    0
db    0
db    0
unk_40DB28 db	 0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    2
db    0
db    0
db    0
db    1
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
unk_40DB48 db	 0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    2
db    0
db    0
db    0
db    2
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
unk_40DB78 db	 0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
unk_40DD88 db	 0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
off_40DD90 dd offset __fptrap
off_40DD94 dd offset __fptrap
dd offset __fptrap
off_40DD9C dd offset __fptrap
dd offset __fptrap
dd offset __fptrap
off_40DDA8 dd offset __ctype+2
dd offset __ctype+2
public __ctype
; unsigned __int16 _ctype[]
__ctype	dd    200000h
unicode	0, <	    (((((	       >
unicode	0, <	H>
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  84h	; Ñ
db    0
db  84h	; Ñ
db    0
db  84h	; Ñ
db    0
db  84h	; Ñ
db    0
db  84h	; Ñ
db    0
db  84h	; Ñ
db    0
db  84h	; Ñ
db    0
db  84h	; Ñ
db    0
db  84h	; Ñ
db    0
db  84h	; Ñ
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  81h	; Å
db    0
db  81h	; Å
db    0
db  81h	; Å
db    0
db  81h	; Å
db    0
db  81h	; Å
db    0
db  81h	; Å
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db    1
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  82h	; Ç
db    0
db  82h	; Ç
db    0
db  82h	; Ç
db    0
db  82h	; Ç
db    0
db  82h	; Ç
db    0
db  82h	; Ç
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db    2
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  10h
db    0
db  20h
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
byte_40DFC0 db 1
db    2
db    4
db    8
db    0
db    0
db    0
db    0
unk_40DFC8 db 0A4h ; §
db    3
db    0
db    0
aVyv db	'`ÇyÇ!',0
align 8
aJ db '¶ﬂ',0
align 10h
aBe db '°•',0
align 8
db  81h	; Å
db  9Fh	; ü
db 0E0h	; ‡
db 0FCh	; ¸
db    0
db    0
db    0
db    0
db  40h	; @
db  7Eh	; ~
db  80h	; Ä
db 0FCh	; ¸
db    0
db    0
db    0
db    0
db 0A8h	; ®
db    3
db    0
db    0
db 0C1h	; ¡
db 0A3h	; £
db 0DAh	; ⁄
db 0A3h	; £
db  20h
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  81h	; Å
db 0FEh	; ˛
db    0
db    0
db    0
db    0
db    0
db    0
db  40h	; @
db 0FEh	; ˛
db    0
db    0
db    0
db    0
db    0
db    0
db 0B5h	; µ
db    3
db    0
db    0
db 0C1h	; ¡
db 0A3h	; £
db 0DAh	; ⁄
db 0A3h	; £
db  20h
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  81h	; Å
db 0FEh	; ˛
db    0
db    0
db    0
db    0
db    0
db    0
db  41h	; A
db 0FEh	; ˛
db    0
db    0
db    0
db    0
db    0
db    0
db 0B6h	; ∂
db    3
db    0
db    0
db 0CFh	; œ
db 0A2h	; ¢
db 0E4h	; ‰
db 0A2h	; ¢
db  1Ah
db    0
db 0E5h	; Â
db 0A2h	; ¢
db 0E8h	; Ë
db 0A2h	; ¢
db  5Bh	; [
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  81h	; Å
db 0FEh	; ˛
db    0
db    0
db    0
db    0
db    0
db    0
db  40h	; @
db  7Eh	; ~
db 0A1h	; °
db 0FEh	; ˛
db    0
db    0
db    0
db    0
db  51h	; Q
db    5
db    0
db    0
db  51h	; Q
db 0DAh	; ⁄
db  5Eh	; ^
db 0DAh	; ⁄
db  20h
db    0
db  5Fh	; _
db 0DAh	; ⁄
db  6Ah	; j
db 0DAh	; ⁄
db  32h	; 2
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db  81h	; Å
db 0D3h	; ”
db 0D8h	; ÿ
db 0DEh	; ﬁ
db 0E0h	; ‡
db 0F9h	; ˘
db    0
db    0
db  31h	; 1
db  7Eh	; ~
db  81h	; Å
db 0FEh	; ˛
db    0
db    0
db    0
db    0
unk_40E0B8 db	 0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
off_40E0C0 dd offset off_40E0C0
; LPVOID off_40E0C4
off_40E0C4 dd offset off_40E0C0
dd offset unk_40E0D8
dd offset unk_40E0D8
dword_40E0D0 dd	0FFFFFFFFh
db 0FFh
db 0FFh
db 0FFh
db 0FFh
unk_40E0D8 db 0F0h ; 
db    0
db    0
db    0
db 0F1h	; Ò
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
off_4100E0 dd offset off_40E0C0
dword_4100E4 dd	1E0h
align 10h
unk_4100F0 db	 1
db    0
db    0
db    0
dword_4100F4 dd	16h
db    2
db    0
db    0
db    0
db    2
db    0
db    0
db    0
db    3
db    0
db    0
db    0
db    2
db    0
db    0
db    0
db    4
db    0
db    0
db    0
db  18h
db    0
db    0
db    0
db    5
db    0
db    0
db    0
db  0Dh
db    0
db    0
db    0
db    6
db    0
db    0
db    0
db    9
db    0
db    0
db    0
db    7
db    0
db    0
db    0
db  0Ch
db    0
db    0
db    0
db    8
db    0
db    0
db    0
db  0Ch
db    0
db    0
db    0
db    9
db    0
db    0
db    0
db  0Ch
db    0
db    0
db    0
db  0Ah
db    0
db    0
db    0
db    7
db    0
db    0
db    0
db  0Bh
db    0
db    0
db    0
db    8
db    0
db    0
db    0
db  0Ch
db    0
db    0
db    0
db  16h
db    0
db    0
db    0
db  0Dh
db    0
db    0
db    0
db  16h
db    0
db    0
db    0
db  0Fh
db    0
db    0
db    0
db    2
db    0
db    0
db    0
db  10h
db    0
db    0
db    0
db  0Dh
db    0
db    0
db    0
db  11h
db    0
db    0
db    0
db  12h
db    0
db    0
db    0
db  12h
db    0
db    0
db    0
db    2
db    0
db    0
db    0
db  21h	; !
db    0
db    0
db    0
db  0Dh
db    0
db    0
db    0
db  35h	; 5
db    0
db    0
db    0
db    2
db    0
db    0
db    0
db  41h	; A
db    0
db    0
db    0
db  0Dh
db    0
db    0
db    0
db  43h	; C
db    0
db    0
db    0
db    2
db    0
db    0
db    0
db  50h	; P
db    0
db    0
db    0
db  11h
db    0
db    0
db    0
db  52h	; R
db    0
db    0
db    0
db  0Dh
db    0
db    0
db    0
db  53h	; S
db    0
db    0
db    0
db  0Dh
db    0
db    0
db    0
db  57h	; W
db    0
db    0
db    0
db  16h
db    0
db    0
db    0
db  59h	; Y
db    0
db    0
db    0
db  0Bh
db    0
db    0
db    0
db  6Ch	; l
db    0
db    0
db    0
db  0Dh
db    0
db    0
db    0
db  6Dh	; m
db    0
db    0
db    0
db  20h
db    0
db    0
db    0
db  70h	; p
db    0
db    0
db    0
db  1Ch
db    0
db    0
db    0
db  72h	; r
db    0
db    0
db    0
db    9
db    0
db    0
db    0
db    6
db    0
db    0
db    0
db  16h
db    0
db    0
db    0
db  80h	; Ä
db    0
db    0
db    0
db  0Ah
db    0
db    0
db    0
db  81h	; Å
db    0
db    0
db    0
db  0Ah
db    0
db    0
db    0
db  82h	; Ç
db    0
db    0
db    0
db    9
db    0
db    0
db    0
db  83h	; É
db    0
db    0
db    0
db  16h
db    0
db    0
db    0
db  84h	; Ñ
db    0
db    0
db    0
db  0Dh
db    0
db    0
db    0
db  91h	; ë
db    0
db    0
db    0
db  29h	; )
db    0
db    0
db    0
db  9Eh	; û
db    0
db    0
db    0
db  0Dh
db    0
db    0
db    0
db 0A1h	; °
db    0
db    0
db    0
db    2
db    0
db    0
db    0
db 0A4h	; §
db    0
db    0
db    0
db  0Bh
db    0
db    0
db    0
db 0A7h	; ß
db    0
db    0
db    0
db  0Dh
db    0
db    0
db    0
db 0B7h	; ∑
db    0
db    0
db    0
db  11h
db    0
db    0
db    0
db 0CEh	; Œ
db    0
db    0
db    0
db    2
db    0
db    0
db    0
db 0D7h	; ◊
db    0
db    0
db    0
db  0Bh
db    0
db    0
db    0
db  18h
db    7
db    0
db    0
db  0Ch
db    0
db    0
db    0
; int cbMultiByte
cbMultiByte dd 1
db  2Eh	; .
db    0
db    0
db    0
db    1
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
; char String[4]
String db 4 dup(0)
; LPVOID dword_410274
dword_410274 dd	0
db    0
db    0
db    0
db    0
dword_41027C dd	0
dword_410280 dd	0
dword_410284 dd	0
db    0
db    0
db    0
db    0
dword_41028C dd	0
dword_410290 dd	0
dword_410294 dd	0
dword_410298 dd	0
dword_41029C dd	0
dword_4102A0 dd	0
align 8
dword_4102A8 dd	0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
dword_4102B8 dd	0
align 10h
byte_4102C0 db 0
align 4
dword_4102C4 dd	0
dword_4102C8 dd	0
dword_4102CC dd	0
; char Filename[260]
Filename db 104h dup(0)
dword_4103D4 dd	0
dword_4103D8 dd	0
dword_4103DC dd	0
dword_4103E0 dd	0
dword_4103E4 dd	0
dword_4103E8 dd	0
dword_4103EC dd	0
dword_4103F0 dd	0
dword_4103F4 dd	0
dword_4103F8 dd	0
unk_4103FC db	 0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
; LCID dword_410404
dword_410404 dd	0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
; UINT CodePage
CodePage dd 0
db    0
db    0
db    0
db    0
dword_41041C dd	0
dword_410420 dd	0
; LPCVOID dword_410424
dword_410424 dd	0
; LPCSTR dword_410428
dword_410428 dd	0
dword_41042C dd	0
; LPCSTR dword_410430
dword_410430 dd	0
; LPCVOID dword_410434
dword_410434 dd	0
; LPCVOID dword_410438
dword_410438 dd	0
; LPCSTR dword_41043C
dword_41043C dd	0
; LPCVOID dword_410440
dword_410440 dd	0
; LPCVOID dword_410444
dword_410444 dd	0
; LPCVOID dword_410448
dword_410448 dd	0
; LPCVOID dword_41044C
dword_41044C dd	0
dword_410450 dd	0
; LPCVOID dword_410454
dword_410454 dd	0
; LPCVOID dword_410458
dword_410458 dd	0
; LPCSTR lpCaption
lpCaption dd 0
; LPCVOID dword_410460
dword_410460 dd	0
; LPCVOID dword_410464
dword_410464 dd	0
; LPCSTR dword_410468
dword_410468 dd	0
dword_41046C dd	0
; LPCSTR dword_410470
dword_410470 dd	0
; LPCSTR dword_410474
dword_410474 dd	0
; LPCVOID dword_410478
dword_410478 dd	0
; LPCSTR lpNewItem
lpNewItem dd 0
dword_410480 dd	0
; LPCVOID dword_410484
dword_410484 dd	0
; LPCSTR lpText
lpText dd 0
; LPCVOID dword_41048C
dword_41048C dd	0
dword_410490 dd	0
; LPCVOID dword_410494
dword_410494 dd	0
; LPCVOID dword_410498
dword_410498 dd	0
; LPCSTR dword_41049C
dword_41049C dd	0
; LPCSTR dword_4104A0
dword_4104A0 dd	0
dword_4104A4 dd	0
dword_4104A8 dd	0
; LPVOID dword_4104AC
dword_4104AC dd	0
dword_4104B0 dd	0
; int dword_4104B4
dword_4104B4 dd	0
; LPVOID dword_4104B8
dword_4104B8 dd	0
; LPVOID dword_4104BC
dword_4104BC dd	0
; LPARAM lParam
lParam dd 0
; LPSTR	dword_4104C4
dword_4104C4 dd	0
; LPVOID dword_4104C8
dword_4104C8 dd	0
; LPSTR	dword_4104CC
dword_4104CC dd	0
dword_4104D0 dd	0
; HANDLE hFile
hFile dd 0
dword_4104D8 dd	0
dword_4104DC dd	0
dword_4104E0 dd	0
dword_4104E4 dd	0
; LPVOID dword_4104E8
dword_4104E8 dd	0
dword_4104EC dd	0
dword_4104F0 dd	0
dword_4104F4 dd	0
dword_4104F8 dd	0
dword_4104FC dd	0
; LPVOID dword_410500
dword_410500 dd	0
dword_410504 dd	0
; LPCSTR dword_410508
dword_410508 dd	0
; LPVOID dword_41050C
dword_41050C dd	0
dword_410510 dd	0
; int dword_410514
dword_410514 dd	0
; HCURSOR hCursor
hCursor	dd 0
; LPSTR	lpName
lpName dd 0
dword_410520 dd	0
; int dword_410524
dword_410524 dd	0
align 20h
; struct tagMSG	Msg
Msg tagMSG <0>
; LPVOID dword_41055C
dword_41055C dd	0
; LPVOID dword_410560
dword_410560 dd	0
; int dword_410564
dword_410564 dd	0
; LPVOID dword_410568
dword_410568 dd	0
; LPVOID dword_41056C
dword_41056C dd	0
; LPVOID dword_410570
dword_410570 dd	0
; LPSYSTEMTIME dword_410574
dword_410574 dd	0
; LPSTR	lpString
lpString dd 0
dword_41057C dd	0
; LPSYSTEMTIME lpSystemTime
lpSystemTime dd	0
; HANDLE dword_410584
dword_410584 dd	0
; int dword_410588
dword_410588 dd	0
dword_41058C dd	0
; LPVOID dword_410590
dword_410590 dd	0
; int dword_410594
dword_410594 dd	0
; HANDLE hHeap
hHeap dd 0
dword_41059C dd	0
; int dword_4105A0
dword_4105A0 dd	0
dword_4105A4 dd	0
dword_4105A8 dd	0
; LPVOID lpMem
lpMem dd 0
; LPVOID dword_4105B0
dword_4105B0 dd	0
dword_4105B4 dd	0
; LPVOID dword_4105B8
dword_4105B8 dd	0
; LPSTR	dword_4105BC
dword_4105BC dd	0
; int dword_4105C0
dword_4105C0 dd	0
align 20h
; struct tagOFNA stru_4105E0
stru_4105E0 tagOFNA <0>
; LPSTR	dword_41062C
dword_41062C dd	0
; LPCSTR dword_410630
dword_410630 dd	0
dword_410634 dd	0
dword_410638 dd	0
align 10h
; struct tagRECT Rect
Rect tagRECT <0>
; DWORD	NumberOfBytesWritten
NumberOfBytesWritten dd	0
; int dword_410654
dword_410654 dd	0
; int dword_410658
dword_410658 dd	0
align 10h
; struct _browseinfoA bi
bi _browseinfoA	<0>
; HMENU	dword_410680
dword_410680 dd	0
; LPVOID dword_410684
dword_410684 dd	0
dword_410688 dd	0
; LPSTR	lpReturnedString
lpReturnedString dd 0
; LPCSTR lpFileName
lpFileName dd 0
dword_410694 dd	0
; HWND hDlg
hDlg dd	0
; LPCSTR dword_41069C
dword_41069C dd	0
; LPVOID dword_4106A0
dword_4106A0 dd	0
; LPVOID dword_4106A4
dword_4106A4 dd	0
; LPVOID dword_4106A8
dword_4106A8 dd	0
; LPVOID dword_4106AC
dword_4106AC dd	0
; int dword_4106B0
dword_4106B0 dd	0
; int dword_4106B4
dword_4106B4 dd	0
; LPSTR	dword_4106B8
dword_4106B8 dd	0
; LPSTR	dword_4106BC
dword_4106BC dd	0
dword_4106C0 dd	0
; int dword_4106C4
dword_4106C4 dd	0
; HMENU	hMenu
hMenu dd 0
; LPVOID dword_4106CC
dword_4106CC dd	0
; LPVOID dword_4106D0
dword_4106D0 dd	0
dword_4106D4 dd	0
dword_4106D8 dd	0
; LPSTR	dword_4106DC
dword_4106DC dd	0
dword_4106E0 dd	0
dword_4106E4 dd	0
dword_4106E8 dd	0
align 10h
; struct _FILETIME ftLastWriteTime
ftLastWriteTime	_FILETIME <0>
dword_4106F8 dd	0
dword_4106FC dd	0
dword_410700 dd	0
dword_410704 dd	0
; void *dword_410708
dword_410708 dd	0
dword_41070C dd	0
; LPVOID dword_410710
dword_410710 dd	0
dword_410714 dd	0
; UINT dword_410718
dword_410718 dd	0
align 10h
unk_410720 db	 0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
dword_41072C dd	0
align 20h
byte_410740 db 0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
unk_410840 db	 0
byte_410841 db 0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
; LCID Locale
Locale dd 0
dword_410948 dd	0
align 20h
unk_410960 db	 0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
dword_411960 dd	?
; HANDLE dword_411964
dword_411964 dd	?
dword_411968 dd	?
align 20h
dword_411980 dd	?
unk_411984 db	 ? ;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
; UINT uNumber
uNumber	dd ?
dword_411A84 dd	?
dword_411A88 dd	?
dword_411A8C dd	?
dword_411A90 dd	?
dword_411A94 dd	?
dword_411A98 dd	?
align 800h
_data ends


end start
