Function at 0x40eff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x480530
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a1620]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
push 1
lea ecx, [esi + 0x744]
mov dword [esp + 0x4c], 0
call fcn.004481ba
lea ebx, [esi + 0x7b8]
push 1
mov ecx, ebx
call fcn.004481ba
push 1
lea ecx, [esi + 0x120c]
call fcn.004481ba
lea ecx, [esi + 0x16ac]
push 1
call fcn.004481ba
push 1
lea ecx, [esi + 0x2040]
call fcn.004481ba
push 1
lea ecx, [esi + 0x2454]
call fcn.004481ba
push 1
lea ecx, [esi + 0x28c4]
call fcn.004481ba
push 1
lea ecx, [esi + 0x2d98]
call fcn.004481ba
push 1
lea ecx, [esi + 0x2f84]
call fcn.004481ba
push 1
lea ecx, [esi + 0x3108]
call fcn.004481ba
lea ecx, [esi + 0x3964]
push 1
call fcn.004481ba
lea ecx, [esi + 0x3fc0]
push 1
call fcn.004481ba
mov ecx, dword [esi + 0x4624]
push 1
call fcn.004481ba
call fcn.0044bb76
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f0e6
push 0x80004005
call fcn.004012e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x48], 1
mov ecx, dword [esi + 0x82c]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov ebp, dword [esp + 0x5c]
mov eax, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 0xc
push ebp
push eax
push 0x48df68
push 0x48df74
call edi
mov ecx, dword [esi + 0x830]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48df88
push 0x48df74
call edi
mov ecx, dword [esi + 0x834]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48df98
push 0x48df74
call edi
mov ecx, dword [esi + 0x838]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48dfac
push 0x48df74
call edi
mov ecx, dword [esi + 0x840]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48dfc0
push 0x48df74
call edi
mov ecx, dword [esi + 0x844]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48dfd0
push 0x48df74
call edi
mov ecx, dword [esi + 0x83c]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48dfe4
push 0x48df74
call edi
push 0x470
mov ecx, ebx
call fcn.004456c3
mov ecx, dword [eax + 0x20]
push 0
push 0
push 0xf0
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48dff8
push 0x48df74
call edi
push 0x417
mov ecx, ebx
call fcn.004456c3
mov ecx, dword [eax + 0x20]
push 0
push 0
push 0xf0
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48e000
push 0x48df74
call edi
mov ecx, dword [esi + 0xf3c]
mov eax, dword [ecx + 0x78]
add eax, 0x58
push eax
lea ecx, [esp + 0x18]
call fcn.00405a40
mov edx, dword [esp + 0x14]
push ebp
push edx
push 0x48e008
push 0x48df74
call edi
push 0x432
mov ecx, ebx
call fcn.004456c3
mov eax, dword [eax + 0x20]
push 0
push 0
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
lea ecx, [esp + 0x18]
push 0x48c018
push ecx
call fcn.004023e0
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebp
push edx
push 0x48e010
push 0x48df74
call edi
mov eax, dword [esi + 0xfc8]
mov eax, dword [eax + 0x78]
add eax, 0x58
push eax
lea ecx, [esp + 0x18]
call fcn.00405a40
mov ecx, dword [esp + 0x14]
push ebp
push ecx
push 0x48e018
push 0x48df74
call edi
push 0x46d
mov ecx, ebx
call fcn.004456c3
mov edx, dword [eax + 0x20]
push 0
push 0
push 0xf0
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
lea eax, [esp + 0x18]
push 0x48c018
push eax
call fcn.004023e0
mov ecx, dword [esp + 0x20]
add esp, 0xc
push ebp
push ecx
push 0x48e020
push 0x48df74
call edi
mov edx, dword [esi + 0x848]
push edx
lea eax, [esp + 0x18]
push 0x48c018
push eax
call fcn.004023e0
mov ecx, dword [esp + 0x20]
add esp, 0xc
push ebp
push ecx
push 0x48d810
push 0x48df74
call edi
mov edx, dword [esi + 0x84c]
push edx
lea eax, [esp + 0x18]
push 0x48c018
push eax
call fcn.004023e0
mov ecx, dword [esp + 0x20]
add esp, 0xc
push ebp
push ecx
push 0x48d81c
push 0x48df74
call edi
mov edx, dword [esi + 0xeb0]
push edx
lea eax, [esp + 0x18]
push 0x48c018
push eax
call fcn.004023e0
add esp, 0xc
push ebp
mov ecx, dword [esp + 0x18]
push ecx
push 0x48d7d4
push 0x48df74
call edi
lea ecx, [esp + 0x14]
call fcn.00401940
mov eax, dword [esi + 0x1290]
xor ebx, ebx
test eax, eax
jle 0x40f49d
test ebx, ebx
jl 0x40f503
cmp ebx, dword [esi + 0x1290]
jge 0x40f503
mov edx, dword [esi + 0x128c]
lea eax, [edx + ebx*4]
push 0x48dd48
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00405710
add esp, 0xc
mov byte [esp + 0x48], 2
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00436bc0
mov byte [esp + 0x48], 1
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f492
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebx, 1
cmp ebx, dword [esi + 0x1290]
jl 0x40f428
mov ecx, dword [esp + 0x14]
push ebp
push ecx
push 0x48e404
push 0x48e414
call edi
mov edx, dword [esi + 0x14dc]
push edx
lea eax, [esp + 0x18]
push 0x48c018
push eax
call fcn.004023e0
mov ebx, dword [esp + 0x20]
add esp, 0xc
push ebp
push ebx
push 0x48e424
push 0x48e414
call edi
cmp dword [ebx - 0xc], 0
mov ecx, dword [ebx - 0x10]
lea eax, [ebx - 0x10]
mov dword [esp + 0x30], ecx
je 0x40f53c
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40f514
cmp dword [ebx - 8], 0
jge 0x40f508
push 0x80070057
call fcn.004012e0
call fcn.0044c4a2
mov dword [ebx - 0xc], 0
mov byte [ebx], 0
jmp 0x40f53c
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f52a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x14], ebx
cmp dword [esi + 0x1728], 0
mov dword [esp + 0x18], 0
jle 0x40f64b
mov eax, dword [esp + 0x18]
test eax, eax
jl 0x40f503
cmp eax, dword [esi + 0x1728]
jge 0x40f503
mov ecx, dword [esi + 0x1724]
mov edx, eax
lea eax, [ecx + edx*4]
push 0x48dd48
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00405710
add esp, 0xc
mov byte [esp + 0x48], 3
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
mov dword [esp + 0x28], eax
sub eax, ebx
mov dword [esp + 0x30], eax
mov eax, dword [ebx - 0xc]
lea edx, [eax + ecx]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], eax
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, edx
or eax, ecx
mov dword [esp + 0x1c], edx
jge 0x40f5c6
mov ecx, edx
push ecx
lea ecx, [esp + 0x18]
call fcn.00401360
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x24]
ja 0x40f5d6
add eax, ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push eax
push edx
push eax
mov eax, dword [esp + 0x30]
add eax, ebx
push eax
call fcn.00465e9e
add esp, 0x10
cmp dword [esp + 0x1c], 0
jl 0x40f4f9
mov eax, dword [esp + 0x1c]
cmp eax, dword [ebx - 8]
jg 0x40f4f9
mov dword [ebx - 0xc], eax
mov byte [eax + ebx], 0
mov byte [esp + 0x48], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f634
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 1
cmp eax, dword [esi + 0x1728]
mov dword [esp + 0x18], eax
jl 0x40f551
push ebp
push ebx
push 0x48d8ec
push 0x48e500
call edi
push 0x412
lea ecx, [esi + 0x16ac]
call fcn.004456c3
mov ecx, dword [eax + 0x20]
push 0
push 0
push 0xf0
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48e50c
push 0x48e500
call edi
mov ecx, dword [esi + 0x1f7c]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48e51c
push 0x48e500
call edi
mov ecx, dword [esi + 0x1878]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48e528
push 0x48e500
call edi
mov ecx, dword [esi + 0x187c]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov ebx, dword [esp + 0x20]
add esp, 0xc
push ebp
push ebx
push 0x48e534
push 0x48e500
call edi
mov eax, dword [esi + 0x1cc8]
mov eax, dword [eax + 0x78]
add eax, 0x58
mov eax, dword [eax]
lea edx, [ebx - 0x10]
lea ecx, [eax - 0x10]
cmp ecx, edx
mov dword [esp + 0x1c], edx
je 0x40f7fa
cmp dword [edx + 0xc], 0
jl 0x40f7e8
mov ecx, dword [eax - 0x10]
cmp ecx, dword [edx]
lea ebx, [eax - 0x10]
jne 0x40f7e8
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x40f77d
cmp eax, dword [ebx]
jne 0x40f77d
mov dword [esp + 0x18], ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40f7ba
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
test eax, eax
mov dword [esp + 0x18], eax
jne 0x40f798
call fcn.00401430
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
add eax, 1
push eax
add ebx, 0x10
push ebx
push eax
add ecx, 0x10
push ecx
call fcn.00465e9e
add esp, 0x10
mov eax, dword [esp + 0x1c]
add eax, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f7db
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x18]
add ebx, 0x10
mov dword [esp + 0x14], ebx
jmp 0x40f7fa
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004018b0
mov ebx, dword [esp + 0x14]
push ebp
push ebx
push 0x48d948
push 0x48e500
call edi
mov ecx, dword [esi + 0x1d54]
mov eax, dword [ecx + 0x78]
add eax, 0x58
mov eax, dword [eax]
lea edx, [ebx - 0x10]
lea ecx, [eax - 0x10]
cmp ecx, edx
mov dword [esp + 0x1c], edx
je 0x40f8e0
cmp dword [edx + 0xc], 0
jl 0x40f8ce
mov ecx, dword [eax - 0x10]
cmp ecx, dword [edx]
lea ebx, [eax - 0x10]
jne 0x40f8ce
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x40f863
cmp eax, dword [ebx]
jne 0x40f863
mov dword [esp + 0x18], ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40f8a0
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
test eax, eax
mov dword [esp + 0x18], eax
jne 0x40f87e
call fcn.00401430
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
add eax, 1
push eax
add ebx, 0x10
push ebx
push eax
add ecx, 0x10
push ecx
call fcn.00465e9e
add esp, 0x10
mov eax, dword [esp + 0x1c]
add eax, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f8c1
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x18]
add ebx, 0x10
mov dword [esp + 0x14], ebx
jmp 0x40f8e0
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004018b0
mov ebx, dword [esp + 0x14]
push ebp
push ebx
push 0x48d950
push 0x48e500
call edi
mov ecx, dword [esi + 0x1734]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48d8f8
push 0x48e500
call edi
mov ecx, dword [esi + 0x1de0]
mov eax, dword [ecx + 0x78]
mov ecx, dword [esp + 0x14]
add eax, 0x58
mov eax, dword [eax]
add ecx, 0xfffffff0
lea ebx, [eax - 0x10]
cmp ebx, ecx
mov dword [esp + 0x1c], ecx
je 0x40f9ef
mov edx, ecx
cmp dword [edx + 0xc], 0
jl 0x40f9e1
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x40f9e1
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x40f976
cmp eax, dword [ebx]
jne 0x40f976
mov dword [esp + 0x18], ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40f9b3
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
test eax, eax
mov dword [esp + 0x18], eax
jne 0x40f991
call fcn.00401430
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
add eax, 1
push eax
add ebx, 0x10
push ebx
push eax
add ecx, 0x10
push ecx
call fcn.00465e9e
add esp, 0x10
mov eax, dword [esp + 0x1c]
add eax, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f9d4
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
add ecx, 0x10
mov dword [esp + 0x14], ecx
jmp 0x40f9ef
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004018b0
mov edx, dword [esp + 0x14]
push ebp
push edx
push 0x48e550
push 0x48e500
call edi
mov eax, dword [esi + 0x173c]
push eax
lea ecx, [esp + 0x18]
push 0x48c018
push ecx
call fcn.004023e0
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebp
push edx
push 0x48e560
push 0x48e500
call edi
mov eax, dword [esi + 0x1738]
push eax
lea ecx, [esp + 0x18]
push 0x48c018
push ecx
call fcn.004023e0
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebp
push edx
push 0x48d904
push 0x48e500
call edi
mov eax, dword [esi + 0x1e6c]
mov eax, dword [eax + 0x78]
mov ecx, dword [esp + 0x14]
add eax, 0x58
mov eax, dword [eax]
add ecx, 0xfffffff0
lea ebx, [eax - 0x10]
cmp ebx, ecx
mov dword [esp + 0x1c], ecx
je 0x40fb2d
mov edx, ecx
cmp dword [edx + 0xc], 0
jl 0x40fb1f
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x40fb1f
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x40fab4
cmp eax, dword [ebx]
jne 0x40fab4
mov dword [esp + 0x18], ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40faf1
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
test eax, eax
mov dword [esp + 0x18], eax
jne 0x40facf
call fcn.00401430
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
add eax, 1
push eax
add ebx, 0x10
push ebx
push eax
add ecx, 0x10
push ecx
call fcn.00465e9e
add esp, 0x10
mov eax, dword [esp + 0x1c]
add eax, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40fb12
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
add ecx, 0x10
mov dword [esp + 0x14], ecx
jmp 0x40fb2d
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004018b0
mov edx, dword [esp + 0x14]
push ebp
push edx
push 0x48e578
push 0x48e500
call edi
mov eax, dword [esi + 0x1740]
push eax
lea ecx, [esp + 0x18]
push 0x48c018
push ecx
call fcn.004023e0
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebp
push edx
push 0x48e584
push 0x48e500
call edi
mov eax, dword [esi + 0x47ec]
push eax
lea ecx, [esp + 0x18]
push 0x48c018
push ecx
call fcn.004023e0
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebp
push edx
push 0x48e590
push 0x48e59c
call edi
mov eax, dword [esi + 0x2108]
push eax
lea ecx, [esp + 0x18]
push 0x48c018
push ecx
call fcn.004023e0
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebp
push edx
push 0x48e5ac
push 0x48e59c
call edi
mov eax, dword [esi + 0x2218]
push eax
lea ecx, [esp + 0x18]
push 0x48c018
push ecx
call fcn.004023e0
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebp
push edx
push 0x48e5bc
push 0x48e59c
call edi
call fcn.0044bb76
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fc05
push 0x80004005
call fcn.004012e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x28], ebx
push 0
push 0
mov byte [esp + 0x50], 4
mov ecx, dword [esi + 0x21d8]
push 0x18b
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jle 0x40fdc1
call fcn.0044bb76
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x40f0dc
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x18]
push 0
push ecx
mov byte [esp + 0x50], 5
mov edx, dword [esi + 0x21d8]
push 0x186
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0x21d8]
push 0
push 0
push 0x188
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
push edx
lea ecx, [esi + 0x21b8]
call fcn.0044edf2
push 0x48bce8
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.00405710
add esp, 0xc
mov byte [esp + 0x48], 6
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
mov dword [esp + 0x24], eax
sub eax, ebx
mov dword [esp + 0x30], eax
mov eax, dword [ebx - 0xc]
lea edx, [eax + ecx]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x2c], eax
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, edx
or eax, ecx
mov dword [esp + 0x1c], edx
jge 0x40fd09
push edx
lea ecx, [esp + 0x2c]
call fcn.00401360
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x2c]
ja 0x40fd19
add eax, ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push eax
add edx, ebx
push edx
call fcn.00465e9e
add esp, 0x10
cmp dword [esp + 0x1c], 0
jl 0x40f4f9
mov eax, dword [esp + 0x1c]
cmp eax, dword [ebx - 8]
jg 0x40f4f9
mov dword [ebx - 0xc], eax
mov byte [eax + ebx], 0
mov byte [esp + 0x48], 5
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fd77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x48], 4
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fd9c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0x21d8]
add dword [esp + 0x18], 1
push 0
push 0
push 0x18b
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esp + 0x18], eax
jl 0x40fc40
push ebp
push ebx
push 0x48e5d4
push 0x48e59c
call edi
call fcn.0044bb76
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fde9
push 0x80004005
call fcn.004012e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x24], ebx
push 0
push 0
mov byte [esp + 0x50], 7
mov ecx, dword [esi + 0x337c]
push 0x18b
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jle 0x40ffa5
call fcn.0044bb76
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x40f0dc
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x18]
push 0
push ecx
mov byte [esp + 0x50], 8
mov edx, dword [esi + 0x337c]
push 0x186
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0x337c]
push 0
push 0
push 0x188
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push edx
lea ecx, [esi + 0x335c]
call fcn.0044edf2
push 0x48bce8
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.00405710
add esp, 0xc
mov byte [esp + 0x48], 9
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
mov dword [esp + 0x2c], eax
sub eax, ebx
mov dword [esp + 0x38], eax
mov eax, dword [ebx - 0xc]
lea edx, [eax + ecx]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], eax
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, edx
or eax, ecx
mov dword [esp + 0x20], edx
jge 0x40feed
push edx
lea ecx, [esp + 0x28]
call fcn.00401360
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x38]
cmp eax, dword [esp + 0x30]
ja 0x40fefd
add eax, ebx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
push eax
push ecx
push eax
add edx, ebx
push edx
call fcn.00465e9e
add esp, 0x10
cmp dword [esp + 0x20], 0
jl 0x40f4f9
mov eax, dword [esp + 0x20]
cmp eax, dword [ebx - 8]
jg 0x40f4f9
mov dword [ebx - 0xc], eax
mov byte [eax + ebx], 0
mov byte [esp + 0x48], 8
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ff5b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x48], 7
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ff80
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0x337c]
add dword [esp + 0x18], 1
push 0
push 0
push 0x18b
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esp + 0x18], eax
jl 0x40fe24
push ebp
push ebx
push 0x48d714
push 0x48e5e0
call edi
mov edx, dword [esi + 0x346c]
push edx
lea eax, [esp + 0x18]
push 0x48c018
push eax
call fcn.004023e0
mov ebx, dword [esp + 0x20]
add esp, 0xc
push ebp
push ebx
push 0x48db64
push 0x48e5e0
call edi
mov ecx, dword [esi + 0x3730]
mov eax, dword [ecx + 0x78]
add eax, 0x58
mov eax, dword [eax]
lea edx, [ebx - 0x10]
lea ecx, [eax - 0x10]
cmp ecx, edx
mov dword [esp + 0x20], edx
je 0x4100b6
cmp dword [edx + 0xc], 0
jl 0x4100a4
mov ecx, dword [eax - 0x10]
cmp ecx, dword [edx]
lea ebx, [eax - 0x10]
jne 0x4100a4
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x410039
cmp eax, dword [ebx]
jne 0x410039
mov dword [esp + 0x18], ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x410076
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
test eax, eax
mov dword [esp + 0x18], eax
jne 0x410054
call fcn.00401430
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
add eax, 1
push eax
add ebx, 0x10
push ebx
push eax
add ecx, 0x10
push ecx
call fcn.00465e9e
add esp, 0x10
mov eax, dword [esp + 0x20]
add eax, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410097
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x18]
add ebx, 0x10
mov dword [esp + 0x14], ebx
jmp 0x4100b6
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004018b0
mov ebx, dword [esp + 0x14]
push ebp
push ebx
push 0x48e5ec
push 0x48e5e0
call edi
mov ecx, dword [esi + 0x37bc]
mov eax, dword [ecx + 0x78]
add eax, 0x58
mov eax, dword [eax]
lea edx, [ebx - 0x10]
lea ecx, [eax - 0x10]
cmp ecx, edx
mov dword [esp + 0x20], edx
je 0x41019c
cmp dword [edx + 0xc], 0
jl 0x41018a
mov ecx, dword [eax - 0x10]
cmp ecx, dword [edx]
lea ebx, [eax - 0x10]
jne 0x41018a
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x41011f
cmp eax, dword [ebx]
jne 0x41011f
mov dword [esp + 0x18], ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x41015c
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
test eax, eax
mov dword [esp + 0x18], eax
jne 0x41013a
call fcn.00401430
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
add eax, 1
push eax
add ebx, 0x10
push ebx
push eax
add ecx, 0x10
push ecx
call fcn.00465e9e
add esp, 0x10
mov eax, dword [esp + 0x20]
add eax, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41017d
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x18]
add ebx, 0x10
mov dword [esp + 0x14], ebx
jmp 0x41019c
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004018b0
mov ebx, dword [esp + 0x14]
push ebp
push ebx
push 0x48e5f8
push 0x48e5e0
call edi
mov ecx, dword [esi + 0x3848]
mov eax, dword [ecx + 0x78]
add eax, 0x58
mov eax, dword [eax]
lea edx, [ebx - 0x10]
lea ecx, [eax - 0x10]
cmp ecx, edx
mov dword [esp + 0x20], edx
je 0x410282
cmp dword [edx + 0xc], 0
jl 0x410270
mov ecx, dword [eax - 0x10]
cmp ecx, dword [edx]
lea ebx, [eax - 0x10]
jne 0x410270
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x410205
cmp eax, dword [ebx]
jne 0x410205
mov dword [esp + 0x18], ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x410242
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
test eax, eax
mov dword [esp + 0x18], eax
jne 0x410220
call fcn.00401430
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
add eax, 1
push eax
add ebx, 0x10
push ebx
push eax
add ecx, 0x10
push ecx
call fcn.00465e9e
add esp, 0x10
mov eax, dword [esp + 0x20]
add eax, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410263
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x18]
add ebx, 0x10
mov dword [esp + 0x14], ebx
jmp 0x410282
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004018b0
mov ebx, dword [esp + 0x14]
push ebp
push ebx
push 0x48e604
push 0x48e5e0
call edi
mov ecx, dword [esi + 0x38d4]
mov eax, dword [ecx + 0x78]
add eax, 0x58
mov eax, dword [eax]
lea edx, [ebx - 0x10]
lea ecx, [eax - 0x10]
cmp ecx, edx
mov dword [esp + 0x20], edx
je 0x410368
cmp dword [edx + 0xc], 0
jl 0x410356
mov ecx, dword [eax - 0x10]
cmp ecx, dword [edx]
lea ebx, [eax - 0x10]
jne 0x410356
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x4102eb
cmp eax, dword [ebx]
jne 0x4102eb
mov dword [esp + 0x18], ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x410328
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
test eax, eax
mov dword [esp + 0x18], eax
jne 0x410306
call fcn.00401430
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
add eax, 1
push eax
add ebx, 0x10
push ebx
push eax
add ecx, 0x10
push ecx
call fcn.00465e9e
add esp, 0x10
mov eax, dword [esp + 0x20]
add eax, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410349
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x18]
add ebx, 0x10
mov dword [esp + 0x14], ebx
jmp 0x410368
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004018b0
mov ebx, dword [esp + 0x14]
push ebp
push ebx
push 0x48e610
push 0x48e5e0
call edi
mov ecx, dword [esi + 0x3960]
mov eax, dword [ecx + 0x78]
add eax, 0x58
mov eax, dword [eax]
lea edx, [ebx - 0x10]
lea ecx, [eax - 0x10]
cmp ecx, edx
mov dword [esp + 0x20], edx
je 0x41044e
cmp dword [edx + 0xc], 0
jl 0x41043c
mov ecx, dword [eax - 0x10]
cmp ecx, dword [edx]
lea ebx, [eax - 0x10]
jne 0x41043c
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x4103d1
cmp eax, dword [ebx]
jne 0x4103d1
mov dword [esp + 0x18], ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x41040e
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
test eax, eax
mov dword [esp + 0x18], eax
jne 0x4103ec
call fcn.00401430
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
add eax, 1
push eax
add ebx, 0x10
push ebx
push eax
add ecx, 0x10
push ecx
call fcn.00465e9e
add esp, 0x10
mov eax, dword [esp + 0x20]
add eax, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41042f
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x18]
add ebx, 0x10
mov dword [esp + 0x14], ebx
jmp 0x41044e
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004018b0
mov ebx, dword [esp + 0x14]
push ebp
push ebx
push 0x48e620
push 0x48e5e0
call edi
push 0x4c8
lea ecx, [esi + 0x3964]
call fcn.004456c3
mov ecx, dword [eax + 0x20]
push 0
push 0
push 0xf0
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48db78
push 0x48e62c
call edi
mov ecx, dword [esi + 0x39d8]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48e638
push 0x48e62c
call edi
mov ecx, dword [esi + 0x39dc]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48e644
push 0x48e62c
call edi
mov ecx, dword [esi + 0x3fbc]
mov eax, dword [ecx + 0x78]
mov ecx, dword [esp + 0x14]
add eax, 0x58
mov eax, dword [eax]
add ecx, 0xfffffff0
lea ebx, [eax - 0x10]
cmp ebx, ecx
mov dword [esp + 0x20], ecx
je 0x4105d0
mov edx, ecx
cmp dword [edx + 0xc], 0
jl 0x4105c2
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x4105c2
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x410557
cmp eax, dword [ebx]
jne 0x410557
mov dword [esp + 0x18], ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x410594
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
test eax, eax
mov dword [esp + 0x18], eax
jne 0x410572
call fcn.00401430
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
add eax, 1
push eax
add ebx, 0x10
push ebx
push eax
add ecx, 0x10
push ecx
call fcn.00465e9e
add esp, 0x10
mov eax, dword [esp + 0x20]
add eax, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4105b5
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
add ecx, 0x10
mov dword [esp + 0x14], ecx
jmp 0x4105d0
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004018b0
mov edx, dword [esp + 0x14]
push ebp
push edx
push 0x48e65c
push 0x48e62c
call edi
mov eax, dword [esi + 0x39e0]
push eax
lea ecx, [esp + 0x18]
push 0x48c018
push ecx
call fcn.004023e0
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebp
push edx
push 0x48e668
push 0x48e62c
call edi
mov eax, dword [esi + 0x39e8]
push eax
lea ecx, [esp + 0x18]
push 0x48c018
push ecx
call fcn.004023e0
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebp
push edx
push 0x48e678
push 0x48e62c
call edi
mov eax, dword [esi + 0x39e4]
push eax
lea ecx, [esp + 0x18]
push 0x48c018
push ecx
call fcn.004023e0
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebp
push edx
push 0x48e684
push 0x48e62c
call edi
mov eax, dword [esi + 0x39ec]
push eax
lea ecx, [esp + 0x18]
push 0x48c018
push ecx
call fcn.004023e0
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebp
push edx
push 0x48dbc4
push 0x48e62c
call edi
mov eax, dword [esi + 0x39f0]
push eax
lea ecx, [esp + 0x18]
push 0x48c018
push ecx
call fcn.004023e0
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebp
push edx
push 0x48e690
push 0x48e62c
call edi
mov eax, dword [esi + 0x39f4]
push eax
lea ecx, [esp + 0x18]
push 0x48c018
push ecx
call fcn.004023e0
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebp
push edx
push 0x48e69c
push 0x48e62c
call edi
mov ecx, dword [esi + 0x4624]
push 0x412
call fcn.004456c3
mov eax, dword [eax + 0x20]
push 0
push 0
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
lea ecx, [esp + 0x18]
push 0x48c018
push ecx
call fcn.004023e0
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebp
push edx
push 0x48dc6c
push 0x48e6ac
call edi
mov eax, dword [esi + 0x4624]
mov ecx, dword [eax + 0x74]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48e6b8
push 0x48e6ac
call edi
mov ecx, dword [esi + 0x4624]
mov edx, dword [ecx + 0x78]
push edx
lea eax, [esp + 0x18]
push 0x48c018
push eax
call fcn.004023e0
mov ecx, dword [esp + 0x20]
add esp, 0xc
push ebp
push ecx
push 0x48e6c4
push 0x48e6ac
call edi
mov edx, dword [esi + 0x4624]
mov eax, dword [edx + 0x7c]
push eax
lea ecx, [esp + 0x18]
push 0x48c018
push ecx
call fcn.004023e0
mov edx, dword [esp + 0x20]
add esp, 0xc
push ebp
push edx
push 0x48e6d4
push 0x48e6ac
call edi
mov eax, dword [esi + 0x4624]
mov ecx, dword [eax + 0x80]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48e6e4
push 0x48e6ac
call edi
mov eax, dword [esi + 0x4624]
mov ecx, dword [eax + 0x170]
add eax, 0xe8
mov eax, dword [ecx + 0x78]
mov ecx, dword [esp + 0x14]
add eax, 0x58
mov eax, dword [eax]
add ecx, 0xfffffff0
lea ebx, [eax - 0x10]
cmp ebx, ecx
mov dword [esp + 0x20], ecx
je 0x4108c8
mov edx, ecx
cmp dword [edx + 0xc], 0
jl 0x4108ba
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x4108ba
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x41084f
cmp eax, dword [ebx]
jne 0x41084f
mov dword [esp + 0x18], ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x41088c
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
test eax, eax
mov dword [esp + 0x18], eax
jne 0x41086a
call fcn.00401430
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
add eax, 1
push eax
add ebx, 0x10
push ebx
push eax
add ecx, 0x10
push ecx
call fcn.00465e9e
add esp, 0x10
mov eax, dword [esp + 0x20]
add eax, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4108ad
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
add ecx, 0x10
mov dword [esp + 0x14], ecx
jmp 0x4108c8
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004018b0
mov edx, dword [esp + 0x14]
push ebp
push edx
push 0x48e6f8
push 0x48e6ac
call edi
mov eax, dword [esi + 0x4624]
mov ecx, dword [eax + 0x84]
push ecx
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48e704
push 0x48e6ac
call edi
push 0x4d9
lea ecx, [esi + 0x3fc0]
call fcn.004456c3
mov ecx, dword [eax + 0x20]
push 0
push 0
push 0xf0
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
lea edx, [esp + 0x18]
push 0x48c018
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48e714
push 0x48e720
call edi
mov ecx, dword [esi + 0x4034]
push ecx
lea edx, [esp + 0x18]
push 0x48df60
push edx
call fcn.004023e0
add esp, 0xc
push 0x5e
push 0x3a
lea ebx, [esp + 0x1c]
call fcn.00436880
mov eax, dword [esp + 0x14]
push ebp
push eax
push 0x48dc30
push 0x48e720
call edi
mov ecx, dword [esi + 0x4038]
push ecx
mov edx, ebx
push 0x48df60
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48e738
push 0x48e720
call edi
mov ecx, dword [esi + 0x403c]
push ecx
mov edx, ebx
push 0x48df60
push edx
call fcn.004023e0
mov eax, dword [esp + 0x20]
add esp, 0xc
push ebp
push eax
push 0x48e744
push 0x48e720
call edi
mov ecx, dword [esi + 0x447c]
mov eax, dword [ecx + 0x78]
mov ecx, dword [esp + 0x14]
add eax, 0x58
mov eax, dword [eax]
add ecx, 0xfffffff0
lea ebx, [eax - 0x10]
cmp ebx, ecx
mov dword [esp + 0x20], ecx
je 0x410ab3
mov edx, ecx
cmp dword [edx + 0xc], 0
jl 0x410aa5
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x410aa5
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x410a3a
cmp eax, dword [ebx]
jne 0x410a3a
mov dword [esp + 0x18], ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x410a77
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
test eax, eax
mov dword [esp + 0x18], eax
jne 0x410a55
call fcn.00401430
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
add eax, 1
push eax
add ebx, 0x10
push ebx
push eax
add ecx, 0x10
push ecx
call fcn.00465e9e
add esp, 0x10
mov eax, dword [esp + 0x20]
add eax, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410a98
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
add ecx, 0x10
mov dword [esp + 0x14], ecx
jmp 0x410ab3
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004018b0
mov edx, dword [esp + 0x14]
push ebp
push edx
push 0x48e750
push 0x48e720
call edi
mov eax, dword [esi + 0x4508]
mov eax, dword [eax + 0x78]
add eax, 0x58
push eax
lea ecx, [esp + 0x18]
call fcn.00405a40
mov ecx, dword [esp + 0x14]
push ebp
push ecx
push 0x48e75c
push 0x48e720
call edi
mov edx, dword [esi + 0x4594]
mov eax, dword [edx + 0x78]
add eax, 0x58
push eax
lea ecx, [esp + 0x18]
call fcn.00405a40
mov eax, dword [esp + 0x14]
push ebp
push eax
push 0x48e768
push 0x48e720
call edi
mov ecx, dword [esi + 0x4620]
mov eax, dword [ecx + 0x78]
add eax, 0x58
push eax
lea ecx, [esp + 0x18]
call fcn.00405a40
mov esi, dword [esp + 0x14]
push ebp
push esi
push 0x48e774
push 0x48e720
call edi
mov byte [esp + 0x48], 4
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x410b62
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x48], 1
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410b87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x48], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410ba8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebp, 0xfffffff0
mov dword [esp + 0x48], 0xffffffff
lea ecx, [ebp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410bcd
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebp
call edx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 4