Function at 0x4bb5f4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x4bb5fc
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b50
mov esi, 0x4f6b34
xor eax, eax
push ebp
push 0x4bc910
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
jmp 0x4bb63a
mov edx, dword [ebp - 4]
mov eax, 0x4bc928
call fcn.00404ca4
test eax, eax
jle 0x4bb684
lea edx, [ebp - 0x10]
mov eax, 0x4bc940
call fcn.004b56a0
mov edx, dword [ebp - 0x10]
mov eax, 0x4cad94
call fcn.004046f4
lea edx, [ebp - 0x14]
mov eax, 0x4bc94c
call fcn.004b56a0
mov edx, dword [ebp - 0x14]
mov eax, 0x4cad98
call fcn.004046f4
jmp 0x4bc8ba
mov edx, dword [ebp - 4]
mov eax, 0x4bc958
call fcn.00404ca4
test eax, eax
jle 0x4bc82e
mov byte [ebp - 5], 1
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00408930
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
mov edx, 0x4bc968
call fcn.004b4d1c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov edx, 0x4bc974
call fcn.00404aac
jne 0x4bba91
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bc988
call fcn.00404ca4
test eax, eax
jle 0x4bb768
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bc998
call fcn.00404aac
jne 0x4bb727
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
mov edx, dword [esi + 0x345]
lea eax, [edx + eax + 5]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
pop edx
mov dword [edx], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bc9a8
call fcn.00404aac
jne 0x4bb768
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
mov edx, dword [esi + 0x345]
lea eax, [edx + eax + 0xd]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
pop edx
mov dword [edx], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bc9b8
call fcn.00404ca4
test eax, eax
jle 0x4bb7f8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bc9c8
call fcn.00404aac
jne 0x4bb7ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
imul eax, eax, 0xb
mov edx, dword [esi + 0x349]
lea eax, [edx + eax*2 + 6]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
pop edx
mov dword [edx], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bc9a8
call fcn.00404aac
jne 0x4bb7f8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
imul eax, eax, 0xb
mov edx, dword [esi + 0x349]
lea eax, [edx + eax*2 + 0xa]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
pop edx
mov dword [edx], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bc9d8
call fcn.00404ca4
test eax, eax
jle 0x4bb856
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bc9e8
call fcn.00404aac
jne 0x4bb831
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
mov dword [esi + 0x36], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bc9fc
call fcn.00404aac
jne 0x4bb856
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
mov dword [esi + 0x3f], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bca10
call fcn.00404ca4
test eax, eax
jle 0x4bb8a8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bc9a8
call fcn.00404aac
jne 0x4bb8a8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
lea eax, [eax + eax*8]
mov edx, dword [esi + 0x34d]
lea eax, [edx + eax + 5]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
pop edx
mov dword [edx], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bca20
call fcn.00404ca4
test eax, eax
jle 0x4bb8e1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bca30
call fcn.00404aac
jne 0x4bb8e1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
mov dword [esi + 0x4e], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bca40
call fcn.00404ca4
test eax, eax
jle 0x4bb91a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bca50
call fcn.00404aac
jne 0x4bb91a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
mov dword [esi + 0x45], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bca60
call fcn.00404ca4
test eax, eax
jle 0x4bb99a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bca70
call fcn.00404aac
jne 0x4bb964
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
imul eax, eax, 0x67
mov dword [esi + eax + 0x6c], ebx
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bc9a8
call fcn.00404aac
jne 0x4bb99a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
imul eax, eax, 0x67
mov dword [esi + eax + 0x74], ebx
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bca80
call fcn.00404ca4
test eax, eax
jle 0x4bb9d6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bc9c8
call fcn.00404aac
jne 0x4bb9d6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
mov dword [esi + 0x339], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bca90
call fcn.00404ca4
test eax, eax
jle 0x4bba0f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcaa0
call fcn.00404aac
jne 0x4bba0f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
mov dword [esi + 9], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcab4
call fcn.00404ca4
test eax, eax
jle 0x4bba88
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcac4
call fcn.00404aac
jne 0x4bba88
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
mov dword [esi + 0x15], eax
fld dword [0x4cada0]
call fcn.00402bf4
mov dword [esi + 0x19], eax
fld dword [0x4cada8]
call fcn.00402bf4
mov dword [esi + 0x1d], eax
mov eax, dword [esi + 0x19]
sub eax, dword [esi + 0x15]
mov dword [esi + 0x21], eax
mov eax, dword [esi + 0x1d]
sub eax, dword [esi + 0x15]
mov dword [esi + 0x25], eax
mov eax, dword [esi + 0x19]
add eax, dword [esi + 0x15]
mov dword [esi + 0x29], eax
mov eax, dword [esi + 0x1d]
add eax, dword [esi + 0x15]
mov dword [esi + 0x2d], eax
jmp 0x4bc8ba
mov byte [ebp - 5], 1
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov edx, 0x4bcad8
call fcn.00404aac
jne 0x4bc047
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bc988
call fcn.00404ca4
test eax, eax
jle 0x4bbb02
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, 0x4bcaf0
call fcn.00404aac
jne 0x4bbad1
mov bl, 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcb00
call fcn.00404aac
jne 0x4bbb02
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
mov edx, dword [esi + 0x345]
mov byte [edx + eax], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bc9b8
call fcn.00404ca4
test eax, eax
jle 0x4bbbce
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, 0x4bcaf0
call fcn.00404aac
jne 0x4bbb30
mov bl, 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcb00
call fcn.00404aac
jne 0x4bbb7f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
imul eax, eax, 0xb
mov edx, dword [esi + 0x349]
mov byte [edx + eax*2 + 1], bl
test bl, bl
je 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
imul eax, eax, 0xb
mov edx, dword [esi + 0x349]
mov byte [edx + eax*2], 0
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcb10
call fcn.00404aac
jne 0x4bbbce
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
imul eax, eax, 0xb
mov edx, dword [esi + 0x349]
mov byte [edx + eax*2], bl
test bl, bl
je 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
imul eax, eax, 0xb
mov edx, dword [esi + 0x349]
mov byte [edx + eax*2 + 1], 0
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcb20
call fcn.00404ca4
test eax, eax
jle 0x4bbc2c
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, 0x4bcaf0
call fcn.00404aac
jne 0x4bbbf8
mov bl, 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcb30
call fcn.00404aac
jne 0x4bbc12
mov byte [esi + 0x31], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcb48
call fcn.00404aac
jne 0x4bbc2c
mov byte [esi + 0x3a], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcb60
call fcn.00404ca4
test eax, eax
jle 0x4bbcbe
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, 0x4bcaf0
call fcn.00404aac
jne 0x4bbc56
mov bl, 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcb70
call fcn.00404aac
jne 0x4bbc70
mov byte [esi + 0x43], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcb88
call fcn.00404aac
jne 0x4bbc8a
mov byte [esi + 6], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcba0
call fcn.00404aac
jne 0x4bbca4
mov byte [esi + 0x13], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcbb4
call fcn.00404aac
jne 0x4bbcbe
mov byte [esi + 5], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bca10
call fcn.00404ca4
test eax, eax
jle 0x4bbd16
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, 0x4bcaf0
call fcn.00404aac
jne 0x4bbce8
mov bl, 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcb00
call fcn.00404aac
jne 0x4bbd16
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
lea eax, [eax + eax*8]
mov edx, dword [esi + 0x34d]
mov byte [edx + eax], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bca20
call fcn.00404ca4
test eax, eax
jle 0x4bbd5a
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, 0x4bcaf0
call fcn.00404aac
jne 0x4bbd40
mov bl, 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcbc8
call fcn.00404aac
jne 0x4bbd5a
mov byte [esi + 0x4d], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bca40
call fcn.00404ca4
test eax, eax
jle 0x4bbd9e
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, 0x4bcaf0
call fcn.00404aac
jne 0x4bbd84
mov bl, 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcbdc
call fcn.00404aac
jne 0x4bbd9e
mov byte [esi + 0x44], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bca60
call fcn.00404ca4
test eax, eax
jle 0x4bbe7b
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, 0x4bcaf0
call fcn.00404aac
jne 0x4bbdcc
mov bl, 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcbf0
call fcn.00404aac
jne 0x4bbdf5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
imul eax, eax, 0x67
mov byte [esi + eax + 0x6b], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcc00
call fcn.00404aac
jne 0x4bbe1e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
imul eax, eax, 0x67
mov byte [esi + eax + 0x69], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcc14
call fcn.00404aac
jne 0x4bbe47
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
imul eax, eax, 0x67
mov byte [esi + eax + 0x6a], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcc24
call fcn.00404aac
jne 0x4bbe61
mov byte [esi + 0x56], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcc34
call fcn.00404aac
jne 0x4bbe7b
mov byte [esi + 0x57], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bca80
call fcn.00404ca4
test eax, eax
jle 0x4bbefc
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, 0x4bcaf0
call fcn.00404aac
jne 0x4bbea5
mov bl, 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcc48
call fcn.00404aac
jne 0x4bbec2
mov byte [esi + 0x337], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcc5c
call fcn.00404aac
jne 0x4bbedf
mov byte [esi + 0x338], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcc70
call fcn.00404aac
jne 0x4bbefc
mov byte [esi + 0x336], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bca90
call fcn.00404ca4
test eax, eax
jle 0x4bbffa
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, 0x4bcaf0
call fcn.00404aac
jne 0x4bbf2a
mov bl, 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcc84
call fcn.00404aac
jne 0x4bbf44
mov byte [esi + 7], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcc98
call fcn.00404aac
jne 0x4bbf5e
mov byte [esi + 8], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bccac
call fcn.00404aac
jne 0x4bbf78
mov byte [esi + 0xe], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bccc0
call fcn.00404aac
jne 0x4bbf92
mov byte [esi + 0xd], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bccd4
call fcn.00404aac
jne 0x4bbfac
mov byte [esi + 0xf], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bccec
call fcn.00404aac
jne 0x4bbfc6
mov byte [esi + 0x10], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcd00
call fcn.00404aac
jne 0x4bbfe0
mov byte [esi + 0x11], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcd14
call fcn.00404aac
jne 0x4bbffa
mov byte [esi + 0x12], bl
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcab4
call fcn.00404ca4
test eax, eax
jle 0x4bc03e
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, 0x4bcaf0
call fcn.00404aac
jne 0x4bc024
mov bl, 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcd28
call fcn.00404aac
jne 0x4bc03e
mov byte [esi + 0x14], bl
jmp 0x4bc8ba
mov byte [ebp - 5], 1
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov edx, 0x4bcd3c
call fcn.00404aac
jne 0x4bc278
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bc988
call fcn.00404ca4
test eax, eax
jle 0x4bc0f7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcd54
call fcn.00404aac
jne 0x4bc0b6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
mov edx, dword [esi + 0x345]
lea eax, [edx + eax + 9]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
pop edx
mov dword [edx], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcd60
call fcn.00404aac
jne 0x4bc0f7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
mov edx, dword [esi + 0x345]
lea eax, [edx + eax + 1]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
pop edx
mov dword [edx], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bc9b8
call fcn.00404ca4
test eax, eax
jle 0x4bc149
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcd54
call fcn.00404aac
jne 0x4bc149
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
imul eax, eax, 0xb
mov edx, dword [esi + 0x349]
lea eax, [edx + eax*2 + 2]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
pop edx
mov dword [edx], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bca10
call fcn.00404ca4
test eax, eax
jle 0x4bc19b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcd54
call fcn.00404aac
jne 0x4bc19b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
lea eax, [eax + eax*8]
mov edx, dword [esi + 0x34d]
lea eax, [edx + eax + 1]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
pop edx
mov dword [edx], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bca60
call fcn.00404ca4
test eax, eax
jle 0x4bc233
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcd70
call fcn.00404aac
jne 0x4bc1e9
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
imul eax, eax, 0x67
mov dword [esi + eax + 0x70], ebx
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcd80
call fcn.00404aac
jne 0x4bc20e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
mov dword [esi + 0x59], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcd90
call fcn.00404aac
jne 0x4bc233
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
mov dword [esi + 0x5d], eax
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bca80
call fcn.00404ca4
test eax, eax
jle 0x4bc26f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcd54
call fcn.00404aac
jne 0x4bc26f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
mov dword [esi + 0x33d], eax
jmp 0x4bc8ba
mov byte [ebp - 5], 1
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov edx, 0x4bcda0
call fcn.00404aac
jne 0x4bc6fe
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcdb4
call fcn.00404ca4
test eax, eax
jle 0x4bc2ac
call fcn.004b9340
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcdd4
call fcn.00404ca4
test eax, eax
jle 0x4bc2d5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
call fcn.00408de0
call fcn.004b9004
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcdf4
call fcn.00404ca4
test eax, eax
jle 0x4bc2f3
call fcn.004b927c
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bce14
call fcn.00404ca4
test eax, eax
jle 0x4bc31c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
call fcn.00408de0
call fcn.004b8f20
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bce34
call fcn.00404ca4
test eax, eax
jle 0x4bc33a
call fcn.004b91cc
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bce50
call fcn.00404ca4
test eax, eax
jle 0x4bc363
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
call fcn.00408de0
call fcn.004b90e8
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bce6c
call fcn.00404ca4
test eax, eax
jle 0x4bc394
lea edx, [ebp - 0x1c]
mov eax, 0x4bce84
call fcn.004b56a0
mov edx, dword [ebp - 0x1c]
mov eax, dword [esi + 0x52]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bce98
call fcn.00404ca4
test eax, eax
jle 0x4bc3c5
lea edx, [ebp - 0x20]
mov eax, 0x4bceb0
call fcn.004b56a0
mov edx, dword [ebp - 0x20]
mov eax, dword [esi + 0x49]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcec4
call fcn.00404ca4
test eax, eax
jle 0x4bc408
lea eax, [ebp - 0x24]
call fcn.004b6ad4
mov edx, dword [ebp - 0x24]
mov eax, 0x4bca60
call fcn.004b5580
lea eax, [ebp - 0x28]
call fcn.004b68b4
mov edx, dword [ebp - 0x28]
mov eax, 0x4bcee0
call fcn.004b5580
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcef8
call fcn.00404ca4
test eax, eax
jle 0x4bc43c
lea edx, [ebp - 0x2c]
mov eax, 0x4bcf10
call fcn.004b56a0
mov edx, dword [ebp - 0x2c]
mov eax, dword [esi + 0x341]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcf24
call fcn.00404ca4
test eax, eax
jle 0x4bc46a
lea eax, [ebp - 0x30]
call fcn.004b7fac
mov edx, dword [ebp - 0x30]
mov eax, 0x4bcf3c
call fcn.004b5580
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcf50
call fcn.00404ca4
test eax, eax
jle 0x4bc488
call fcn.004bf40c
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcf64
call fcn.00404ca4
test eax, eax
jle 0x4bc4a6
call fcn.004bef24
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcf78
call fcn.00404ca4
test eax, eax
jle 0x4bc4f4
mov eax, dword [0x4f6ad4]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [0x4f6ad8]
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4ba450
call sub.user32.dll_EnumWindows
lea eax, [ebp - 0x34]
call fcn.004b7cf0
mov edx, dword [ebp - 0x34]
mov eax, 0x4bcf90
call fcn.004b5580
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcfa4
call fcn.00404ca4
test eax, eax
jle 0x4bc55e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
call fcn.00408de0
cdq
push edx
push eax
mov eax, dword [0x4cad58]
call fcn.004551dc
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4bc52b
cmp eax, dword [esp]
pop edx
pop eax
je 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
call fcn.00408de0
mov dword [0x4cad70], eax
mov eax, dword [0x4cad70]
push eax
mov eax, dword [0x4cad6c]
push eax
call sub.user32.dll_SetParent
call fcn.004ba024
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcfbc
call fcn.00404ca4
test eax, eax
jle 0x4bc5bf
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, 0x4bcaf0
call fcn.00404aac
jne 0x4bc5a3
push 0x83
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [0x4f6ac4]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x4bc8ba
push 0x43
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [0x4f6ac4]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcfd8
call fcn.00404ca4
test eax, eax
jle 0x4bc600
mov dl, 1
mov eax, dword [0x4cad58]
call fcn.0043a5e4
mov eax, dword [0x4cad58]
call fcn.0043c9f8
mov eax, dword [0x4cad58]
mov eax, dword [eax + 0x300]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x30]
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bcff0
call fcn.00404ca4
test eax, eax
jle 0x4bc61e
call fcn.004bb428
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bd00c
call fcn.00404ca4
test eax, eax
jle 0x4bc647
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
call fcn.00408de0
call fcn.004bb0d0
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bd02c
call fcn.00404ca4
test eax, eax
jle 0x4bc665
call fcn.004babc8
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, 0x4bd048
call fcn.00404ca4
test eax, eax
jle 0x4bc6f5
fld dword [0x4cada0]
call fcn.00402bf4
mov dword [esi + 0x19], eax
fld dword [0x4cada8]
call fcn.00402bf4
mov dword [esi + 0x1d], eax
mov eax, dword [esi + 0x19]
sub eax, dword [esi + 0x15]
mov dword [esi + 0x21], eax
mov eax, dword [esi + 0x1d]
sub eax, dword [esi + 0x15]
mov dword [esi + 0x25], eax
mov eax, dword [esi + 0x19]
add eax, dword [esi + 0x15]
mov dword [esi + 0x29], eax
mov eax, dword [esi + 0x1d]
add eax, dword [esi + 0x15]
mov dword [esi + 0x2d], eax
lea eax, [ebp - 0x38]
push eax
mov eax, dword [esi + 0x19]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
mov eax, dword [esi + 0x1d]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
lea edx, [ebp - 0x48]
mov ecx, 1
mov eax, 0x4bd060
call fcn.00409b7c
mov edx, dword [ebp - 0x38]
mov eax, 0x4bd048
call fcn.004b5580
jmp 0x4bc8ba
mov byte [ebp - 5], 1
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov edx, 0x4bd078
call fcn.00404aac
jne 0x4bc79d
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
mov eax, 0x4f6f6c
mov edx, 0x4bd08c
call fcn.004049ac
lea eax, [ebp - 0x50]
mov ecx, 0x4bd09c
mov edx, dword [0x4f6f6c]
call fcn.004049ac
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
call fcn.00404f20
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x4cad58]
mov eax, dword [eax + 0x304]
call fcn.004abff0
xor edx, edx
mov eax, dword [0x4cad58]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
call fcn.00408de0
mov edx, eax
mov eax, dword [0x4cad58]
call fcn.0043948c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
mov edx, eax
mov eax, dword [0x4cad58]
call fcn.004394bc
mov byte [ebp - 5], 1
jmp 0x4bc8ba
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov edx, 0x4bd0b0
call fcn.00404aac
jne 0x4bc82e
mov eax, dword [ebp - 0xc]
push dword [eax + 8]
push 0x4bc968
mov eax, dword [ebp - 0xc]
push dword [eax + 0xc]
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.00404a20
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x54]
call fcn.00404f20
mov edx, dword [ebp - 0x54]
mov eax, dword [0x4cad58]
mov eax, dword [eax + 0x304]
call fcn.004abff0
xor edx, edx
mov eax, dword [0x4cad58]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
call fcn.00408de0
mov edx, eax
mov eax, dword [0x4cad58]
call fcn.0043948c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
call fcn.00408de0
mov edx, eax
mov eax, dword [0x4cad58]
call fcn.004394bc
mov byte [ebp - 5], 1
jmp 0x4bc8ba
mov edx, dword [ebp - 4]
mov eax, 0x4bd0c4
call fcn.00404ca4
test eax, eax
jle 0x4bc8aa
mov byte [ebp - 5], 1
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00408930
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0xc]
mov edx, 0x4bc968
call fcn.004b4d1c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov edx, 0x4bd0d4
call fcn.00404aac
jne 0x4bc8aa
mov ecx, dword [0x4c6cd8]
mov eax, dword [0x4c6d4c]
mov eax, dword [eax]
mov edx, dword [0x4aef44]
call fcn.0043fec8
mov eax, dword [0x4c6cd8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xec]
dec eax
jne 0x4bc8a4
mov eax, dword [0x4cad58]
call fcn.0043c858
mov byte [ebp - 5], 1
jmp 0x4bc8ba
jmp 0x4bc8ba
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc917
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.004046c4
lea eax, [ebp - 0x54]
call fcn.00404dd4
lea eax, [ebp - 0x50]
call fcn.004046a0
lea eax, [ebp - 0x4c]
call fcn.00404dd4
lea eax, [ebp - 0x38]
mov edx, 0xb
call fcn.004046c4
lea eax, [ebp - 0xc]
mov edx, dword [0x476558]
call fcn.00405a60
lea eax, [ebp - 4]
call fcn.004046a0
ret