Function at 0x412ad0
Capabilities:
Access peb ldr_data
Check os version
Get process heap force flags
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x482dbc
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x4a4b70]
xor eax, esp
mov dword [esp + 0xf8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a4b70]
xor eax, esp
push eax
lea eax, [esp + 0x110]
mov dword fs:[0], eax
mov eax, dword [esp + 0x124]
mov edi, dword [esp + 0x130]
mov edx, dword [esp + 0x138]
mov ebp, dword [esp + 0x120]
mov ebx, dword [ebp + 0xd4]
mov esi, ecx
mov ecx, dword [esp + 0x134]
sub esp, 0x18
mov dword [esp + 0x30], eax
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x154]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x158]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x15c]
mov dword [eax + 0x10], edx
mov dword [esp + 0x70], esi
mov dword [ebp + 0x15c], 0
mov dword [eax + 0x14], ecx
call fcn.0042a400
mov eax, dword [esp + 0x134]
mov edx, dword [esp + 0x12c]
mov ecx, dword [esp + 0x138]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x144]
mov dword [esp + 0x54], eax
xor eax, eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x240]
lea ebx, [ebp + 0x240]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x13c]
sub eax, 0x10
mov esi, edi
mov edi, dword [esp + 0x140]
push eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], edi
call fcn.00402be0
add eax, 0x10
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, ebx
mov dword [esp + 0x118], 0
call fcn.004027b0
lea ecx, [ebp + 0x244]
call fcn.004027b0
lea ecx, [ebp + 0x248]
call fcn.004027b0
cmp dword [ebp + 0x15c], 0
je 0x412c26
mov ebx, dword [esp + 0x18]
mov ecx, dword [ebx + 8]
push ecx
call dword [sym.imp.GDI32.dll_GetBkColor]
jmp 0x412c38
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextColor]
mov ebx, dword [esp + 0x18]
push 1
mov ecx, ebx
mov dword [esp + 0x40], eax
call fcn.0043cce0
mov ecx, dword [ebp + 0x17c]
push ecx
push 2
push 0
lea ecx, [esp + 0x78]
call fcn.0043daca
lea edx, [esp + 0x6c]
push edx
mov ecx, ebx
mov byte [esp + 0x11c], 1
call fcn.0043da25
mov dword [esp + 0x64], eax
mov eax, dword [ebx + 8]
push 6
push eax
call dword [sym.imp.GDI32.dll_GetCurrentObject]
push eax
call fcn.0043d91e
mov edx, dword [eax + 4]
lea ecx, [esp + 0xac]
push ecx
push 0x5c
push edx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x58]
mov eax, dword [eax]
cmp esi, eax
jg 0x413a86
jne 0x412cb4
mov ecx, dword [esp + 0x58]
cmp edi, dword [ecx + 0x10]
jge 0x413a86
test esi, esi
mov ecx, dword [ebp + 0xd4]
jl 0x413a86
mov eax, dword [ecx + 0xc]
cmp esi, eax
jge 0x413a86
lea edx, [esi + 1]
cmp edx, eax
jne 0x412ced
cmp esi, eax
jge 0x413a6d
mov eax, esi
imul eax, eax, 0x2c
add eax, dword [ecx + 8]
cmp edi, dword [eax + 0x24]
jge 0x413a86
mov ebx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
sub esp, 0x18
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], ebx
mov dword [eax + 8], edx
mov edx, dword [esp + 0x64]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x68]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x6c]
push ecx
lea edi, [esp + 0xb0]
mov dword [eax + 0x14], edx
call fcn.0042ab40
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x74], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x78], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x80], edx
mov edx, dword [eax + 0x14]
sub esp, 0x18
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], ebx
mov ebx, dword [ebp + 0xd4]
mov dword [esp + 0x9c], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0xa0], edx
mov edx, dword [esp + 0x64]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x68]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x6c]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
call fcn.0042a8f0
test eax, eax
mov dword [esp + 0x24], eax
je 0x413a86
mov edi, eax
cmp dword [edi], 2
je 0x413a72
cmp dword [edi + 0x24], 0
mov dword [esp + 0x30], 0
jle 0x412de7
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
sub esp, 0x18
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x64]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x68]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x6c]
mov dword [eax + 0x10], edx
mov esi, ebp
mov dword [eax + 0x14], ecx
call fcn.00417fb0
mov dword [esp + 0x30], 1
jmp 0x412e24
cmp dword [edi + 0x28], 0
jle 0x412e20
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
sub esp, 0x18
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], edx
mov edx, dword [esp + 0x64]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x68]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x6c]
mov dword [eax + 0x10], ecx
mov esi, ebp
mov dword [eax + 0x14], edx
call fcn.00417fb0
jmp 0x412e24
mov eax, dword [esp + 0x3c]
mov ebx, dword [edi + 8]
lea esi, [esp + 0x68]
mov dword [esp + 0x38], eax
call fcn.00426b90
mov byte [esp + 0x118], 2
mov ecx, dword [eax]
mov esi, dword [esp + 0x1c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x412e93
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x412e85
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x412e85
push eax
call fcn.00402be0
mov edi, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x412e7c
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add edi, 0x10
mov dword [esp + 0x1c], edi
jmp 0x412e93
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.00402e60
mov byte [esp + 0x118], 1
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412ebb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [0x4a6268]
mov ecx, dword [esp + 0x24]
mov edx, dword [ebp + 0x1d4]
mov edi, dword [ecx + 8]
mov ebx, dword [0x4a6264]
xor eax, eax
test esi, esi
jle 0x412efa
mov ecx, ebx
test eax, eax
jl 0x413a6d
cmp eax, esi
jge 0x413a6d
cmp edi, dword [ecx]
je 0x412f26
add eax, 1
add ecx, 0x40
cmp eax, esi
jl 0x412edc
mov dword [esp + 0x20], edx
xor eax, eax
test esi, esi
jle 0x412f5a
mov ecx, ebx
test eax, eax
jl 0x413a6d
cmp eax, esi
jge 0x413a6d
cmp edi, dword [ecx]
je 0x412f49
add eax, 1
add ecx, 0x40
cmp eax, esi
jl 0x412f06
jmp 0x412f5a
shl eax, 6
mov ecx, dword [eax + ebx + 0x3c]
add eax, ebx
imul ecx, edx
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x20], eax
jmp 0x412efe
shl eax, 6
mov esi, dword [eax + ebx + 0x38]
add eax, ebx
test esi, esi
mov dword [esp + 0x28], esi
jne 0x412f7e
mov eax, dword [esp + 0x24]
movzx edx, word [eax + 0xe]
movzx eax, word [eax + 0xc]
test ax, ax
jbe 0x412f73
movzx eax, ax
shl eax, 0x10
add edx, eax
call fcn.00427190
mov dword [esp + 0x28], eax
mov esi, eax
xor edi, edi
cmp dword [esp + 0xb8], 0xa8c
mov dword [esp + 0x34], edi
jne 0x412f9a
mov edi, 1
mov dword [esp + 0x34], edi
cmp dword [ebp + 0x15c], 0
mov eax, dword [esp + 0x38]
je 0x4131b4
cmp eax, dword [ebp + 0x170]
mov esi, dword [esp + 0x18]
jne 0x412fc5
mov edx, dword [esi]
mov eax, dword [ebp + 0x164]
mov edx, dword [edx + 0x2c]
push eax
jmp 0x412fe1
cmp eax, dword [ebp + 0x174]
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
jne 0x412fda
mov ecx, dword [ebp + 0x168]
jmp 0x412fe0
mov ecx, dword [ebp + 0x16c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [ebp + 0x240]
xor eax, eax
xor ebx, ebx
cmp ecx, ebx
setne al
cmp eax, ebx
je 0x413b3d
mov edi, dword [esp + 0x1c]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x413028
cmp dx, bx
je 0x413024
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x413028
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x413002
xor eax, eax
jmp 0x41302d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
setne al
test al, al
jne 0x413044
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x34], eax
je 0x413199
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [ebp + 0x240]
call fcn.00402de0
mov ecx, dword [ebp + 0x244]
cmp dword [ecx - 0xc], ebx
mov esi, dword [ecx - 0x10]
lea eax, [ecx - 0x10]
je 0x4130ac
cmp dword [eax + 0xc], ebx
lea edx, [eax + 0xc]
jge 0x413084
cmp dword [ecx - 8], ebx
jl 0x413b47
mov dword [ecx - 0xc], ebx
mov edx, dword [ebp + 0x244]
mov word [edx], bx
jmp 0x4130ac
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41309a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
add eax, 0x10
mov dword [ebp + 0x244], eax
mov ecx, dword [ebp + 0x248]
cmp dword [ecx - 0xc], ebx
mov esi, dword [ecx - 0x10]
lea eax, [ecx - 0x10]
je 0x413104
cmp dword [eax + 0xc], ebx
lea edx, [eax + 0xc]
jge 0x4130dc
cmp dword [ecx - 8], ebx
jl 0x413b47
mov dword [ecx - 0xc], ebx
mov ecx, dword [ebp + 0x248]
mov word [ecx], bx
jmp 0x413104
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4130f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
add eax, 0x10
mov dword [ebp + 0x248], eax
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x230]
mov edx, dword [edx + 0x28]
push eax
call edx
mov ecx, dword [ebp + 0x22c]
call fcn.0043d97f
mov ecx, dword [ebp + 0x22c]
cmp ecx, ebx
je 0x413134
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 1
call edx
push 8
call fcn.004307fb
add esp, 4
cmp eax, ebx
je 0x41314f
mov dword [eax + 4], ebx
mov dword [eax], vtable.CFont.0
mov esi, eax
jmp 0x413151
xor esi, esi
cmp dword [esp + 0x28], ebx
push edi
push ebx
push ebx
push 0x10
push ebx
push 1
push ebx
push ebx
push ebx
mov dword [ebp + 0x22c], esi
push 0x190
je 0x41317f
mov eax, dword [esp + 0x48]
push 0xa8c
push 0xa8c
push ebx
push eax
jmp 0x413187
mov ecx, dword [esp + 0x48]
push ebx
push ebx
push ebx
push ecx
call dword [sym.imp.GDI32.dll_CreateFontW]
push eax
mov ecx, esi
call fcn.0043d92c
mov esi, dword [esp + 0x18]
mov edx, dword [esi]
mov eax, dword [ebp + 0x22c]
mov edx, dword [edx + 0x28]
push eax
mov ecx, esi
call edx
mov dword [ebp + 0x230], eax
jmp 0x41383c
cmp eax, dword [ebp + 0x170]
jne 0x4132ec
cmp dword [ebp + 0x1b8], 0
je 0x4132ec
cmp dword [esp + 0x30], 0
jne 0x4132ec
lea eax, [esp + 0x1c]
push eax
lea esi, [ebp + 0x244]
mov eax, esi
call fcn.0040caf0
add esp, 4
test al, al
jne 0x4131ff
mov ecx, dword [esp + 0x34]
cmp ecx, dword [esp + 0x28]
je 0x41362d
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.00402de0
lea ecx, [ebp + 0x248]
call fcn.004027b0
lea ecx, [ebp + 0x240]
call fcn.004027b0
mov edi, dword [esp + 0x18]
mov ecx, dword [ebp + 0x230]
mov eax, dword [edi]
mov edx, dword [eax + 0x28]
push ecx
mov ecx, edi
call edx
mov ecx, dword [ebp + 0x234]
call fcn.0043d97f
mov ecx, dword [ebp + 0x234]
test ecx, ecx
je 0x413253
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 1
call edx
push 8
call fcn.004307fb
add esp, 4
test eax, eax
je 0x413272
mov dword [eax + 4], 0
mov dword [eax], vtable.CFont.0
mov esi, eax
jmp 0x413274
xor esi, esi
cmp dword [esp + 0x28], 0
mov dword [ebp + 0x234], esi
je 0x4132ae
mov eax, dword [esp + 0x1c]
push eax
push 0
mov ecx, dword [esp + 0x28]
push 0
push 0x10
push 0
push 1
push 0
push 1
push 0
push 0x190
push 0xa8c
push 0xa8c
push 0
push ecx
jmp 0x4132d3
mov edx, dword [esp + 0x1c]
push edx
push 0
mov eax, dword [esp + 0x28]
push 0
push 0x10
push 0
push 1
push 0
push 1
push 0
push 0x190
push 0
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_CreateFontW]
push eax
mov ecx, esi
call fcn.0043d92c
mov eax, dword [ebp + 0x234]
jmp 0x41361d
cmp eax, dword [ebp + 0x174]
jne 0x413451
cmp dword [esp + 0x30], 0
je 0x413451
mov ecx, dword [ebp + 0x248]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x413b3d
mov eax, dword [esp + 0x1c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x413346
test dx, dx
je 0x413342
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x413346
add eax, 4
add ecx, 4
test dx, dx
jne 0x413320
xor eax, eax
jmp 0x41334b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
jne 0x41335c
cmp edi, esi
je 0x41362d
lea eax, [esp + 0x1c]
push eax
lea ecx, [ebp + 0x248]
call fcn.00402de0
lea ecx, [ebp + 0x244]
call fcn.004027b0
lea ecx, [ebp + 0x240]
call fcn.004027b0
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x230]
mov edx, dword [edx + 0x28]
push eax
call edx
mov ecx, dword [ebp + 0x238]
call fcn.0043d97f
mov ecx, dword [ebp + 0x238]
test ecx, ecx
je 0x4133b2
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 1
call edx
push 8
call fcn.004307fb
add esp, 4
test eax, eax
je 0x4133d1
mov dword [eax + 4], 0
mov dword [eax], vtable.CFont.0
mov esi, eax
jmp 0x4133d3
xor esi, esi
cmp dword [esp + 0x28], 0
mov dword [ebp + 0x238], esi
je 0x41340d
mov eax, dword [esp + 0x1c]
push eax
push 0
mov ecx, dword [esp + 0x28]
push 0
push 0x10
push 0
push 1
push 1
push 0
push 0
push 0x190
push 0xa8c
push 0xa8c
push 0
push ecx
jmp 0x413432
mov edx, dword [esp + 0x1c]
push edx
push 0
mov eax, dword [esp + 0x28]
push 0
push 0x10
push 0
push 1
push 1
push 0
push 0
push 0x190
push 0
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_CreateFontW]
push eax
mov ecx, esi
call fcn.0043d92c
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x238]
jmp 0x413621
mov ecx, dword [ebp + 0x240]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x413b3d
mov eax, dword [esp + 0x1c]
xor ebx, ebx
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x413496
cmp dx, bx
je 0x413492
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x413496
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x413470
xor eax, eax
jmp 0x41349b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
setne al
test al, al
jne 0x4134ac
cmp edi, esi
je 0x41362d
lea eax, [esp + 0x1c]
push eax
lea ecx, [ebp + 0x240]
call fcn.00402de0
mov ecx, dword [ebp + 0x248]
cmp dword [ecx - 0xc], ebx
mov esi, dword [ecx - 0x10]
lea eax, [ecx - 0x10]
je 0x413514
cmp dword [eax + 0xc], ebx
lea edx, [eax + 0xc]
jge 0x4134ec
cmp dword [ecx - 8], ebx
jl 0x413b47
mov dword [ecx - 0xc], ebx
mov ecx, dword [ebp + 0x248]
mov word [ecx], bx
jmp 0x413514
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x413502
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
add eax, 0x10
mov dword [ebp + 0x248], eax
mov ecx, dword [ebp + 0x244]
cmp dword [ecx - 0xc], ebx
mov esi, dword [ecx - 0x10]
lea eax, [ecx - 0x10]
je 0x41356c
cmp dword [eax + 0xc], ebx
lea edx, [eax + 0xc]
jge 0x413544
cmp dword [ecx - 8], ebx
jl 0x413b47
mov dword [ecx - 0xc], ebx
mov ecx, dword [ebp + 0x244]
mov word [ecx], bx
jmp 0x41356c
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41355a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
add eax, 0x10
mov dword [ebp + 0x244], eax
mov edi, dword [esp + 0x18]
mov edx, dword [edi]
mov eax, dword [ebp + 0x230]
mov edx, dword [edx + 0x28]
push eax
mov ecx, edi
call edx
mov ecx, dword [ebp + 0x22c]
call fcn.0043d97f
mov ecx, dword [ebp + 0x22c]
cmp ecx, ebx
je 0x41359e
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 1
call edx
push 8
call fcn.004307fb
add esp, 4
cmp eax, ebx
je 0x4135b9
mov dword [eax + 4], ebx
mov dword [eax], vtable.CFont.0
mov esi, eax
jmp 0x4135bb
xor esi, esi
cmp dword [esp + 0x28], ebx
mov dword [ebp + 0x22c], esi
je 0x4135ed
mov eax, dword [esp + 0x1c]
push eax
push ebx
mov ecx, dword [esp + 0x28]
push ebx
push 0x10
push ebx
push 1
push ebx
push ebx
push ebx
push 0x190
push 0xa8c
push 0xa8c
push ebx
push ecx
jmp 0x413609
mov edx, dword [esp + 0x1c]
push edx
push ebx
mov eax, dword [esp + 0x28]
push ebx
push 0x10
push ebx
push 1
push ebx
push ebx
push ebx
push 0x190
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.GDI32.dll_CreateFontW]
push eax
mov ecx, esi
call fcn.0043d92c
mov eax, dword [ebp + 0x22c]
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0x28]
push eax
call edx
mov dword [ebp + 0x230], eax
cmp dword [ebp + 0x150], 0
jne 0x4137df
mov eax, dword [ebp + 0x268]
cmp eax, 4
je 0x4137df
cmp eax, 5
je 0x4137df
mov eax, dword [ebp + 0x260]
mov ecx, dword [ebp + 0x25c]
lea esi, [eax + 1]
cmp ecx, esi
jne 0x413667
mov ecx, eax
mov ebx, dword [esp + 0x24]
mov edx, dword [ebx + 0x24]
test edx, edx
jg 0x41368e
cmp dword [ebx + 0x28], 0
jg 0x41368a
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
mov edx, dword [eax + 0x30]
push 0
call edx
jmp 0x413840
test edx, edx
jle 0x41369d
mov eax, edx
sub ecx, eax
jns 0x4136ab
cmp edx, esi
je 0x4136a8
mov eax, dword [ebx + 0x28]
jmp 0x4136ab
mov eax, dword [ebx + 0x28]
sub ecx, eax
jns 0x4136ab
cmp eax, esi
jne 0x4136ab
sub eax, 1
add eax, 0xffffffff
cmp eax, 0xb
ja case.default.0x4136b7
jmp dword [eax*4 + 0x413b54]
mov eax, dword [ebp + 0x184]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
jmp 0x413840
mov eax, dword [ebp + 0x188]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
jmp 0x413840
mov eax, dword [ebp + 0x18c]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
jmp 0x413840
mov eax, dword [ebp + 0x190]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
jmp 0x413840
mov eax, dword [ebp + 0x194]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
jmp 0x413840
mov eax, dword [ebp + 0x198]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
jmp 0x413840
mov eax, dword [ebp + 0x19c]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
jmp 0x413840
mov eax, dword [ebp + 0x1a0]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
jmp 0x413840
mov eax, dword [ebp + 0x1a4]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
jmp 0x413840
mov eax, dword [ebp + 0x1a8]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
jmp 0x413840
mov eax, dword [ebp + 0x1ac]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
jmp 0x413840
mov eax, dword [ebp + 0x1b0]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
jmp 0x413840
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
xor eax, eax
push eax
mov eax, dword [edx + 0x30]
call eax
jmp 0x413840
cmp dword [ebp + 0x15c], 0
jne 0x41383c
mov eax, dword [ebp + 0x170]
mov ecx, dword [esp + 0x38]
cmp ecx, eax
jne 0x41380b
cmp dword [esp + 0x30], 0
jne 0x41380b
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
jmp 0x41383c
mov eax, dword [ebp + 0x174]
cmp ecx, eax
jne 0x41382a
cmp dword [esp + 0x30], 0
je 0x41382a
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x30]
call eax
jmp 0x41383c
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x178]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ebx, dword [esp + 0x24]
cmp word [ebx + 0x10], 0
jbe 0x4139e1
call fcn.00440a5b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x413b3d
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x34], esi
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x118], 3
movzx edx, word [ecx + 0x10]
mov edi, dword [esi - 0xc]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
lea ebx, [edi + 1]
sub eax, ebx
or eax, ecx
mov dword [esp + 0x30], edx
jge 0x4138a8
push ebx
lea ecx, [esp + 0x38]
call fcn.00402ab0
mov esi, dword [esp + 0x34]
test ebx, ebx
mov ax, word [esp + 0x30]
mov word [esi + edi*2], ax
jl 0x413b47
cmp ebx, dword [esi - 8]
jg 0x413b47
cmp dword [esp + 0x28], 0
mov ecx, dword [esp + 0x18]
push 0
push 1
push esi
mov dword [esi - 0xc], ebx
push 0
mov word [esi + ebx*2], 0
mov ebx, dword [esp + 0x3c]
push 0x10
push ebx
je 0x41391b
mov eax, dword [ecx]
mov edi, dword [esp + 0x38]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x1d4]
sub eax, edi
lea edx, [eax + eax*2]
mov eax, 0x66666667
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, edi
mov edi, dword [esp + 0x140]
add eax, edi
push eax
mov eax, dword [esp + 0x48]
jmp 0x413944
mov eax, dword [ebp + 0x1d4]
sub eax, dword [esp + 0x38]
mov edi, dword [esp + 0x140]
lea edx, [eax + eax*2]
mov eax, 0x66666667
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, edi
push eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x60]
call edx
mov eax, dword [esp + 0x24]
cmp byte [eax + 0x2c], 0
je 0x4139bb
mov eax, dword [ebp + 0x1e0]
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp + 0x208]
lea ecx, [ebx - 1]
push ecx
mov ecx, dword [esp + 0x1c]
add eax, edi
push eax
lea edx, [esp + 0x94]
push edx
call fcn.0043d36e
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 4]
imul ecx, dword [esp + 0x20]
mov eax, 0x51eb851f
imul ecx
mov eax, dword [ebp + 0x1e0]
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ecx + ebx + 1]
mov ecx, dword [esp + 0x18]
push edx
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp + 0x208]
add eax, edi
push eax
call fcn.0043ce89
add esi, 0xfffffff0
mov byte [esp + 0x118], 1
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4139e5
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
jmp 0x4139e5
mov ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov ecx, dword [ecx + 4]
imul ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebx, eax
cmp dword [ebp + 0x15c], 0
mov dword [esp + 0x2c], ebx
je 0x413a21
mov edx, dword [esi]
mov eax, dword [esp + 0x3c]
mov edx, dword [edx + 0x2c]
push eax
jmp 0x413a2b
mov eax, dword [esi]
mov ecx, dword [esp + 0x3c]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x80]
mov edi, dword [esp + 0x84]
mov esi, dword [esp + 0x74]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], eax
jmp 0x412c71
call fcn.0043cb4a
xor ecx, ecx
cmp dword [edi + 0x24], ecx
mov dword [esp + 0x5c], 1
setg cl
mov dword [esp + 0x60], ecx
mov edx, dword [esp + 0x64]
mov edi, dword [esp + 0x18]
push edx
mov ecx, edi
call fcn.0043da25
cmp dword [esp + 0x5c], 0
je 0x413acb
cmp dword [ebp + 0x158], 0
je 0x413acb
cmp dword [ebp + 0x21c], 0
jne 0x413acb
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x128]
push eax
add ecx, 2
push ecx
push edx
mov ecx, ebp
call fcn.00419b40
mov byte [esp + 0x118], 0
lea ecx, [esp + 0x6c]
mov dword [esp + 0x6c], vtable.CPen.0
call fcn.00403060
mov dword [esp + 0x118], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413b0f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xf8]
xor ecx, esp
call fcn.00467f41
add esp, 0x108
ret 0x28
push 0x80004005
call fcn.00402a60
push 0x80070057
call fcn.00402a60
lea ecx, [ecx]
mov esi, 0xd5004136
inc ecx
add ah, ch
inc ecx
add byte [ebx], al
aaa
inc ecx
add byte [edx], bl
aaa
inc ecx
add byte [ecx], dh
aaa
inc ecx
add byte [eax + 0x37], cl
inc ecx
add byte [edi + 0x37], bl
inc ecx
add byte [esi + 0x37], dh
inc ecx
add byte [ebp - 0x5bffbec9], cl
aaa
inc ecx
add byte [ebx - 0x33ffbec9], bh
int3