Function at 0x40dad4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x40
push 0
push 0
dec ecx
jne 0x40dadc
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x40f7c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x54]
call fcn.00405b7c
mov eax, dword [ebx + 0x3c]
call fcn.00405b7c
mov eax, dword [ebx + 0xdc]
call fcn.00409a08
mov eax, dword [ebx + 0xe4]
call fcn.00409a08
mov eax, dword [ebx + 0xe8]
call fcn.00409a08
mov eax, dword [ebx + 0xec]
call fcn.00409a08
mov eax, dword [ebx + 0xe0]
call fcn.00409a08
mov eax, dword [ebx + 0xf0]
call fcn.00409a08
mov eax, dword [ebx + 0xf4]
call fcn.00409a08
mov eax, dword [ebx + 0xf8]
call fcn.00409a08
mov eax, dword [ebx + 0xfc]
call fcn.00409a08
mov eax, dword [ebx + 0x100]
call fcn.00409a08
lea eax, [ebp - 4]
call fcn.00402ff8
lea eax, [ebp - 8]
call fcn.00402ff8
lea eax, [ebp - 0xc]
call fcn.00402ff8
lea eax, [ebp - 0x10]
call fcn.00402ff8
mov eax, ebx
mov edx, 0x40f7e0
call fcn.0040d6dc
mov edx, eax
mov eax, dword [ebx + 0x70]
call fcn.00409448
mov eax, ebx
mov edx, 0x40f7f8
call fcn.0040d6dc
mov edx, eax
mov eax, dword [ebx + 0x6c]
call fcn.00409448
mov eax, dword [ebx + 0x6c]
call fcn.00409428
test al, al
jne 0x40dbf0
mov eax, dword [ebx + 0x70]
call fcn.00409428
test al, al
jne 0x40dbf0
mov eax, dword [ebx + 0x70]
mov dl, 1
call fcn.00409448
mov eax, dword [ebx + 0xd4]
xor edx, edx
call fcn.00409448
mov eax, dword [ebx + 0xd4]
call fcn.00409428
mov edx, eax
mov eax, dword [ebx + 0x6c]
call fcn.00408604
mov eax, dword [ebx + 0xd4]
call fcn.00409428
mov edx, eax
mov eax, dword [ebx + 0x70]
call fcn.00408604
mov eax, dword [ebx + 0x6c]
call fcn.00409428
test al, al
je 0x40dc51
mov eax, dword [ebx + 0x70]
call fcn.00409428
test al, al
je 0x40dc51
mov eax, dword [ebx + 0x6c]
mov dl, 1
call fcn.00409448
mov eax, dword [ebx + 0x6c]
call fcn.00409428
mov edx, eax
xor dl, 1
mov eax, dword [ebx + 0x70]
call fcn.00409448
mov esi, 1
mov ax, word [0x40f804]
call fcn.0040682c
test al, al
jne 0x40de83
mov ax, word [0x40f808]
call fcn.0040682c
test al, al
jne 0x40de83
mov ax, word [0x40f80c]
call fcn.0040682c
test al, al
jne 0x40de83
mov ax, word [0x40f810]
call fcn.0040682c
test al, al
jne 0x40de83
mov ax, word [0x40f814]
call fcn.0040682c
test al, al
je 0x40deae
jmp 0x40de83
lea edx, [ebp - 0x3c]
mov eax, esi
call fcn.00407734
mov eax, dword [ebp - 0x3c]
push eax
mov edx, 0x40f820
mov eax, 0x80000001
call fcn.004046d0
lea ecx, [ebp - 4]
pop edx
call fcn.00404800
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.00407820
mov edx, dword [ebp - 0x40]
mov eax, dword [ebx + 0xdc]
call fcn.004099f8
mov eax, dword [ebx + 0x100]
xor edx, edx
call fcn.004099f8
lea eax, [ebp - 0x44]
mov ecx, dword [ebp - 4]
mov edx, 0x40f840
call fcn.004031c8
mov edx, dword [ebp - 0x44]
mov eax, 0x80000002
call fcn.004046d0
lea ecx, [ebp - 8]
mov edx, 0x40f87c
call fcn.00404800
cmp dword [ebp - 8], 0
je 0x40dd85
lea eax, [ebp - 0x48]
call fcn.00404658
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 8]
call fcn.00403184
mov eax, dword [ebp - 0x48]
call fcn.00407958
test al, al
je 0x40dd85
lea eax, [ebp - 0x50]
call fcn.00404658
lea eax, [ebp - 0x50]
mov edx, dword [ebp - 8]
call fcn.00403184
mov edx, dword [ebp - 0x50]
lea ecx, [ebp - 0x4c]
mov eax, ebx
call fcn.00413d84
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebx + 0xf8]
call fcn.004099f8
jmp 0x40ddbd
lea eax, [ebp - 0x58]
mov ecx, dword [ebp - 4]
mov edx, 0x40f840
call fcn.004031c8
mov edx, dword [ebp - 0x58]
mov eax, 0x80000002
call fcn.004046d0
lea ecx, [ebp - 0x54]
mov edx, 0x40f890
call fcn.00404800
mov edx, dword [ebp - 0x54]
mov eax, dword [ebx + 0xf8]
call fcn.004099f8
lea eax, [ebp - 0x5c]
mov ecx, dword [ebp - 4]
mov edx, 0x40f840
call fcn.004031c8
mov edx, dword [ebp - 0x5c]
mov eax, 0x80000002
call fcn.004046d0
lea ecx, [ebp - 8]
mov edx, 0x40f8a4
call fcn.00404800
cmp dword [ebp - 8], 0
je 0x40de0a
lea ecx, [ebp - 0x60]
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0041403c
mov edx, dword [ebp - 0x60]
mov eax, dword [ebx + 0xfc]
call fcn.004099f8
jmp 0x40de2c
lea ecx, [ebp - 0x64]
mov edi, dword [ebx + 0xf8]
mov edx, dword [edi + 0x1c]
dec edx
mov eax, edi
call fcn.00409a64
mov edx, dword [ebp - 0x64]
mov eax, dword [ebx + 0xfc]
call fcn.004099f8
mov eax, dword [ebx + 0x70]
call fcn.00409428
test al, al
je 0x40de57
lea ecx, [ebp - 0x68]
mov edi, dword [ebx + 0xf8]
mov edx, dword [edi + 0x1c]
dec edx
mov eax, edi
call fcn.00409a64
mov edx, dword [ebp - 0x68]
mov eax, dword [ebx + 0x54]
call fcn.004068cc
mov eax, dword [ebx + 0x6c]
call fcn.00409428
test al, al
je 0x40de82
lea ecx, [ebp - 0x6c]
mov edi, dword [ebx + 0xfc]
mov edx, dword [edi + 0x1c]
dec edx
mov eax, edi
call fcn.00409a64
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebx + 0x54]
call fcn.004068cc
inc esi
lea edx, [ebp - 0x70]
mov eax, esi
call fcn.00407734
mov eax, dword [ebp - 0x70]
push eax
mov edx, 0x40f820
mov eax, 0x80000001
call fcn.004046d0
pop edx
call fcn.00404950
test al, al
jne 0x40dcba
mov ax, word [0x40f8b8]
call fcn.0040682c
test al, al
jne 0x40dedf
mov ax, word [0x40f8bc]
call fcn.0040682c
test al, al
jne 0x40dedf
mov ax, word [0x40f8c0]
call fcn.0040682c
test al, al
je 0x40e142
mov eax, dword [ebx + 0x9c]
xor edx, edx
call fcn.00408604
jmp 0x40e107
lea edx, [ebp - 0x78]
mov eax, esi
call fcn.00407734
mov ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x74]
mov edx, 0x40f8cc
call fcn.004031c8
mov edx, dword [ebp - 0x74]
mov eax, 0x80000001
call fcn.004046d0
lea ecx, [ebp - 4]
xor edx, edx
call fcn.00404800
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 4]
call fcn.00407820
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebx + 0xdc]
call fcn.004099f8
mov eax, dword [ebx + 0x100]
xor edx, edx
call fcn.004099f8
lea eax, [ebp - 0x80]
mov ecx, dword [ebp - 4]
mov edx, 0x40f840
call fcn.004031c8
mov edx, dword [ebp - 0x80]
mov eax, 0x80000002
call fcn.004046d0
lea ecx, [ebp - 8]
mov edx, 0x40f87c
call fcn.00404800
cmp dword [ebp - 8], 0
je 0x40dfdf
lea eax, [ebp - 0x84]
call fcn.00404658
lea eax, [ebp - 0x84]
mov edx, dword [ebp - 8]
call fcn.00403184
mov eax, dword [ebp - 0x84]
call fcn.00407958
test al, al
je 0x40dfdf
lea eax, [ebp - 0x8c]
call fcn.00404658
lea eax, [ebp - 0x8c]
mov edx, dword [ebp - 8]
call fcn.00403184
mov edx, dword [ebp - 0x8c]
lea ecx, [ebp - 0x88]
mov eax, ebx
call fcn.00413d84
mov edx, dword [ebp - 0x88]
mov eax, dword [ebx + 0xf8]
call fcn.004099f8
jmp 0x40e023
lea eax, [ebp - 0x94]
mov ecx, dword [ebp - 4]
mov edx, 0x40f840
call fcn.004031c8
mov edx, dword [ebp - 0x94]
mov eax, 0x80000002
call fcn.004046d0
lea ecx, [ebp - 0x90]
mov edx, 0x40f890
call fcn.00404800
mov edx, dword [ebp - 0x90]
mov eax, dword [ebx + 0xf8]
call fcn.004099f8
lea eax, [ebp - 0x98]
mov ecx, dword [ebp - 4]
mov edx, 0x40f840
call fcn.004031c8
mov edx, dword [ebp - 0x98]
mov eax, 0x80000002
call fcn.004046d0
lea ecx, [ebp - 8]
mov edx, 0x40f8a4
call fcn.00404800
cmp dword [ebp - 8], 0
je 0x40e07c
lea ecx, [ebp - 0x9c]
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0041403c
mov edx, dword [ebp - 0x9c]
mov eax, dword [ebx + 0xfc]
call fcn.004099f8
jmp 0x40e0a4
lea ecx, [ebp - 0xa0]
mov edi, dword [ebx + 0xf8]
mov edx, dword [edi + 0x1c]
dec edx
mov eax, edi
call fcn.00409a64
mov edx, dword [ebp - 0xa0]
mov eax, dword [ebx + 0xfc]
call fcn.004099f8
mov eax, dword [ebx + 0x70]
call fcn.00409428
test al, al
je 0x40e0d5
lea ecx, [ebp - 0xa4]
mov edi, dword [ebx + 0xf8]
mov edx, dword [edi + 0x1c]
dec edx
mov eax, edi
call fcn.00409a64
mov edx, dword [ebp - 0xa4]
mov eax, dword [ebx + 0x54]
call fcn.004068cc
mov eax, dword [ebx + 0x6c]
call fcn.00409428
test al, al
je 0x40e106
lea ecx, [ebp - 0xa8]
mov edi, dword [ebx + 0xfc]
mov edx, dword [edi + 0x1c]
dec edx
mov eax, edi
call fcn.00409a64
mov edx, dword [ebp - 0xa8]
mov eax, dword [ebx + 0x54]
call fcn.004068cc
inc esi
lea edx, [ebp - 0xb0]
mov eax, esi
call fcn.00407734
mov ecx, dword [ebp - 0xb0]
lea eax, [ebp - 0xac]
mov edx, 0x40f8cc
call fcn.004031c8
mov edx, dword [ebp - 0xac]
mov eax, 0x80000001
call fcn.00404930
test al, al
jne 0x40def1
xor esi, esi
jmp 0x40e17c
lea eax, [ebp - 0xb4]
push eax
mov eax, dword [ebx + 0x54]
xor ecx, ecx
mov edx, esi
call fcn.00405a08
cmp dword [ebp - 0xb4], 0
jne 0x40e17b
mov eax, dword [ebx + 0xdc]
mov edx, esi
call fcn.00409a38
mov eax, dword [ebx + 0x54]
mov edx, esi
call fcn.00405ae0
jmp 0x40e17c
inc esi
mov eax, dword [ebx + 0xdc]
cmp esi, dword [eax + 0x1c]
jl 0x40e146
mov eax, dword [ebx + 0xdc]
mov eax, dword [eax + 0x1c]
mov dword [ebx + 0x108], eax
xor esi, esi
lea ecx, [ebp - 0xbc]
lea edi, [esi + 0x100]
mov eax, edi
mov edx, 3
call fcn.004076c8
mov ecx, dword [ebp - 0xbc]
lea eax, [ebp - 0xb8]
mov edx, 0x40f8f0
call fcn.004031c8
mov edx, dword [ebp - 0xb8]
mov eax, 0x80000001
call fcn.00404930
test al, al
je 0x40e3e4
push 8
lea ecx, [ebp - 0xc4]
mov eax, edi
mov edx, 3
call fcn.004076c8
mov ecx, dword [ebp - 0xc4]
lea eax, [ebp - 0xc0]
mov edx, 0x40f8f0
call fcn.004031c8
mov edx, dword [ebp - 0xc0]
mov eax, 0x80000001
call fcn.004046d0
lea ecx, [ebp - 0x18]
mov edx, 0x40f924
call fcn.00404988
lea ecx, [ebp - 8]
mov edx, 8
mov eax, dword [ebp - 0x18]
call fcn.004076c8
lea eax, [ebp - 0xc8]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004033d4
mov eax, dword [ebp - 0xc8]
push eax
lea eax, [ebp - 0xcc]
push eax
mov ecx, 8
mov edx, 5
mov eax, dword [ebp - 8]
call fcn.004033d4
mov edx, dword [ebp - 0xcc]
pop eax
call fcn.004032c8
jne 0x40e2a8
lea eax, [ebp - 0xd0]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004033d4
mov ecx, dword [ebp - 0xd0]
lea eax, [ebp - 8]
mov edx, 0x40f938
call fcn.004031c8
mov byte [ebp - 0x31], 0
mov eax, dword [ebx + 0xdc]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40e2f0
inc edi
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0xd4]
mov eax, dword [ebx + 0xdc]
mov edx, dword [ebp - 0x14]
call fcn.00409a64
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 8]
call fcn.004032c8
jne 0x40e2ea
mov byte [ebp - 0x31], 1
inc dword [ebp - 0x14]
dec edi
jne 0x40e2c2
cmp byte [ebp - 0x31], 0
je 0x40e3e4
mov eax, dword [ebx + 0xe8]
mov edx, dword [ebp - 8]
call fcn.004099f8
push 8
lea ecx, [ebp - 0xdc]
lea edi, [esi + 0x100]
mov eax, edi
mov edx, 3
call fcn.004076c8
mov ecx, dword [ebp - 0xdc]
lea eax, [ebp - 0xd8]
mov edx, 0x40f8f0
call fcn.004031c8
mov edx, dword [ebp - 0xd8]
mov eax, 0x80000001
call fcn.004046d0
lea ecx, [ebp - 0x18]
mov edx, 0x40f948
call fcn.00404988
lea ecx, [ebp - 0xe0]
mov edx, 8
mov eax, dword [ebp - 0x18]
call fcn.004076c8
mov edx, dword [ebp - 0xe0]
mov eax, dword [ebx + 0xe4]
call fcn.004099f8
push 8
lea ecx, [ebp - 0xe8]
mov eax, edi
mov edx, 3
call fcn.004076c8
mov ecx, dword [ebp - 0xe8]
lea eax, [ebp - 0xe4]
mov edx, 0x40f8f0
call fcn.004031c8
mov edx, dword [ebp - 0xe4]
mov eax, 0x80000001
call fcn.004046d0
lea ecx, [ebp - 0x18]
mov edx, 0x40f960
call fcn.00404988
lea ecx, [ebp - 0xec]
mov edx, 8
mov eax, dword [ebp - 0x18]
call fcn.004076c8
mov edx, dword [ebp - 0xec]
mov eax, dword [ebx + 0xec]
call fcn.004099f8
inc esi
cmp esi, 0x64
jne 0x40e198
mov eax, dword [ebx + 0xe4]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40e4cb
inc edi
xor esi, esi
mov eax, dword [ebx + 0xdc]
mov eax, dword [eax + 0x1c]
dec eax
test eax, eax
jl 0x40e4c3
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0xf0]
mov eax, dword [ebx + 0xdc]
mov edx, dword [ebp - 0x14]
call fcn.00409a64
mov eax, dword [ebp - 0xf0]
push eax
lea ecx, [ebp - 0xf4]
mov eax, dword [ebx + 0xe8]
mov edx, esi
call fcn.00409a64
mov edx, dword [ebp - 0xf4]
pop eax
call fcn.004032c8
jne 0x40e4b7
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0xfc]
mov eax, dword [ebx + 0xec]
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0xfc]
push eax
lea ecx, [ebp - 0x100]
mov eax, dword [ebx + 0xe4]
mov edx, esi
call fcn.00409a64
mov edx, dword [ebp - 0x100]
mov eax, ebx
pop ecx
call fcn.00411ec4
mov eax, dword [ebp - 0xf8]
push eax
mov eax, dword [ebx + 0x54]
mov ecx, 1
mov edx, dword [ebp - 0x14]
call fcn.00405a78
jmp 0x40e4c3
inc dword [ebp - 0x14]
dec dword [ebp - 0x38]
jne 0x40e420
inc esi
dec edi
jne 0x40e403
mov esi, dword [ebx + 0x104]
cmp esi, 0x804
jne 0x40e4e6
lea eax, [ebp - 4]
mov edx, 0x40f974
call fcn.00403090
cmp esi, 0x404
jne 0x40e4fb
lea eax, [ebp - 4]
mov edx, 0x40f980
call fcn.00403090
cmp esi, 0x412
jne 0x40e510
lea eax, [ebp - 4]
mov edx, 0x40f98c
call fcn.00403090
mov esi, 1
lea edi, [ebx + 0x468]
push 0x40f998
push dword [ebp - 4]
lea edx, [ebp - 0x108]
mov eax, esi
dec eax
call fcn.00407734
push dword [ebp - 0x108]
lea eax, [ebp - 0x104]
mov edx, 3
call fcn.0040323c
mov edx, dword [ebp - 0x104]
mov eax, 0x80000001
call fcn.00404930
test al, al
je 0x40e638
push 8
push 0x40f998
push dword [ebp - 4]
lea edx, [ebp - 0x110]
mov eax, esi
dec eax
call fcn.00407734
push dword [ebp - 0x110]
lea eax, [ebp - 0x10c]
mov edx, 3
call fcn.0040323c
mov edx, dword [ebp - 0x10c]
mov eax, 0x80000001
call fcn.004046d0
lea ecx, [ebp - 0x18]
mov edx, 0x40f948
call fcn.00404988
lea ecx, [ebp - 0x114]
mov edx, 8
mov eax, dword [ebp - 0x18]
call fcn.004076c8
mov edx, dword [ebp - 0x114]
mov eax, edi
call fcn.0040304c
push 8
push 0x40f998
push dword [ebp - 4]
lea edx, [ebp - 0x11c]
mov eax, esi
dec eax
call fcn.00407734
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.0040323c
mov edx, dword [ebp - 0x118]
mov eax, 0x80000001
call fcn.004046d0
lea ecx, [ebp - 0x18]
mov edx, 0x40f960
call fcn.00404988
lea ecx, [ebp - 0x120]
mov edx, 8
mov eax, dword [ebp - 0x18]
call fcn.004076c8
mov edx, dword [ebp - 0x120]
lea eax, [edi + 4]
call fcn.0040304c
jmp 0x40e647
mov eax, edi
call fcn.00402ff8
lea eax, [edi + 4]
call fcn.00402ff8
inc esi
add edi, 8
cmp esi, 4
jne 0x40e51b
cmp dword [ebx + 0x104], 0x411
jne 0x40e735
mov eax, dword [ebx + 0x8c]
mov edx, 1
call fcn.00409680
mov eax, dword [ebx + 0x8c]
mov edx, 2
call fcn.00409680
lea eax, [ebx + 0x468]
call fcn.00402ff8
lea eax, [ebx + 0x46c]
call fcn.00402ff8
mov edx, 0x40f9cc
mov eax, 0x80000001
call fcn.00404930
test al, al
je 0x40e735
push 8
mov edx, 0x40f9cc
mov eax, 0x80000001
call fcn.004046d0
lea ecx, [ebp - 0x18]
mov edx, 0x40f948
call fcn.00404988
lea ecx, [ebp - 0x124]
mov edx, 8
mov eax, dword [ebp - 0x18]
call fcn.004076c8
mov edx, dword [ebp - 0x124]
lea eax, [ebx + 0x468]
call fcn.0040304c
push 8
mov edx, 0x40f9cc
mov eax, 0x80000001
call fcn.004046d0
lea ecx, [ebp - 0x18]
mov edx, 0x40f960
call fcn.00404988
lea ecx, [ebp - 0x128]
mov edx, 8
mov eax, dword [ebp - 0x18]
call fcn.004076c8
mov edx, dword [ebp - 0x128]
lea eax, [ebx + 0x46c]
call fcn.0040304c
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebx + 0x46c]
mov edx, dword [ebx + 0x468]
mov eax, ebx
call fcn.00411ec4
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebx + 0x90]
call fcn.00408c98
mov eax, dword [ebx + 0x54]
call fcn.00406d8c
test eax, eax
jne 0x40e778
mov eax, dword [ebx + 0x40]
xor edx, edx
call fcn.00408604
jmp 0x40e782
mov eax, dword [ebx + 0x40]
mov dl, 1
call fcn.00408604
mov eax, dword [ebx + 0x54]
call fcn.00406d8c
mov esi, eax
mov eax, dword [ebx + 0x54]
call fcn.004095dc
dec eax
cmp esi, eax
jne 0x40e7a5
mov eax, dword [ebx + 0x44]
xor edx, edx
call fcn.00408604
jmp 0x40e7af
mov eax, dword [ebx + 0x44]
mov dl, 1
call fcn.00408604
call fcn.00405418
mov dword [ebp - 0x1c], eax
call fcn.00405418
mov dword [ebp - 0x20], eax
call fcn.00405418
mov dword [ebp - 0x24], eax
call fcn.00405418
mov dword [ebp - 0x28], eax
call fcn.00405418
mov dword [ebp - 0x2c], eax
call fcn.00405418
mov dword [ebp - 0x30], eax
mov edx, 0x40fa04
mov eax, 0x80000002
call fcn.00404930
test al, al
jne 0x40e8e9
mov ax, word [0x40f804]
call fcn.0040682c
test al, al
jne 0x40e845
mov ax, word [0x40f808]
call fcn.0040682c
test al, al
jne 0x40e845
mov ax, word [0x40f80c]
call fcn.0040682c
test al, al
jne 0x40e845
mov ax, word [0x40f810]
call fcn.0040682c
test al, al
jne 0x40e845
mov ax, word [0x40f814]
call fcn.0040682c
test al, al
je 0x40e8e9
mov edx, 0x40fa04
mov eax, 0x80000002
call fcn.00404730
mov ecx, 0x40fa48
mov edx, 0x40fa5c
call fcn.0040489c
cmp dword [ebx + 0x104], 0x804
jne 0x40e88d
mov edx, 0x40fa04
mov eax, 0x80000002
call fcn.00404730
mov ecx, 0x40fa70
mov edx, 0x40f890
call fcn.0040489c
cmp dword [ebx + 0x104], 0x404
jne 0x40e8b7
mov edx, 0x40fa04
mov eax, 0x80000002
call fcn.00404730
mov ecx, 0x40fa84
mov edx, 0x40f890
call fcn.0040489c
mov eax, dword [ebx + 0x104]
cmp eax, 0x404
je 0x40e8e9
cmp eax, 0x804
je 0x40e8e9
mov edx, 0x40fa04
mov eax, 0x80000002
call fcn.00404730
mov ecx, 0x40fa98
mov edx, 0x40f890
call fcn.0040489c
cmp dword [ebx + 0x104], 0x404
jne 0x40ea03
mov edx, 0x40faa4
mov eax, 0x80000002
call fcn.00404930
test al, al
jne 0x40ea03
mov ax, word [0x40f804]
call fcn.0040682c
test al, al
jne 0x40e95f
mov ax, word [0x40f808]
call fcn.0040682c
test al, al
jne 0x40e95f
mov ax, word [0x40f80c]
call fcn.0040682c
test al, al
jne 0x40e95f
mov ax, word [0x40f810]
call fcn.0040682c
test al, al
jne 0x40e95f
mov ax, word [0x40f814]
call fcn.0040682c
test al, al
je 0x40ea03
mov edx, 0x40faa4
mov eax, 0x80000002
call fcn.00404730
mov ecx, 0x40fa48
mov edx, 0x40fa5c
call fcn.0040489c
cmp dword [ebx + 0x104], 0x804
jne 0x40e9a7
mov edx, 0x40faa4
mov eax, 0x80000002
call fcn.00404730
mov ecx, 0x40fae8
mov edx, 0x40f890
call fcn.0040489c
cmp dword [ebx + 0x104], 0x404
jne 0x40e9d1
mov edx, 0x40faa4
mov eax, 0x80000002
call fcn.00404730
mov ecx, 0x40fb08
mov edx, 0x40f890
call fcn.0040489c
mov eax, dword [ebx + 0x104]
cmp eax, 0x404
je 0x40ea03
cmp eax, 0x804
je 0x40ea03
mov edx, 0x40faa4
mov eax, 0x80000002
call fcn.00404730
mov ecx, 0x40fb28
mov edx, 0x40f890
call fcn.0040489c
cmp dword [ebx + 0x104], 0x804
jne 0x40eab1
mov edx, 0x40fb54
mov eax, 0x80000002
call fcn.00404930
test al, al
jne 0x40eab1
mov ax, word [0x40f804]
call fcn.0040682c
test al, al
jne 0x40ea75
mov ax, word [0x40f808]
call fcn.0040682c
test al, al
jne 0x40ea75
mov ax, word [0x40f80c]
call fcn.0040682c
test al, al
jne 0x40ea75
mov ax, word [0x40f810]
call fcn.0040682c
test al, al
jne 0x40ea75
mov ax, word [0x40f814]
call fcn.0040682c
test al, al
je 0x40eab1
mov edx, 0x40fb54
mov eax, 0x80000002
call fcn.00404730
mov ecx, 0x40fa48
mov edx, 0x40fa5c
call fcn.0040489c
mov edx, 0x40faa4
mov eax, 0x80000002
call fcn.00404730
mov ecx, 0x40fb98
mov edx, 0x40f890
call fcn.0040489c
mov edx, 0x40fbb8
mov eax, 0x80000002
call fcn.004046d0
mov edx, dword [ebp - 0x1c]
call fcn.00404a00
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40eb8c
inc edi
xor esi, esi
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x134]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0x134]
mov ecx, 4
mov edx, 5
call fcn.004033d4
mov eax, dword [ebp - 0x130]
mov edx, 0x40fbf4
call fcn.004032c8
jne 0x40eb84
cmp dword [ebx + 0x104], 0x404
jne 0x40eb55
lea ecx, [ebp - 0x13c]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.00407820
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x24]
call fcn.004099f8
jmp 0x40eb84
lea ecx, [ebp - 0x144]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00407820
mov edx, dword [ebp - 0x140]
mov eax, dword [ebp - 0x20]
call fcn.004099f8
inc esi
dec edi
jne 0x40eada
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40ec50
inc edi
xor esi, esi
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x14c]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0x14c]
mov ecx, 4
mov edx, 5
call fcn.004033d4
mov eax, dword [ebp - 0x148]
mov edx, 0x40fc04
call fcn.004032c8
jne 0x40ec48
cmp dword [ebx + 0x104], 0x404
jne 0x40ec19
lea ecx, [ebp - 0x154]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.00407820
mov edx, dword [ebp - 0x150]
mov eax, dword [ebp - 0x20]
call fcn.004099f8
jmp 0x40ec48
lea ecx, [ebp - 0x15c]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x158]
call fcn.00407820
mov edx, dword [ebp - 0x158]
mov eax, dword [ebp - 0x24]
call fcn.004099f8
inc esi
dec edi
jne 0x40eb9e
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40ecb3
inc edi
xor esi, esi
lea ecx, [ebp - 0x160]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0x160]
mov edx, 0x40fc14
call fcn.004032c8
jne 0x40ecaf
lea ecx, [ebp - 0x168]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0x168]
lea edx, [ebp - 0x164]
call fcn.00407820
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 0x28]
call fcn.004099f8
inc esi
dec edi
jne 0x40ec5e
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40ed32
inc edi
xor esi, esi
lea eax, [ebp - 0x16c]
push eax
lea ecx, [ebp - 0x170]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0x170]
mov ecx, 4
mov edx, 5
call fcn.004033d4
mov eax, dword [ebp - 0x16c]
mov edx, 0x40fc28
call fcn.004032c8
jne 0x40ed2e
lea ecx, [ebp - 0x178]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.00407820
mov edx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x2c]
call fcn.004099f8
inc esi
dec edi
jne 0x40ecc1
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40edb1
inc edi
xor esi, esi
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x180]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0x180]
mov ecx, 4
mov edx, 5
call fcn.004033d4
mov eax, dword [ebp - 0x17c]
mov edx, 0x40fc38
call fcn.004032c8
jne 0x40edad
lea ecx, [ebp - 0x188]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0x188]
lea edx, [ebp - 0x184]
call fcn.00407820
mov edx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x30]
call fcn.004099f8
inc esi
dec edi
jne 0x40ed40
mov eax, dword [ebp - 0x28]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40ede4
inc edi
xor esi, esi
lea ecx, [ebp - 0x18c]
mov eax, dword [ebp - 0x28]
mov edx, esi
call fcn.00409a64
mov edx, dword [ebp - 0x18c]
mov eax, dword [ebx + 0xe0]
call fcn.004099f8
inc esi
dec edi
jne 0x40edbf
mov eax, dword [ebp - 0x20]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40ee17
inc edi
xor esi, esi
lea ecx, [ebp - 0x190]
mov eax, dword [ebp - 0x20]
mov edx, esi
call fcn.00409a64
mov edx, dword [ebp - 0x190]
mov eax, dword [ebx + 0xe0]
call fcn.004099f8
inc esi
dec edi
jne 0x40edf2
mov eax, dword [ebp - 0x24]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40ee4a
inc edi
xor esi, esi
lea ecx, [ebp - 0x194]
mov eax, dword [ebp - 0x24]
mov edx, esi
call fcn.00409a64
mov edx, dword [ebp - 0x194]
mov eax, dword [ebx + 0xe0]
call fcn.004099f8
inc esi
dec edi
jne 0x40ee25
mov eax, dword [ebp - 0x2c]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40ee7d
inc edi
xor esi, esi
lea ecx, [ebp - 0x198]
mov eax, dword [ebp - 0x2c]
mov edx, esi
call fcn.00409a64
mov edx, dword [ebp - 0x198]
mov eax, dword [ebx + 0xe0]
call fcn.004099f8
inc esi
dec edi
jne 0x40ee58
mov eax, dword [ebp - 0x30]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40eeb0
inc edi
xor esi, esi
lea ecx, [ebp - 0x19c]
mov eax, dword [ebp - 0x30]
mov edx, esi
call fcn.00409a64
mov edx, dword [ebp - 0x19c]
mov eax, dword [ebx + 0xe0]
call fcn.004099f8
inc esi
dec edi
jne 0x40ee8b
mov ax, word [0x40f804]
call fcn.0040682c
test al, al
jne 0x40eeff
mov ax, word [0x40f808]
call fcn.0040682c
test al, al
jne 0x40eeff
mov ax, word [0x40f80c]
call fcn.0040682c
test al, al
jne 0x40eeff
mov ax, word [0x40f810]
call fcn.0040682c
test al, al
jne 0x40eeff
mov ax, word [0x40f814]
call fcn.0040682c
test al, al
je 0x40eff7
mov eax, dword [ebp - 0x20]
call fcn.00409a08
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40efc4
inc edi
xor esi, esi
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0x1a0]
mov ecx, 4
mov edx, 5
call fcn.004033d4
mov eax, dword [ebp - 4]
mov edx, 0x40fc48
call fcn.004032c8
je 0x40efbc
mov eax, dword [ebp - 4]
mov edx, 0x40fc04
call fcn.004032c8
je 0x40efbc
mov eax, dword [ebp - 4]
mov edx, 0x40fbf4
call fcn.004032c8
je 0x40efbc
mov eax, dword [ebp - 4]
mov edx, 0x40fc28
call fcn.004032c8
je 0x40efbc
mov eax, dword [ebp - 4]
mov edx, 0x40fc38
call fcn.004032c8
je 0x40efbc
lea ecx, [ebp - 0x1a8]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0x1a8]
lea edx, [ebp - 0x1a4]
call fcn.00407820
mov edx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x20]
call fcn.004099f8
inc esi
dec edi
jne 0x40ef19
mov eax, dword [ebp - 0x20]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40eff7
inc edi
xor esi, esi
lea ecx, [ebp - 0x1ac]
mov eax, dword [ebp - 0x20]
mov edx, esi
call fcn.00409a64
mov edx, dword [ebp - 0x1ac]
mov eax, dword [ebx + 0xe0]
call fcn.004099f8
inc esi
dec edi
jne 0x40efd2
mov eax, dword [ebp - 0x1c]
call fcn.00407028
mov eax, dword [ebp - 0x20]
call fcn.00407028
mov eax, dword [ebp - 0x24]
call fcn.00407028
mov eax, dword [ebp - 0x28]
call fcn.00407028
mov eax, dword [ebp - 0x2c]
call fcn.00407028
mov eax, dword [ebp - 0x30]
call fcn.00407028
mov eax, dword [ebx + 0xdc]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40f0a7
inc edi
xor esi, esi
mov eax, dword [ebx + 0xe0]
mov eax, dword [eax + 0x1c]
dec eax
test eax, eax
jl 0x40f0a3
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1b0]
mov eax, dword [ebx + 0xe0]
mov edx, dword [ebp - 0x14]
call fcn.00409a64
mov eax, dword [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x1b4]
mov eax, dword [ebx + 0xdc]
mov edx, esi
call fcn.00409a64
mov edx, dword [ebp - 0x1b4]
pop eax
call fcn.004032c8
jne 0x40f09b
mov eax, dword [ebx + 0xe0]
mov edx, dword [ebp - 0x14]
call fcn.00409a38
inc dword [ebp - 0x14]
dec dword [ebp - 0x38]
jne 0x40f051
inc esi
dec edi
jne 0x40f038
xor esi, esi
jmp 0x40f176
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x1bc]
mov eax, edi
mov edx, esi
call fcn.00409a64
mov eax, dword [ebp - 0x1bc]
mov ecx, 1
mov edx, 1
call fcn.004033d4
mov eax, dword [ebp - 0x1b8]
mov edx, 0x40fc58
call fcn.004032c8
je 0x40f175
lea ecx, [ebp - 0x1c4]
mov eax, dword [ebx + 0xe0]
mov edx, esi
call fcn.00409a64
mov ecx, dword [ebp - 0x1c4]
lea eax, [ebp - 0x1c0]
mov edx, 0x40f840
call fcn.004031c8
mov edx, dword [ebp - 0x1c0]
mov eax, 0x80000002
call fcn.004046d0
lea ecx, [ebp - 4]
mov edx, 0x40fc64
call fcn.00404800
cmp dword [ebp - 4], 0
je 0x40f163
lea eax, [ebp - 0x1c8]
call fcn.00404658
lea eax, [ebp - 0x1c8]
mov edx, dword [ebp - 4]
call fcn.00403184
mov eax, dword [ebp - 0x1c8]
call fcn.00407958
test al, al
jne 0x40f172
mov eax, dword [ebx + 0xe0]
mov edx, esi
call fcn.00409a38
jmp 0x40f176
inc esi
jmp 0x40f176
inc esi
mov edi, dword [ebx + 0xe0]
cmp esi, dword [edi + 0x1c]
jl 0x40f0ae
mov eax, dword [ebx + 0xe0]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40f34a
inc edi
xor esi, esi
lea ecx, [ebp - 0x1d0]
mov eax, dword [ebx + 0xe0]
mov edx, esi
call fcn.00409a64
mov ecx, dword [ebp - 0x1d0]
lea eax, [ebp - 0x1cc]
mov edx, 0x40f840
call fcn.004031c8
mov edx, dword [ebp - 0x1cc]
mov eax, 0x80000002
call fcn.004046d0
lea ecx, [ebp - 4]
mov edx, 0x40f87c
call fcn.00404800
cmp dword [ebp - 4], 0
je 0x40f24d
lea eax, [ebp - 0x1d4]
call fcn.00404658
lea eax, [ebp - 0x1d4]
mov edx, dword [ebp - 4]
call fcn.00403184
mov eax, dword [ebp - 0x1d4]
call fcn.00407958
test al, al
je 0x40f24d
lea eax, [ebp - 0x1dc]
call fcn.00404658
lea eax, [ebp - 0x1dc]
mov edx, dword [ebp - 4]
call fcn.00403184
mov edx, dword [ebp - 0x1dc]
lea ecx, [ebp - 0x1d8]
mov eax, ebx
call fcn.00413d84
mov edx, dword [ebp - 0x1d8]
mov eax, dword [ebx + 0xf0]
call fcn.004099f8
jmp 0x40f2a7
lea ecx, [ebp - 0x1e8]
mov eax, dword [ebx + 0xe0]
mov edx, esi
call fcn.00409a64
mov ecx, dword [ebp - 0x1e8]
lea eax, [ebp - 0x1e4]
mov edx, 0x40f840
call fcn.004031c8
mov edx, dword [ebp - 0x1e4]
mov eax, 0x80000002
call fcn.004046d0
lea ecx, [ebp - 0x1e0]
mov edx, 0x40f890
call fcn.00404800
mov edx, dword [ebp - 0x1e0]
mov eax, dword [ebx + 0xf0]
call fcn.004099f8
lea ecx, [ebp - 0x1f0]
mov eax, dword [ebx + 0xe0]
mov edx, esi
call fcn.00409a64
mov ecx, dword [ebp - 0x1f0]
lea eax, [ebp - 0x1ec]
mov edx, 0x40f840
call fcn.004031c8
mov edx, dword [ebp - 0x1ec]
mov eax, 0x80000002
call fcn.004046d0
lea ecx, [ebp - 4]
mov edx, 0x40f8a4
call fcn.00404800
cmp dword [ebp - 4], 0
je 0x40f316
lea ecx, [ebp - 0x1f4]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0041403c
mov edx, dword [ebp - 0x1f4]
mov eax, dword [ebx + 0xf4]
call fcn.004099f8
jmp 0x40f342
lea ecx, [ebp - 0x1f8]
mov eax, dword [ebx + 0xf0]
mov edx, dword [eax + 0x1c]
dec edx
mov eax, dword [ebx + 0xf0]
call fcn.00409a64
mov edx, dword [ebp - 0x1f8]
mov eax, dword [ebx + 0xf4]
call fcn.004099f8
inc esi
dec edi
jne 0x40f19a
mov eax, dword [ebx + 0x70]
call fcn.00409428
test al, al
je 0x40f38c
mov eax, dword [ebx + 0xf0]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40f38c
inc edi
xor esi, esi
lea ecx, [ebp - 0x1fc]
mov eax, dword [ebx + 0xf0]
mov edx, esi
call fcn.00409a64
mov edx, dword [ebp - 0x1fc]
mov eax, dword [ebx + 0x3c]
call fcn.00409624
inc esi
dec edi
jne 0x40f367
mov eax, dword [ebx + 0x6c]
call fcn.00409428
test al, al
je 0x40f3ce
mov eax, dword [ebx + 0xf4]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40f3ce
inc edi
xor esi, esi
lea ecx, [ebp - 0x200]
mov eax, dword [ebx + 0xf4]
mov edx, esi
call fcn.00409a64
mov edx, dword [ebp - 0x200]
mov eax, dword [ebx + 0x3c]
call fcn.00409624
inc esi
dec edi
jne 0x40f3a9
mov eax, 0x80000002
call fcn.004048dc
mov edx, 0x40fc78
mov eax, 0x80000001
call fcn.004046d0
mov edx, 0x40fc90
call fcn.00404770
test eax, eax
jne 0x40f404
mov eax, dword [ebx + 0x9c]
xor edx, edx
call fcn.004098fc
jmp 0x40f414
mov eax, dword [ebx + 0x9c]
mov edx, 1
call fcn.004098fc
mov edx, 0x40fca4
mov eax, 0x80000001
call fcn.004046d0
lea ecx, [ebp - 0x204]
mov edx, 0x40fcc8
call fcn.00404800
mov eax, dword [ebp - 0x204]
mov edx, 0x40f974
call fcn.004032c8
jne 0x40f454
mov eax, dword [ebx + 0xa0]
mov dl, 1
call fcn.00409448
jmp 0x40f461
mov eax, dword [ebx + 0xa0]
xor edx, edx
call fcn.00409448
mov edx, 0x40fcdc
mov eax, 0x80000001
call fcn.004046d0
lea ecx, [ebp - 8]
mov edx, 0x40fcfc
call fcn.00404800
mov edx, 0x40fcdc
mov eax, 0x80000001
call fcn.004046d0
lea ecx, [ebp - 0xc]
mov edx, 0x40fd0c
call fcn.00404800
mov edx, 0x40fcdc
mov eax, 0x80000001
call fcn.004046d0
lea ecx, [ebp - 0x10]
mov edx, 0x40fd24
call fcn.00404800
mov eax, dword [ebp - 8]
mov edx, 0x40f974
call fcn.004032c8
je 0x40f4d3
mov eax, dword [ebp - 0xc]
mov edx, 0x40f974
call fcn.004032c8
jne 0x40f4ea
mov eax, dword [ebx + 0x78]
mov dl, 1
call fcn.00409448
mov eax, dword [ebx + 0x7c]
mov edx, 1
call fcn.004098fc
mov eax, dword [ebp - 8]
mov edx, 0x40fd3c
call fcn.004032c8
je 0x40f508
mov eax, dword [ebp - 0xc]
mov edx, 0x40fd3c
call fcn.004032c8
jne 0x40f51c
mov eax, dword [ebx + 0x78]
mov dl, 1
call fcn.00409448
mov eax, dword [ebx + 0x7c]
xor edx, edx
call fcn.004098fc
mov eax, dword [ebp - 8]
mov edx, 0x40fd48
call fcn.004032c8
je 0x40f53a
mov eax, dword [ebp - 0xc]
mov edx, 0x40fd48
call fcn.004032c8
jne 0x40f54e
mov eax, dword [ebx + 0x78]
xor edx, edx
call fcn.00409448
mov eax, dword [ebx + 0x7c]
xor edx, edx
call fcn.00408604
mov eax, dword [ebp - 0x10]
mov edx, 0x40f974
call fcn.004032c8
jne 0x40f57a
mov eax, dword [ebx + 0x80]
mov dl, 1
call fcn.00409448
mov eax, dword [ebx + 0x84]
mov edx, 1
call fcn.004098fc
mov eax, dword [ebp - 0x10]
mov edx, 0x40fd3c
call fcn.004032c8
jne 0x40f5a3
mov eax, dword [ebx + 0x80]
mov dl, 1
call fcn.00409448
mov eax, dword [ebx + 0x84]
xor edx, edx
call fcn.004098fc
mov eax, dword [ebp - 0x10]
mov edx, 0x40fd48
call fcn.004032c8
jne 0x40f5dc
mov eax, dword [ebx + 0x80]
xor edx, edx
call fcn.00409448
mov eax, dword [ebx + 0x84]
mov edx, 1
call fcn.004098fc
mov eax, dword [ebx + 0x84]
xor edx, edx
call fcn.00408604
mov eax, dword [ebx + 0x6c]
call fcn.00409428
mov edx, eax
mov eax, dword [ebx + 0x80]
call fcn.00408604
mov eax, dword [ebx + 0x6c]
call fcn.00409428
mov edx, eax
mov eax, dword [ebx + 0x84]
call fcn.00408604
mov eax, dword [ebx + 0x70]
call fcn.00409428
test al, al
je 0x40f6dc
mov ax, word [0x40f8b8]
call fcn.0040682c
test al, al
jne 0x40f643
mov ax, word [0x40f8bc]
call fcn.0040682c
test al, al
jne 0x40f643
mov ax, word [0x40f8c0]
call fcn.0040682c
test al, al
je 0x40f69b
mov edx, 0x40fcdc
mov eax, 0x80000001
call fcn.004046d0
lea ecx, [ebp - 8]
xor edx, edx
call fcn.00404800
mov eax, dword [ebx + 0x78]
mov dl, 1
call fcn.00409448
mov eax, dword [ebp - 8]
mov edx, 0x40fd3c
call fcn.004032c8
jne 0x40f67f
mov eax, dword [ebx + 0x7c]
xor edx, edx
call fcn.004098fc
mov eax, dword [ebp - 8]
mov edx, 0x40f974
call fcn.004032c8
jne 0x40f69b
mov eax, dword [ebx + 0x7c]
mov edx, 1
call fcn.004098fc
mov eax, dword [ebx + 0x104]
sub eax, 0x404
je 0x40f6be
sub eax, 0x400
jne 0x40f6cd
mov eax, dword [ebx + 0x78]
mov edx, 0x40fd54
call fcn.00408c98
jmp 0x40f71b
mov eax, dword [ebx + 0x78]
mov edx, 0x40fd68
call fcn.00408c98
jmp 0x40f71b
mov eax, dword [ebx + 0x78]
mov edx, 0x40fd7c
call fcn.00408c98
jmp 0x40f71b
mov eax, dword [ebx + 0x104]
sub eax, 0x404
je 0x40f6ff
sub eax, 0x400
jne 0x40f70e
mov eax, dword [ebx + 0x78]
mov edx, 0x40fd90
call fcn.00408c98
jmp 0x40f71b
mov eax, dword [ebx + 0x78]
mov edx, 0x40fda8
call fcn.00408c98
jmp 0x40f71b
mov eax, dword [ebx + 0x78]
mov edx, 0x40fdc0
call fcn.00408c98
mov eax, 0x80000001
call fcn.004048dc
mov eax, dword [ebx + 0x3c]
xor edx, edx
call fcn.004098fc
mov eax, dword [ebx + 0x54]
xor edx, edx
call fcn.00406d9c
lea eax, [ebx + 0x110]
push eax
push 0x1e
call fcn.00403b60
mov eax, ebx
call fcn.00413174
mov ax, word [0x40f814]
call fcn.0040682c
test al, al
je 0x40f771
mov eax, dword [ebx + 0x6c]
mov dl, 1
call fcn.00409448
mov eax, dword [ebx + 0x70]
xor edx, edx
call fcn.00408604
mov eax, dword [ebx + 0x70]
call fcn.00409428
mov byte [ebx + 0x18c], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f7ce
lea eax, [ebp - 0x204]
mov edx, 0x63
call fcn.0040301c
lea eax, [ebp - 0x74]
call fcn.00402ff8
lea eax, [ebp - 0x78]
call fcn.00402ff8
lea eax, [ebp - 0x70]
mov edx, 0xe
call fcn.0040301c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040301c
ret