Function at 0x409da5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5c94df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd0
push ebx
push ebp
push esi
push edi
push 6
push 0x609a98
lea ecx, [esp + 0x44]
call fcn.00558100
xor ebp, ebp
push 6
push 0x609a90
lea ecx, [esp + 0x4c]
mov dword [esp + 0xf0], ebp
call fcn.00558100
push 6
push 0x609a88
lea ecx, [esp + 0x48]
mov byte [esp + 0xf0], 1
call fcn.00558100
push 6
push 0x609a80
lea ecx, [esp + 0x18]
mov byte [esp + 0xf0], 2
call fcn.00558100
push 0x96
push ebp
lea ecx, [esp + 0x44]
mov byte [esp + 0xf0], 3
call fcn.005584a0
push 0x96
push ebp
lea ecx, [esp + 0x4c]
call fcn.005584a0
push 0x96
push ebp
lea ecx, [esp + 0x48]
call fcn.005584a0
push 0x96
push ebp
lea ecx, [esp + 0x18]
call fcn.005584a0
push ebp
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push 6
push 0x609448
call fcn.00558100
push ecx
mov byte [esp + 0xf8], 4
mov ecx, esp
mov dword [esp + 0x3c], esp
push 6
push 0x609558
call fcn.00558100
mov ecx, 0x619a58
mov byte [esp + 0xf8], 3
call fcn.00543af0
lea ecx, [esp + 0x4c]
call fcn.005589e0
lea ecx, [esp + 0xbc]
mov byte [esp + 0xe8], 5
call fcn.00559c60
mov al, byte [esp + 0x3b]
mov dword [esp + 0x18], ebp
mov byte [esp + 0x14], al
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov cl, byte [esp + 0x3b]
mov dword [esp + 0xb0], ebp
mov byte [esp + 0xac], cl
mov dword [esp + 0xb4], ebp
mov dword [esp + 0xb8], ebp
lea ecx, [esp + 0x48]
mov byte [esp + 0xe8], 8
call fcn.00558060
mov eax, dword [0x619c28]
mov byte [esp + 0xe8], 9
cmp eax, 0x4106a
mov dword [esp + 0x30], ebp
mov dword [esp + 0x5c], 0x609a78
mov dword [esp + 0x60], 0x609a70
mov dword [esp + 0x64], 0x609a68
mov dword [esp + 0x68], 0x609a60
mov dword [esp + 0x6c], 0x609a58
mov dword [esp + 0x70], ebp
mov dword [esp + 0x74], 0x609a50
mov dword [esp + 0x78], 0x609a48
mov dword [esp + 0x7c], 0x609a40
mov dword [esp + 0x80], 0x609a38
mov dword [esp + 0x84], 0x609a30
mov dword [esp + 0x88], ebp
mov dword [esp + 0x8c], 0x609a28
mov dword [esp + 0x90], 0x609a20
mov dword [esp + 0x94], 0x609a18
mov dword [esp + 0x98], 0x609a10
mov dword [esp + 0x9c], 0x609a08
mov dword [esp + 0xa0], 0x609a00
mov dword [esp + 0xa4], 0x6099f8
mov dword [esp + 0xa8], ebp
ja 0x409f44
cmp eax, 0x41069
jae 0x409f62
cmp eax, 0x41063
ja 0x409f36
je 0x409f2f
cmp eax, 0x31066
je 0x409f2b
cmp eax, 0x31362
jne 0x409f77
xor eax, eax
jmp 0x409f83
mov eax, 1
jmp 0x409f83
cmp eax, 0x41066
jne 0x409f77
mov eax, 2
jmp 0x409f83
cmp eax, 0x44062
ja 0x409f70
je 0x409f69
cmp eax, 0x4106c
je 0x409f62
cmp eax, 0x44061
jne 0x409f77
mov eax, 4
jmp 0x409f83
mov eax, 3
jmp 0x409f83
mov eax, 5
jmp 0x409f83
cmp eax, 0x44367
je 0x409f7e
mov eax, 7
jmp 0x409f83
mov eax, 6
push eax
push 2
lea ecx, [esp + 0x18]
call fcn.005584a0
lea ecx, [esp + 0x24]
call fcn.00558060
lea ecx, [esp + 0x4c]
mov byte [esp + 0xe8], 0xa
call fcn.00559480
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push edx
push eax
push eax
call fcn.00412590
mov edi, eax
mov eax, dword [esp + 0x28]
add esp, 0xc
cmp edi, eax
mov ebx, eax
mov esi, edi
je 0x409fd9
push ebp
mov ecx, esi
call fcn.00406c10
add esi, 4
cmp esi, ebx
jne 0x409fca
mov eax, dword [0x619c28]
mov dword [esp + 0x1c], edi
cmp eax, 0x4106a
ja 0x40a085
cmp eax, 0x41069
jae 0x40a0a6
cmp eax, 0x41063
ja 0x40a07e
je 0x40a0a6
cmp eax, 0x31066
je 0x40a0a6
cmp eax, 0x31362
je 0x40a0a6
mov esi, dword [esp + 0xf4]
xor ebx, ebx
mov dword [esp + 0x2c], ebx
movsx edi, bx
push 5
lea ecx, [esp + 0x28]
mov edx, dword [esp + edi*4 + 0x60]
push edx
call fcn.00558600
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00558070
lea ecx, [esp + 0x50]
call fcn.00558c30
lea ecx, [esp + 0x14]
push 1
lea edx, [esp + 0x50]
push ecx
push edx
mov ecx, 0x619c20
call fcn.00406ed0
mov ecx, dword [esp + 0x18]
cmp ecx, ebp
jne 0x40a7c1
xor eax, eax
jmp 0x40a7ca
cmp eax, 0x41066
jmp 0x40a015
cmp eax, 0x44062
ja 0x40a5a7
cmp eax, 0x44061
jae 0x40a3a6
cmp eax, 0x4106c
jne 0x40a01b
mov ebx, dword [esp + 0xf4]
xor esi, esi
mov dword [esp + 0x2c], esi
movsx edi, si
push 5
lea ecx, [esp + 0x28]
mov eax, dword [esp + edi*4 + 0x60]
push eax
call fcn.00558600
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.00558070
lea ecx, [esp + 0x50]
call fcn.00558c30
lea eax, [esp + 0x14]
push 1
lea ecx, [esp + 0x50]
push eax
push ecx
mov ecx, 0x619c20
call fcn.00406ed0
cmp si, bp
jne 0x40a17f
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push edx
push eax
push eax
call fcn.00412590
mov ebp, dword [esp + 0x28]
mov ebx, eax
add esp, 0xc
cmp ebx, ebp
mov esi, ebx
je 0x40a12e
push 0
mov ecx, esi
call fcn.00406c10
add esi, 4
cmp esi, ebp
jne 0x40a11e
push 5
push 0x609a78
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], ebx
call fcn.00558600
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00558070
lea ecx, [esp + 0x50]
call fcn.00558c30
lea ecx, [esp + 0x14]
push 1
lea edx, [esp + 0x50]
push ecx
push edx
mov ecx, 0x619c20
call fcn.00406ed0
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0xf4]
xor ebp, ebp
mov ecx, dword [esp + 0x18]
cmp ecx, ebp
jne 0x40a18b
xor eax, eax
jmp 0x40a194
mov eax, dword [esp + 0x1c]
sub eax, ecx
sar eax, 2
cmp eax, edi
jbe 0x40a309
lea ecx, [ecx + edi*4]
call fcn.00558520
cmp ax, 2
jle 0x40a206
mov eax, dword [esp + 0x18]
push 2
lea ecx, [eax + edi*4]
call fcn.00558380
test al, al
je 0x40a206
mov ecx, dword [esp + 0x18]
push 2
lea ecx, [ecx + edi*4]
call fcn.00558380
cmp al, 0x80
je 0x40a206
mov edx, dword [esp + 0x18]
push 2
lea ecx, [edx + edi*4]
call fcn.00558380
mov byte [esp + 0x34], al
lea ecx, [esp + 0x10]
mov eax, dword [esp + 0x34]
push eax
push 5
call fcn.005584a0
mov eax, dword [ebx + 8]
lea ecx, [esp + 0x10]
push ecx
push 1
push eax
mov ecx, ebx
call fcn.00402a90
inc dword [esp + 0x30]
inc esi
cmp si, 5
mov dword [esp + 0x2c], esi
jl 0x40a0b3
lea ecx, [esp + 0x24]
mov byte [esp + 0xe8], 9
call fcn.005581a0
lea ecx, [esp + 0x48]
mov byte [esp + 0xe8], 8
call fcn.005581a0
push ebp
call fcn.005bc500
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
add esp, 4
cmp esi, eax
mov byte [esp + 0xe8], 6
mov edi, eax
je 0x40a268
mov ecx, esi
call fcn.005581a0
add esi, 4
cmp esi, edi
jne 0x40a256
mov esi, dword [esp + 0x18]
push esi
call fcn.005bc500
add esp, 4
lea ecx, [esp + 0xbc]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov byte [esp + 0xe8], 5
call fcn.00559d60
lea ecx, [esp + 0x4c]
mov byte [esp + 0xe8], 3
call fcn.00558a00
lea ecx, [esp + 0x10]
mov byte [esp + 0xe8], 2
call fcn.005581a0
lea ecx, [esp + 0x40]
mov byte [esp + 0xe8], 1
call fcn.005581a0
lea ecx, [esp + 0x44]
mov byte [esp + 0xe8], 0
call fcn.005581a0
lea ecx, [esp + 0x3c]
mov dword [esp + 0xe8], 0xffffffff
call fcn.005581a0
mov ax, word [esp + 0x30]
mov ecx, dword [esp + 0xe0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xdc
ret 8
push ebp
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push 6
push 0x6094cc
call fcn.00558100
push ecx
mov byte [esp + 0xf8], 0xb
mov ecx, esp
mov dword [esp + 0x3c], esp
push 6
push 0x609440
call fcn.00558100
mov ecx, 0x619a58
mov byte [esp + 0xf8], 0xa
call fcn.00543af0
lea ecx, [esp + 0x24]
mov byte [esp + 0xe8], 9
call fcn.005581a0
lea ecx, [esp + 0x48]
mov byte [esp + 0xe8], 8
call fcn.005581a0
push ebp
call fcn.005bc500
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
add esp, 4
cmp esi, eax
mov byte [esp + 0xe8], 6
mov edi, eax
je 0x40a3a0
push ebp
mov ecx, esi
call fcn.00406c10
add esi, 4
cmp esi, edi
jne 0x40a38d
mov esi, dword [esp + 0x18]
push esi
jmp 0x40aa20
mov edi, dword [esp + 0xf4]
xor ebx, ebx
movsx esi, bx
push 5
lea ecx, [esp + 0x28]
mov edx, dword [esp + esi*4 + 0x78]
push edx
call fcn.00558600
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00558070
lea ecx, [esp + 0x50]
call fcn.00558c30
lea ecx, [esp + 0x14]
push 1
lea edx, [esp + 0x50]
push ecx
push edx
mov ecx, 0x619c20
call fcn.00406ed0
mov ecx, dword [esp + 0x18]
cmp ecx, ebp
jne 0x40a3fe
xor eax, eax
jmp 0x40a407
mov eax, dword [esp + 0x1c]
sub eax, ecx
sar eax, 2
cmp eax, esi
jbe 0x40a485
lea ecx, [ecx + esi*4]
call fcn.00558520
cmp ax, 2
jle 0x40a475
mov eax, dword [esp + 0x18]
push 2
lea ecx, [eax + esi*4]
call fcn.00558380
test al, al
je 0x40a475
mov ecx, dword [esp + 0x18]
push 2
lea ecx, [ecx + esi*4]
call fcn.00558380
cmp al, 0x80
je 0x40a475
mov edx, dword [esp + 0x18]
push 2
lea ecx, [edx + esi*4]
call fcn.00558380
mov byte [esp + 0x34], al
lea ecx, [esp + 0x10]
mov eax, dword [esp + 0x34]
push eax
push 5
call fcn.005584a0
mov eax, dword [edi + 8]
lea ecx, [esp + 0x10]
push ecx
push 1
push eax
mov ecx, edi
call fcn.00402a90
inc dword [esp + 0x30]
inc ebx
cmp bx, 5
jl 0x40a3af
jmp 0x40a215
push ebp
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push 6
push 0x6094cc
call fcn.00558100
push ecx
mov byte [esp + 0xf8], 0xc
mov ecx, esp
mov dword [esp + 0x3c], esp
push 6
push 0x609440
call fcn.00558100
mov ecx, 0x619a58
mov byte [esp + 0xf8], 0xa
call fcn.00543af0
lea ecx, [esp + 0x24]
mov byte [esp + 0xe8], 9
call fcn.005581a0
lea ecx, [esp + 0x48]
mov byte [esp + 0xe8], 8
call fcn.005581a0
push ebp
call fcn.005bc500
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
add esp, 4
cmp eax, ecx
mov byte [esp + 0xe8], 6
mov edi, ecx
mov esi, eax
je 0x40a51d
mov ecx, esi
call fcn.005581a0
add esi, 4
cmp esi, edi
jne 0x40a50b
mov eax, dword [esp + 0x18]
push eax
call fcn.005bc500
add esp, 4
lea ecx, [esp + 0xbc]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov byte [esp + 0xe8], 5
call fcn.00559d60
lea ecx, [esp + 0x4c]
mov byte [esp + 0xe8], 3
call fcn.00558a00
lea ecx, [esp + 0x10]
mov byte [esp + 0xe8], 2
call fcn.005581a0
lea ecx, [esp + 0x40]
mov byte [esp + 0xe8], 1
call fcn.005581a0
lea ecx, [esp + 0x44]
mov byte [esp + 0xe8], 0
call fcn.005581a0
lea ecx, [esp + 0x3c]
mov dword [esp + 0xe8], 0xffffffff
call fcn.005581a0
or ax, 0xffff
jmp 0x40a2ee
cmp eax, 0x44367
jb 0x40a01b
cmp eax, 0x4436a
ja 0x40a01b
mov edi, dword [esp + 0xf4]
xor ebx, ebx
movsx esi, bx
push 5
lea ecx, [esp + 0x28]
mov edx, dword [esp + esi*4 + 0x90]
push edx
call fcn.00558600
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00558070
lea ecx, [esp + 0x50]
call fcn.00558c30
lea ecx, [esp + 0x14]
push 1
lea edx, [esp + 0x50]
push ecx
push edx
mov ecx, 0x619c20
call fcn.00406ed0
mov ecx, dword [esp + 0x18]
cmp ecx, ebp
jne 0x40a618
xor eax, eax
jmp 0x40a621
mov eax, dword [esp + 0x1c]
sub eax, ecx
sar eax, 2
cmp eax, esi
jbe 0x40a69f
lea ecx, [ecx + esi*4]
call fcn.00558520
cmp ax, 2
jle 0x40a68f
mov eax, dword [esp + 0x18]
push 2
lea ecx, [eax + esi*4]
call fcn.00558380
test al, al
je 0x40a68f
mov ecx, dword [esp + 0x18]
push 2
lea ecx, [ecx + esi*4]
call fcn.00558380
cmp al, 0x80
je 0x40a68f
mov edx, dword [esp + 0x18]
push 2
lea ecx, [edx + esi*4]
call fcn.00558380
mov byte [esp + 0x34], al
lea ecx, [esp + 0x10]
mov eax, dword [esp + 0x34]
push eax
push 5
call fcn.005584a0
mov eax, dword [edi + 8]
lea ecx, [esp + 0x10]
push ecx
push 1
push eax
mov ecx, edi
call fcn.00402a90
inc dword [esp + 0x30]
inc ebx
cmp bx, 7
jl 0x40a5c6
jmp 0x40a215
push ebp
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push 6
push 0x6094cc
call fcn.00558100
push ecx
mov byte [esp + 0xf8], 0xd
mov ecx, esp
mov dword [esp + 0x3c], esp
push 6
push 0x609440
call fcn.00558100
mov ecx, 0x619a58
mov byte [esp + 0xf8], 0xa
call fcn.00543af0
lea ecx, [esp + 0x24]
mov byte [esp + 0xe8], 9
call fcn.005581a0
lea ecx, [esp + 0x48]
mov byte [esp + 0xe8], 8
call fcn.005581a0
push ebp
call fcn.005bc500
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
add esp, 4
cmp eax, ecx
mov byte [esp + 0xe8], 6
mov edi, ecx
mov esi, eax
je 0x40a737
mov ecx, esi
call fcn.005581a0
add esi, 4
cmp esi, edi
jne 0x40a725
mov eax, dword [esp + 0x18]
push eax
call fcn.005bc500
add esp, 4
lea ecx, [esp + 0xbc]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov byte [esp + 0xe8], 5
call fcn.00559d60
lea ecx, [esp + 0x4c]
mov byte [esp + 0xe8], 3
call fcn.00558a00
lea ecx, [esp + 0x10]
mov byte [esp + 0xe8], 2
call fcn.005581a0
lea ecx, [esp + 0x40]
mov byte [esp + 0xe8], 1
call fcn.005581a0
lea ecx, [esp + 0x44]
mov byte [esp + 0xe8], 0
call fcn.005581a0
lea ecx, [esp + 0x3c]
mov dword [esp + 0xe8], 0xffffffff
call fcn.005581a0
or ax, 0xffff
jmp 0x40a2ee
mov eax, dword [esp + 0x1c]
sub eax, ecx
sar eax, 2
cmp eax, edi
jbe 0x40a987
lea ecx, [ecx + edi*4]
call fcn.00558520
cmp ax, 2
jle 0x40a973
mov eax, dword [esp + 0x18]
push 2
lea ecx, [eax + edi*4]
call fcn.00558380
test al, al
je 0x40a973
mov ecx, dword [esp + 0x18]
push 2
lea ecx, [ecx + edi*4]
call fcn.00558380
cmp al, 0x80
je 0x40a973
mov edx, dword [esp + 0x18]
push 2
lea ecx, [edx + edi*4]
call fcn.00558380
mov byte [esp + 0x34], al
lea ecx, [esp + 0x10]
mov eax, dword [esp + 0x34]
push eax
push 5
call fcn.005584a0
mov edi, dword [esi + 8]
mov ecx, dword [esi + 0xc]
sub ecx, edi
sar ecx, 2
cmp ecx, 1
jae 0x40a8f2
mov ecx, esi
call fcn.0056e680
cmp eax, 1
jbe 0x40a85d
mov ecx, esi
call fcn.0056e680
mov ebx, eax
jmp 0x40a862
mov ebx, 1
mov ecx, esi
call fcn.0056e680
add eax, ebx
mov dword [esp + 0x28], eax
jns 0x40a873
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.005bcf2f
add esp, 4
mov ebp, eax
mov eax, dword [esi + 4]
mov ecx, esi
push ebp
push edi
push eax
call fcn.00402d20
lea ecx, [esp + 0x10]
mov ebx, eax
push ecx
push 1
push ebx
mov ecx, esi
call fcn.00402d60
mov edx, dword [esi + 8]
add ebx, 4
push ebx
push edx
push edi
mov ecx, esi
call fcn.00402d20
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push eax
push ecx
mov ecx, esi
call fcn.00402cf0
mov eax, dword [esi + 4]
push eax
call fcn.005bc500
mov edx, dword [esp + 0x2c]
add esp, 4
mov ecx, esi
lea eax, [ebp + edx*4]
mov dword [esi + 0xc], eax
call fcn.0056e680
mov ebx, dword [esp + 0x2c]
lea ecx, [ebp + eax*4 + 4]
mov dword [esi + 4], ebp
mov dword [esi + 8], ecx
xor ebp, ebp
jmp 0x40a96f
mov edx, edi
sub edx, edi
sar edx, 2
cmp edx, 1
jae 0x40a93e
lea eax, [edi + 4]
mov ecx, esi
push eax
push edi
push edi
call fcn.00402d20
mov eax, dword [esi + 8]
lea ecx, [esp + 0x10]
mov edx, eax
push ecx
sub edx, edi
mov ecx, 1
sar edx, 2
sub ecx, edx
push ecx
push eax
mov ecx, esi
call fcn.00402d60
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push eax
push edi
call fcn.00402d90
add esp, 0xc
jmp 0x40a96b
push edi
lea ecx, [edi - 4]
push edi
push ecx
mov ecx, esi
call fcn.00402d20
mov eax, dword [esi + 8]
push eax
add eax, 0xfffffffc
push eax
push edi
call fcn.00402dd0
lea edx, [esp + 0x1c]
lea eax, [edi + 4]
push edx
push eax
push edi
call fcn.00402d90
add esp, 0x18
add dword [esi + 8], 4
inc dword [esp + 0x30]
inc ebx
cmp bx, 5
mov dword [esp + 0x2c], ebx
jl 0x40a028
jmp 0x40a215
push ebp
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push 6
push 0x6094cc
call fcn.00558100
push ecx
mov byte [esp + 0xf8], 0xe
mov ecx, esp
mov dword [esp + 0x3c], esp
push 6
push 0x609440
call fcn.00558100
mov ecx, 0x619a58
mov byte [esp + 0xf8], 0xa
call fcn.00543af0
lea ecx, [esp + 0x24]
mov byte [esp + 0xe8], 9
call fcn.005581a0
lea ecx, [esp + 0x48]
mov byte [esp + 0xe8], 8
call fcn.005581a0
push ebp
call fcn.005bc500
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
add esp, 4
cmp eax, ecx
mov byte [esp + 0xe8], 6
mov edi, ecx
mov esi, eax
je 0x40aa1f
mov ecx, esi
call fcn.005581a0
add esi, 4
cmp esi, edi
jne 0x40aa0d
mov eax, dword [esp + 0x18]
push eax
call fcn.005bc500
add esp, 4
lea ecx, [esp + 0xbc]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov byte [esp + 0xe8], 5
call fcn.00559d60
lea ecx, [esp + 0x4c]
mov byte [esp + 0xe8], 3
call fcn.00558a00
lea ecx, [esp + 0x10]
mov byte [esp + 0xe8], 2
call fcn.005581a0
lea ecx, [esp + 0x40]
mov byte [esp + 0xe8], 1
call fcn.005581a0
lea ecx, [esp + 0x44]
mov byte [esp + 0xe8], 0
call fcn.005581a0
lea ecx, [esp + 0x3c]
mov dword [esp + 0xe8], 0xffffffff
call fcn.005581a0
or ax, 0xffff
jmp 0x40a2ee