Function at 0x40ee90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44798e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x45c070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [ebp - 4], edi
mov dword [esi], vtable.CSetupDlg.0
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov eax, dword [0x45d48c]
mov edx, dword [eax + 0xc]
mov ecx, 0x45d48c
call edx
add eax, 0x10
mov dword [esi + 0x3c], eax
fld dword [0x454bd8]
mov al, byte [ebp + 0xc]
mov byte [esi + 0x40], al
fstp dword [esi + 0x50]
fld dword [0x454bdc]
add esi, 0x44
fstp dword [esi + 0x10]
mov ecx, esi
fld dword [0x454be0]
mov dword [esi], edi
fstp dword [esi + 0x14]
mov dword [esi + 4], edi
mov dword [esi + 8], 0x11
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
call fcn.0040c600
mov byte [ebp - 4], 2
mov ecx, dword [esi + 8]
xor eax, eax
xor edx, edx
div ecx
mov eax, dword [esi]
mov dword [ebp + 0xc], edi
mov ebx, edx
cmp eax, edi
je 0x40f060
mov eax, dword [eax + ebx*4]
cmp eax, edi
je 0x40ef80
cmp dword [eax + 0xc], edi
jne 0x40ef79
cmp dword [eax], edi
je 0x40ef8a
mov eax, dword [eax + 8]
cmp eax, edi
jne 0x40ef70
push edi
lea ecx, [ebp + 0xc]
push ecx
call fcn.0041f6b0
mov edx, dword [0x45d48c]
mov eax, dword [edx + 0xc]
mov ecx, 0x45d48c
mov dword [ebp - 0x10], 1
call eax
add eax, 0x10
mov dword [ebp + 0xc], eax
mov edi, 0xa8
mov byte [ebp - 4], 3
call fcn.004032e0
test eax, eax
je 0x40efc4
push eax
mov eax, edi
lea edi, [ebp + 0xc]
call fcn.00403490
mov byte [ebp - 4], 4
mov ecx, dword [esi + 8]
mov edi, 1
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [esi]
mov ebx, edx
test eax, eax
je 0x40f07b
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x40f000
lea esp, [esp]
cmp dword [eax + 0xc], edi
jne 0x40eff9
cmp dword [eax], edi
je 0x40f00a
mov eax, dword [eax + 8]
test eax, eax
jne 0x40eff0
push edi
lea ecx, [ebp - 0x10]
push ecx
call fcn.0041f6b0
mov edi, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
add eax, 4
add edi, 0xfffffff0
sub ebx, 0x10
mov dword [ebp - 0x10], eax
cmp edi, ebx
je 0x40f0a5
cmp dword [ebx + 0xc], 0
jl 0x40f095
mov edx, dword [edi]
cmp edx, dword [ebx]
jne 0x40f095
mov eax, edi
call fcn.00403230
mov dword [ebp - 0x14], eax
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f053
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add ecx, 0x10
mov dword [edx], ecx
jmp 0x40f0a5
push 1
push ecx
push esi
call fcn.0040c680
test al, al
jne 0x40ef80
push 0x8007000e
call fcn.004036a0
push edi
push ecx
push esi
call fcn.0040c680
test al, al
jne 0x40f000
push 0x8007000e
call fcn.004036a0
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.004036c0
mov byte [ebp - 4], 2
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f0c2
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, dword [0x45d48c]
mov edx, dword [eax + 0xc]
mov ebx, 2
mov ecx, 0x45d48c
mov dword [ebp - 0x14], ebx
call edx
add eax, 0x10
mov dword [ebp + 0xc], eax
mov edi, 0xa9
mov byte [ebp - 4], 5
call fcn.004032e0
test eax, eax
je 0x40f0fc
push eax
mov eax, edi
lea edi, [ebp + 0xc]
call fcn.00403490
mov byte [ebp - 4], 6
mov ecx, dword [esi + 8]
xor edx, edx
mov eax, ebx
div ecx
mov eax, dword [esi]
mov edi, edx
test eax, eax
je 0x40f187
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40f128
cmp dword [eax + 0xc], ebx
jne 0x40f121
cmp dword [eax], ebx
je 0x40f135
mov eax, dword [eax + 8]
test eax, eax
jne 0x40f118
push 2
lea eax, [ebp - 0x14]
push eax
mov ebx, edi
call fcn.0041f6b0
mov ecx, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
add eax, 4
lea edi, [ecx - 0x10]
sub ebx, 0x10
mov dword [ebp - 0x10], eax
cmp edi, ebx
je 0x40f1ab
cmp dword [ebx + 0xc], 0
jl 0x40f19e
mov edx, dword [edi]
cmp edx, dword [ebx]
jne 0x40f19e
mov eax, edi
call fcn.00403230
mov dword [ebp - 0x14], eax
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f17a
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add ecx, 0x10
mov dword [edx], ecx
jmp 0x40f1ab
push 1
push ecx
push esi
call fcn.0040c680
test al, al
jne 0x40f128
push 0x8007000e
call fcn.004036a0
mov eax, dword [ebp - 0x10]
mov ebx, dword [ecx - 0xc]
push ecx
push eax
call fcn.004036c0
mov byte [ebp - 4], 2
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f1c8
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, dword [0x45d48c]
mov edx, dword [eax + 0xc]
mov ebx, 3
mov ecx, 0x45d48c
mov dword [ebp - 0x14], ebx
call edx
add eax, 0x10
mov dword [ebp + 0xc], eax
mov edi, 0xaa
mov byte [ebp - 4], 7
call fcn.004032e0
test eax, eax
je 0x40f202
push eax
mov eax, edi
lea edi, [ebp + 0xc]
call fcn.00403490
mov byte [ebp - 4], 8
mov ecx, dword [esi + 8]
xor edx, edx
mov eax, ebx
div ecx
mov eax, dword [esi]
mov edi, edx
test eax, eax
je 0x40f28f
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40f230
mov edi, edi
cmp dword [eax + 0xc], ebx
jne 0x40f229
cmp dword [eax], ebx
je 0x40f23d
mov eax, dword [eax + 8]
test eax, eax
jne 0x40f220
push 3
lea eax, [ebp - 0x14]
push eax
mov ebx, edi
call fcn.0041f6b0
mov ecx, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
add eax, 4
lea edi, [ecx - 0x10]
sub ebx, 0x10
mov dword [ebp - 0x10], eax
cmp edi, ebx
je 0x40f2b3
cmp dword [ebx + 0xc], 0
jl 0x40f2a6
mov edx, dword [edi]
cmp edx, dword [ebx]
jne 0x40f2a6
mov eax, edi
call fcn.00403230
mov dword [ebp - 0x14], eax
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f282
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add ecx, 0x10
mov dword [edx], ecx
jmp 0x40f2b3
push 1
push ecx
push esi
call fcn.0040c680
test al, al
jne 0x40f230
push 0x8007000e
call fcn.004036a0
mov eax, dword [ebp - 0x10]
mov ebx, dword [ecx - 0xc]
push ecx
push eax
call fcn.004036c0
mov byte [ebp - 4], 2
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f2d0
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, dword [0x45d48c]
mov edx, dword [eax + 0xc]
mov ebx, 4
mov ecx, 0x45d48c
mov dword [ebp - 0x14], ebx
call edx
add eax, 0x10
mov dword [ebp + 0xc], eax
mov edi, 0xae
mov byte [ebp - 4], 9
call fcn.004032e0
test eax, eax
je 0x40f30a
push eax
mov eax, edi
lea edi, [ebp + 0xc]
call fcn.00403490
mov byte [ebp - 4], 0xa
mov ecx, dword [esi + 8]
xor edx, edx
mov eax, ebx
div ecx
mov eax, dword [esi]
mov edi, edx
test eax, eax
je 0x40f395
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40f336
cmp dword [eax + 0xc], ebx
jne 0x40f32f
cmp dword [eax], ebx
je 0x40f343
mov eax, dword [eax + 8]
test eax, eax
jne 0x40f326
push 4
lea eax, [ebp - 0x14]
push eax
mov ebx, edi
call fcn.0041f6b0
mov ecx, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
add eax, 4
lea edi, [ecx - 0x10]
sub ebx, 0x10
mov dword [ebp - 0x10], eax
cmp edi, ebx
je 0x40f3b9
cmp dword [ebx + 0xc], 0
jl 0x40f3ac
mov edx, dword [edi]
cmp edx, dword [ebx]
jne 0x40f3ac
mov eax, edi
call fcn.00403230
mov dword [ebp - 0x14], eax
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f388
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add ecx, 0x10
mov dword [edx], ecx
jmp 0x40f3b9
push 1
push ecx
push esi
call fcn.0040c680
test al, al
jne 0x40f336
push 0x8007000e
call fcn.004036a0
mov eax, dword [ebp - 0x10]
mov ebx, dword [ecx - 0xc]
push ecx
push eax
call fcn.004036c0
mov byte [ebp - 4], 2
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f3d6
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, dword [0x45d48c]
mov edx, dword [eax + 0xc]
mov ebx, 5
mov ecx, 0x45d48c
mov dword [ebp - 0x14], ebx
call edx
add eax, 0x10
mov dword [ebp + 0xc], eax
mov edi, 0xab
mov byte [ebp - 4], 0xb
call fcn.004032e0
test eax, eax
je 0x40f410
push eax
mov eax, edi
lea edi, [ebp + 0xc]
call fcn.00403490
mov byte [ebp - 4], 0xc
mov ecx, dword [esi + 8]
xor edx, edx
mov eax, ebx
div ecx
mov eax, dword [esi]
mov edi, edx
test eax, eax
je 0x40f49f
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40f440
lea esp, [esp]
cmp dword [eax + 0xc], ebx
jne 0x40f439
cmp dword [eax], ebx
je 0x40f44d
mov eax, dword [eax + 8]
test eax, eax
jne 0x40f430
push 5
lea eax, [ebp - 0x14]
push eax
mov ebx, edi
call fcn.0041f6b0
mov ecx, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
add eax, 4
lea edi, [ecx - 0x10]
sub ebx, 0x10
mov dword [ebp - 0x10], eax
cmp edi, ebx
je 0x40f4c3
cmp dword [ebx + 0xc], 0
jl 0x40f4b6
mov edx, dword [edi]
cmp edx, dword [ebx]
jne 0x40f4b6
mov eax, edi
call fcn.00403230
mov dword [ebp - 0x14], eax
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f492
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add ecx, 0x10
mov dword [edx], ecx
jmp 0x40f4c3
push 1
push ecx
push esi
call fcn.0040c680
test al, al
jne 0x40f440
push 0x8007000e
call fcn.004036a0
mov eax, dword [ebp - 0x10]
mov ebx, dword [ecx - 0xc]
push ecx
push eax
call fcn.004036c0
mov byte [ebp - 4], 2
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f4e0
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, dword [0x45d48c]
mov edx, dword [eax + 0xc]
mov ebx, 6
mov ecx, 0x45d48c
mov dword [ebp - 0x14], ebx
call edx
add eax, 0x10
mov dword [ebp + 0xc], eax
mov edi, 0xaf
mov byte [ebp - 4], 0xd
call fcn.004032e0
test eax, eax
je 0x40f51a
push eax
mov eax, edi
lea edi, [ebp + 0xc]
call fcn.00403490
mov byte [ebp - 4], 0xe
mov ecx, dword [esi + 8]
xor edx, edx
mov eax, ebx
div ecx
mov eax, dword [esi]
mov edi, edx
test eax, eax
je 0x40f5a5
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40f546
cmp dword [eax + 0xc], ebx
jne 0x40f53f
cmp dword [eax], ebx
je 0x40f553
mov eax, dword [eax + 8]
test eax, eax
jne 0x40f536
push 6
lea eax, [ebp - 0x14]
push eax
mov ebx, edi
call fcn.0041f6b0
mov ecx, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
add eax, 4
lea edi, [ecx - 0x10]
sub ebx, 0x10
mov dword [ebp - 0x10], eax
cmp edi, ebx
je 0x40f5c9
cmp dword [ebx + 0xc], 0
jl 0x40f5bc
mov edx, dword [edi]
cmp edx, dword [ebx]
jne 0x40f5bc
mov eax, edi
call fcn.00403230
mov dword [ebp - 0x14], eax
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f598
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add ecx, 0x10
mov dword [edx], ecx
jmp 0x40f5c9
push 1
push ecx
push esi
call fcn.0040c680
test al, al
jne 0x40f546
push 0x8007000e
call fcn.004036a0
mov eax, dword [ebp - 0x10]
mov ebx, dword [ecx - 0xc]
push ecx
push eax
call fcn.004036c0
mov byte [ebp - 4], 2
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f5e6
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, dword [0x45d48c]
mov edx, dword [eax + 0xc]
mov ebx, 7
mov ecx, 0x45d48c
mov dword [ebp - 0x14], ebx
call edx
add eax, 0x10
mov dword [ebp + 0xc], eax
mov edi, 0xb1
mov byte [ebp - 4], 0xf
call fcn.004032e0
test eax, eax
je 0x40f620
push eax
mov eax, edi
lea edi, [ebp + 0xc]
call fcn.00403490
mov byte [ebp - 4], 0x10
mov ecx, dword [esi + 8]
xor edx, edx
mov eax, ebx
div ecx
mov eax, dword [esi]
mov edi, edx
test eax, eax
je 0x40f6af
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40f650
lea esp, [esp]
cmp dword [eax + 0xc], ebx
jne 0x40f649
cmp dword [eax], ebx
je 0x40f65d
mov eax, dword [eax + 8]
test eax, eax
jne 0x40f640
push 7
lea eax, [ebp - 0x14]
push eax
mov ebx, edi
call fcn.0041f6b0
mov ecx, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
add eax, 4
lea edi, [ecx - 0x10]
sub ebx, 0x10
mov dword [ebp - 0x10], eax
cmp edi, ebx
je 0x40f6d3
cmp dword [ebx + 0xc], 0
jl 0x40f6c6
mov edx, dword [edi]
cmp edx, dword [ebx]
jne 0x40f6c6
mov eax, edi
call fcn.00403230
mov dword [ebp - 0x14], eax
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f6a2
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add ecx, 0x10
mov dword [edx], ecx
jmp 0x40f6d3
push 1
push ecx
push esi
call fcn.0040c680
test al, al
jne 0x40f650
push 0x8007000e
call fcn.004036a0
mov eax, dword [ebp - 0x10]
mov ebx, dword [ecx - 0xc]
push ecx
push eax
call fcn.004036c0
mov byte [ebp - 4], 2
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f6f0
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, dword [0x45d48c]
mov edx, dword [eax + 0xc]
mov ebx, 8
mov ecx, 0x45d48c
mov dword [ebp - 0x14], ebx
call edx
add eax, 0x10
mov dword [ebp + 0xc], eax
mov edi, 0xac
mov byte [ebp - 4], 0x11
call fcn.004032e0
test eax, eax
je 0x40f72a
push eax
mov eax, edi
lea edi, [ebp + 0xc]
call fcn.00403490
mov byte [ebp - 4], 0x12
mov ecx, dword [esi + 8]
xor edx, edx
mov eax, ebx
div ecx
mov eax, dword [esi]
mov edi, edx
test eax, eax
je 0x40f7b5
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40f756
cmp dword [eax + 0xc], ebx
jne 0x40f74f
cmp dword [eax], ebx
je 0x40f763
mov eax, dword [eax + 8]
test eax, eax
jne 0x40f746
push 8
lea eax, [ebp - 0x14]
push eax
mov ebx, edi
call fcn.0041f6b0
mov ecx, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
add eax, 4
lea edi, [ecx - 0x10]
sub ebx, 0x10
mov dword [ebp - 0x10], eax
cmp edi, ebx
je 0x40f7d9
cmp dword [ebx + 0xc], 0
jl 0x40f7cc
mov edx, dword [edi]
cmp edx, dword [ebx]
jne 0x40f7cc
mov eax, edi
call fcn.00403230
mov dword [ebp - 0x14], eax
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f7a8
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add ecx, 0x10
mov dword [edx], ecx
jmp 0x40f7d9
push 1
push ecx
push esi
call fcn.0040c680
test al, al
jne 0x40f756
push 0x8007000e
call fcn.004036a0
mov eax, dword [ebp - 0x10]
mov ebx, dword [ecx - 0xc]
push ecx
push eax
call fcn.004036c0
mov byte [ebp - 4], 2
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f7f6
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, dword [0x45d48c]
mov edx, dword [eax + 0xc]
mov ebx, 9
mov ecx, 0x45d48c
mov dword [ebp - 0x14], ebx
call edx
add eax, 0x10
mov dword [ebp + 0xc], eax
mov edi, 0xb0
mov byte [ebp - 4], 0x13
call fcn.004032e0
test eax, eax
je 0x40f830
push eax
mov eax, edi
lea edi, [ebp + 0xc]
call fcn.00403490
mov byte [ebp - 4], 0x14
mov ecx, dword [esi + 8]
xor edx, edx
mov eax, ebx
div ecx
mov eax, dword [esi]
mov edi, edx
test eax, eax
je 0x40f8bf
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40f860
lea esp, [esp]
cmp dword [eax + 0xc], ebx
jne 0x40f859
cmp dword [eax], ebx
je 0x40f86d
mov eax, dword [eax + 8]
test eax, eax
jne 0x40f850
push 9
lea eax, [ebp - 0x14]
push eax
mov ebx, edi
call fcn.0041f6b0
mov ecx, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
add eax, 4
lea edi, [ecx - 0x10]
sub ebx, 0x10
mov dword [ebp - 0x10], eax
cmp edi, ebx
je 0x40f8e3
cmp dword [ebx + 0xc], 0
jl 0x40f8d6
mov edx, dword [edi]
cmp edx, dword [ebx]
jne 0x40f8d6
mov eax, edi
call fcn.00403230
mov dword [ebp - 0x14], eax
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f8b2
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add ecx, 0x10
mov dword [edx], ecx
jmp 0x40f8e3
push 1
push ecx
push esi
call fcn.0040c680
test al, al
jne 0x40f860
push 0x8007000e
call fcn.004036a0
mov eax, dword [ebp - 0x10]
mov ebx, dword [ecx - 0xc]
push ecx
push eax
call fcn.004036c0
mov byte [ebp - 4], 2
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f900
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, dword [0x45d48c]
mov edx, dword [eax + 0xc]
mov ebx, 0xa
mov ecx, 0x45d48c
mov dword [ebp - 0x14], ebx
call edx
add eax, 0x10
mov dword [ebp + 0xc], eax
mov edi, 0xad
mov byte [ebp - 4], 0x15
call fcn.004032e0
test eax, eax
je 0x40f93a
push eax
mov eax, edi
lea edi, [ebp + 0xc]
call fcn.00403490
mov byte [ebp - 4], 0x16
mov ecx, dword [esi + 8]
xor edx, edx
mov eax, ebx
div ecx
mov eax, dword [esi]
mov edi, edx
test eax, eax
je 0x40f9bf
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40f966
cmp dword [eax + 0xc], ebx
jne 0x40f95f
cmp dword [eax], ebx
je 0x40f973
mov eax, dword [eax + 8]
test eax, eax
jne 0x40f956
push 0xa
lea eax, [ebp - 0x14]
push eax
mov ebx, edi
call fcn.0041f6b0
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 4]
lea ebx, [eax + 4]
add edi, 0xfffffff0
sub esi, 0x10
cmp edi, esi
je 0x40f9e3
cmp dword [esi + 0xc], 0
jl 0x40f9d6
mov ecx, dword [edi]
cmp ecx, dword [esi]
jne 0x40f9d6
mov eax, edi
call fcn.00403230
mov dword [ebp - 0x14], eax
lea eax, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [eax], edx
dec edx
test edx, edx
jg 0x40f9b5
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebx], eax
jmp 0x40f9e3
push 1
push ecx
push esi
call fcn.0040c680
test al, al
jne 0x40f966
push 0x8007000e
call fcn.004036a0
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov ebx, dword [eax - 0xc]
call fcn.004036c0
mov byte [ebp - 4], 2
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fa00
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8