Function at 0x4047f0
Capabilities:
Get keyboard layout
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
push ebx
push esi
cmp dword [ebp - 0xd4], 0x4c
jle 0x404837
mov eax, 6
sub eax, dword [0x410030]
sub eax, dword [0x41002c]
add eax, 0xd
mov word [ebp - 0x120], ax
mov ecx, dword [ebp - 0xbc]
add ecx, 0x26
xor ecx, 0x8b
xor ecx, 0x25
mov byte [ebp - 0x111], cl
mov byte [0x410034], 0x1a
mov dword [ebp - 0x174], 0xb
mov edx, dword [0x410028]
add edx, dword [0x410024]
add edx, dword [ebp - 0xf8]
mov dword [ebp - 0x1c4], edx
mov eax, 0x17
sub eax, dword [0x410030]
sub eax, 0x47
or eax, dword [0x410020]
or eax, 9
mov byte [ebp - 0xa1], al
movzx ecx, byte [ebp - 0x121]
mov dword [ebp - 0x128], ecx
movzx edx, byte [ebp - 0x1c5]
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x14], 0xd
movzx eax, word [ebp - 0x20]
mov ecx, dword [ebp - 0xb8]
add ecx, 0x29
and eax, ecx
mov byte [ebp - 0xcd], al
mov edx, 0xc
sub edx, dword [ebp - 0x14]
movzx eax, byte [ebp - 0x25]
and edx, eax
or edx, dword [ebp - 0x268]
mov byte [ebp - 0x1b1], dl
movzx ecx, word [ebp - 0x260]
movzx edx, byte [ebp - 0xa1]
add edx, 0x62
xor ecx, edx
movzx eax, word [ebp - 0xe4]
sub eax, ecx
mov word [ebp - 0xe4], ax
movzx ecx, byte [ebp - 0x25]
movzx edx, byte [ebp - 0x121]
lea eax, [ecx + edx + 0x7d]
mov byte [ebp - 0x111], al
movzx ecx, byte [ebp - 0xed]
mov edx, dword [ebp - 0x268]
lea eax, [edx + ecx + 0x48]
mov byte [ebp - 0xf], al
mov ecx, dword [ebp - 0x128]
push ecx
mov edx, dword [ebp - 0x1cc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00401280
add eax, 0x12
movzx edx, word [ebp - 0x1b0]
sub eax, edx
mov dword [ebp - 0xb8], eax
movzx eax, byte [ebp - 0xa1]
sub eax, 0x14
sub eax, dword [ebp - 0xd4]
mov word [ebp - 0x1a0], ax
mov ecx, dword [ebp - 0x268]
add ecx, dword [ebp - 0x14]
movzx edx, word [ebp - 0xa0]
add edx, 0x61
sub edx, dword [ebp - 0x1cc]
xor ecx, edx
mov byte [ebp - 0xa1], cl
movzx eax, byte [ebp - 0x25]
sub eax, 0xd
sub eax, dword [ebp - 0x1cc]
and eax, 0x96
mov byte [ebp - 0x122], al
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx - 0xe]
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1cc], ecx
mov edx, 0x7d77
mov word [ebp - 0x2c], dx
mov eax, dword [ebp - 0x11c]
add eax, 6
mov dword [ebp - 0x128], eax
mov ecx, dword [ebp - 0x1cc]
or ecx, 0x3f
mov dword [ebp - 0xd4], ecx
mov edx, 0x2d
mov word [ebp - 0x1cc], dx
mov dword [ebp - 0x17c], 1
movzx eax, byte [ebp - 0x121]
mov ecx, 0x56
sub ecx, eax
movzx edx, word [ebp - 0xa0]
add ecx, edx
mov dword [ebp - 0x9c], ecx
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1bc], 0x1a
mov ecx, 0x2a
sub ecx, dword [ebp - 0xd4]
sub ecx, 0x3b
mov dword [ebp - 0x274], ecx
movzx edx, word [ebp - 0x100]
and edx, 0x19
movzx eax, word [ebp - 0x110]
sub eax, edx
mov word [ebp - 0x110], ax
movzx ecx, word [ebp - 0xe8]
mov edx, 0x3f
sub edx, dword [ebp - 0xb0]
sub edx, 0x7f
and ecx, edx
mov byte [ebp - 0xf9], cl
mov dword [0x410030], 7
mov dword [ebp - 0x1ac], 0xcf
mov dword [0x410034], 0x4e
mov dword [ebp - 0x15c], 0x58
mov dword [ebp - 0x1ac], 0xfffffff3
mov eax, 0xfffffff2
sub eax, dword [ebp - 0x108]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0xf8]
add ecx, 0x23
mov word [ebp - 0x264], cx
movzx edx, word [ebp - 0x260]
mov eax, 0x3d
sub eax, edx
and eax, dword [ebp - 0x14]
mov dword [ebp - 0x25c], eax
movzx ecx, byte [ebp - 0xed]
movzx edx, word [ebp - 0x198]
add edx, dword [0x410044]
add edx, ecx
mov dword [0x410044], edx
mov dword [ebp - 0x128], 0x59
mov eax, dword [ebp - 0xf8]
add eax, 0x51
sub eax, dword [ebp - 0xd4]
mov dword [ebp - 0x9c], eax
mov ecx, dword [ebp - 0x268]
mov dword [ebp - 0x64], ecx
movzx edx, word [ebp - 0x264]
and edx, dword [ebp - 0x268]
and edx, 0x3b
mov dword [ebp - 0xf8], edx
mov dword [0x410060], 0x3d
push 0x3b
call dword [sym.imp.USER32.dll_UpdateWindow]
sub eax, 0x64
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x128], eax
mov ecx, dword [ebp - 0x1cc]
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp - 0x268]
sub edx, dword [ebp - 0x1cc]
xor edx, dword [ebp - 0x258]
mov dword [ebp - 0x11c], edx
mov eax, 0x5e
sub eax, dword [ebp - 0x1cc]
mov dword [ebp - 0xf8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xb0]
lea eax, [edx + ecx - 0x35]
sub eax, dword [ebp - 0xd4]
mov word [ebp - 0x24], ax
movzx ebx, byte [ebp - 0x112]
add ebx, 0x1b
mov ecx, dword [ebp - 0x1cc]
push ecx
mov edx, dword [ebp - 0xd4]
push edx
mov eax, dword [ebp - 0xd4]
push eax
call fcn.00404730
sub eax, 0xd
sub eax, dword [ebp - 0x1cc]
xor ebx, eax
mov byte [ebp - 0x122], bl
movzx ecx, byte [ebp - 0xf]
mov edx, 0xe
sub edx, ecx
mov eax, dword [ebp - 0x268]
lea ecx, [edx + eax - 0x4a]
sub ecx, dword [ebp - 0x128]
mov byte [ebp - 0xf9], cl
mov edx, dword [ebp - 0xd4]
mov dword [ebp - 0x158], edx
mov eax, 0x51
sub eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd4]
lea edx, [eax + ecx + 0x66]
mov byte [ebp - 0xf], dl
mov eax, 0x61
sub eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0xac], 0
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 0x270], ecx
mov edx, 0xffffffd3
sub edx, dword [0x410030]
movzx eax, word [ebp - 0x1a0]
add eax, edx
mov word [ebp - 0x1a0], ax
mov esi, dword [str._fM05]
add esi, dword [ebp - 0xc8]
mov ecx, dword [0x41002c]
push ecx
push 0x20
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
sub esi, eax
mov dword [ebp - 0x1c], esi
movzx dx, byte [ebp - 0x121]
mov word [ebp - 0xc4], dx
mov eax, 0x410028
sub eax, 0x41
mov ecx, dword [eax]
mov dword [0x410028], ecx
mov edx, 0x46fd
mov word [ebp - 8], dx
mov eax, 0x55
sub eax, dword [0x410020]
mov dword [0x41002c], eax
movzx esi, byte [ebp - 0x121]
add esi, 0x1d
mov ecx, dword [ebp - 0x128]
push ecx
call fcn.00402250
add eax, 0x16
and esi, eax
mov word [ebp - 0xa0], si
mov dword [ebp - 0x1cc], 0x48
mov dword [ebp - 0xd4], 0x1e
movzx esi, byte [ebp - 0xed]
mov edx, dword [ebp - 0x128]
push edx
mov eax, dword [ebp - 0xd4]
push eax
mov ecx, dword [ebp - 0xd4]
push ecx
mov edx, dword [ebp - 0x128]
push edx
call fcn.004034d0
sub esi, eax
movzx eax, byte [ebp - 0xcd]
and esi, eax
mov dword [ebp - 0x11c], esi
push 0
push 0
call fcn.004038f0
mov dword [0x4355c0], eax
movzx ecx, byte [ebp - 0x1b1]
sub ecx, 0x20
mov dword [ebp - 0x11c], ecx
movzx edx, byte [ebp - 0xf]
mov eax, dword [ebp - 0x128]
sub eax, edx
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x268]
mov dword [ebp - 0x1cc], ecx
movzx edx, byte [ebp - 0xed]
movzx eax, word [ebp - 0x1d8]
add eax, 0x1e
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0xd4]
and eax, ecx
xor edx, eax
mov byte [ebp - 0x1c5], dl
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp - 0xd4]
lea ecx, [eax + edx + 0x57]
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0x1cc], edx
movzx eax, word [ebp - 0x24c]
movzx ecx, word [ebp - 0xec]
add eax, ecx
mov edx, dword [0x410044]
sub edx, eax
mov dword [0x410044], edx
movzx eax, byte [ebp - 0x26]
mov ecx, dword [ebp - 0x268]
lea edx, [ecx + eax - 0xa3]
and edx, dword [ebp - 0x9c]
mov byte [ebp - 0x122], dl
mov dword [ebp - 0x26c], 0
movzx eax, word [ebp - 0x18]
mov ecx, 0x3d
sub ecx, eax
movzx edx, byte [ebp - 0xa1]
imul edx, ecx
mov byte [ebp - 0xa1], dl
mov eax, 0x56
sub eax, dword [ebp - 0x268]
movzx ecx, word [ebp - 0xe8]
sub eax, ecx
movzx edx, byte [ebp - 0x122]
sub eax, edx
add eax, dword [ebp - 0xb0]
mov byte [ebp - 0x25], al
movzx eax, byte [ebp - 0xa1]
sub eax, dword [ebp - 0x128]
movzx ecx, word [ebp - 0xe4]
add eax, ecx
mov dword [ebp - 0x1ac], eax
mov edx, dword [0x410028]
mov dword [str._fM05], edx
movzx eax, byte [ebp - 0xf9]
add eax, 0x29
mov dword [0x410034], eax
mov dword [ebp - 0xe0], 0x56
mov ecx, dword [0x410030]
sub ecx, 0x2c
sub ecx, dword [0x410034]
and ecx, 0x27
mov word [ebp - 0x1d8], cx
movzx esi, byte [ebp - 0xa1]
mov edx, dword [0x410028]
push edx
mov eax, dword [0x410030]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
add esi, eax
and esi, 0x1b
and esi, 0x1f
mov word [ebp - 0xa0], si
push 0x23
mov ecx, dword [0x410024]
push ecx
call dword [sym.imp.GDI32.dll_GetClipBox]
add eax, 0xf
mov dword [0x410028], eax
mov edx, dword [str._fM05]
mov dword [0x410030], edx
mov dword [ebp - 0x7c], 0x51
movzx eax, word [ebp - 0x10c]
mov ecx, dword [0x41002c]
sub ecx, eax
sub ecx, dword [ebp - 0x258]
add ecx, dword [0x410020]
mov word [ebp - 0x1d8], cx
movzx edx, byte [ebp - 0xf9]
movzx eax, byte [ebp - 0xf]
and edx, eax
movzx ecx, word [ebp - 0x1d8]
sub ecx, edx
mov word [ebp - 0x1d8], cx
mov edx, dword [ebp - 0x25c]
and edx, 0x10
and edx, dword [0x410028]
mov byte [ebp - 0xcd], dl
movzx eax, word [ebp - 0x264]
add eax, 7
and eax, 0x4b
movzx ecx, word [ebp - 0x198]
xor ecx, eax
mov word [ebp - 0x198], cx
mov dword [str._fM05], 0x11
mov dword [ebp - 0xf4], 0x89f2
movzx edx, word [ebp - 0xc0]
mov eax, dword [0x41002c]
lea ecx, [edx + eax + 0x79]
mov word [ebp - 0xa0], cx
movzx edx, byte [ebp - 0xf9]
mov eax, dword [0x410034]
sub eax, edx
add eax, 0x34
xor eax, 0x57
mov word [ebp - 0x1d8], ax
movzx ecx, byte [ebp - 0xed]
sub ecx, 0xa
mov edx, dword [0x410030]
mov eax, dword [0x410028]
lea edx, [eax + edx - 0xc]
xor ecx, edx
mov byte [ebp - 0x111], cl
mov dword [0x410028], 0x48
movzx eax, word [ebp - 0xc0]
add eax, 0xc
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x1e
or ecx, dword [ebp - 0xb0]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x1d4], 0
mov edx, dword [ebp - 0x268]
mov dword [ebp - 0x128], edx
movzx eax, word [ebp - 0xcc]
mov ecx, dword [ebp - 0x128]
lea ebx, [eax + ecx + 3]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xd4]
push eax
mov ecx, dword [ebp - 0xd4]
push ecx
push 0x4a
mov edx, dword [ebp - 0xd4]
push edx
push 0x1d
mov eax, dword [ebp - 0x1cc]
push eax
mov ecx, dword [ebp - 0x268]
push ecx
mov edx, dword [ebp - 0xd4]
push edx
call dword [sym.imp.GDI32.dll_Pie]
sub ebx, eax
mov byte [ebp - 0xe], bl
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x9c]
add ecx, 0xe
sub ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x14]
sub edx, 0x46
xor ecx, edx
mov byte [ebp - 0x1b1], cl
lea eax, [ebp - 0x128]
sub eax, 0x17
movzx ecx, word [eax]
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x268]
mov dword [ebp - 0x170], edx
mov eax, dword [ebp - 0xc8]
sub eax, 0x47
sub eax, dword [ebp - 0x1cc]
or eax, 0x10
mov byte [ebp - 0x111], al
mov dword [ebp - 0x1d0], 0
movzx ecx, word [ebp - 0x19c]
movzx edx, byte [ebp - 0xd]
lea eax, [ecx + edx + 0x2c]
movzx ecx, word [ebp - 0x104]
sub ecx, eax
mov word [ebp - 0x104], cx
mov edx, dword [0x410024]
add edx, 0x55
and edx, 0x3a
xor edx, 0x19
mov word [ebp - 0xc0], dx
mov dword [0x410048], 0x38
mov eax, dword [ebp - 0x1c4]
add eax, dword [0x410020]
sub eax, dword [0x410024]
sub eax, dword [0x410034]
mov word [ebp - 0x110], ax
movzx ecx, byte [ebp - 0xed]
mov edx, dword [str._fM05]
sub edx, ecx
add edx, 0x64
mov dword [ebp - 0x274], edx
movzx ebx, word [ebp - 0x120]
sub ebx, dword [ebp - 0x25c]
push 0xc
push 0x58
mov eax, dword [0x410024]
push eax
call dword [sym.imp.USER32.dll_ChildWindowFromPoint]
movzx ecx, word [ebp - 0x120]
lea edx, [eax + ecx + 0x11]
xor ebx, edx
mov byte [ebp - 0xe], bl
movzx eax, byte [ebp - 0x26]
mov ecx, dword [0x410034]
sub ecx, eax
sub ecx, 0x5b
mov dword [ebp - 0xc], ecx
mov edx, dword [str._fM05]
add edx, dword [ebp - 0xf8]
mov dword [str._fM05], edx
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x268]
lea edx, [ecx + eax + 0x35]
mov dword [ebp - 0x258], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0xb0]
add ecx, 0xc
xor eax, ecx
mov byte [ebp - 0x111], al
mov edx, 0x48
sub edx, dword [ebp - 0x268]
sub edx, dword [ebp - 0xe0]
sub edx, 0xb
mov word [ebp - 0x20], dx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov ecx, dword [0x41004c]
sub ecx, 0x2a
mov dword [0x41004c], ecx
mov edx, dword [ebp - 0x1cc]
sub edx, 0x23
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x258], edx
mov eax, dword [str.25_nF_nLD.ULaXDU]
add eax, dword [ebp - 0x1cc]
mov dword [str.25_nF_nLD.ULaXDU], eax
mov ecx, 0x4d
mov word [ebp - 0xd4], cx
mov edx, dword [ebp - 0xd4]
add edx, 0xae
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x1c]
lea edx, [ecx + eax - 0x50]
xor edx, 0x56
mov word [ebp - 0x110], dx
movzx eax, byte [ebp - 0xf9]
add eax, dword [ebp - 0x1cc]
xor eax, 3
mov dword [ebp - 0x25c], eax
mov ecx, 0x55
sub ecx, dword [ebp - 0x1cc]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x1cc]
mov dword [ebp - 0x14], edx
mov byte [ebp - 0x128], 0x60
mov dword [ebp - 0x8c], 0x51
mov eax, 0x4e2a
mov word [ebp - 0x290], ax
movzx ecx, byte [ebp - 0x1c5]
add ecx, dword [ebp - 0x274]
movzx edx, word [ebp - 0xc0]
mov eax, 0x23
sub eax, edx
and ecx, eax
and ecx, 0x14
mov byte [ebp - 0x275], cl
mov dword [ebp - 0x1dc], 1
mov dword [ebp - 0xd4], 0x48
mov ecx, dword [ebp - 0xd4]
and ecx, 0x36
mov dword [ebp - 0x1cc], ecx
mov edx, dword [ebp - 0x1cc]
sub edx, 4
mov dword [ebp - 0x25c], edx
mov dword [0x410048], 0x57
movzx eax, word [ebp - 0xcc]
movzx ecx, byte [ebp - 0xcd]
lea edx, [eax + ecx - 0x1a]
mov dword [ebp - 0x258], edx
mov dword [ebp - 0x268], 0x49
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x5c], eax
movzx ecx, word [ebp - 0xcc]
mov dword [ebp - 0x1cc], ecx
movzx edx, byte [ebp - 0x1cc]
mov dword [ebp - 0x1cc], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0xd4], 0x33
mov ecx, dword [ebp - 0x270]
add ecx, dword [ebp - 0x1dc]
mov dword [ebp - 0x1d0], ecx
mov dword [ebp - 0x178], 0xb
mov dword [ebp - 0xb8], 0x51
mov edx, dword [ebp - 0xd4]
sub edx, 0x21
mov dword [ebp - 0x1ac], edx
movzx eax, word [ebp - 0x260]
sub eax, dword [ebp - 0x1cc]
movzx ecx, byte [ebp - 0x111]
sub eax, ecx
xor eax, dword [ebp - 0x268]
mov word [ebp - 0xe8], ax
movzx edx, byte [ebp - 0xed]
mov eax, dword [ebp - 0x14]
sub eax, edx
or eax, 0x2d
movzx ecx, word [ebp - 0x260]
add ecx, eax
mov word [ebp - 0x260], cx
movzx edx, word [ebp - 0x104]
add edx, 0xa4
mov byte [ebp - 0x275], dl
mov eax, 0x58
mov word [ebp - 0x268], ax
mov ecx, 0xff77
mov word [ebp - 0x27c], cx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x1cc]
mov dword [ebp - 0x11c], edx
movzx eax, word [ebp - 0x20]
mov ecx, 0x1a
sub ecx, eax
mov dword [ebp - 0x274], ecx
movzx edx, word [ebp - 0x11]
mov dword [ebp - 0x1cc], edx
mov dword [ebp - 0x80], 0x26
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x268]
lea edx, [ecx + eax - 0x3a]
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x14], 0x61
mov dword [ebp - 0x1cc], 0xf
cmp dword [ebp - 0xe0], 0x15
ja 0x40543e
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0xd4], 6
jmp 0x405467
mov ecx, dword [ebp - 0x1cc]
sub ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x14]
lea eax, [ecx + edx - 0x47]
mov word [ebp - 0xe8], ax
mov ecx, dword [ebp - 0x268]
sub ecx, dword [ebp - 0xb0]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 0x42
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x268], edx
mov eax, dword [ebp - 0x14]
add eax, 0x23
sub eax, dword [ebp - 0x1cc]
sub eax, 0x58
mov byte [ebp - 0x275], al
mov ecx, dword [ebp - 0x268]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx - 0x5e]
xor eax, 0x3f
mov word [ebp - 0x120], ax
mov ecx, dword [ebp - 0x268]
mov dword [ebp - 0x164], ecx
mov edx, 0x25
sub edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x128]
and edx, 0xffffffe6
mov byte [ebp - 0x111], dl
mov eax, dword [ebp - 0x128]
sub eax, 0x44
mov byte [ebp - 0x26], al
mov dword [ebp - 0x208], 0x18
mov dword [ebp - 0x28c], 0x27e
mov ecx, dword [ebp - 0x258]
add ecx, 0x27
movzx edx, word [ebp - 0x260]
sub edx, 0x2d
xor ecx, edx
movzx eax, byte [ebp - 0x1b1]
or ecx, eax
mov byte [ebp - 0xd], cl
mov dword [ebp - 0x128], 0x11
mov byte [ebp - 0x291], 0x87
mov ecx, 0xb
sub ecx, dword [ebp - 0x1cc]
xor ecx, 0x45
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0xd4]
add edx, 0x18
mov dword [ebp - 0x268], edx
movzx eax, byte [ebp - 0x1cc]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x44], 0x49
mov dword [ebp - 0x280], 0x365
mov ecx, dword [ebp - 0x270]
add ecx, dword [ebp - 0x1dc]
xor ecx, dword [0x41f584]
mov edx, dword [ebp - 0x1d0]
xor edx, dword [0x41f584]
xor ecx, edx
mov dword [0x4355c4], ecx
mov eax, dword [0x410030]
push eax
mov ecx, dword [0x410028]
push ecx
mov edx, dword [0x410030]
push edx
mov eax, dword [0x410024]
push eax
mov ecx, dword [str._fM05]
push ecx
mov edx, dword [str._fM05]
push edx
call fcn.00401c80
mov ecx, 0xffffffdd
sub ecx, eax
mov dword [ebp - 0xbc], ecx
movzx edx, word [ebp - 0x110]
sub edx, dword [0x410020]
sub edx, 0x46
and edx, dword [ebp - 0x25c]
mov word [ebp - 0x1a0], dx
movzx eax, byte [ebp - 0x1c5]
sub eax, dword [0x410030]
movzx ecx, word [ebp - 0xec]
or eax, ecx
mov dword [ebp - 0x274], eax
mov edx, dword [str._fM05]
mov dword [0x410028], edx
movzx eax, word [ebp - 0x1c0]
and eax, 0xfffffffd
mov word [ebp - 0x1c0], ax
movzx ecx, word [ebp - 0x250]
and ecx, dword [0x410044]
mov dword [0x410044], ecx
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x18c], edx
mov dword [ebp - 0x268], 0x63
movzx eax, byte [ebp - 0x1c5]
sub eax, 0x4d
movzx ecx, word [ebp - 0xc0]
sub eax, ecx
mov dword [ebp - 0xf8], eax
mov edx, dword [0x41002c]
mov eax, dword [ebp - 0x1c]
lea ecx, [eax + edx - 0x1e]
sub ecx, dword [0x41002c]
sub ecx, 0x27
mov byte [ebp - 0xa1], cl
mov edx, dword [0x410030]
mov dword [0x410034], edx
mov dword [ebp - 0x284], 0x2df7
mov eax, dword [0x41002c]
mov dword [ebp - 0x58], eax
movzx ecx, word [ebp - 0x264]
add ecx, dword [0x410020]
mov dword [0x41002c], ecx
movzx edx, byte [ebp - 0xcd]
mov dword [ebp - 0x268], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x37
mov dword [ebp - 0x1cc], eax
mov ecx, dword [ebp - 0x1cc]
xor ecx, 0x57
mov word [ebp - 0x24], cx
movzx edx, word [ebp - 0x24]
add edx, 0x1d
movzx eax, byte [ebp - 0x121]
sub eax, edx
mov byte [ebp - 0x121], al
mov esi, dword [ebp - 0x1cc]
sub esi, 6
mov ecx, dword [ebp - 0x128]
push ecx
push 0x35
mov edx, dword [ebp - 0x1cc]
push edx
call dword [sym.imp.GDI32.dll_SetBoundsRect]
or esi, eax
mov dword [ebp - 0x108], esi
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax*8 + 0x410078]
mov dword [ebp - 0x1b8], ecx
movzx edx, byte [ebp - 0xf]
movzx eax, word [ebp - 0x118]
add eax, edx
mov word [ebp - 0x118], ax
mov ecx, 0x28
sub ecx, dword [ebp - 0xb8]
mov dword [ebp - 0xd4], ecx
movzx edx, word [ebp - 0x260]
xor edx, 0x5d
mov word [ebp - 0x198], dx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x268]
push ecx
mov edx, dword [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.00401280
mov ecx, dword [ebp - 0x268]
and ecx, 0x36
or eax, ecx
mov dword [ebp - 0x1c4], eax
mov edx, 0x5a
mov word [ebp - 0x1cc], dx
mov eax, 0x911c
mov word [ebp - 0x288], ax
movzx ecx, word [ebp - 0x24]
mov dword [ebp - 0xd4], ecx
mov edx, dword [ebp - 0x1b8]
add edx, dword [0x4355c4]
mov eax, dword [0x41f580]
add eax, dword [ebp - 0xac]
mov byte [eax], dl
mov dword [0x410030], 0xc
movzx ecx, byte [ebp - 0xf9]
add ecx, 0x28
sub ecx, dword [ebp - 0xbc]
mov byte [ebp - 0x1b1], cl
movzx edx, byte [ebp - 0x26]
add edx, dword [0x41002c]
mov dword [0x410028], edx
movzx eax, word [ebp - 0x24]
mov ecx, 0x2c
sub ecx, eax
mov dword [0x410050], ecx
movzx edx, word [ebp - 0xe4]
mov eax, 0x21
sub eax, edx
sub eax, 0x37
mov dword [ebp - 0x11c], eax
movzx ecx, word [ebp - 0x19c]
or ecx, 0x54
mov word [ebp - 0x19c], cx
mov edx, dword [ebp - 0xac]
add edx, 1
mov dword [ebp - 0xac], edx
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x268]
lea edx, [ecx + eax + 0x71]
mov word [ebp - 0xe8], dx
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x268]
mov edx, dword [ebp - 0xd4]
lea eax, [edx + ecx - 0x32]
sub eax, dword [ebp - 0x1c4]
xor eax, 0x61
mov byte [ebp - 0xa1], al
mov ecx, 7
sub ecx, dword [ebp - 0x268]
xor ecx, dword [ebp - 0x25c]
xor ecx, 0x57
mov word [ebp - 0x110], cx
cmp dword [ebp - 0x14], 0x2b
jg 0x4058ae
mov dword [str._fM05], 0x6b
mov edx, dword [str._fM05]
add edx, 0x35
sub edx, dword [0x41002c]
mov dword [ebp - 0xb8], edx
mov eax, dword [0x410034]
mov dword [ebp - 0x184], eax
mov ecx, dword [0x410024]
add ecx, 0x88
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xac]
cmp edx, dword [0x410074]
jne 0x405249
mov dword [ebp - 0xc8], 0xfffffffa
movzx eax, word [ebp - 0x1c0]
movzx ecx, word [ebp - 0xcc]
add ecx, eax
mov word [ebp - 0xcc], cx
movzx edx, word [0x410030]
mov dword [0x410028], edx
mov eax, dword [0x410030]
or eax, dword [ebp - 0x1ac]
mov dword [str._fM05], eax
movzx ecx, word [ebp - 0x1d8]
mov edx, 0x1d
sub edx, ecx
sub edx, dword [0x410030]
movzx eax, byte [ebp - 0x112]
and edx, eax
mov word [ebp - 0x10c], dx
mov ecx, dword [0x410028]
mov dword [0x41002c], ecx
movzx edx, word [ebp - 0x1a0]
movzx eax, byte [ebp - 0xf]
sub eax, edx
mov byte [ebp - 0xf], al
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x1cc]
mov dword [ebp - 0x128], edx
mov eax, dword [0x410028]
mov ecx, dword [0x410028]
lea edx, [ecx + eax + 0x2c]
sub edx, dword [0x41002c]
sub edx, dword [0x41002c]
mov byte [ebp - 0x26], dl
mov eax, dword [str._fM05]
sub eax, dword [0x41002c]
mov dword [0x410020], eax
mov ecx, dword [0x41002c]
sub ecx, dword [0x410028]
mov dword [0x41002c], ecx
mov edx, dword [0x41002c]
mov dword [0x410034], edx
mov eax, dword [0x410030]
add eax, 0x1d
sub eax, dword [str._fM05]
sub eax, dword [0x410034]
mov byte [ebp - 0xcd], al
mov ecx, dword [ebp + 8]
mov dword [0x435588], ecx
mov dword [ebp - 0x14], 0x39
mov edx, dword [ebp - 0x1cc]
sub edx, 0x3c
mov word [ebp - 0x24], dx
mov eax, dword [ebp - 0x14]
xor eax, 0x2b
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 8]
mov dword [ebp - 0xf8], eax
mov dword [0x410058], 6
mov ecx, 0x13
sub ecx, dword [ebp - 0x268]
add ecx, 0xb
mov dword [ebp - 0xc8], ecx
movzx edx, word [ebp - 0x198]
movzx eax, byte [ebp - 0x121]
lea ecx, [edx + eax + 0x3e]
movzx edx, byte [ebp - 0xcd]
add edx, ecx
mov byte [ebp - 0xcd], dl
movzx eax, byte [ebp - 0x25]
mov ecx, 0x13
sub ecx, eax
add ecx, dword [ebp - 0x1cc]
and ecx, 0x2c
mov byte [ebp - 0x25], cl
mov dword [ebp - 0x14], 0x55
movzx edx, word [ebp - 0x1a0]
mov dword [ebp - 0x128], edx
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
je 0x405a93
cmp dword [ebp - 0x298], 1
je 0x405a95
jmp 0x405aab
jmp 0x405ab5
movzx ecx, byte [ebp - 0xcd]
mov edx, 0x56
sub edx, ecx
mov dword [ebp - 0x268], edx
jmp 0x405ab5
mov dword [ebp - 0x128], 0x58
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1cc]
sub eax, 0x10
mov dword [ebp - 0xb8], eax
xor ecx, ecx
je 0x405ad7
mov edx, dword [ebp - 0xbc]
and edx, 0x51
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x204], 7
mov eax, dword [ebp - 0xd4]
sub eax, 0x58
mov ecx, 0x4c
sub ecx, dword [ebp - 0x268]
movzx edx, word [ebp - 0x1d8]
sub ecx, edx
or eax, ecx
mov byte [ebp - 0x1b1], al
mov eax, dword [ebp - 0x128]
push eax
call fcn.004027f0
add eax, dword [ebp - 0x11c]
sub eax, dword [ebp - 0x128]
and eax, dword [ebp - 0x268]
mov word [ebp - 0x1a0], ax
mov ecx, dword [ebp - 0x1cc]
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp - 0x108]
sub edx, dword [ebp - 0x258]
mov eax, dword [ebp - 0x14]
lea ecx, [edx + eax - 0x59]
mov word [ebp - 0xa0], cx
push 0x59
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
movzx edx, word [ebp - 0x260]
sub edx, 0x75
mov dword [ebp - 0x1c4], edx
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x68], eax
mov ecx, 0x23
sub ecx, dword [ebp - 0x14]
sub ecx, 0x32
mov word [ebp - 0x1b0], cx
call fcn.00401540
movzx edx, word [ebp - 0x20]
sub edx, 3
movzx eax, word [ebp - 0x250]
sub eax, edx
mov word [ebp - 0x250], ax
mov ecx, dword [0x410028]
mov edx, dword [0x410034]
lea eax, [edx + ecx - 0x3a]
movzx ecx, word [ebp - 0xec]
sub eax, ecx
add eax, 0x14
mov byte [ebp - 0x26], al
mov edx, dword [0x410030]
and edx, 0x67
movzx eax, word [ebp - 0xa0]
add eax, edx
mov word [ebp - 0xa0], ax
movzx ecx, byte [ebp - 0xed]
mov dword [0x410028], ecx
movzx edx, word [ebp - 0x260]
mov eax, 0x20
sub eax, edx
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
movzx edx, word [ebp - 0xc0]
mov ebx, 0xc
sub ebx, edx
movzx eax, word [ebp - 0x260]
add ebx, eax
mov ecx, dword [ebp - 0x1cc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1cc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1cc]
push eax
call fcn.00402690
sub ebx, eax
or ebx, dword [ebp - 0x1cc]
mov byte [ebp - 0xa1], bl
mov ecx, dword [ebp - 0x268]
add ecx, 0xb
sub ecx, dword [ebp - 0x268]
mov byte [ebp - 0xe], cl
mov edx, dword [ebp - 0x268]
mov dword [ebp - 0x14], edx
movzx eax, word [ebp - 0x10c]
sub eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x1cc]
push ecx
mov edx, dword [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x128]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1cc]
push eax
call fcn.00401c80
mov esi, eax
mov ecx, dword [ebp - 0x1cc]
push ecx
push 0x1c
push 0x51
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.GDI32.dll_GetCharWidthFloatA]
add esi, eax
and esi, dword [ebp - 0x1cc]
mov dword [ebp - 0x1c], esi
movzx eax, byte [ebp - 0xf9]
or eax, dword [ebp - 0x1cc]
movzx ecx, word [ebp - 0xd8]
sub ecx, eax
mov word [ebp - 0xd8], cx
mov dword [ebp - 0x268], 7
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x184], edx
mov dword [ebp - 0xa8], 0xac
movzx eax, byte [ebp - 0x26]
add eax, 0x31
mov dword [ebp - 0x1cc], eax
mov ecx, dword [0x41004c]
sub ecx, 0x5a
mov dword [0x41004c], ecx
mov dx, word [ebp - 0x268]
mov word [ebp - 0x128], dx
mov dword [ebp - 0x18c], 0x12
mov byte [ebp - 0x1a1], 4
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
je 0x405d78
cmp dword [ebp - 0x29c], 1
je 0x405dc1
cmp dword [ebp - 0x29c], 2
je 0x405df6
jmp 0x405e22
cmp dword [ebp - 0x128], 0x2c
jge 0x405dae
mov dword [ebp - 0x268], 0x22
mov ecx, dword [ebp - 0x1cc]
add ecx, 0xb
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x128]
movzx eax, word [ebp - 0xe8]
add edx, eax
xor ecx, edx
mov byte [ebp - 0x121], cl
movzx ecx, word [ebp - 0x1b0]
mov edx, 0x58
sub edx, ecx
mov dword [ebp - 0x14], edx
jmp 0x405e3d
mov eax, dword [0x41004c]
add eax, dword [ebp - 0x14]
mov dword [0x41004c], eax
movzx ecx, byte [ebp - 0x112]
add ecx, 0x60
mov byte [ebp - 0x112], cl
mov edx, dword [ebp - 0x1cc]
sub edx, dword [ebp - 0x268]
add edx, 0x36
mov word [ebp - 0x1a8], dx
jmp 0x405e3d
mov dword [ebp - 0x1cc], 0x61
movzx eax, byte [ebp - 0xe]
or eax, 0x41
mov word [ebp - 0x264], ax
mov ecx, dword [ebp - 0x268]
sub ecx, 0x16
and ecx, 0x38
mov dword [ebp - 0xf8], ecx
jmp 0x405e3d
mov edx, dword [ebp - 0xc]
add edx, 0x3e
movzx eax, byte [ebp - 0x275]
sub eax, 0x3b
xor edx, eax
or edx, dword [ebp - 0x14]
mov byte [ebp - 0x122], dl
mov ecx, dword [ebp - 0x128]
add ecx, dword [ebp - 0x128]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 0x28
movzx edx, word [ebp - 0xe4]
movzx eax, byte [ebp - 0xe]
add edx, dword [ebp - 0x128]
lea ecx, [eax + edx - 0x42]
mov byte [ebp - 0x112], cl
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10