Function at 0x83d8f0
Capabilities:
Check os version
Get number of processors

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2c
push 0
push 0
dec ecx
jne 0x83d8f8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x840aa4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0xcc8], 0
je 0x8409d4
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.008538bc
mov eax, dword [ebp - 4]
call fcn.0084d6ec
xor edx, edx
push ebp
push 0x8409ca
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x8409b9
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 0x70], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xdf4], 0
mov byte [ebp - 0x6d], 0
mov byte [ebp - 0x6f], 0
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov al, byte [eax + 0x80b]
mov byte [ebp - 0x3d], al
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov ebx, dword [eax + 0x800]
mov eax, dword [ebx + 0x2b0]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x4c]
mov edx, dword [0x8a9588]
mov edx, dword [ebx + 0x2b4]
call fcn.00404bcc
mov byte [ebp - 0x51], 0
mov byte [ebp - 0x69], 0
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov byte [eax + 0x80b], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
mov edx, dword [eax]
call dword [edx + 0x124]
test al, al
je 0x83da0a
mov ax, word [0x840ab8]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb9c]
mov edx, dword [eax + 0x60]
mov cl, 2
mov eax, dword [ebp - 4]
call fcn.00837bd8
call fcn.004045a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8409d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
call fcn.0082b3d4
test al, al
je 0x83da4f
mov ax, word [0x840ab8]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb9c]
mov edx, dword [eax + 0x64]
mov cl, 2
mov eax, dword [ebp - 4]
call fcn.00837bd8
call fcn.004045a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8409d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x24], 1
jne 0x83daa7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x78], 1
jle 0x83daa7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
xor edx, edx
call fcn.004055f0
jne 0x83daab
xor eax, eax
jmp 0x83daad
mov al, 1
mov byte [ebp - 0x6b], al
cmp byte [ebp - 0x6b], 0
je 0x83db05
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
call fcn.0047bf44
mov edx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
call fcn.00404dc4
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x24]
call fcn.0040aabc
mov eax, dword [ebp - 0x24]
mov edx, 0x840ac4
call fcn.00404f40
je 0x83db05
mov eax, dword [ebp - 0x24]
mov edx, 0x840ad4
call fcn.00404f40
je 0x83db05
mov byte [ebp - 0x6b], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
mov edx, dword [eax]
call dword [edx + 0xd0]
call fcn.00878138
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov edx, eax
mov eax, dword [ebp - 0x2c]
call fcn.005c87e0
xor ebx, ebx
mov eax, dword [0x8a9588]
mov eax, dword [eax]
cmp byte [eax + 0x151a], 0
jne 0x83dbe4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
xor edx, edx
call fcn.004055f0
je 0x83dbe4
cmp dword [ebp - 8], 0
je 0x83dba1
mov eax, dword [0x8a9588]
mov eax, dword [eax]
cmp eax, dword [ebp - 8]
jne 0x83dba1
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp dword [eax + 0x1c0], 3
je 0x83dbe4
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
call fcn.0047bf44
mov edx, dword [ebp - 0x84]
lea eax, [ebp - 0x80]
call fcn.00404dc4
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x28]
call fcn.0040aabc
mov eax, dword [ebp - 0x28]
mov edx, 0x840ae4
call fcn.00404f40
sete bl
lea eax, [ebp - 0x50]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x22c]
mov edx, dword [edx + 0x38]
call fcn.004052c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
push eax
push ebx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.0083c340
mov byte [ebp - 0x3e], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
cmp dword [eax + 0xc], 0x477a
sete byte [ebp - 0x6a]
mov byte [ebp - 0x3f], 0
cmp dword [ebp - 8], 0
je 0x83e814
mov eax, dword [0x8a9588]
mov eax, dword [eax]
cmp eax, dword [ebp - 8]
jne 0x83e814
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp dword [eax + 0x1c0], 3
jne 0x83e814
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x538]
cmp byte [eax + 0xa8], 0
je 0x83dc95
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
xor edx, edx
call fcn.004055f0
jne 0x83e814
mov byte [ebp - 0x70], 1
mov eax, dword [0x8a9588]
mov eax, dword [eax]
cmp byte [eax + 0x151a], 0
jne 0x83dcd6
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp dword [eax + 0x2c4], 0
jg 0x83dcd6
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov dword [eax + 0x2c4], 3
mov eax, dword [0x8a9588]
mov eax, dword [eax]
call fcn.00767f94
test al, al
jne 0x83dcf8
call fcn.004045a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8409d4
lea edx, [ebp - 0x88]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x2c0]
call fcn.0087c650
mov eax, dword [ebp - 0x88]
call fcn.00876648
test al, al
je 0x83e7d5
lea edx, [ebp - 0x34]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x2c0]
call fcn.0087c650
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x2c4]
cmp eax, 5
ja case.default.0x83dd5c
jmp dword [eax*4 + 0x83dd63]
lea eax, [ebp - 0x24]
mov edx, 0x840af4
call fcn.00404bcc
jmp 0x83dde2
lea eax, [ebp - 0x24]
mov edx, 0x840b04
call fcn.00404bcc
jmp 0x83dde2
lea eax, [ebp - 0x24]
mov edx, 0x840b14
call fcn.00404bcc
jmp 0x83dde2
lea eax, [ebp - 0x24]
mov edx, 0x840b24
call fcn.00404bcc
jmp 0x83dde2
lea eax, [ebp - 0x24]
mov edx, 0x840b34
call fcn.00404bcc
jmp 0x83dde2
lea eax, [ebp - 0x24]
mov edx, 0x840b44
call fcn.00404bcc
jmp 0x83dde2
lea eax, [ebp - 0x24]
mov edx, 0x840b24
call fcn.00404bcc
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x2c4]
cmp eax, 5
ja case.default.0x83ddfe
jmp dword [eax*4 + 0x83de05]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x24], 5
jmp 0x83dec6
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x24], 2
jmp 0x83dec6
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x24], 3
jmp 0x83dec6
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x24], 8
jmp 0x83dec6
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x24], 1
jmp 0x83dec6
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x24], 0x12
jmp 0x83dec6
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x24], 8
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
add eax, 0x188
mov edx, dword [ebp - 0x24]
call fcn.00404b88
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 0x34]
call fcn.00877708
push dword [ebp - 0x8c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
push dword [eax + 0x244]
push dword [eax + 0x240]
lea ecx, [ebp - 0x90]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
xor edx, edx
call fcn.0076f478
push dword [ebp - 0x90]
lea eax, [ebp - 0x94]
mov edx, dword [ebp - 0x24]
call fcn.0040544c
push dword [ebp - 0x94]
mov eax, dword [ebp - 0x2c]
add eax, 0x100
mov edx, 3
call fcn.004055a8
jmp 0x83dfc9
call fcn.0040d838
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
fstp qword [eax + 0x240]
wait
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x34]
call fcn.00877708
push dword [ebp - 0x98]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
push dword [eax + 0x244]
push dword [eax + 0x240]
lea ecx, [ebp - 0x9c]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
xor edx, edx
call fcn.0076f478
push dword [ebp - 0x9c]
lea eax, [ebp - 0xa0]
mov edx, dword [ebp - 0x24]
call fcn.0040544c
push dword [ebp - 0xa0]
mov eax, dword [ebp - 0x2c]
add eax, 0x100
mov edx, 3
call fcn.004055a8
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov edx, dword [eax + 0x2a8]
mov eax, 0x840b50
call fcn.004057ec
test eax, eax
jle 0x83e00b
lea edx, [ebp - 0xa4]
mov eax, dword [ebp - 0x2c]
call fcn.005c319c
mov eax, dword [ebp - 0xa4]
call fcn.008765c8
test al, al
jne 0x83df4b
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov edx, dword [eax + 0x2a8]
mov eax, 0x840b58
call fcn.004057ec
test eax, eax
jle 0x83e101
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov edx, dword [eax + 0x2a8]
mov eax, 0x840b50
call fcn.004057ec
test eax, eax
jg 0x83e101
xor ebx, ebx
jmp 0x83e0e0
call fcn.0040d838
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
fstp qword [eax + 0x240]
wait
lea edx, [ebp - 0xa8]
mov eax, dword [ebp - 0x34]
call fcn.00877708
push dword [ebp - 0xa8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
push dword [eax + 0x244]
push dword [eax + 0x240]
lea ecx, [ebp - 0xac]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
xor edx, edx
call fcn.0076f478
push dword [ebp - 0xac]
lea eax, [ebp - 0xb0]
mov edx, dword [ebp - 0x24]
call fcn.0040544c
push dword [ebp - 0xb0]
mov eax, dword [ebp - 0x2c]
add eax, 0x100
mov edx, 3
call fcn.004055a8
inc ebx
cmp ebx, 0x1e
jg 0x83e101
lea edx, [ebp - 0xb4]
mov eax, dword [ebp - 0x2c]
call fcn.005c319c
mov eax, dword [ebp - 0xb4]
call fcn.008765c8
test al, al
jne 0x83e05c
lea edx, [ebp - 0xb8]
mov eax, dword [ebp - 0x2c]
call fcn.005c319c
mov eax, dword [ebp - 0xb8]
call fcn.008765c8
test al, al
je 0x83e19c
call fcn.0040d838
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
fstp qword [eax + 0x240]
wait
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 0x34]
call fcn.00877708
push dword [ebp - 0xbc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
push dword [eax + 0x244]
push dword [eax + 0x240]
lea ecx, [ebp - 0xc0]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
xor edx, edx
call fcn.0076f478
push dword [ebp - 0xc0]
lea eax, [ebp - 0xc4]
mov edx, dword [ebp - 0x24]
call fcn.0040544c
push dword [ebp - 0xc4]
mov eax, dword [ebp - 0x2c]
add eax, 0x100
mov edx, 3
call fcn.004055a8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x24], 3
jne 0x83e2cd
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x2cc]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x17c]
mov edx, dword [edx + 0x1bc]
mov dword [edx + 0xc8], eax
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp dword [eax + 0x2d0], 2
jne 0x83e20b
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov byte [eax + 0xcd], 2
jmp 0x83e24f
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp dword [eax + 0x2d0], 1
jne 0x83e239
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov byte [eax + 0xcd], 1
jmp 0x83e24f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov byte [eax + 0xcd], 0
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp byte [eax + 0x4a5], 0
je 0x83e27b
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov byte [eax + 0xc4], 1
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0xc8], 0xa
jl 0x83e2af
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0xc8], 0x64
jle 0x83e70d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0xc8], 0x5a
jmp 0x83e70d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x24], 2
jne 0x83e359
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp dword [eax + 0x2d4], 0
jl 0x83e70d
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp dword [eax + 0x2d4], 6
jg 0x83e70d
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x2d4]
add eax, 2
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x17c]
mov edx, dword [edx + 0x1bc]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 1
jmp 0x83e70d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x24], 8
jne 0x83e3e6
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp byte [eax + 0x2d8], 0
je 0x83e3b5
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 8], 8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 3
jmp 0x83e70d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 8], 8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 1
jmp 0x83e70d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x24], 1
jne 0x83e487
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp byte [eax + 0x2d9], 0
je 0x83e443
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 8], 8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 3
jmp 0x83e46f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 8], 8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov byte [eax + 0x31], 5
jmp 0x83e70d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x24], 5
jne 0x83e514
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp byte [eax + 0x2da], 0
je 0x83e4e3
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 8], 8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 3
jmp 0x83e70d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 8], 8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 1
jmp 0x83e70d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x24], 0x12
jne 0x83e70d
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x4a8]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x17c]
mov edx, dword [edx + 0x1bc]
mov dword [edx + 0x4e8], eax
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x4ac]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x17c]
mov edx, dword [edx + 0x1bc]
mov dword [edx + 0x4e0], eax
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov al, byte [eax + 0x4b0]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x17c]
mov edx, dword [edx + 0x1bc]
mov byte [edx + 0x4e4], al
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov al, byte [eax + 0x4b1]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x17c]
mov edx, dword [edx + 0x1bc]
mov byte [edx + 0x4ec], al
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x4b4]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x17c]
mov edx, dword [edx + 0x1bc]
mov dword [edx + 0x4f0], eax
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x4b8]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x17c]
mov edx, dword [edx + 0x1bc]
mov dword [edx + 0x4f4], eax
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x4bc]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x17c]
mov edx, dword [edx + 0x1bc]
mov dword [edx + 0x4f8], eax
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x4c0]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x17c]
mov edx, dword [edx + 0x1bc]
mov dword [edx + 0x4fc], eax
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov al, byte [eax + 0x4c4]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x17c]
mov edx, dword [edx + 0x1bc]
mov byte [edx + 0x500], al
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov al, byte [eax + 0x4c5]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x17c]
mov edx, dword [edx + 0x1bc]
mov byte [edx + 0x501], al
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov al, byte [eax + 0x4c6]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x17c]
mov edx, dword [edx + 0x1bc]
mov byte [edx + 0x502], al
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov al, byte [eax + 0x4c7]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x17c]
mov edx, dword [edx + 0x1bc]
mov byte [edx + 0x503], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x24], 0x12
je 0x83e7c8
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp byte [eax + 0x4a5], 0
je 0x83e7c8
xor eax, eax
push ebp
push 0x83e7c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637aa0
mov al, byte [eax + 0x30]
mov byte [ebp - 0x1e], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637aa0
mov byte [eax + 0x30], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637aa0
call fcn.005ee294
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x83e7c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637aa0
mov dl, byte [ebp - 0x1e]
mov byte [eax + 0x30], dl
ret
mov byte [ebp - 0x1d], 1
mov byte [ebp - 0x3e], 1
jmp 0x83f38b
mov ax, word [0x840ab8]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb9c]
mov edx, dword [eax + 0x68]
mov cl, 2
mov eax, dword [ebp - 4]
call fcn.00837bd8
mov byte [ebp - 0x1d], 0
push 0
mov eax, dword [0x8a9588]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 1
call fcn.0076bfa0
jmp 0x83f38b
lea edx, [ebp - 0x34]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
call fcn.0077ea94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
xor edx, edx
call fcn.004055f0
jne 0x83efab
mov byte [ebp - 0x70], 1
lea edx, [ebp - 0x24]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x188]
call fcn.0040aabc
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x1078]
mov edx, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jl 0x83e895
lea eax, [ebp - 0x24]
mov edx, dword [0x8a9588]
mov edx, dword [edx]
mov edx, dword [edx + 0x800]
mov edx, dword [edx + 0x188]
call fcn.00404bcc
jmp 0x83e8a2
lea eax, [ebp - 0x24]
mov edx, 0x840b14
call fcn.00404bcc
mov eax, dword [0x8a9588]
mov eax, dword [eax]
cmp byte [eax + 0x151a], 0
jne 0x83e8df
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 0x24]
call fcn.0040aabc
mov eax, dword [ebp - 0xc8]
mov edx, 0x840ae4
call fcn.00404f40
jne 0x83e8df
lea eax, [ebp - 0x24]
mov edx, 0x840b24
call fcn.00404bcc
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
add eax, 0x188
mov edx, dword [ebp - 0x24]
call fcn.00404b88
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
cmp byte [eax + 0x24c], 0
je 0x83e997
lea edx, [ebp - 0xcc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x248]
call fcn.0040af30
mov eax, dword [ebp - 0xcc]
xor edx, edx
call fcn.004055f0
je 0x83e997
lea edx, [ebp - 0xd0]
mov eax, dword [ebp - 0x34]
call fcn.00877708
push dword [ebp - 0xd0]
lea edx, [ebp - 0xd4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x248]
call fcn.0040af30
push dword [ebp - 0xd4]
lea eax, [ebp - 0xd8]
mov edx, dword [ebp - 0x24]
call fcn.0040544c
push dword [ebp - 0xd8]
mov eax, dword [ebp - 0x2c]
add eax, 0x100
mov edx, 3
call fcn.004055a8
jmp 0x83ec53
lea edx, [ebp - 0xdc]
mov eax, dword [ebp - 0x34]
call fcn.00877708
push dword [ebp - 0xdc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
push dword [eax + 0x244]
push dword [eax + 0x240]
lea ecx, [ebp - 0xe0]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
xor edx, edx
call fcn.0076f478
push dword [ebp - 0xe0]
lea eax, [ebp - 0xe4]
mov edx, dword [ebp - 0x24]
call fcn.0040544c
push dword [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
add eax, 0x100
mov edx, 3
call fcn.004055a8
jmp 0x83ea80
call fcn.0040d838
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
fstp qword [eax + 0x240]
wait
lea edx, [ebp - 0xe8]
mov eax, dword [ebp - 0x34]
call fcn.00877708
push dword [ebp - 0xe8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
push dword [eax + 0x244]
push dword [eax + 0x240]
lea ecx, [ebp - 0xec]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
xor edx, edx
call fcn.0076f478
push dword [ebp - 0xec]
lea eax, [ebp - 0xf0]
mov edx, dword [ebp - 0x24]
call fcn.0040544c
push dword [ebp - 0xf0]
mov eax, dword [ebp - 0x2c]
add eax, 0x100
mov edx, 3
call fcn.004055a8
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov edx, dword [eax + 0x2a8]
mov eax, 0x840b50
call fcn.004057ec
test eax, eax
jle 0x83eac2
lea edx, [ebp - 0xf4]
mov eax, dword [ebp - 0x2c]
call fcn.005c319c
mov eax, dword [ebp - 0xf4]
call fcn.008765c8
test al, al
jne 0x83ea02
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov edx, dword [eax + 0x2a8]
mov eax, 0x840b58
call fcn.004057ec
test eax, eax
jle 0x83ebb8
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov edx, dword [eax + 0x2a8]
mov eax, 0x840b50
call fcn.004057ec
test eax, eax
jg 0x83ebb8
xor ebx, ebx
jmp 0x83eb97
call fcn.0040d838
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
fstp qword [eax + 0x240]
wait
lea edx, [ebp - 0xf8]
mov eax, dword [ebp - 0x34]
call fcn.00877708
push dword [ebp - 0xf8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
push dword [eax + 0x244]
push dword [eax + 0x240]
lea ecx, [ebp - 0xfc]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
xor edx, edx
call fcn.0076f478
push dword [ebp - 0xfc]
lea eax, [ebp - 0x100]
mov edx, dword [ebp - 0x24]
call fcn.0040544c
push dword [ebp - 0x100]
mov eax, dword [ebp - 0x2c]
add eax, 0x100
mov edx, 3
call fcn.004055a8
inc ebx
cmp ebx, 0x1e
jg 0x83ebb8
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0x2c]
call fcn.005c319c
mov eax, dword [ebp - 0x104]
call fcn.008765c8
test al, al
jne 0x83eb13
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 0x2c]
call fcn.005c319c
mov eax, dword [ebp - 0x108]
call fcn.008765c8
test al, al
je 0x83ec53
call fcn.0040d838
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
fstp qword [eax + 0x240]
wait
lea edx, [ebp - 0x10c]
mov eax, dword [ebp - 0x34]
call fcn.00877708
push dword [ebp - 0x10c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
push dword [eax + 0x244]
push dword [eax + 0x240]
lea ecx, [ebp - 0x110]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
xor edx, edx
call fcn.0076f478
push dword [ebp - 0x110]
lea eax, [ebp - 0x114]
mov edx, dword [ebp - 0x24]
call fcn.0040544c
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x2c]
add eax, 0x100
mov edx, 3
call fcn.004055a8
lea edx, [ebp - 0x118]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x188]
call fcn.0040aabc
mov eax, dword [ebp - 0x118]
mov edx, 0x840b64
call fcn.00404f40
jne 0x83ecf3
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp byte [eax + 0x194], 0
je 0x83ecc7
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 8], 8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 3
jmp 0x83ecf3
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 8], 8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 1
lea edx, [ebp - 0x11c]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x188]
call fcn.0040aabc
mov eax, dword [ebp - 0x11c]
mov edx, 0x840b74
call fcn.00404f40
jne 0x83ed8d
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp dword [eax + 0x1a0], 0
jl 0x83ed8d
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp dword [eax + 0x1a0], 6
jge 0x83ed8d
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x1a0]
add eax, 2
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x17c]
mov edx, dword [edx + 0x1bc]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 1
lea edx, [ebp - 0x120]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x188]
call fcn.0040aabc
mov eax, dword [ebp - 0x120]
mov edx, 0x840ad4
call fcn.00404f40
je 0x83edf1
lea edx, [ebp - 0x124]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x188]
call fcn.0040aabc
mov eax, dword [ebp - 0x124]
mov edx, 0x840ac4
call fcn.00404f40
jne 0x83eea5
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp dword [eax + 0x1a4], 0
jne 0x83ee35
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 8], 4
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 1
jmp 0x83eea5
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp dword [eax + 0x1a4], 1
jne 0x83ee79
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 8], 8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 1
jmp 0x83eea5
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 8], 8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 3
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov byte [eax + 0x31], 5
lea edx, [ebp - 0x128]
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x188]
call fcn.0040aabc
mov eax, dword [ebp - 0x128]
mov edx, 0x840ae4
call fcn.00404f40
jne 0x83f0db
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp dword [eax + 0x1a8], 0
jne 0x83ef33
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 8], 4
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 1
jmp 0x83f0db
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp dword [eax + 0x1a8], 1
jne 0x83ef7a
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 8], 8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 1
jmp 0x83f0db
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 8], 8
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x10], 3
jmp 0x83f0db
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
add eax, 0xc
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xcc8]
mov edx, dword [edx + 0x264]
call fcn.004052a4
cmp byte [ebp - 0x6a], 0
jne 0x83f051
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
call fcn.008765c8
test al, al
je 0x83f051
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x24], 3
jne 0x83f051
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov edx, dword [eax + 0x264]
mov eax, dword [ebp - 4]
call fcn.0082fe70
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jle 0x83f051
cmp dword [ebp - 0x30], 0x64
jg 0x83f051
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x1bc]
mov edx, dword [ebp - 0x30]
mov dword [eax + 0xc8], edx
mov byte [ebp - 0x3f], 1
lea edx, [ebp - 0x12c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
call fcn.0047bdec
mov eax, dword [ebp - 0x12c]
call fcn.00876648
test al, al
je 0x83f098
mov eax, dword [ebp - 0x2c]
add eax, 0x100
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xcc8]
mov edx, dword [edx + 0x264]
call fcn.004052a4
jmp 0x83f0db
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
call fcn.0047bf0c
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 0x34]
call fcn.00877708
mov edx, dword [ebp - 0x134]
mov eax, dword [ebp - 0x2c]
add eax, 0x100
pop ecx
call fcn.00405544
mov eax, dword [0x8a9dac]
mov eax, dword [eax]
mov byte [eax + 0x2fc], 1
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x7c], 0
mov eax, dword [0x8a9588]
mov eax, dword [eax]
cmp eax, dword [ebp - 8]
jne 0x83f133
mov eax, dword [0x8a9dac]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
jne 0x83f133
mov eax, dword [ebp - 4]
cmp dword [eax + 0xdbc], 0
ja 0x83f133
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x7c], 1
mov eax, dword [0x8a9588]
mov eax, dword [eax]
call fcn.00455b24
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x78], eax
jmp 0x83f1d4
mov eax, dword [0x8a9dac]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
jne 0x83f14c
mov eax, dword [ebp - 4]
cmp dword [eax + 0xdbc], 0
ja 0x83f15c
mov eax, dword [ebp - 4]
call fcn.00838f44
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x78], eax
jmp 0x83f1d4
mov eax, dword [ebp - 4]
cmp dword [eax + 0xdbc], 0
jbe 0x83f18c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdbc]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x83f18c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdbc]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x78], eax
jmp 0x83f1d4
mov eax, dword [0x8a9588]
mov eax, dword [eax]
call fcn.00455b24
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x83f1bd
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x7c], 1
mov eax, dword [0x8a9588]
mov eax, dword [eax]
call fcn.00455b24
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x78], eax
jmp 0x83f1d4
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x7c], 1
mov eax, dword [0x8a9c8c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x78], eax
xor eax, eax
push ebp
push 0x83f2ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0xdbc]
test ebx, ebx
jbe 0x83f218
mov eax, dword [ebp - 4]
cmp dword [eax + 0xdb4], 0
jl 0x83f218
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x83f218
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdb4]
mov edx, dword [0x8a9c84]
mov dword [edx], eax
jmp 0x83f220
mov eax, dword [ebp - 4]
call fcn.008486b8
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0x174], 0
je 0x83f248
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov al, byte [eax + 0x72d]
mov edx, dword [ebp - 0x2c]
mov byte [edx + 0x175], al
mov byte [ebp - 0x6f], 1
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov byte [ebp - 0x1d], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x83f2b4
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0x174], 0
je 0x83f28d
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + 0x175]
mov edx, dword [0x8a9588]
mov edx, dword [edx]
mov edx, dword [edx + 0x800]
mov byte [edx + 0x72d], al
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x7c], 0
mov eax, dword [0x8a9c84]
mov dword [eax], 0xffffffff
mov eax, dword [ebp - 4]
mov dword [eax + 0xdb4], 0xffffffff
ret
cmp byte [ebp - 0x1d], 0
je 0x840929
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 0x2c]
call fcn.005c319c
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x18]
call fcn.0040af30
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x18]
call fcn.0047bdec
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
add eax, 0x184
mov edx, dword [ebp - 0x34]
call fcn.004052a4
cmp byte [ebp - 0x6f], 0
je 0x83f41c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc4]
mov edx, dword [0x8a9588]
mov edx, dword [edx]
lea eax, [edx + eax*4 + 0x14bc]
mov edx, dword [ebp - 0x34]
call fcn.004052a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc4]
mov edx, dword [0x8a9588]
mov edx, dword [edx]
lea eax, [edx + eax*4 + 0x14e4]
mov edx, dword [ebp - 0x34]
call fcn.004052a4
xor edx, edx
push ebp
push 0x84082e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov byte [eax + 0x4c0], 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x24], 0x12
jne 0x83f48f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0xc8], 0x5a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x24], 1
jne 0x83f4f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
mov edx, dword [eax]
call dword [edx + 0xd0]
call fcn.00645e2c
test al, al
je 0x83f4f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
mov edx, dword [eax]
call dword [edx + 0xd0]
mov edx, 0xffffff
call fcn.0087800c
xor edx, edx
push ebp
push 0x83fdd2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x8aa338]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x42], ax
mov eax, dword [0x8aa338]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0046f580
mov edx, dword [0x8a9588]
mov edx, dword [edx]
mov edx, dword [edx + 0x800]
cmp byte [edx + 0x5a2], 0
je 0x83f59e
mov edx, dword [0x8a9588]
mov edx, dword [edx]
cmp dword [edx + 0x7f0], 0
je 0x83f59e
mov edx, dword [0x8a9588]
mov edx, dword [edx]
mov edx, dword [edx + 0x7f0]
cmp byte [edx + 0x57], 0
jne 0x83f584
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x390]
mov eax, dword [eax + 0xc]
cmp eax, 2
je 0x83f596
mov edx, dword [0x8a9588]
cmp eax, 3
je 0x83f596
mov edx, dword [0x8a9588]
cmp eax, 5
je 0x83f596
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x538]
cmp byte [eax + 0xa8], 0
je 0x83f59e
mov eax, dword [ebp - 4]
call fcn.0083ce2c
xor eax, eax
push ebp
push 0x83fd6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov al, byte [eax + 0xcd]
mov byte [ebp - 0x52], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x24], 0x12
jne 0x83f610
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov byte [eax + 0xcd], 0
cmp byte [ebp - 0x3e], 0
jne 0x83f94d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x24], 1
jne 0x83f94d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x78], 1
jle 0x83f94d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
xor edx, edx
call fcn.004055f0
je 0x83f94d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
call fcn.008765c8
test al, al
je 0x83f94d
mov byte [ebp - 0x69], 1
lea eax, [ebp - 0x58]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xcc8]
mov edx, dword [edx + 0x264]
call fcn.004052c8
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 0x58]
call fcn.0040ad0c
mov eax, dword [ebp - 0x13c]
push eax
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 0x18]
call fcn.0040ad0c
mov edx, dword [ebp - 0x140]
pop eax
call fcn.004055f0
jne 0x83f6f8
lea eax, [ebp - 0x5c]
mov ecx, 0x840b80
mov edx, dword [ebp - 0x58]
call fcn.00405544
jmp 0x83f703
lea eax, [ebp - 0x5c]
mov edx, dword [ebp - 0x18]
call fcn.004052c8
mov byte [ebp - 0x5d], 0
xor eax, eax
push ebp
push 0x83f946
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x629c30]
call fcn.0062ad18
mov dword [ebp - 0x64], eax
xor edx, edx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
call dword [ecx + 0x12c]
mov eax, dword [ebp - 0x64]
call fcn.00637aa0
mov byte [eax + 0x30], 0
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xcc8]
mov edx, dword [edx + 0x264]
mov si, 0xffe8
call fcn.00403f24
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
dec eax
test eax, eax
jl 0x83f8b3
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov eax, dword [eax + 0x34]
cmp eax, dword [ebp - 0x14]
jne 0x83f7f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov edx, dword [eax + 0x254]
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
push eax
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
pop edx
call fcn.0061ed70
jmp 0x83f83c
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov edx, dword [ebp - 0x14]
call fcn.00620070
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov byte [eax + 0x68], 1
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xcc8]
mov edx, dword [edx + 0x264]
mov si, 0xffed
call fcn.00403f24
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x6c], 0x5a
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov edx, dword [ebp - 0x14]
call fcn.00620070
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov edx, 1
call fcn.006200c4
cmp dword [ebp - 0x14], 0
jne 0x83f897
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov edx, dword [ebp - 0x5c]
call fcn.0061d5b8
jmp 0x83f8a7
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov edx, dword [ebp - 0x5c]
call fcn.00618f20
inc dword [ebp - 0x14]
dec dword [ebp - 0x74]
jne 0x83f78a
mov byte [ebp - 0x5d], 1
lea edx, [ebp - 0x144]
mov eax, dword [ebp - 0x58]
call fcn.0040ad0c
mov eax, dword [ebp - 0x144]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 0x18]
call fcn.0040ad0c
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004055f0
jne 0x83f902
mov byte [ebp - 0x5d], 0
mov eax, dword [ebp - 0x58]
call fcn.0047c26c
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x5c]
call fcn.0047c248
mov byte [ebp - 0x5d], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x83fd34
lea eax, [ebp - 0x64]
call fcn.00411378
cmp byte [ebp - 0x5d], 0
jne 0x83f945
mov ax, word [0x840ab8]
push eax
push 0
push 0
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x418]
mov edx, dword [eax + 0xd0]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.00837bd8
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x24], 0x12
je 0x83fa8e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
cmp dword [eax + 0x24], 3
jne 0x83fa69
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
cmp byte [eax + 0x178], 0
je 0x83fa69
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
call fcn.0040af30
mov eax, dword [ebp - 0x14c]
xor edx, edx
call fcn.004055f0
je 0x83fa69
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
call fcn.008765c8
test al, al
je 0x83fa69
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
xor edx, edx
call fcn.00621674
cmp eax, 3
jne 0x83fa69
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov ecx, dword [eax + 0x264]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov edx, dword [eax + 0x254]
mov eax, dword [ebp - 4]
call fcn.0083d6fc
test al, al
jne 0x83fd34
mov ecx, 0x840b94
mov dl, 1
mov eax, dword [0x409e50]
call fcn.0040f79c
call fcn.004044f4
jmp 0x83fd34
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov edx, dword [ebp - 0x18]
mov si, 0xffec
call fcn.00403f24
jmp 0x83fd34
cmp byte [ebp - 0x6b], 0
je 0x83fcfb
cmp byte [ebp - 0x3e], 0
jne 0x83fcfb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x264]
call fcn.008765c8
test al, al
je 0x83fcfb
xor eax, eax
push ebp
push 0x83fcd6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x6d], 1
mov byte [ebp - 0x6c], 1
xor ecx, ecx
mov dl, 1
mov eax, dword [0x629c30]
call fcn.0062ad18
mov dword [ebp - 0x68], eax
xor edx, edx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
call dword [ecx + 0x12c]
xor ecx, ecx
mov dl, 1
mov eax, dword [0x629c30]
call fcn.0062ad18
mov dword [ebp - 0x64], eax
xor edx, edx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
call dword [ecx + 0x12c]
mov eax, dword [ebp - 0x64]
call fcn.00637aa0
mov byte [eax + 0x30], 0
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xcc8]
mov edx, dword [edx + 0x264]
mov si, 0xffe8
call fcn.00403f24
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x10], eax
mov eax, dword [0x8a9390]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [0x8aa28c]
xor edx, edx
mov dword [eax], edx
call fcn.0040d838
mov eax, dword [0x8a9dd8]
fstp qword [eax]
wait
mov eax, dword [ebp - 0x10]
dec eax
test eax, eax
jl 0x83fcb8
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov eax, dword [eax + 0x34]
cmp eax, dword [ebp - 0x14]
jne 0x83fbc2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov edx, dword [eax + 0x254]
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x83fc0a
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov edx, dword [ebp - 0x14]
call fcn.00620070
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov byte [eax + 0x68], 1
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xcc8]
mov edx, dword [edx + 0x264]
mov si, 0xffed
call fcn.00403f24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
push eax
mov eax, dword [ebp - 0x64]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
pop edx
call fcn.0061ed70
xor eax, eax
push ebp
push 0x83fc98
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x14], 0
jne 0x83fc5d
mov eax, dword [ebp - 0x68]
call fcn.00637a4c
mov edx, dword [ebp - 0x18]
call fcn.00628bd8
push 0
push 0
push 0
mov ecx, dword [ebp - 0x68]
xor edx, edx
mov eax, dword [ebp - 0x64]
call fcn.0088227c
test al, al
jne 0x83fc78
mov byte [ebp - 0x6c], 0
mov eax, dword [ebp - 0x10]
dec eax
cmp eax, dword [ebp - 0x14]
jne 0x83fc8e
mov eax, dword [ebp - 0x68]
call fcn.00637a4c
call fcn.00628cb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x83fca6
cmp byte [ebp - 0x6c], 0
je 0x83fcb8
inc dword [ebp - 0x14]
dec dword [ebp - 0x74]
jne 0x83fb87
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x83fcdd
lea eax, [ebp - 0x68]
call fcn.00411378
lea eax, [ebp - 0x64]
call fcn.00411378
ret
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
xor ecx, ecx
mov edx, dword [ebp - 0x18]
call fcn.0088227c
test al, al
jne 0x83fd34
mov ecx, 0x840b94
mov dl, 1
mov eax, dword [0x409e50]
call fcn.0040f79c
call fcn.004044f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x83fd74
mov eax, dword [ebp - 4]
call fcn.0083d174
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov dl, byte [ebp - 0x52]
mov byte [eax + 0xcd], dl
ret
mov eax, dword [0x8a9588]
mov eax, dword [eax]
call fcn.0076e658
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8409c0
cmp byte [ebp - 0x6d], 0
je 0x840969
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637a4c
mov eax, dword [eax + 0x1bc]
mov dword [eax + 0x24], 1
cmp byte [ebp - 0x51], 0
jne 0x840998
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov ebx, dword [eax + 0x800]
mov eax, dword [ebp - 0x48]
mov dword [ebx + 0x2b0], eax
mov eax, dword [0x8a9588]
lea eax, [ebx + 0x2b4]
mov edx, dword [ebp - 0x4c]
call fcn.00404b88
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov dl, byte [ebp - 0x3d]
mov byte [eax + 0x80b], dl
mov eax, dword [ebp - 4]
call fcn.0083d240
mov eax, dword [ebp - 4]
call fcn.0083c24c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x840aae
lea eax, [ebp - 0x160]
mov edx, 4
call fcn.00405280
lea eax, [ebp - 0x150]
call fcn.00404b34
lea eax, [ebp - 0x14c]
mov edx, 9
call fcn.00405280
lea eax, [ebp - 0x128]
mov edx, 5
call fcn.00404b58
lea eax, [ebp - 0x114]
mov edx, 0x13
call fcn.00405280
lea eax, [ebp - 0xc8]
call fcn.00404b34
lea eax, [ebp - 0xc4]
mov edx, 0x11
call fcn.00405280
lea eax, [ebp - 0x80]
call fcn.00404b34
lea eax, [ebp - 0x7c]
call fcn.00405268
lea eax, [ebp - 0x78]
call fcn.00404b34
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00405280
lea eax, [ebp - 0x50]
call fcn.00405268
lea eax, [ebp - 0x4c]
call fcn.00404b34
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00405280
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404b58
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405280
ret