Function at 0x40db50
Capabilities:
Get graphical window text
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x446e1d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x7e2c
call fcn.0042b690
mov eax, dword [0x459220]
push ebx
mov ebx, ecx
mov dword [esp + 0x7e2c], eax
mov al, byte [ebx + 0x2ac]
test al, al
push esi
push edi
mov dword [esp + 0x88], ebx
jne 0x4100cb
push 0
push 0x43b
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
push 0
push 0xbc8
mov ecx, ebx
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
push 0
push 0x3f7
mov ecx, ebx
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
push 1
push 0x3f8
mov ecx, ebx
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
call fcn.00443b5e
push 1
mov ecx, ebx
call fcn.0043bea1
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xa4], eax
mov dword [esp + 0x7e44], 0
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x7e44], 1
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xf8], eax
mov byte [esp + 0x7e44], 2
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xe8], eax
mov byte [esp + 0x7e44], 3
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x58], eax
mov byte [esp + 0x7e44], 4
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10c], eax
mov byte [esp + 0x7e44], 5
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xfc], eax
mov byte [esp + 0x7e44], 6
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x104], eax
mov byte [esp + 0x7e44], 7
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xf0], eax
mov byte [esp + 0x7e44], 8
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xec], eax
mov byte [esp + 0x7e44], 9
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x100], eax
mov byte [esp + 0x7e44], 0xa
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xe4], eax
mov byte [esp + 0x7e44], 0xb
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xb8], eax
lea eax, [esp + 0x58]
push eax
push 0x415
mov ecx, ebx
mov byte [esp + 0x7e4c], 0xc
call fcn.0043e49d
mov ecx, dword [ebx + 0x2c8]
mov eax, dword [esp + 0x58]
push ecx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401c60
lea edx, [ebx + 0x4d8]
add esp, 4
add eax, 0x10
push edx
mov dword [esi], eax
call fcn.00402270
mov eax, dword [esp + 0x64]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00401c60
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.004063e0
add esp, 4
lea eax, [esp + 0xb8]
push eax
push 0x458
mov ecx, ebx
call fcn.0043e49d
lea ecx, [esp + 0x114]
call fcn.004383c3
mov edx, dword [ebx + 0x250]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0xe
push edx
mov byte [esp + 0x7e58], 0xd
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 0
lea ecx, [ebx + 0x234]
call fcn.00437ede
lea eax, [esp + 0x114]
push eax
mov eax, dword [esp + 0x18]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401c60
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.004069f0
mov eax, dword [esp + 0x124]
lea esi, [eax*4]
mov edi, eax
push esi
mov dword [esp + 0x6c], edi
call fcn.00438e3f
push esi
mov dword [esp + 0xa0], eax
call fcn.00438e3f
push esi
mov dword [esp + 0xa0], eax
call fcn.00438e3f
push esi
mov dword [esp + 0xb0], eax
call fcn.00438e3f
push esi
mov dword [esp + 0xa0], eax
call fcn.00438e3f
push esi
mov dword [esp + 0x64], eax
call fcn.00438e3f
push esi
mov dword [esp + 0x80], eax
call fcn.00438e3f
xor esi, esi
add esp, 0x24
test edi, edi
mov dword [esp + 0xa0], eax
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x1c], esi
jle 0x40e6fd
lea ecx, [esp + 0x64]
call fcn.004383c3
test esi, esi
push 0x3d
lea ecx, [esp + 0x68]
mov byte [esp + 0x7e48], 0xe
push ecx
jl 0x4100ec
cmp esi, dword [esp + 0x124]
jge 0x4100ec
mov edx, dword [esp + 0x120]
mov esi, dword [edx + esi*4]
push ecx
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
sub esi, 0x10
mov dword [esp + 0x24], esp
mov ebx, esp
call dword [eax + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40df45
cmp eax, dword [esi]
jne 0x40df45
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40df77
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
je 0x40f562
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, 0x10
mov dword [ebx], eax
call fcn.004034f0
mov eax, dword [esp + 0x78]
lea ecx, [eax - 1]
add esp, 0xc
cmp ecx, 1
jl 0x40e6d0
test eax, eax
jle 0x4100ec
mov edx, dword [esp + 0x68]
mov eax, dword [edx]
sub eax, 0x10
push eax
call fcn.00401c60
add eax, 0x10
add esp, 4
mov dword [esp + 0x38], eax
push 1
push 0x44962c
lea ecx, [esp + 0x40]
mov byte [esp + 0x7e4c], 0xf
call fcn.00402e50
mov ebx, dword [esp + 0x38]
mov eax, dword [ebx - 0xc]
test eax, eax
mov dword [esp + 0x34], eax
jl 0x40dff6
push 0x44962c
push ebx
call fcn.0042ac83
add esp, 8
test eax, eax
je 0x40dff6
sub eax, ebx
mov dword [esp + 0x10], eax
jns 0x40dffe
lea eax, [ebx - 0x10]
jmp 0x40e6b1
cmp eax, dword [ebx - 0xc]
jg 0x40e01f
add eax, ebx
push 0x449630
push eax
call fcn.0042ac83
add esp, 8
test eax, eax
je 0x40e01f
sub eax, ebx
mov dword [esp + 0x2c], eax
jmp 0x40e027
mov dword [esp + 0x2c], 0xffffffff
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x6c]
inc esi
cmp eax, 1
mov dword [esp + 0x48], esi
jle 0x4100ec
mov eax, dword [esp + 0x68]
mov ecx, dword [eax + 4]
mov eax, dword [ecx - 0xc]
lea edx, [eax*8 + 8]
push edx
call fcn.00438e3f
mov edi, dword [esp + 0x94]
mov dword [edi + esi*4], eax
mov eax, dword [esp + 0x70]
add esp, 4
cmp eax, 1
jle 0x4100ec
mov eax, dword [esp + 0x68]
mov ecx, dword [eax + 4]
mov eax, dword [ecx - 0xc]
lea edx, [eax*8 + 8]
push edx
call fcn.00438e3f
mov ecx, dword [esp + 0x90]
add esp, 4
mov dword [ecx + esi*4], eax
mov edx, dword [edi + esi*4]
push eax
cmp dword [esp + 0x70], 1
push edx
jle 0x4100ec
mov eax, dword [esp + 0x70]
mov eax, dword [eax + 4]
push ecx
sub eax, 0x10
mov dword [esp + 0x24], esp
mov edi, esp
push eax
call fcn.00401c60
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.004065b0
mov ecx, dword [esp + 0xa4]
mov edi, dword [esp + 0xac]
mov dword [ecx + esi*4], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x40]
add esp, 0xc
cmp eax, ecx
mov dword [edi + esi*4], 0
jge 0x40e149
lea ecx, [ecx]
test eax, eax
jl 0x40e8f0
mov edx, dword [ebx - 0xc]
cmp eax, edx
jg 0x40e8f0
mov cl, byte [ebx + eax]
cmp cl, 0x2b
je 0x40e130
cmp eax, edx
jg 0x40e8f0
cmp cl, 0x2d
je 0x40e139
cmp eax, edx
jg 0x40e8f0
cmp cl, 0x2f
je 0x40e142
mov ecx, dword [esp + 0x34]
inc eax
cmp eax, ecx
jl 0x40e0f0
jmp 0x40e149
mov dword [edi + esi*4], 1
jmp 0x40e149
mov dword [edi + esi*4], 2
jmp 0x40e149
mov dword [edi + esi*4], 3
mov ecx, dword [ebx - 0x10]
mov edx, dword [ecx]
lea esi, [ebx - 0x10]
mov dword [esp + 0x4c], esi
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40e173
cmp eax, dword [esi]
jne 0x40e173
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40e1a5
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
je 0x40f562
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, 0x10
mov dword [esp + 0x28], eax
xor eax, eax
mov ecx, 0x44a234
mov dword [esp + 0xd0], ecx
mov dword [esp + 0xd4], eax
mov dword [esp + 0xe0], eax
mov dword [esp + 0xdc], eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xc0], eax
mov dword [esp + 0xcc], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0x38]
mov eax, dword [eax - 0xc]
mov ecx, dword [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x30]
mov byte [esp + 0x7e4c], 0x12
call fcn.00401e90
mov ebx, dword [esp + 0x28]
mov eax, dword [ebx - 0xc]
lea edx, [eax*4 + 0xc]
push edx
call fcn.00438e3f
mov esi, eax
mov eax, dword [ebx - 0xc]
lea eax, [eax*4 + 0xc]
push eax
mov dword [esp + 0x18], esi
call fcn.00438e3f
add esp, 8
mov edi, eax
push edi
push esi
push ecx
mov ecx, dword [ebx - 0x10]
mov edx, dword [ecx]
lea esi, [ebx - 0x10]
mov dword [esp + 0x40], edi
mov dword [esp + 0x24], esp
mov dword [esp + 0x3c], esp
mov dword [esp + 0x2c], esi
call dword [edx + 0x10]
mov ecx, dword [esi + 0xc]
test ecx, ecx
lea edx, [esi + 0xc]
jl 0x40e27f
cmp eax, dword [esi]
jne 0x40e27f
mov eax, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x40e2bd
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
je 0x40f562
mov edx, dword [esp + 0x2c]
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 4]
inc ecx
lea esi, [edx + 0x10]
mov edx, ecx
shr ecx, 2
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
add eax, 0x10
mov dword [ecx], eax
call fcn.00405f60
add esp, 0xc
test eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x24], 0
jl 0x40e34b
mov eax, dword [esp + 0x10]
sub eax, edi
mov dword [esp + 0x30], eax
jmp 0x40e2f0
mov eax, dword [esp + 0x30]
mov edi, edi
mov esi, dword [eax + edi]
cmp esi, dword [edi]
jg 0x40e32f
mov eax, dword [esp + 0xd8]
test eax, eax
mov dword [esp + 0x3c], eax
jl 0x4100ec
push 0xffffffffffffffff
inc eax
push eax
lea ecx, [esp + 0xd8]
call fcn.00407520
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0xd4]
mov dword [edx + eax*4], esi
mov eax, dword [edi]
inc esi
cmp esi, eax
jle 0x40e2f7
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
inc eax
add edi, 4
cmp eax, ecx
mov dword [esp + 0x24], eax
jle 0x40e2ea
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00438e44
push edi
call fcn.00438e44
mov eax, dword [esp + 0x34]
add esp, 8
test eax, eax
jl 0x40e558
mov eax, dword [esp + 0x4c]
cmp eax, esi
je 0x40e3c0
mov ecx, dword [esi + 0xc]
test ecx, ecx
lea ebx, [esi + 0xc]
jl 0x40e3aa
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x40e3aa
push eax
call fcn.00401c60
mov edi, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x40e3a1
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
lea ebx, [edi + 0x10]
mov dword [esp + 0x28], ebx
jmp 0x40e3c0
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x30]
call fcn.00402990
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
inc edi
jns 0x40e3c9
xor edi, edi
mov esi, dword [ebx - 0xc]
cmp edi, esi
jle 0x40e3d2
mov edi, esi
test edi, edi
jle 0x40e419
mov eax, dword [ebx - 4]
sub esi, edi
cmp eax, 1
jle 0x40e3f1
mov eax, dword [ebx - 0xc]
push eax
lea ecx, [esp + 0x2c]
call fcn.00401960
mov ebx, dword [esp + 0x28]
lea eax, [esi + 1]
push eax
add edi, ebx
push edi
push ebx
call fcn.0042ae50
add esp, 0xc
test esi, esi
jl 0x40e8f0
cmp esi, dword [ebx - 8]
jg 0x40e8f0
mov dword [ebx - 0xc], esi
mov byte [esi + ebx], 0
mov eax, dword [ebx - 0xc]
lea ecx, [eax*4 + 0xc]
push ecx
call fcn.00438e3f
mov esi, eax
mov eax, dword [ebx - 0xc]
lea edx, [eax*4 + 0xc]
push edx
mov dword [esp + 0x18], esi
call fcn.00438e3f
add esp, 8
mov edi, eax
push edi
push esi
push ecx
mov ecx, dword [ebx - 0x10]
mov eax, dword [ecx]
lea esi, [ebx - 0x10]
mov dword [esp + 0x40], edi
mov dword [esp + 0x24], esp
mov dword [esp + 0x3c], esp
mov dword [esp + 0x2c], esi
call dword [eax + 0x10]
mov ecx, dword [esi + 0xc]
test ecx, ecx
lea edx, [esi + 0xc]
jl 0x40e47d
cmp eax, dword [esi]
jne 0x40e47d
mov eax, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x40e4bb
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
je 0x40f562
mov edx, dword [esp + 0x2c]
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 4]
inc ecx
lea esi, [edx + 0x10]
mov edx, ecx
shr ecx, 2
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
add eax, 0x10
mov dword [ecx], eax
call fcn.00405f60
add esp, 0xc
test eax, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x24], 0
jl 0x40e545
mov eax, dword [esp + 0x10]
sub eax, edi
mov ebx, edi
mov dword [esp + 0x30], eax
jmp 0x40e4f0
mov eax, dword [esp + 0x30]
mov edi, edi
mov esi, dword [eax + ebx]
cmp esi, dword [ebx]
jg 0x40e529
mov eax, dword [esp + 0xc4]
test eax, eax
mov edi, eax
jl 0x4100ec
push 0xffffffffffffffff
inc eax
push eax
lea ecx, [esp + 0xc4]
call fcn.00407520
mov edx, dword [esp + 0xc0]
mov dword [edx + edi*4], esi
mov eax, dword [ebx]
inc esi
cmp esi, eax
jle 0x40e4f7
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x3c]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x24], eax
jle 0x40e4ea
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x10]
push eax
call fcn.00438e44
push edi
call fcn.00438e44
add esp, 8
mov ecx, dword [esp + 0x84]
mov edi, dword [esp + 0xd8]
mov ebx, dword [esp + 0x48]
push 8
dec edi
mov dword [ecx + ebx*4], 1
call fcn.00438e3f
mov edx, dword [esp + 0x48]
push 8
mov dword [edx + ebx*4], eax
call fcn.00438e3f
mov ecx, dword [esp + 0x64]
lea edx, [edi*4 + 4]
mov dword [ecx + ebx*4], eax
push edx
mov dword [eax], edi
call fcn.00438e3f
mov ecx, dword [esp + 0x50]
mov edx, dword [ecx + ebx*4]
mov dword [edx], eax
add esp, 0xc
xor eax, eax
test edi, edi
jl 0x40e5e0
nop
test eax, eax
jl 0x4100ec
cmp eax, dword [esp + 0xd8]
jge 0x4100ec
mov ecx, dword [esp + 0x44]
mov edx, dword [ecx + ebx*4]
mov ecx, dword [edx]
mov edx, dword [esp + 0xd4]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, edi
jle 0x40e5b0
mov edi, dword [esp + 0xc4]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + ebx*4]
dec edi
lea edx, [edi*4 + 4]
push edx
mov dword [ecx + 4], edi
call fcn.00438e3f
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx + ebx*4]
mov dword [edx + 4], eax
add esp, 4
xor eax, eax
test edi, edi
jl 0x40e643
test eax, eax
jl 0x4100ec
cmp eax, dword [esp + 0xc4]
jge 0x4100ec
mov ecx, dword [esp + 0x44]
mov edx, dword [ecx + ebx*4]
mov ecx, dword [edx + 4]
mov edx, dword [esp + 0xc0]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, edi
jle 0x40e612
mov eax, dword [esp + 0xc0]
test eax, eax
mov edi, 0x44a234
mov byte [esp + 0x7e44], 0x11
mov dword [esp + 0xbc], edi
je 0x40e66b
push eax
call fcn.00438e44
add esp, 4
mov eax, dword [esp + 0xd4]
test eax, eax
mov byte [esp + 0x7e44], 0x10
mov dword [esp + 0xd0], edi
je 0x40e68e
push eax
call fcn.00438e44
add esp, 4
mov byte [esp + 0x7e44], 0xf
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40e6ad
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [esp + 0x4c]
mov byte [esp + 0x7e44], 0xe
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e6d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x64]
mov byte [esp + 0x7e44], 0xd
call fcn.00438415
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x60]
inc esi
cmp esi, eax
mov dword [esp + 0x1c], esi
jl 0x40dee1
mov ebx, dword [esp + 0x88]
push 0xc
call fcn.00438e3f
mov edi, eax
add esp, 4
mov dword [esp + 0x34], edi
xor esi, esi
nop
push 0x14
call fcn.00438e3f
add esp, 4
mov dword [edi + esi*4], eax
inc esi
cmp esi, 3
jl 0x40e710
mov ecx, 0x3e8
mov esi, edi
mov dword [esp + 0x10], 3
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
xor eax, eax
mov edi, dword [esi]
mov edx, ecx
imul edx, eax
mov word [edi + eax*2], dx
inc eax
cmp eax, 9
jle 0x40e747
mov eax, dword [esp + 0x10]
add esi, 4
dec eax
mov dword [esp + 0x10], eax
jne 0x40e732
push 0xfa0
mov dword [esp + 0x14], 0xffffffff
call fcn.00438e3f
mov esi, eax
add esp, 4
mov dword [esp + 0x30], esi
xor edi, edi
push 6
call fcn.00438e3f
add esp, 4
mov dword [esi + edi*4], eax
inc edi
cmp edi, 0x3e8
jl 0x40e783
or eax, 0xffffffff
xor edi, edi
mov dword [esp + 0x1c], edi
xor ecx, ecx
jmp 0x40e7b0
mov dword [esp + 0x20], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov word [edx], di
mov edx, dword [esi + eax*4]
mov word [edx + 2], cx
mov edi, dword [esi + eax*4]
mov edx, dword [esp + 0x20]
mov word [edi + 4], dx
mov edi, dword [esp + 0x1c]
cmp edi, ecx
jg 0x40e7f3
cmp ecx, edx
jg 0x40e7f3
mov edi, dword [esp + 0x10]
inc edi
mov dword [esp + 0x10], edi
mov word [esp + edi*2 + 0x18a0], ax
mov edi, dword [esp + 0x1c]
inc edx
cmp edx, 9
mov dword [esp + 0x20], edx
jle 0x40e7b8
inc ecx
cmp ecx, 9
jle 0x40e7b0
inc edi
cmp edi, 9
mov dword [esp + 0x1c], edi
jle 0x40e7a2
or esi, 0xffffffff
mov dword [esp + 0x1c], 0
jmp 0x40e820
mov dword [esp + 0x24], 0
jmp 0x40e830
lea edi, [esi + esi*2]
mov dword [esp + 0x20], 0
lea edi, [esp + edi*2 + 0x2070]
jmp 0x40e850
mov ax, word [esp + 0x1c]
mov cx, word [esp + 0x24]
mov dx, word [esp + 0x20]
mov word [esp + 0x10c8], ax
lea eax, [esp + 0x10c8]
push 2
push eax
mov word [esp + 0x10d2], cx
mov word [esp + 0x10d4], dx
inc esi
add edi, 6
call fcn.00401fc0
add esp, 8
xor eax, eax
mov word [esp + esi*2 + 0x10d0], ax
jmp 0x40e8a0
movsx ecx, word [esp + eax*2 + 0x10c8]
mov edx, dword [esp + 0x34]
mov edx, dword [edx + eax*4]
mov cx, word [edx + ecx*2]
add word [esp + esi*2 + 0x10d0], cx
inc eax
cmp eax, 3
jl 0x40e8a0
mov cx, word [esp + 0x10c8]
mov dx, word [esp + 0x10cc]
cmp cx, dx
jne 0x40e8fa
mov dword [esp + esi*4 + 0x128], 0xffffffff
mov word [esp + esi*2 + 0x18a0], 0
jmp 0x40e97e
push 0x80070057
call fcn.00401250
mov ax, word [esp + 0x10ca]
cmp cx, ax
je 0x40e952
cmp ax, dx
je 0x40e952
mov ecx, dword [esp + 0x10ca]
mov eax, 2
mov dword [esp + esi*4 + 0x128], eax
mov word [esp + esi*2 + 0x18a0], ax
mov eax, dword [esp + 0x10c8]
lea eax, [eax + eax*4]
shl eax, 1
lea edx, [ecx + eax]
mov word [edi], dx
mov edx, dword [esp + 0x10cc]
add eax, edx
lea ecx, [ecx + ecx*4]
lea edx, [edx + ecx*2]
mov word [edi + 2], ax
mov word [edi + 4], dx
jmp 0x40e97e
mov eax, dword [esp + 0x10c8]
mov ecx, dword [esp + 0x10cc]
lea eax, [eax + eax*4]
lea edx, [ecx + eax*2]
mov dword [esp + esi*4 + 0x128], 0
mov word [esp + esi*2 + 0x18a0], 1
mov word [edi], dx
mov eax, dword [esp + 0x20]
inc eax
cmp eax, 9
mov dword [esp + 0x20], eax
jle 0x40e850
mov eax, dword [esp + 0x24]
inc eax
cmp eax, 9
mov dword [esp + 0x24], eax
jle 0x40e830
mov eax, dword [esp + 0x1c]
inc eax
cmp eax, 9
mov dword [esp + 0x1c], eax
jle 0x40e820
push 0x28
call fcn.00438e3f
mov edi, eax
add esp, 4
mov dword [esp + 0x3c], edi
xor esi, esi
push 0x14
call fcn.00438e3f
add esp, 4
mov dword [edi + esi*4], eax
inc esi
cmp esi, 0xa
jl 0x40e9c6
xor ecx, ecx
mov edx, edi
lea ecx, [ecx]
xor eax, eax
cmp ecx, eax
mov edi, dword [edx]
jg 0x40e9f0
lea esi, [ecx + ecx*4]
lea esi, [eax + esi*2]
jmp 0x40e9f6
lea esi, [eax + eax*4]
lea esi, [ecx + esi*2]
mov word [edi + eax*2], si
inc eax
cmp eax, 9
jle 0x40e9e2
inc ecx
add edx, 4
cmp ecx, 9
jle 0x40e9e0
mov eax, dword [ebx + 0x101c]
dec eax
lea edi, [eax + 1]
lea eax, [esp + 0x14]
push eax
push 0x43d
mov ecx, ebx
mov dword [esp + 0x5c], edi
call fcn.0043e49d
mov esi, dword [esp + 0x14]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x20], esp
mov dword [esp + 0x14], esp
call dword [edx + 0x10]
mov ecx, dword [esi + 0xc]
test ecx, ecx
lea edx, [esi + 0xc]
jl 0x40ea60
cmp eax, dword [esi]
jne 0x40ea60
mov eax, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x40ea97
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40ea75
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x5c]
mov ecx, dword [esp + 0x14]
lea edx, [ebx + 0xc18]
add eax, 0x10
push edx
mov dword [ecx], eax
call fcn.00402270
mov eax, dword [esp + 0x20]
push eax
call fcn.0042ac4f
add esp, 0x10
cmp eax, 1
mov dword [esp + 0x1c], eax
jge 0x40ead4
cmp edi, 1
mov eax, edi
mov dword [esp + 0x1c], eax
jge 0x40ead4
mov byte [ebx + 0x2ac], 1
mov cl, byte [ebx + 0x2ac]
test cl, cl
jne 0x40fc19
test eax, eax
jle 0x40fc19
push fcn.00401f70
push fcn.00401f50
push 7
push 4
lea ecx, [esp + 0x74]
push ecx
call fcn.0042ba0d
lea edx, [esp + 0x14]
push edx
push 0x432
mov ecx, ebx
mov byte [esp + 0x7e4c], 0x13
call fcn.0043e49d
mov esi, dword [esp + 0x14]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x20], esp
mov dword [esp + 0x14], esp
call dword [eax + 0x10]
mov ecx, dword [esi + 0xc]
test ecx, ecx
lea edx, [esi + 0xc]
jl 0x40eb53
cmp eax, dword [esi]
jne 0x40eb53
mov eax, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x40eb86
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40eb68
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
lea edx, [ebx + 0xa88]
add eax, 0x10
push edx
mov dword [ecx], eax
call fcn.00402270
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x70]
add edi, 0xfffffff0
lea esi, [eax - 0x10]
add esp, 0xc
cmp esi, edi
mov dword [esp + 0xc], edi
je 0x40ec5c
mov ecx, dword [edi + 0xc]
test ecx, ecx
jl 0x40ec4e
mov ecx, dword [esi]
cmp ecx, dword [edi]
jne 0x40ec4e
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40ebeb
cmp eax, dword [esi]
jne 0x40ebeb
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40ec2e
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x40ec04
jmp fcn.00401950
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
lea edi, [eax + 0x10]
mov eax, ecx
add esi, 0x10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ec45
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
add esi, 0x10
mov dword [esp + 0x64], esi
jmp 0x40ec5c
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x6c]
call fcn.00402990
lea eax, [esp + 0x14]
push eax
push 0x420
mov ecx, ebx
call fcn.0043e49d
mov esi, dword [esp + 0x14]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x20], esp
mov dword [esp + 0x14], esp
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40eca5
cmp eax, dword [esi]
jne 0x40eca5
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40ecd8
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40ecba
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
lea edx, [ebx + 0x70c]
add eax, 0x10
push edx
mov dword [ecx], eax
call fcn.00402270
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x74]
add edi, 0xfffffff0
lea esi, [eax - 0x10]
add esp, 0xc
cmp esi, edi
mov dword [esp + 0xc], edi
je 0x40edae
mov ecx, dword [edi + 0xc]
test ecx, ecx
jl 0x40eda0
mov ecx, dword [esi]
cmp ecx, dword [edi]
jne 0x40eda0
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40ed3d
cmp eax, dword [esi]
jne 0x40ed3d
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40ed80
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x40ed56
jmp fcn.00401950
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
lea edi, [eax + 0x10]
mov eax, ecx
add esi, 0x10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ed97
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
add esi, 0x10
mov dword [esp + 0x68], esi
jmp 0x40edae
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x70]
call fcn.00402990
lea eax, [esp + 0x14]
push eax
push 0x416
mov ecx, ebx
call fcn.0043e49d
mov esi, dword [esp + 0x14]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x20], esp
mov dword [esp + 0x14], esp
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40edf7
cmp eax, dword [esi]
jne 0x40edf7
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40ee2a
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40ee0c
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
lea edx, [ebx + 0x528]
add eax, 0x10
push edx
mov dword [ecx], eax
call fcn.00402270
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x78]
add edi, 0xfffffff0
lea esi, [eax - 0x10]
add esp, 0xc
cmp esi, edi
mov dword [esp + 0xc], edi
je 0x40ef00
mov ecx, dword [edi + 0xc]
test ecx, ecx
jl 0x40eef2
mov ecx, dword [esi]
cmp ecx, dword [edi]
jne 0x40eef2
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40ee8f
cmp eax, dword [esi]
jne 0x40ee8f
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40eed2
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x40eea8
jmp fcn.00401950
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
lea edi, [eax + 0x10]
mov eax, ecx
add esi, 0x10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40eee9
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
add esi, 0x10
mov dword [esp + 0x6c], esi
jmp 0x40ef00
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x74]
call fcn.00402990
lea eax, [esp + 0x14]
push eax
push 0x422
mov ecx, ebx
call fcn.0043e49d
mov esi, dword [esp + 0x14]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x20], esp
mov dword [esp + 0x14], esp
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40ef49
cmp eax, dword [esi]
jne 0x40ef49
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40ef7c
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40ef5e
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
lea edx, [ebx + 0x7fc]
add eax, 0x10
push edx
mov dword [ecx], eax
call fcn.00402270
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x7c]
add edi, 0xfffffff0
lea esi, [eax - 0x10]
add esp, 0xc
cmp esi, edi
mov dword [esp + 0xc], edi
je 0x40f052
mov ecx, dword [edi + 0xc]
test ecx, ecx
jl 0x40f044
mov ecx, dword [esi]
cmp ecx, dword [edi]
jne 0x40f044
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40efe1
cmp eax, dword [esi]
jne 0x40efe1
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40f024
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x40effa
jmp fcn.00401950
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
lea edi, [eax + 0x10]
mov eax, ecx
add esi, 0x10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f03b
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
add esi, 0x10
mov dword [esp + 0x70], esi
jmp 0x40f052
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x78]
call fcn.00402990
lea eax, [esp + 0x14]
push eax
push 0x41e
mov ecx, ebx
call fcn.0043e49d
mov esi, dword [esp + 0x14]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x20], esp
mov dword [esp + 0x14], esp
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40f09b
cmp eax, dword [esi]
jne 0x40f09b
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40f0ce
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40f0b0
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
lea edx, [ebx + 0x66c]
add eax, 0x10
push edx
mov dword [ecx], eax
call fcn.00402270
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x80]
add edi, 0xfffffff0
lea esi, [eax - 0x10]
add esp, 0xc
cmp esi, edi
mov dword [esp + 0xc], edi
je 0x40f1a7
mov ecx, dword [edi + 0xc]
test ecx, ecx
jl 0x40f199
mov ecx, dword [esi]
cmp ecx, dword [edi]
jne 0x40f199
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40f136
cmp eax, dword [esi]
jne 0x40f136
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40f179
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x40f14f
jmp fcn.00401950
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
lea edi, [eax + 0x10]
mov eax, ecx
add esi, 0x10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f190
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
add esi, 0x10
mov dword [esp + 0x74], esi
jmp 0x40f1a7
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x7c]
call fcn.00402990
lea eax, [esp + 0x14]
push eax
push 0x443
mov ecx, ebx
call fcn.0043e49d
mov esi, dword [esp + 0x14]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x20], esp
mov dword [esp + 0x14], esp
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40f1f0
cmp eax, dword [esi]
jne 0x40f1f0
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40f223
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40f205
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
lea edx, [ebx + 0xc68]
add eax, 0x10
push edx
mov dword [ecx], eax
call fcn.00402270
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x84]
add edi, 0xfffffff0
lea esi, [eax - 0x10]
add esp, 0xc
cmp esi, edi
mov dword [esp + 0xc], edi
je 0x40f2ff
mov ecx, dword [edi + 0xc]
test ecx, ecx
jl 0x40f2ee
mov ecx, dword [esi]
cmp ecx, dword [edi]
jne 0x40f2ee
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40f28b
cmp eax, dword [esi]
jne 0x40f28b
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40f2ce
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x40f2a4
jmp fcn.00401950
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
lea edi, [eax + 0x10]
mov eax, ecx
add esi, 0x10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f2e5
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
add esi, 0x10
mov dword [esp + 0x78], esi
jmp 0x40f2ff
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x80]
call fcn.00402990
lea eax, [esp + 0x14]
push eax
push 0x423
mov ecx, ebx
call fcn.0043e49d
mov esi, dword [esp + 0x14]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x20], esp
mov dword [esp + 0x14], esp
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40f348
cmp eax, dword [esi]
jne 0x40f348
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40f37b
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40f35d
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
lea edx, [ebx + 0x84c]
add eax, 0x10
push edx
mov dword [ecx], eax
call fcn.00402270
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x88]
add edi, 0xfffffff0
lea esi, [eax - 0x10]
add esp, 0xc
cmp esi, edi
mov dword [esp + 0xc], edi
je 0x40f457
mov ecx, dword [edi + 0xc]
test ecx, ecx
jl 0x40f446
mov ecx, dword [esi]
cmp ecx, dword [edi]
jne 0x40f446
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40f3e3
cmp eax, dword [esi]
jne 0x40f3e3
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40f426
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x40f3fc
jmp fcn.00401950
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
lea edi, [eax + 0x10]
mov eax, ecx
add esi, 0x10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f43d
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
add esi, 0x10
mov dword [esp + 0x7c], esi
jmp 0x40f457
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x84]
call fcn.00402990
lea eax, [esp + 0x14]
push eax
push 0x417
mov ecx, ebx
call fcn.0043e49d
mov esi, dword [esp + 0x14]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x20], esp
mov dword [esp + 0x14], esp
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40f4a0
cmp eax, dword [esi]
jne 0x40f4a0
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40f4d3
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40f4b5
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
lea edx, [ebx + 0x578]
add eax, 0x10
push edx
mov dword [ecx], eax
call fcn.00402270
mov eax, dword [esp + 0x20]
mov eax, dword [eax - 0xc]
lea ecx, [eax*4 + 8]
push ecx
call fcn.00438e3f
mov edx, dword [esp + 0x24]
mov edi, eax
mov eax, dword [edx - 0xc]
lea eax, [eax*4 + 8]
push eax
mov dword [esp + 0x60], edi
call fcn.00438e3f
mov esi, dword [esp + 0x28]
add esp, 0x14
push eax
push edi
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], esp
mov dword [esp + 0x18], esp
call dword [edx + 0x10]
mov ecx, dword [esi + 0xc]
test ecx, ecx
lea edx, [esi + 0xc]
jl 0x40f552
cmp eax, dword [esi]
jne 0x40f552
mov eax, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x40f589
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40f567
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x58]
mov ecx, dword [esp + 0x18]
add eax, 0x10
mov dword [ecx], eax
call fcn.00405f60
add esp, 0xc
test eax, eax
mov dword [esp + 0xb0], eax
jge 0x40f5bd
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x10]
inc eax
mov dword [edi], eax
mov dword [esp + 0xb0], 0
mov dword [edx], eax
xor esi, esi
lea ecx, [ebx + 0x374]
mov dword [esp + 0x80], esi
call fcn.004187c0
mov eax, dword [esp + 0x1c]
shl eax, 2
push eax
call fcn.00438e3f
mov edi, eax
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
mov dword [esp + 0x38], edi
jle 0x40f609
nop
push 0xfa0
call fcn.00438e3f
add esp, 4
mov dword [edi + esi*4], eax
mov eax, dword [esp + 0x1c]
inc esi
cmp esi, eax
jl 0x40f5f0
mov eax, dword [esp + 0x54]
cdq
idiv dword [esp + 0x1c]
push 0
push 0
push 0x147
mov dword [esp + 0x6c], 0
mov esi, eax
mov eax, dword [ebx + 0xcd4]
push eax
mov dword [esp + 0x28], esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0xf4], eax
xor eax, eax
cmp esi, eax
mov dword [esp + 0xc], eax
jle 0x40fbbf
mov dword [esp + 0x9c], eax
mov dword [esp + 0x54], eax
jmp 0x40f660
mov ebx, dword [esp + 0x88]
mov al, byte [ebx + 0x2ac]
test al, al
jne 0x40fbbb
mov eax, dword [esp + 0x1c]
xor esi, esi
test eax, eax
jle 0x40f731
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x40], ecx
jmp 0x40f6a0
mov eax, dword [esp + 0x2c]
lea esp, [esp]
mov cl, byte [ebx + 0x2ac]
test cl, cl
jne 0x40f731
test eax, eax
mov edx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x10d4]
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [ecx + esi*4]
mov ecx, dword [esp + 0x100]
push edx
push ecx
jl 0x4100ec
cmp eax, dword [ebx + 0x101c]
jge 0x4100ec
mov eax, dword [ebx + 0x1018]
add eax, dword [esp + 0x54]
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x68], esp
mov edi, esp
push eax
call fcn.00401c60
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.004039f0
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x34]
add esp, 0x18
add edx, 4
inc esi
inc ecx
cmp esi, eax
mov dword [esp + 0x40], edx
mov dword [esp + 0x2c], ecx
jl 0x40f698
xor eax, eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x24], eax
mov edi, edi
mov edi, dword [esp + 0x1c]
xor ecx, ecx
cmp edi, ecx
mov dword [esp + 0x94], ecx
mov ebx, SysReAllocString
mov dword [esp + 0x28], ecx
jle 0x40fabf
mov edx, dword [esp + 0x38]
mov eax, dword [edx + ecx*4]
mov esi, dword [esp + 0x24]
mov eax, dword [esi + eax]
cmp ebx, eax
jle 0x40f772
mov ebx, eax
mov esi, dword [esp + 0x28]
cmp esi, eax
jge 0x40f780
mov esi, eax
mov dword [esp + 0x28], esi
inc ecx
cmp ecx, edi
jl 0x40f762
cmp ebx, 0x7fffffff
je 0x40fabf
sub esi, ebx
inc esi
lea ecx, [esi*4]
push ecx
call fcn.00438e3f
add esp, 4
test esi, esi
mov dword [esp + 0x20], eax
jle 0x40f7b6
mov edi, dword [esp + 0x20]
mov ecx, esi
xor eax, eax
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x38]
xor eax, eax
lea esp, [esp]
mov ecx, dword [edx + eax*4]
mov esi, dword [esp + 0x24]
mov ecx, dword [ecx + esi]
mov esi, dword [esp + 0x20]
sub ecx, ebx
mov edi, dword [esi + ecx*4]
lea ecx, [esi + ecx*4]
inc edi
mov dword [ecx], edi
mov edi, dword [esp + 0x1c]
inc eax
cmp eax, edi
jl 0x40f7c0
mov eax, dword [esp + 0x48]
test eax, eax
jl 0x40fa45
mov esi, dword [esp + 0xa0]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x84]
mov edi, dword [esp + 0x5c]
sub ecx, esi
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x98]
sub ecx, esi
mov dword [esp + 0x110], ecx
mov ecx, dword [esp + 0x8c]
sub ecx, esi
mov dword [esp + 0xa8], ecx
mov ecx, dword [esp + 0x90]
sub edx, esi
sub edi, esi
sub ecx, esi
inc eax
mov dword [esp + 0xb4], edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x50], ecx
mov dword [esp + 0xac], eax
jmp 0x40f860
mov edx, dword [esp + 0xb4]
mov edi, dword [esp + 0x2c]
jmp 0x40f860
mov eax, dword [esi + edx]
test eax, eax
jl 0x40fa29
cmp eax, 1
jg 0x40fa29
mov eax, dword [esi + edi]
fld qword [0x449698]
mov eax, dword [eax]
test eax, eax
jl 0x40f8ab
mov edx, dword [esp + 0x40]
mov ecx, dword [esi + edx]
mov ecx, dword [ecx]
lea edx, [eax + 1]
nop
mov eax, dword [ecx]
cmp eax, ebx
jl 0x40f8a5
cmp eax, dword [esp + 0x28]
jg 0x40f8a5
mov edi, dword [esp + 0x20]
sub eax, ebx
fiadd dword [edi + eax*4]
add ecx, 4
dec edx
jne 0x40f890
mov edx, dword [esp + 0xb4]
cmp dword [esi + edx], 1
jne 0x40f9f2
mov eax, dword [esi]
cmp eax, 1
jg 0x40f902
mov eax, dword [esp + 0x2c]
mov eax, dword [esi + eax]
mov eax, dword [eax + 4]
test eax, eax
jl 0x40f9f2
mov ecx, dword [esp + 0x40]
mov edx, dword [esi + ecx]
mov ecx, dword [edx + 4]
lea edx, [eax + 1]
mov eax, dword [ecx]
cmp eax, ebx
jl 0x40f8f7
cmp eax, dword [esp + 0x28]
jg 0x40f8f7
mov edi, dword [esp + 0x20]
sub eax, ebx
fiadd dword [edi + eax*4]
add ecx, 4
dec edx
jne 0x40f8e2
jmp 0x40f9f2
cmp eax, 2
jne 0x40f946
mov eax, dword [esp + 0x2c]
mov eax, dword [esi + eax]
mov eax, dword [eax + 4]
test eax, eax
jl 0x40f9f2
mov ecx, dword [esp + 0x40]
mov edx, dword [esi + ecx]
mov ecx, dword [edx + 4]
lea edx, [eax + 1]
mov eax, dword [ecx]
cmp eax, ebx
jl 0x40f93b
cmp eax, dword [esp + 0x28]
jg 0x40f93b
mov edi, dword [esp + 0x20]
sub eax, ebx
fisub dword [edi + eax*4]
add ecx, 4
dec edx
jne 0x40f926
jmp 0x40f9f2
cmp eax, 3
jne 0x40f9f2
mov eax, dword [esp + 0x2c]
fld qword [0x449698]
mov eax, dword [esi + eax]
mov eax, dword [eax + 4]
test eax, eax
jl 0x40f99c
mov ecx, dword [esp + 0x40]
mov edx, dword [esi + ecx]
mov ecx, dword [edx + 4]
lea edx, [eax + 1]
mov eax, dword [ecx]
cmp eax, ebx
jl 0x40f985
cmp eax, dword [esp + 0x28]
jg 0x40f985
mov edi, dword [esp + 0x20]
sub eax, ebx
fiadd dword [edi + eax*4]
add ecx, 4
dec edx
jne 0x40f970
fcom qword [0x449698]
fnstsw ax
test ah, 0x41
jne 0x40f99c
fdivp st(1)
jmp 0x40f9a6
fstp st(0)
fstp st(0)
fld qword [0x44a358]
fld st(0)
call fcn.0042a7e4
mov dword [esp + 0x108], eax
fild dword [esp + 0x108]
fsubr st(1)
fcomp qword [0x44a350]
fnstsw ax
test ah, 1
jne 0x40f9d0
fsub qword [0x44a350]
sub esp, 8
fstp qword [esp]
lea eax, [esp + 0x1c]
push str._.2f
push eax
call fcn.00403000
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0042ab8f
add esp, 0x14
mov edx, dword [esp + 0x110]
mov eax, dword [esi + edx]
mov ecx, dword [esp + 0xa8]
mov edx, dword [esi + ecx]
sub esp, 8
fstp qword [esp]
push eax
mov eax, dword [esp + 0x5c]
mov ecx, dword [esi + eax]
push edx
push ecx
call fcn.004013f0
add esp, 0x14
test al, al
je 0x40fa29
inc dword [esp + 0x94]
mov eax, dword [esp + 0xac]
add esi, 4
dec eax
mov dword [esp + 0xac], eax
jne 0x40f850
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push edx
call fcn.00438e44
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0xb4]
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x54]
push ecx
push edx
push eax
call fcn.004016a0
add esp, 0x14
test al, al
je 0x40fabf
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
mov eax, dword [ecx + edx]
push 0
push 0
push 2
push 0
push 0
push 2
push eax
lea ecx, [esp + 0x9c]
push ecx
lea edx, [esp + 0x3800]
push edx
call fcn.00403630
push 0x449678
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0x380c]
push ecx
call fcn.00401120
add esp, 0x30
mov eax, dword [esp + 0x24]
add eax, 4
cmp eax, 0xfa0
mov dword [esp + 0x24], eax
jl 0x40f740
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x80]
inc eax
push eax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x5c]
push eax
lea ecx, [esp + 0xac]
push str._s_05d.txt
push ecx
mov byte [esp + edx + 0x37f0], 0
call fcn.00403000
add esp, 0x10
push 1
push ecx
lea edx, [esp + 0x37e8]
mov ecx, esp
mov dword [esp + 0x58], esp
push edx
call fcn.00405440
mov esi, dword [esp + 0xac]
push ecx
add esi, 0xfffffff0
mov dword [esp + 0xb4], esp
mov ebx, esp
push esi
mov byte [esp + 0x7e54], 0x14
call fcn.00401c60
add eax, 0x10
add esp, 4
mov dword [ebx], eax
mov byte [esp + 0x7e50], 0x13
call fcn.004020d0
add esp, 8
mov dword [esp + 0x54], esp
mov ebx, esp
push esi
call fcn.00401c60
mov ecx, dword [esp + 0x90]
add eax, 0x10
add esp, 4
add ecx, 0x374
mov dword [ebx], eax
call fcn.00418680
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x9c]
lea ecx, [edi*4]
add edx, ecx
mov ecx, dword [esp + 0x18]
inc eax
add esi, edi
cmp eax, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x9c], esi
mov dword [esp + 0x54], edx
jl 0x40f660
mov ebx, dword [esp + 0x88]
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x4c]
push eax
call fcn.00438e44
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00438e44
mov eax, dword [esp + 0x24]
add esp, 8
xor esi, esi
test eax, eax
jle 0x40fbf5
mov eax, dword [edi + esi*4]
push eax
call fcn.00438e44
mov eax, dword [esp + 0x20]
add esp, 4
inc esi
cmp esi, eax
jl 0x40fbe0
push edi
call fcn.00438e44
add esp, 4
push fcn.00401f70
push 7
push 4
lea edx, [esp + 0x70]
push edx
mov byte [esp + 0x7e54], 0xd
call fcn.0042b9ad
mov edi, dword [esp + 0x3c]
xor esi, esi
nop
mov eax, dword [edi + esi*4]
push eax
call fcn.00438e44
add esp, 4
inc esi
cmp esi, 0xa
jl 0x40fc20
push edi
call fcn.00438e44
mov edi, dword [esp + 0x34]
add esp, 4
xor esi, esi
mov eax, dword [edi + esi*4]
push eax
call fcn.00438e44
add esp, 4
inc esi
cmp esi, 0x3e8
jl 0x40fc41
push edi
call fcn.00438e44
mov edi, dword [esp + 0x38]
add esp, 4
xor esi, esi
mov eax, dword [edi + esi*4]
push eax
call fcn.00438e44
add esp, 4
inc esi
cmp esi, 3
jl 0x40fc65
push edi
call fcn.00438e44
mov ecx, dword [esp + 0x4c]
add esp, 4
test ecx, ecx
jl 0x40fd3d
mov esi, dword [esp + 0x8c]
mov eax, dword [esp + 0x90]
sub eax, esi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x5c]
sub eax, esi
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x84]
sub eax, esi
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x44]
sub eax, esi
inc ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + esi]
push eax
call fcn.00438e44
mov eax, dword [esi]
push eax
call fcn.00438e44
mov ecx, dword [esp + 0x58]
mov eax, dword [ecx + esi]
push eax
call fcn.00438e44
mov edx, dword [esp + 0x3c]
mov eax, dword [edx + esi]
add esp, 0xc
xor edi, edi
test eax, eax
jl 0x40fd1f
jmp 0x40fd00
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + esi]
mov eax, dword [ecx + edi*4]
push eax
call fcn.00438e44
mov edx, dword [esp + 0x34]
mov eax, dword [edx + esi]
add esp, 4
inc edi
cmp edi, eax
jle 0x40fd00
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + esi]
push eax
call fcn.00438e44
mov eax, dword [esp + 0x10]
add esp, 4
add esi, 4
dec eax
mov dword [esp + 0xc], eax
jne 0x40fcc6
mov ecx, dword [esp + 0x90]
push ecx
call fcn.00438e44
mov edx, dword [esp + 0x90]
push edx
call fcn.00438e44
mov eax, dword [esp + 0x64]
push eax
call fcn.00438e44
mov ecx, dword [esp + 0x50]
push ecx
call fcn.00438e44
mov edx, dword [esp + 0xb0]
push edx
call fcn.00438e44
mov eax, dword [esp + 0xac]
push eax
call fcn.00438e44
mov ecx, dword [esp + 0x9c]
push ecx
call fcn.00438e44
mov eax, dword [ebx + 0x2a8]
add esp, 0x1c
cmp eax, 0x22b8
mov byte [ebx + 0x2ac], 1
je 0x40fdbe
mov edx, dword [ebx + 0x1c]
push eax
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [ebx + 0x2a8], 0x22b8
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x44a330
call fcn.00405440
mov eax, dword [ebx + 0x2bc]
push eax
lea edx, [esp + 0x20]
lea ecx, [eax + 1]
push edx
mov dword [ebx + 0x2bc], ecx
call fcn.00405e40
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x24]
push 0x44a320
push ecx
mov byte [esp + 0x7e5c], 0x15
call fcn.00403000
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x18
mov byte [esp + 0x7e44], 0xd
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40fe2c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
push eax
push 0x517
mov ecx, ebx
call fcn.0043e669
push 1
push 0x43b
mov ecx, ebx
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
push 1
push 0xbc8
mov ecx, ebx
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
push 1
push 0x3f7
mov ecx, ebx
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
push 0
push 0x3f8
mov ecx, ebx
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
mov al, byte [ebx + 0x2b8]
test al, al
je 0x40fea5
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x150]
lea ecx, [esp + 0x114]
mov byte [esp + 0x7e44], 0xc
call fcn.00438415
mov eax, dword [esp + 0xb8]
add eax, 0xfffffff0
mov byte [esp + 0x7e44], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fee2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xe4]
add eax, 0xfffffff0
mov byte [esp + 0x7e44], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ff0b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x100]
add eax, 0xfffffff0
mov byte [esp + 0x7e44], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ff34
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xec]
add eax, 0xfffffff0
mov byte [esp + 0x7e44], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ff5d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xf0]
add eax, 0xfffffff0
mov byte [esp + 0x7e44], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ff86
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x104]
add eax, 0xfffffff0
mov byte [esp + 0x7e44], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ffaf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xfc]
add eax, 0xfffffff0
mov byte [esp + 0x7e44], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ffd8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10c]
add eax, 0xfffffff0
mov byte [esp + 0x7e44], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410001
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
mov byte [esp + 0x7e44], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410027
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xe8]
add eax, 0xfffffff0
mov byte [esp + 0x7e44], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410050
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xf8]
add eax, 0xfffffff0
mov byte [esp + 0x7e44], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410079
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x7e44], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41009f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xa4]
add eax, 0xfffffff0
mov dword [esp + 0x7e44], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4100cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x7e3c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x7e34]
call fcn.0042aa55
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jmp fcn.004373f3