Function at 0x40b670
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47c5f8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x25c4
call fcn.0045e3b0
mov eax, dword [0x4a05d0]
xor eax, esp
mov dword [esp + 0x25c0], eax
push ebx
push esi
push edi
mov eax, dword [0x4a05d0]
xor eax, esp
push eax
lea eax, [esp + 0x25d8]
mov dword fs:[0], eax
push 3
push 0
push 0
push 0
push 0
mov esi, ecx
push 0x4a4440
mov dword [esp + 0x28], esi
call fcn.0043fe6b
push 3
push 0
push 0
push 0
push 0
push 0x4a4498
mov ecx, esi
call fcn.0043fe6b
mov eax, dword [0x4a9600]
shr eax, 5
test al, 1
je 0x40bc1e
push 0
mov eax, 4
mov ecx, 0x4a1ac0
mov ebx, 0x486364
call fcn.00406880
add esp, 4
cmp eax, 6
jne 0x40c4b3
mov eax, dword [esi + 0xf84]
xor ebx, ebx
test eax, eax
jle 0x40bbfa
add esi, 0xf90
mov dword [esp + 0x18], esi
test ebx, ebx
jl 0x40bc19
mov ecx, dword [esp + 0x18]
cmp ebx, dword [ecx + 8]
jge 0x40bc19
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 4]
lea ecx, [ebx*4]
add eax, ecx
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00409fc0
lea edi, [eax + 0x10]
add esp, 4
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x10]
add eax, 0xfc0
mov dword [esp + 0x25e0], 0
call fcn.004117d0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esi]
mov eax, 0x10624dd3
mul ecx
mov esi, edx
shr esi, 6
cmp dword [edi - 0xc], 0
jge 0x40b7a7
or eax, 0xffffffff
jmp 0x40b7c2
push 0x486384
push edi
call fcn.00459abe
add esp, 8
test eax, eax
jne 0x40b7be
or eax, 0xffffffff
jmp 0x40b7c2
sub eax, edi
sar eax, 1
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x24]
call fcn.004116c0
xor eax, eax
push 0x1fe
push eax
lea ecx, [esp + 0x1d6]
mov byte [esp + 0x25e8], 1
push ecx
mov word [esp + 0x1d8], ax
call fcn.0045db90
add esp, 0xc
push str.http:__record.4399.com_d.php_aweb.onlinegame_sserverS_slength_ldcid
lea ecx, [esp + 0x30]
call fcn.0040a630
mov edi, eax
mov byte [esp + 0x25e0], 2
call fcn.00413640
push eax
lea edx, [esp + 0x2c]
push edi
push edx
call fcn.00408c50
add esp, 0xc
mov edi, eax
mov eax, dword [esp + 0x10]
add eax, 0xfd8
push ebx
mov byte [esp + 0x25e4], 3
mov dword [esp + 0x24], eax
call fcn.00411910
add eax, 0x38
cmp dword [eax + 0x18], 8
jb 0x40b850
mov eax, dword [eax + 4]
jmp 0x40b853
add eax, 4
mov ecx, dword [esp + 0x14]
mov edi, dword [edi]
push esi
push ecx
push eax
push edi
lea edx, [esp + 0x1dc]
push pe_nt_image_headers32
push edx
call fcn.00459cf8
mov byte [esp + 0x25f8], 2
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
add esp, 0x18
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b89a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x25e0], 1
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b8c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x10]
mov esi, dword [edi + 0xfcc]
cmp esi, dword [edi + 0xfd0]
jbe 0x40b8d9
call fcn.0045bac4
mov edi, dword [edi + 0xfc0]
test edi, edi
jne 0x40b8fa
call fcn.0045bac4
xor eax, eax
lea esi, [esi + ebx*4]
cmp esi, dword [eax + 0x10]
ja 0x40b905
test edi, edi
je 0x40b8fe
mov edi, dword [edi]
jmp 0x40b900
mov eax, dword [edi]
jmp 0x40b8ea
xor edi, edi
cmp esi, dword [edi + 0xc]
jae 0x40b90a
call fcn.0045bac4
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0xfd0]
lea ecx, [esi + 4]
sub eax, ecx
sar eax, 2
test eax, eax
jle 0x40b930
add eax, eax
add eax, eax
push eax
push ecx
push eax
push esi
call fcn.00459958
add esp, 0x10
add dword [edi + 0xfd0], 0xfffffffc
mov eax, dword [edi + 0xfd0]
cmp dword [edi + 0xfcc], esi
ja 0x40b949
cmp esi, eax
jbe 0x40b94e
call fcn.0045bac4
push 0x485fe4
lea ecx, [esp + 0x1d0]
call fcn.00406530
add esp, 4
xor ecx, ecx
push 0x2e
push ecx
lea edx, [esp + 0x76]
push edx
mov word [esp + 0x78], cx
call fcn.0045db90
add esp, 0xc
lea esi, [esp + 0x6c]
call fcn.00408080
xor eax, eax
push 0x7e
push eax
lea ecx, [esp + 0xd6]
push ecx
mov word [esp + 0xd8], ax
call fcn.0045db90
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [esp + 0x5d6]
push eax
mov word [esp + 0x5d8], dx
call fcn.0045db90
add esp, 0xc
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x15d6]
push edx
mov word [esp + 0x15d8], cx
call fcn.0045db90
add esp, 0xc
lea eax, [esp + 0xcc]
push 0x400
push eax
mov ecx, 0x48642c
call fcn.004068f0
add esp, 8
lea ecx, [esp + 0x5cc]
push 0x400
push ecx
call fcn.00413410
mov ecx, eax
call fcn.004068f0
add esp, 8
lea edx, [esp + 0x5cc]
push edx
mov eax, esi
push 0x48538c
push eax
call fcn.004136b0
push eax
call fcn.00413640
push eax
call fcn.00413800
push eax
call fcn.00413790
push eax
call fcn.00413720
push eax
call fcn.004134f0
push eax
lea ecx, [esp + 0xf0]
push ecx
push 0x486438
push 0x485398
lea edx, [esp + 0x15fc]
call fcn.00409a30
push 0x485fe4
lea ecx, [esp + 0x1600]
call fcn.00406530
lea ecx, [edi + 0xf7c]
add esp, 0x34
cmp ebx, dword [ecx + 8]
jge 0x40bc19
mov edx, dword [ecx + 4]
mov eax, dword [edx + ebx*4]
push 1
push ebx
mov dword [esp + 0x2c], eax
call fcn.0043cafa
mov ecx, dword [esp + 0x18]
push 1
push ebx
call fcn.0043cd56
mov edi, dword [esp + 0x20]
mov esi, dword [edi + 0xc]
cmp esi, dword [edi + 0x10]
jbe 0x40bab9
call fcn.0045bac4
mov edi, dword [edi]
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], esi
test edi, edi
jne 0x40bae2
call fcn.0045bac4
xor eax, eax
mov ecx, ebx
imul ecx, ecx, 0x54
add esi, ecx
cmp esi, dword [eax + 0x10]
ja 0x40baed
test edi, edi
je 0x40bae6
mov edi, dword [edi]
jmp 0x40bae8
mov eax, dword [edi]
jmp 0x40bace
xor edi, edi
cmp esi, dword [edi + 0xc]
jae 0x40baf2
call fcn.0045bac4
mov edx, dword [esp + 0x34]
mov edi, dword [esp + 0x20]
push esi
push edx
lea eax, [esp + 0x44]
push eax
call fcn.00411a50
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xf84]
cmp ebx, eax
jl 0x40bb17
lea ebx, [eax - 1]
mov eax, dword [esi + 0xf98]
imul eax, eax, 0xb0
push 1
push 0x10
push 0x1c
push 5
add eax, 0x82
push eax
lea ecx, [esi + 0x6d0]
mov dword [esi + 0xfb4], ebx
call fcn.0043fb81
mov eax, dword [esi + 0xf84]
mov ecx, dword [esp + 0x24]
imul eax, eax, 0xb0
add eax, 0x132
push ecx
mov dword [esp + 0x50], 0x82
mov dword [esp + 0x54], 3
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0x19
call fcn.00443a23
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x60]
call eax
mov edx, dword [esi + 0x20]
push 1
lea ecx, [esp + 0x50]
push ecx
or edi, 0xffffffff
push edx
mov dword [esi + 0xfbc], edi
mov dword [esi + 0xfb8], edi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [esp + 0x25e0], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bbc9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x25e0], edi
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x40bbed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esi + 0xf84], 0
jg 0x40b731
push 4
push 1
push 2
push 0
push 0
push 0
mov ecx, esi
call fcn.0043fe6b
mov eax, esi
call fcn.0040b3c0
jmp 0x40c4b3
call fcn.00439d70
mov eax, dword [esi + 0xf84]
mov dword [esp + 0x14], 0
test eax, eax
jle 0x40c468
add esi, 0xf90
mov dword [esp + 0x18], esi
mov eax, esi
jmp 0x40bc46
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test ebx, ebx
jl 0x40bc19
cmp ebx, dword [eax + 8]
jge 0x40bc19
mov eax, dword [eax + 4]
lea ecx, [ebx*4]
mov esi, dword [eax + ecx]
add eax, ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
sub esi, 0x10
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x40bc89
cmp eax, dword [esi]
jne 0x40bc89
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x40bcc4
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x40c4d7
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004598db
add esp, 0x10
add edi, 0x10
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x10]
add eax, 0xfc0
mov dword [esp + 0x25e0], 4
mov dword [esp + 0x30], eax
call fcn.004117d0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esi]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
cmp dword [edi - 0xc], 0
mov dword [esp + 0x24], edx
jge 0x40bd0d
or eax, 0xffffffff
jmp 0x40bd28
push 0x486384
push edi
call fcn.00459abe
add esp, 8
test eax, eax
jne 0x40bd24
or eax, 0xffffffff
jmp 0x40bd28
sub eax, edi
sar eax, 1
push eax
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x30]
call fcn.004116c0
xor eax, eax
push 0x1fe
push eax
lea ecx, [esp + 0x3d6]
mov byte [esp + 0x25e8], 5
push ecx
mov word [esp + 0x3d8], ax
call fcn.0045db90
add esp, 0xc
push str.http:__record.4399.com_d.php_aweb.onlinegame_sserverS_slength_ldcid
lea ecx, [esp + 0x48]
call fcn.0040a630
mov ebx, eax
mov eax, 0x4a9100
mov byte [esp + 0x25e0], 6
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40bd80
sub eax, ecx
lea edi, [eax + eax + 2]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00439af0
add esp, 4
push edi
mov esi, eax
push 0
push esi
call fcn.0045db90
mov eax, 0x4a9100
add esp, 0xc
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40bdc0
push edi
push esi
sub eax, ecx
push eax
push 0x4a9100
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.00408c50
add esp, 0xc
mov esi, eax
mov eax, dword [esp + 0x10]
mov byte [esp + 0x25e0], 7
mov ecx, dword [esp + 0x14]
add eax, 0xfd8
push ecx
mov dword [esp + 0x24], eax
call fcn.00411910
add eax, 0x38
cmp dword [eax + 0x18], 8
jb 0x40be19
mov eax, dword [eax + 4]
jmp 0x40be1c
add eax, 4
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esi]
push edx
push ecx
push eax
push esi
lea edx, [esp + 0x3dc]
push pe_nt_image_headers32
push edx
call fcn.00459cf8
mov byte [esp + 0x25f8], 6
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
add esp, 0x18
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40be67
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x25e0], 5
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40be8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x30]
mov esi, dword [edi + 0xc]
cmp esi, dword [edi + 0x10]
jbe 0x40bea0
call fcn.0045bac4
mov ebx, dword [edi]
test ebx, ebx
jne 0x40bec4
call fcn.0045bac4
xor ecx, ecx
mov eax, dword [esp + 0x14]
add eax, eax
add eax, eax
add esi, eax
cmp esi, dword [ecx + 0x10]
ja 0x40becf
test ebx, ebx
je 0x40bec8
mov ebx, dword [ebx]
jmp 0x40beca
mov ecx, dword [ebx]
jmp 0x40bead
xor ebx, ebx
cmp esi, dword [ebx + 0xc]
jae 0x40bed4
call fcn.0045bac4
mov eax, dword [edi + 0x10]
lea ecx, [esi + 4]
sub eax, ecx
sar eax, 2
test eax, eax
jle 0x40bef3
add eax, eax
add eax, eax
push eax
push ecx
push eax
push esi
call fcn.00459958
add esp, 0x10
add dword [edi + 0x10], 0xfffffffc
mov eax, dword [edi + 0x10]
cmp dword [edi + 0xc], esi
ja 0x40bf03
cmp esi, eax
jbe 0x40bf08
call fcn.0045bac4
push 0x485fe4
lea ecx, [esp + 0x3d0]
call fcn.00406530
add esp, 4
xor ecx, ecx
push 0x2e
push ecx
lea edx, [esp + 0xa6]
push edx
mov word [esp + 0xa8], cx
call fcn.0045db90
add esp, 0xc
lea esi, [esp + 0x9c]
call fcn.00408080
xor eax, eax
push 0x7e
push eax
lea ecx, [esp + 0x156]
push ecx
mov word [esp + 0x158], ax
call fcn.0045db90
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [esp + 0xdd6]
push eax
mov word [esp + 0xdd8], dx
call fcn.0045db90
add esp, 0xc
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x1dd6]
push edx
mov word [esp + 0x1dd8], cx
call fcn.0045db90
add esp, 0xc
lea eax, [esp + 0x14c]
push 0x400
push eax
mov ecx, 0x48642c
call fcn.004068f0
mov eax, 0x4a8500
add esp, 8
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40bfc4
sub eax, ecx
lea edi, [eax + eax + 2]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00439af0
add esp, 4
push edi
mov esi, eax
push 0
push esi
call fcn.0045db90
mov eax, 0x4a8500
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c002
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
push esi
sub eax, ecx
push eax
push 0x4a8500
push 0
push 0
call ebx
lea eax, [esp + 0xdcc]
push 0x400
push eax
mov ecx, esi
call fcn.004068f0
mov eax, 0x4a9200
add esp, 8
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c040
sub eax, ecx
lea esi, [eax + eax + 2]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00439af0
add esp, 4
push esi
mov edi, eax
push 0
push edi
mov dword [esp + 0x3c], edi
call fcn.0045db90
mov eax, 0x4a9200
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c082
push esi
push edi
sub eax, ecx
push eax
push 0x4a9200
push 0
push 0
call ebx
mov eax, 0x4a9100
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c0a1
sub eax, ecx
lea esi, [eax + eax + 2]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00439af0
add esp, 4
push esi
mov edi, eax
push 0
push edi
mov dword [esp + 0x30], edi
call fcn.0045db90
mov eax, 0x4a9100
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c0e3
push esi
push edi
sub eax, ecx
push eax
push 0x4a9100
push 0
push 0
call ebx
mov eax, 0x4a9500
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c102
sub eax, ecx
lea esi, [eax + eax + 2]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00439af0
add esp, 4
push esi
mov edi, eax
push 0
push edi
mov dword [esp + 0x54], edi
call fcn.0045db90
mov eax, 0x4a9500
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c144
push esi
push edi
sub eax, ecx
push eax
push 0x4a9500
push 0
push 0
call ebx
mov eax, 0x4a9400
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c163
sub eax, ecx
lea esi, [eax + eax + 2]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00439af0
add esp, 4
push esi
mov edi, eax
push 0
push edi
mov dword [esp + 0x40], edi
call fcn.0045db90
mov eax, 0x4a9400
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c1a5
push esi
push edi
sub eax, ecx
push eax
push 0x4a9400
push 0
push 0
call ebx
mov eax, 0x4a9300
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c1c4
sub eax, ecx
lea esi, [eax + eax + 2]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00439af0
add esp, 4
push esi
mov ebx, eax
push 0
push ebx
call fcn.0045db90
mov eax, 0x4a9300
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c202
push esi
push ebx
sub eax, edi
push eax
push 0x4a9300
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, 0x4a8800
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c225
sub eax, esi
lea edi, [eax + eax + 2]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00439af0
add esp, 4
push edi
mov esi, eax
push 0
push esi
call fcn.0045db90
mov eax, 0x4a8800
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c263
push edi
push esi
sub eax, ecx
push eax
push 0x4a8800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [esp + 0x30]
lea eax, [esp + 0xdcc]
push eax
mov eax, dword [esp + 0x28]
push 0x48538c
lea ecx, [esp + 0xa4]
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x44]
push eax
push ecx
push edx
push ebx
push esi
lea eax, [esp + 0x170]
push eax
push 0x486438
push 0x485398
lea edx, [esp + 0x1dfc]
call fcn.00409a30
push 0x485fe4
lea ecx, [esp + 0x1e00]
call fcn.00406530
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
add ecx, 0xf7c
add esp, 0x34
cmp edx, dword [ecx + 8]
jge 0x40bc19
mov eax, dword [ecx + 4]
mov ebx, edx
mov edx, dword [eax + ebx*4]
push 1
push ebx
mov dword [esp + 0x3c], edx
call fcn.0043cafa
mov ecx, dword [esp + 0x18]
push 1
push ebx
call fcn.0043cd56
mov edi, dword [esp + 0x20]
mov esi, dword [edi + 0xc]
cmp esi, dword [edi + 0x10]
jbe 0x40c323
call fcn.0045bac4
mov edi, dword [edi]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], esi
test edi, edi
jne 0x40c34c
call fcn.0045bac4
xor eax, eax
mov ecx, ebx
imul ecx, ecx, 0x54
add esi, ecx
cmp esi, dword [eax + 0x10]
ja 0x40c357
test edi, edi
je 0x40c350
mov edi, dword [edi]
jmp 0x40c352
mov eax, dword [edi]
jmp 0x40c338
xor edi, edi
cmp esi, dword [edi + 0xc]
jae 0x40c35c
call fcn.0045bac4
mov edx, dword [esp + 0x3c]
mov edi, dword [esp + 0x20]
push esi
push edx
lea eax, [esp + 0x54]
push eax
call fcn.00411a50
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xf84]
cmp ebx, eax
jl 0x40c385
lea ebx, [eax - 1]
mov dword [esp + 0x14], ebx
mov eax, dword [esi + 0xf98]
imul eax, eax, 0xb0
push 1
push 0x10
push 0x1c
push 5
add eax, 0x82
push eax
lea ecx, [esi + 0x6d0]
mov dword [esi + 0xfb4], ebx
call fcn.0043fb81
mov eax, dword [esi + 0xf84]
mov ecx, dword [esp + 0x34]
imul eax, eax, 0xb0
add eax, 0x132
push ecx
mov dword [esp + 0x60], 0x82
mov dword [esp + 0x64], 3
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0x19
call fcn.00443a23
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x60]
call eax
mov edx, dword [esi + 0x20]
push 1
lea ecx, [esp + 0x60]
push ecx
or edi, 0xffffffff
push edx
mov dword [esi + 0xfbc], edi
mov dword [esi + 0xfb8], edi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [esp + 0x25e0], 4
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c437
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x25e0], edi
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x40c45b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esi + 0xf84], 0
jg 0x40bc42
push 4
push 1
push 2
push 0
push 0
push 0
mov ecx, esi
call fcn.0043fe6b
cmp dword [esi + 0x1900], 0
mov ecx, dword [esi + 0xf84]
mov dword [0x4a5694], ecx
je 0x40c4b3
add esi, 0x18e0
push 5
mov ecx, esi
call fcn.0043fbc1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00443a23
push eax
mov ecx, esi
call fcn.0044334b
mov ecx, dword [esp + 0x25d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x25c0]
xor ecx, esp
call fcn.004597c7
mov esp, ebp
pop ebp
ret
call fcn.0040a400
int3