Function at 0x409790
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x5ecf5a
mov eax, dword fs:[0]
push eax
sub esp, 0x1cc
mov eax, dword [0x6731c0]
xor eax, esp
mov dword [esp + 0x1c4], eax
push esi
push edi
mov eax, dword [0x6731c0]
xor eax, esp
push eax
lea eax, [esp + 0x1d8]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x30], edi
push 0
push 0
push 0x31
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call fcn.00460613
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x409812
mov esi, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call esi
test eax, eax
jne 0x409808
push 0xc
call esi
test eax, eax
je 0x409812
push eax
call fcn.00460613
mov dword [esp + 0x2c], eax
lea eax, [edi + 0xbc]
mov ecx, eax
mov dword [esp + 0x20], eax
call fcn.0043b150
lea esi, [edi + 0x120c0]
mov ecx, esi
call fcn.0040ce40
mov ecx, eax
call fcn.0040cec0
mov eax, dword [esi]
push ecx
sub eax, 0x10
mov edi, esp
push eax
call fcn.0040de00
add esp, 4
lea ecx, [esp + 0x40]
add eax, 0x10
mov dword [edi], eax
call fcn.0044e590
mov dword [esp + 0x1e0], 0
mov byte [esp + 0x54], 1
call fcn.0045e131
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x409882
push 0x80004005
call fcn.0040ddd0
mov eax, dword [edx]
mov ecx, edx
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
mov byte [esp + 0x1e0], 1
push eax
lea ecx, [esp + 0x40]
call fcn.0044e6d0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0044e7f0
lea eax, [esp + 0x14]
mov byte [esp + 0x1e0], 2
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0044e990
lea eax, [esp + 0x14]
mov byte [esp + 0x1e0], 3
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0044eb20
mov byte [esp + 0x1e0], 4
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 4
call esi
push 0x20
mov edi, eax
call esi
push 0x21
mov dword [esp + 0x64], eax
call esi
mov esi, eax
lea ecx, [esp + 0x3c]
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0044f030
mov ecx, dword [esp + 0x168]
sub ecx, dword [esp + 0x160]
mov eax, dword [esp + 0x164]
add ecx, esi
sub eax, dword [esp + 0x15c]
add ecx, edi
add eax, dword [esp + 0x60]
mov edi, dword [esp + 0x30]
push 1
push ecx
push eax
push 0
push 0
mov ecx, edi
call fcn.0045db93
lea eax, [esp + 0x14]
push eax
lea esi, [edi + 0x120c4]
push esi
push ecx
call fcn.0044f430
lea eax, [esp + 0x14]
push eax
push esi
push ecx
call fcn.00452a90
push dword [esp + 0x24]
mov ecx, edi
call fcn.0045ddcb
mov ecx, edi
call fcn.00409000
push 1
push dword [esi]
mov ecx, edi
call fcn.0045e75f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x40]
call fcn.0044e6d0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x64]
push eax
call fcn.0044e7f0
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x1e4], 5
call fcn.0040de70
mov byte [esp + 0x1e0], 4
or eax, 0xffffffff
mov edx, dword [esp + 0x60]
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4099e4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esp + 0x20]
jmp 0x4099f0
mov eax, dword [esp + 0x34]
mov edx, 0x644e14
mov ecx, eax
jmp 0x409a00
mov si, word [ecx]
cmp si, word [edx]
jne 0x409a26
test si, si
je 0x409a22
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x409a26
add ecx, 4
add edx, 4
test si, si
jne 0x409a00
xor ecx, ecx
jmp 0x409a2b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
setne cl
test cl, cl
je 0x40cd7a
mov edx, 0x644e20
mov ecx, eax
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x409a66
test si, si
je 0x409a62
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x409a66
add ecx, 4
add edx, 4
test si, si
jne 0x409a40
xor ecx, ecx
jmp 0x409a6b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
sete cl
test cl, cl
je 0x409c7d
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x15c]
push eax
call fcn.0044e990
mov byte [esp + 0x1e0], 6
mov ecx, dword [eax]
mov esi, dword [esp + 0x1c]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x409aec
cmp dword [esi + 0xc], 0
jl 0x409adf
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x409adf
push edx
call fcn.0040de00
add esp, 4
mov dword [esp + 0x18], eax
or ecx, 0xffffffff
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409ad6
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0x10
mov dword [esp + 0x1c], eax
jmp 0x409aec
push dword [ecx - 0xc]
push ecx
lea ecx, [esp + 0x24]
call fcn.0040dd10
mov byte [esp + 0x1e0], 4
or ecx, 0xffffffff
mov edx, dword [esp + 0x158]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409b15
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x120]
push eax
call fcn.0044eb20
mov byte [esp + 0x1e0], 7
mov ecx, dword [eax]
mov esi, dword [esp + 0x24]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x409b89
cmp dword [esi + 0xc], 0
jl 0x409b7c
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x409b7c
push edx
call fcn.0040de00
add esp, 4
mov dword [esp + 0x18], eax
or ecx, 0xffffffff
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409b73
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0x10
mov dword [esp + 0x24], eax
jmp 0x409b89
push dword [ecx - 0xc]
push ecx
lea ecx, [esp + 0x2c]
call fcn.0040dd10
mov byte [esp + 0x1e0], 4
or ecx, 0xffffffff
mov edx, dword [esp + 0x11c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409bb2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0xa4
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x90], eax
mov byte [esp + 0x1e0], 8
test eax, eax
je 0x409bf7
mov ecx, eax
call fcn.00439270
mov ecx, eax
mov dword [esp + 0x18], eax
jmp 0x409bfd
xor ecx, ecx
mov dword [esp + 0x18], ecx
push 0xffff
push dword [esp + 0x34]
lea edx, [esp + 0x164]
mov byte [esp + 0x1e8], 4
mov eax, dword [ecx]
push edx
push 0x54000100
push dword [esp + 0x34]
call dword [eax + 0x160]
mov esi, dword [esp + 0x2c]
test esi, esi
jne 0x409c33
xor eax, eax
jmp 0x409c36
mov eax, dword [esi + 4]
mov esi, dword [esp + 0x18]
push 1
push eax
push 0x30
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x14]
push eax
push esi
push 0
lea ecx, [esp + 0x48]
call fcn.0044f780
push 0
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
mov ecx, edi
push 0
push esi
call fcn.0043af20
jmp 0x40cd2a
mov edx, 0x644e28
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x409caa
test si, si
je 0x409ca6
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x409caa
add ecx, 4
add edx, 4
test si, si
jne 0x409c84
xor ecx, ecx
jmp 0x409caf
sbb ecx, ecx
or ecx, 1
test ecx, ecx
sete cl
test cl, cl
je 0x409f7e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x134]
push eax
call fcn.0044e990
mov byte [esp + 0x1e0], 9
mov ecx, dword [eax]
mov esi, dword [esp + 0x1c]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x409d30
cmp dword [esi + 0xc], 0
jl 0x409d23
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x409d23
push edx
call fcn.0040de00
add esp, 4
mov dword [esp + 0x18], eax
or ecx, 0xffffffff
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409d1a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0x10
mov dword [esp + 0x1c], eax
jmp 0x409d30
push dword [ecx - 0xc]
push ecx
lea ecx, [esp + 0x24]
call fcn.0040dd10
mov byte [esp + 0x1e0], 4
or ecx, 0xffffffff
mov edx, dword [esp + 0x130]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409d59
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x144]
push eax
call fcn.0044eb20
mov byte [esp + 0x1e0], 0xa
mov ecx, dword [eax]
mov esi, dword [esp + 0x24]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x409dcd
cmp dword [esi + 0xc], 0
jl 0x409dc0
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x409dc0
push edx
call fcn.0040de00
add esp, 4
mov dword [esp + 0x18], eax
or ecx, 0xffffffff
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409db7
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0x10
mov dword [esp + 0x24], eax
jmp 0x409dcd
push dword [ecx - 0xc]
push ecx
lea ecx, [esp + 0x2c]
call fcn.0040dd10
mov byte [esp + 0x1e0], 4
or ecx, 0xffffffff
mov edx, dword [esp + 0x140]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409df6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0xd4
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x90], eax
mov byte [esp + 0x1e0], 0xb
test eax, eax
je 0x409e3b
mov ecx, eax
call fcn.00433ea0
mov ecx, eax
mov dword [esp + 0x18], eax
jmp 0x409e41
xor ecx, ecx
mov dword [esp + 0x18], ecx
push 0xffff
push dword [esp + 0x34]
lea edx, [esp + 0x164]
mov byte [esp + 0x1e8], 4
mov eax, dword [ecx]
push edx
push 0x54004300
push dword [esp + 0x34]
call dword [eax + 0x160]
mov esi, dword [esp + 0x2c]
test esi, esi
jne 0x409e77
xor eax, eax
jmp 0x409e7a
mov eax, dword [esi + 4]
mov esi, dword [esp + 0x18]
push 1
push eax
push 0x30
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
push eax
call fcn.0040de00
add eax, 0x10
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0xc
lea ecx, [eax - 0x10]
mov edx, dword [esi + 0x78]
sub edx, 0x10
mov dword [esp + 0x18], ecx
mov dword [esp + 0x58], edx
cmp ecx, edx
je 0x409f26
cmp dword [edx + 0xc], 0
lea edi, [edx + 0xc]
mov dword [esp + 0x5c], edi
mov edi, dword [esp + 0x20]
jl 0x409f16
mov ecx, dword [ecx]
cmp ecx, dword [edx]
jne 0x409f16
mov edx, dword [esp + 0x18]
push edx
call fcn.0040de00
mov dword [esp + 0x94], eax
add esp, 4
mov eax, dword [esp + 0x5c]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409f07
mov eax, dword [esp + 0x58]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x90]
add eax, 0x10
mov dword [esi + 0x78], eax
jmp 0x409f22
push dword [eax - 0xc]
lea ecx, [esi + 0x78]
push eax
call fcn.0040dd10
mov ecx, dword [esp + 0x18]
lea eax, [ecx + 0xc]
mov byte [esp + 0x1e0], 4
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409f49
mov edx, dword [esp + 0x18]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x14]
push eax
push esi
push 1
lea ecx, [esp + 0x48]
call fcn.0044f780
push 1
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
mov ecx, edi
push 1
push esi
call fcn.0043af20
jmp 0x40cd2a
mov edx, 0x644e30
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x409fab
test si, si
je 0x409fa7
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x409fab
add ecx, 4
add edx, 4
test si, si
jne 0x409f85
xor ecx, ecx
jmp 0x409fb0
sbb ecx, ecx
or ecx, 1
test ecx, ecx
sete cl
test cl, cl
je 0x40a308
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x150]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0xd
call fcn.0040de70
mov byte [esp + 0x1e0], 4
or ecx, 0xffffffff
mov edx, dword [esp + 0x14c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a00a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14c]
push eax
call fcn.0044eb20
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1e4], 0xe
call fcn.0040de70
mov byte [esp + 0x1e0], 4
or ecx, 0xffffffff
mov edx, dword [esp + 0x148]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a057
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0xb4
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0xf
test eax, eax
je 0x40a095
mov ecx, eax
call fcn.004359c0
mov esi, eax
jmp 0x40a097
xor esi, esi
lea eax, [esp + 0x14]
mov byte [esp + 0x1e0], 4
push eax
push esi
push 2
lea ecx, [esp + 0x48]
call fcn.0044f780
mov al, byte [esi + 0xa0]
test al, al
je 0x40a19e
mov cl, byte [esi + 0xa1]
test cl, cl
je 0x40a150
mov al, byte [esi + 0xa2]
test al, al
jne 0x40a105
push 0xffff
push dword [esp + 0x34]
lea eax, [esp + 0x164]
mov ecx, esi
push eax
push 0x54801044
call fcn.00467d04
push 1
push 1
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_ShowScrollBar]
jmp 0x40a1bb
test cl, cl
je 0x40a150
mov al, byte [esi + 0xa2]
test al, al
je 0x40a14c
push 0xffff
push dword [esp + 0x34]
lea eax, [esp + 0x164]
mov ecx, esi
push eax
push 0x548010c4
call fcn.00467d04
push 1
push 1
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_ShowScrollBar]
push 1
push 0
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_ShowScrollBar]
jmp 0x40a1bb
test cl, cl
jne 0x40a186
mov al, byte [esi + 0xa2]
test al, al
je 0x40a186
push 0xffff
push dword [esp + 0x34]
lea eax, [esp + 0x164]
mov ecx, esi
push eax
push 0x54801084
call fcn.00467d04
push 1
push 0
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_ShowScrollBar]
jmp 0x40a1bb
push 0xffff
push dword [esp + 0x34]
lea eax, [esp + 0x164]
push eax
push 0x54801044
jmp 0x40a1b4
push 0xffff
push dword [esp + 0x34]
lea eax, [esp + 0x164]
push eax
push 0x54800080
mov ecx, esi
call fcn.00467d04
mov al, byte [esi + 0x9f]
test al, al
jne 0x40a1d5
push 0
push 0x8000000
push 0
mov ecx, esi
call fcn.0045da41
mov al, byte [esi + 0x9e]
test al, al
je 0x40a1f1
push 0
push 1
push 0xcf
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov al, byte [esi + 0x9c]
test al, al
je 0x40a20d
push 0
push 0x2a
push 0xcc
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov al, byte [esi + 0x9d]
test al, al
je 0x40a227
push 0
push 0x2000
push 0
mov ecx, esi
call fcn.0045da41
mov eax, dword [esi + 0x84]
test eax, eax
je 0x40a23b
mov ecx, esi
mov dword [esi + 0x74], eax
call fcn.00435e40
mov eax, dword [esi + 0x88]
cmp eax, 0xffffff
je 0x40a252
mov ecx, esi
mov dword [esi + 0x78], eax
call fcn.00435e40
mov edx, dword [esi + 0xa4]
mov eax, 2
cmp edx, 2
cmova edx, eax
mov eax, dword [esi + 0x20]
mov dword [esp + 0x18], edx
test eax, eax
je 0x40a2a4
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, dword [esp + 0x18]
mov ecx, edx
and ecx, eax
cmp ecx, edx
je 0x40a2a4
push 0
push edx
push dword [esi + 0xa4]
mov ecx, esi
call fcn.0045da41
push 1
push 0
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [esp + 0x18]
lea eax, [esi + 0xac]
mov dword [esi + 0xa4], edx
test eax, eax
je 0x40a2c0
cmp dword [eax + 4], 0
je 0x40a2c0
test eax, eax
jne 0x40a2c8
jmp 0x40a2cb
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x40a2cb
mov eax, dword [eax + 4]
push 1
push eax
push 0x30
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [esp + 0x24]
mov ecx, esi
call fcn.0045ddcb
push 2
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
mov ecx, edi
push 2
push esi
call fcn.0043af20
jmp 0x40cd2a
mov ecx, 0x644e38
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40a336
test dx, dx
je 0x40a332
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40a336
add eax, 4
add ecx, 4
test dx, dx
jne 0x40a310
xor eax, eax
jmp 0x40a33b
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
je 0x40a4aa
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xa8]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x10
call fcn.0040de70
mov byte [esp + 0x1e0], 4
or ecx, 0xffffffff
mov edx, dword [esp + 0xa4]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a395
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x108]
push eax
call fcn.0044eb20
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1e4], 0x11
call fcn.0040de70
mov byte [esp + 0x1e0], 4
or ecx, 0xffffffff
mov edx, dword [esp + 0x104]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a3e2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push pe_nt_image_headers32
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x12
test eax, eax
je 0x40a424
mov ecx, eax
call fcn.00438d20
mov ecx, eax
mov dword [esp + 0x18], eax
jmp 0x40a42a
xor ecx, ecx
mov dword [esp + 0x18], ecx
push 0xffff
push dword [esp + 0x34]
lea edx, [esp + 0x164]
mov byte [esp + 0x1e8], 4
mov eax, dword [ecx]
push edx
push 0x54000009
push dword [esp + 0x34]
call dword [eax + 0x160]
mov esi, dword [esp + 0x2c]
test esi, esi
jne 0x40a460
xor eax, eax
jmp 0x40a463
mov eax, dword [esi + 4]
mov esi, dword [esp + 0x18]
push 1
push eax
push 0x30
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x14]
push eax
push esi
push 3
lea ecx, [esp + 0x48]
call fcn.0044f780
push 3
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
mov ecx, edi
push 3
push esi
call fcn.0043af20
jmp 0x40cd2a
lea eax, [esp + 0x34]
push 0x644e40
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40a626
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xb0]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x13
call fcn.0040de70
mov byte [esp + 0x1e0], 4
or ecx, 0xffffffff
mov edx, dword [esp + 0xac]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a511
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.0044eb20
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1e4], 0x14
call fcn.0040de70
mov byte [esp + 0x1e0], 4
or ecx, 0xffffffff
mov edx, dword [esp + 0x134]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a55e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push pe_nt_image_headers32
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x15
test eax, eax
je 0x40a5a0
mov ecx, eax
call fcn.00434e80
mov ecx, eax
mov dword [esp + 0x18], eax
jmp 0x40a5a6
xor ecx, ecx
mov dword [esp + 0x18], ecx
push 0xffff
push dword [esp + 0x34]
lea edx, [esp + 0x164]
mov byte [esp + 0x1e8], 4
mov eax, dword [ecx]
push edx
push 0x54000003
push dword [esp + 0x34]
call dword [eax + 0x160]
mov esi, dword [esp + 0x2c]
test esi, esi
jne 0x40a5dc
xor eax, eax
jmp 0x40a5df
mov eax, dword [esi + 4]
mov esi, dword [esp + 0x18]
push 1
push eax
push 0x30
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x14]
push eax
push esi
push 4
lea ecx, [esp + 0x48]
call fcn.0044f780
push 4
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
mov ecx, edi
push 4
push esi
call fcn.0043af20
jmp 0x40cd2a
lea eax, [esp + 0x34]
push 0x644e48
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40a7b1
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xb8]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x16
call fcn.0040de70
mov byte [esp + 0x1e0], 4
or ecx, 0xffffffff
mov edx, dword [esp + 0xb4]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a68d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x110]
push eax
call fcn.0044eb20
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1e4], 0x17
call fcn.0040de70
mov byte [esp + 0x1e0], 4
or ecx, 0xffffffff
mov edx, dword [esp + 0x10c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a6da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0xf8
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x18
test eax, eax
je 0x40a71c
mov ecx, eax
call fcn.004363e0
mov esi, eax
mov dword [esp + 0x18], eax
jmp 0x40a722
xor esi, esi
mov dword [esp + 0x18], esi
push 0
push 0xffff
push dword [esp + 0x38]
lea ecx, [esp + 0x168]
mov byte [esp + 0x1ec], 4
mov eax, dword [esi]
push ecx
push 0x54000100
push dword [esp + 0x38]
mov ecx, esi
push 0
call dword [eax + 0x54]
mov eax, dword [esi]
mov ecx, esi
push dword [esp + 0x24]
call dword [eax + 0x180]
lea eax, [esp + 0x16c]
push eax
mov eax, dword [esp + 0x30]
push 0x5c
push dword [eax + 4]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esi]
sub esp, 0x5c
mov edi, esp
lea esi, [esp + 0x1c8]
mov ecx, 0x17
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x74]
mov ecx, esi
call dword [eax + 0x198]
lea eax, [esp + 0x14]
push eax
push esi
push 6
lea ecx, [esp + 0x48]
call fcn.0044f780
push dword [esp + 0x1c]
push 6
jmp 0x40cd1c
lea eax, [esp + 0x34]
push 0x644e50
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40a94b
lea ecx, [esp + 0x64]
call fcn.00467f94
lea eax, [esp + 0x14]
mov byte [esp + 0x1e0], 0x19
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x1a
call fcn.0040de70
lea ecx, [esp + 0xbc]
mov byte [esp + 0x1e0], 0x19
call fcn.0040df20
push ecx
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00454320
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0x88
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x1b
test eax, eax
je 0x40a862
mov ecx, eax
call fcn.004351f0
mov edi, eax
jmp 0x40a864
xor edi, edi
lea eax, [esp + 0x14]
mov byte [esp + 0x1e0], 0x19
push eax
push edi
push 5
lea ecx, [esp + 0x48]
call fcn.0044f780
mov eax, dword [edi]
lea edx, [esp + 0x15c]
xor ecx, ecx
cmp byte [edi + 0x74], cl
push 0xffff
push dword [esp + 0x34]
setne cl
add ecx, 0x54200002
push edx
push ecx
mov ecx, edi
call dword [eax + 0x160]
push 1
push dword [esp + 0x30]
mov ecx, edi
call fcn.0040d150
mov eax, dword [esp + 0x6c]
xor esi, esi
test eax, eax
jle 0x40a8f0
mov edi, edi
test esi, esi
js 0x40cd75
cmp esi, eax
jge 0x40cd75
mov eax, dword [esp + 0x68]
push dword [eax + esi*4]
push 0
push 0x143
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x6c]
inc esi
cmp esi, eax
jl 0x40a8c0
mov eax, dword [edi + 0x20]
test eax, eax
je 0x40a908
push 0
push dword [edi + 0x78]
push 0x14e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [edi + 0x75]
mov ecx, edi
push eax
call fcn.004354c0
push 5
lea eax, [esp + 0x18]
push eax
push edi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
push 5
mov ecx, dword [esp + 0x28]
push edi
call fcn.0043af20
lea ecx, [esp + 0x64]
mov byte [esp + 0x1e0], 4
call fcn.00467fab
jmp 0x40cd26
lea eax, [esp + 0x34]
push 0x644e58
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40aae0
lea ecx, [esp + 0x64]
call fcn.00467f94
lea eax, [esp + 0x14]
mov byte [esp + 0x1e0], 0x1c
push eax
lea eax, [esp + 0x154]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x1d
call fcn.0040de70
lea ecx, [esp + 0x150]
mov byte [esp + 0x1e0], 0x1c
call fcn.0040df20
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xc8]
push eax
call fcn.0044eb20
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1e4], 0x1e
call fcn.0040de70
lea ecx, [esp + 0xc4]
mov byte [esp + 0x1e0], 0x1c
call fcn.0040df20
push ecx
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00454320
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0x1f4
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x1f
test eax, eax
je 0x40aa34
mov ecx, eax
call fcn.004379d0
mov edi, eax
jmp 0x40aa36
xor edi, edi
push 0xffff
push dword [esp + 0x34]
lea ecx, [esp + 0x164]
mov byte [esp + 0x1e8], 0x1c
mov eax, dword [edi]
push ecx
push 0x54800120
push dword [esp + 0x34]
mov ecx, edi
call dword [eax + 0x160]
push dword [esp + 0x24]
mov ecx, edi
call fcn.0045ddcb
push 1
push dword [esp + 0x30]
mov ecx, edi
call fcn.0040d150
mov eax, dword [esp + 0x6c]
xor esi, esi
test eax, eax
jle 0x40aab3
test esi, esi
js 0x40cd75
cmp esi, eax
jge 0x40cd75
mov eax, dword [esp + 0x68]
mov ecx, edi
mov edx, dword [edi]
push 0xffffffffffffffff
push 0
lea eax, [eax + esi*4]
push eax
call dword [edx + 0x168]
mov eax, dword [esp + 0x6c]
inc esi
cmp esi, eax
jl 0x40aa84
lea eax, [esp + 0x14]
push eax
push edi
push 7
lea ecx, [esp + 0x48]
call fcn.0044f780
push 7
lea eax, [esp + 0x18]
push eax
push edi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
push 7
jmp 0x40a92b
lea eax, [esp + 0x34]
push 0x644e60
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40abc0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x118]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x20
call fcn.0040de70
lea ecx, [esp + 0x114]
mov byte [esp + 0x1e0], 4
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0x7c
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x21
test eax, eax
je 0x40ab6d
mov ecx, eax
call fcn.00438bc0
mov esi, eax
jmp 0x40ab6f
xor esi, esi
push 0xffff
push dword [esp + 0x34]
mov byte [esp + 0x1e8], 4
lea ecx, [esp + 0x164]
mov eax, dword [esi]
push ecx
push 0x54000000
mov ecx, esi
call dword [eax + 0x160]
push 1
push dword [esp + 0x30]
mov ecx, esi
call fcn.0040d150
lea eax, [esp + 0x14]
push eax
push esi
push 8
lea ecx, [esp + 0x48]
call fcn.0044f780
push dword [esp + 0x1c]
push 8
jmp 0x40cd1c
lea eax, [esp + 0x34]
push 0x644e68
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40acb4
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xd0]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x22
call fcn.0040de70
lea ecx, [esp + 0xcc]
mov byte [esp + 0x1e0], 4
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push pe_nt_image_headers32
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x23
test eax, eax
je 0x40ac50
mov ecx, eax
call fcn.00438f10
mov esi, eax
jmp 0x40ac52
xor esi, esi
push 0xffff
push dword [esp + 0x34]
mov byte [esp + 0x1e8], 4
lea ecx, [esp + 0x164]
mov eax, dword [esi]
push ecx
push 0x54000000
mov ecx, esi
call dword [eax + 0x160]
push 1
push dword [esp + 0x30]
mov ecx, esi
call fcn.0040d150
lea eax, [esp + 0x14]
push eax
push esi
push 0xb
lea ecx, [esp + 0x48]
call fcn.0044f780
push 0xb
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
push 0xb
jmp 0x40cd1c
lea eax, [esp + 0x34]
push 0x644e70
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40ada0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x140]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x24
call fcn.0040de70
lea ecx, [esp + 0x13c]
mov byte [esp + 0x1e0], 4
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0xbc
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x25
test eax, eax
je 0x40ad44
mov ecx, eax
call fcn.004384e0
mov esi, eax
jmp 0x40ad46
xor esi, esi
push 0xffff
push dword [esp + 0x34]
lea ecx, [esp + 0x164]
mov byte [esp + 0x1e8], 4
mov eax, dword [esi]
push ecx
push 0x5400010e
push 0x644e70
mov ecx, esi
call dword [eax + 0x160]
lea eax, [esp + 0x14]
push eax
push esi
push 0xa
lea ecx, [esp + 0x48]
call fcn.0044f780
push 0xa
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
push 0xa
jmp 0x40cd1c
lea eax, [esp + 0x34]
push str.OmFh
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40ae9c
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xd8]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x26
call fcn.0040de70
lea ecx, [esp + 0xd4]
mov byte [esp + 0x1e0], 4
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0xcc
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x27
test eax, eax
je 0x40ae30
mov ecx, eax
call fcn.00437f20
mov esi, eax
jmp 0x40ae32
xor esi, esi
push 0xffff
push dword [esp + 0x34]
lea eax, [esp + 0x164]
mov byte [esp + 0x1e8], 4
push eax
push 0x14800080
mov ecx, esi
call fcn.00467d04
push 0
push 0
mov ecx, esi
call fcn.004685a2
push 1
push dword [esp + 0x30]
mov ecx, esi
call fcn.0040d150
lea eax, [esp + 0x14]
push eax
push esi
push 0xc
lea ecx, [esp + 0x48]
call fcn.0044f780
push 0xc
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
push 0xc
jmp 0x40cd1c
lea eax, [esp + 0x34]
push 0x644e80
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40af88
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x9c]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x28
call fcn.0040de70
lea ecx, [esp + 0x98]
mov byte [esp + 0x1e0], 4
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0x88
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x29
test eax, eax
je 0x40af2c
mov ecx, eax
call fcn.0043a620
mov esi, eax
jmp 0x40af2e
xor esi, esi
push 0xffff
push dword [esp + 0x34]
lea ecx, [esp + 0x164]
mov byte [esp + 0x1e8], 4
mov eax, dword [esi]
push ecx
push 0x5400090e
push 0x644e80
mov ecx, esi
call dword [eax + 0x160]
lea eax, [esp + 0x14]
push eax
push esi
push 0xe
lea ecx, [esp + 0x48]
call fcn.0044f780
push 0xe
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
push 0xe
jmp 0x40cd1c
lea eax, [esp + 0x34]
push 0x644e88
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40b09d
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xe0]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x2a
call fcn.0040de70
lea ecx, [esp + 0xdc]
mov byte [esp + 0x1e0], 4
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0x94
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x2b
test eax, eax
je 0x40b018
mov ecx, eax
call fcn.00437310
mov esi, eax
jmp 0x40b01a
xor esi, esi
push 0xffff
push dword [esp + 0x34]
mov byte [esp + 0x1e8], 4
lea ecx, [esp + 0x164]
mov eax, dword [esi]
push ecx
push 0x54000000
mov ecx, esi
call dword [eax + 0x160]
push 1
push dword [esp + 0x30]
mov ecx, esi
call fcn.0040d150
lea eax, [esp + 0x14]
push eax
push esi
push 0xf
lea ecx, [esp + 0x48]
call fcn.0044f780
movzx eax, word [esi + 0x84]
mov ecx, esi
push eax
movzx eax, word [esi + 0x82]
push eax
call fcn.0040d050
sub esp, 8
mov ecx, esi
call fcn.00437530
push 0xf
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
push 0xf
jmp 0x40cd1c
lea eax, [esp + 0x34]
push str.OmhV
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40b1e0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x158]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x2c
call fcn.0040de70
lea ecx, [esp + 0x154]
mov byte [esp + 0x1e0], 4
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
xorps xmm0, xmm0
mov dword [esp + 0x74], 0
push 0xd8
movdqa xmmword [esp + 0x68], xmm0
call fcn.0045c7e8
mov esi, eax
add esp, 4
mov dword [esp + 0x28], esi
mov byte [esp + 0x1e0], 0x2d
test esi, esi
je 0x40b144
mov ecx, esi
call fcn.00470f50
mov dword [esi], vtable.CMyDocument.0
jmp 0x40b146
xor esi, esi
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x64]
push 0xe900
mov byte [esp + 0x1e4], 4
push eax
mov dword [esp + 0x70], esi
mov dword [esp + 0x6c], 0x6455e0
call fcn.00469c84
mov esi, eax
test esi, esi
je 0x40b176
mov eax, dword [esi + 0x20]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x4000000
test esi, esi
jne 0x40b18c
xor ecx, ecx
jmp 0x40b18f
mov ecx, dword [esi + 0x20]
push eax
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
mov ecx, esi
call fcn.0045de0f
push 1
lea eax, [esp + 0x160]
mov ecx, esi
push eax
call fcn.0040cff0
lea eax, [esp + 0x14]
push eax
push esi
push 0x10
lea ecx, [esp + 0x48]
call fcn.0044f780
push 0x10
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
push 0x10
jmp 0x40cd1c
lea eax, [esp + 0x34]
push 0x644e98
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40b302
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xe8]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x2e
call fcn.0040de70
lea ecx, [esp + 0xe4]
mov byte [esp + 0x1e0], 4
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0x50c
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x2f
test eax, eax
je 0x40b273
sub esp, 0x10
mov ecx, eax
call fcn.0041af60
mov esi, eax
jmp 0x40b275
xor esi, esi
sub esp, 8
mov byte [esp + 0x1e8], 4
lea eax, [esp + 0x164]
mov ecx, esi
push dword [esp + 0x38]
push eax
call fcn.0041bc30
push 1
push dword [esp + 0x30]
mov ecx, esi
call fcn.0040d150
mov eax, dword [esi + 0x19c]
lea ecx, [esi + 0x19c]
push 0xffffff
call dword [eax + 0x24]
mov ecx, esi
call fcn.00423180
push 0xf
mov dword [esi + 0xd4], 0
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
mov ecx, esi
call fcn.00408c30
lea eax, [esp + 0x14]
push eax
push esi
push 0x11
lea ecx, [esp + 0x48]
call fcn.0044f780
push 0x11
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
push 0x11
jmp 0x40cd1c
lea eax, [esp + 0x34]
push 0x644ea0
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40cc3e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x128]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x30
call fcn.0040de70
lea ecx, [esp + 0x124]
mov byte [esp + 0x1e0], 4
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0x90
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x31
test eax, eax
je 0x40b396
mov ecx, eax
call fcn.00439970
mov edi, eax
mov dword [esp + 0x5c], eax
jmp 0x40b39c
xor edi, edi
mov dword [esp + 0x5c], edi
push 0xffff
push dword [esp + 0x34]
mov byte [esp + 0x1e8], 4
lea ecx, [esp + 0x164]
mov eax, dword [edi]
push ecx
push 0x14000200
mov ecx, edi
call dword [eax + 0x160]
push 1
push dword [esp + 0x30]
mov ecx, edi
call fcn.0040d150
lea eax, [esp + 0x14]
push eax
push edi
push 0xd
lea ecx, [esp + 0x48]
call fcn.0044f780
push 0xd
lea eax, [esp + 0x18]
push eax
push edi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push 0xd
push edi
call fcn.0043af20
lea eax, [esp + 0x14]
xor esi, esi
push 0x644ea8
push eax
mov dword [esp + 0x60], esi
call fcn.0040cdd0
add esp, 8
test al, al
je 0x40cc20
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x40]
call fcn.0044e6d0
lea eax, [esp + 0x14]
push 0x644ea8
push eax
call fcn.0040d200
add esp, 8
test al, al
jne 0x40cc20
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xf0]
push eax
call fcn.0044e7f0
lea ecx, [esp + 0xec]
call fcn.0040df20
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x64]
push eax
call fcn.0044ecd0
push ecx
lea eax, [esp + 0x64]
mov byte [esp + 0x1e4], 0x32
mov ecx, esp
push eax
call fcn.0040dae0
mov ecx, edi
call fcn.00439cd0
lea ecx, [esp + 0x8c]
call fcn.0040dab0
lea ecx, [esp + 0x88]
call fcn.0040dab0
lea eax, [esp + 0x88]
mov byte [esp + 0x1e0], 0x34
push eax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00452890
test al, al
je 0x40b582
jmp 0x40b4e0
lea eax, [esp + 0x8c]
push 0x644eb4
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40b527
mov eax, dword [edi + 0x84]
push dword [esp + 0x88]
lea esi, [eax + esi*4]
call fcn.0058844c
mov ecx, dword [esi]
add esp, 4
push 1
push eax
mov dword [ecx + 0xbc], eax
call fcn.0045e75f
mov esi, dword [esp + 0x58]
jmp 0x40b560
lea eax, [esp + 0x8c]
push 0x644ec0
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40b560
push 1
push ecx
lea eax, [esp + 0x90]
mov ecx, esp
push eax
call fcn.0040dae0
mov eax, dword [edi + 0x84]
mov ecx, dword [eax + esi*4]
call fcn.0043a4b0
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00452890
test al, al
jne 0x40b4e0
lea eax, [esp + 0x14]
mov byte [esp + 0x54], 1
push 0x644ecc
push eax
call fcn.0040cdd0
add esp, 8
test al, al
je 0x40cbd8
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x40]
call fcn.0044e6d0
lea eax, [esp + 0x14]
push 0x644ecc
push eax
call fcn.0040d200
add esp, 8
test al, al
jne 0x40cbd4
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0044e7f0
lea eax, [esp + 0x38]
mov byte [esp + 0x1e0], 0x35
push 0x644e20
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40b71b
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x148]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x36
call fcn.0040de70
lea ecx, [esp + 0x144]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xf8]
push eax
call fcn.0044eb20
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1e4], 0x37
call fcn.0040de70
lea ecx, [esp + 0xf4]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0xa4
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x38
test eax, eax
je 0x40b6a6
mov ecx, eax
call fcn.00439270
jmp 0x40b6a8
xor eax, eax
mov byte [esp + 0x1e0], 0x35
mov edx, dword [eax]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x84]
push 0xffff
push dword [eax + esi*4]
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x164]
push eax
push 0x54000100
push dword [esp + 0x34]
mov ecx, esi
call dword [edx + 0x160]
push 1
push dword [esp + 0x30]
mov ecx, esi
call fcn.0040d150
lea eax, [esp + 0x14]
push eax
push esi
push 0
lea ecx, [esp + 0x48]
call fcn.0044f780
push 0
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
push 0
jmp 0x40cb9b
lea eax, [esp + 0x38]
push 0x644e28
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40b86a
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x130]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x39
call fcn.0040de70
lea ecx, [esp + 0x12c]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x100]
push eax
call fcn.0044eb20
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1e4], 0x3a
call fcn.0040de70
lea ecx, [esp + 0xfc]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0xd4
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x3b
test eax, eax
je 0x40b7e1
mov ecx, eax
call fcn.00433ea0
jmp 0x40b7e3
xor eax, eax
mov byte [esp + 0x1e0], 0x35
mov edx, dword [eax]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x84]
push 0xffff
push dword [eax + esi*4]
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x164]
push eax
push 0x54004300
push dword [esp + 0x34]
mov ecx, esi
call dword [edx + 0x160]
push 1
push dword [esp + 0x30]
mov ecx, esi
call fcn.0040d150
push ecx
lea eax, [esp + 0x20]
mov ecx, esp
push eax
call fcn.0040dae0
mov ecx, esi
call fcn.00408a50
lea eax, [esp + 0x14]
push eax
push esi
push 1
lea ecx, [esp + 0x48]
call fcn.0044f780
push 1
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
push dword [esp + 0x1c]
push 1
jmp 0x40cb9b
lea eax, [esp + 0x38]
push 0x644e30
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40bb78
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xa0]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x3c
call fcn.0040de70
lea ecx, [esp + 0x9c]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xa4]
push eax
call fcn.0044eb20
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1e4], 0x3d
call fcn.0040de70
lea ecx, [esp + 0xa0]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0xb4
call fcn.0045c7e8
add esp, 4
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x3e
test eax, eax
je 0x40b932
mov ecx, eax
call fcn.004359c0
mov esi, eax
jmp 0x40b934
xor esi, esi
lea eax, [esp + 0x14]
mov byte [esp + 0x1e0], 0x35
push eax
push esi
push 2
lea ecx, [esp + 0x48]
call fcn.0044f780
mov al, byte [esi + 0xa0]
test al, al
je 0x40ba62
mov cl, byte [esi + 0xa1]
test cl, cl
je 0x40ba02
mov al, byte [esi + 0xa2]
test al, al
jne 0x40b9ab
mov eax, dword [edi + 0x84]
mov ecx, dword [esp + 0x58]
push 0xffff
push dword [eax + ecx*4]
lea eax, [esp + 0x164]
mov ecx, esi
push eax
push 0x54801044
call fcn.00467d04
push 1
push 1
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_ShowScrollBar]
jmp 0x40ba88
test cl, cl
je 0x40ba02
mov al, byte [esi + 0xa2]
test al, al
je 0x40b9fe
mov eax, dword [edi + 0x84]
mov ecx, dword [esp + 0x58]
push 0xffff
push dword [eax + ecx*4]
lea eax, [esp + 0x164]
mov ecx, esi
push eax
push 0x548010c4
call fcn.00467d04
push 1
push 1
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_ShowScrollBar]
push 1
push 0
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_ShowScrollBar]
jmp 0x40ba88
test cl, cl
jne 0x40ba41
mov al, byte [esi + 0xa2]
test al, al
je 0x40ba41
mov eax, dword [edi + 0x84]
mov ecx, dword [esp + 0x58]
push 0xffff
push dword [eax + ecx*4]
lea eax, [esp + 0x164]
mov ecx, esi
push eax
push 0x54801084
call fcn.00467d04
push 1
push 0
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_ShowScrollBar]
jmp 0x40ba88
mov eax, dword [edi + 0x84]
mov ecx, dword [esp + 0x58]
push 0xffff
push dword [eax + ecx*4]
lea eax, [esp + 0x164]
push eax
push 0x54801044
jmp 0x40ba81
mov eax, dword [edi + 0x84]
mov ecx, dword [esp + 0x58]
push 0xffff
push dword [eax + ecx*4]
lea eax, [esp + 0x164]
push eax
push 0x54800080
mov ecx, esi
call fcn.00467d04
mov al, byte [esi + 0x9f]
test al, al
jne 0x40baa2
push 0
push 0x8000000
push 0
mov ecx, esi
call fcn.0045da41
mov al, byte [esi + 0x9e]
test al, al
je 0x40bab4
push ecx
mov ecx, esi
call fcn.0040d110
mov al, byte [esi + 0x9c]
test al, al
je 0x40bac6
push ecx
mov ecx, esi
call fcn.0040d0f0
mov al, byte [esi + 0x9d]
test al, al
je 0x40bae0
push 0
push 0x2000
push 0
mov ecx, esi
call fcn.0045da41
mov eax, dword [esi + 0x84]
test eax, eax
je 0x40baf4
mov ecx, esi
mov dword [esi + 0x74], eax
call fcn.00435e40
mov ecx, esi
call fcn.00408b10
cmp eax, 0xffffff
je 0x40bb11
mov ecx, esi
call fcn.00408b10
push eax
mov ecx, esi
call fcn.00408ae0
mov ecx, esi
call fcn.00408bf0
push eax
mov ecx, esi
call fcn.00408b90
lea ecx, [esi + 0xac]
call fcn.0040d2e0
mov ecx, esi
push 1
test eax, eax
je 0x40bb3c
lea eax, [esi + 0xac]
push eax
jmp 0x40bb40
push dword [esp + 0x30]
call fcn.0040d150
lea ecx, [esp + 0x24]
call fcn.0040da30
push eax
mov ecx, esi
call fcn.0045ddcb
push 2
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
lea ecx, [esp + 0x1c]
call fcn.0040da30
push eax
push 2
jmp 0x40cb9b
lea eax, [esp + 0x38]
push 0x644e38
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40bccd
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xac]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x3f
call fcn.0040dee0
lea ecx, [esp + 0xa8]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xb4]
push eax
call fcn.0044eb20
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1e4], 0x40
call fcn.0040dee0
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push pe_nt_image_headers32
call fcn.0040d190
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x41
test eax, eax
je 0x40bc3f
mov ecx, eax
call fcn.00438d20
mov dword [esp + 0x18], eax
jmp 0x40bc47
mov dword [esp + 0x18], 0
push esi
lea ecx, [edi + 0x84]
mov byte [esp + 0x1e4], 0x35
call fcn.0040ce30
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push 0xfffc
push dword [eax]
mov esi, dword [esi]
lea eax, [esp + 0x164]
push eax
push 0x54000009
call fcn.0040da30
mov ecx, dword [esp + 0x28]
push eax
call dword [esi + 0x160]
mov esi, dword [esp + 0x18]
mov ecx, esi
push 1
push dword [esp + 0x30]
call fcn.0040d150
lea eax, [esp + 0x14]
push eax
push esi
push 3
lea ecx, [esp + 0x48]
call fcn.0044f780
push 3
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
lea ecx, [esp + 0x1c]
call fcn.0040da30
push eax
push 3
jmp 0x40cb9b
lea eax, [esp + 0x38]
push 0x644e40
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40be22
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xbc]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x42
call fcn.0040dee0
lea ecx, [esp + 0xb8]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xc4]
push eax
call fcn.0044eb20
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1e4], 0x43
call fcn.0040dee0
lea ecx, [esp + 0xc0]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push pe_nt_image_headers32
call fcn.0040d190
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x44
test eax, eax
je 0x40bd94
mov ecx, eax
call fcn.00434e80
mov dword [esp + 0x18], eax
jmp 0x40bd9c
mov dword [esp + 0x18], 0
push esi
lea ecx, [edi + 0x84]
mov byte [esp + 0x1e4], 0x35
call fcn.0040ce30
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push 0xfffd
push dword [eax]
mov esi, dword [esi]
lea eax, [esp + 0x164]
push eax
push 0x54000003
call fcn.0040da30
mov ecx, dword [esp + 0x28]
push eax
call dword [esi + 0x160]
mov esi, dword [esp + 0x18]
mov ecx, esi
push 1
push dword [esp + 0x30]
call fcn.0040d150
lea eax, [esp + 0x14]
push eax
push esi
push 4
lea ecx, [esp + 0x48]
call fcn.0044f780
push 4
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
lea ecx, [esp + 0x1c]
call fcn.0040da30
push eax
push 4
jmp 0x40cb9b
lea eax, [esp + 0x38]
push 0x644e48
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40bfa2
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xcc]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x45
call fcn.0040dee0
lea ecx, [esp + 0xc8]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xd4]
push eax
call fcn.0044eb20
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1e4], 0x46
call fcn.0040dee0
lea ecx, [esp + 0xd0]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0xf8
call fcn.0040d190
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x47
test eax, eax
je 0x40bee5
mov ecx, eax
call fcn.004363e0
jmp 0x40bee7
xor eax, eax
push esi
lea ecx, [edi + 0x84]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1e4], 0x35
call fcn.0040ce30
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push 0
push 0xffff
push dword [eax]
mov esi, dword [edi]
lea eax, [esp + 0x168]
push eax
push 0x54000000
call fcn.0040da30
push eax
push 0
mov ecx, edi
call dword [esi + 0x54]
mov esi, dword [edi]
lea ecx, [esp + 0x24]
call fcn.0040da30
push eax
mov ecx, edi
call dword [esi + 0x180]
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x16c]
push eax
call fcn.0040d0d0
mov eax, dword [edi]
lea esi, [esp + 0x16c]
sub esp, 0x5c
mov ecx, 0x17
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x74]
mov ecx, esi
call dword [eax + 0x198]
lea eax, [esp + 0x14]
push eax
push esi
push 6
lea ecx, [esp + 0x48]
call fcn.0044f780
lea ecx, [esp + 0x1c]
call fcn.0040da30
mov ecx, dword [esp + 0x20]
push eax
push 6
push esi
call fcn.0043af20
mov edi, dword [esp + 0x5c]
jmp 0x40cba5
lea eax, [esp + 0x38]
push 0x644e50
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40c130
lea ecx, [esp + 0x64]
call fcn.00467f94
lea eax, [esp + 0x14]
mov byte [esp + 0x1e0], 0x48
push eax
lea eax, [esp + 0xdc]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x49
call fcn.0040dee0
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1e0], 0x48
call fcn.0040df20
push ecx
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00454320
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0x88
call fcn.0040d190
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x4a
test eax, eax
je 0x40c050
mov ecx, eax
call fcn.004351f0
mov edi, eax
jmp 0x40c052
xor edi, edi
lea eax, [esp + 0x14]
mov byte [esp + 0x1e0], 0x48
push eax
push edi
push 5
lea ecx, [esp + 0x48]
call fcn.0044f780
mov ecx, dword [esp + 0x5c]
xor eax, eax
cmp byte [edi + 0x74], al
push esi
setne al
add ecx, 0x84
add eax, 0x54200002
mov dword [esp + 0x94], eax
call fcn.0040ce30
mov edx, dword [edi]
mov ecx, edi
push 0xffff
push dword [eax]
lea eax, [esp + 0x164]
push eax
push dword [esp + 0x9c]
call dword [edx + 0x160]
push 1
push dword [esp + 0x30]
mov ecx, edi
call fcn.0040d150
lea ecx, [esp + 0x64]
xor esi, esi
call fcn.0040d0c0
test eax, eax
jle 0x40c0f7
jmp 0x40c0d0
push esi
lea ecx, [esp + 0x68]
call fcn.0040d080
mov ecx, eax
call fcn.0040da30
push eax
mov ecx, edi
call fcn.0040d0a0
lea ecx, [esp + 0x64]
inc esi
call fcn.0040d0c0
cmp esi, eax
jl 0x40c0d0
push dword [edi + 0x78]
mov ecx, edi
call fcn.00408c00
movzx eax, byte [edi + 0x75]
mov ecx, edi
push eax
call fcn.004354c0
push 5
lea eax, [esp + 0x18]
push eax
push edi
lea ecx, [esp + 0x48]
call fcn.00452e20
lea ecx, [esp + 0x1c]
call fcn.0040da30
push eax
push 5
push edi
jmp 0x40c2ed
lea eax, [esp + 0x38]
push 0x644e58
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40c310
lea ecx, [esp + 0x64]
call fcn.00467f94
lea eax, [esp + 0x14]
mov byte [esp + 0x1e0], 0x4b
push eax
lea eax, [esp + 0xe4]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x4c
call fcn.0040dee0
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1e0], 0x4b
call fcn.0040df20
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xec]
push eax
call fcn.0044eb20
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1e4], 0x4d
call fcn.0040dee0
lea ecx, [esp + 0xe8]
mov byte [esp + 0x1e0], 0x4b
call fcn.0040df20
push ecx
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00454320
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0x1f4
call fcn.0040d190
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x4e
test eax, eax
je 0x40c21a
mov ecx, eax
call fcn.004379d0
mov edi, eax
mov dword [esp + 0x18], eax
jmp 0x40c220
xor edi, edi
mov dword [esp + 0x18], edi
mov ecx, dword [esp + 0x5c]
push esi
add ecx, 0x84
mov byte [esp + 0x1e4], 0x4b
call fcn.0040ce30
mov esi, dword [edi]
lea ecx, [esp + 0x24]
push 0xffff
push dword [eax]
lea eax, [esp + 0x164]
push eax
push 0x54800120
call fcn.0040da30
push eax
mov ecx, edi
call dword [esi + 0x160]
lea ecx, [esp + 0x24]
call fcn.0040da30
mov esi, dword [esp + 0x18]
mov ecx, esi
push eax
call fcn.0045ddcb
push 1
push dword [esp + 0x30]
mov ecx, esi
call fcn.0040d150
lea ecx, [esp + 0x64]
xor edi, edi
call fcn.0040d0c0
test eax, eax
jle 0x40c2be
mov esi, dword [esi]
lea ecx, [esp + 0x64]
push 0xffffffffffffffff
push 0
push edi
call fcn.0040d080
mov ecx, dword [esp + 0x20]
push eax
call dword [esi + 0x168]
lea ecx, [esp + 0x64]
inc edi
call fcn.0040d0c0
mov esi, dword [esp + 0x18]
cmp edi, eax
jl 0x40c291
lea eax, [esp + 0x14]
push eax
push esi
push 7
lea ecx, [esp + 0x48]
call fcn.0044f780
push 7
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
lea ecx, [esp + 0x1c]
call fcn.0040da30
push eax
push 7
push esi
mov ecx, dword [esp + 0x2c]
call fcn.0043af20
lea ecx, [esp + 0x64]
mov byte [esp + 0x1e0], 0x35
call fcn.00467fab
mov edi, dword [esp + 0x5c]
jmp 0x40cba5
lea eax, [esp + 0x38]
push 0x644e60
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40c403
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xf4]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x4f
call fcn.0040dee0
lea ecx, [esp + 0xf0]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0x7c
call fcn.0040d190
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x50
test eax, eax
je 0x40c398
mov ecx, eax
call fcn.00438bc0
jmp 0x40c39a
xor eax, eax
push esi
lea ecx, [edi + 0x84]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1e4], 0x35
call fcn.0040ce30
mov esi, dword [esp + 0x18]
mov ecx, esi
push 0x10001
push dword [eax]
mov edx, dword [esi]
lea eax, [esp + 0x164]
push eax
push 0x54000000
call dword [edx + 0x160]
push 1
push dword [esp + 0x30]
mov ecx, esi
call fcn.0040d150
lea eax, [esp + 0x14]
push eax
push esi
push 8
lea ecx, [esp + 0x48]
call fcn.0044f780
lea ecx, [esp + 0x1c]
call fcn.0040da30
push eax
push 8
jmp 0x40cb9b
lea eax, [esp + 0x38]
push 0x644edc
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40c4f6
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xfc]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x51
call fcn.0040dee0
lea ecx, [esp + 0xf8]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0x7c
call fcn.0040d190
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x52
test eax, eax
je 0x40c48b
mov ecx, eax
call fcn.00435760
jmp 0x40c48d
xor eax, eax
push esi
lea ecx, [edi + 0x84]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1e4], 0x35
call fcn.0040ce30
mov esi, dword [esp + 0x18]
mov ecx, esi
push 0xffff
push dword [eax]
mov edx, dword [esi]
lea eax, [esp + 0x164]
push eax
push 0x54000000
call dword [edx + 0x160]
push 1
push dword [esp + 0x30]
mov ecx, esi
call fcn.0040d150
lea eax, [esp + 0x14]
push eax
push esi
push 9
lea ecx, [esp + 0x48]
call fcn.0044f780
lea ecx, [esp + 0x1c]
call fcn.0040da30
push eax
push 9
jmp 0x40cb9b
lea eax, [esp + 0x38]
push 0x644e68
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40c5fd
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x104]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x53
call fcn.0040dee0
lea ecx, [esp + 0x100]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push pe_nt_image_headers32
call fcn.0040d190
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x54
test eax, eax
je 0x40c581
mov ecx, eax
call fcn.00438f10
jmp 0x40c583
xor eax, eax
push esi
lea ecx, [edi + 0x84]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1e4], 0x35
call fcn.0040ce30
mov esi, dword [esp + 0x18]
mov ecx, esi
push 0x10003
push dword [eax]
mov edx, dword [esi]
lea eax, [esp + 0x164]
push eax
push 0x54000000
call dword [edx + 0x160]
push 1
push dword [esp + 0x30]
mov ecx, esi
call fcn.0040d150
lea eax, [esp + 0x14]
push eax
push esi
push 0xb
lea ecx, [esp + 0x48]
call fcn.0044f780
push 0xb
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
lea ecx, [esp + 0x1c]
call fcn.0040da30
push eax
push 0xb
jmp 0x40cb9b
lea eax, [esp + 0x38]
push 0x644e70
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40c6fc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10c]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x55
call fcn.0040dee0
lea ecx, [esp + 0x108]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0xbc
call fcn.0040d190
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x56
test eax, eax
je 0x40c688
mov ecx, eax
call fcn.004384e0
jmp 0x40c68a
xor eax, eax
push esi
lea ecx, [edi + 0x84]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1e4], 0x35
call fcn.0040ce30
mov esi, dword [esp + 0x18]
mov ecx, esi
push 0xffff
push dword [eax]
mov edx, dword [esi]
lea eax, [esp + 0x164]
push eax
push 0x5400010e
push 0x644e70
call dword [edx + 0x160]
lea eax, [esp + 0x14]
push eax
push esi
push 0xa
lea ecx, [esp + 0x48]
call fcn.0044f780
push 0xa
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
lea ecx, [esp + 0x1c]
call fcn.0040da30
push eax
push 0xa
jmp 0x40cb9b
lea eax, [esp + 0x38]
push str.OmFh
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40c80b
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x114]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x57
call fcn.0040dee0
lea ecx, [esp + 0x110]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0xcc
call fcn.0040d190
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x58
test eax, eax
je 0x40c787
mov ecx, eax
call fcn.00437f20
jmp 0x40c789
xor eax, eax
push esi
lea ecx, [edi + 0x84]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1e4], 0x35
call fcn.0040ce30
mov esi, dword [esp + 0x18]
mov ecx, esi
push 0x9ffcf
push dword [eax]
lea eax, [esp + 0x164]
push eax
push 0x54800080
call fcn.00467d04
push 0
push 0
mov ecx, esi
call fcn.004685a2
push 1
push dword [esp + 0x30]
mov ecx, esi
call fcn.0040d150
lea eax, [esp + 0x14]
push eax
push esi
push 0xc
lea ecx, [esp + 0x48]
call fcn.0044f780
push 0xc
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
lea ecx, [esp + 0x1c]
call fcn.0040da30
push eax
push 0xc
jmp 0x40cb9b
lea eax, [esp + 0x38]
push 0x644e88
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40c933
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x11c]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x59
call fcn.0040dee0
lea ecx, [esp + 0x118]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0x94
call fcn.0040d190
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x5a
test eax, eax
je 0x40c896
mov ecx, eax
call fcn.00437310
jmp 0x40c898
xor eax, eax
push esi
lea ecx, [edi + 0x84]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1e4], 0x35
call fcn.0040ce30
mov esi, dword [esp + 0x18]
mov ecx, esi
push 0xffff
push dword [eax]
mov edx, dword [esi]
lea eax, [esp + 0x164]
push eax
push 0x54000000
call dword [edx + 0x160]
push 1
push dword [esp + 0x30]
mov ecx, esi
call fcn.0040d150
lea eax, [esp + 0x14]
push eax
push esi
push 0xf
lea ecx, [esp + 0x48]
call fcn.0044f780
movzx eax, word [esi + 0x84]
mov ecx, esi
push eax
movzx eax, word [esi + 0x82]
push eax
call fcn.0040d050
sub esp, 8
mov ecx, esi
call fcn.00437530
push 0xf
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
lea ecx, [esp + 0x1c]
call fcn.0040da30
push eax
push 0xf
jmp 0x40cb9b
lea eax, [esp + 0x38]
push str.OmhV
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40ca71
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x124]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x5b
call fcn.0040dee0
lea ecx, [esp + 0x120]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
lea ecx, [esp + 0x64]
call fcn.0040d030
push esi
lea ecx, [edi + 0x84]
call fcn.0040ce30
push 0xd8
mov esi, dword [eax]
call fcn.0040d190
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x5c
test eax, eax
je 0x40c9d5
mov ecx, eax
call fcn.0040e570
jmp 0x40c9d7
xor eax, eax
mov byte [esp + 0x1e0], 0x35
mov ecx, esi
mov dword [esp + 0x68], eax
lea eax, [esp + 0x64]
push 0xe900
push eax
mov dword [esp + 0x6c], 0x6455e0
call fcn.00469c84
mov esi, eax
push 0xfffffffffffffff0
mov ecx, esi
call fcn.0040d020
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x4000000
mov ecx, esi
push eax
push 0xfffffffffffffff0
call fcn.0040d020
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
mov ecx, esi
call fcn.0045de0f
push 1
lea eax, [esp + 0x160]
mov ecx, esi
push eax
call fcn.0040cff0
lea eax, [esp + 0x14]
push eax
push esi
push 0x10
lea ecx, [esp + 0x48]
call fcn.0044f780
push 0x10
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
lea ecx, [esp + 0x1c]
call fcn.0040da30
push eax
push 0x10
jmp 0x40cb9b
lea eax, [esp + 0x38]
push 0x644e98
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40cba5
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x12c]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x5d
call fcn.0040dee0
lea ecx, [esp + 0x128]
mov byte [esp + 0x1e0], 0x35
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0x50c
call fcn.0040d190
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x5e
test eax, eax
je 0x40caff
sub esp, 0x10
mov ecx, eax
call fcn.0041af60
jmp 0x40cb01
xor eax, eax
push esi
lea ecx, [edi + 0x84]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1e4], 0x35
call fcn.0040ce30
mov esi, dword [esp + 0x18]
sub esp, 8
mov ecx, esi
push dword [eax]
lea eax, [esp + 0x168]
push eax
call fcn.0041bc30
push 1
push dword [esp + 0x30]
mov ecx, esi
call fcn.0040d150
push 0
push 0
mov ecx, esi
call fcn.00408c80
push 0xffffff
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x24]
push ecx
mov ecx, esi
call fcn.00424a50
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
mov ecx, esi
call fcn.00408c30
lea eax, [esp + 0x14]
push eax
push esi
push 0x11
lea ecx, [esp + 0x48]
call fcn.0044f780
push 0x11
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.00452e20
lea ecx, [esp + 0x1c]
call fcn.0040da30
push eax
push 0x11
mov ecx, dword [esp + 0x28]
push esi
call fcn.0043af20
lea ecx, [esp + 0x38]
mov byte [esp + 0x1e0], 0x34
call fcn.0040df20
lea eax, [esp + 0x14]
push 0x644ecc
push eax
call fcn.0040cdd0
mov esi, dword [esp + 0x60]
add esp, 8
test al, al
jne 0x40b5a1
mov esi, dword [esp + 0x58]
inc esi
lea ecx, [esp + 0x88]
mov dword [esp + 0x58], esi
call fcn.0040df20
lea ecx, [esp + 0x8c]
call fcn.0040df20
lea ecx, [esp + 0x60]
mov byte [esp + 0x1e0], 4
call fcn.0040df20
lea eax, [esp + 0x14]
push 0x644ea8
push eax
call fcn.0040cdd0
add esp, 8
test al, al
jne 0x40b423
mov ecx, edi
call fcn.0043a090
push 0
mov ecx, edi
call fcn.0040cfd0
push 0
mov ecx, edi
call fcn.00439fc0
jmp 0x40cd26
lea eax, [esp + 0x34]
push 0x644edc
push eax
call fcn.0040d200
add esp, 8
test al, al
je 0x40cd2a
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x98]
push eax
call fcn.0044e990
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1e4], 0x5f
call fcn.0040dee0
lea ecx, [esp + 0x94]
mov byte [esp + 0x1e0], 4
call fcn.0040df20
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.0044f030
push 0x7c
call fcn.0040d190
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e0], 0x60
test eax, eax
je 0x40ccc8
mov ecx, eax
call fcn.00435760
mov esi, eax
jmp 0x40ccca
xor esi, esi
push 0xffff
push dword [esp + 0x34]
mov byte [esp + 0x1e8], 4
lea ecx, [esp + 0x164]
mov eax, dword [esi]
push ecx
push 0x54000000
mov ecx, esi
call dword [eax + 0x160]
push 1
push dword [esp + 0x30]
mov ecx, esi
call fcn.0040d150
lea eax, [esp + 0x14]
push eax
push esi
push 9
lea ecx, [esp + 0x48]
call fcn.0044f780
lea ecx, [esp + 0x1c]
call fcn.0040da30
push eax
push 9
mov ecx, dword [esp + 0x28]
push esi
call fcn.0043af20
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x40]
call fcn.0044e6d0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x13c]
push eax
call fcn.0044e7f0
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x1e4], 0x61
call fcn.0040dee0
lea ecx, [esp + 0x138]
mov byte [esp + 0x1e0], 4
call fcn.0040df20
jmp 0x4099f0
call fcn.0045d0fa
lea ecx, [esp + 0x24]
call fcn.0040df20
lea ecx, [esp + 0x1c]
call fcn.0040df20
lea ecx, [esp + 0x34]
call fcn.0040df20
lea ecx, [esp + 0x14]
call fcn.0040df20
lea ecx, [esp + 0x3c]
call fcn.0044e6c0
mov ecx, dword [esp + 0x1d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c4]
xor ecx, esp
call fcn.00587560
mov esp, ebp
pop ebp
ret