Function at 0x414370
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453068
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x60
mov eax, dword [0x47d00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], edx
mov edi, ecx
mov dword [ebp - 0x24], edi
mov eax, dword [ebx + 0x14]
mov edx, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
mov esi, dword [ebx + 0x10]
mov dword [ebp - 0x6c], eax
mov eax, dword [edi + 0x1c0]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x68], esi
mov dword [eax + 0x30], edi
cmp edx, 0x110
ja 0x4152a9
je case.0x4152d3.289
lea eax, [edx - 3]
cmp eax, 0xa0
ja case.0x4152d3.275
movzx eax, byte [eax + 0x415b88]
jmp dword [eax*4 + 0x415b3c]
mov ecx, dword [ebp - 0x64]
cmp ecx, dword [edi + 0x22c]
jne case.0x4152d3.275
cmp byte [edi + 0x242], 0
je case.0x4152d3.275
jmp 0x415b18
mov ecx, dword [ebp - 0x64]
cmp ecx, dword [edi + 0x22c]
jne case.0x4152d3.275
cmp byte [edi + 0x242], 0
je case.0x4152d3.275
mov eax, 1
jmp 0x415b1a
cmp byte [edi + 0x242], 0
je case.0x4152d3.275
mov ecx, dword [ebp - 0x64]
cmp ecx, dword [edi + 0x22c]
jne case.0x4152d3.275
cmp dword [ebp - 0x18], 0
je 0x415b18
mov edi, dword [esi + 8]
mov eax, edi
mov edx, dword [esi]
sub eax, edx
mov esi, dword [esi + 0xc]
dec edx
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 4]
mov eax, esi
sub eax, ecx
dec ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x68]
movups xmm0, xmmword [eax]
movups xmmword [eax + 0x10], xmm0
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax + 0x242]
add eax, edx
mov edx, dword [ebp - 0x68]
mov dword [edx], eax
mov edx, dword [ebp - 0x24]
movzx eax, byte [edx + 0x242]
add eax, ecx
mov ecx, dword [ebp - 0x68]
mov dword [ecx + 4], eax
movzx eax, byte [edx + 0x242]
sub edi, eax
inc edi
mov dword [ecx + 8], edi
movzx eax, byte [edx + 0x242]
sub esi, eax
mov eax, dword [ecx + 0x30]
inc esi
mov dword [ecx + 0xc], esi
mov ecx, dword [ebp - 0x6c]
mov dword [eax + 0x10], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
mov dword [eax + 0x14], ecx
mov eax, 0x700
jmp 0x415b1a
mov esi, dword [ebp - 0x64]
cmp esi, dword [edi + 0x22c]
jne case.0x4152d3.275
test cx, cx
je 0x414580
cmp dword [edi + 0x40], 1
jle 0x41456d
mov esi, 1
push esi
mov ecx, edi
call fcn.004174a0
test al, al
je 0x414561
mov edx, dword [edi + 0x250]
mov eax, dword [edi + 0x3c]
lea ecx, [edx + edx*8]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x414542
push 1
push 0
push edx
mov ecx, edi
call fcn.004175f0
jmp 0x414561
cmp eax, 0x23
jne 0x414561
mov eax, dword [ecx + 0x44]
test eax, eax
je 0x414561
mov edx, dword [eax + 0x14]
cmp dword [ecx + 0x1c], edx
je 0x414561
push edx
push dword [eax + 4]
mov ecx, edi
call fcn.00416a50
inc esi
cmp esi, dword [edi + 0x40]
jl 0x414512
mov edx, dword [ebx + 8]
mov esi, dword [ebp - 0x64]
mov eax, dword [edi + 0x1c0]
push 0
push 0
push esi
push edx
mov dword [eax + 0x34], esi
push 0xffffffffffffffee
jmp 0x414595
mov eax, dword [edi + 0x1c0]
push 0
push 0
push esi
push edx
mov dword [eax + 0x34], 0
push 0xffffffffffffffed
mov ecx, edi
call fcn.00417dc0
mov dword [edi + 0x250], 0
jmp case.0x4152d3.275
push 0
push ecx
mov ecx, dword [ebp - 0x64]
push ecx
push edx
push 0xffffffffffffffef
jmp 0x415b0b
push 0
push ecx
mov ecx, dword [ebp - 0x64]
push ecx
push edx
push 0xffffffffffffffe5
jmp 0x415b0b
push 0
push ecx
mov ecx, dword [ebp - 0x64]
push ecx
push edx
push 0xffffffffffffffe4
jmp 0x415b0b
mov ecx, dword [ebp - 0x64]
push 0
push 0
push ecx
push edx
push 0xfffffffffffffffb
mov ecx, edi
call fcn.00417dc0
jmp 0x415b18
push ecx
mov ecx, edi
call fcn.00413670
mov esi, eax
mov ecx, edi
push esi
call fcn.004174a0
test al, al
jne 0x414609
xor esi, esi
jmp 0x41460f
mov dword [edi + 0x250], esi
mov ecx, dword [ebp - 0x64]
push 0
push esi
push ecx
push dword [ebx + 8]
mov ecx, edi
push 0xffffffffffffffeb
call fcn.00417dc0
jmp 0x415b18
mov ecx, dword [ebp - 0x64]
push 0
push 0
push ecx
push edx
push 0xffffffffffffffe7
jmp 0x415b0b
cmp ecx, 3
jae 0x41464a
mov ecx, dword [ebp - 0x64]
push ecx
mov ecx, edi
call fcn.004137f0
mov edx, dword [ebx + 8]
push 0
push 0
push dword [ebp - 0x64]
mov ecx, edi
push edx
push 0xfffffffffffffffd
call fcn.00417dc0
jmp 0x415b18
mov eax, dword [esi + 4]
mov ecx, edi
push eax
mov dword [ebp - 0x18], eax
call fcn.004174a0
test al, al
je 0x415b18
mov edx, dword [esi + 8]
cmp edx, 0xfffffffe
jne 0x4146e9
mov edx, dword [ebp - 0x18]
mov eax, dword [edi + 0x3c]
lea ecx, [edx + edx*8]
mov eax, dword [eax + ecx*8]
cmp eax, 0x1f
jne 0x4146c8
mov eax, dword [ebp - 0x68]
lea ecx, [edi + 0x110]
add eax, 0x7c
push eax
call fcn.00409a70
lea ecx, [edi + 0x110]
call fcn.00409c40
push eax
mov eax, dword [ebp - 0x68]
mov ecx, edi
push dword [eax + 0x10]
push dword [ebp - 0x64]
push dword [ebx + 8]
push dword [ebp - 0x18]
call fcn.00417dc0
jmp 0x415b18
cmp eax, 0x1b
jne 0x415b18
push 0
push edx
push dword [ebp - 0x64]
mov ecx, edi
push dword [ebx + 8]
push dword [esi + 0xc]
call fcn.00417dc0
jmp 0x415b18
mov eax, dword [ebp - 0x18]
lea ecx, [eax + eax*8]
mov eax, dword [edi + 0x3c]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp eax, 0x1b
jne 0x41471d
cmp edx, 0xfffffd3a
jne 0x41471d
push 0
push dword [esi + 0xc]
mov ecx, edi
push dword [ebp - 0x64]
push dword [ebx + 8]
push 0xffffffffffffffeb
call fcn.00417dc0
jmp 0x415b18
cmp edx, 0xfffffffd
jne 0x41473b
push 0
push dword [ebp - 0x18]
mov ecx, edi
push dword [ebp - 0x64]
push dword [ebx + 8]
push 0xfffffffffffffff3
call fcn.00417dc0
jmp 0x415b18
cmp edx, 0xfffffffc
jne 0x414759
push 0
push dword [ebp - 0x18]
mov ecx, edi
push dword [ebp - 0x64]
push dword [ebx + 8]
push 0xffffffffffffffe6
call fcn.00417dc0
jmp 0x415b18
cmp eax, 0x19
jne 0x4148ba
cmp edx, 0xfffffdd8
jne 0x4147cf
push 0
push 0
push 0x130b
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x415b18
push eax
push dword [esi]
call fcn.004174d0
mov esi, eax
test esi, esi
je 0x415b18
push esi
mov ecx, edi
call fcn.004174a0
test al, al
je 0x415b18
mov eax, dword [edi + 0x3c]
lea ecx, [esi + esi*8]
push 0
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
push dword [ebp - 0x64]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffdd
call fcn.00417dc0
jmp 0x415b18
cmp edx, 0xfffffdd9
jne 0x415b18
push 0
push 0
push 0xb
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x130b
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x415b18
push eax
push dword [esi]
call fcn.004174d0
mov dword [ebp - 0x24], eax
test eax, eax
je 0x415b18
push eax
mov ecx, edi
call fcn.004174a0
test al, al
je 0x415b18
mov eax, dword [ebp - 0x68]
lea esi, [edi + 0x120]
push esi
push dword [eax]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x68]
push esi
push 0
push 0x1328
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x24]
mov edx, dword [esi]
mov ecx, dword [edi + 0x124]
push 0
lea esi, [eax + eax*8]
mov eax, dword [edi + 0x12c]
sub eax, ecx
push eax
mov eax, dword [edi + 0x128]
sub eax, edx
push eax
mov eax, dword [ebp - 0x68]
push ecx
push edx
push dword [eax]
mov eax, dword [edi + 0x3c]
push dword [eax + esi*8 + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [edi + 0x3c]
push 5
push dword [eax + esi*8 + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x68]
push 0
push 1
push 0xb
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push dword [ebp - 0x24]
mov ecx, edi
push dword [ebp - 0x64]
push dword [ebx + 8]
push 0xffffffffffffffdc
call fcn.00417dc0
jmp 0x415b18
cmp eax, 0xf
jne 0x414c1a
cmp edx, 0xffffff98
je 0x415b18
cmp edx, 0xffffff99
jne 0x4148f7
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x4148de
push ecx
call fcn.00415d70
push 0
push dword [ebp - 0x18]
mov ecx, edi
push dword [ebp - 0x64]
push dword [ebx + 8]
push 0xffffffffffffffcf
call fcn.00417dc0
jmp 0x415b18
cmp edx, 0xffffff94
jne 0x414916
test byte [ecx + 0x44], 1
je 0x415b18
mov edx, dword [esi + 0x10]
push ecx
mov ecx, dword [esi]
call fcn.00412240
jmp 0x415b18
cmp edx, 0xffffff9b
jne 0x4149c6
mov eax, dword [esi + 0x14]
mov ecx, eax
and ecx, 2
je 0x414949
test byte [esi + 0x18], 2
jne 0x414949
push dword [esi + 0xc]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x64]
push dword [ebx + 8]
push 0xffffffffffffffd3
call fcn.00417dc0
jmp 0x415b18
test ecx, ecx
jne 0x41496d
test byte [esi + 0x18], 2
je 0x41496d
push dword [esi + 0xc]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x64]
push dword [ebx + 8]
push 0xffffffffffffffd2
call fcn.00417dc0
jmp 0x415b18
and eax, 0x2000
je 0x414997
test dword [esi + 0x18], 0x2000
jne 0x414997
push dword [esi + 0xc]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x64]
push dword [ebx + 8]
push 0xffffffffffffffd1
call fcn.00417dc0
jmp 0x415b18
test eax, eax
jne 0x415b18
test dword [esi + 0x18], 0x2000
je 0x415b18
push dword [esi + 0xc]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x64]
push dword [ebx + 8]
push 0xffffffffffffffd0
call fcn.00417dc0
jmp 0x415b18
cmp edx, 0xffffff4c
je 0x414bef
cmp edx, 0xffffff4b
je 0x414bef
cmp edx, 0xfffffff4
jne 0x415b18
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x4149f9
mov eax, 0x20
jmp 0x415b1a
cmp eax, 0x10001
jne 0x414ae8
cmp dword [esi + 0x3c], 0
jne 0x414ae8
mov edi, dword [esi + 0x2c]
mov dword [ebp - 0x6c], edi
test edi, edi
je 0x415b18
mov eax, dword [edi + 0xc]
test eax, eax
je 0x414a2d
push eax
push dword [esi + 0x10]
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x414a37
mov dword [esi + 0x30], eax
cmp dword [edi + 0x10], 0
je 0x414abf
push 1
push dword [esi + 0x10]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [edi + 8]
test eax, eax
je 0x414a61
push eax
lea eax, [esi + 0x14]
push eax
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_FillRect]
mov ecx, dword [edi + 0x10]
mov esi, dword [esi + 0x18]
call fcn.00401680
mov ecx, dword [ebp - 0x68]
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x24], 0
mov edi, dword [ecx + 0x20]
sub edi, esi
sub edi, eax
lea eax, [ebp - 0x24]
push eax
push dword [ecx + 0x10]
shr edi, 1
add edi, esi
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x68]
push edi
mov edi, dword [ebp - 0x6c]
push dword [eax + 0x14]
push dword [edi + 0x10]
call fcn.00401410
push dword [ebp - 0x1c]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
jmp 0x414aca
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
je 0x414aca
mov dword [esi + 0x34], eax
cmp dword [edi + 0x14], 0
je 0x414be5
cmp dword [edi + 0x18], 0
je 0x414be5
mov eax, 0x20
jmp 0x415b1a
cmp eax, 0x30001
jne 0x415b18
cmp dword [esi + 0x3c], 0
jne 0x415b18
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x415b18
mov eax, dword [esi + 0x38]
test eax, eax
js 0x415b18
mov edx, dword [ecx + 0x14]
test edx, edx
je 0x415b18
cmp eax, dword [ecx + 0x18]
jg 0x415b18
lea eax, [eax + eax*4]
lea edi, [edx + eax*4]
mov eax, dword [edi]
mov dword [ebp - 0x6c], edi
cmp eax, 0xffffffff
je 0x414b3a
mov dword [esi + 0x30], eax
cmp dword [edi + 0x10], 0
je 0x414bc5
push 1
push dword [esi + 0x10]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [edi + 8]
test eax, eax
je 0x414b64
push eax
lea eax, [esi + 0x14]
push eax
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_FillRect]
mov ecx, dword [edi + 0x10]
mov esi, dword [esi + 0x18]
call fcn.00401680
mov edx, dword [ebp - 0x68]
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x24], 0
mov edi, dword [edx + 0x20]
sub edi, esi
sub edi, eax
lea eax, [ebp - 0x24]
shr edi, 1
add edi, esi
mov esi, edx
push eax
push dword [esi + 0x10]
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x14]
push edi
mov edi, dword [ebp - 0x6c]
add eax, 2
push eax
push dword [edi + 0x10]
call fcn.00401410
push dword [ebp - 0x1c]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
jmp 0x414bd0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
je 0x414bd0
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0xc]
test eax, eax
je 0x415b18
push eax
push dword [esi + 0x10]
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, 2
jmp 0x415b1a
movzx ecx, word [esi + 0x10]
movzx eax, word [esi + 0xc]
shl ecx, 0x10
or ecx, eax
xor eax, eax
push ecx
push dword [ebp - 0x18]
cmp edx, 0xffffff4c
push dword [ebp - 0x64]
sete al
push dword [ebx + 8]
add eax, 0xffffffcd
push eax
jmp 0x415b0b
cmp eax, 0x1d
jne 0x415b18
cmp edx, 0xfffffe36
jne 0x414c61
push dword [esi + 0x14]
mov eax, dword [esi + 0x34]
mov ecx, edi
push dword [ebp - 0x18]
mov dword [ebp - 0x6c], eax
push dword [ebp - 0x64]
push dword [ebx + 8]
push 0xffffffffffffffc4
call fcn.00417dc0
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x415b18
push 0xc
push eax
call fcn.00425adf
add esp, 8
jmp 0x415b18
cmp edx, 0xfffffe60
je 0x414da0
cmp edx, 0xfffffe5f
je 0x414da0
cmp edx, 0xfffffe5e
je 0x414d86
cmp edx, 0xfffffe5d
je 0x414d86
cmp edx, 0xfffffe3a
jne 0x414cc5
test byte [esi + 0xc], 2
mov ecx, edi
push dword [esi + 0x3c]
push dword [ebp - 0x18]
push dword [ebp - 0x64]
push dword [ebx + 8]
je 0x414cb9
push 0xffffffffffffffc9
call fcn.00417dc0
jmp 0x415b18
push 0xffffffffffffffc8
call fcn.00417dc0
jmp 0x415b18
cmp edx, 0xfffffe3d
jne 0x414ce7
push dword [esi + 0x3c]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x64]
push dword [ebx + 8]
push 0xffffffffffffffc7
call fcn.00417dc0
jmp 0x415b18
cmp edx, 0xfffffffb
jne 0x414d18
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 8
push 0x110a
push dword [esi]
call edi
test eax, eax
je 0x415b18
push eax
push 9
push 0x110b
push dword [esi]
call edi
jmp 0x415b18
cmp edx, 0xfffffff4
jne 0x415b18
mov eax, dword [esi + 0xc]
cmp eax, 1
je 0x4149ef
cmp eax, 0x10001
jne 0x415b18
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x415b18
test byte [esi + 0x28], 0x10
jne 0x414d5e
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x414d53
mov dword [esi + 0x30], ecx
mov ecx, dword [eax + 4]
cmp ecx, 0xffffffff
je 0x414d5e
mov dword [esi + 0x34], ecx
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x415b18
mov eax, dword [esi + 0x10]
test eax, eax
je 0x414be5
push ecx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, 2
jmp 0x415b1a
push dword [esi + 0x10]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x64]
push dword [ebx + 8]
push 0xffffffffffffffc5
call fcn.00417dc0
jmp 0x415b18
test byte [ecx + 0x44], 1
je 0x414e74
push 0xfffffffffffffff0
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x100
je 0x414e74
push dword [esi + 0x10]
push 4
push 0x110a
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x415b18
push 0
push 0
push 0xb
push dword [esi]
mov edi, eax
mov dword [ebp - 0x60], 8
mov eax, dword [esi + 0x14]
xorps xmm0, xmm0
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], 0xf000
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x5c], edi
push eax
push 0
push 0x113f
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 1
push 0x110a
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
test edi, edi
jne 0x414e38
push eax
push 1
push 0xb
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [ebp - 0x24]
push dword [esi + 0x10]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x64]
push dword [ebx + 8]
push 0xffffffffffffffc6
call fcn.00417dc0
jmp 0x415b18
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0x220]
test eax, eax
je 0x414f0d
cmp ecx, dword [ebp - 0x64]
jne 0x414f0d
cmp si, 1
jne 0x414f0d
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 0x24], 1
xor esi, esi
push esi
mov ecx, edi
call fcn.004174a0
xor ecx, ecx
test al, al
mov eax, dword [edi + 0x250]
cmove esi, ecx
cmp eax, esi
je 0x414fa8
test eax, eax
je 0x414f67
push eax
mov ecx, edi
call fcn.004174a0
test al, al
je 0x414f67
mov edx, dword [edi + 0x250]
mov eax, dword [edi + 0x3c]
lea ecx, [edx + edx*8]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x414f48
push 1
push 0
push edx
mov ecx, edi
call fcn.004175f0
jmp 0x414f67
test ecx, ecx
je 0x414eb6
push ecx
mov ecx, edi
call fcn.00413670
mov esi, eax
mov ecx, edi
push esi
call fcn.004174a0
test al, al
je 0x414eb8
mov ecx, dword [edi + 0x3c]
lea edx, [esi + esi*8]
mov eax, dword [ecx + edx*8 + 0x18]
test eax, eax
je 0x414eb8
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 0x24], 1
jmp 0x414eb8
cmp eax, 0x23
jne 0x414f67
mov eax, dword [ecx + 0x44]
test eax, eax
je 0x414f67
mov edx, dword [eax + 0x14]
cmp dword [ecx + 0x1c], edx
je 0x414f67
push edx
push dword [eax + 4]
mov ecx, edi
call fcn.00416a50
test esi, esi
je 0x414fa8
mov eax, dword [edi + 0x3c]
lea ecx, [esi + esi*8]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x414f89
push 1
push 1
push esi
mov ecx, edi
call fcn.004175f0
jmp 0x414fa8
cmp eax, 0x23
jne 0x414fa8
mov eax, dword [ecx + 0x44]
test eax, eax
je 0x414fa8
mov edx, dword [eax + 0x18]
cmp dword [ecx + 0x1c], edx
je 0x414fa8
push edx
push dword [eax + 4]
mov ecx, edi
call fcn.00416a50
push 0
push esi
push dword [ebp - 0x64]
mov ecx, edi
mov dword [edi + 0x250], esi
push dword [ebx + 8]
push 0xffffffffffffffec
call fcn.00417dc0
mov eax, dword [ebp - 0x24]
test eax, eax
je case.0x4152d3.275
jmp 0x415b1a
mov edx, dword [edi + 0x144]
mov ecx, dword [edi + 0x140]
lea eax, [ecx + edx]
test eax, eax
je 0x414fe9
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], edx
mov edx, dword [edi + 0x14c]
mov ecx, dword [edi + 0x148]
lea eax, [ecx + edx]
test eax, eax
je 0x415b18
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
jmp 0x415b18
mov eax, dword [ebp - 0x64]
cmp eax, dword [edi + 0x22c]
jne 0x415b18
test esi, esi
je 0x415b18
test byte [esi + 0x18], 2
jne 0x41503c
push dword [esi + 0xc]
mov ecx, edi
push dword [esi + 8]
push eax
call fcn.004136c0
mov edx, dword [ebx + 8]
mov eax, dword [ebp - 0x64]
push 0
push 0
push eax
push edx
push 0xfffffffffffffffe
mov ecx, edi
call fcn.00417dc0
jmp 0x415b18
test esi, esi
je 0x415b18
test byte [esi + 0x18], 1
jne 0x415b18
mov esi, dword [ebp - 0x64]
mov ecx, edi
push esi
call fcn.004137f0
cmp dword [edi + 0x204], 2
jne 0x415086
push 1
push 0
push dword [edi + 0x22c]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push esi
push dword [ebx + 8]
mov ecx, edi
push 0xfffffffffffffffd
call fcn.00417dc0
jmp 0x415b18
cmp dword [edi + 0x204], 3
je case.0x4152d3.275
cmp dword [edi + 0x1fc], 0
je 0x41443f
cmp dword [edi + 0x3c], 0
je 0x415227
cmp dword [edi + 0x40], 1
mov dword [ebp - 0x68], 1
jl 0x415227
mov esi, 0x48
mov dword [ebp - 0x24], esi
nop dword [eax]
mov eax, dword [edi + 0x3c]
cmp dword [eax + esi + 0xc], 0
je 0x415211
mov edx, dword [eax + esi + 4]
test edx, edx
je 0x415211
test dword [eax + esi + 0x3c], 0x400
je 0x415211
mov ecx, dword [eax + esi]
cmp ecx, 0x1e
je 0x415211
cmp ecx, 0x1a
je 0x415211
cmp ecx, 0x1c
je 0x415211
cmp dword [eax + esi + 0x20], 0xfffffffe
je 0x415211
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x415211
mov eax, dword [edi + 0x3c]
push dword [eax + esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, dword [edi + 0x22c]
jne 0x415211
lea eax, [edi + 0x120]
push eax
mov eax, dword [edi + 0x3c]
push dword [eax + esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x415211
push 2
lea eax, [edi + 0x120]
push eax
push dword [ebp - 0x64]
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx + esi]
cmp eax, 0xa
je 0x4151c3
cmp eax, 0x20
jne 0x4151a0
cmp dword [ecx + esi + 0x40], 0
ja 0x4151c3
push dword [edi + 0x12c]
push dword [edi + 0x128]
push dword [edi + 0x124]
push dword [edi + 0x120]
push dword [ebp - 0x18]
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
jmp 0x415211
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov ecx, dword [edi + 0x3c]
mov esi, eax
mov eax, dword [ebp - 0x24]
push esi
push dword [ecx + eax + 4]
call dword [sym.imp.USER32.dll_GetWindowRgn]
test eax, eax
je 0x415207
push dword [edi + 0x124]
push dword [edi + 0x120]
push esi
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 4
push esi
push dword [ebp - 0x18]
call dword [sym.imp.GDI32.dll_ExtSelectClipRgn]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x68]
add esi, 0x48
inc eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x68], eax
cmp eax, dword [edi + 0x40]
jle 0x4150e0
lea esi, [edi + 0x120]
push esi
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_GetClientRect]
test eax, eax
je 0x415294
cmp dword [edi + 0x204], 2
je 0x415256
push dword [edi + 0x1fc]
push esi
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_FillRect]
jmp 0x415294
mov esi, dword [ebp - 0x18]
push 4
push esi
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
push 0xcc0020
push dword [edi + 0x21c]
push dword [edi + 0x218]
push 0
push 0
push dword [edi + 0x1e8]
push dword [edi + 0x12c]
push dword [edi + 0x128]
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_StretchBlt]
push 0
push dword [ebp - 0x18]
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov eax, 1
jmp 0x415b1a
cmp edx, 0x214
ja 0x415932
je 0x415918
lea eax, [edx - 0x111]
cmp eax, 0xf9
ja case.0x4152d3.275
movzx eax, byte [eax + 0x415c6c]
jmp dword [eax*4 + 0x415c2c]
push 0
push ecx
push dword [ebp - 0x64]
push edx
push 0xfffffffffffffff6
jmp 0x415b0b
push 0
push ecx
push dword [ebp - 0x64]
push edx
push 0xfffffffffffffff5
jmp 0x415b0b
push 0
push ecx
push dword [ebp - 0x64]
push edx
push 0xfffffffffffffff4
jmp 0x415b0b
push 0
push dword [edi + 0x250]
push dword [ebp - 0x64]
push edx
push 0xfffffffffffffff3
jmp 0x415b0b
push 0
push dword [edi + 0x250]
push dword [ebp - 0x64]
push edx
push 0xfffffffffffffff2
jmp 0x415b0b
push 0
push ecx
push dword [ebp - 0x64]
push edx
push 0xfffffffffffffff0
jmp 0x415b0b
push esi
push ecx
push edx
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_DefDlgProcW]
jmp 0x415b1a
sub esp, 0x24
mov ecx, edi
call fcn.00414340
mov eax, dword [ebp - 0x18]
cmp eax, 0xf120
jne 0x415372
push 0
push 0
push dword [ebp - 0x64]
mov eax, 0xfffffff9
push dword [ebx + 8]
push eax
jmp 0x415b0b
cmp eax, 0xf030
jne 0x41538e
push 0
push 0
push dword [ebp - 0x64]
mov eax, 0xfffffff8
push dword [ebx + 8]
push eax
jmp 0x415b0b
cmp eax, 0xf020
jne 0x4153aa
push 0
push 0
push dword [ebp - 0x64]
mov eax, 0xfffffffa
push dword [ebx + 8]
push eax
jmp 0x415b0b
cmp eax, 0xf060
jne 0x4153c6
push 0
push 0
push dword [ebp - 0x64]
mov eax, 0xfffffffb
push dword [ebx + 8]
push eax
jmp 0x415b0b
cmp eax, 0xf010
jne case.0x4152d3.275
push 0
push 0
push dword [ebp - 0x64]
mov eax, 0xffffffe8
push dword [ebx + 8]
push eax
jmp 0x415b0b
movsx ecx, si
shr esi, 0x10
movsx eax, si
push 0
mov dword [edi + 0x248], eax
mov eax, dword [ebp - 0x18]
push eax
push dword [ebp - 0x64]
mov dword [edi + 0x244], ecx
push edx
mov dword [edi + 0x24c], eax
push 0xfffffffffffffff1
jmp 0x415b0b
movsx ecx, si
shr esi, 0x10
movsx eax, si
mov esi, dword [ebp - 0x64]
push eax
push ecx
push esi
call dword [sym.imp.USER32.dll_ChildWindowFromPoint]
test eax, eax
je 0x415481
push eax
mov ecx, edi
call fcn.00413670
push eax
mov ecx, edi
mov dword [ebp - 0x24], eax
call fcn.004174a0
test al, al
je 0x415481
mov eax, dword [ebp - 0x24]
lea ecx, [eax + eax*8]
mov eax, dword [edi + 0x3c]
test dword [eax + ecx*8 + 0x3c], 0x1000
je 0x415481
mov eax, dword [edi + 0x1c0]
movzx ecx, word [eax + 0x2c]
movzx eax, word [eax + 0x28]
shl ecx, 0x10
or ecx, eax
push ecx
push 2
push 0xa1
push dword [edi + 0x22c]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x4152d3.275
push 0
push 0
push esi
push dword [ebx + 8]
push 0xfffffffffffffff7
jmp 0x415b0b
mov eax, ecx
shr eax, 0x10
mov dword [ebp - 0x68], eax
movzx eax, cx
mov ecx, edi
push eax
mov dword [ebp - 0x24], eax
call fcn.004174a0
test al, al
je case.0x4152d3.275
mov edx, dword [ebp - 0x24]
mov eax, dword [edi + 0x3c]
lea ecx, [edx + edx*8]
lea eax, [eax + ecx*8]
mov ecx, dword [eax]
mov dword [ebp - 0x18], eax
cmp ecx, 5
je 0x41564d
cmp ecx, 6
je 0x41564d
cmp ecx, 9
je 0x4155c6
cmp ecx, 0xc
je 0x4155c6
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], 0
cmp word [ebp - 0x6c], ax
je 0x415504
mov dword [ebp - 0x6c], 1
cmp word [ebp - 0x6c], ax
jne 0x415b18
cmp ecx, 0x22
jne 0x415534
push 0x80
push edx
mov ecx, edi
call fcn.00416d40
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x68]
push esi
movzx eax, ax
mov ecx, edi
push eax
push dword [ebp - 0x64]
push dword [ebx + 8]
push edx
call fcn.00417dc0
jmp 0x415b18
cmp ecx, 0x23
jne 0x415583
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x44]
mov dword [ebp - 0x6c], ecx
test ecx, ecx
je 0x415b18
xor eax, eax
cmp dword [ecx + 8], 4
mov ecx, edi
sete al
lea eax, [eax*4 + 4]
push eax
push edx
call fcn.00416d40
mov eax, dword [ebp - 0x68]
mov ecx, edi
push esi
movzx eax, ax
push eax
push dword [ebp - 0x64]
mov eax, dword [ebp - 0x6c]
push dword [ebx + 8]
push dword [eax + 4]
call fcn.00417dc0
jmp 0x415b18
mov ecx, dword [edi + 0x22c]
cmp ecx, dword [ebp - 0x64]
jne 0x41551c
mov ecx, dword [ebp - 0x18]
test dword [ecx + 0x3c], 0x1000
je 0x41551c
mov eax, dword [edi + 0x1c0]
movzx ecx, word [eax + 0x2c]
movzx eax, word [eax + 0x28]
shl ecx, 0x10
or ecx, eax
push ecx
push 2
push 0xa1
push dword [edi + 0x22c]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x415b18
mov eax, dword [ebp - 0x68]
mov ecx, 0x400
cmp cx, ax
jne 0x4155e9
push esi
push edx
push dword [ebp - 0x64]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffb5
call fcn.00417dc0
jmp 0x415b18
mov ecx, 0x300
cmp cx, ax
jne 0x415609
push esi
push edx
push dword [ebp - 0x64]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffb4
call fcn.00417dc0
jmp 0x415b18
mov ecx, 0x100
cmp cx, ax
jne 0x415629
push esi
push edx
push dword [ebp - 0x64]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffb3
call fcn.00417dc0
jmp 0x415b18
mov ecx, 0x200
cmp cx, ax
jne 0x415b18
push esi
push edx
push dword [ebp - 0x64]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffb2
call fcn.00417dc0
jmp 0x415b18
mov eax, dword [ebp - 0x68]
mov ecx, 1
cmp cx, ax
jne 0x415670
push esi
push edx
push dword [ebp - 0x64]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffbf
call fcn.00417dc0
jmp 0x415b18
mov ecx, 7
cmp cx, ax
jne 0x415690
push esi
push edx
push dword [ebp - 0x64]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffbe
call fcn.00417dc0
jmp 0x415b18
mov ecx, 8
cmp cx, ax
jne 0x4156b0
push esi
push edx
push dword [ebp - 0x64]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffbd
call fcn.00417dc0
jmp 0x415b18
mov ecx, 3
cmp cx, ax
jne 0x4156d0
push esi
push edx
push dword [ebp - 0x64]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffbc
call fcn.00417dc0
jmp 0x415b18
mov ecx, 4
cmp cx, ax
jne 0x4156f0
push esi
push edx
push dword [ebp - 0x64]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffbb
call fcn.00417dc0
jmp 0x415b18
mov ecx, 2
cmp cx, ax
jne 0x415b18
push esi
push edx
push dword [ebp - 0x64]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffba
call fcn.00417dc0
jmp 0x415b18
push ecx
push esi
call dword [sym.imp.USER32.dll_GetMenuItemID]
mov ecx, dword [ebp - 0x64]
push esi
push dword [ebp - 0x18]
push ecx
push dword [ebx + 8]
mov ecx, edi
push eax
call fcn.00417dc0
jmp 0x415b18
push esi
mov ecx, edi
call fcn.00413670
mov esi, eax
mov ecx, edi
push esi
call fcn.004174a0
test al, al
je case.0x4152d3.275
mov ecx, dword [edi + 0x3c]
lea edx, [esi + esi*8]
cmp dword [ecx + edx*8], 0x17
jne case.0x4152d3.275
push 0
push 0
push 0x400
push dword [ecx + edx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, edi
movzx eax, ax
push eax
push dword [ebp - 0x64]
push dword [ebx + 8]
push esi
call fcn.00417dc0
jmp 0x415b18
cmp dword [edi + 0x3c], 0
je case.0x4152d3.275
push esi
mov ecx, edi
call fcn.00413670
mov esi, eax
mov ecx, edi
push esi
call fcn.004174a0
test al, al
je case.0x4152d3.275
mov eax, dword [edi + 0x3c]
lea ecx, [esi + esi*8]
mov esi, dword [ebp - 0x18]
shl ecx, 3
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + ecx + 0x1c]
cmp eax, 0xffffffff
je 0x4157d3
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [ebp - 0x24]
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + ecx + 0x20]
cmp eax, 0xffffffff
je 0x4157ea
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, dword [ebp - 0x24]
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + ecx + 0x10]
test eax, eax
je case.0x4152d3.275
jmp 0x415b1a
cmp dword [edi + 0x3c], 0
je case.0x4152d3.275
push esi
mov ecx, edi
call fcn.00413670
mov esi, eax
mov ecx, edi
push esi
mov dword [ebp - 0x24], esi
call fcn.004174a0
test al, al
je case.0x4152d3.275
mov eax, dword [edi + 0x3c]
lea ecx, [esi + esi*8]
mov esi, dword [ebp - 0x18]
shl ecx, 3
mov dword [ebp - 0x68], ecx
mov eax, dword [eax + ecx + 0x1c]
cmp eax, 0xffffffff
je 0x415848
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + ecx + 0x20]
cmp eax, 0xfffffffe
jne 0x41586a
push 1
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x415b1a
cmp eax, 0xffffffff
je 0x41588b
push 2
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [edi + 0x3c]
mov ecx, dword [ebp - 0x68]
push dword [eax + ecx + 0x20]
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x415894
push 1
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [edi + 0x3c]
mov ecx, dword [ebp - 0x68]
mov edx, dword [eax + ecx + 0x10]
mov dword [ebp - 0x18], edx
test edx, edx
jne 0x4158bb
push esi
push dword [ebp - 0x24]
mov ecx, edi
call fcn.00417250
mov dword [ebp - 0x18], eax
test eax, eax
je case.0x4152d3.275
mov ecx, dword [edi + 0x3c]
mov eax, dword [ebp - 0x68]
cmp dword [eax + ecx], 0xa
jne 0x415906
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov ecx, dword [edi + 0x3c]
push eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x68]
push dword [ecx + eax + 4]
call dword [sym.imp.USER32.dll_GetWindowRgn]
mov edi, dword [ebp - 0x18]
test eax, eax
je 0x4158fb
push edi
push dword [ebp - 0x24]
push esi
call dword [sym.imp.GDI32.dll_FillRgn]
push dword [ebp - 0x24]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x415909
mov edi, dword [ebp - 0x18]
test edi, edi
je case.0x4152d3.275
mov eax, edi
jmp 0x415b1a
push 0
push 0
push dword [ebp - 0x64]
mov ecx, edi
push 0x214
push 0xfffffffffffffffe
call fcn.00417dc0
jmp 0x415b18
cmp edx, 0x233
ja 0x415ad7
je 0x415993
sub edx, 0x216
je 0x415974
sub edx, 0x1c
jne case.0x4152d3.275
mov esi, dword [ebp - 0x64]
mov ecx, edi
push esi
call fcn.004137f0
push 0
push 0
push esi
push 0x232
push 0xffffffffffffffe7
mov ecx, edi
call fcn.00417dc0
jmp 0x415b18
push 0
push 0
push dword [ebp - 0x64]
mov ecx, edi
push 0x216
push 0xffffffffffffffe8
call fcn.00417dc0
mov eax, 1
jmp 0x415b1a
lea eax, [edi + 0x210]
mov dword [edi + 0x20c], ecx
push eax
push ecx
call dword [sym.imp.SHELL32.dll_DragQueryPoint]
test eax, eax
jne 0x4159bc
push dword [edi + 0x20c]
call dword [sym.imp.SHELL32.dll_DragFinish]
jmp 0x415b18
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.004099b0
lea ecx, [edi + 0x110]
mov dword [ebp - 4], 0
call fcn.00409b00
push 0x800
xor esi, esi
lea ecx, [ebp - 0x20]
push esi
push 0x800
call fcn.00409f00
push eax
push esi
push dword [edi + 0x20c]
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
test eax, eax
je 0x415a76
nop dword [eax]
test esi, esi
je 0x415a26
sub esp, 0x28
lea ecx, [ebp - 0x20]
push 0
push 0x46e158
call fcn.0040ada0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.00409c40
push eax
lea ecx, [edi + 0x110]
call fcn.0040aa90
push 0x800
push 0
push 0x800
lea ecx, [ebp - 0x20]
inc esi
call fcn.00409f00
push eax
push esi
push dword [edi + 0x20c]
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
test eax, eax
jne 0x415a10
push dword [edi + 0x20c]
call dword [sym.imp.SHELL32.dll_DragFinish]
mov esi, dword [ebp - 0x64]
mov edx, dword [edi + 0x210]
push ecx
push dword [edi + 0x214]
mov ecx, esi
mov dword [ebp - 0x24], 0
call fcn.00411a60
test eax, eax
je 0x415aaf
push eax
mov ecx, edi
call fcn.00413670
mov dword [ebp - 0x24], eax
lea ecx, [edi + 0x110]
call fcn.00409c40
push eax
push dword [ebp - 0x24]
mov ecx, edi
push esi
push 0x233
push 0xfffffffffffffffc
call fcn.00417dc0
lea ecx, [ebp - 0x20]
call fcn.00409af0
jmp 0x415b18
cmp edx, 0x2a2
je 0x415afe
cmp edx, 0x400
jne case.0x4152d3.275
cmp dword [edi + 0x1ec], 0
je 0x415b18
movzx eax, word [edi + 0x1ec]
or eax, 0x534b0000
jmp 0x415b1a
push 0
push ecx
push dword [ebp - 0x64]
push 0x2a2
push 0xffffffffffffffea
mov ecx, edi
call fcn.00417dc0
mov eax, dword [ebp - 0x6c]
mov byte [eax], 1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042520b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10