Function at 0x41de7c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x41de84
push ebx
push esi
push edi
test dl, dl
je 0x41de9a
add esp, 0xfffffff0
call fcn.00402b78
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x41e998
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.0040296c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x40f248]
call fcn.0040f2cc
mov esi, eax
mov dword [edi + 4], esi
mov dword [esi + 0x24], 0x14
mov dword [esi + 0x28], 0x69
mov dword [esi + 0x2c], 0x304
mov dword [esi + 0x30], 0x1ee
mov byte [esi + 0x34], 0
mov dword [esi + 0x3c], 0xff000003
push 0
push 1
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
mov dl, 8
mov eax, 0x41e9c8
call fcn.0040e890
lea edx, [ebp - 0x10]
lea eax, [esi + 0x48]
mov ecx, dword [0x40e0d0]
call fcn.00403b88
mov byte [esi + 0xcf], 0xff
mov edx, 0x41e9e0
mov eax, esi
call fcn.0040f5d0
mov dl, 3
mov eax, esi
call fcn.0040f604
mov byte [esi + 0xd0], 0
push 0x41e9ec
mov eax, dword [0x41f75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0040f788
mov byte [esi + 0xcd], 0
xor edx, edx
mov eax, esi
call fcn.0040f75c
mov byte [esi + 0xce], 1
mov byte [esi + 0x5a], 1
xor eax, eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0xe0], 0xffffff
mov dword [esi + 0xd8], esi
mov dword [esi + 0xd4], 0x40faa8
lea eax, [esi + 0xdc]
mov edx, 0x41e9fc
call fcn.00403378
mov byte [esi + 0x60], 0
mov byte [esi + 0xe5], 0
mov dword [esi + 0xec], esi
mov dword [esi + 0xe8], 0x40fab0
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x20]
mov dl, 1
mov eax, dword [0x40fc0c]
call fcn.0040fc84
mov dword [edi + 8], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x20]
mov dl, 1
mov eax, dword [0x412c3c]
call fcn.00412cc0
mov dword [edi + 0xc], eax
mov dl, 1
mov eax, dword [0x4132f8]
call fcn.0040296c
mov dword [edi + 0x10], eax
mov dl, 1
mov eax, dword [0x4132f8]
call fcn.0040296c
mov dword [edi + 0x14], eax
mov dl, 1
mov eax, dword [0x41348c]
call fcn.0040296c
mov dword [edi + 0x18], eax
mov dl, 1
mov eax, dword [0x4132f8]
call fcn.0040296c
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x20]
mov dl, 1
mov eax, dword [0x4135e8]
call fcn.00413654
mov dword [edi + 0x20], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x20]
mov dl, 1
mov eax, dword [0x413954]
call fcn.004139b0
mov dword [edi + 0x24], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x20]
mov dl, 1
mov eax, dword [0x40fc0c]
call fcn.0040fc84
mov dword [edi + 0x28], eax
mov dl, 1
mov eax, dword [0x4132f8]
call fcn.0040296c
mov dword [edi + 0x2c], eax
mov dl, 1
mov eax, dword [0x41348c]
call fcn.0040296c
mov dword [edi + 0x30], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x20]
mov dl, 1
mov eax, dword [0x40fc0c]
call fcn.0040fc84
mov dword [edi + 0x34], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x20]
mov dl, 1
mov eax, dword [0x413d1c]
call fcn.00413d8c
mov dword [edi + 0x38], eax
mov dl, 1
mov eax, dword [0x41348c]
call fcn.0040296c
mov dword [edi + 0x3c], eax
mov dl, 1
mov eax, dword [0x413fc8]
call fcn.0040296c
mov dword [edi + 0x40], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x20]
mov dl, 1
mov eax, dword [0x4140b8]
call fcn.00414130
mov dword [edi + 0x44], eax
mov dl, 1
mov eax, dword [0x41348c]
call fcn.0040296c
mov dword [edi + 0x48], eax
mov dl, 1
mov eax, dword [0x4132f8]
call fcn.0040296c
mov dword [edi + 0x4c], eax
mov dl, 1
mov eax, dword [0x4132f8]
call fcn.0040296c
mov dword [edi + 0x50], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x20]
mov dl, 1
mov eax, dword [0x4140b8]
call fcn.00414130
mov esi, eax
mov dword [edi + 0x54], esi
mov eax, esi
mov byte [eax + 0x14], 0
call fcn.0041424c
mov esi, dword [edi + 0x54]
mov edx, 0x416060
mov eax, esi
call fcn.00414330
xor edx, edx
mov eax, esi
call fcn.00414250
xor edx, edx
mov eax, esi
call fcn.00414274
mov esi, dword [edi + 0x50]
mov byte [esi + 4], 0
lea edx, [ebp - 0x28]
mov eax, 0x41ea10
call fcn.0040e738
lea edx, [ebp - 0x28]
lea eax, [esi + 0x20]
mov ecx, dword [0x40e0b4]
call fcn.00403b88
mov eax, dword [edi + 0x44]
push eax
push 0x4142dc
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 0x50]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x54], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x58], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x5c], edx
mov esi, dword [edi + 0x4c]
mov byte [esi + 4], 0
lea edx, [ebp - 0x28]
mov eax, 0x41ea24
call fcn.0040e738
lea edx, [ebp - 0x28]
lea eax, [esi + 0x20]
mov ecx, dword [0x40e0b4]
call fcn.00403b88
mov eax, dword [edi + 0x54]
push eax
push 0x4142dc
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 0x4c]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x54], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x58], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x5c], edx
mov eax, dword [edi + 0x48]
mov byte [eax + 5], 1
mov dx, 2
call fcn.004134f4
mov eax, dword [edi + 0x4c]
push eax
push 0x41336c
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 0x48]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x34]
mov dword [eax], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 8], edx
mov eax, dword [edi + 0x50]
push eax
push 0x41336c
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 0x48]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x14], edx
mov eax, dword [edi + 0x44]
mov byte [eax + 0x14], 0
call fcn.0041424c
mov esi, dword [edi + 0x44]
mov edx, 0x41928c
mov eax, esi
call fcn.00414330
mov dx, 2
mov eax, esi
call fcn.00414250
xor edx, edx
mov eax, esi
call fcn.00414274
mov eax, dword [edi + 0x40]
push eax
push 0x41401c
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 0x44]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 0x34]
mov dword [eax], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 8], edx
mov eax, dword [edi + 8]
push eax
push 0x40fd44
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 0x44]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x14], edx
mov eax, dword [edi + 0x40]
mov dword [eax + 4], 0x1f4
mov dword [eax + 8], 0x32
mov eax, dword [edi + 0x3c]
mov byte [eax + 5], 1
mov dx, 2
call fcn.004134f4
mov eax, dword [edi + 0x20]
push eax
push 0x413844
lea edx, [ebp - 0x34]
mov ax, 1
call fcn.0040e25c
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x34]
mov dword [eax], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 8], edx
mov eax, dword [edi + 8]
push eax
push 0x40fd44
lea edx, [ebp - 0x34]
mov ax, 4
call fcn.0040e25c
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x14], edx
mov esi, dword [edi + 0x38]
mov eax, 0x41ea2c
call fcn.0040e858
mov edx, eax
lea eax, [ebp - 0x38]
call fcn.00403448
mov edx, dword [ebp - 0x38]
mov eax, esi
call fcn.00413e0c
mov eax, dword [edi + 0x48]
push eax
push 0x41351c
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 0x38]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x34], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x38], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x3c], edx
mov eax, dword [edi + 0x34]
mov byte [eax + 0x10], 0
call fcn.0040fcf8
mov esi, dword [edi + 0x34]
mov edx, 0x419a8c
mov eax, esi
call fcn.0040fd70
mov dx, 2
mov eax, esi
call fcn.0040fcfc
xor edx, edx
mov eax, esi
call fcn.0040fd20
mov eax, dword [edi + 8]
push eax
push 0x40fd44
lea edx, [ebp - 0x34]
mov ax, 3
call fcn.0040e25c
mov eax, dword [edi + 0x34]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x34]
mov dword [eax], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 8], edx
mov eax, dword [edi + 0x30]
mov byte [eax + 5], 2
mov dx, 1
call fcn.004134f4
mov eax, dword [edi + 4]
push eax
push 0x40faf4
lea edx, [ebp - 0x34]
mov ax, 3
call fcn.0040e25c
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x34]
mov dword [eax], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 8], edx
mov esi, dword [edi + 0x2c]
mov byte [esi + 4], 0
lea edx, [ebp - 0x28]
mov eax, 3
call fcn.0040e72c
lea edx, [ebp - 0x28]
lea eax, [esi + 0x20]
mov ecx, dword [0x40e0b4]
call fcn.00403b88
mov eax, dword [edi + 0x30]
push eax
push 0x41351c
lea edx, [ebp - 0x34]
mov ax, 1
call fcn.0040e25c
mov eax, dword [edi + 0x2c]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x54], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x58], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x5c], edx
mov eax, dword [edi + 0x28]
mov byte [eax + 0x10], 0
call fcn.0040fcf8
mov esi, dword [edi + 0x28]
mov edx, 0x41a940
mov eax, esi
call fcn.0040fd70
xor edx, edx
mov eax, esi
call fcn.0040fcfc
xor edx, edx
mov eax, esi
call fcn.0040fd20
mov esi, dword [edi + 0x24]
mov eax, 0x41ea34
call fcn.0040e858
mov edx, eax
lea eax, [ebp - 0x38]
call fcn.00403448
mov edx, dword [ebp - 0x38]
mov eax, esi
call fcn.00413c04
mov eax, dword [edi + 0x18]
push eax
push 0x41351c
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 0x24]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x1c], edx
mov esi, dword [edi + 0x20]
xor edx, edx
mov eax, esi
call fcn.004136e8
mov byte [esi + 0x70], 0
mov eax, dword [edi + 0x24]
push eax
push 0x413c88
lea edx, [ebp - 0x34]
mov ax, 1
call fcn.0040e25c
mov eax, dword [edi + 0x20]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x80], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x84], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x88], edx
mov esi, dword [edi + 0x1c]
mov byte [esi + 4], 0
lea edx, [ebp - 0x28]
mov eax, 1
call fcn.0040e72c
lea edx, [ebp - 0x28]
lea eax, [esi + 0x20]
mov ecx, dword [0x40e0b4]
call fcn.00403b88
mov eax, dword [edi + 8]
push eax
push 0x40fd44
lea edx, [ebp - 0x34]
mov ax, 1
call fcn.0040e25c
mov eax, dword [edi + 0x1c]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x54], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x58], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x5c], edx
mov eax, dword [edi + 0x18]
mov byte [eax + 5], 1
mov dx, 4
call fcn.004134f4
mov eax, dword [edi + 0x14]
push eax
push 0x41336c
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 0x18]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x34]
mov dword [eax], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 8], edx
mov eax, dword [edi + 0x1c]
push eax
push 0x41336c
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 0x18]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x14], edx
mov eax, dword [edi + 0x10]
push eax
push 0x41336c
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 0x18]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x1c], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x20], edx
mov eax, dword [edi + 0x2c]
push eax
push 0x41336c
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 0x18]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x24], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x28], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x2c], edx
mov esi, dword [edi + 0x14]
mov byte [esi + 4], 0
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.0040e72c
lea edx, [ebp - 0x28]
lea eax, [esi + 0x20]
mov ecx, dword [0x40e0b4]
call fcn.00403b88
mov eax, dword [edi + 0x20]
push eax
push 0x41383c
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 0x14]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x54], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x58], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x5c], edx
mov esi, dword [edi + 0x10]
mov byte [esi + 4], 0
lea edx, [ebp - 0x28]
mov eax, 2
call fcn.0040e72c
lea edx, [ebp - 0x28]
lea eax, [esi + 0x20]
mov ecx, dword [0x40e0b4]
call fcn.00403b88
mov eax, dword [edi + 8]
push eax
push 0x40fd44
lea edx, [ebp - 0x34]
mov ax, 2
call fcn.0040e25c
mov eax, dword [edi + 0x10]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x54], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x58], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x5c], edx
mov esi, dword [edi + 0xc]
mov dword [esi + 0x24], 0x2a8
mov dword [esi + 0x28], 0x186
mov dword [esi + 0x2c], 0x46
mov dword [esi + 0x30], 0x19
mov byte [esi + 0x34], 0
xor eax, eax
mov dword [esi + 0x38], eax
mov dword [esi + 0xec], 0xff00000f
lea eax, [esi + 0x44]
call fcn.00403324
push 0
push 1
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov dl, 8
mov eax, 0x41e9c8
call fcn.0040e890
lea edx, [ebp - 0x10]
lea eax, [esi + 0x48]
mov ecx, dword [0x40e0d0]
call fcn.00403b88
mov byte [esi + 0x58], 0
mov byte [esi + 0x5a], 1
mov byte [esi + 0x5b], 1
xor eax, eax
mov dword [esi + 0x5c], eax
mov edx, 0x41ea44
mov eax, esi
call fcn.00413000
mov byte [esi + 0xe8], 0xa
mov byte [esi + 0xe9], 0xa
mov dword [esi + 0xf8], 0xffffff
mov dword [esi + 0xf0], 0xf0caa6
mov dword [esi + 0xf4], 0xff
mov dword [esi + 0x100], 0xf0caa6
mov dword [esi + 0xfc], 0xf0caa6
xor eax, eax
mov dword [esi + 0x104], eax
mov byte [esi + 0x108], 3
mov dword [esi + 0x114], 0xf0caa6
mov dword [esi + 0x10c], 0xffffff
mov dword [esi + 0x110], 0xff
mov dword [esi + 0x11c], 0x808080
mov dword [esi + 0x118], 0x808080
mov dword [esi + 0x120], 1
mov byte [esi + 0x124], 5
mov dword [esi + 0x130], 0xf0fbff
mov dword [esi + 0x128], 0xf0caa6
xor eax, eax
mov dword [esi + 0x12c], eax
mov dword [esi + 0x138], 0xa4a0a0
mov dword [esi + 0x134], 0x808080
mov dword [esi + 0x13c], 0xffffffff
mov byte [esi + 0x140], 5
mov dword [esi + 0x14c], 0xffffff
mov dword [esi + 0x144], 0x808080
mov dword [esi + 0x148], 0x808080
mov dword [esi + 0x154], 0xa4a0a0
mov dword [esi + 0x150], 0xffffff
mov dword [esi + 0x158], 1
mov byte [esi + 0x15c], 5
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [edi + 0x30]
push eax
push 0x41351c
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0xc4], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0xc8], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0xcc], edx
mov eax, dword [edi + 8]
mov byte [eax + 0x10], 0
call fcn.0040fcf8
mov esi, dword [edi + 8]
mov edx, 0x41bf5c
mov eax, esi
call fcn.0040fd70
mov dx, 2
mov eax, esi
call fcn.0040fcfc
xor edx, edx
mov eax, esi
call fcn.0040fd20
mov eax, dword [edi + 0x44]
push eax
push 0x4142dc
lea edx, [ebp - 0x34]
mov ax, 1
call fcn.0040e25c
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x34]
mov dword [eax], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 8], edx
mov eax, dword [edi + 0x28]
push eax
push 0x40fd44
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x14], edx
mov eax, dword [edi + 0x3c]
push eax
push 0x41351c
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.0040e25c
mov eax, dword [edi + 4]
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x138], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x13c], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x140], edx
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x20]
call fcn.0040b138
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e99f
lea eax, [ebp - 0x38]
call fcn.00403324
lea eax, [ebp - 0x28]
mov edx, dword [0x40e0b4]
call fcn.00403978
lea eax, [ebp - 0x10]
mov edx, dword [0x40e0d0]
call fcn.00403978
ret