Function at 0x40e6c1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x478b78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push ebx
xor ebx, ebx
mov dword [ebp - 0x128], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
xor edi, edi
mov dword [ebp - 0x12c], edx
inc edi
mov dword [ebp - 0x120], ecx
cmp eax, edi
mov dword [ebp - 0x118], ebx
push edx
cmovl eax, edi
mov dword [ebp - 0xd8], ebx
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0xbc], ebx
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0xa4], eax
call esi
mov ebx, eax
cmp dword [ebx + 0x34], 0x13
je 0x40e773
cmp dword [ebx + 0x34], 0x1c
jne 0x40e801
cmp dword [ebx + 0x2c], 0xffffffff
mov dword [ebp - 0x94], edi
je 0x40e7f1
lea eax, [ebp - 0x130]
push eax
push dword [ebx + 0x2c]
push 0x65
push dword [ebp + 0xc]
call fcn.0043c164
test eax, eax
jne 0x40e7f1
push dword [ebp - 0x130]
call esi
push dword [ebx + 0x30]
push eax
call fcn.0041e296
mov esi, eax
mov dword [ebp - 0xb0], esi
test byte [esi + 0xf4], 0x80
je 0x40e7d9
push 0
push 0x1000
lea eax, [esi + 0x2c]
push eax
call fcn.0046bad9
and dword [esi + 0xfc], 0
and dword [esi + 0x100], 0
jmp 0x40e7e1
xor edi, edi
mov dword [ebp - 0x94], edi
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test edi, edi
je 0x40e801
cmp dword [ebx + 0x34], 0x13
push 0x21
pop eax
push 0xe
pop ecx
cmove eax, ecx
mov dword [ebx + 0x34], eax
mov eax, dword [ebx + 0xa0]
mov ecx, dword [ebx + 0x8c]
add eax, ebx
mov edx, dword [ebx + 0x34]
mov edi, ecx
sub edi, dword [ebx + 0x90]
mov esi, dword [ebx + 0x80]
mov dword [ebp - 0xcc], eax
mov eax, edx
mov dword [ebp - 0x84], edi
mov dword [ebp - 0xc8], edx
mov dword [ebp - 0x100], esi
sub eax, 0x17
je 0x40e87f
dec eax
sub eax, 1
je 0x40e873
sub eax, 3
je 0x40e86f
sub eax, 1
je 0x40e86a
sub eax, 4
jne 0x40e8c6
push 0xe
pop eax
mov edx, eax
xor eax, eax
mov dword [ebp - 0xc8], edx
inc eax
mov dword [ebp - 0xfc], eax
jmp 0x40e8c9
push 6
pop edx
jmp 0x40e859
push 0x13
jmp 0x40e86c
mov dword [ebp - 0xc8], 5
jmp 0x40e889
mov dword [ebp - 0xc8], 0x10
xor eax, eax
inc eax
mov esi, eax
mov dword [ebp - 0xfc], eax
lea eax, [ecx - 1]
push eax
push ebx
call fcn.0041e296
mov edi, eax
push edi
push ebx
mov dword [ebp - 0x88], edi
call fcn.0041e380
mov edi, dword [ebp - 0x84]
xor ecx, ecx
mov edx, dword [ebp - 0xc8]
test eax, eax
cmovs esi, ecx
mov dword [ebp - 0x124], esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa4], 4
jne 0x40e8f9
cmp edi, eax
jne 0x40e8f9
mov dword [ebp - 0xa4], 2
cmp edx, 3
je 0x40e8f5
cmp edx, 8
jne 0x40e8f9
push 0xf
pop ecx
mov dword [ebp - 0xc8], ecx
jmp 0x40e8ff
push 5
jmp 0x40e8ec
mov ecx, dword [ebp - 0xc8]
mov eax, edi
mov dword [ebp - 0xf4], edi
cdq
idiv dword [ebp - 0xa4]
xor edx, edx
mov esi, eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xa4]
cmp eax, 1
setg dl
imul eax, esi
inc edx
mov dword [ebp - 0xa0], edx
sub dword [ebp - 0xf4], eax
je 0x40e93d
inc esi
mov dword [ebp - 0x8c], esi
push 3
pop eax
cmp ecx, eax
jne 0x40e95e
xor ecx, ecx
mov dword [ebp - 0xa0], eax
inc ecx
mov dword [ebp - 0xc], 2
mov eax, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], eax
jmp 0x40e97f
test edx, edx
jle 0x40e97c
mov eax, dword [ebp - 0xa4]
lea edi, [ebp - 0x10]
mov ecx, edx
cdq
idiv dword [ebp - 0xa0]
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc0], eax
lea ecx, [edi + 1]
mov eax, dword [ebx + 0x78]
xor edx, edx
add eax, dword [ebx + 0x70]
add eax, dword [ebx + 0x84]
mov dword [ebp - 0x108], eax
xor eax, eax
inc eax
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x90], eax
lea eax, [ecx - 1]
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0xf0], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0xe0], eax
add eax, esi
mov dword [ebp - 0xac], edx
mov dword [ebp - 0x11c], edx
mov edx, dword [ebp - 0xc8]
mov dword [ebp - 0xec], eax
cmp edx, 0xd
jg 0x40eb22
je 0x40eb17
mov eax, edx
sub eax, 3
je 0x40ea70
sub eax, 1
je 0x40ea48
dec eax
sub eax, 1
je 0x40ea3d
dec eax
sub eax, 1
je 0x40eb9c
sub eax, 1
je 0x40ea53
sub eax, 3
jne 0x40eaa4
inc eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x110], eax
mov eax, ecx
mov dword [ebp - 0xe0], eax
inc eax
add eax, esi
mov dword [ebp - 0xec], eax
xor ecx, ecx
inc ecx
mov dword [ebp - 0xe4], ecx
jmp 0x40eaa7
xor ecx, ecx
inc ecx
mov dword [ebp - 0xe4], ecx
jmp 0x40ea56
xor ecx, ecx
inc ecx
push 2
pop eax
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x90], eax
jmp 0x40eb8b
push 2
pop eax
cmp edi, eax
jg 0x40ea87
mov eax, dword [ebp - 0x110]
cmp edi, 1
cmovg eax, dword [ebp - 0xb4]
mov dword [ebp - 0x110], eax
mov eax, ecx
lea ecx, [eax + esi*2]
add ecx, dword [ebp - 0x110]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xec], ecx
xor ecx, ecx
inc ecx
cmp dword [ebx + 0x2c], 0xffffffff
jne 0x40ebf0
cmp edi, ecx
jne 0x40ebf0
mov eax, dword [ebx + 0x34]
mov esi, ecx
sub eax, 6
je 0x40ebcb
sub eax, 0xa
je 0x40ebcb
sub eax, 7
je 0x40eae4
dec eax
sub eax, 1
je 0x40eae4
sub eax, 4
jne 0x40ebf6
mov eax, dword [ebx + 0x8c]
dec eax
push eax
push ebx
call fcn.0041e296
mov edi, eax
push edi
push ebx
mov dword [ebp - 0x88], edi
call fcn.0041e380
mov edx, dword [ebp - 0xc8]
cmp eax, 0xffffffff
je 0x40ebf6
xor esi, esi
jmp 0x40ebf6
xor ecx, ecx
inc ecx
mov dword [ebp - 0xe4], ecx
jmp 0x40eb85
mov eax, edx
sub eax, 0xe
je 0x40ebae
sub eax, 1
je 0x40eb9c
sub eax, 3
je 0x40eb82
sub eax, 1
je 0x40eb5e
sub eax, 3
jne 0x40eaa4
inc eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x110], eax
mov eax, ecx
lea ecx, [esi + 1]
add ecx, eax
jmp 0x40ea98
xor ecx, ecx
inc ecx
and dword [ebp - 0x108], 0
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0xac], ecx
jmp 0x40eb8b
xor ecx, ecx
inc ecx
mov dword [ebp - 0x11c], ecx
mov eax, dword [ebx + 0x88]
mov dword [ebp - 0x100], eax
jmp 0x40eaa7
and dword [ebp - 0x114], 0
lea eax, [edi + edi]
lea ecx, [eax + esi]
jmp 0x40ea98
xor ecx, ecx
inc ecx
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0xac], ecx
jmp 0x40eb8b
push 0
push ebx
call fcn.0041e296
push eax
push ebx
mov dword [ebp - 0x88], eax
call fcn.0041e380
mov edx, dword [ebp - 0xc8]
xor ecx, ecx
cmp eax, 0xffffffff
cmovne esi, ecx
jmp 0x40ebf6
mov esi, dword [ebp - 0xa8]
cmp dword [ebx + 0x9c], 0
je 0x40ec03
test esi, esi
je 0x40ec17
xor esi, esi
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0x90], esi
mov esi, dword [ebp - 0xf4]
test esi, esi
je 0x40ec42
mov ecx, dword [ebp - 0xa0]
xor eax, eax
test ecx, ecx
jle 0x40ec4f
sub esi, dword [ebp + eax*4 - 0x10]
mov dword [ebp - 0xf4], esi
test esi, esi
jle 0x40ec49
inc eax
cmp eax, ecx
jl 0x40ec2d
jmp 0x40ec4f
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xf4], eax
push 0xc
xor eax, eax
lea edi, [ebp - 0x40]
pop ecx
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0xf0]
test edi, edi
je 0x40ec80
cmp edx, 0x13
sete al
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
call fcn.004112cd
and dword [ebp - 0x9c], 0
xor esi, esi
mov eax, dword [ebp - 0x8c]
test edi, edi
cmovne esi, dword [ebp - 0x5c]
xor edi, edi
xor edx, edx
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0xd4], edi
mov dword [ebp - 0x98], edx
test eax, eax
jle 0x40f201
and dword [ebp - 0xd8], edx
and dword [ebp - 0xa8], 0
xor ecx, ecx
xor esi, esi
mov dword [ebp - 0xf8], ecx
mov eax, 0x7fff
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xa0], ecx
jle 0x40f028
test esi, esi
je 0x40ecf5
add ecx, dword [ebp + esi*4 - 0x14]
mov dword [ebp - 0xf8], ecx
mov eax, dword [ebp + esi*4 - 0x10]
mov dword [ebp - 0xb4], eax
lea edi, [eax + ecx]
mov eax, dword [ebp - 0x9c]
add eax, ecx
cmp eax, dword [ebp - 0x84]
jge 0x40f01c
mov ecx, dword [ebp - 0x8c]
dec ecx
cmp edx, ecx
jl 0x40edd3
cmp dword [ebp - 0xfc], 0
jne 0x40edd3
mov edi, dword [ebp - 0x9c]
test esi, esi
jne 0x40ee63
push dword [ebp + 0x20]
push dword [ebp - 0x120]
push dword [ebp + 0x14]
push dword [ebp - 0xe8]
push dword [ebp - 0x84]
push edi
push dword [ebp - 0x12c]
push dword [ebp + 0xc]
push dword [ebp - 0x128]
call fcn.00413a77
mov dword [ebp - 0x118], eax
test eax, eax
je 0x40ee63
mov ebx, dword [ebp - 0x118]
mov esi, dword [ebp - 0x94]
mov edi, dword [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp - 0xfc], 0
je 0x40edbe
test ebx, ebx
jne 0x40edbe
cmp esi, 0xffffffff
je 0x40edbe
push dword [ebp + 0x20]
push dword [ebp + 0x14]
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x128]
call fcn.00411413
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00475d95
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x84]
lea esi, [edi + ecx]
cmp esi, edx
jg 0x40ee2a
push dword [ebp + 0x20]
push dword [ebp - 0x120]
push dword [ebp + 0x14]
push dword [ebp - 0xe8]
push esi
push eax
push dword [ebp - 0x12c]
push dword [ebp + 0xc]
push dword [ebp - 0x128]
call fcn.00413a77
mov ecx, eax
mov dword [ebp - 0x118], ecx
test ecx, ecx
jne 0x40ed7b
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x84]
cmp dword [ebp - 0xc8], 8
jne 0x40ee5d
cmp esi, edx
jge 0x40ee5d
xor eax, eax
inc eax
push eax
lea eax, [edi + ecx]
mov ecx, dword [ebp - 0xcc]
add eax, dword [ebp - 0x90]
add ecx, 0xfffffffc
imul eax, eax, 0x14
push 0x4000
add eax, ecx
push eax
call fcn.0046bad9
mov edi, dword [ebp - 0x9c]
xor esi, esi
mov dword [ebp - 0x104], esi
cmp dword [ebp - 0xb4], esi
jle 0x40efa4
mov eax, dword [ebp - 0xf8]
add eax, edi
add eax, esi
cmp eax, dword [ebp - 0x84]
jge 0x40efa4
push eax
push ebx
call fcn.0041e296
mov ecx, eax
mov dword [ebp - 0x88], ecx
lea edi, [ecx + 0x30]
test esi, esi
jne 0x40eeb1
mov eax, dword [edi]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], ecx
cmp dword [ebp - 0x11c], 0
je 0x40eebf
mov eax, dword [ecx + 0x68]
jmp 0x40ef1b
mov edx, dword [edi + 0xc]
sub edx, dword [edi + 4]
mov eax, dword [ecx + 0xf0]
test eax, eax
mov esi, dword [ecx + 0xe8]
cmovne edx, eax
test esi, esi
je 0x40eedc
sub edx, esi
test dword [ecx + 0x2c], 0x2000
jne 0x40eef9
mov eax, dword [ebp - 0x88]
mov ecx, dword [ecx + 0x84]
sub ecx, dword [eax + 0x8c]
add edx, ecx
mov eax, edx
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0xdc]
sar ecx, 1
add ecx, esi
mov esi, dword [ebp - 0x104]
cmp ecx, eax
mov dword [ebp - 0x94], ecx
cmovl eax, ecx
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0xdc], eax
test ecx, ecx
jne 0x40ef3a
mov eax, dword [edi + 8]
cmp eax, dword [ebp + esi*4 - 0x3c]
jle 0x40ef77
mov dword [ebp + esi*4 - 0x3c], eax
jmp 0x40ef77
xor eax, eax
inc eax
cmp esi, eax
jne 0x40ef77
cmp dword [ebp - 0xa0], 3
jge 0x40ef62
mov eax, ecx
mov ecx, dword [edi]
sub ecx, dword [ebp - 0xbc]
add eax, eax
cmp ecx, dword [ebp + eax*8 - 0x38]
jle 0x40ef77
mov dword [ebp + eax*8 - 0x38], ecx
jmp 0x40ef77
mov eax, dword [edi + 8]
add ecx, ecx
sub eax, dword [ebp - 0xbc]
cmp eax, dword [ebp + ecx*8 - 0x38]
jle 0x40ef77
mov dword [ebp + ecx*8 - 0x38], eax
mov eax, dword [ebp - 0xe8]
test eax, eax
jle 0x40ef8b
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_OffsetRect]
mov edi, dword [ebp - 0x9c]
inc esi
mov dword [ebp - 0x104], esi
cmp esi, dword [ebp - 0xb4]
jl 0x40ee77
mov ecx, dword [ebp - 0x8c]
mov esi, dword [ebp - 0xd0]
dec ecx
cmp dword [ebp - 0x98], ecx
jl 0x40efc6
cmp dword [ebp - 0xfc], 0
jne 0x40efc6
test esi, esi
jne 0x40efd2
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebx + 0x24]
mov dword [ecx + 0x14], eax
mov eax, dword [ebx + 0x28]
sub eax, dword [ebx + 0x20]
mov ecx, dword [ebp - 0xa8]
cmp ecx, eax
push dword [ebx + 0x94]
cmovl ecx, eax
mov eax, dword [ebx + 0xa4]
add eax, ebx
mov dword [ebp - 0xa8], ecx
push eax
call fcn.0041d5da
mov edx, dword [ebp - 0x98]
inc esi
mov ecx, dword [ebp - 0xf8]
mov dword [ebp - 0xd0], esi
cmp esi, dword [ebp - 0xa0]
jl 0x40ece7
mov eax, dword [ebp - 0xdc]
mov edi, dword [ebp - 0xd4]
cmp dword [ebp - 0xf0], 0
jne 0x40f0e0
cmp dword [ebp - 0x114], 0
je 0x40f150
mov ecx, dword [ebp - 0x10c]
test edx, edx
jne 0x40f069
cmp dword [ebp - 0xa0], 3
jge 0x40f069
test ecx, ecx
jne 0x40f069
mov esi, dword [ebp - 0xe8]
add esi, eax
xor eax, eax
push eax
push eax
push eax
push eax
jmp 0x40f0c9
cmp dword [ebp - 0xc8], 3
je 0x40f076
test ecx, ecx
je 0x40f082
test edi, edi
jne 0x40f082
mov edi, dword [ebx + 0x84]
neg edi
mov esi, dword [ebp - 0xe8]
push 0x2000
add esi, eax
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ebp - 0xe0]
push esi
push edi
add eax, edx
push eax
push ebx
call fcn.0041ce72
cmp dword [ebp - 0xa0], 2
jle 0x40f0d2
xor eax, eax
xor ecx, ecx
push eax
inc ecx
push ecx
push eax
push eax
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0xe0]
add eax, dword [ebp - 0x8c]
push esi
push edi
push eax
push ebx
call fcn.0041ce72
mov edx, dword [ebp - 0x98]
mov edi, esi
mov dword [ebp - 0xd4], edi
mov esi, dword [ebp - 0xe8]
add esi, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
add dword [ebp - 0x9c], ecx
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0xe8], esi
cmp edx, eax
jge 0x40f12a
add esi, dword [ebp - 0x100]
cmp dword [ebp - 0x114], 0
mov dword [ebp - 0xe8], esi
jne 0x40f12a
add esi, dword [ebx + 0x84]
mov dword [ebp - 0xe8], esi
cmp esi, 0x870
ja 0x40f1ee
mov eax, dword [ebp - 0x8c]
inc edx
mov dword [ebp - 0x98], edx
cmp edx, eax
jl 0x40ecb9
jmp 0x40f207
mov esi, dword [ebp - 0xe8]
test edx, edx
jle 0x40f1b8
mov ecx, dword [ebx + 0x84]
xor eax, eax
push 0x2000
push eax
push eax
push eax
mov eax, esi
sub eax, ecx
push eax
mov eax, edi
sub eax, ecx
push eax
mov eax, dword [ebp - 0xe0]
add eax, edx
push eax
push ebx
call fcn.0041ce72
cmp dword [ebp - 0xa0], 2
jle 0x40f1db
mov ecx, dword [ebx + 0x84]
xor eax, eax
push eax
xor edx, edx
sub edi, ecx
inc edx
push edx
push eax
push eax
mov eax, esi
sub eax, ecx
push eax
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0xe0]
add eax, dword [ebp - 0x8c]
push edi
push eax
jmp 0x40f1d5
push 0x2001
xor ecx, ecx
mov eax, esi
sub eax, dword [ebx + 0x84]
push ecx
push ecx
push ecx
push eax
mov eax, dword [ebp - 0x108]
neg eax
push eax
push ecx
push ebx
call fcn.0041ce72
mov edx, dword [ebp - 0x98]
mov edi, esi
mov dword [ebp - 0xd4], edi
jmp 0x40f0e6
mov ecx, dword [ebp - 0x120]
mov eax, dword [ebx + 0x38]
push 0x67
pop ebx
mov dword [ecx], eax
jmp 0x40ed81
mov ecx, dword [ebp - 0xa4]
xor edx, edx
inc edx
cmp eax, edx
jg 0x40f334
cmp dword [ebp - 0xfc], 0
jne 0x40f334
cmp dword [ebp - 0x114], 0
jne 0x40f28d
push 0
push ebx
call fcn.0041e296
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.0041167d
test byte [esi + 0xf4], 4
je 0x40f31a
push esi
push ebx
call fcn.0041e380
cmp eax, 0xffffffff
je 0x40f31a
mov eax, dword [esi + 0x30]
add eax, dword [esi + 0x60]
push 2
push 0
push eax
push eax
mov eax, dword [esi + 0xf0]
sub eax, dword [ebp - 0x44]
mov ecx, dword [esi + 0x34]
add eax, ecx
sub ecx, dword [ebx + 0x84]
push eax
push ecx
push dword [ebp - 0x90]
push ebx
call fcn.0041ce72
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xc0]
xor esi, esi
inc esi
cmp ecx, esi
jle 0x40f7b5
xor esi, esi
mov dword [ebp - 0x9c], esi
test eax, eax
jle 0x40f7b2
mov ecx, dword [ebp - 0x84]
mov eax, edx
imul eax, esi
mov dword [ebp - 0x98], eax
lea esi, [eax + 1]
cmp esi, ecx
jge 0x40f791
push eax
push ebx
call fcn.0041e296
push esi
mov edi, eax
push ebx
mov dword [ebp - 0xa8], edi
call fcn.0041e296
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0xb0], esi
call fcn.0041167d
mov ecx, dword [ebp - 0x8c]
xor eax, eax
inc eax
cmp ecx, eax
jle 0x40f4ff
mov eax, dword [ebp - 0x38]
sub eax, dword [esi + 0x38]
jmp 0x40f501
mov eax, dword [esi + 0x30]
add eax, dword [esi + 0x64]
push 2
push 0
push eax
push eax
mov eax, dword [esi + 0xe8]
add eax, dword [ebp - 0x4c]
jmp 0x40f26e
and dword [ebp - 0xa8], 0
test eax, eax
jle 0x40f28d
xor edi, edi
mov eax, ecx
neg eax
mov dword [ebp - 0xf8], edi
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xbc], eax
push edi
push ebx
call fcn.0041e296
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.0041167d
cmp dword [ebp - 0xe4], 0
lea eax, [esi + 0x30]
jne 0x40f395
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [eax + 8]
cmp dword [ebp - 0xac], 0
mov dword [ebp - 0x94], ecx
je 0x40f39d
xor ecx, ecx
mov dword [ebp - 0x94], ecx
test ecx, ecx
je 0x40f455
sub dword [esi + 0x18], ecx
add dword [esi + 0x14], ecx
push 0
push ecx
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0xc0]
dec eax
cmp dword [ebp - 0xa8], eax
cmove edx, dword [ebp - 0xbc]
xor eax, eax
inc eax
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0xb8], eax
mov ecx, eax
cmp edx, eax
jle 0x40f455
lea eax, [edi + ecx]
push eax
push ebx
call fcn.0041e296
push 0
push dword [ebp - 0x94]
mov dword [ebp - 0x88], eax
lea edi, [eax + 0x30]
push edi
call dword [sym.imp.USER32.dll_OffsetRect]
mov ecx, dword [ebp - 0xb8]
xor eax, eax
inc eax
cmp ecx, eax
jne 0x40f41e
mov eax, dword [ebp - 0x38]
sub eax, dword [edi + 8]
jns 0x40f41e
sub dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 0x14]
sub eax, dword [edi + 8]
add eax, dword [edi]
test eax, eax
jle 0x40f435
add eax, dword [edi + 8]
jmp 0x40f438
mov eax, dword [edi + 8]
cmp eax, dword [esi + 0x14]
jle 0x40f440
mov dword [esi + 0x14], eax
mov edi, dword [ebp - 0xf8]
inc ecx
mov dword [ebp - 0xb8], ecx
cmp ecx, dword [ebp - 0xb4]
jl 0x40f3e4
cmp dword [ebp - 0x114], 0
jne 0x40f4bb
test byte [esi + 0xf4], 4
je 0x40f48a
push esi
push ebx
call fcn.0041e380
cmp eax, 0xffffffff
je 0x40f48a
mov eax, dword [esi + 0x30]
add eax, dword [esi + 0x60]
push 2
push 0
push eax
push eax
mov eax, dword [esi + 0xf0]
sub eax, dword [ebp - 0x44]
jmp 0x40f49f
mov eax, dword [esi + 0x30]
add eax, dword [esi + 0x64]
push 2
push 0
push eax
push eax
mov eax, dword [esi + 0xe8]
add eax, dword [ebp - 0x4c]
mov ecx, dword [esi + 0x34]
add eax, ecx
sub ecx, dword [ebx + 0x84]
push eax
mov eax, dword [ebp - 0x90]
push ecx
add eax, edi
push eax
push ebx
call fcn.0041ce72
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xbc]
inc eax
mov edx, dword [ebp - 0xa4]
add edi, edx
add ecx, dword [ebp - 0x104]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xf8], edi
mov dword [ebp - 0xbc], ecx
cmp eax, dword [ebp - 0x8c]
jl 0x40f361
mov eax, dword [ebp - 0x8c]
jmp 0x40f293
xor eax, eax
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0x94], eax
test eax, eax
jle 0x40f5ad
lea eax, [ecx - 1]
mov ecx, dword [ebp - 0x98]
cmp edx, eax
jne 0x40f52c
mov edi, dword [ebp - 0x84]
sub edi, ecx
jmp 0x40f532
mov edi, dword [ebp - 0xc0]
xor esi, esi
inc esi
mov dword [ebp - 0xb8], esi
mov eax, esi
cmp edi, esi
jle 0x40f5a7
add eax, ecx
push eax
push ebx
call fcn.0041e296
push 0
push dword [ebp - 0x94]
mov dword [ebp - 0x88], eax
lea esi, [eax + 0x30]
push esi
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 0x14]
sub eax, dword [esi + 8]
add eax, dword [esi]
test eax, eax
jle 0x40f579
add eax, dword [esi + 8]
jmp 0x40f57c
mov eax, dword [esi + 8]
mov ecx, dword [ebp - 0xa8]
cmp eax, dword [ecx + 0x14]
jle 0x40f58a
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0xb8], eax
cmp eax, edi
jl 0x40f541
mov edx, dword [ebp - 0x9c]
mov edi, dword [ebp - 0xa8]
cmp dword [ebp - 0xf0], 0
jne 0x40f785
cmp dword [ebp - 0x114], 0
je 0x40f66b
test edx, edx
jne 0x40f5dc
cmp dword [ebp - 0xa0], 3
jge 0x40f5dc
cmp dword [ebp - 0x10c], edx
je 0x40f5e5
cmp dword [ebp - 0xec], 0
jne 0x40f5f0
mov eax, dword [ebp - 0xcc]
mov esi, dword [eax + 8]
jmp 0x40f605
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xcc]
add eax, edx
imul eax, eax, 0x14
mov esi, dword [eax + ecx + 8]
mov eax, dword [ebp - 0xb0]
test byte [eax + 0xf4], 4
je 0x40f660
push eax
push ebx
call fcn.0041e380
cmp eax, 0xffffffff
je 0x40f65a
mov ecx, dword [ebp - 0xb0]
xor eax, eax
inc eax
push 0
push eax
test dword [ecx + 0xf4], 0x100
je 0x40f651
push dword [ecx + 0x38]
push dword [edi + 0x38]
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0x90]
push esi
push esi
jmp 0x40f77e
mov eax, dword [ecx + 0x60]
add eax, dword [ecx + 0x30]
push eax
jmp 0x40f63b
mov eax, dword [ebp - 0xb0]
xor ecx, ecx
push 0
inc ecx
push ecx
push dword [eax + 0x30]
jmp 0x40f63b
mov esi, dword [ebp - 0xb0]
test byte [esi + 0xf4], 4
je 0x40f6a2
push esi
push ebx
call fcn.0041e380
cmp eax, 0xffffffff
je 0x40f6a2
mov eax, dword [esi + 0x30]
add eax, dword [esi + 0x60]
mov ecx, dword [esi + 0x34]
push 2
push 0
push eax
push eax
mov eax, dword [esi + 0xf0]
sub eax, dword [ebp - 0x44]
add eax, ecx
jmp 0x40f6bc
mov eax, dword [esi + 0x30]
add eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x34]
push 2
push 0
push eax
push eax
mov eax, dword [esi + 0xe8]
add eax, ecx
add eax, dword [ebp - 0x4c]
sub ecx, dword [ebx + 0x84]
push eax
mov eax, dword [ebp - 0x98]
inc eax
add eax, dword [ebp - 0x90]
push ecx
push eax
push ebx
call fcn.0041ce72
test byte [edi + 0xf4], 4
je 0x40f6f2
push edi
push ebx
call fcn.0041e380
cmp eax, 0xffffffff
je 0x40f6f2
mov esi, dword [edi + 0x60]
jmp 0x40f6f5
mov esi, dword [edi + 0x64]
mov eax, dword [ebp - 0xb0]
test byte [eax + 0xf4], 4
je 0x40f739
push eax
push ebx
call fcn.0041e380
cmp eax, 0xffffffff
je 0x40f739
mov edx, dword [edi + 0x34]
xor ecx, ecx
sub edx, dword [ebx + 0x84]
mov eax, dword [ebp - 0x8c]
dec eax
cmp dword [ebp - 0x9c], eax
push 0
sete cl
push ecx
mov ecx, dword [ebp - 0xb0]
mov eax, dword [ecx + 0x60]
jmp 0x40f760
mov edx, dword [edi + 0x34]
xor ecx, ecx
sub edx, dword [ebx + 0x84]
mov eax, dword [ebp - 0x8c]
dec eax
cmp dword [ebp - 0x9c], eax
push 0
sete cl
push ecx
mov ecx, dword [ebp - 0xb0]
mov eax, dword [ecx + 0x64]
add eax, dword [ecx + 0x30]
push eax
mov eax, dword [edi + 0x30]
add eax, esi
push eax
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x84]
push edx
push edx
push eax
push ebx
call fcn.0041ce72
mov edx, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x84]
mov esi, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x8c]
inc esi
mov dword [ebp - 0x9c], esi
cmp esi, eax
jl 0x40f2ba
mov ecx, dword [ebp - 0xc0]
xor esi, esi
inc esi
mov edi, dword [ebp - 0xa0]
cmp edi, esi
jle 0x40f98c
cmp dword [ebp - 0xc], esi
jle 0x40f98c
cmp eax, esi
jle 0x40f98c
xor esi, esi
mov dword [ebp - 0xd4], esi
test eax, eax
jle 0x40f98c
and dword [ebp - 0xa8], esi
mov eax, edx
neg eax
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x84]
mov edi, eax
sub edi, ecx
mov dword [ebp - 0x104], edi
jmp 0x40f80c
mov eax, dword [ebp - 0x84]
cmp ecx, eax
jge 0x40f980
push ecx
push ebx
call fcn.0041e296
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x8c]
dec eax
cmp esi, eax
jge 0x40f849
push dword [ebp - 0xc0]
push ebx
call fcn.0041e296
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xb4], eax
jmp 0x40f863
push dword [ebp - 0xa8]
push ebx
call fcn.0041e296
mov dword [ebp - 0xb8], eax
mov eax, edi
mov dword [ebp - 0xb4], edi
xor ecx, ecx
inc ecx
mov edi, ecx
cmp eax, ecx
jle 0x40f93d
mov eax, dword [ebp - 0xc0]
add eax, edi
cmp eax, dword [ebp - 0x84]
jge 0x40f937
push eax
push ebx
call fcn.0041e296
mov dword [ebp - 0x88], eax
lea esi, [eax + 0x30]
xor eax, eax
inc eax
cmp edi, eax
jne 0x40f8ee
mov eax, dword [ebp - 0x8c]
dec eax
cmp dword [ebp - 0xa0], 3
jge 0x40f8ca
cmp dword [ebp - 0xd4], eax
jge 0x40f8ba
mov eax, dword [ebp - 0x28]
sub eax, dword [esi]
jmp 0x40f8d8
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax + 0x30]
sub eax, dword [esi]
add eax, dword [ebp - 0x28]
jmp 0x40f8d8
cmp dword [ebp - 0xd4], eax
jge 0x40f8e0
mov eax, dword [ebp - 0x28]
sub eax, dword [esi + 8]
mov dword [ebp - 0x94], eax
jmp 0x40f8f4
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax + 0x30]
sub eax, dword [esi + 8]
jmp 0x40f8c5
mov eax, dword [ebp - 0x94]
test eax, eax
jle 0x40f92a
push 0
push eax
push esi
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 0x14]
sub eax, dword [esi + 8]
add eax, dword [esi]
test eax, eax
jle 0x40f919
add eax, dword [esi + 8]
jmp 0x40f91c
mov eax, dword [esi + 8]
mov ecx, dword [ebp - 0xb8]
cmp eax, dword [ecx + 0x14]
jle 0x40f92a
mov dword [ecx + 0x14], eax
inc edi
cmp edi, dword [ebp - 0xb4]
jl 0x40f870
mov esi, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xc0]
inc esi
mov edi, dword [ebp - 0x104]
mov edx, dword [ebp - 0xa4]
add ecx, edx
add edi, dword [ebp - 0x11c]
add dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0x104], edi
cmp esi, eax
jl 0x40f806
jmp 0x40f986
mov eax, dword [ebp - 0x8c]
mov edi, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x34]
xor esi, esi
xor edx, edx
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0x9c], ecx
test edi, edi
jle 0x40fde1
dec eax
lea edi, [ebp - 0x40]
imul eax, dword [ebp - 0xa4]
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0xa0]
cmp eax, 1
jne 0x40fa05
cmp dword [ebp - 0xe4], 0
je 0x40f9e0
mov eax, dword [ebx + 0x7c]
mov dword [ebp - 0x40], eax
jmp 0x40fa05
cmp ecx, dword [ebp - 0x3c]
cmovl ecx, dword [ebp - 0x3c]
cmp dword [ebp - 0xac], 0
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x34], ecx
jne 0x40fa05
add ecx, dword [ebx + 0x7c]
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0xfc], 0
mov ecx, dword [ebp + edx*4 - 0x10]
mov dword [ebp - 0x104], ecx
je 0x40fa29
cmp dword [ebp - 0xf0], 0
jne 0x40fa29
mov eax, dword [ebp - 0x8c]
jmp 0x40fa36
mov eax, dword [ebp - 0x8c]
mov edi, dword [ebp - 0x98]
dec eax
and dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], eax
test eax, eax
jle 0x40fbbf
mov eax, esi
mov dword [ebp - 0xa8], esi
cmp eax, dword [ebp - 0x84]
jge 0x40fbaa
push eax
push ebx
call fcn.0041e296
xor ecx, ecx
mov esi, eax
inc ecx
cmp dword [ebp - 0xa0], ecx
jne 0x40fb17
cmp dword [ebp - 0xe4], 0
je 0x40fabc
mov ecx, dword [ebx + 0x7c]
add dword [esi + 0x18], ecx
mov ecx, dword [esi + 0x18]
mov eax, dword [ebx + 0xa8]
test eax, eax
jns 0x40fa96
add eax, 1
sar eax, 1
add ecx, eax
mov dword [esi + 0x18], ecx
cmp dword [ebx + 0xb0], 0
je 0x40faff
mov eax, dword [ebx + 0xbc]
test eax, eax
jns 0x40faff
cdq
xor eax, edx
sub eax, edx
add eax, ecx
mov dword [esi + 0x18], eax
jmp 0x40faff
cmp dword [ebp - 0xac], 0
jne 0x40fb02
mov eax, dword [ebx + 0x7c]
add dword [esi + 0x14], eax
mov ecx, dword [esi + 0x14]
mov eax, dword [ebx + 0xa8]
test eax, eax
jns 0x40fadb
add eax, 1
sar eax, 1
add ecx, eax
mov dword [esi + 0x14], ecx
cmp dword [ebx + 0xb0], 0
je 0x40faff
mov eax, dword [ebx + 0xbc]
test eax, eax
jle 0x40faff
cdq
xor eax, edx
sub eax, edx
add eax, ecx
mov dword [esi + 0x14], eax
xor ecx, ecx
inc ecx
cmp dword [ebp - 0xf0], 0
je 0x40fb17
mov eax, dword [ebp - 0x58]
add dword [esi + 0x14], eax
mov eax, dword [ebp - 0x60]
add dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
cmp eax, dword [edi + 0xc]
jle 0x40fb22
mov dword [edi + 0xc], eax
mov edx, dword [ebp - 0xd0]
test edx, edx
jle 0x40fb36
cmp dword [esi + 0x18], 0
jge 0x40fb36
and dword [esi + 0x18], 0
mov edi, ecx
cmp dword [ebp + edx*4 - 0x10], ecx
jle 0x40fb70
mov eax, dword [ebp - 0xa8]
add eax, edi
push eax
push ebx
call fcn.0041e296
mov ecx, eax
mov dword [ebp - 0x88], ecx
mov eax, dword [ecx + 0x18]
sub eax, dword [ecx + 0x30]
cmp eax, dword [esi + 0x18]
jle 0x40fb63
mov dword [esi + 0x18], eax
mov edx, dword [ebp - 0xd0]
inc edi
cmp edi, dword [ebp + edx*4 - 0x10]
jl 0x40fb3e
mov edi, dword [ebp - 0x98]
mov eax, dword [esi + 0x18]
cmp eax, dword [edi]
jle 0x40fb7f
mov dword [edi], eax
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xa8]
inc ecx
add eax, dword [ebp - 0xa4]
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xa8], eax
cmp ecx, dword [ebp - 0xb4]
jl 0x40fa53
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x104]
mov esi, dword [ebp - 0xf8]
mov dword [ebp - 0x9c], eax
mov edi, dword [ebp - 0x11c]
add edi, esi
add esi, ecx
mov dword [ebp - 0xf8], esi
cmp edi, dword [ebp - 0x84]
jge 0x40fd9f
push edi
push ebx
call fcn.0041e296
mov esi, eax
xor eax, eax
inc eax
cmp dword [ebp - 0xa0], eax
jne 0x40fd00
cmp dword [ebp - 0xe4], 0
je 0x40fc77
mov ecx, dword [ebx + 0x7c]
add dword [esi + 0x18], ecx
mov ecx, dword [esi + 0x18]
mov eax, dword [ebx + 0xa8]
test eax, eax
jns 0x40fc12
add eax, 1
sar eax, 1
add ecx, eax
mov dword [esi + 0x18], ecx
mov eax, dword [ebx + 0xa8]
cdq
sub eax, edx
mov edx, dword [ebp - 0x40]
sar eax, 1
sub edx, eax
cmp dword [ebx + 0xb0], 0
mov dword [ebp - 0xc4], edx
je 0x40fc5d
mov eax, dword [ebx + 0xbc]
test eax, eax
jns 0x40fc5d
cdq
xor eax, edx
sub eax, edx
add eax, ecx
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 0xbc]
cdq
xor eax, edx
sub eax, edx
sub dword [ebp - 0xc4], eax
mov eax, dword [ebx + 0xa8]
mov ecx, dword [ebx + 0x7c]
cdq
sub eax, edx
mov edx, dword [ebp - 0xc4]
sar eax, 1
sub ecx, eax
cmp edx, ecx
jmp 0x40fce0
cmp dword [ebp - 0xac], 0
jne 0x40fceb
mov eax, dword [ebx + 0x7c]
add dword [esi + 0x14], eax
mov eax, dword [ebx + 0xa8]
mov ecx, dword [esi + 0x14]
cdq
sub eax, edx
mov edx, dword [ebp - 0x9c]
sar eax, 1
add ecx, eax
sub edx, eax
mov dword [esi + 0x14], ecx
cmp dword [ebx + 0xb0], 0
mov dword [ebp - 0xc4], edx
je 0x40fcdd
mov eax, dword [ebx + 0xbc]
test eax, eax
jle 0x40fcdd
cdq
xor eax, edx
sub eax, edx
add eax, ecx
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0xbc]
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp - 0xc4]
sub edx, eax
mov dword [ebp - 0xc4], edx
cmp edx, dword [ebx + 0x7c]
jge 0x40fceb
add edx, dword [ebx + 0x7c]
mov dword [ebp - 0xc4], edx
cmp dword [ebp - 0xf0], 0
je 0x40fd00
mov eax, dword [ebp - 0x58]
add dword [esi + 0x14], eax
mov eax, dword [ebp - 0x60]
add dword [esi + 0x18], eax
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x84]
dec eax
add eax, edi
cmp eax, ecx
jl 0x40fd16
lea eax, [ecx - 1]
push eax
push ebx
call fcn.0041e296
mov ecx, eax
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0x88], ecx
mov edx, dword [ecx + 0x38]
cmp dword [ebp - 0xd0], eax
jl 0x40fd47
mov eax, dword [ecx + 0x14]
sub eax, edx
add eax, dword [ecx + 0x30]
test eax, eax
jle 0x40fd47
add eax, edx
jmp 0x40fd49
mov eax, edx
mov edi, dword [ebp - 0x98]
mov ecx, dword [esi + 0x30]
sub eax, ecx
cmp eax, dword [edi + 0xc]
jle 0x40fd65
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0xd0], 0
jle 0x40fd8d
sub ecx, dword [esi + 0x18]
mov eax, dword [ebx + 0x7c]
sub ecx, dword [ebp - 0xd8]
add eax, eax
sub ecx, eax
cmp ecx, dword [edi]
jle 0x40fd8d
mov dword [edi], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x9c], eax
mov esi, dword [ebp - 0xf8]
mov dword [ebp - 0xd8], edx
mov edx, dword [ebp - 0xd0]
mov edi, dword [ebp - 0x98]
test edx, edx
jle 0x40fdbb
mov eax, dword [ebx + 0x7c]
add eax, eax
add dword [edi], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x9c], ecx
jmp 0x40fdc1
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
inc edx
add edi, 0x10
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0x98], edi
cmp edx, eax
jl 0x40f9ca
mov edi, eax
cmp dword [ebp - 0xf0], 0
je 0x40fe12
mov eax, dword [ebp - 0x54]
add dword [ebp - 0xe8], eax
mov eax, dword [ebx + 0xa8]
cdq
sub eax, edx
sar eax, 1
cmp dword [ebp - 0xe4], 0
je 0x40fe0a
mov ecx, dword [ebp - 0x40]
sub ecx, eax
mov dword [ebp - 0xc4], ecx
xor eax, eax
inc eax
cmp edi, eax
jle 0x4100a1
xor edi, edi
mov dword [ebp - 0x98], edi
cmp dword [ebp - 0x8c], edi
jle 0x4100a1
mov esi, dword [ebp - 0xa4]
and dword [ebp - 0xd0], 0
imul esi, edi
push esi
push ebx
call fcn.0041e296
mov dword [ebp - 0xb8], eax
xor eax, eax
inc eax
mov ecx, eax
mov dword [ebp - 0xc0], ecx
cmp dword [ebp - 0xa0], eax
jle 0x41008e
lea eax, [ebp - 0x30]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xe0]
add eax, edi
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x84]
cmp esi, eax
jge 0x41008e
mov eax, dword [ebp + ecx*4 - 0x14]
add esi, eax
mov edx, dword [ebp - 0xbc]
lea eax, [eax + ecx*4]
mov eax, dword [ebp + eax*4 - 0x50]
add eax, dword [ebp - 0xd0]
mov edx, dword [edx]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax - 4]
add eax, dword [ebp - 0xd0]
add edx, eax
add eax, dword [ebx + 0x7c]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xd0], edx
cmp esi, eax
jge 0x41004d
mov eax, dword [ebp - 0x8c]
mov edi, dword [ebp + ecx*4 - 0x10]
dec eax
mov ecx, edx
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0x94], ecx
cmp dword [ebp - 0x98], eax
jne 0x40ff5b
mov edi, dword [ebp - 0x84]
push esi
sub edi, esi
push ebx
mov dword [ebp - 0xb4], edi
call fcn.0041e296
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0x88], eax
sub ecx, dword [eax + 0x30]
mov dword [ebp - 0x94], ecx
test esi, esi
jle 0x40ff5b
lea eax, [esi - 1]
push eax
push ebx
call fcn.0041e296
mov ecx, dword [ebx + 0x7c]
mov dword [ebp - 0xb0], eax
mov eax, dword [eax + 0x38]
lea eax, [eax + ecx*2]
mov ecx, dword [ebp - 0x88]
sub eax, dword [ecx + 0x30]
mov ecx, dword [ebp - 0x94]
cmp eax, ecx
cmovg ecx, eax
mov dword [ebp - 0x94], ecx
test ecx, ecx
jle 0x40ffdd
xor ecx, ecx
mov dword [ebp - 0xd4], ecx
test edi, edi
jle 0x40ffdd
lea eax, [esi + ecx]
push eax
push ebx
call fcn.0041e296
push 0
push dword [ebp - 0x94]
mov dword [ebp - 0x88], eax
lea edi, [eax + 0x30]
push edi
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [ebp - 0x8c]
dec eax
cmp dword [ebp - 0x98], eax
jne 0x410029
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 0x14]
sub eax, dword [edi + 8]
add eax, dword [edi]
test eax, eax
jle 0x40ffb7
add eax, dword [edi + 8]
jmp 0x40ffba
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 0xb8]
cmp eax, dword [ecx + 0x14]
jle 0x40ffc8
mov dword [ecx + 0x14], eax
mov ecx, dword [ebp - 0xd4]
inc ecx
mov dword [ebp - 0xd4], ecx
cmp ecx, dword [ebp - 0xb4]
jl 0x40ff6b
mov edi, dword [ebp - 0x98]
xor edx, edx
inc edx
cmp dword [ebp - 0xf0], 0
jne 0x4107b3
cmp dword [ebp - 0x114], 0
je 0x4103d7
test edi, edi
jne 0x410015
cmp dword [ebp - 0xa0], 3
jge 0x410015
cmp dword [ebp - 0x10c], edi
je 0x410022
cmp dword [ebp - 0xec], 0
jne 0x4101c6
xor ecx, ecx
jmp 0x4101cc
mov ecx, dword [ebp - 0xd4]
test ecx, ecx
jne 0x40ffce
mov eax, dword [ebp - 0x88]
mov edx, dword [ebp - 0xb8]
mov eax, dword [eax + 0x14]
add eax, dword [ebp - 0xd0]
mov dword [edx + 0x14], eax
jmp 0x40ffce
xor edx, edx
mov esi, eax
inc edx
cmp ecx, edx
jle 0x40ffe6
mov edx, dword [ebp - 0x8c]
lea ecx, [edx - 1]
imul ecx, dword [ebp - 0xa4]
sub eax, ecx
cmp eax, 2
jne 0x40ffe3
mov eax, dword [ebp - 0xe0]
push 0
push 0
push 0
push 0
push 0
add eax, edi
push 0
add eax, edx
push eax
push ebx
call fcn.0041ce72
inc edi
mov dword [ebp - 0x98], edi
cmp edi, dword [ebp - 0x8c]
jl 0x40fe31
mov edi, dword [ebp - 0x8c]
dec edi
imul edi, dword [ebp - 0xa4]
push edi
push ebx
mov dword [ebp - 0xb4], edi
call fcn.0041e296
mov ecx, dword [ebp - 0x84]
mov esi, eax
cmp edi, ecx
jge 0x4100f0
push edi
push ebx
call fcn.0041e296
mov ecx, eax
mov dword [ebp - 0x88], ecx
mov eax, dword [ecx + 0x18]
sub eax, dword [ecx + 0x30]
cmp eax, dword [esi + 0x18]
jle 0x4100e5
mov dword [esi + 0x18], eax
mov ecx, dword [ebp - 0x84]
inc edi
cmp edi, ecx
jl 0x4100c8
mov eax, dword [ebp - 0x40]
cmp dword [esi + 0x18], eax
cmovg eax, dword [esi + 0x18]
xor edi, edi
mov dword [ebp - 0x40], eax
inc edi
mov eax, dword [ebp - 0x8c]
cmp eax, edi
jne 0x41014c
mov eax, dword [ebp - 0xa0]
dec eax
cmp dword [ebp - 0xf4], eax
jge 0x410146
lea eax, [ecx - 1]
push eax
push ebx
call fcn.0041e296
mov ecx, eax
mov eax, dword [esi + 0x14]
mov edx, eax
mov dword [ebp - 0x88], ecx
sub edx, dword [ecx + 0x38]
mov dword [ebp - 0x94], edx
cmp edx, dword [ebx + 0x7c]
jge 0x410146
sub eax, edx
add eax, dword [ebx + 0x7c]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0xa0], edi
jne 0x4109c0
xor esi, esi
mov dword [ebp - 0xbc], esi
test eax, eax
jle 0x4109c0
mov eax, dword [ebp - 0xa4]
imul eax, esi
push eax
push ebx
mov dword [ebp - 0xf4], eax
call fcn.0041e296
mov edi, eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x88]
call fcn.0041167d
test esi, esi
jne 0x41019f
cmp dword [ebp - 0x10c], esi
je 0x4107f6
mov edx, dword [ebp - 0xf0]
test edx, edx
jne 0x4107fc
cmp dword [ebx + 0x9c], edx
je 0x4107fc
mov eax, dword [ebp - 0xe0]
add eax, esi
jmp 0x4107fe
mov ecx, dword [ebp - 0x100]
mov edx, dword [ebp - 0xcc]
imul eax, ecx, 0x14
mov edi, dword [eax + edx + 8]
mov edx, dword [eax + edx]
mov eax, dword [ebp - 0xa0]
dec eax
cmp dword [ebp - 0xc0], eax
jne 0x4101f9
cmp dword [ebp - 0x124], 0
jne 0x4101f9
xor eax, eax
inc eax
jmp 0x4101fb
xor eax, eax
push 0x2000
push eax
mov eax, dword [ebp - 0xdc]
push eax
push eax
push edi
push edx
push ecx
push ebx
call fcn.0041ce72
lea eax, [esi - 1]
push eax
push ebx
call fcn.0041e296
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x88], eax
push ecx
push eax
call fcn.0041167d
mov eax, dword [ebp - 0x88]
test byte [eax + 0xf4], 4
je 0x410282
push eax
push ebx
call fcn.0041e380
cmp eax, 0xffffffff
je 0x410282
mov ecx, dword [ebp - 0x88]
xor eax, eax
push 0
inc eax
push eax
test dword [ecx + 0xf4], 0x100
push dword [ebp - 0xdc]
je 0x410277
mov eax, dword [ecx + 0x30]
sub eax, dword [ecx + 0x38]
add eax, dword [ebp - 0x50]
add eax, dword [ebp - 0xd8]
push eax
jmp 0x410297
mov eax, dword [ecx + 0x60]
sub eax, dword [ecx + 0x38]
add eax, dword [ecx + 0x30]
jmp 0x41026e
mov ecx, dword [ebp - 0xd8]
xor eax, eax
inc eax
sub ecx, dword [ebp - 0x48]
push eax
push eax
push dword [ebp - 0xdc]
push ecx
mov eax, dword [ebp - 0x90]
push edi
dec eax
push edi
add eax, esi
push eax
push ebx
call fcn.0041ce72
mov ecx, dword [ebp - 0x84]
cmp esi, ecx
jge 0x410338
push esi
push ebx
call fcn.0041e296
lea ecx, [ebp - 0x50]
mov dword [ebp - 0xb0], eax
push ecx
push eax
call fcn.0041167d
mov eax, dword [ebp - 0xb0]
test byte [eax + 0xf4], 4
je 0x41030b
push eax
push ebx
call fcn.0041e380
cmp eax, 0xffffffff
je 0x41030b
mov eax, dword [ebp - 0xb0]
xor ecx, ecx
inc ecx
push 0
push ecx
test dword [eax + 0xf4], 0x100
mov eax, dword [eax + 0x60]
je 0x410314
add eax, eax
sub eax, dword [ebp - 0x48]
jmp 0x410314
xor eax, eax
inc eax
push 2
push eax
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0xd0]
push eax
push dword [ebp - 0xdc]
mov eax, dword [ebp - 0x90]
push edi
push edi
add eax, esi
push eax
push ebx
call fcn.0041ce72
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0xc0]
xor edx, edx
inc edx
cmp dword [ebp + eax*4 - 0x10], edx
jle 0x4107b3
lea eax, [esi + 1]
cmp eax, ecx
jge 0x4107b3
cmp dword [ebp - 0xa0], 3
jge 0x4107b3
push eax
push ebx
call fcn.0041e296
mov dword [ebp - 0x88], eax
test byte [eax + 0xf4], 4
je 0x4103cc
push eax
push ebx
call fcn.0041e380
cmp eax, 0xffffffff
je 0x4103c6
mov edx, dword [ebp - 0x88]
xor eax, eax
inc eax
push 0
push eax
test dword [edx + 0xf4], 0x100
je 0x4103be
mov ecx, dword [edx + 0x60]
mov eax, dword [edx + 0x30]
lea eax, [eax + ecx*2]
push eax
mov eax, dword [ebp - 0xb0]
push dword [eax + 0x38]
mov eax, dword [ebp - 0x90]
push edi
push edi
inc eax
jmp 0x4107aa
mov eax, dword [edx + 0x60]
add eax, dword [edx + 0x30]
jmp 0x4103a6
mov eax, dword [ebp - 0x88]
xor ecx, ecx
push 0
inc ecx
push ecx
push dword [eax + 0x30]
jmp 0x4103a7
xor ecx, ecx
mov dword [ebp - 0x94], ecx
test edi, edi
jne 0x4103ef
mov ecx, edx
xor eax, eax
mov dword [ebp - 0x94], ecx
jmp 0x4103f5
mov eax, dword [ebp - 0x100]
mov edx, dword [ebp - 0xcc]
mov dword [ebp - 0xb4], eax
imul eax, eax, 0x14
mov edi, dword [eax + edx + 8]
mov edx, dword [eax + edx]
mov eax, ecx
or eax, 0x2000
mov dword [ebp - 0xd8], edi
push eax
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
dec eax
cmp dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xdc]
sete cl
push ecx
push eax
push eax
push edi
push edx
push dword [ebp - 0xb4]
push ebx
call fcn.0041ce72
lea eax, [esi - 1]
push eax
push ebx
call fcn.0041e296
mov dword [ebp - 0x88], eax
test byte [eax + 0xf4], 4
je 0x4104c6
push eax
push ebx
call fcn.0041e380
cmp eax, 0xffffffff
je 0x4104c6
mov edx, dword [ebp - 0x88]
xor ecx, ecx
mov eax, dword [ebp - 0x8c]
dec eax
push ecx
test dword [edx + 0xf4], 0x100
je 0x4104ab
cmp dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x84]
sete cl
dec eax
add eax, dword [ebp - 0x90]
push ecx
push dword [ebp - 0xdc]
mov dword [ebp - 0xd4], ecx
push dword [edx + 0x30]
jmp 0x410503
cmp dword [ebp - 0x98], eax
sete cl
mov dword [ebp - 0xd4], ecx
push ecx
mov ecx, dword [ebp - 0x88]
mov eax, dword [ecx + 0x60]
jmp 0x4104ea
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
dec eax
cmp dword [ebp - 0x98], eax
push 0
sete cl
mov dword [ebp - 0xd4], ecx
push ecx
mov ecx, dword [ebp - 0x88]
mov eax, dword [ecx + 0x64]
mov edx, dword [ebp - 0x90]
add edx, dword [ebp - 0x84]
push dword [ebp - 0xdc]
add eax, dword [ecx + 0x30]
push eax
lea eax, [edx - 1]
push edi
push edi
add eax, esi
push eax
push ebx
call fcn.0041ce72
mov eax, dword [ebp - 0x84]
cmp esi, eax
jge 0x4107b9
push esi
push ebx
call fcn.0041e296
mov edi, eax
lea eax, [ebp - 0x50]
push eax
push edi
mov dword [ebp - 0x88], edi
call fcn.0041167d
test byte [edi + 0xf4], 4
je 0x4105e0
push edi
push ebx
call fcn.0041e380
cmp eax, 0xffffffff
je 0x4105e0
mov ecx, dword [ebp - 0x88]
mov edi, dword [ebp - 0xd4]
push 0
push edi
mov eax, dword [ecx + 0x60]
add eax, dword [ecx + 0x30]
push eax
push dword [ebp - 0xdc]
mov eax, dword [ebp - 0xd8]
push eax
push eax
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x84]
add eax, esi
push eax
push ebx
call fcn.0041ce72
mov edx, dword [ebp - 0x88]
xor eax, eax
push 0
mov ecx, dword [edx + 0x60]
add ecx, dword [edx + 0x30]
cmp dword [ebp - 0xc0], eax
mov edx, dword [edx + 0x34]
setg al
push eax
mov eax, dword [ebp - 0x88]
push ecx
push ecx
mov eax, dword [eax + 0xf0]
sub eax, dword [ebp - 0x44]
add eax, edx
sub edx, dword [ebx + 0x84]
push eax
mov eax, dword [ebp - 0x90]
push edx
add eax, esi
push eax
push ebx
call fcn.0041ce72
mov ecx, dword [ebp - 0x88]
mov eax, dword [ecx + 0x60]
jmp 0x410669
mov ecx, dword [ebp - 0x88]
mov edi, dword [ebp - 0xd4]
push 0
push edi
mov eax, dword [ecx + 0x64]
add eax, dword [ecx + 0x30]
push eax
push dword [ebp - 0xdc]
mov eax, dword [ebp - 0xd8]
push eax
push eax
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x84]
add eax, esi
push eax
push ebx
call fcn.0041ce72
mov edx, dword [ebp - 0x88]
xor eax, eax
push 2
mov ecx, dword [edx + 0x64]
add ecx, dword [edx + 0x30]
cmp dword [ebp - 0xc0], eax
mov edx, dword [edx + 0x34]
setg al
push eax
mov eax, dword [ebp - 0x88]
push ecx
push ecx
mov eax, dword [eax + 0xe8]
add eax, edx
sub edx, dword [ebx + 0x84]
add eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x90]
push edx
add eax, esi
push eax
push ebx
call fcn.0041ce72
mov ecx, dword [ebp - 0x88]
mov eax, dword [ecx + 0x64]
mov dword [ebp - 0xd8], eax
xor ecx, ecx
mov eax, dword [ebp - 0x88]
inc ecx
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp + eax*4 - 0x10], ecx
jle 0x4107b3
lea eax, [esi + 1]
cmp eax, dword [ebp - 0x84]
jge 0x4107b3
push eax
push ebx
call fcn.0041e296
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x88], eax
push ecx
push eax
call fcn.0041167d
mov edx, dword [ebp - 0x88]
test byte [edx + 0xf4], 4
je 0x410700
push edx
push ebx
call fcn.0041e380
mov edx, dword [ebp - 0x88]
cmp eax, 0xffffffff
je 0x410700
mov ecx, dword [edx + 0x60]
xor eax, eax
add ecx, dword [edx + 0x30]
cmp dword [ebp - 0xc0], 1
mov edx, dword [edx + 0x34]
setg al
push 0
push eax
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 0xf0]
sub eax, dword [ebp - 0x44]
add eax, edx
jmp 0x410729
mov ecx, dword [edx + 0x64]
xor eax, eax
add ecx, dword [edx + 0x30]
cmp dword [ebp - 0xc0], 1
mov edx, dword [edx + 0x34]
setg al
push 2
push eax
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 0xe8]
add eax, edx
add eax, dword [ebp - 0x4c]
sub edx, dword [ebx + 0x84]
push ecx
push ecx
push eax
mov eax, dword [ebp - 0x90]
inc eax
push edx
add eax, esi
push eax
push ebx
call fcn.0041ce72
mov edx, dword [ebp - 0x88]
test byte [edx + 0xf4], 4
je 0x410772
push edx
push ebx
call fcn.0041e380
mov edx, dword [ebp - 0x88]
cmp eax, 0xffffffff
je 0x410772
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax + 0x34]
mov eax, dword [edx + 0x60]
jmp 0x41077e
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax + 0x34]
mov eax, dword [edx + 0x64]
add eax, dword [edx + 0x30]
sub ecx, dword [ebx + 0x84]
push 0
push edi
push eax
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax + 0x30]
add eax, dword [ebp - 0xd8]
push eax
mov eax, dword [ebp - 0x84]
inc eax
add eax, dword [ebp - 0x90]
push ecx
push ecx
add eax, esi
push eax
push ebx
call fcn.0041ce72
mov eax, dword [ebp - 0x84]
mov edi, dword [ebp - 0xc0]
mov edx, dword [ebp - 0x8c]
inc edi
add dword [ebp - 0x100], edx
add dword [ebp - 0xbc], 0x10
cmp edi, dword [ebp - 0xa0]
mov dword [ebp - 0xc0], edi
mov edi, dword [ebp - 0x98]
jge 0x41008e
mov ecx, dword [ebp - 0xc0]
jmp 0x40fe82
mov edx, dword [ebp - 0xf0]
xor eax, eax
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0xa8], eax
imul eax, eax, 0x14
mov esi, dword [eax + ecx + 8]
mov eax, dword [eax + ecx]
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xb8], eax
test edx, edx
je 0x410860
cmp dword [ebp - 0xc8], 0x13
jne 0x4109a7
mov eax, dword [ebp - 0x9c]
xor ecx, ecx
sub eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x68]
push ecx
push ecx
push eax
mov eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x70]
push eax
push 0xfffffffffffffffe
push 0xfffffffffffffffe
mov dword [ebp - 0x108], 2
push ecx
jmp 0x4109a1
cmp dword [ebp - 0xe4], 0
je 0x4108fd
test byte [edi + 0xf4], 4
je 0x4108ac
push edi
push ebx
call fcn.0041e380
cmp eax, 0xffffffff
je 0x4108ac
mov esi, dword [ebp - 0xc4]
xor eax, eax
inc eax
neg esi
test dword [edi + 0xf4], 0x100
push 0
push eax
je 0x4108a4
mov eax, dword [edi + 0x38]
sub eax, dword [ebp - 0x48]
jmp 0x4108c0
mov eax, dword [edi + 0x60]
add eax, dword [edi + 0x30]
jmp 0x4108c0
mov esi, dword [ebp - 0xc4]
xor eax, eax
inc eax
neg esi
push 2
push eax
mov eax, dword [edi + 0x30]
add eax, dword [ebp - 0x50]
mov edi, dword [ebp - 0xd8]
push eax
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x90]
push esi
push edi
push edi
push eax
push ebx
call fcn.0041ce72
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
push ecx
dec eax
cmp dword [ebp - 0xbc], eax
pop eax
push 0
push 0
push esi
push esi
cmove ecx, eax
push edi
jmp 0x41098f
test byte [edi + 0xf4], 4
je 0x41093a
push edi
push ebx
call fcn.0041e380
cmp eax, 0xffffffff
je 0x41093a
xor eax, eax
push 0
inc eax
test dword [edi + 0xf4], 0x100
push eax
push dword [ebp - 0xc4]
je 0x410932
mov eax, dword [edi + 0x30]
sub eax, dword [ebp - 0x50]
jmp 0x41094b
mov eax, dword [edi + 0x60]
add eax, dword [edi + 0x30]
jmp 0x41094b
xor eax, eax
inc eax
push eax
push eax
mov eax, dword [edi + 0x38]
push dword [ebp - 0xc4]
sub eax, dword [ebp - 0x48]
push eax
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x90]
push esi
push esi
push eax
push ebx
call fcn.0041ce72
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
dec eax
xor edi, edi
cmp dword [ebp - 0xbc], eax
push 0x2000
cmove ecx, edi
xor eax, eax
cmp dword [ebp - 0x124], eax
sete al
push eax
mov eax, dword [ebp - 0xc4]
push eax
push eax
push esi
push dword [ebp - 0xb8]
mov dword [ebp - 0x94], ecx
push dword [ebp - 0xa8]
push ebx
call fcn.0041ce72
mov esi, dword [ebp - 0xbc]
inc esi
mov dword [ebp - 0xbc], esi
cmp esi, dword [ebp - 0x8c]
jl 0x410168
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
mov esi, dword [ebp - 0x9c]
inc ecx
mov edi, esi
cmp eax, ecx
jle 0x4109ea
lea ecx, [ebp - 0x30]
lea edx, [eax - 1]
mov eax, dword [ecx + 0xc]
add eax, dword [ecx]
lea ecx, [ecx + 0x10]
add edi, eax
sub edx, 1
jne 0x4109db
push dword [ebp - 0xb4]
push ebx
call fcn.0041e296
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x108]
cmp edi, dword [eax + 0x14]
cmovl edi, dword [eax + 0x14]
cmp dword [ebp - 0x10c], 0
mov dword [ebp - 0xb8], edi
mov dword [ebx + 0x18], edx
lea eax, [edi + ecx]
mov dword [ebx + 0x50], eax
je 0x410bc8
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0xec]
cdq
sub eax, edx
sar eax, 1
mov dword [ebx + 0x14], eax
test esi, esi
jle 0x410afc
push 0
xor ecx, ecx
cmp dword [ebp - 0xc8], 0xc
sete cl
push ecx
push eax
push eax
mov eax, dword [ebx + 0x84]
neg eax
push eax
mov eax, dword [ebp - 0x108]
neg eax
push eax
push 0
push ebx
call fcn.0041ce72
and dword [ebp - 0x94], 0
imul eax, dword [ebp - 0xe0], 0x14
cmp dword [ebp - 0xe4], 0
mov ecx, dword [ebp - 0xcc]
je 0x410a97
mov ecx, dword [eax + ecx + 4]
xor eax, eax
mov edx, dword [ebx + 0x14]
mov dword [ebx + 0x58], eax
mov dword [ebp - 0x94], eax
jmp 0x410aa6
mov edx, dword [eax + ecx + 4]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebx + 0x14]
mov dword [ebx + 0x58], eax
xor eax, eax
cmp dword [ebx + 0x2c], 0xffffffff
jne 0x410adf
mov esi, dword [ebp - 0x84]
push eax
push eax
push eax
push eax
push eax
push eax
mov eax, dword [ebp - 0x90]
add eax, esi
push eax
push ebx
call fcn.0041ce72
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
mov eax, dword [ebp - 0xec]
dec eax
push eax
push ebx
call fcn.0041ce72
jmp 0x410b02
mov eax, dword [ebx + 0x84]
push 0x2000
push 0
push edx
neg eax
push ecx
push eax
push eax
lea eax, [esi - 1]
push eax
push ebx
call fcn.0041ce72
mov esi, dword [ebp - 0x84]
mov edx, dword [ebp - 0xac]
cmp dword [ebp - 0xf0], 0
je 0x411074
test edx, edx
jne 0x411074
lea eax, [esi - 1]
push eax
push ebx
call fcn.0041e296
mov eax, dword [eax + 0x3c]
cdq
sub eax, edx
xor edx, edx
mov esi, eax
mov dword [ebp - 0x94], edx
sar esi, 1
cmp dword [ebx + 0xb0], edx
je 0x410b67
mov ecx, dword [ebx + 0xbc]
mov eax, dword [ebp - 0xe4]
test ecx, ecx
jns 0x410b57
test eax, eax
jne 0x410b5d
test ecx, ecx
jle 0x410b67
test eax, eax
jne 0x410b67
mov edx, ecx
neg edx
mov dword [ebp - 0x94], edx
mov ecx, dword [ebx + 0x14]
xor eax, eax
inc eax
add ecx, edx
push eax
xor eax, eax
cmp dword [ebp - 0xe4], eax
sete al
push eax
mov eax, dword [ebp - 0x108]
push ecx
push ecx
push esi
neg eax
push eax
push 0
push ebx
call fcn.0041ce72
push 0
push ebx
call fcn.0041e296
lea ecx, [ebp - 0x50]
push ecx
push eax
call fcn.0041167d
cmp dword [ebp - 0xe4], 0
je 0x411033
mov ecx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x7c]
add ecx, dword [ebp - 0x94]
add eax, dword [ebp - 0x50]
push 2
add eax, ecx
pop edx
jmp 0x411049
mov edx, dword [ebp - 0xac]
test edx, edx
je 0x410c19
cdq
xor esi, esi
sub eax, edx
sar eax, 1
push esi
sub eax, ecx
push ebx
mov dword [ebx + 0x14], eax
call fcn.0041e296
lea ecx, [ebp - 0x50]
push ecx
push eax
call fcn.0041167d
push 0xe
pop eax
cmp dword [ebp - 0xc8], eax
jne 0x410afc
mov eax, dword [ebp - 0x108]
push 3
push esi
push dword [ebx + 0x14]
neg eax
push dword [ebx + 0x14]
push dword [ebp - 0x4c]
push eax
push esi
jmp 0x410af6
cmp dword [ebp - 0xe4], 0
je 0x410c2c
mov eax, dword [ebp - 0xc4]
neg eax
jmp 0x410c3f
mov ecx, dword [ebp - 0xa4]
xor eax, eax
inc eax
cmp ecx, eax
jne 0x410c4d
mov eax, dword [ebp - 0xc4]
mov esi, dword [ebp - 0x84]
mov dword [ebx + 0x14], eax
jmp 0x410b08
cmp dword [ebp - 0xa0], 3
jge 0x410db2
mov eax, dword [ebx + 0x7c]
add eax, esi
mov esi, dword [ebp - 0x84]
mov dword [ebx + 0x14], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x8c], eax
jne 0x410b08
cmp ecx, 2
je 0x410c84
cmp esi, 2
jl 0x410c84
push eax
jmp 0x410c86
push 0
push ebx
call fcn.0041e296
mov ecx, dword [eax + 0x38]
mov eax, dword [ebx + 0x7c]
add eax, ecx
cmp dword [ebx + 0x14], eax
jge 0x410c9c
mov dword [ebx + 0x14], eax
mov edx, dword [ebx + 0xa0]
add edx, ebx
cmp dword [ebx + 0x9c], 0
mov dword [ebp - 0xcc], edx
je 0x410b02
cmp dword [ebp - 0x114], 0
mov eax, dword [ebx + 0x14]
mov dword [edx + 4], eax
mov eax, dword [ebx + 0x14]
mov dword [edx + 0xc], eax
je 0x410d5a
mov eax, dword [ebx + 0x14]
xor ecx, ecx
inc ecx
mov dword [edx + 0x20], eax
cmp esi, ecx
jle 0x410b02
mov eax, dword [ebx + 0x14]
push ecx
push ebx
mov dword [edx + 0x2c], eax
call fcn.0041e296
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.0041167d
mov edx, dword [ebp - 0xcc]
mov ecx, dword [esi + 0x30]
mov dword [edx + 0x34], ecx
test byte [esi + 0xf4], 4
je 0x410d4f
push esi
push ebx
call fcn.0041e380
cmp eax, 0xffffffff
je 0x410d49
mov eax, dword [esi + 0x60]
test dword [esi + 0xf4], 0x100
mov ecx, dword [ebp - 0xcc]
mov edx, dword [ebp - 0xac]
mov esi, dword [ebp - 0x84]
je 0x410d41
add eax, eax
sub eax, dword [ebp - 0x48]
add dword [ecx + 0x34], eax
jmp 0x410b08
mov edx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x50]
add dword [edx + 0x34], eax
jmp 0x410afc
cmp dword [ebp - 0xa4], 2
jne 0x410d84
mov eax, dword [ebx + 0x14]
imul ecx, esi, 0x14
mov dword [ecx + edx + 0x20], eax
xor eax, eax
inc eax
cmp esi, eax
jle 0x410b02
mov eax, dword [ebx + 0x14]
mov dword [ecx + edx + 0x2c], eax
jmp 0x410b02
xor eax, eax
inc eax
cmp esi, eax
mov eax, dword [ebx + 0x14]
jne 0x410d96
mov dword [edx + 0x34], eax
jmp 0x410b02
imul ecx, esi, 0x14
mov dword [ecx + edx + 0x34], eax
cmp esi, 2
jle 0x410b02
mov eax, dword [ebx + 0x14]
mov dword [ecx + edx + 0x40], eax
jmp 0x410b02
mov edx, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xcc]
imul eax, edx, 0x14
mov dword [ebp - 0xb4], eax
mov esi, dword [eax + ecx + 4]
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xbc], esi
cmp eax, 2
jle 0x410e12
mov eax, dword [ebp - 0x8c]
add eax, edx
imul eax, eax, 0x14
mov edi, dword [eax + ecx + 4]
xor eax, eax
inc eax
push eax
push ebx
call fcn.0041e296
push 2
push ebx
mov esi, eax
call fcn.0041e296
mov eax, dword [eax + 0x38]
sub eax, dword [esi + 0x30]
cdq
sub eax, edx
sar eax, 1
add eax, dword [esi + 0x30]
mov dword [ebx + 0x14], eax
jmp 0x410e37
jne 0x410e29
xor eax, eax
inc eax
push eax
push ebx
call fcn.0041e296
mov ecx, dword [ebx + 0x7c]
add ecx, dword [eax + 0x38]
mov dword [ebx + 0x14], ecx
jmp 0x410e34
push 0
push ebx
call fcn.0041e296
mov dword [ebx + 0x14], esi
mov edi, dword [ebx + 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 0x8c], eax
jne 0x410f46
push 0
push ebx
call fcn.0041e296
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.0041167d
mov ecx, dword [esi + 0x38]
mov edx, dword [ebp - 0xcc]
sub ecx, dword [ebp - 0x48]
mov dword [edx + 0x18], ecx
mov eax, dword [esi + 0x30]
add eax, dword [ebp - 0xbc]
mov dword [edx + 0x20], eax
xor eax, eax
inc eax
cmp dword [ebp - 0x84], eax
jle 0x410ea8
push eax
push ebx
call fcn.0041e296
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.0041167d
mov edx, dword [ebp - 0xcc]
mov ecx, dword [edx + 0x20]
mov dword [edx + 0x2c], ecx
mov eax, dword [esi + 0x30]
add eax, dword [ebp - 0x50]
mov dword [edx + 0x34], eax
cmp dword [ebp - 0x84], 2
mov eax, dword [ebp - 0xb4]
mov esi, dword [edx + 0x20]
mov dword [ebp - 0xbc], esi
mov dword [eax + edx + 4], esi
mov dword [eax + edx + 0xc], esi
jle 0x410f4c
push 2
push ebx
call fcn.0041e296
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.0041167d
mov eax, dword [esi + 0x38]
mov ecx, dword [ebp - 0xcc]
sub eax, dword [ebp - 0x48]
push 0
push ebx
mov dword [ecx + 0x40], eax
call fcn.0041e296
mov ecx, dword [ebp - 0xcc]
mov eax, dword [eax + 0x30]
add edi, eax
cmp dword [ebp - 0x84], 3
mov dword [ecx + 0x48], edi
jle 0x410f34
push 3
push ebx
call fcn.0041e296
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.0041167d
mov ecx, dword [ebp - 0xcc]
mov dword [ecx + 0x54], edi
mov eax, dword [esi + 0x30]
add eax, dword [ebp - 0x50]
mov dword [ecx + 0x5c], eax
mov eax, dword [ebp - 0xe0]
inc eax
imul eax, eax, 0x14
mov dword [eax + ecx + 4], edi
mov dword [eax + ecx + 0xc], edi
mov esi, dword [ebp - 0xbc]
xor eax, eax
cmp dword [ebp - 0x84], 2
push 0
setle al
push eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 0x84]
push dword [ebx + 0x14]
neg eax
push eax
mov eax, dword [ebp - 0x108]
neg eax
push eax
push 0
push ebx
call fcn.0041ce72
mov ecx, dword [ebp - 0x110]
test ecx, ecx
jle 0x410fbe
mov eax, dword [ebx + 0x84]
xor edx, edx
push edx
push edx
push dword [ebx + 0x14]
neg eax
mov dword [ebp - 0x94], edx
push esi
push eax
push eax
mov eax, dword [ebp - 0xec]
sub eax, ecx
push eax
push ebx
call fcn.0041ce72
mov ecx, dword [ebp - 0x110]
lea eax, [esi + 0xa]
mov dword [ebx + 0x58], eax
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x5c], eax
xor eax, eax
inc eax
cmp ecx, eax
jle 0x410ff5
mov eax, dword [ebx + 0x84]
and dword [ebp - 0x94], 0
neg eax
push 0x2000
push 0
push edi
push dword [ebx + 0x14]
push eax
push eax
mov eax, dword [ebp - 0xec]
dec eax
push eax
push ebx
call fcn.0041ce72
lea eax, [edi - 0xa]
mov dword [ebx + 0x5c], eax
mov esi, dword [ebp - 0x84]
mov eax, esi
and eax, 0x80000003
jns 0x411009
dec eax
or eax, 0xfffffffc
inc eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x411028
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
mov eax, dword [ebp - 0x8c]
lea eax, [esi + eax*2]
push eax
push ebx
call fcn.0041ce72
mov edi, dword [ebp - 0xb8]
jmp 0x410b02
mov eax, dword [ebx + 0x14]
mov edx, 0x2001
add eax, dword [ebp - 0x94]
mov ecx, eax
sub ecx, dword [ebx + 0x7c]
sub ecx, dword [ebp - 0x48]
cmp dword [ebx + 0x2c], 0xffffffff
je 0x411064
push edx
xor edx, edx
inc edx
push edx
push eax
push ecx
push esi
push esi
xor esi, esi
inc esi
push esi
push ebx
call fcn.0041ce72
jmp 0x411077
push 0
xor esi, esi
inc esi
push esi
push 0
push 0
push 0
push 0
jmp 0x41105b
xor esi, esi
inc esi
cmp dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xec]
mov dword [ebx + 0x98], eax
je 0x411169
mov eax, dword [ebp - 0xe8]
add eax, dword [ebp - 0x108]
push 0
push ebx
push 0
push eax
mov eax, dword [ebx + 0xa4]
push edi
push dword [ebp - 0x40]
add eax, ebx
push dword [ebx + 0x94]
push eax
call fcn.0041cf0c
mov eax, dword [ebx + 0xa4]
add eax, ebx
push eax
push ebx
call fcn.0041cd1e
cmp dword [ebp - 0xac], 0
mov ecx, dword [ebp - 0x84]
je 0x4111ab
mov esi, dword [ebx + 0x24]
xor edi, edi
sub esi, dword [ebx + 0x1c]
mov dword [ebp - 0x94], esi
test ecx, ecx
jle 0x4111b1
push edi
push ebx
call fcn.0041e296
mov edx, eax
mov esi, dword [edx + 0x18]
cmp esi, dword [ebp - 0x60]
cmovl esi, dword [ebp - 0x60]
test dword [edx + 0xf4], 0x100
jne 0x41115c
mov eax, dword [edx + 0xa8]
xor ecx, ecx
sub eax, ecx
je 0x41114b
dec eax
sub eax, 1
je 0x411143
mov eax, dword [ebp - 0x94]
lea ecx, [edx + 0x30]
sub eax, dword [edx + 0x14]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
sub eax, dword [ecx]
add eax, dword [ebx + 0x1c]
push 0
add eax, esi
push eax
push ecx
jmp 0x411156
mov eax, dword [ebx + 0x24]
sub eax, dword [edx + 0x14]
jmp 0x411150
mov eax, dword [ebx + 0x1c]
add eax, esi
push ecx
push eax
lea eax, [edx + 0x30]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov ecx, dword [ebp - 0x84]
inc edi
cmp edi, ecx
jl 0x4110f2
jmp 0x4111ab
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0xe4]
cmp ecx, esi
jne 0x411181
test edx, edx
jne 0x411181
mov eax, esi
jmp 0x411183
xor eax, eax
push eax
mov eax, dword [ebp - 0xe8]
add eax, dword [ebp - 0x108]
push edx
push dword [ebp - 0xc4]
push eax
push ecx
push dword [ebp - 0x8c]
push ebx
call fcn.0041d60a
mov ecx, dword [ebp - 0x84]
mov esi, dword [ebp - 0x94]
mov eax, dword [ebx + 0x28]
mov edx, 0xb40
sub eax, dword [ebx + 0x20]
cmp eax, edx
jg 0x4111ca
mov eax, dword [ebx + 0x24]
sub eax, dword [ebx + 0x1c]
cmp eax, edx
jle 0x4111e0
mov edx, dword [ebp - 0x120]
mov eax, dword [ebx + 0x38]
push 0x67
mov dword [edx], eax
pop eax
mov dword [ebp - 0x118], eax
jmp 0x4111e6
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0xfc], 0
je 0x4112b5
test eax, eax
jne 0x4112b5
push ecx
push ebx
call fcn.0041e296
mov esi, dword [sym.imp.USER32.dll_SetRect]
xor ecx, ecx
push ecx
push ecx
mov edi, eax
push ecx
push ecx
lea eax, [edi + 0x30]
push eax
call esi
xor ecx, ecx
lea eax, [edi + 0xe4]
push ecx
push ecx
push ecx
push ecx
push eax
call esi
and dword [edi + 0x60], 0
and dword [edi + 0x64], 0
mov eax, dword [ebx + 0x34]
mov esi, dword [edi]
sub eax, 0x17
je 0x411282
dec eax
sub eax, 1
je 0x411282
sub eax, 3
je 0x41124c
sub eax, 1
je 0x411282
sub eax, 4
jne 0x4112b5
mov eax, dword [ebx + 0x24]
sub eax, dword [ebx + 0x1c]
push dword [ebx + 0x28]
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebx + 0x1c]
push eax
lea eax, [edi + 0x30]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [ebx + 0x1c]
add eax, dword [ebp - 0x60]
mov dword [edi + 0xe4], eax
mov eax, dword [ebx + 0x24]
sub eax, dword [ebp - 0x58]
mov dword [edi + 0xec], eax
jmp 0x4112b5
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x411293
xor eax, eax
jmp 0x41129a
dec eax
add eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xcc]
imul eax, eax, 0x14
push dword [eax + ecx + 8]
push dword [eax + ecx + 4]
lea eax, [edi + 0x30]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push 0
push 2
lea eax, [ebx + 0x10]
push eax
call fcn.0046bad9
mov ebx, dword [ebp - 0x118]
jmp 0x40ed87