Function at 0x40a950
Capabilities:
Check for foreground window switch

Disassembly:
push 0xffffffffffffffff
push 0x465603
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47a770]
xor eax, esp
push eax
lea eax, [esp + 0xe4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xf8]
xor eax, eax
mov dword [esp + 0xec], eax
push eax
mov dword [esp + 0x98], eax
call fcn.0044bf56
add esp, 4
push eax
call fcn.0044bf22
add esp, 4
call fcn.0044bf34
cdq
idiv dword [0x480c2c]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x6c], edx
lea esp, [esp]
mov eax, dword [esp + 0xfc]
mov esi, dword [esp + 0xf4]
push eax
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov dword [esp + 0x20], esp
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x40a9ff
cmp eax, dword [esi]
jne 0x40a9ff
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40aa33
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x40bd71
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
inc eax
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0044b46f
add esp, 0x10
mov edx, dword [esp + 0x20]
add edi, 0x10
mov ecx, ebp
mov dword [edx], edi
call fcn.00408690
mov esi, dword [esp + 0xfc]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
add esi, 0xfffffff0
add esp, 4
mov dword [esp + 0x18], esp
mov dword [esp + 0x1c], esp
call edx
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x40aa7c
cmp eax, dword [esi]
jne 0x40aa7c
mov edi, esi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x40aab0
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x40bd71
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
inc eax
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0044b46f
add esp, 0x10
mov edx, dword [esp + 0x1c]
add edi, 0x10
mov dword [edx], edi
mov edi, ebp
call fcn.00407850
mov eax, dword [0x47baf4]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
add esp, 4
lea ecx, [esp + 0x70]
push ecx
push ebp
mov dword [esp + 0x20], eax
call esi
mov edx, dword [esp + 0x70]
push edx
push 0
push 0x1fffff
mov dword [esp + 0x48], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x18]
mov edi, eax
lea eax, [esp + 0xd8]
push eax
push 4
lea ecx, [esp + 0x44]
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x47baf8]
lea ecx, [esp + 0x74]
push ecx
push ebp
mov dword [esp + 0x20], eax
call esi
mov edx, dword [esp + 0x74]
push edx
push 0
push 0x1fffff
mov dword [esp + 0x50], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x18]
mov edi, eax
lea eax, [esp + 0xcc]
push eax
push 4
lea ecx, [esp + 0x4c]
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x3c], 0
jne case.0x40ad69.1002
cmp dword [esp + 0x44], 0x457
jne case.0x40ad69.1002
mov eax, dword [0x480c28]
push eax
call ebx
call fcn.0044bf34
mov ecx, dword [0x480c2c]
cdq
idiv ecx
mov eax, ecx
mov edi, edx
cdq
sub eax, edx
sar eax, 1
sub eax, edi
mov dword [esp + 0x20], eax
call fcn.0044bf34
mov ecx, dword [0x480c2c]
cdq
idiv ecx
mov eax, ecx
mov edi, edx
cdq
sub eax, edx
sar eax, 1
sub eax, edi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xf4]
add eax, 0xfffffff0
push eax
call fcn.00429de0
mov ecx, dword [0x47bb0c]
add esp, 4
lea edx, [esp + 0x64]
push edx
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
call esi
mov eax, dword [esp + 0x64]
push eax
push 0
push 0x1fffff
mov dword [esp + 0x58], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0xd4]
push ecx
push 4
mov edi, eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x54]
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x4c]
lea edx, [esp + 0x68]
push edx
push ebp
mov dword [esp + 0x20], ecx
call esi
mov eax, dword [esp + 0x68]
push eax
push 0
push 0x1fffff
mov dword [esp + 0x54], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0xdc]
push ecx
mov edi, eax
mov eax, dword [esp + 0x1c]
push 4
lea edx, [esp + 0x50]
push edx
add eax, 0x1ec
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40aca1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xf4]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov esi, ebp
lea edi, [esp + 0x2c]
call fcn.004045c0
mov esi, dword [esp + 0x2c]
add esp, 4
cmp dword [esp + 0x84], esi
jne 0x40ad4e
mov eax, dword [esp + 0xf4]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov eax, ebp
call fcn.004046f0
add esp, 4
test al, al
je 0x40ad4e
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xf4]
mov edi, dword [esp + 0x20]
add ecx, 0xe3
push ecx
push ecx
mov dword [esp + 0x20], esp
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
push eax
add edi, 0x13e
call fcn.00429de0
mov edx, dword [esp + 0x24]
add eax, 0x10
mov dword [edx], eax
add esp, 4
mov ecx, edi
mov edx, ebp
call fcn.004062f0
add esp, 8
mov eax, dword [esp + 0x14]
add eax, 0xfffffc17
cmp eax, 0x8c
ja case.0x40ad69.1002
movzx eax, byte [eax + 0x40bd90]
jmp dword [eax*4 + 0x40bd78]
mov ecx, dword [esp + 0xfc]
mov eax, dword [esp + 0xf4]
push ecx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, ebp
mov dword [edi], eax
call fcn.00409040
add esp, 8
cmp esi, 0x11
ja 0x40ae96
mov edi, dword [esp + 0x2c]
cmp edi, 0xd
ja 0x40ae96
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
call fcn.0044bf34
cmp esi, 0xf
jge 0x40addd
mov eax, 0xf
sub eax, esi
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov dword [esp + 0x1c], eax
cmp edi, 0xd
jge 0x40adf4
mov eax, 0xc
sub eax, edi
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov dword [esp + 0x18], eax
lea edx, [esi + esi*4]
add edx, edx
add edx, edx
mov eax, 0x16d
sub eax, edx
mov edx, dword [esp + 0x18]
sub eax, dword [esp + 0x1c]
lea ecx, [edi + edi*4 + 0x32]
lea ecx, [edx + ecx*4]
mov edx, dword [esp + 0x24]
add ecx, edx
push ecx
mov ecx, dword [esp + 0x24]
push ecx
lea edi, [eax + ecx]
lea eax, [esp + 0xfc]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, edi
mov edx, ebp
call fcn.004062f0
add esp, 8
push 0x578
call ebx
xor esi, esi
jmp 0x40ae50
mov eax, dword [esp + 0xf4]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov edi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov eax, ebp
call fcn.00403f70
add esp, 4
cmp eax, 0x456
je case.0x40ad69.1002
push 0x12c
call ebx
inc esi
cmp esi, 0xa
jle 0x40ae50
jmp case.0x40ad69.1002
mov eax, dword [esp + 0xf4]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
lea edx, [esp + 0xb8]
add esp, 4
mov dword [esi], eax
push edx
mov eax, ebp
call fcn.004060f0
mov eax, dword [esp + 0xfc]
add esp, 4
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov eax, ebp
call fcn.004046f0
add esp, 4
test al, al
jne 0x40b004
cmp dword [esp + 0xb0], 0x295
jne 0x40b004
cmp dword [esp + 0xb4], 0x1a3
jne 0x40b004
push ecx
lea eax, [esp + 0xf8]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
lea eax, [esp + 0x7c]
push eax
mov eax, ebp
call fcn.00405d80
mov ecx, dword [esp + 0x80]
add ecx, 0x2e
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x1c]
add esp, 8
fadd qword [0x46f348]
call fcn.00450dd0
mov edx, dword [esp + 0x7c]
add edx, 0x178
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
mov edi, eax
fsub qword [0x46f340]
call fcn.00450dd0
mov dword [esp + 0x14], eax
call fcn.0044bf34
cdq
mov ecx, 0xa
idiv ecx
mov esi, 5
sub esi, edx
call fcn.0044bf34
cdq
mov ecx, 0xa
idiv ecx
mov eax, 5
add edi, esi
sub eax, edx
mov edx, dword [esp + 0x14]
add eax, edx
push eax
push ecx
lea eax, [esp + 0xfc]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, edi
mov edx, ebp
call fcn.004062f0
add esp, 8
push 0x12c
call ebx
push 0x18
push ecx
lea eax, [esp + 0xfc]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov edi, ebp
call fcn.004054b0
mov eax, dword [esp + 0x80]
add esp, 8
mov dword [esp + 0x84], eax
jmp case.0x40ad69.1002
mov eax, dword [esp + 0xf4]
push 0x18
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
mov edi, ebp
mov dword [esi], eax
call fcn.004054b0
add esp, 8
jmp case.0x40ad69.1002
add esi, 0xffffff2b
cmp esi, 0x10
ja 0x40b255
mov ecx, dword [esp + 0x2c]
add ecx, 0xffffffca
cmp ecx, 0xe
ja 0x40b255
push ecx
lea eax, [esp + 0xf8]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
lea edx, [esp + 0xa4]
push edx
mov eax, ebp
call fcn.004060f0
add esp, 4
lea eax, [esp + 0xf8]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
mov eax, ebp
call fcn.004046f0
add esp, 4
test al, al
jne 0x40b16e
cmp dword [esp + 0xa0], 0x1e2
jne 0x40b16e
cmp dword [esp + 0xa4], 0xa7
jne 0x40b16e
push 0x47e5d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call esi
cmp eax, ebp
je 0x40b0f1
mov edi, dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x40b0e0
push ebp
call edi
call fcn.00408120
push eax
call ebx
call esi
cmp eax, ebp
jne 0x40b0e0
push 0x113
push ecx
lea eax, [esp + 0xfc]
mov esi, esp
mov edi, 0x56
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, edi
mov edx, ebp
call fcn.004062f0
add esp, 8
push 0x4b0
call ebx
push 0x47e5d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
mov edi, edi
push ecx
lea eax, [esp + 0xf8]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
mov eax, ebp
call fcn.00403f70
add esp, 4
cmp eax, 0x474
je 0x40b24c
push 0x12c
call ebx
inc edi
cmp edi, 0xa
jle 0x40b130
push 5
call ebx
jmp case.0x40ad69.1002
push ecx
lea eax, [esp + 0xf8]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
mov eax, ebp
call fcn.00406270
add esp, 4
cmp al, 1
je 0x40b24c
mov eax, dword [esp + 0xfc]
mov edi, dword [eax + 0x64]
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x46dca8
call fcn.0042a2b0
push ecx
lea eax, [esp + 0x100]
mov esi, esp
mov byte [esp + 0xf8], 1
mov dword [esp + 0x24], esp
call fcn.00403870
mov ecx, edi
mov esi, ebp
mov byte [esp + 0xf8], 0
call fcn.004036d0
xor edi, edi
mov edi, edi
push 0x12c
call ebx
push ecx
lea eax, [esp + 0xf8]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
lea ecx, [esp + 0xac]
push ecx
mov eax, ebp
call fcn.004060f0
add esp, 4
lea eax, [esp + 0xf8]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
mov eax, ebp
call fcn.004046f0
add esp, 4
test al, al
jne 0x40b246
cmp dword [esp + 0xa8], 0x1e2
jne 0x40b246
cmp dword [esp + 0xac], 0xa7
je 0x40b24c
inc edi
cmp edi, 8
jle 0x40b1e0
push 5
call ebx
jmp case.0x40ad69.1002
mov eax, dword [esp + 0xf4]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
lea edx, [esp + 0xc0]
add esp, 4
mov dword [esi], eax
push edx
mov eax, ebp
call fcn.004060f0
mov eax, dword [esp + 0xfc]
add esp, 4
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov eax, ebp
call fcn.004046f0
add esp, 4
test al, al
jne 0x40b004
cmp dword [esp + 0xb8], 0x195
jne 0x40b004
cmp dword [esp + 0xbc], 0x1a3
jne 0x40b004
push ecx
lea eax, [esp + 0xf8]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
lea eax, [esp + 0x5c]
push eax
mov eax, ebp
call fcn.00405d80
add esp, 8
cmp dword [esp + 0x58], 0
jne 0x40b309
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x40b33f
push 0
push 0
push ecx
lea eax, [esp + 0x100]
mov esi, esp
mov dword [esp + 0x20], esp
call fcn.00403870
mov esi, ebp
call fcn.00405f00
add esp, 0xc
push 0x12c
call ebx
xor eax, eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], eax
add eax, 0x178
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fsub qword [0x46f338]
call fcn.00450dd0
mov edi, eax
call fcn.0044bf34
cdq
mov ecx, 0xa
idiv ecx
mov esi, 5
sub esi, edx
call fcn.0044bf34
cdq
mov ecx, 0xa
idiv ecx
mov eax, 5
sub eax, edx
add eax, edi
push eax
push ecx
lea edi, [esi + 0x161]
lea eax, [esp + 0xfc]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, edi
mov edx, ebp
call fcn.004062f0
add esp, 8
push 0x12c
call ebx
push 0x18
push ecx
lea eax, [esp + 0xfc]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov edi, ebp
call fcn.004054b0
add esp, 8
push 0x12c
call ebx
mov dword [esp + 0x84], 0
jmp case.0x40ad69.1002
mov edx, dword [esp + 0xfc]
mov eax, dword [esp + 0xf4]
push edx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, ebp
mov dword [edi], eax
call fcn.00409040
lea eax, [esi - 4]
add esp, 8
cmp eax, 0xc
ja 0x40b519
mov edi, dword [esp + 0x2c]
lea ecx, [edi - 0x38]
cmp ecx, 0xd
ja 0x40b519
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call fcn.0044bf34
cmp esi, 0xf
jge 0x40b459
mov eax, 0xf
sub eax, esi
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov dword [esp + 0x18], eax
cmp edi, 0xd
jge 0x40b470
mov eax, 0xc
sub eax, edi
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov dword [esp + 0x1c], eax
lea edx, [esi + esi*4]
add edx, edx
add edx, edx
mov eax, 0x1e5
sub eax, edx
mov edx, dword [esp + 0x1c]
sub eax, dword [esp + 0x18]
lea ecx, [edi + edi*4 - 0x113]
lea ecx, [edx + ecx*4]
mov edx, dword [esp + 0x24]
lea ecx, [ecx + edx - 0x32]
mov edx, dword [esp + 0x20]
push ecx
push ecx
lea edi, [eax + edx]
lea eax, [esp + 0xfc]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, edi
mov edx, ebp
call fcn.004062f0
add esp, 8
push 0x578
call ebx
xor esi, esi
jmp 0x40b4d0
mov eax, dword [esp + 0xf4]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov edi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov eax, ebp
call fcn.00403f70
add esp, 4
cmp eax, 0x475
je 0x40b50d
push 0x12c
call ebx
inc esi
cmp esi, 0xa
jle 0x40b4d0
push 0x190
call ebx
jmp case.0x40ad69.1002
mov eax, dword [esp + 0xf4]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0xa0]
add esp, 4
push eax
mov eax, ebp
call fcn.004060f0
mov eax, dword [esp + 0xfc]
add esp, 4
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov eax, ebp
call fcn.004046f0
add esp, 4
test al, al
jne 0x40b004
cmp dword [esp + 0x98], 0x1e5
jne 0x40b004
cmp dword [esp + 0x9c], 0x1a3
jne 0x40b004
push ecx
lea eax, [esp + 0xf8]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
lea ecx, [esp + 0x54]
push ecx
mov eax, ebp
call fcn.00405d80
add esp, 8
cmp dword [esp + 0x50], 0
jne 0x40b5cd
mov eax, dword [esp + 0x54]
test eax, eax
je 0x40b603
push 0
push 0
push ecx
lea eax, [esp + 0x100]
mov esi, esp
mov dword [esp + 0x20], esp
call fcn.00403870
mov esi, ebp
call fcn.00405f00
add esp, 0xc
push 0x12c
call ebx
xor eax, eax
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], eax
add eax, 0x178
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fsub qword [0x46f330]
call fcn.00450dd0
mov edi, eax
call fcn.0044bf34
cdq
mov ecx, 0xa
idiv ecx
mov esi, 5
sub esi, edx
call fcn.0044bf34
cdq
mov ecx, 0xa
idiv ecx
mov eax, 5
sub eax, edx
add eax, edi
push eax
push ecx
lea edi, [esi + 0xb0]
lea eax, [esp + 0xfc]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, edi
mov edx, ebp
call fcn.004062f0
add esp, 8
push 0x190
call ebx
push 0x18
push ecx
lea eax, [esp + 0xfc]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov edi, ebp
call fcn.004054b0
add esp, 8
push 0x190
call ebx
mov dword [esp + 0x84], 0
jmp case.0x40ad69.1002
cmp esi, 0x12
jg 0x40b6e9
cmp dword [esp + 0x2c], 0x1d
jl 0x40b6e9
mov eax, dword [esp + 0xfc]
lea edx, [esp + 0x94]
push edx
push 1
push eax
push ebp
push ecx
lea eax, [esp + 0x108]
mov esi, esp
mov dword [esp + 0x28], esp
call fcn.00403870
call fcn.004091a0
add esp, 0x14
jmp case.0x40ad69.1002
mov esi, dword [esp + 0xfc]
mov eax, dword [esp + 0xf4]
push 0xc
push 0x2e
push esi
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, ebp
mov dword [edi], eax
call fcn.00407a80
mov eax, dword [esp + 0x104]
add esp, 0x10
push 0x11
push 0x29
push esi
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, ebp
mov dword [edi], eax
call fcn.00407a80
mov eax, dword [esp + 0x104]
add esp, 0x10
push 0x15
push 0x22
push esi
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, ebp
mov dword [edi], eax
call fcn.00407a80
mov eax, dword [esp + 0x104]
add esp, 0x10
push 0x19
push 0x19
push esi
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, ebp
mov dword [edi], eax
call fcn.00407a80
mov eax, dword [esp + 0x104]
add esp, 0x10
push 0x1d
push 0x12
push esi
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, ebp
mov dword [edi], eax
call fcn.00407a80
add esp, 0x10
mov eax, dword [esp + 0xf4]
push 0x21
push 0xd
push esi
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, ebp
mov dword [esi], eax
call fcn.00407a80
add esp, 0x10
push 0x12c
call ebx
mov eax, dword [esp + 0xf4]
push 0xd7
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
mov esi, 0xf9
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, esi
mov edx, ebp
mov dword [edi], eax
call fcn.004062f0
add esp, 8
jmp case.0x40ad69.1002
mov eax, dword [0x480c2c]
cdq
sub eax, edx
sar eax, 1
cmp dword [esp + 0x6c], eax
jle 0x40bae6
cmp esi, 9
jle 0x40b944
mov edi, dword [esp + 0x2c]
cmp edi, 0xa
jle 0x40b944
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
call fcn.0044bf34
cmp esi, 0xf
jge 0x40b895
mov eax, 0xf
sub eax, esi
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov dword [esp + 0x1c], eax
cmp edi, 0xd
jge 0x40b8ac
mov eax, 0xc
sub eax, edi
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov dword [esp + 0x18], eax
cmp esi, 0x21
jle 0x40b8c3
mov eax, 0x21
sub eax, esi
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
lea ecx, [esi + esi*4]
add ecx, ecx
lea edx, [eax + eax*4 + 0x23]
mov eax, dword [esp + 0x18]
add ecx, ecx
mov edi, 0x34d
sub edi, ecx
sub edi, dword [esp + 0x1c]
lea ecx, [eax + edx*4]
push 0x5a
push ecx
lea eax, [esp + 0xfc]
mov esi, esp
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], esp
call fcn.00403870
mov esi, ebp
call fcn.00405540
push 0x32
call ebx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add eax, edx
push eax
push ecx
lea eax, [esp + 0xfc]
mov esi, esp
add edi, ecx
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, edi
mov edx, ebp
call fcn.004062f0
add esp, 8
push 0x4b0
call ebx
jmp case.0x40ad69.1002
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0xf4]
mov esi, dword [esp + 0x20]
add edx, 0x1ae
push edx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
add esi, 0xd6
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, esi
mov edx, ebp
mov dword [edi], eax
call fcn.004062f0
add esp, 8
xor edi, edi
push 0xc8
call ebx
mov eax, dword [esp + 0xf4]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov eax, ebp
call fcn.00403f70
add esp, 4
cmp eax, 0x3e9
je 0x40b9c3
inc edi
cmp edi, 7
jle 0x40b986
mov dword [esp + 0x18], 0
jmp 0x40b9d0
push 0xc8
call ebx
mov eax, dword [esp + 0xf4]
add eax, 0xfffffff0
push eax
call fcn.00429de0
add esp, 4
lea ecx, [esp + 0x90]
mov esi, eax
mov eax, dword [0x47bb0c]
push ecx
push ebp
add esi, 0x10
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 0x90]
push edx
push 0
push 0x1fffff
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x14]
mov edi, eax
lea eax, [esp + 0xc8]
push eax
push 4
lea ecx, [esp + 0x38]
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x60]
push ecx
push ebp
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 0x60]
push edx
push 0
push 0x1fffff
mov dword [esp + 0x4c], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x14]
mov edi, eax
lea eax, [esp + 0xc0]
push eax
push 4
lea ecx, [esp + 0x48]
push ecx
add edx, 0x1ec
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x40]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bac0
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
cmp edi, 0x3e9
je 0x40bada
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 7
mov dword [esp + 0x18], eax
jle 0x40b9d0
push 0xc8
call ebx
jmp case.0x40ad69.1002
cmp esi, 0xd
jle 0x40bbd1
mov edi, dword [esp + 0x2c]
cmp edi, 0xb
jge 0x40bbd1
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
call fcn.0044bf34
cmp esi, 0xf
jge 0x40bb22
mov eax, 0xf
sub eax, esi
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov dword [esp + 0x1c], eax
cmp edi, 0xd
jge 0x40bb39
mov eax, 0xc
sub eax, edi
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov dword [esp + 0x18], eax
cmp esi, 0x21
jle 0x40bb50
mov eax, 0x21
sub eax, esi
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
lea ecx, [esi + esi*4]
add ecx, ecx
lea edx, [eax + eax*4 - 0xa]
mov eax, dword [esp + 0x18]
add ecx, ecx
mov edi, 0x20d
sub edi, ecx
sub edi, dword [esp + 0x1c]
lea ecx, [eax + edx*4]
push 0x5a
push ecx
lea eax, [esp + 0xfc]
mov esi, esp
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], esp
call fcn.00403870
mov esi, ebp
call fcn.00405540
push 0x32
call ebx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add eax, edx
push eax
push ecx
lea eax, [esp + 0xfc]
mov esi, esp
add edi, ecx
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, edi
mov edx, ebp
call fcn.004062f0
add esp, 8
push 0x4b0
call ebx
jmp case.0x40ad69.1002
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0xf4]
add edx, 0xe6
push edx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00429de0
mov ecx, dword [esp + 0x2c]
add eax, 0x10
add esp, 4
mov edx, ebp
mov dword [esi], eax
call fcn.004062f0
add esp, 8
xor edi, edi
jmp 0x40bc10
push 0xc8
call ebx
mov eax, dword [esp + 0xf4]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov eax, ebp
call fcn.00403f70
add esp, 4
cmp eax, 0x3e9
je 0x40bc4d
inc edi
cmp edi, 7
jle 0x40bc10
mov dword [esp + 0x18], 0
push 0xc8
call ebx
mov eax, dword [esp + 0xf4]
add eax, 0xfffffff0
push eax
call fcn.00429de0
add esp, 4
lea ecx, [esp + 0x8c]
mov esi, eax
mov eax, dword [0x47bb0c]
push ecx
push ebp
add esi, 0x10
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 0x8c]
push edx
push 0
push 0x1fffff
mov dword [esp + 0x44], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x14]
mov edi, eax
lea eax, [esp + 0xd0]
push eax
push 4
lea ecx, [esp + 0x40]
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x80]
push ecx
push ebp
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 0x80]
push edx
push 0
push 0x1fffff
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x14]
mov edi, eax
lea eax, [esp + 0xc4]
push eax
push 4
lea ecx, [esp + 0x3c]
push ecx
add edx, 0x1ec
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x34]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bd4b
mov eax, 0x8b004672
jl 0x40bd52
xor al, 0x83
invalid
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
cmp edi, 0x3e9
je 0x40bd65
adc cl, byte [ebx + 0x40182444]
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 7
mov dword [esp + 0x18], eax
jle 0x40bc55
push 0xc8
call ebx
jmp case.0x40ad69.1002
call fcn.00401ea0
mov edi, edi
jo 0x40bd27
inc eax
add byte [ebp - 0x48], al
inc eax
add byte [eax + esi*4], dh
inc eax
add dh, ah
mov bl, 0x40
add byte [edx - 0x3fffbf4a], ch
test eax, 0x5000040
add eax, 0x5050505
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215041
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84214277
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, -872152315
int3