Function at 0x4205f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48ff78
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x4ae650]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
push esi
push edi
mov eax, dword [0x4ae650]
xor eax, esp
push eax
lea eax, [esp + 0x2a8]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebx + 0x80]
push eax
push 0x5c
push 0xd
mov dword [esp + 0x4c], ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
mov esi, dword [sym.imp.GDI32.dll_GetObjectW]
push eax
call esi
xor eax, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], vtable.CFont.0
push ebx
lea ecx, [esp + 0x248]
mov dword [esp + 0x2b4], eax
call fcn.00454c36
mov byte [esp + 0x2b0], 1
mov ecx, dword [esp + 0x248]
push 0x58
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, 0x2973
mov edi, eax
call fcn.00439be0
imul eax, eax, 0x3c0
cdq
idiv edi
push 0x5c
lea edx, [esp + 0x1e8]
push 0
push edx
mov edi, eax
call fcn.004738b0
add esp, 0xc
push 0
lea eax, [ebx + 0x9c]
push eax
push edi
lea ecx, [esp + 0x44]
call fcn.0045d815
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x1e4]
push ecx
push 0x5c
push edx
call esi
push str.Arial
lea eax, [esp + 0x204]
push 0x20
push eax
call fcn.00471f30
add esp, 0xc
lea ecx, [esp + 0x1e4]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
call fcn.00454d3e
mov edx, dword [ebx + 0xf74]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x20
push 0x141
push edx
mov esi, eax
call edi
mov eax, dword [ebx + 0x154]
push 0
push 0x80
push 0xc5
push eax
call edi
test esi, esi
jne 0x42073b
xor eax, eax
jmp 0x42073e
mov eax, dword [esi + 4]
mov ecx, dword [ebx + 0x1a8]
push 1
push eax
push 0x30
push ecx
call edi
test esi, esi
jne 0x420754
xor eax, eax
jmp 0x420757
mov eax, dword [esi + 4]
mov edx, dword [ebx + 0xecc]
push 1
push eax
push 0x30
push edx
call edi
test esi, esi
jne 0x42076d
xor eax, eax
jmp 0x420770
mov eax, dword [esi + 4]
push 1
push eax
mov eax, dword [ebx + 0xf20]
push 0x30
push eax
call edi
test esi, esi
jne 0x420786
xor eax, eax
jmp 0x420789
mov eax, dword [esi + 4]
mov ecx, dword [ebx + 0x1070]
push 1
push eax
push 0x30
push ecx
call edi
test esi, esi
jne 0x42079f
xor eax, eax
jmp 0x4207a2
mov eax, dword [esi + 4]
mov edx, dword [ebx + 0x101c]
push 1
push eax
push 0x30
push edx
call edi
test esi, esi
jne 0x4207b8
xor eax, eax
jmp 0x4207bb
mov eax, dword [esi + 4]
push 1
push eax
mov eax, dword [ebx + 0x154]
push 0x30
push eax
call edi
test esi, esi
jne 0x4207d1
xor eax, eax
jmp 0x4207d4
mov eax, dword [esi + 4]
mov ecx, dword [ebx + 0xe78]
push 1
push eax
push 0x30
push ecx
call edi
test esi, esi
jne 0x4207ea
xor eax, eax
jmp 0x4207ed
mov eax, dword [esi + 4]
mov edx, dword [ebx + 0xf74]
push 1
push eax
push 0x30
push edx
call edi
test esi, esi
jne 0x420803
xor eax, eax
jmp 0x420806
mov eax, dword [esi + 4]
push 1
push eax
mov eax, dword [ebx + 0xfc8]
push 0x30
push eax
call edi
test esi, esi
jne 0x42081c
xor eax, eax
jmp 0x42081f
mov eax, dword [esi + 4]
mov ecx, dword [ebx + 0x12dc]
push 1
push eax
push 0x30
push ecx
call edi
test esi, esi
jne 0x420835
xor eax, eax
jmp 0x420838
mov eax, dword [esi + 4]
mov edx, dword [ebx + 0x1330]
push 1
push eax
push 0x30
push edx
call edi
test esi, esi
jne 0x42084e
xor eax, eax
jmp 0x420851
mov eax, dword [esi + 4]
push 1
push eax
mov eax, dword [ebx + 0x13a4]
push 0x30
push eax
call edi
test esi, esi
jne 0x420867
xor eax, eax
jmp 0x42086a
mov eax, dword [esi + 4]
mov ecx, dword [ebx + 0x8c8]
push 1
push eax
push 0x30
push ecx
call edi
test esi, esi
jne 0x420880
xor eax, eax
jmp 0x420883
mov eax, dword [esi + 4]
mov edx, dword [ebx + 0xa30]
push 1
push eax
push 0x30
push edx
call edi
test esi, esi
je 0x420898
mov esi, dword [esi + 4]
mov eax, dword [ebx + 0xc9c]
push 1
push esi
push 0x30
push eax
call edi
cmp dword [0x4b2e0c], 0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x499dd0
je 0x420960
call fcn.00406160
push 0xfd
call fcn.00434010
add esp, 8
mov ecx, 0x29cf
mov dword [ebx + 0x74], eax
call fcn.00439dd0
mov ecx, dword [ebx + 0x1a8]
push 0
push 0
push 0xf1
push ecx
mov dword [ebx + 0x7c], eax
call edi
mov edx, dword [ebx + 0xecc]
push 0
push 0
push 0xf1
push edx
call edi
mov eax, dword [ebx + 0xf20]
push 0
push 0
push 0xf1
push eax
call edi
mov ecx, dword [ebx + 0x1070]
push 0
push 0
push 0xf1
push ecx
call edi
mov edx, dword [ebx + 0x101c]
push 0
push 1
push 0xf1
push edx
call edi
mov esi, ebx
mov dword [ebx + 0x158c], 1
call fcn.00425f40
mov eax, dword [ebx + 0x154]
push 0
push 0x2a
push 0xcc
push eax
call edi
jmp 0x420989
call fcn.00406160
push 0xfd
call fcn.00434010
add esp, 8
mov ecx, 0x29cf
mov dword [ebx + 0x74], eax
call fcn.00439dd0
mov esi, ebx
mov dword [ebx + 0x7c], eax
call fcn.00425f40
mov edi, dword [ebx + 0x1dc]
lea esi, [ebx + 0x1dc]
mov ecx, 0x296d
call fcn.00439be0
mov edx, dword [edi + 0x160]
push eax
mov ecx, esi
call edx
mov eax, dword [ebx + 0x2e8]
lea edi, [ebx + 0x2e8]
mov ecx, 0x296d
mov dword [esp + 0x20], eax
call fcn.00439be0
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [edx + 0x160]
mov ecx, edi
call eax
mov ecx, dword [ebx + 0x3f4]
mov dword [esp + 0x20], ecx
mov ecx, 0x296d
call fcn.00439be0
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [edx + 0x160]
lea ecx, [ebx + 0x3f4]
call eax
mov ecx, dword [ebx + 0x500]
mov dword [esp + 0x20], ecx
mov ecx, 0x296d
call fcn.00439be0
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [edx + 0x160]
lea ecx, [ebx + 0x500]
call eax
mov ecx, dword [ebx + 0x60c]
mov dword [esp + 0x20], ecx
mov ecx, 0x296d
call fcn.00439be0
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [edx + 0x160]
lea ecx, [ebx + 0x60c]
call eax
mov ecx, dword [ebx + 0x10a4]
mov dword [esp + 0x20], ecx
mov ecx, 0x296d
call fcn.00439be0
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [edx + 0x160]
lea ecx, [ebx + 0x10a4]
call eax
mov ecx, dword [ebx + 0x11b0]
mov dword [esp + 0x20], ecx
mov ecx, 0x296d
call fcn.00439be0
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [edx + 0x160]
lea ecx, [ebx + 0x11b0]
call eax
mov ecx, dword [ebx + 0x900]
mov dword [esp + 0x20], ecx
mov ecx, 0x296d
call fcn.00439be0
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [edx + 0x160]
lea ecx, [ebx + 0x900]
call eax
mov ecx, dword [ebx + 0xa64]
mov dword [esp + 0x20], ecx
mov ecx, 0x296d
call fcn.00439be0
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [edx + 0x160]
lea ecx, [ebx + 0xa64]
call eax
mov ecx, dword [ebx + 0xb70]
mov dword [esp + 0x20], ecx
mov ecx, 0x296d
call fcn.00439be0
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [edx + 0x160]
lea ecx, [ebx + 0xb70]
call eax
lea ecx, [esp + 0x20]
push 0
push ecx
mov ecx, 0x835
call fcn.00439ca0
add esp, 8
mov byte [esp + 0x2b0], 2
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x14c]
mov ecx, esi
call eax
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420b5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push 0
push ecx
mov ecx, 0x836
call fcn.00439ca0
add esp, 8
mov byte [esp + 0x2b0], 3
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x14c]
mov ecx, edi
call eax
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420bad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push 0
push ecx
mov ecx, 0x837
call fcn.00439ca0
add esp, 8
mov byte [esp + 0x2b0], 4
mov edx, dword [ebx + 0x3f4]
lea ecx, [ebx + 0x3f4]
push eax
mov eax, dword [edx + 0x14c]
call eax
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420c06
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push 0
push ecx
mov ecx, 0x838
call fcn.00439ca0
add esp, 8
mov byte [esp + 0x2b0], 5
mov edx, dword [ebx + 0x500]
lea ecx, [ebx + 0x500]
push eax
mov eax, dword [edx + 0x14c]
call eax
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420c5f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push 0
push ecx
mov ecx, 0x839
call fcn.00439ca0
add esp, 8
mov byte [esp + 0x2b0], 6
mov edx, dword [ebx + 0x60c]
lea ecx, [ebx + 0x60c]
push eax
mov eax, dword [edx + 0x14c]
call eax
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420cb8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push 0
push ecx
mov ecx, 0x83a
call fcn.00439ca0
add esp, 8
mov byte [esp + 0x2b0], 7
mov edx, dword [ebx + 0x10a4]
lea ecx, [ebx + 0x10a4]
push eax
mov eax, dword [edx + 0x14c]
call eax
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420d11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push 0
push ecx
mov ecx, 0x83b
call fcn.00439ca0
add esp, 8
mov byte [esp + 0x2b0], 8
mov edx, dword [ebx + 0x11b0]
lea ecx, [ebx + 0x11b0]
push eax
mov eax, dword [edx + 0x14c]
call eax
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420d6a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push 0
push ecx
mov ecx, 0x83c
call fcn.00439ca0
add esp, 8
mov byte [esp + 0x2b0], 9
mov eax, dword [eax]
lea ecx, [ebx + 0x188]
push eax
call fcn.0045bfea
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x420dbc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push 0
push ecx
mov ecx, 0x83d
call fcn.00439ca0
add esp, 8
mov byte [esp + 0x2b0], 0xa
mov eax, dword [eax]
lea ecx, [ebx + 0xeac]
push eax
call fcn.0045bfea
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x420e0e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push 0
push ecx
mov ecx, 0x83e
call fcn.00439ca0
add esp, 8
mov byte [esp + 0x2b0], 0xb
mov eax, dword [eax]
lea ecx, [ebx + 0xf00]
push eax
call fcn.0045bfea
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x420e60
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push 0
push ecx
mov ecx, 0x83f
call fcn.00439ca0
add esp, 8
mov byte [esp + 0x2b0], 0xc
mov eax, dword [eax]
lea ecx, [ebx + 0xffc]
push eax
call fcn.0045bfea
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x420eb2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
push 0
push ecx
mov ecx, 0x840
call fcn.00439ca0
add esp, 8
mov byte [esp + 0x2b0], 0xd
mov eax, dword [eax]
lea ecx, [ebx + 0x1050]
push eax
mov dword [esp + 0x24], ecx
call fcn.0045bfea
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x420f08
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
push 0
push ecx
mov ecx, 0x5dc
call fcn.00439ca0
add esp, 8
mov byte [esp + 0x2b0], 0xe
mov edx, dword [ebx + 0x900]
lea ecx, [ebx + 0x900]
push eax
mov eax, dword [edx + 0x14c]
call eax
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420f61
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
push 0
push ecx
mov ecx, 0x5dd
call fcn.00439ca0
add esp, 8
mov byte [esp + 0x2b0], 0xf
mov edx, dword [ebx + 0xa64]
lea ecx, [ebx + 0xa64]
push eax
mov eax, dword [edx + 0x14c]
call eax
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420fba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
push 0
push ecx
mov ecx, 0x5de
call fcn.00439ca0
add esp, 8
mov byte [esp + 0x2b0], 0x10
mov edx, dword [ebx + 0xb70]
lea ecx, [ebx + 0xb70]
push eax
mov eax, dword [edx + 0x14c]
call eax
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421013
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x124]
push 0x2819
push ecx
call fcn.00439910
mov esi, eax
mov ecx, 0x17
lea edi, [esp + 0x18c]
rep movsd dword es:[edi], dword [esi]
sub esp, 0x54
lea edx, [ebx + 0x1dc]
mov esi, eax
mov eax, dword [edx]
mov edi, esp
mov ecx, 0x17
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [eax + 0x190]
call edx
mov edx, dword [ebx + 0x2e8]
sub esp, 0x5c
lea eax, [ebx + 0x2e8]
mov edi, esp
mov ecx, 0x17
lea esi, [esp + 0x1e0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [edx + 0x190]
call eax
mov edx, dword [ebx + 0x3f4]
sub esp, 0x5c
lea eax, [ebx + 0x3f4]
mov edi, esp
mov ecx, 0x17
lea esi, [esp + 0x1e0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [edx + 0x190]
call eax
mov edx, dword [ebx + 0x500]
sub esp, 0x5c
lea eax, [ebx + 0x500]
mov edi, esp
mov ecx, 0x17
lea esi, [esp + 0x1e0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [edx + 0x190]
call eax
mov edx, dword [ebx + 0x60c]
sub esp, 0x5c
lea eax, [ebx + 0x60c]
mov edi, esp
mov ecx, 0x17
lea esi, [esp + 0x1e0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [edx + 0x190]
call eax
mov edx, dword [ebx + 0x10a4]
sub esp, 0x5c
lea eax, [ebx + 0x10a4]
mov edi, esp
mov ecx, 0x17
lea esi, [esp + 0x1e0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [edx + 0x190]
call eax
mov edx, dword [ebx + 0x11b0]
sub esp, 0x5c
lea eax, [ebx + 0x11b0]
mov edi, esp
mov ecx, 0x17
lea esi, [esp + 0x1e0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [edx + 0x190]
call eax
mov edx, dword [ebx + 0x900]
lea eax, [ebx + 0x900]
sub esp, 0x5c
mov edi, esp
mov ecx, 0x17
lea esi, [esp + 0x1e0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [edx + 0x190]
call eax
mov edx, dword [ebx + 0xa64]
sub esp, 0x5c
lea eax, [ebx + 0xa64]
mov edi, esp
mov ecx, 0x17
lea esi, [esp + 0x1e0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [edx + 0x190]
call eax
mov edx, dword [ebx + 0xb70]
sub esp, 0x5c
lea eax, [ebx + 0xb70]
mov edi, esp
mov ecx, 0x17
lea esi, [esp + 0x1e0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [edx + 0x190]
call eax
push 0x424
mov ecx, ebx
call fcn.0045bed4
mov edx, dword [eax + 0x20]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x10]
push ecx
push edx
call esi
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00454820
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x718], ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebx + 0x71c], edx
mov dword [ebx + 0x720], eax
mov dword [ebx + 0x724], ecx
push 0x425
mov ecx, ebx
call fcn.0045bed4
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x10]
push edx
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00454820
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0x728], edx
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x72c], eax
mov dword [ebx + 0x730], ecx
push 0x426
mov ecx, ebx
mov dword [ebx + 0x734], edx
call fcn.0045bed4
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call esi
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00454820
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x738], ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebx + 0x73c], edx
mov dword [ebx + 0x740], eax
mov dword [ebx + 0x744], ecx
push 0x427
mov ecx, ebx
call fcn.0045bed4
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x10]
push edx
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00454820
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0x748], edx
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x74c], eax
mov dword [ebx + 0x750], ecx
push 0x428
mov ecx, ebx
mov dword [ebx + 0x754], edx
call fcn.0045bed4
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call esi
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00454820
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x758], ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebx + 0x75c], edx
mov dword [ebx + 0x760], eax
mov dword [ebx + 0x764], ecx
push 0x3f2
mov ecx, ebx
call fcn.0045bed4
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x10]
push edx
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00454820
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0x768], edx
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x76c], eax
mov dword [ebx + 0x770], ecx
push 0x40e
mov ecx, ebx
mov dword [ebx + 0x774], edx
call fcn.0045bed4
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call esi
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00454820
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x788], ecx
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [ebx + 0x78c], edx
mov dword [ebx + 0x790], eax
mov dword [ebx + 0x794], ecx
push 0x40d
mov ecx, ebx
call fcn.0045bed4
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x10]
push edx
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00454820
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0x778], edx
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x77c], eax
mov dword [ebx + 0x780], ecx
push 0x3f3
mov ecx, ebx
mov dword [ebx + 0x784], edx
call fcn.0045bed4
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call esi
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00454820
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x798], ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebx + 0x79c], edx
mov dword [ebx + 0x7a0], eax
mov dword [ebx + 0x7a4], ecx
push 0x3f4
mov ecx, ebx
call fcn.0045bed4
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x10]
push edx
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00454820
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0x7a8], edx
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x7ac], eax
mov dword [ebx + 0x7b0], ecx
push 0x40f
mov ecx, ebx
mov dword [ebx + 0x7b4], edx
call fcn.0045bed4
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call esi
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00454820
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [ebx + 0x7b8], ecx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [ebx + 0x7bc], edx
mov dword [ebx + 0x7c0], eax
mov dword [ebx + 0x7c4], ecx
push 0x410
mov ecx, ebx
call fcn.0045bed4
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x10]
push edx
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00454820
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0x7c8], edx
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x7cc], eax
mov dword [ebx + 0x7d0], ecx
push 0x411
mov ecx, ebx
mov dword [ebx + 0x7d4], edx
call fcn.0045bed4
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call esi
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00454820
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x7d8], ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebx + 0x7dc], edx
mov dword [ebx + 0x7e0], eax
mov dword [ebx + 0x7e4], ecx
push 0x412
mov ecx, ebx
call fcn.0045bed4
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x10]
push edx
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00454820
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0x7e8], edx
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x7ec], eax
mov dword [ebx + 0x7f0], ecx
push 0x42a
mov ecx, ebx
mov dword [ebx + 0x7f4], edx
call fcn.0045bed4
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call esi
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00454820
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [ebx + 0x7f8], ecx
mov dword [ebx + 0x7fc], edx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [ebx + 0x800], eax
mov dword [ebx + 0x804], ecx
push 0x429
mov ecx, ebx
call fcn.0045bed4
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x10]
push edx
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00454820
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0x808], edx
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x80c], eax
mov dword [ebx + 0x810], ecx
push 0x414
mov ecx, ebx
mov dword [ebx + 0x814], edx
call fcn.0045bed4
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call esi
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00454820
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x818], ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebx + 0x81c], edx
mov dword [ebx + 0x820], eax
mov dword [ebx + 0x824], ecx
push 0x413
mov ecx, ebx
call fcn.0045bed4
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x10]
push edx
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00454820
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0x828], edx
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x82c], eax
mov dword [ebx + 0x830], ecx
push 0x415
mov ecx, ebx
mov dword [ebx + 0x834], edx
call fcn.0045bed4
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call esi
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00454820
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x838], ecx
mov dword [ebx + 0x83c], edx
mov ecx, dword [esp + 0x1c]
mov dword [ebx + 0x840], eax
mov dword [ebx + 0x844], ecx
push 0x514
mov ecx, ebx
call fcn.0045bed4
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x10]
push edx
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00454820
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0x848], edx
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x84c], eax
mov dword [ebx + 0x850], ecx
push 0x578
mov ecx, ebx
mov dword [ebx + 0x854], edx
call fcn.0045bed4
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call esi
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00454820
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x858], ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebx + 0x85c], edx
mov dword [ebx + 0x860], eax
mov dword [ebx + 0x864], ecx
push 0x515
mov ecx, ebx
call fcn.0045bed4
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x10]
push edx
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00454820
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0x868], edx
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x86c], eax
mov dword [ebx + 0x870], ecx
push 0x579
mov ecx, ebx
mov dword [ebx + 0x874], edx
call fcn.0045bed4
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call esi
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00454820
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x878], ecx
mov dword [ebx + 0x87c], edx
mov dword [ebx + 0x880], eax
mov ecx, dword [esp + 0x1c]
mov dword [ebx + 0x884], ecx
push 0x516
mov ecx, ebx
call fcn.0045bed4
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x10]
push edx
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00454820
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [ebx + 0x888], edx
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x88c], eax
mov dword [ebx + 0x890], ecx
push 0x57a
mov ecx, ebx
mov dword [ebx + 0x894], edx
call fcn.0045bed4
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call esi
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00454820
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x898], ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebx + 0x89c], edx
mov edx, dword [ebx + 0x718]
mov dword [ebx + 0x8a0], eax
mov dword [ebx + 0x8a4], ecx
mov ecx, dword [ebx + 0x71c]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [ebx + 0x720]
mov dword [eax + 4], ecx
mov ecx, dword [ebx + 0x724]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov ecx, 0x7d1
lea esi, [esp + 0x20]
call fcn.00434410
mov edx, dword [eax]
mov dword [ebx + 0x718], edx
mov ecx, dword [eax + 4]
mov dword [ebx + 0x71c], ecx
mov edx, dword [eax + 8]
mov ecx, dword [ebx + 0x728]
mov dword [ebx + 0x720], edx
mov eax, dword [eax + 0xc]
mov edx, dword [ebx + 0x72c]
mov dword [ebx + 0x724], eax
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x730]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x734]
mov dword [eax + 8], ecx
mov ecx, 0x7d2
lea esi, [esp + 0x20]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x728], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x72c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x730], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x738]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x740]
mov dword [ebx + 0x734], edx
mov edx, dword [ebx + 0x73c]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x744]
mov dword [eax + 8], ecx
mov ecx, 0x7d3
lea esi, [esp + 0x20]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x738], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x73c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x740], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x748]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x750]
mov dword [ebx + 0x744], edx
mov edx, dword [ebx + 0x74c]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x754]
mov dword [eax + 8], ecx
mov ecx, 0x7d4
lea esi, [esp + 0x20]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x748], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x74c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x750], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x758]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x760]
mov dword [ebx + 0x754], edx
mov edx, dword [ebx + 0x75c]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x764]
mov dword [eax + 8], ecx
mov ecx, 0x7d5
lea esi, [esp + 0x20]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x758], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x75c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x760], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x768]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x770]
mov dword [ebx + 0x764], edx
mov edx, dword [ebx + 0x76c]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x774]
mov dword [eax + 8], ecx
mov ecx, 0x7d6
lea esi, [esp + 0x20]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x768], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x76c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x770], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x778]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x780]
mov dword [ebx + 0x774], edx
mov edx, dword [ebx + 0x77c]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x784]
mov dword [eax + 8], ecx
mov ecx, 0x7d7
lea esi, [esp + 0x20]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x778], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x77c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x780], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x788]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x790]
mov dword [ebx + 0x784], edx
mov edx, dword [ebx + 0x78c]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x794]
mov dword [eax + 8], ecx
mov ecx, 0x7d8
lea esi, [esp + 0x20]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x788], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x78c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x790], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x798]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x7a0]
mov dword [ebx + 0x794], edx
mov edx, dword [ebx + 0x79c]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x7a4]
mov dword [eax + 8], ecx
mov ecx, 0x7d9
lea esi, [esp + 0x20]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x798], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x79c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x7a0], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x7a8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x7b0]
mov dword [ebx + 0x7a4], edx
mov edx, dword [ebx + 0x7ac]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x7b4]
mov dword [eax + 8], ecx
mov ecx, 0x7da
lea esi, [esp + 0x20]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x7a8], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x7ac], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x7b0], ecx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0x7b4], edx
mov ecx, dword [ebx + 0x7b8]
mov edx, dword [ebx + 0x7bc]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x7c0]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x7c4]
mov dword [eax + 8], ecx
mov ecx, 0x7db
lea esi, [esp + 0x20]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x7b8], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x7bc], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x7c0], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x7c8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x7d0]
mov dword [ebx + 0x7c4], edx
mov edx, dword [ebx + 0x7cc]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x7d4]
mov dword [eax + 8], ecx
mov ecx, 0x7dc
lea esi, [esp + 0x20]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x7c8], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x7cc], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x7d0], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x7d8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x7e0]
mov dword [ebx + 0x7d4], edx
mov edx, dword [ebx + 0x7dc]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x7e4]
mov dword [eax + 8], ecx
mov ecx, 0x7dd
lea esi, [esp + 0x104]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x7d8], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x7dc], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x7e0], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x7e8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x7f0]
mov dword [ebx + 0x7e4], edx
mov edx, dword [ebx + 0x7ec]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x7f4]
mov dword [eax + 8], ecx
mov ecx, 0x7de
lea esi, [esp + 0xe4]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x7e8], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x7ec], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x7f0], ecx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0x7f4], edx
mov eax, esp
mov ecx, dword [ebx + 0x7f8]
mov edx, dword [ebx + 0x7fc]
mov dword [eax], ecx
mov ecx, dword [ebx + 0x800]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x804]
mov dword [eax + 8], ecx
mov ecx, 0x7df
lea esi, [esp + 0xf4]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x7f8], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x7fc], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x800], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x808]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x810]
mov dword [ebx + 0x804], edx
mov edx, dword [ebx + 0x80c]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x814]
mov dword [eax + 8], ecx
mov ecx, 0x7e0
lea esi, [esp + 0x94]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x808], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x80c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x810], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x818]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x820]
mov dword [ebx + 0x814], edx
mov edx, dword [ebx + 0x81c]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x824]
mov dword [eax + 8], ecx
mov ecx, 0x7e1
lea esi, [esp + 0x64]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x818], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x81c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x820], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x828]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x830]
mov dword [ebx + 0x824], edx
mov edx, dword [ebx + 0x82c]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x834]
mov dword [eax + 8], ecx
mov ecx, 0x7e2
lea esi, [esp + 0xb4]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x828], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x82c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x830], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x838]
mov dword [ebx + 0x834], edx
mov eax, esp
mov edx, dword [ebx + 0x83c]
mov dword [eax], ecx
mov ecx, dword [ebx + 0x840]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x844]
mov dword [eax + 8], ecx
mov ecx, 0x7e3
lea esi, [esp + 0x114]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x838], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x83c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x840], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x848]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x850]
mov dword [ebx + 0x844], edx
mov edx, dword [ebx + 0x84c]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x854]
mov dword [eax + 8], ecx
mov ecx, 0x7e9
lea esi, [esp + 0xd4]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x848], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x84c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x850], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x858]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x860]
mov dword [ebx + 0x854], edx
mov edx, dword [ebx + 0x85c]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x864]
mov dword [eax + 8], ecx
mov ecx, 0x7ec
lea esi, [esp + 0x124]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x858], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x85c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x860], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x868]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x870]
mov dword [ebx + 0x864], edx
mov edx, dword [ebx + 0x86c]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x874]
mov dword [eax + 8], ecx
mov ecx, 0x7ea
lea esi, [esp + 0x74]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x868], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x86c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x870], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x878]
mov eax, esp
mov dword [ebx + 0x874], edx
mov dword [eax], ecx
mov edx, dword [ebx + 0x87c]
mov ecx, dword [ebx + 0x880]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x884]
mov dword [eax + 8], ecx
mov ecx, 0x7ed
lea esi, [esp + 0x84]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x878], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x87c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x880], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x888]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x890]
mov dword [ebx + 0x884], edx
mov edx, dword [ebx + 0x88c]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x894]
mov dword [eax + 8], ecx
mov ecx, 0x7eb
lea esi, [esp + 0xa4]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x888], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x88c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x890], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [ebx + 0x898]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebx + 0x8a0]
mov dword [ebx + 0x894], edx
mov edx, dword [ebx + 0x89c]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x8a4]
mov dword [eax + 8], ecx
mov ecx, 0x7ee
lea esi, [esp + 0xc4]
mov dword [eax + 0xc], edx
call fcn.00434410
mov ecx, dword [eax]
mov dword [ebx + 0x898], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x89c], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x8a0], ecx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0x8a4], edx
mov eax, dword [ebx + 0x71c]
mov edx, dword [ebx + 0x724]
mov ecx, dword [ebx + 0x718]
add esp, 0x10
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x720]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x1dc]
call fcn.0045c075
mov eax, dword [ebx + 0x72c]
mov edx, dword [ebx + 0x734]
mov ecx, dword [ebx + 0x728]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x730]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x2e8]
call fcn.0045c075
mov eax, dword [ebx + 0x73c]
mov edx, dword [ebx + 0x744]
mov ecx, dword [ebx + 0x738]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x740]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x3f4]
call fcn.0045c075
mov eax, dword [ebx + 0x74c]
mov edx, dword [ebx + 0x754]
mov ecx, dword [ebx + 0x748]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x750]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x500]
call fcn.0045c075
mov eax, dword [ebx + 0x75c]
mov edx, dword [ebx + 0x764]
mov ecx, dword [ebx + 0x758]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x760]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x60c]
call fcn.0045c075
mov eax, dword [ebx + 0x76c]
mov edx, dword [ebx + 0x774]
mov ecx, dword [ebx + 0x768]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x770]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x188]
call fcn.0045c075
mov eax, dword [ebx + 0x77c]
mov edx, dword [ebx + 0x784]
mov ecx, dword [ebx + 0x778]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x780]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0xe58]
call fcn.0045c075
mov eax, dword [ebx + 0x78c]
mov edx, dword [ebx + 0x794]
mov ecx, dword [ebx + 0x788]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x790]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x134]
call fcn.0045c075
mov eax, dword [ebx + 0x79c]
mov edx, dword [ebx + 0x7a4]
mov ecx, dword [ebx + 0x798]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x7a0]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0xeac]
call fcn.0045c075
mov eax, dword [ebx + 0x7ac]
mov edx, dword [ebx + 0x7b4]
mov ecx, dword [ebx + 0x7a8]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x7b0]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0xf00]
call fcn.0045c075
mov eax, dword [ebx + 0x7bc]
mov edx, dword [ebx + 0x7c4]
mov ecx, dword [ebx + 0x7b8]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x7c0]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0xf54]
call fcn.0045c075
mov eax, dword [ebx + 0x7cc]
mov edx, dword [ebx + 0x7d4]
mov ecx, dword [ebx + 0x7c8]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x7d0]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0xfa8]
call fcn.0045c075
mov eax, dword [ebx + 0x7dc]
mov edx, dword [ebx + 0x7e4]
mov ecx, dword [ebx + 0x7d8]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x7e0]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0xffc]
call fcn.0045c075
mov eax, dword [ebx + 0x7ec]
mov edx, dword [ebx + 0x7f4]
mov ecx, dword [ebx + 0x7e8]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x7f0]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x34]
call fcn.0045c075
mov eax, dword [ebx + 0x7fc]
mov ecx, dword [ebx + 0x7f8]
push 1
mov edx, dword [ebx + 0x804]
sub edx, eax
push edx
mov edx, dword [ebx + 0x800]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x11b0]
call fcn.0045c075
mov eax, dword [ebx + 0x80c]
mov edx, dword [ebx + 0x814]
mov ecx, dword [ebx + 0x808]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x810]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x10a4]
call fcn.0045c075
mov eax, dword [ebx + 0x81c]
mov edx, dword [ebx + 0x824]
mov ecx, dword [ebx + 0x818]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x820]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x1310]
call fcn.0045c075
mov eax, dword [ebx + 0x82c]
mov edx, dword [ebx + 0x834]
mov ecx, dword [ebx + 0x828]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x830]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x12bc]
call fcn.0045c075
mov eax, dword [ebx + 0x83c]
mov edx, dword [ebx + 0x844]
mov ecx, dword [ebx + 0x838]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x840]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x1384]
call fcn.0045c075
mov eax, dword [ebx + 0x84c]
mov edx, dword [ebx + 0x854]
mov ecx, dword [ebx + 0x848]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x850]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x900]
call fcn.0045c075
mov eax, dword [ebx + 0x85c]
mov edx, dword [ebx + 0x864]
mov ecx, dword [ebx + 0x858]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x860]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0x8a8]
call fcn.0045c075
mov eax, dword [ebx + 0x86c]
mov edx, dword [ebx + 0x874]
mov ecx, dword [ebx + 0x868]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x870]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0xa64]
call fcn.0045c075
mov eax, dword [ebx + 0x87c]
mov edx, dword [ebx + 0x884]
mov ecx, dword [ebx + 0x878]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x880]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0xa10]
call fcn.0045c075
mov eax, dword [ebx + 0x88c]
mov edx, dword [ebx + 0x894]
mov ecx, dword [ebx + 0x888]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x890]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0xb70]
call fcn.0045c075
mov eax, dword [ebx + 0x89c]
mov edx, dword [ebx + 0x8a4]
mov ecx, dword [ebx + 0x898]
push 1
sub edx, eax
push edx
mov edx, dword [ebx + 0x8a0]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [ebx + 0xc7c]
call fcn.0045c075
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x499dd0
call fcn.00406160
push 0x161
call fcn.00434010
add esp, 4
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x499dd0
mov edi, eax
call fcn.00406160
push 0x162
call fcn.00434010
add esp, 4
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x499dd0
mov dword [esp + 0x3c], eax
call fcn.00406160
push 0x163
call fcn.00434010
add esp, 4
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x499dd0
mov dword [esp + 0x38], eax
call fcn.00406160
push 0x164
call fcn.00434010
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub esp, 8
mov dword [esp + 0x34], eax
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [eax + 8], ecx
mov ecx, 0x7e8
lea esi, [esp + 0x54]
mov dword [eax + 0xc], edx
call fcn.00434410
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov esi, dword [esp + 0x40]
mov dword [esp + 0x24], edx
mov edx, dword [eax + 0xc]
add ebx, 0x13dc
add esp, 0x10
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 8]
push ebx
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x1c], ecx
call fcn.0043d4f0
mov esi, dword [esp + 0x2c]
mov dword [esi + 0xa8], 1
mov eax, dword [esi + 0x70]
test eax, eax
je 0x422713
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
mov dword [esi + 0x70], 0
call fcn.0045e249
mov eax, dword [eax + 0xc]
push 0
push 0
push 0
push 2
push 0x86
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x70], eax
mov eax, dword [esp + 0x1c]
push 4
sub eax, ebx
sub ecx, edi
inc eax
push eax
inc ecx
push ecx
push ebx
push edi
push 0
mov ecx, esi
call fcn.0045c340
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x499dd0
call fcn.00406160
push 0x119
call fcn.00434010
add esp, 4
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x499dd0
mov dword [esp + 0x34], eax
call fcn.00406160
push 0x11a
call fcn.00434010
add esp, 4
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x499dd0
mov dword [esp + 0x3c], eax
call fcn.00406160
push 0x117
call fcn.00434010
add esp, 4
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x499dd0
mov dword [esp + 0x38], eax
call fcn.00406160
push 0x118
call fcn.00434010
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
sub esp, 8
mov dword [esp + 0x34], eax
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], ebx
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov ecx, 0x7e7
lea esi, [esp + 0x54]
call fcn.00434410
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [esp + 0x20], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x50]
add esp, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
add eax, 0x14b4
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x34]
mov edx, dword [esp + 0x24]
push eax
mov dword [esp + 0x2c], eax
call fcn.0043d4f0
mov esi, dword [esp + 0x28]
mov edi, 1
mov dword [esi + 0xa8], edi
mov eax, dword [esi + 0x70]
test eax, eax
je 0x422864
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
mov dword [esi + 0x70], 0
call fcn.0045e249
mov eax, dword [eax + 0xc]
push 0
push 0
push 0
push 2
push 0x86
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x70], eax
mov eax, dword [esp + 0x1c]
sub eax, edx
push 4
add eax, edi
push eax
mov eax, dword [esp + 0x20]
sub eax, ecx
add eax, edi
push eax
push edx
push ecx
push 0
mov ecx, esi
call fcn.0045c340
mov ebx, dword [esp + 0x40]
push ebx
call fcn.00427580
cmp dword [0x4b2df8], edi
jne 0x4228ce
mov ecx, dword [esp + 0x20]
push 0
call fcn.0045c0b5
cmp dword [0x4b2e0c], 0
jne 0x4228de
mov ecx, ebx
call fcn.00422940
call fcn.00426370
lea ecx, [esp + 0x244]
mov byte [esp + 0x2b0], 0
call fcn.00454c8a
mov dword [esp + 0x2b0], 0xffffffff
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], vtable.CFont.0
call fcn.00406650
mov ecx, dword [esp + 0x2a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x290]
xor ecx, esp
call fcn.00471ad7
mov esp, ebp
pop ebp
ret