Function at 0x4146b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x4146b8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x415901
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [0x415910]
call fcn.004068b8
test al, al
jne 0x4146ef
mov eax, ebx
call fcn.0040dc64
test al, al
je 0x414719
mov eax, dword [ebx + 0x7c]
mov edx, 0x41591c
call fcn.004096c0
mov eax, dword [ebx + 0x84]
mov edx, 0x41591c
call fcn.004096c0
mov eax, dword [ebx + 0xc4]
xor edx, edx
call fcn.00408690
call fcn.004045c0
test eax, eax
jle 0x414738
lea eax, [ebp - 0x40]
call fcn.004066bc
mov edx, dword [ebp - 0x34]
inc edx
mov eax, dword [ebx + 0x18]
call fcn.00409118
jmp 0x41475e
mov eax, dword [ebx + 0x18]
call fcn.00409164
push eax
lea eax, [ebp - 0x40]
call fcn.004066bc
mov edx, dword [ebp - 0x34]
pop eax
sub edx, eax
sar edx, 1
jns 0x414756
adc edx, 0
mov eax, dword [ebx + 0x18]
call fcn.00409118
mov eax, dword [ebx + 0x18]
mov edx, 0x415928
call fcn.00408d34
push 0
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x28]
push eax
call sub.user32.dll_GetSystemMenu
mov esi, eax
push 0x415910
push 0
push 0x800
push esi
call sub.user32.dll_AppendMenuA
mov eax, dword [ebx + 0x104]
sub eax, 0x404
je 0x4147c7
sub eax, 0x400
jne 0x4147ed
push 0x415938
push 0x402
push 0
push esi
call sub.user32.dll_AppendMenuA
push 0x415948
push 0x401
push 8
push esi
call sub.user32.dll_AppendMenuA
jmp 0x414811
push 0x415954
push 0x402
push 0
push esi
call sub.user32.dll_AppendMenuA
push 0x415960
push 0x401
push 8
push esi
call sub.user32.dll_AppendMenuA
jmp 0x414811
push 0x41596c
push 0x402
push 0
push esi
call sub.user32.dll_AppendMenuA
push 0x415984
push 0x401
push 8
push esi
call sub.user32.dll_AppendMenuA
lea eax, [ebp - 0x44]
call fcn.00404660
mov edx, dword [ebp - 0x44]
mov eax, dword [ebx + 0xa8]
add eax, 0x21
call fcn.0040304c
call fcn.004054a4
mov dword [ebx + 0xdc], eax
call fcn.004054a4
mov dword [ebx + 0xe4], eax
call fcn.004054a4
mov dword [ebx + 0xe8], eax
call fcn.004054a4
mov dword [ebx + 0xec], eax
call fcn.004054a4
mov dword [ebx + 0xe0], eax
push 0x9a
mov eax, dword [ebx + 0x54]
mov ecx, 0x101d
xor edx, edx
call fcn.00409e84
push 0x9b
mov eax, dword [ebx + 0x54]
mov ecx, 0x101d
mov edx, 1
call fcn.00409e84
lea eax, [ebx + 0x480]
mov edx, 0x415998
call fcn.0040304c
lea eax, [ebx + 0x484]
mov edx, 0x4159ac
call fcn.0040304c
lea eax, [ebx + 0x488]
mov edx, 0x4159b8
call fcn.0040304c
lea eax, [ebx + 0x48c]
mov edx, 0x4159c4
call fcn.0040304c
lea eax, [ebx + 0x490]
mov edx, 0x4159d4
call fcn.0040304c
lea eax, [ebx + 0x494]
mov edx, 0x4159e8
call fcn.0040304c
mov eax, dword [ebx + 0x104]
cmp eax, 0x404
jne 0x414bc4
mov dword [ebp - 0x30], 1
mov eax, 0x4159f0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 0
push 0x1306
mov eax, dword [ebx + 0x58]
push eax
call fcn.00409e5c
mov eax, 0x4159f8
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 1
push 0x1306
mov eax, dword [ebx + 0x58]
push eax
call fcn.00409e5c
mov eax, 0x415a00
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 2
push 0x1306
mov eax, dword [ebx + 0x58]
push eax
call fcn.00409e5c
lea eax, [ebx + 0x480]
mov edx, 0x415a10
call fcn.0040304c
lea eax, [ebx + 0x484]
mov edx, 0x415a24
call fcn.0040304c
lea eax, [ebx + 0x488]
mov edx, 0x415a30
call fcn.0040304c
lea eax, [ebx + 0x48c]
mov edx, 0x415a3c
call fcn.0040304c
lea eax, [ebx + 0x490]
mov edx, 0x415a4c
call fcn.0040304c
lea eax, [ebx + 0x494]
mov edx, 0x415a60
call fcn.0040304c
mov eax, dword [ebx + 0x18]
mov edx, 0x415a70
call fcn.00408d34
mov eax, dword [ebx + 0x18]
call fcn.004092f4
xor edx, edx
call fcn.0040418c
mov eax, dword [ebx + 0x68]
mov edx, 0x415a88
call fcn.00408d34
mov eax, dword [ebx + 0x88]
mov edx, 0x415a9c
call fcn.00408d34
mov eax, dword [ebx + 0xac]
mov edx, 0x415ab4
call fcn.00408d34
mov eax, dword [ebx + 0xc8]
mov edx, 0x415ac8
call fcn.00408d34
mov eax, dword [ebx + 0x94]
mov edx, 0x415ae0
call fcn.00408d34
mov eax, dword [ebx + 0x98]
mov edx, 0x415af0
call fcn.00408d34
mov eax, dword [ebx + 0x8c]
call fcn.00405c08
mov eax, dword [ebx + 0x8c]
mov edx, 0x415b04
call fcn.004096c0
mov eax, dword [ebx + 0x8c]
mov edx, 0x415b1c
call fcn.004096c0
mov eax, dword [ebx + 0x8c]
mov edx, 0x415b34
call fcn.004096c0
mov eax, dword [ebx + 0x6c]
mov edx, 0x415b4c
call fcn.00408d34
mov eax, dword [ebx + 0x70]
mov edx, 0x415b64
call fcn.00408d34
mov eax, dword [ebx + 0x40]
mov edx, 0x415b7c
call fcn.00408d34
mov eax, dword [ebx + 0x44]
mov edx, 0x415b8c
call fcn.00408d34
mov eax, dword [ebx + 0x24]
mov edx, 0x415b9c
call fcn.00408d34
mov eax, dword [ebx + 0x28]
mov edx, 0x415bac
call fcn.00408d34
mov eax, dword [ebx + 0x2c]
mov edx, 0x415bbc
call fcn.00408d34
mov eax, dword [ebx + 0x38]
mov edx, 0x415bcc
call fcn.00408d34
mov eax, dword [ebx + 0x50]
mov edx, 0x415bdc
call fcn.00408d34
mov eax, dword [ebx + 0x48]
mov edx, 0x415bec
call fcn.00408d34
mov eax, dword [ebx + 0x4c]
mov edx, 0x415bfc
call fcn.00408d34
lea edx, [ebp - 0x48]
mov eax, dword [ebx + 0x48]
call fcn.0040507c
mov edx, dword [ebp - 0x48]
mov eax, dword [ebx + 0x90]
call fcn.00408d34
mov eax, dword [ebx + 0x54]
mov ecx, 0x415c0c
xor edx, edx
call fcn.004059b4
mov eax, dword [ebx + 0x54]
mov ecx, 0x415bec
mov edx, 1
call fcn.004059b4
mov eax, dword [ebx + 0xc4]
mov edx, 0x415c1c
call fcn.00408d34
mov eax, dword [ebx + 0xcc]
mov edx, 0x415b9c
call fcn.00408d34
mov eax, dword [ebx + 0x30]
mov edx, 0x415c2c
call fcn.00408d34
mov eax, dword [ebx + 0x78]
mov edx, 0x415c3c
call fcn.00408d34
mov eax, dword [ebx + 0x80]
mov edx, 0x415c54
call fcn.00408d34
mov eax, dword [ebx + 0xa0]
mov edx, 0x415c6c
call fcn.00408d34
mov eax, dword [ebx + 0xb0]
mov edx, 0x415c84
call fcn.00408d34
mov eax, dword [ebx + 0xb4]
mov edx, 0x415c9c
call fcn.00408d34
mov eax, dword [ebx + 0xd4]
mov edx, 0x415cb0
call fcn.00408d34
jmp 0x414e91
cmp eax, 0x804
je 0x414e91
mov dword [ebp - 0x30], 1
mov eax, 0x415cbc
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 0
push 0x1306
mov eax, dword [ebx + 0x58]
push eax
call fcn.00409e5c
mov eax, 0x415cc4
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 1
push 0x1306
mov eax, dword [ebx + 0x58]
push eax
call fcn.00409e5c
mov eax, 0x415ccc
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 2
push 0x1306
mov eax, dword [ebx + 0x58]
push eax
call fcn.00409e5c
lea eax, [ebx + 0x480]
mov edx, 0x415ce0
call fcn.0040304c
lea eax, [ebx + 0x484]
mov edx, 0x415cfc
call fcn.0040304c
lea eax, [ebx + 0x488]
mov edx, 0x415d0c
call fcn.0040304c
lea eax, [ebx + 0x48c]
mov edx, 0x415d1c
call fcn.0040304c
lea eax, [ebx + 0x490]
mov edx, 0x415d30
call fcn.0040304c
lea eax, [ebx + 0x494]
mov edx, 0x415d50
call fcn.0040304c
mov eax, dword [ebx + 0x18]
mov edx, 0x415d5c
call fcn.00408d34
mov eax, dword [ebx + 0x18]
call fcn.004092f4
xor edx, edx
call fcn.0040418c
mov eax, dword [ebx + 0x68]
mov edx, 0x415d70
call fcn.00408d34
mov eax, dword [ebx + 0x88]
mov edx, 0x415d84
call fcn.00408d34
mov eax, dword [ebx + 0xac]
mov edx, 0x415da4
call fcn.00408d34
mov eax, dword [ebx + 0xc8]
mov edx, 0x415db8
call fcn.00408d34
mov eax, dword [ebx + 0x94]
mov edx, 0x415dd8
call fcn.00408d34
mov eax, dword [ebx + 0x98]
mov edx, 0x415de8
call fcn.00408d34
mov eax, dword [ebx + 0x8c]
call fcn.00405c08
mov eax, dword [ebx + 0x8c]
mov edx, 0x415e04
call fcn.004096c0
mov eax, dword [ebx + 0x8c]
mov edx, 0x415e20
call fcn.004096c0
mov eax, dword [ebx + 0x8c]
mov edx, 0x415e38
call fcn.004096c0
mov eax, dword [ebx + 0x6c]
mov edx, 0x415e50
call fcn.00408d34
mov eax, dword [ebx + 0x70]
mov edx, 0x415e68
call fcn.00408d34
mov eax, dword [ebx + 0x40]
mov edx, 0x415e80
call fcn.00408d34
mov eax, dword [ebx + 0x44]
mov edx, 0x415e8c
call fcn.00408d34
mov eax, dword [ebx + 0x24]
mov edx, 0x415e9c
call fcn.00408d34
mov eax, dword [ebx + 0x28]
mov edx, 0x415eac
call fcn.00408d34
mov eax, dword [ebx + 0x2c]
mov edx, 0x415ebc
call fcn.00408d34
mov eax, dword [ebx + 0x38]
mov edx, 0x415ec8
call fcn.00408d34
mov eax, dword [ebx + 0x50]
mov edx, 0x415ed8
call fcn.00408d34
mov eax, dword [ebx + 0x48]
mov edx, 0x415eec
call fcn.00408d34
mov eax, dword [ebx + 0x4c]
mov edx, 0x415efc
call fcn.00408d34
lea edx, [ebp - 0x4c]
mov eax, dword [ebx + 0x48]
call fcn.0040507c
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebx + 0x90]
call fcn.00408d34
mov eax, dword [ebx + 0x54]
mov ecx, 0x415f10
xor edx, edx
call fcn.004059b4
mov eax, dword [ebx + 0x54]
mov ecx, 0x415f20
mov edx, 1
call fcn.004059b4
mov eax, dword [ebx + 0xc4]
mov edx, 0x415f30
call fcn.00408d34
mov eax, dword [ebx + 0xcc]
mov edx, 0x415f40
call fcn.00408d34
mov eax, dword [ebx + 0x30]
mov edx, 0x415f50
call fcn.00408d34
mov eax, dword [ebx + 0x78]
mov edx, 0x415f60
call fcn.00408d34
mov eax, dword [ebx + 0x80]
mov edx, 0x415f80
call fcn.00408d34
mov eax, dword [ebx + 0xa0]
mov edx, 0x415fa0
call fcn.00408d34
mov eax, dword [ebx + 0xb0]
mov edx, 0x415fb4
call fcn.00408d34
mov eax, dword [ebx + 0xb4]
mov edx, 0x415fcc
call fcn.00408d34
mov eax, dword [ebx + 0xd4]
mov edx, 0x415fe0
call fcn.00408d34
lea edx, [ebp - 0x50]
mov eax, dword [ebx + 0x18]
call fcn.0040507c
mov edx, dword [ebp - 0x50]
mov eax, dword [0x41c528]
mov eax, dword [eax]
call fcn.00408d34
lea edx, [ebp - 0x54]
mov eax, dword [ebx + 0x18]
call fcn.0040507c
lea eax, [ebp - 0x54]
mov edx, 0x415ff8
call fcn.00403184
mov edx, dword [ebp - 0x54]
mov eax, dword [ebx + 0x18]
call fcn.00408d34
xor esi, esi
lea edi, [ebx + 0x190]
lea edx, [ebp - 0x58]
mov eax, esi
call fcn.004077c0
mov edx, dword [ebp - 0x58]
mov eax, edi
call fcn.0040304c
lea edx, [ebp - 0x5c]
lea eax, [esi + 0x1e]
call fcn.004077c0
mov edx, dword [ebp - 0x5c]
lea eax, [edi + 4]
call fcn.0040304c
inc esi
add edi, 8
cmp esi, 0xa
jne 0x414ed6
lea eax, [ebx + 0x1e0]
mov edx, 0x416008
call fcn.0040304c
lea eax, [ebx + 0x1e4]
mov edx, 0x416018
call fcn.0040304c
mov esi, 1
lea edx, [ebp - 0x60]
mov eax, esi
call fcn.004077c0
mov ecx, dword [ebp - 0x60]
lea edi, [esi + 0xb]
lea eax, [ebx + edi*8 + 0x188]
mov edx, 0x416024
call fcn.004031c8
lea ecx, [ebp - 0x64]
lea eax, [esi + 0x6f]
mov edx, 2
call fcn.00407754
mov edx, dword [ebp - 0x64]
lea eax, [ebx + edi*8 + 0x18c]
call fcn.0040304c
inc esi
cmp esi, 0xd
jne 0x414f2e
mov esi, 1
lea eax, [esi + 0x17]
lea eax, [ebx + eax*8 + 0x188]
lea edi, [esi + 0x40]
mov edx, edi
call fcn.00403118
lea ecx, [ebp - 0x68]
mov eax, edi
mov edx, 2
call fcn.00407754
mov edx, dword [ebp - 0x68]
lea eax, [esi + 0x17]
lea eax, [ebx + eax*8 + 0x18c]
call fcn.0040304c
inc esi
cmp esi, 0x1b
jne 0x414f79
lea eax, [ebx + 0x318]
mov edx, 0x416030
call fcn.0040304c
lea eax, [ebx + 0x31c]
mov edx, 0x41603c
call fcn.0040304c
lea eax, [ebx + 0x320]
mov edx, 0x416048
call fcn.0040304c
lea eax, [ebx + 0x324]
mov edx, 0x416054
call fcn.0040304c
lea eax, [ebx + 0x328]
mov edx, 0x416060
call fcn.0040304c
lea eax, [ebx + 0x32c]
mov edx, 0x41606c
call fcn.0040304c
lea eax, [ebx + 0x330]
mov edx, 0x416078
call fcn.0040304c
lea eax, [ebx + 0x334]
mov edx, 0x416084
call fcn.0040304c
lea eax, [ebx + 0x338]
mov edx, 0x416090
call fcn.0040304c
lea eax, [ebx + 0x33c]
mov edx, 0x41609c
call fcn.0040304c
lea eax, [ebx + 0x340]
mov edx, 0x4160a8
call fcn.0040304c
lea eax, [ebx + 0x344]
mov edx, 0x4160b4
call fcn.0040304c
lea eax, [ebx + 0x348]
mov edx, 0x41591c
call fcn.0040304c
lea eax, [ebx + 0x34c]
mov edx, 0x4160c0
call fcn.0040304c
lea eax, [ebx + 0x350]
mov edx, 0x4160cc
call fcn.0040304c
lea eax, [ebx + 0x354]
mov edx, 0x4160d8
call fcn.0040304c
lea eax, [ebx + 0x358]
mov edx, 0x4160e4
call fcn.0040304c
lea eax, [ebx + 0x35c]
mov edx, 0x4160f0
call fcn.0040304c
lea eax, [ebx + 0x360]
mov edx, 0x4160fc
call fcn.0040304c
lea eax, [ebx + 0x364]
mov edx, 0x416108
call fcn.0040304c
lea eax, [ebx + 0x368]
mov edx, 0x416114
call fcn.0040304c
lea eax, [ebx + 0x36c]
mov edx, 0x416120
call fcn.0040304c
lea eax, [ebx + 0x370]
mov edx, 0x41612c
call fcn.0040304c
lea eax, [ebx + 0x374]
mov edx, 0x416140
call fcn.0040304c
lea eax, [ebx + 0x378]
mov edx, 0x41614c
call fcn.0040304c
lea eax, [ebx + 0x37c]
mov edx, 0x416158
call fcn.0040304c
lea eax, [ebx + 0x380]
mov edx, 0x416164
call fcn.0040304c
lea eax, [ebx + 0x384]
mov edx, 0x416174
call fcn.0040304c
lea eax, [ebx + 0x388]
mov edx, 0x416180
call fcn.0040304c
lea eax, [ebx + 0x38c]
mov edx, 0x416190
call fcn.0040304c
lea eax, [ebx + 0x390]
mov edx, 0x41619c
call fcn.0040304c
lea eax, [ebx + 0x394]
mov edx, 0x4161b0
call fcn.0040304c
lea eax, [ebx + 0x398]
mov edx, 0x4161bc
call fcn.0040304c
lea eax, [ebx + 0x39c]
mov edx, 0x4161c8
call fcn.0040304c
lea eax, [ebx + 0x3a0]
mov edx, 0x4161d4
call fcn.0040304c
lea eax, [ebx + 0x3a4]
mov edx, 0x4161e4
call fcn.0040304c
lea eax, [ebx + 0x3a8]
mov edx, 0x4161f0
call fcn.0040304c
lea eax, [ebx + 0x3ac]
mov edx, 0x416200
call fcn.0040304c
lea eax, [ebx + 0x3b0]
mov edx, 0x41620c
call fcn.0040304c
lea eax, [ebx + 0x3b4]
mov edx, 0x416218
call fcn.0040304c
lea eax, [ebx + 0x3b8]
mov edx, 0x416224
call fcn.0040304c
lea eax, [ebx + 0x3bc]
mov edx, 0x416234
call fcn.0040304c
lea eax, [ebx + 0x3c0]
mov edx, 0x416240
call fcn.0040304c
lea eax, [ebx + 0x3c4]
mov edx, 0x416250
call fcn.0040304c
lea eax, [ebx + 0x3c8]
mov edx, 0x41625c
call fcn.0040304c
lea eax, [ebx + 0x3cc]
mov edx, 0x416268
call fcn.0040304c
lea eax, [ebx + 0x3d0]
mov edx, 0x416274
call fcn.0040304c
lea eax, [ebx + 0x3d4]
mov edx, 0x416280
call fcn.0040304c
lea eax, [ebx + 0x3d8]
mov edx, 0x41628c
call fcn.0040304c
lea eax, [ebx + 0x3dc]
mov edx, 0x4162a0
call fcn.0040304c
lea eax, [ebx + 0x3e0]
mov edx, 0x4162ac
call fcn.0040304c
lea eax, [ebx + 0x3e4]
mov edx, 0x4162c4
call fcn.0040304c
lea eax, [ebx + 0x3e8]
mov edx, 0x4162d0
call fcn.0040304c
lea eax, [ebx + 0x3ec]
mov edx, 0x4162e0
call fcn.0040304c
xor esi, esi
lea edx, [ebp - 0x6c]
mov eax, esi
call fcn.004077c0
mov ecx, dword [ebp - 0x6c]
lea edi, [esi + 0x4d]
lea eax, [ebx + edi*8 + 0x188]
mov edx, 0x4162ec
call fcn.004031c8
lea edx, [ebp - 0x70]
lea eax, [esi + 0x3c]
call fcn.004077c0
mov edx, dword [ebp - 0x70]
lea eax, [ebx + edi*8 + 0x18c]
call fcn.0040304c
inc esi
cmp esi, 0xa
jne 0x415316
lea eax, [ebx + 0x440]
mov edx, 0x4162fc
call fcn.0040304c
lea eax, [ebx + 0x444]
mov edx, 0x416310
call fcn.0040304c
lea eax, [ebx + 0x448]
mov edx, 0x41631c
call fcn.0040304c
lea eax, [ebx + 0x44c]
mov edx, 0x416330
call fcn.0040304c
lea eax, [ebx + 0x450]
mov edx, 0x41633c
call fcn.0040304c
lea eax, [ebx + 0x454]
mov edx, 0x416350
call fcn.0040304c
lea eax, [ebx + 0x458]
mov edx, 0x41635c
call fcn.0040304c
lea eax, [ebx + 0x45c]
mov edx, 0x416370
call fcn.0040304c
lea eax, [ebx + 0x460]
mov edx, 0x41637c
call fcn.0040304c
lea eax, [ebx + 0x464]
mov edx, 0x416390
call fcn.0040304c
mov eax, dword [ebx + 0xd4]
call fcn.004092f4
mov ecx, 0xfffffff4
mov edx, 4
call fcn.004073c4
mov ax, word [0x416394]
call fcn.004068b8
test al, al
jne 0x41546b
mov ax, word [0x416398]
call fcn.004068b8
test al, al
jne 0x41546b
mov ax, word [0x41639c]
call fcn.004068b8
test al, al
jne 0x41546b
mov ax, word [0x4163a0]
call fcn.004068b8
test al, al
jne 0x41546b
mov ax, word [0x415910]
call fcn.004068b8
test al, al
jne 0x41546b
mov eax, ebx
call fcn.0040dc64
test al, al
je 0x4156ea
mov eax, dword [ebx + 0x18]
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
mov eax, dword [ebx + 0x18]
call fcn.00409e7c
mov edi, eax
dec edi
test edi, edi
jl 0x4154b6
inc edi
xor esi, esi
mov eax, dword [ebx + 0x18]
mov edx, esi
call fcn.0040512c
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
inc esi
dec edi
jne 0x415494
mov eax, dword [ebx + 0x58]
call fcn.00409e7c
mov edi, eax
dec edi
test edi, edi
jl 0x4154ea
inc edi
xor esi, esi
mov eax, dword [ebx + 0x58]
mov edx, esi
call fcn.0040512c
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
inc esi
dec edi
jne 0x4154c8
mov eax, dword [ebx + 0xd4]
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
mov eax, dword [ebx + 0x68]
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
mov eax, dword [ebx + 0x68]
call fcn.00409e7c
mov edi, eax
dec edi
test edi, edi
jl 0x41554f
inc edi
xor esi, esi
mov eax, dword [ebx + 0x68]
mov edx, esi
call fcn.0040512c
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
inc esi
dec edi
jne 0x41552d
mov eax, dword [ebx + 0x88]
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
mov eax, dword [ebx + 0x88]
call fcn.00409e7c
mov edi, eax
dec edi
test edi, edi
jl 0x4155a3
inc edi
xor esi, esi
mov eax, dword [ebx + 0x88]
mov edx, esi
call fcn.0040512c
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
inc esi
dec edi
jne 0x41557e
mov eax, dword [ebx + 0xac]
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
mov eax, dword [ebx + 0xac]
call fcn.00409e7c
mov edi, eax
dec edi
test edi, edi
jl 0x4155f7
inc edi
xor esi, esi
mov eax, dword [ebx + 0xac]
mov edx, esi
call fcn.0040512c
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
inc esi
dec edi
jne 0x4155d2
mov eax, dword [ebx + 0xc8]
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
mov eax, dword [ebx + 0xc8]
call fcn.00409e7c
mov edi, eax
dec edi
test edi, edi
jl 0x41564b
inc edi
xor esi, esi
mov eax, dword [ebx + 0xc8]
mov edx, esi
call fcn.0040512c
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
inc esi
dec edi
jne 0x415626
mov eax, dword [ebx + 0x74]
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
mov eax, dword [ebx + 0x74]
call fcn.00409e7c
mov edi, eax
dec edi
test edi, edi
jl 0x415696
inc edi
xor esi, esi
mov eax, dword [ebx + 0x74]
mov edx, esi
call fcn.0040512c
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
inc esi
dec edi
jne 0x415674
mov eax, dword [ebx + 0x94]
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
mov eax, dword [ebx + 0x94]
call fcn.00409e7c
mov edi, eax
dec edi
test edi, edi
jl 0x4156ea
inc edi
xor esi, esi
mov eax, dword [ebx + 0x94]
mov edx, esi
call fcn.0040512c
call fcn.004092f4
mov ecx, 0xfffffff5
mov edx, 4
call fcn.004073c4
inc esi
dec edi
jne 0x4156c5
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040dc8c
call fcn.004045c0
test eax, eax
jle 0x415707
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00418d20
mov eax, dword [ebx + 0xdc]
mov esi, dword [eax + 0x1c]
dec esi
cmp esi, 0
jl 0x4158cc
lea ecx, [ebp - 0x7c]
mov eax, dword [ebx + 0xdc]
mov edx, esi
call fcn.00409b00
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
mov edx, 0x4163ac
call fcn.004031c8
mov edx, dword [ebp - 0x78]
mov eax, 0x80000002
call fcn.004046d8
lea ecx, [ebp - 0x74]
mov edx, 0x4163e8
call fcn.00404808
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0x10]
call fcn.004078ac
cmp dword [ebp - 0x10], 0
je 0x4158c2
mov eax, esi
dec eax
cmp eax, 0
jl 0x4158c2
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x8c]
mov eax, dword [ebx + 0xdc]
mov edx, dword [ebp - 8]
call fcn.00409b00
mov ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x88]
mov edx, 0x4163ac
call fcn.004031c8
mov edx, dword [ebp - 0x88]
mov eax, 0x80000002
call fcn.004046d8
lea ecx, [ebp - 0x84]
mov edx, 0x4163e8
call fcn.00404808
mov eax, dword [ebp - 0x84]
lea edx, [ebp - 0x80]
call fcn.004078ac
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x10]
call fcn.004032c8
jne 0x4158b5
lea ecx, [ebp - 0x94]
mov eax, dword [ebx + 0xdc]
mov edx, esi
call fcn.00409b00
mov ecx, dword [ebp - 0x94]
lea eax, [ebp - 0x90]
mov edx, 0x4163ac
call fcn.004031c8
mov edx, dword [ebp - 0x90]
mov eax, 0x80000002
call fcn.004048f0
mov eax, dword [ebx + 0x54]
mov edx, esi
call fcn.00406e28
lea ecx, [ebp - 0x14]
mov eax, dword [ebx + 0xdc]
mov edx, esi
call fcn.00409b00
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004100d4
mov eax, dword [ebx + 0xe0]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x4158b5
inc edi
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x98]
mov eax, dword [ebx + 0xe0]
mov edx, dword [ebp - 0xc]
call fcn.00409b00
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x14]
call fcn.004032c8
jne 0x4158af
mov eax, dword [ebx + 0xe0]
mov edx, dword [ebp - 0xc]
call fcn.00409ad4
mov eax, dword [ebx + 0x3c]
mov edx, dword [ebp - 0xc]
call fcn.0040971c
mov eax, dword [ebx + 0xf0]
mov edx, dword [ebp - 0xc]
call fcn.00409ad4
mov eax, dword [ebx + 0xf4]
mov edx, dword [ebp - 0xc]
call fcn.00409ad4
jmp 0x4158b5
inc dword [ebp - 0xc]
dec edi
jne 0x415854
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffff
jne 0x415778
dec esi
cmp esi, 0xffffffff
jne 0x41571a
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00413824
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415908
lea eax, [ebp - 0x98]
mov edx, 0x16
call fcn.0040301c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040301c
ret