Function at 0x40be20
Capabilities:
Check for foreground window switch
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4655c3
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47a770]
xor eax, esp
push eax
lea eax, [esp + 0xec]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x100]
xor eax, eax
mov dword [esp + 0xf4], eax
push eax
mov dword [esp + 0x8c], eax
call fcn.0044bf56
add esp, 4
push eax
call fcn.0044bf22
add esp, 4
call fcn.0044bf34
cdq
idiv dword [0x480c2c]
mov dword [esp + 0x94], edx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop
mov eax, dword [esp + 0x104]
mov esi, dword [esp + 0xfc]
push eax
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov dword [esp + 0x20], esp
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x40becf
cmp eax, dword [esi]
jne 0x40becf
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40bf03
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x40d177
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
inc eax
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0044b46f
add esp, 0x10
mov edx, dword [esp + 0x20]
add edi, 0x10
mov ecx, ebp
mov dword [edx], edi
call fcn.00408690
mov esi, dword [esp + 0x104]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
add esi, 0xfffffff0
add esp, 4
mov dword [esp + 0x18], esp
mov dword [esp + 0x1c], esp
call edx
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x40bf4c
cmp eax, dword [esi]
jne 0x40bf4c
mov edi, esi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x40bf80
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x40d177
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
inc eax
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0044b46f
add esp, 0x10
mov edx, dword [esp + 0x1c]
add edi, 0x10
mov dword [edx], edi
mov edi, ebp
call fcn.00407850
mov eax, dword [0x47baf4]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
add esp, 4
lea ecx, [esp + 0x74]
push ecx
push ebp
mov dword [esp + 0x20], eax
call esi
mov edx, dword [esp + 0x74]
push edx
push 0
push 0x1fffff
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x18]
mov edi, eax
lea eax, [esp + 0xd8]
push eax
push 4
lea ecx, [esp + 0x3c]
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x47baf8]
lea ecx, [esp + 0x8c]
push ecx
push ebp
mov dword [esp + 0x20], eax
call esi
mov edx, dword [esp + 0x8c]
push edx
push 0
push 0x1fffff
mov dword [esp + 0x48], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x18]
mov edi, eax
lea eax, [esp + 0xcc]
push eax
push 4
lea ecx, [esp + 0x44]
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x34], 0
jne case.0x40c226.1002
cmp dword [esp + 0x3c], 0x457
jne case.0x40c226.1002
mov eax, dword [0x480c28]
push eax
call ebx
push 0
call fcn.0044bf56
add esp, 4
push eax
call fcn.0044bf22
add esp, 4
call fcn.0044bf34
mov ecx, dword [0x480c2c]
cdq
idiv ecx
mov eax, ecx
mov edi, edx
cdq
sub eax, edx
sar eax, 1
sub eax, edi
mov dword [esp + 0x1c], eax
call fcn.0044bf34
mov ecx, dword [0x480c2c]
cdq
idiv ecx
mov eax, ecx
mov edi, edx
cdq
sub eax, edx
sar eax, 1
sub eax, edi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xfc]
add eax, 0xfffffff0
push eax
call fcn.00429de0
mov ecx, dword [0x47bb0c]
add esp, 4
lea edx, [esp + 0x78]
push edx
push ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
call esi
mov eax, dword [esp + 0x78]
push eax
push 0
push 0x1fffff
mov dword [esp + 0x50], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0xd4]
push ecx
push 4
mov edi, eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x4c]
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x84]
push edx
push ebp
mov dword [esp + 0x20], ecx
call esi
mov eax, dword [esp + 0x84]
push eax
push 0
push 0x1fffff
mov dword [esp + 0x44], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0xdc]
push ecx
mov edi, eax
mov eax, dword [esp + 0x1c]
push 4
lea edx, [esp + 0x40]
push edx
add eax, 0x1ec
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c190
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xfc]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov esi, ebp
lea edi, [esp + 0x2c]
call fcn.004045c0
mov edi, dword [esp + 0x2c]
add esp, 4
cmp dword [esp + 0x60], edi
jne 0x40c20d
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xfc]
mov esi, dword [esp + 0x1c]
add ecx, 0xe3
push ecx
push ecx
mov dword [esp + 0x1c], esp
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
push eax
add esi, 0x13e
call fcn.00429de0
mov edx, dword [esp + 0x20]
add eax, 0x10
mov dword [edx], eax
add esp, 4
mov ecx, esi
mov edx, ebp
call fcn.004062f0
add esp, 8
mov eax, dword [esp + 0x18]
add eax, 0xfffffc17
cmp eax, 0x7b
ja case.0x40c226.1002
movzx eax, byte [eax + 0x40d198]
jmp dword [eax*4 + 0x40d17c]
mov eax, dword [0x480c2c]
cdq
sub eax, edx
sar eax, 1
cmp dword [esp + 0x94], eax
jle 0x40c49c
cmp edi, 9
jle 0x40c2f7
cmp dword [esp + 0x2c], 0xa
jle 0x40c2f7
xor esi, esi
mov dword [esp + 0x14], esi
call fcn.0044bf34
cmp edi, 0xf
jge 0x40c276
mov eax, 0xf
sub eax, edi
lea esi, [eax + eax*4]
add esi, esi
add esi, esi
mov ecx, dword [esp + 0x2c]
cmp ecx, 0xd
jge 0x40c28f
mov eax, 0xc
sub eax, ecx
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
jmp 0x40c293
mov eax, dword [esp + 0x14]
cmp edi, 0x21
jle 0x40c2a6
mov esi, 0x21
sub esi, edi
lea esi, [esi + esi*4]
add esi, esi
add esi, esi
lea edx, [edi + edi*4]
add edx, edx
add edx, edx
lea ecx, [ecx + ecx*4 + 0x23]
mov edi, 0x34d
sub edi, edx
push 0x5a
push ecx
lea edx, [eax + ecx*4]
sub edi, esi
lea eax, [esp + 0x104]
mov esi, esp
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], esp
call fcn.00403870
mov esi, ebp
call fcn.00405540
push 0x32
call ebx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
add ecx, eax
push ecx
add edi, edx
jmp 0x40c550
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
add eax, 0x1ae
push eax
mov eax, dword [esp + 0x100]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
add esi, 0xd6
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, esi
mov edx, ebp
mov dword [edi], eax
call fcn.004062f0
add esp, 8
xor edi, edi
push 0xc8
call ebx
mov eax, dword [esp + 0xfc]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov eax, ebp
call fcn.00403f70
add esp, 4
cmp eax, 0x3e9
je 0x40c375
inc edi
cmp edi, 7
jle 0x40c338
mov dword [esp + 0x18], 0
lea ecx, [ecx]
push 0xc8
call ebx
mov eax, dword [esp + 0xfc]
add eax, 0xfffffff0
push eax
call fcn.00429de0
mov ecx, dword [0x47bb0c]
add esp, 4
lea edx, [esp + 0x9c]
push edx
mov esi, eax
push ebp
add esi, 0x10
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x9c]
push eax
push 0
push 0x1fffff
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0xe4]
push ecx
push 4
mov edi, eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x38]
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x98]
push edx
push ebp
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x98]
push eax
push 0
push 0x1fffff
mov dword [esp + 0x4c], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0xd0]
push ecx
mov edi, eax
mov eax, dword [esp + 0x18]
push 4
lea edx, [esp + 0x48]
push edx
add eax, 0x1ec
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x40]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c476
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
cmp edi, 0x3e9
je 0x40c490
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 7
mov dword [esp + 0x18], eax
jle 0x40c380
push 0xc8
call ebx
jmp case.0x40c226.1002
cmp edi, 0xd
jle 0x40c57b
cmp dword [esp + 0x2c], 0xb
jge 0x40c57b
xor esi, esi
mov dword [esp + 0x18], esi
call fcn.0044bf34
cmp edi, 0xf
jge 0x40c4ce
mov eax, 0xf
sub eax, edi
lea esi, [eax + eax*4]
add esi, esi
add esi, esi
mov ecx, dword [esp + 0x2c]
cmp ecx, 0xd
jge 0x40c4e9
mov eax, 0xc
sub eax, ecx
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov dword [esp + 0x18], eax
cmp edi, 0x21
jle 0x40c4fc
mov eax, 0x21
sub eax, edi
lea esi, [eax + eax*4]
add esi, esi
add esi, esi
mov edx, dword [esp + 0x18]
lea eax, [edi + edi*4]
add eax, eax
add eax, eax
mov edi, 0x20d
sub edi, eax
mov eax, dword [esp + 0x2c]
lea ecx, [eax + eax*4 - 0xa]
lea eax, [edx + ecx*4]
push 0x5a
push ecx
mov dword [esp + 0x20], eax
sub edi, esi
lea eax, [esp + 0x104]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov esi, ebp
call fcn.00405540
push 0x32
call ebx
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
add edx, ecx
push edx
add edi, eax
push ecx
lea eax, [esp + 0x104]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, edi
mov edx, ebp
call fcn.004062f0
add esp, 8
push 0x4b0
call ebx
jmp case.0x40c226.1002
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xfc]
add ecx, 0xe6
push ecx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00429de0
mov ecx, dword [esp + 0x28]
add eax, 0x10
add esp, 4
mov edx, ebp
mov dword [esi], eax
call fcn.004062f0
add esp, 8
xor edi, edi
push 0xc8
call ebx
mov eax, dword [esp + 0xfc]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov eax, ebp
call fcn.00403f70
add esp, 4
cmp eax, 0x3e9
je 0x40c5f2
inc edi
cmp edi, 7
jle 0x40c5b5
mov dword [esp + 0x18], 0
lea ebx, [ebx]
push 0xc8
call ebx
mov eax, dword [esp + 0xfc]
add eax, 0xfffffff0
push eax
call fcn.00429de0
mov edx, dword [0x47bb0c]
mov esi, eax
add esp, 4
lea eax, [esp + 0x70]
push eax
push ebp
add esi, 0x10
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [esp + 0x70]
push ecx
push 0
push 0x1fffff
mov dword [esp + 0x58], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xe0]
push edx
mov edi, eax
push 4
lea eax, [esp + 0x54]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x4c]
lea eax, [esp + 0x90]
push eax
push ebp
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [esp + 0x90]
push ecx
push 0
push 0x1fffff
mov dword [esp + 0x54], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xc8]
push edx
mov edi, eax
push 4
lea eax, [esp + 0x50]
push eax
add ecx, 0x1ec
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x48]
add esi, 0xfffffff0
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40c6f1
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
cmp edi, 0x3e9
je 0x40c70b
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 7
mov dword [esp + 0x18], eax
jle 0x40c600
push 0xc8
call ebx
jmp case.0x40c226.1002
lea ecx, [edi - 0x111]
cmp ecx, 0xf
ja 0x40ca17
mov edx, dword [esp + 0x2c]
add edx, 0xffffffdd
cmp edx, 0x14
ja 0x40ca17
push ecx
lea eax, [esp + 0x100]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
lea eax, [esp + 0xbc]
push eax
mov eax, ebp
call fcn.00405d80
add esp, 4
lea eax, [esp + 0x100]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
mov eax, ebp
call fcn.004046f0
add esp, 4
test al, al
jne 0x40c886
cmp dword [esp + 0xb8], 0x32
jne 0x40c886
cmp dword [esp + 0xbc], 0xe6
jne 0x40c886
push 0x47e5d8
mov byte [esp + 0x2b], al
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call esi
cmp eax, ebp
je 0x40c7d1
mov edi, dword [sym.imp.USER32.dll_SetForegroundWindow]
nop
push ebp
call edi
call fcn.00408120
push eax
call ebx
call esi
cmp eax, ebp
jne 0x40c7c0
push ecx
lea eax, [esp + 0x100]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
mov eax, ebp
call fcn.00406270
add esp, 4
cmp al, 1
je 0x40c826
push 0x113
push ecx
lea eax, [esp + 0x104]
mov esi, esp
mov edi, 0x56
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, edi
mov edx, ebp
call fcn.004062f0
add esp, 8
push 0x578
call ebx
mov bl, 1
jmp 0x40c82a
mov bl, byte [esp + 0x27]
push 0x47e5d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp bl, 1
jne 0x40ca0a
xor edi, edi
push ecx
lea eax, [esp + 0x100]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
mov eax, ebp
call fcn.00403f70
add esp, 4
cmp eax, 0x456
je 0x40ca0a
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jle 0x40c840
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40be89
push ecx
lea eax, [esp + 0x100]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
mov eax, ebp
call fcn.00406270
add esp, 4
cmp al, 1
je 0x40ca0a
push 0x514
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7a
push ecx
lea eax, [esp + 0x104]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov esi, ebp
call fcn.00405540
mov ecx, dword [esp + 0x104]
mov ebx, dword [ecx + 0x64]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x46d09c
call fcn.0042a2b0
push ecx
lea eax, [esp + 0x104]
mov esi, esp
mov byte [esp + 0xfc], 1
mov dword [esp + 0x20], esp
call fcn.00403870
lea edx, [esp + 0x84]
push edx
mov esi, ebp
mov byte [esp + 0x100], 0
call fcn.00408500
mov ebx, dword [esp + 0x88]
add esp, 0xc
test ebx, ebx
je 0x40ca06
mov eax, dword [esp + 0x80]
test eax, eax
je 0x40ca06
push ebx
push ecx
lea edi, [eax + 1]
lea eax, [esp + 0x104]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, edi
mov esi, ebp
call fcn.00407980
add esp, 8
push ebx
push ecx
lea eax, [esp + 0x104]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, dword [esp + 0x88]
mov esi, ebp
call fcn.00407980
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
xor edi, edi
push 0x12c
call ebx
push ecx
lea eax, [esp + 0x100]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
lea eax, [esp + 0xac]
push eax
mov eax, ebp
call fcn.00405d80
add esp, 4
lea eax, [esp + 0x100]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
mov eax, ebp
call fcn.004046f0
add esp, 4
test al, al
jne 0x40c9f3
cmp dword [esp + 0xa8], 0x32
jne 0x40c9f3
cmp dword [esp + 0xac], 0xe6
je 0x40ca0a
inc edi
cmp edi, 8
jle 0x40c990
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40be89
mov dword [esp + 0x60], edi
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40be89
mov eax, dword [esp + 0xfc]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
lea ecx, [esp + 0xb8]
add esp, 4
mov dword [esi], eax
push ecx
mov eax, ebp
call fcn.004060f0
mov eax, dword [esp + 0x104]
add esp, 4
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov eax, ebp
call fcn.004046f0
add esp, 4
test al, al
jne 0x40cba5
cmp dword [esp + 0xb0], 0x295
jne 0x40cba5
cmp dword [esp + 0xb4], 0x1a3
jne 0x40cba5
push ecx
lea eax, [esp + 0x100]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
lea edx, [esp + 0x54]
push edx
mov eax, ebp
call fcn.00405d80
add esp, 8
cmp dword [esp + 0x50], 0
jne 0x40cacb
mov eax, dword [esp + 0x54]
test eax, eax
je 0x40cb01
push 0
push 0
push ecx
lea eax, [esp + 0x108]
mov esi, esp
mov dword [esp + 0x20], esp
call fcn.00403870
mov esi, ebp
call fcn.00405f00
add esp, 0xc
push 0x12c
call ebx
xor eax, eax
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], eax
add eax, 0x178
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fsub qword [0x46f290]
call fcn.00450dd0
mov edi, eax
call fcn.0044bf34
cdq
mov ecx, 0xa
idiv ecx
mov esi, 5
sub esi, edx
call fcn.0044bf34
cdq
mov ecx, 0xa
idiv ecx
mov eax, 5
sub eax, edx
add eax, edi
lea edi, [esi + 0x147]
push eax
push ecx
lea eax, [esp + 0x104]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, edi
mov edx, ebp
call fcn.004062f0
add esp, 8
push 0x12c
call ebx
push 0x18
push ecx
lea eax, [esp + 0x104]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov edi, ebp
call fcn.004054b0
add esp, 8
push 0x12c
call ebx
mov dword [esp + 0x60], 0
jmp case.0x40c226.1002
mov eax, dword [esp + 0xfc]
push 0x18
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
mov edi, ebp
mov dword [esi], eax
call fcn.004054b0
add esp, 8
jmp case.0x40c226.1002
mov edx, dword [esp + 0x104]
mov eax, dword [esp + 0xfc]
push edx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, ebp
mov dword [esi], eax
call fcn.00409040
lea eax, [edi - 0x2d]
add esp, 8
cmp eax, 0xd
ja 0x40cd2f
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffec3
cmp ecx, 0x12
ja 0x40cd2f
xor esi, esi
mov dword [esp + 0x18], esi
call fcn.0044bf34
cmp edi, 0xf
jge 0x40cc47
mov eax, 0xf
sub eax, edi
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2c]
cmp eax, 0xd
jge 0x40cc5e
mov esi, 0xc
sub esi, eax
lea esi, [esi + esi*4]
add esi, esi
add esi, esi
cmp eax, 0x143
jle 0x40cc73
mov esi, 0x143
sub esi, eax
lea esi, [esi + esi*4]
add esi, esi
add esi, esi
mov ecx, dword [esp + 0x2c]
lea edx, [edi + edi*4]
lea ecx, [ecx + ecx*4 - 0x63b]
lea esi, [esi + ecx*4]
mov ecx, dword [esp + 0x20]
add edx, edx
add edx, edx
mov eax, 0x519
sub eax, edx
sub eax, dword [esp + 0x18]
add esi, ecx
push esi
push ecx
lea edi, [eax + ecx]
lea eax, [esp + 0x104]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, edi
mov edx, ebp
call fcn.004062f0
add esp, 8
push 0x5dc
call ebx
xor edi, edi
push ecx
lea eax, [esp + 0x100]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
mov eax, ebp
call fcn.00403f70
add esp, 4
cmp eax, 0x462
je case.0x40c226.1002
push 0x1f4
call ebx
inc edi
cmp edi, 0x12
jle 0x40ccc5
push 0x12c
call ebx
push 0xf0
push ecx
lea eax, [esp + 0x104]
mov esi, esp
mov edi, 0x205
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, edi
mov edx, ebp
call fcn.004062f0
add esp, 8
jmp case.0x40c226.1002
mov eax, dword [esp + 0xfc]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
lea edx, [esp + 0xc8]
add esp, 4
mov dword [esi], eax
push edx
mov eax, ebp
call fcn.004060f0
mov eax, dword [esp + 0x104]
add esp, 4
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov eax, ebp
call fcn.004046f0
add esp, 4
test al, al
jne 0x40cba5
cmp dword [esp + 0xc0], 0x195
jne 0x40cba5
cmp dword [esp + 0xc4], 0x1a3
jne 0x40cba5
push ecx
lea eax, [esp + 0x100]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
lea eax, [esp + 0x5c]
push eax
mov eax, ebp
call fcn.00405d80
add esp, 8
cmp dword [esp + 0x58], 0
jne 0x40cde3
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x40ce19
push 0
push 0
push ecx
lea eax, [esp + 0x108]
mov esi, esp
mov dword [esp + 0x20], esp
call fcn.00403870
mov esi, ebp
call fcn.00405f00
add esp, 0xc
push 0x12c
call ebx
xor eax, eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], eax
add eax, 0x178
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fsub qword [0x46f328]
call fcn.00450dd0
mov edi, eax
call fcn.0044bf34
cdq
mov ecx, 0xa
idiv ecx
mov esi, 5
sub esi, edx
call fcn.0044bf34
cdq
mov ecx, 0xa
idiv ecx
mov eax, 5
sub eax, edx
add eax, edi
lea edi, [esi + 0xd7]
jmp 0x40cb4b
mov edx, dword [esp + 0x104]
mov eax, dword [esp + 0xfc]
push edx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, ebp
mov dword [esi], eax
call fcn.00409040
lea eax, [edi - 0x19]
add esp, 8
cmp eax, 0xf
ja 0x40cf80
mov esi, dword [esp + 0x2c]
lea ecx, [esi - 0x3c]
cmp ecx, 0xf
ja 0x40cf80
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call fcn.0044bf34
cmp edi, 0xf
jge 0x40cedb
mov eax, 0xf
sub eax, edi
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov dword [esp + 0x18], eax
cmp esi, 0xd
jge 0x40cef2
mov eax, 0xc
sub eax, esi
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov dword [esp + 0x1c], eax
lea edx, [edi + edi*4]
add edx, edx
add edx, edx
mov eax, 0x375
sub eax, edx
mov edx, dword [esp + 0x1c]
sub eax, dword [esp + 0x18]
lea ecx, [esi + esi*4 - 0x122]
lea ecx, [edx + ecx*4]
mov edx, dword [esp + 0x20]
lea ecx, [ecx + edx - 0x32]
push ecx
push ecx
lea edi, [eax + edx]
lea eax, [esp + 0x104]
mov esi, esp
mov dword [esp + 0x1c], esp
call fcn.00403870
mov ecx, edi
mov edx, ebp
call fcn.004062f0
add esp, 8
push 0x578
call ebx
xor edi, edi
push ecx
lea eax, [esp + 0x100]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
mov eax, ebp
call fcn.00403f70
add esp, 4
cmp eax, 0x463
je case.0x40c226.1002
push 0xfa
call ebx
inc edi
cmp edi, 0xa
jle 0x40cf46
jmp case.0x40c226.1002
mov eax, dword [esp + 0xfc]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
lea edx, [esp + 0xa8]
add esp, 4
mov dword [esi], eax
push edx
mov eax, ebp
call fcn.004060f0
mov eax, dword [esp + 0x104]
add esp, 4
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov eax, ebp
call fcn.004046f0
add esp, 4
test al, al
jne 0x40cba5
cmp dword [esp + 0xa0], 0x1e5
jne 0x40cba5
cmp dword [esp + 0xa4], 0x1a3
jne 0x40cba5
push ecx
lea eax, [esp + 0x100]
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.00403870
lea eax, [esp + 0x6c]
push eax
mov eax, ebp
call fcn.00405d80
add esp, 8
cmp dword [esp + 0x68], 0
jne 0x40d034
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x40d06a
push 0
push 0
push ecx
lea eax, [esp + 0x108]
mov esi, esp
mov dword [esp + 0x20], esp
call fcn.00403870
mov esi, ebp
call fcn.00405f00
add esp, 0xc
push 0x12c
call ebx
xor eax, eax
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], eax
add eax, 0x178
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fsub qword [0x46f320]
call fcn.00450dd0
mov edi, eax
call fcn.0044bf34
cdq
mov ecx, 0xa
idiv ecx
mov esi, 5
sub esi, edx
call fcn.0044bf34
cdq
mov ecx, 0xa
idiv ecx
mov eax, 5
sub eax, edx
add eax, edi
lea edi, [esi + 0xcb]
jmp 0x40cb4b
mov edx, dword [esp + 0x104]
mov eax, dword [esp + 0xfc]
push edx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, ebp
mov dword [esi], eax
call fcn.00409040
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
cdq
sub eax, edx
sar eax, 1
add eax, 0xe
add esp, 8
push eax
mov eax, dword [esp + 0x100]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
add esi, 0xf5
call fcn.00429de0
add eax, 0x10
add esp, 4
mov ecx, esi
mov edx, ebp
mov dword [edi], eax
call fcn.004062f0
add esp, 8
push 0x190
call ebx
jmp case.0x40c226.1002
mov ecx, dword [esp + 0x104]
lea eax, [esp + 0x88]
push eax
mov eax, dword [esp + 0x100]
push 1
push ecx
push ebp
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov esi, esp
push eax
call fcn.00429de0
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.004091a0
add esp, 0x14
jmp case.0x40c226.1002
call fcn.00401ea0
pop ss
mov dword [eax], case.0x40c226.1024
aad 0xcb
inc eax
add byte [eax - 0x32], ch
inc eax
add byte [ecx + 0x380040d0], bh
rol dword [eax], 1
nop
mov esi, 100663360
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add dword [esi], eax
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add al, byte [esi]
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
add eax, dword [eax - 858993460]
int3