Function at 0x41b100
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4823b1
mov eax, dword fs:[0]
push eax
sub esp, 0x774
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x780]
mov ecx, 0x1dd
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4a2024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, 0x4a60fa
call fcn.00436115
mov ecx, dword [ebp - 0x14]
call fcn.00402d90
mov dword [ebp - 4], 0
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x260], esp
mov eax, dword [ebp + 8]
push eax
call fcn.00402e60
lea ecx, [ebp - 0x280]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov eax, dword [ebp - 0x778]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00406450
lea ecx, [ebp - 0x280]
call fcn.00405e30
mov eax, dword [ebp - 0x14]
push eax
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x28c], esp
mov edx, dword [ebp + 8]
add edx, 0x6c
push edx
call fcn.00402e60
lea eax, [ebp - 0x2ac]
push eax
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov ecx, dword [ebp - 0x774]
mov dword [ebp - 0x778], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x778]
push edx
lea eax, [ebp - 0x2cc]
push eax
call fcn.00401390
add esp, 0xc
mov dword [ebp - 0x77c], eax
mov ecx, dword [ebp - 0x77c]
mov dword [ebp - 0x780], ecx
mov ecx, dword [ebp - 0x780]
call fcn.00407fb0
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp esi, esp
call fcn.004360e6
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x18], eax
lea ecx, [ebp - 0x2cc]
call fcn.00405e30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2ac]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x2d8], esp
mov eax, dword [ebp + 8]
add eax, 0xf0
push eax
call fcn.00402e60
lea ecx, [ebp - 0x2f8]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.004360e6
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x30], eax
lea ecx, [ebp - 0x2f8]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x304], esp
mov eax, dword [ebp + 8]
add eax, 0xd8
push eax
call fcn.00402e60
lea ecx, [ebp - 0x324]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x2c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x324]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x330], esp
mov eax, dword [ebp + 8]
add eax, 0x78
push eax
call fcn.00402e60
lea ecx, [ebp - 0x350]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x34], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x350]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x35c], esp
mov eax, dword [ebp + 8]
add eax, 0x84
push eax
call fcn.00402e60
lea ecx, [ebp - 0x37c]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x38], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x37c]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x388], esp
mov eax, dword [ebp + 8]
add eax, 0x90
push eax
call fcn.00402e60
lea ecx, [ebp - 0x3a8]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x40], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3a8]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x3b4], esp
mov eax, dword [ebp + 8]
add eax, 0x9c
push eax
call fcn.00402e60
lea ecx, [ebp - 0x3d4]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x3c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3d4]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x3e0], esp
mov eax, dword [ebp + 8]
add eax, 0xa8
push eax
call fcn.00402e60
lea ecx, [ebp - 0x400]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x44], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x400]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x40c], esp
mov eax, dword [ebp + 8]
add eax, 0xc0
push eax
call fcn.00402e60
lea ecx, [ebp - 0x42c]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x48], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x42c]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x438], esp
mov eax, dword [ebp + 8]
add eax, 0xcc
push eax
call fcn.00402e60
lea ecx, [ebp - 0x458]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x4c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x458]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x464], esp
mov eax, dword [ebp + 8]
add eax, 0xe4
push eax
call fcn.00402e60
lea ecx, [ebp - 0x484]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x50], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x484]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x490], esp
mov eax, dword [ebp + 8]
add eax, 0x138
push eax
call fcn.00402e60
lea ecx, [ebp - 0x4b0]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x54], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4b0]
call fcn.00405e30
mov eax, dword [ebp - 0x14]
push eax
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x4bc], esp
mov edx, dword [ebp + 8]
add edx, 0x144
push edx
call fcn.00402e60
lea eax, [ebp - 0x4dc]
push eax
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov ecx, dword [ebp - 0x774]
mov dword [ebp - 0x778], ecx
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x778]
push edx
lea eax, [ebp - 0x4fc]
push eax
call fcn.00401390
add esp, 0xc
mov dword [ebp - 0x77c], eax
mov ecx, dword [ebp - 0x77c]
mov dword [ebp - 0x780], ecx
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x780]
call fcn.00407fb0
mov esi, esp
push eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x2c]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x1c], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x4fc]
call fcn.00405e30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4dc]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x508], esp
mov eax, dword [ebp + 8]
add eax, 0x150
push eax
call fcn.00402e60
lea ecx, [ebp - 0x528]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x58], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x528]
call fcn.00405e30
mov eax, dword [ebp - 0x14]
push eax
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x534], esp
mov edx, dword [ebp + 8]
add edx, 0x15c
push edx
call fcn.00402e60
lea eax, [ebp - 0x554]
push eax
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov ecx, dword [ebp - 0x774]
mov dword [ebp - 0x778], ecx
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x778]
push edx
lea eax, [ebp - 0x574]
push eax
call fcn.00401390
add esp, 0xc
mov dword [ebp - 0x77c], eax
mov ecx, dword [ebp - 0x77c]
mov dword [ebp - 0x780], ecx
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x780]
call fcn.00407fb0
mov esi, esp
push eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x2c]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x20], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x574]
call fcn.00405e30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x554]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x580], esp
mov eax, dword [ebp + 8]
add eax, 0x168
push eax
call fcn.00402e60
lea ecx, [ebp - 0x5a0]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x20]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x5c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5a0]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x5ac], esp
mov eax, dword [ebp + 8]
add eax, 0x174
push eax
call fcn.00402e60
lea ecx, [ebp - 0x5cc]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x20]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x60], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5cc]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x5d8], esp
mov eax, dword [ebp + 8]
add eax, 0x180
push eax
call fcn.00402e60
lea ecx, [ebp - 0x5f8]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x20]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x64], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5f8]
call fcn.00405e30
mov eax, dword [ebp - 0x14]
push eax
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x604], esp
mov edx, dword [ebp + 8]
add edx, 0x18c
push edx
call fcn.00402e60
lea eax, [ebp - 0x624]
push eax
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov ecx, dword [ebp - 0x774]
mov dword [ebp - 0x778], ecx
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x778]
push edx
lea eax, [ebp - 0x644]
push eax
call fcn.00401390
add esp, 0xc
mov dword [ebp - 0x77c], eax
mov ecx, dword [ebp - 0x77c]
mov dword [ebp - 0x780], ecx
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x780]
call fcn.00407fb0
mov esi, esp
push eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x2c]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x24], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x644]
call fcn.00405e30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x624]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x650], esp
mov eax, dword [ebp + 8]
add eax, 0x198
push eax
call fcn.00402e60
lea ecx, [ebp - 0x670]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x68], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x670]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x67c], esp
mov eax, dword [ebp + 8]
add eax, 0x1a4
push eax
call fcn.00402e60
lea ecx, [ebp - 0x69c]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x6c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x69c]
call fcn.00405e30
mov eax, dword [ebp - 0x14]
push eax
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x6a8], esp
mov edx, dword [ebp + 8]
add edx, 0x1b0
push edx
call fcn.00402e60
lea eax, [ebp - 0x6c8]
push eax
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov ecx, dword [ebp - 0x774]
mov dword [ebp - 0x778], ecx
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x778]
push edx
lea eax, [ebp - 0x6e8]
push eax
call fcn.00401390
add esp, 0xc
mov dword [ebp - 0x77c], eax
mov ecx, dword [ebp - 0x77c]
mov dword [ebp - 0x780], ecx
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x780]
call fcn.00407fb0
mov esi, esp
push eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x2c]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x28], eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x6e8]
call fcn.00405e30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6c8]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x6f4], esp
mov eax, dword [ebp + 8]
add eax, 0x1bc
push eax
call fcn.00402e60
lea ecx, [ebp - 0x714]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x28]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x70], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x714]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x720], esp
mov eax, dword [ebp + 8]
add eax, 0x1c8
push eax
call fcn.00402e60
lea ecx, [ebp - 0x740]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x28]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x74], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x740]
call fcn.00405e30
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x74c], esp
mov eax, dword [ebp + 8]
add eax, 0x1d4
push eax
call fcn.00402e60
lea ecx, [ebp - 0x76c]
push ecx
call fcn.0040f430
add esp, 0x10
mov dword [ebp - 0x774], eax
mov edx, dword [ebp - 0x774]
mov dword [ebp - 0x778], edx
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x778]
call fcn.00407fb0
mov esi, esp
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x28]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
cmp esi, esp
call fcn.004360e6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x78], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x76c]
call fcn.00405e30
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x780
cmp ebp, esp
call fcn.004360e6
mov esp, ebp
pop ebp
ret 4