Function at 0x4355a0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a2b20
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x138], ecx
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0xc]
sub ecx, 0x94
mov dword [ebp - 0x1ac], ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0xc]
sub eax, 0xd
mov dword [ebp - 0x1a4], eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x10]
sub edx, 0x2e
mov dword [ebp - 0x1a8], edx
mov eax, dword [ebp - 0x1a8]
add eax, 0x1a
mov dword [ebp - 0x1a0], eax
push 0xcc
call fcn.00480108
add esp, 4
mov dword [ebp - 0x198], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x198], 0
je 0x435691
push 0xcc
mov ecx, dword [ebp - 0x198]
call fcn.00413f70
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp - 0x1ac]
mov dword [ecx], edx
mov eax, dword [ebp - 0x1a8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1a4]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x1a0]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp - 0x198]
call fcn.00505f70
mov dword [ebp - 0x1dc], eax
jmp 0x43569b
mov dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x21c]
mov dword [ecx + 0x68], edx
push 1
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x68]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x68]
mov edx, dword [eax + 0x54]
call edx
push 0
push 0xa6
call fcn.0041a0e0
add esp, 4
push eax
push 0xa6
call fcn.0041a0e0
add esp, 4
push eax
push 0xa5
call fcn.0041a0e0
add esp, 4
push eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x68]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x68]
mov edx, dword [eax + 0x60]
call edx
push 0
push 0xa8
call fcn.0041a0e0
add esp, 4
push eax
push 0xa8
call fcn.0041a0e0
add esp, 4
push eax
push 0xa7
call fcn.0041a0e0
add esp, 4
push eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x68]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x68]
mov edx, dword [eax + 0x80]
call edx
push 8
push 0xe
push 9
mov eax, dword [ebp - 0x1a4]
sub eax, dword [ebp - 0x1ac]
sub eax, 0xe
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x68]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x68]
mov eax, dword [edx + 0x84]
call eax
mov ecx, dword [ebp - 0x1a0]
sub ecx, dword [ebp - 0x1a8]
push ecx
mov edx, dword [ebp - 0x1a4]
sub edx, dword [ebp - 0x1ac]
sub edx, 0x10
push edx
push 0
push 0
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x68]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x68]
mov edx, dword [eax + 0x88]
call edx
push 0x26
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x68]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x68]
mov edx, dword [eax + 0x28]
call edx
push 0xcccbc2
push 0xe3a378
push 0xe3a378
push 0xcec0a3
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x68]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x68]
mov edx, dword [eax + 0x5c]
call edx
push 1
call fcn.004f50a0
add esp, 4
push eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x68]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x68]
mov edx, dword [eax + 0x18]
call edx
push 0x5c
push 0
lea eax, [ebp - 0x134]
push eax
call fcn.0066eb10
add esp, 0xc
push 0x60
push 0x5a
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 0xe
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x268]
push eax
mov ecx, dword [ebp - 0x138]
call fcn.00441690
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x228]
call fcn.0041b040
push eax
push 0x741088
push 0x20
lea ecx, [ebp - 0x118]
push ecx
call fcn.0066d85d
add esp, 0x10
lea ecx, [ebp - 0x268]
call fcn.00419320
lea edx, [ebp - 0x134]
push edx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x68]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x68]
mov eax, dword [edx + 0x20]
call eax
push 0x64f
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x68]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x68]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x68]
mov dword [ebp - 0x230], edx
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x138]
add ecx, 0x50
call fcn.00444ee0
mov dword [ebp - 0x14c], 0x2c
push 0
call fcn.004f5950
add esp, 4
add eax, dword [ebp - 0x14c]
mov dword [ebp - 0x144], eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x10]
add edx, 8
mov dword [ebp - 0x148], edx
mov eax, dword [ebp - 0x148]
add eax, 0x14
mov dword [ebp - 0x140], eax
push 0xcc
call fcn.00480108
add esp, 4
mov dword [ebp - 0x18c], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x18c], 0
je 0x4359f2
push 0xcc
mov ecx, dword [ebp - 0x18c]
call fcn.00413f70
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp - 0x14c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x148]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x144]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x140]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp - 0x18c]
call fcn.00505f70
mov dword [ebp - 0x1e8], eax
jmp 0x4359fc
mov dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x208], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x208]
mov dword [ecx + 0x6c], edx
push 1
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x6c]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x6c]
mov edx, dword [eax + 0x54]
call edx
push 0
push 0x9f
call fcn.0041a0e0
add esp, 4
push eax
push 0x9e
call fcn.0041a0e0
add esp, 4
push eax
push 0x9d
call fcn.0041a0e0
add esp, 4
push eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x6c]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x6c]
mov edx, dword [eax + 0x60]
call edx
push 0
push 0x9d
call fcn.0041a0e0
add esp, 4
push eax
push 0xa0
call fcn.0041a0e0
add esp, 4
push eax
push 0x9f
call fcn.0041a0e0
add esp, 4
push eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x6c]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x6c]
mov edx, dword [eax + 0x80]
call edx
push 0xe
push 0xe
push 3
push 0
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x6c]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x6c]
mov edx, dword [eax + 0x84]
call edx
mov eax, dword [ebp - 0x140]
sub eax, dword [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x144]
sub ecx, dword [ebp - 0x14c]
sub ecx, 0x19
push ecx
push 0
push 0x14
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x6c]
mov ecx, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x6c]
mov eax, dword [edx + 0x88]
call eax
push 0x24
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x6c]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x6c]
mov eax, dword [edx + 0x28]
call eax
push 0x777777
push 0x777777
push 0x777777
push 0x777777
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x6c]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x6c]
mov eax, dword [edx + 0x5c]
call eax
push 2
call fcn.004f50a0
add esp, 4
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x6c]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x6c]
mov eax, dword [edx + 0x18]
call eax
push 0x5c
push 0
lea ecx, [ebp - 0x7c]
push ecx
call fcn.0066eb10
add esp, 0xc
push 0x60
push 0x5a
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 0xe
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [ebp - 0x7c], eax
lea ecx, [ebp - 0x298]
push ecx
mov ecx, dword [ebp - 0x138]
call fcn.00441690
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x20c]
call fcn.0041b040
push eax
push 0x741090
push 0x20
lea edx, [ebp - 0x60]
push edx
call fcn.0066d85d
add esp, 0x10
lea ecx, [ebp - 0x298]
call fcn.00419320
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x13c]
push ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x6c]
mov ecx, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x6c]
mov eax, dword [edx + 0x20]
call eax
push 0x650
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x6c]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x6c]
mov eax, dword [edx + 8]
call eax
push 0
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x6c]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x6c]
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x6c]
mov dword [ebp - 0x214], edx
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp - 0x138]
add ecx, 0x50
call fcn.00444ee0
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x1bc], ecx
mov edx, dword [ebp - 0x148]
mov dword [ebp - 0x1b8], edx
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x1b4], eax
mov ecx, dword [ebp - 0x140]
mov dword [ebp - 0x1b0], ecx
mov edx, dword [ebp - 0x148]
mov dword [ebp - 0x1b8], edx
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x1b0], eax
mov ecx, dword [ebp - 0x144]
mov dword [ebp - 0x1bc], ecx
push 1
call fcn.004f5950
add esp, 4
add eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1b4], eax
mov byte [ebp - 0x67], 1
lea edx, [ebp - 0x7c]
push edx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [ebp - 0x1d4], eax
push 0x9c
call fcn.00480108
add esp, 4
mov dword [ebp - 0x184], eax
mov dword [ebp - 4], 2
cmp dword [ebp - 0x184], 0
je 0x435d91
push 0x9c
mov ecx, dword [ebp - 0x184]
call fcn.00413f70
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x1bc]
mov dword [eax], ecx
mov edx, dword [ebp - 0x1b8]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1b4]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x1b0]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x184]
call fcn.00505960
mov dword [ebp - 0x1f0], eax
jmp 0x435d9b
mov dword [ebp - 0x1f0], 0
mov edx, dword [ebp - 0x1f0]
mov dword [ebp - 0x204], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x204]
mov dword [eax + 0x70], ecx
push 0x24
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x70]
mov ecx, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x70]
mov eax, dword [edx + 0x28]
call eax
push 0xe58c19
push 0xe58c19
push 0xe58c19
push 0xe58c19
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x70]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x70]
mov eax, dword [edx + 0x5c]
call eax
push 3
call fcn.004f50a0
add esp, 4
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x70]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x70]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 0x13c]
push ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x70]
mov ecx, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x70]
mov eax, dword [edx + 0x20]
call eax
mov ecx, dword [ebp - 0x1d4]
push ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x70]
mov ecx, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x70]
mov eax, dword [edx + 0x78]
call eax
mov ecx, dword [ebp - 0x13c]
push ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x70]
mov ecx, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x70]
mov eax, dword [edx + 0x20]
call eax
push 0x651
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x70]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x70]
mov eax, dword [edx + 8]
call eax
push 0
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x70]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x70]
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x70]
mov dword [ebp - 0x224], edx
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x138]
add ecx, 0x50
call fcn.00444ee0
mov ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x14c]
mov dword [ecx + 0x78], edx
mov eax, dword [ebp - 0x138]
mov dword [eax + 0x80], 0x225
mov ecx, dword [ebp - 0x140]
add ecx, 0xf
mov edx, dword [ebp - 0x138]
mov dword [edx + 0x7c], ecx
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x7c]
add ecx, 0x1a
mov edx, dword [ebp - 0x138]
mov dword [edx + 0x84], ecx
push 0
push 0
push 0
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x138]
mov ecx, dword [edx + 0x84]
sub ecx, dword [eax + 0x7c]
push ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x138]
mov ecx, dword [edx + 0x80]
sub ecx, dword [eax + 0x78]
push ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x7c]
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x78]
push edx
push 0x50800024
push 0
push str.edit
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, dword [ebp - 0x138]
mov dword [ecx + 0x74], eax
push 0x5c
push 0
lea edx, [ebp - 0xd8]
push edx
call fcn.0066eb10
add esp, 0xc
push 0x60
push 0x5a
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 0xe
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [ebp - 0xd8], eax
lea edx, [ebp - 0x280]
push edx
mov ecx, dword [ebp - 0x138]
call fcn.00441690
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x22c]
call fcn.0041b040
push eax
push 0x7410a4
push 0x20
lea eax, [ebp - 0xbc]
push eax
call fcn.0066d85d
add esp, 0x10
lea ecx, [ebp - 0x280]
call fcn.00419320
lea ecx, [ebp - 0xd8]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [ebp - 0x248], eax
push 1
mov edx, dword [ebp - 0x248]
push edx
push 0x30
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x74]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x74]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 1
push 4
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_OffsetRect]
lea eax, [ebp - 0x20]
push eax
push 0
push 0xb3
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x74]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x138]
add ecx, 0x11c
call fcn.0041b040
push eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x74]
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [ebp - 0x138]
add edx, 0x78
mov eax, dword [edx]
mov dword [ebp - 0x1cc], eax
mov ecx, dword [edx + 4]
mov dword [ebp - 0x1c8], ecx
mov eax, dword [edx + 8]
mov dword [ebp - 0x1c4], eax
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x1c0], ecx
mov edx, dword [ebp - 0x1c4]
mov dword [ebp - 0x1cc], edx
mov eax, dword [ebp - 0x1cc]
add eax, 0x1d
mov dword [ebp - 0x1c4], eax
push 0x98
call fcn.00480108
add esp, 4
mov dword [ebp - 0x194], eax
mov dword [ebp - 4], 3
cmp dword [ebp - 0x194], 0
je 0x43616c
push 0x98
mov ecx, dword [ebp - 0x194]
call fcn.00413f70
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp - 0x1cc]
mov dword [ecx], edx
mov eax, dword [ebp - 0x1c8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1c4]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x1c0]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp - 0x194]
call fcn.00505020
mov dword [ebp - 0x1ec], eax
jmp 0x436176
mov dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x250], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x250]
mov dword [ecx + 0x88], edx
push 1
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x88]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x88]
mov edx, dword [eax + 0x54]
call edx
push 0x653
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x88]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x88]
mov edx, dword [eax + 8]
call edx
push 0
push 0xa9
call fcn.0041a0e0
add esp, 4
push eax
push 0xaa
call fcn.0041a0e0
add esp, 4
push eax
push 0xab
call fcn.0041a0e0
add esp, 4
push eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x88]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x88]
mov edx, dword [eax + 0x60]
call edx
mov eax, dword [ebp - 0x138]
add eax, 0x88
push eax
mov ecx, dword [ebp - 0x138]
add ecx, 0x50
call fcn.00444ee0
mov ecx, dword [ebp - 0x1c0]
add ecx, 0xa
mov dword [ebp - 0x178], ecx
mov edx, dword [ebp - 0x178]
add edx, 0x14
mov dword [ebp - 0x170], edx
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x17c], eax
mov ecx, dword [ebp - 0x138]
mov eax, dword [ecx + 0xc]
cdq
sub eax, edx
sar eax, 1
add eax, 0x64
mov dword [ebp - 0x174], eax
push 0xcc
call fcn.00480108
add esp, 4
mov dword [ebp - 0x19c], eax
mov dword [ebp - 4], 4
cmp dword [ebp - 0x19c], 0
je 0x4362fe
push 0xcc
mov ecx, dword [ebp - 0x19c]
call fcn.00413f70
sub esp, 0x10
mov edx, esp
mov eax, dword [ebp - 0x17c]
mov dword [edx], eax
mov ecx, dword [ebp - 0x178]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x174]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x170]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x19c]
call fcn.00505f70
mov dword [ebp - 0x1d8], eax
jmp 0x436308
mov dword [ebp - 0x1d8], 0
mov ecx, dword [ebp - 0x1d8]
mov dword [ebp - 0x244], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x244]
mov dword [edx + 0x8c], eax
push 1
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x8c]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x8c]
mov eax, dword [edx + 0x54]
call eax
push 0
push 0x9f
call fcn.0041a0e0
add esp, 4
push eax
push 0x9e
call fcn.0041a0e0
add esp, 4
push eax
push 0x9d
call fcn.0041a0e0
add esp, 4
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x8c]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x8c]
mov eax, dword [edx + 0x60]
call eax
push 0
push 0x9d
call fcn.0041a0e0
add esp, 4
push eax
push 0xa0
call fcn.0041a0e0
add esp, 4
push eax
push 0x9f
call fcn.0041a0e0
add esp, 4
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x8c]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x8c]
mov eax, dword [edx + 0x80]
call eax
push 0xe
push 0xe
push 3
push 0
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x8c]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x8c]
mov eax, dword [edx + 0x84]
call eax
mov ecx, dword [ebp - 0x170]
sub ecx, dword [ebp - 0x178]
push ecx
mov edx, dword [ebp - 0x174]
sub edx, dword [ebp - 0x17c]
sub edx, 0x19
push edx
push 0
push 0x14
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x8c]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x8c]
mov edx, dword [eax + 0x88]
call edx
push 0x24
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x8c]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x8c]
mov edx, dword [eax + 0x28]
call edx
push 0x777777
push 0x777777
push 0x777777
push 0x777777
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x8c]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x8c]
mov edx, dword [eax + 0x5c]
call edx
push 4
call fcn.004f50a0
add esp, 4
push eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x8c]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x8c]
mov edx, dword [eax + 0x18]
call edx
mov eax, dword [ebp - 0x13c]
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x8c]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x8c]
mov eax, dword [edx + 0x20]
call eax
push 0x654
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x8c]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x8c]
mov eax, dword [edx + 8]
call eax
push 0
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x8c]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x8c]
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x8c]
mov dword [ebp - 0x238], edx
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x138]
add ecx, 0x50
call fcn.00444ee0
mov ecx, dword [ebp - 0x17c]
mov dword [ebp - 0x16c], ecx
mov edx, dword [ebp - 0x178]
mov dword [ebp - 0x168], edx
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x164], eax
mov ecx, dword [ebp - 0x170]
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp - 0x170]
add edx, 0xa
mov dword [ebp - 0x168], edx
mov eax, dword [ebp - 0x168]
add eax, 0x14
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x174]
mov dword [ebp - 0x164], ecx
push 0xcc
call fcn.00480108
add esp, 4
mov dword [ebp - 0x190], eax
mov dword [ebp - 4], 5
cmp dword [ebp - 0x190], 0
je 0x436636
push 0xcc
mov ecx, dword [ebp - 0x190]
call fcn.00413f70
sub esp, 0x10
mov edx, esp
mov eax, dword [ebp - 0x16c]
mov dword [edx], eax
mov ecx, dword [ebp - 0x168]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x164]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x160]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x190]
call fcn.00505f70
mov dword [ebp - 0x1d0], eax
jmp 0x436640
mov dword [ebp - 0x1d0], 0
mov ecx, dword [ebp - 0x1d0]
mov dword [ebp - 0x210], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x210]
mov dword [edx + 0x90], eax
push 1
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x90]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x90]
mov eax, dword [edx + 0x54]
call eax
push 0
push 0x9f
call fcn.0041a0e0
add esp, 4
push eax
push 0x9e
call fcn.0041a0e0
add esp, 4
push eax
push 0x9d
call fcn.0041a0e0
add esp, 4
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x90]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x90]
mov eax, dword [edx + 0x60]
call eax
push 0
push 0x9d
call fcn.0041a0e0
add esp, 4
push eax
push 0xa0
call fcn.0041a0e0
add esp, 4
push eax
push 0x9f
call fcn.0041a0e0
add esp, 4
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x90]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x90]
mov eax, dword [edx + 0x80]
call eax
push 0xe
push 0xe
push 3
push 0
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x90]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x90]
mov eax, dword [edx + 0x84]
call eax
mov ecx, dword [ebp - 0x160]
sub ecx, dword [ebp - 0x168]
push ecx
mov edx, dword [ebp - 0x164]
sub edx, dword [ebp - 0x16c]
sub edx, 0x19
push edx
push 0
push 0x14
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x90]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x90]
mov edx, dword [eax + 0x88]
call edx
push 0x24
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x90]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x90]
mov edx, dword [eax + 0x28]
call edx
push 0x777777
push 0x777777
push 0x777777
push 0x777777
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x90]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x90]
mov edx, dword [eax + 0x5c]
call edx
push 0x37
call fcn.004f50a0
add esp, 4
push eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x90]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x90]
mov edx, dword [eax + 0x18]
call edx
mov eax, dword [ebp - 0x13c]
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x90]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x90]
mov eax, dword [edx + 0x20]
call eax
push 0x65f
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x90]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x90]
mov eax, dword [edx + 8]
call eax
push 0
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x90]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x90]
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x90]
mov dword [ebp - 0x240], edx
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x138]
add ecx, 0x50
call fcn.00444ee0
mov ecx, dword [ebp - 0x16c]
mov dword [ebp - 0x15c], ecx
mov edx, dword [ebp - 0x168]
mov dword [ebp - 0x158], edx
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x154], eax
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0x150], ecx
mov edx, dword [ebp - 0x160]
add edx, 0xa
mov dword [ebp - 0x158], edx
mov eax, dword [ebp - 0x158]
add eax, 0x14
mov dword [ebp - 0x150], eax
push 2
call fcn.004f5950
add esp, 4
add eax, dword [ebp - 0x15c]
mov dword [ebp - 0x154], eax
push 0xcc
call fcn.00480108
add esp, 4
mov dword [ebp - 0x180], eax
mov dword [ebp - 4], 6
cmp dword [ebp - 0x180], 0
je 0x436978
push 0xcc
mov ecx, dword [ebp - 0x180]
call fcn.00413f70
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp - 0x15c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x158]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x154]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x150]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp - 0x180]
call fcn.00505f70
mov dword [ebp - 0x1e0], eax
jmp 0x436982
mov dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x218], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x218]
mov dword [ecx + 0x94], edx
push 1
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x94]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x94]
mov edx, dword [eax + 0x54]
call edx
push 0
push 0x9f
call fcn.0041a0e0
add esp, 4
push eax
push 0x9e
call fcn.0041a0e0
add esp, 4
push eax
push 0x9d
call fcn.0041a0e0
add esp, 4
push eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x94]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x94]
mov edx, dword [eax + 0x60]
call edx
push 0
push 0x9d
call fcn.0041a0e0
add esp, 4
push eax
push 0xa0
call fcn.0041a0e0
add esp, 4
push eax
push 0x9f
call fcn.0041a0e0
add esp, 4
push eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x94]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x94]
mov edx, dword [eax + 0x80]
call edx
push 0xe
push 0xe
push 3
push 0
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x94]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x94]
mov edx, dword [eax + 0x84]
call edx
mov eax, dword [ebp - 0x150]
sub eax, dword [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x154]
sub ecx, dword [ebp - 0x15c]
sub ecx, 0x19
push ecx
push 0
push 0x14
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x94]
mov ecx, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x94]
mov eax, dword [edx + 0x88]
call eax
push 0x24
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x94]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x94]
mov eax, dword [edx + 0x28]
call eax
push 0x777777
push 0x777777
push 0x777777
push 0x777777
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x94]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x94]
mov eax, dword [edx + 0x5c]
call eax
push 7
call fcn.004f50a0
add esp, 4
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x94]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x94]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 0x13c]
push ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x94]
mov ecx, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x94]
mov eax, dword [edx + 0x20]
call eax
push 0x656
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x94]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x94]
mov eax, dword [edx + 8]
call eax
push 0
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x94]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x94]
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x94]
mov dword [ebp - 0x23c], edx
lea eax, [ebp - 0x23c]
push eax
mov ecx, dword [ebp - 0x138]
add ecx, 0x50
call fcn.00444ee0
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x200], ecx
mov edx, dword [ebp - 0x158]
mov dword [ebp - 0x1fc], edx
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x1f8], eax
mov ecx, dword [ebp - 0x150]
mov dword [ebp - 0x1f4], ecx
mov edx, dword [ebp - 0x154]
mov dword [ebp - 0x200], edx
push 3
call fcn.004f5950
add esp, 4
add eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f8], eax
push 0x9c
call fcn.00480108
add esp, 4
mov dword [ebp - 0x188], eax
mov dword [ebp - 4], 7
cmp dword [ebp - 0x188], 0
je 0x436ca8
push 0x9c
mov ecx, dword [ebp - 0x188]
call fcn.00413f70
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x200]
mov dword [eax], ecx
mov edx, dword [ebp - 0x1fc]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1f8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x1f4]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x188]
call fcn.00505960
mov dword [ebp - 0x1e4], eax
jmp 0x436cb2
mov dword [ebp - 0x1e4], 0
mov edx, dword [ebp - 0x1e4]
mov dword [ebp - 0x220], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x220]
mov dword [eax + 0x98], ecx
push 0x24
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x98]
mov ecx, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x98]
mov eax, dword [edx + 0x28]
call eax
push 0xe58c19
push 0xe58c19
push 0xe58c19
push 0xe58c19
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x98]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x98]
mov eax, dword [edx + 0x5c]
call eax
push 8
call fcn.004f50a0
add esp, 4
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x98]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x98]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 0x13c]
push ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x98]
mov ecx, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x98]
mov eax, dword [edx + 0x20]
call eax
mov ecx, dword [ebp - 0x1d4]
push ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x98]
mov ecx, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x98]
mov eax, dword [edx + 0x78]
call eax
mov ecx, dword [ebp - 0x13c]
push ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x98]
mov ecx, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x98]
mov eax, dword [edx + 0x20]
call eax
push 0x657
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x98]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x98]
mov eax, dword [edx + 8]
call eax
push 0
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x98]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x98]
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x98]
mov dword [ebp - 0x24c], edx
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x138]
add ecx, 0x50
call fcn.00444ee0
push 1
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x6c]
mov eax, dword [ebp - 0x138]
mov edx, dword [edx]
mov ecx, dword [eax + 0x6c]
mov eax, dword [edx + 0x78]
call eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 0x12a0]
and edx, 1
push edx
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x8c]
mov edx, dword [ebp - 0x138]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x8c]
mov edx, dword [eax + 0x78]
call edx
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 0x12a0]
and ecx, 2
push ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x94]
mov ecx, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x94]
mov eax, dword [edx + 0x78]
call eax
mov ecx, dword [ebp - 0x138]
mov dword [ecx + 0x1364], 0x14
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0xc]
sub eax, 0x14
mov ecx, dword [ebp - 0x138]
mov dword [ecx + 0x136c], eax
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x84]
add eax, 8
mov ecx, dword [ebp - 0x138]
mov dword [ecx + 0x1368], eax
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x10]
sub eax, 0x1e
mov ecx, dword [ebp - 0x138]
mov dword [ecx + 0x1370], eax
push 1
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 0x90]
mov ecx, dword [ebp - 0x138]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x90]
mov eax, dword [edx + 0x78]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret