Function at 0x40c5b0
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x48fa21
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [str.CombineRgn]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [str.CombineRgn]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xbc]
mov ecx, dword [ebp + 0xa28]
mov eax, dword [ecx]
mov edx, dword [eax + 0x30]
call edx
push eax
lea ecx, [esp + 0x18]
call fcn.00443c76
mov eax, dword [ebp + 0xa28]
mov edx, dword [ebp + 0xc8c]
lea ecx, [eax + 0x38c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
push edx
call eax
mov eax, dword [ebp + 0xa28]
mov edx, dword [eax + 0x38c]
mov edx, dword [edx + 0x10]
lea ecx, [eax + 0x38c]
mov eax, dword [ebp + 0xc94]
push eax
call edx
mov eax, dword [ebp + 0xa28]
mov edx, dword [ebp + 0xc90]
lea ecx, [eax + 0x38c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
push edx
call eax
mov eax, dword [ebp + 0xa28]
mov edx, dword [eax + 0x38c]
mov edx, dword [edx + 0x10]
lea ecx, [eax + 0x38c]
mov eax, dword [ebp + 0xc98]
push eax
call edx
mov esi, dword [esp + 0x14]
mov ecx, dword [ebp + 0xc8c]
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x28]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x2c]
mov dword [eax + 8], esi
mov esi, dword [esp + 0x30]
mov dword [eax + 0xc], esi
mov eax, dword [edx + 0x34]
call eax
mov esi, dword [esp + 0x14]
mov ecx, dword [ebp + 0xc94]
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x28]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x2c]
mov dword [eax + 8], esi
mov esi, dword [esp + 0x30]
mov dword [eax + 0xc], esi
mov eax, dword [edx + 0x34]
call eax
mov esi, dword [esp + 0x14]
mov ecx, dword [ebp + 0xc98]
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x28]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x2c]
mov dword [eax + 8], esi
mov esi, dword [esp + 0x30]
mov dword [eax + 0xc], esi
mov eax, dword [edx + 0x34]
call eax
mov ecx, dword [ebp + 0xc90]
mov edx, dword [ecx]
sub esp, 0x10
mov esi, dword [esp + 0x24]
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x28]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x2c]
mov dword [eax + 8], esi
mov esi, dword [esp + 0x30]
mov dword [eax + 0xc], esi
mov eax, dword [edx + 0x34]
call eax
push 0
push 0
push ebp
push 0x40a030
push 0
push 0
call fcn.0046e706
mov ebx, dword [0x490260]
add esp, 0x18
push eax
mov dword [ebp + 0xec4], eax
call ebx
cmp byte [ebp + 0xa6d], 0
je 0x40c7b0
cmp byte [ebp + 0xa72], 0
jne 0x40c7b0
lea ecx, [esp + 0x2c]
call fcn.00443c66
lea ecx, [esp + 0x2c]
push ecx
mov ecx, ebp
call fcn.0045e523
push eax
call dword [0x490444]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push 0x201
push edx
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
push 0xffffffffffffffff
mov ecx, ebp
call fcn.0045e523
push eax
call dword [0x490428]
mov byte [ebp + 0xa72], 1
lea esi, [esp + 0x24]
call fcn.00425850
push 0x11
push 0x49af50
mov eax, esi
push eax
mov dword [esp + 0xc0], 0
call fcn.00415b30
mov eax, dword [esp + 0x24]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x30], esp
mov esi, esp
call fcn.004183b0
lea ecx, [esp + 0x30]
add eax, 0x10
push ecx
mov dword [esi], eax
call fcn.00425560
add esp, 8
lea esi, [ebp + 0xc88]
mov edi, esi
mov byte [esp + 0xb4], 1
call fcn.00413db0
mov byte [esp + 0xb4], 0
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c835
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, 0x49af74
call fcn.00418e10
mov byte [esp + 0xb4], 2
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea edx, [esp + 0x30]
push edx
call fcn.00415b30
mov ecx, dword [ebp + 0xc80]
mov eax, dword [ecx]
mov edx, dword [esp + 0x28]
mov eax, dword [eax + 0x2c]
push edx
call eax
lea ecx, [ebp + 0x4b0]
push ecx
call dword [0x490244]
push 0
push 0
push ebp
push 0x40a170
push 0
push 0
call fcn.0046e706
add esp, 0x18
push eax
mov dword [ebp + 0xc7c], eax
call ebx
push 0
push 0
push ebp
push 0x408980
push 0
push 0
call fcn.0046e706
add esp, 0x18
push eax
call ebx
mov edx, dword [ebp + 0xc84]
push 0x2710
push 0xa
lea esi, [ebp + 0x14]
push edx
mov ecx, esi
call fcn.004454ae
mov eax, dword [ebp + 0xc80]
push 0x3e8
push 0xb
push eax
mov ecx, esi
call fcn.004454ae
mov ecx, dword [ebp + 0xa18]
push 0x493e0
push 0xc
push ecx
mov ecx, esi
call fcn.004454ae
cmp dword [ebp + 0xef4], 8
lea esi, [ebp + 0xedc]
jb 0x40c90a
mov eax, dword [esi + 4]
jmp 0x40c90d
lea eax, [esi + 4]
mov edi, dword [0x490210]
push eax
push 0
push 0
push 0
call edi
mov dword [ebp + 0xed0], eax
xor ebx, ebx
cmp dword [ebp + 0xed0], 0
jne 0x40c9c9
cmp ebx, 3
jl 0x40c951
call dword [0x490264]
mov edx, 0x49af7c
mov ecx, eax
call fcn.00425110
push 1
mov ecx, ebp
call fcn.00444d49
xor edx, edx
push 0x62
push edx
lea eax, [esp + 0x46]
push eax
mov word [esp + 0x48], dx
call fcn.00471b20
add esp, 0xc
push 0xa
push 0x32
lea ecx, [esp + 0x44]
push ecx
call dword [0x490220]
push eax
call fcn.0046e8ac
lea eax, [esp + 0x4c]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c987
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x40]
mov ecx, esi
call fcn.00414190
cmp dword [esi + 0x18], 8
jb 0x40c9ad
mov eax, dword [esi + 4]
jmp 0x40c9b0
lea eax, [esi + 4]
push eax
push 0
push 0
push 0
call edi
inc ebx
cmp ebx, 3
mov dword [ebp + 0xed0], eax
jl 0x40c924
cmp dword [ebp + 0xf10], 8
lea ebx, [ebp + 0xef8]
jb 0x40c9dd
mov eax, dword [ebx + 4]
jmp 0x40c9e0
lea eax, [ebx + 4]
push eax
push 0
push 0
push 0
call edi
mov dword [ebp + 0xed4], eax
xor esi, esi
cmp dword [ebp + 0xed4], 0
jne 0x40ca96
cmp esi, 3
jl 0x40ca1e
call dword [0x490264]
mov edx, 0x49af7c
mov ecx, eax
call fcn.00425110
push 1
mov ecx, ebp
call fcn.00444d49
xor edx, edx
push 0x62
push edx
lea eax, [esp + 0x46]
push eax
mov word [esp + 0x48], dx
call fcn.00471b20
add esp, 0xc
push 0xa
push 0x32
lea ecx, [esp + 0x44]
push ecx
call dword [0x490220]
push eax
call fcn.0046e8ac
lea eax, [esp + 0x4c]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ca54
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x40]
mov ecx, ebx
call fcn.00414190
cmp dword [ebx + 0x18], 8
jb 0x40ca7a
mov eax, dword [ebx + 4]
jmp 0x40ca7d
lea eax, [ebx + 4]
push eax
push 0
push 0
push 0
call edi
inc esi
cmp esi, 3
mov dword [ebp + 0xed4], eax
jl 0x40c9f1
cmp dword [ebp + 0xf2c], 8
lea ebx, [ebp + 0xf14]
jb 0x40caaa
mov eax, dword [ebx + 4]
jmp 0x40caad
lea eax, [ebx + 4]
mov edi, dword [0x4901c0]
push eax
push 0
push 0
call edi
mov dword [ebp + 0xf4c], eax
xor esi, esi
cmp dword [ebp + 0xf4c], 0
jne 0x40cb65
cmp esi, 3
jl 0x40caef
call dword [0x490264]
mov edx, 0x49af7c
mov ecx, eax
call fcn.00425110
push 1
mov ecx, ebp
call fcn.00444d49
xor edx, edx
push 0x62
push edx
lea eax, [esp + 0x46]
push eax
mov word [esp + 0x48], dx
call fcn.00471b20
add esp, 0xc
push 0xa
push 0x32
lea ecx, [esp + 0x44]
push ecx
call dword [0x490220]
push eax
call fcn.0046e8ac
lea eax, [esp + 0x4c]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cb25
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x40]
mov ecx, ebx
call fcn.00414190
cmp dword [ebx + 0x18], 8
jb 0x40cb4b
mov eax, dword [ebx + 4]
jmp 0x40cb4e
lea eax, [ebx + 4]
push eax
push 0
push 0
call edi
inc esi
cmp esi, 3
mov dword [ebp + 0xf4c], eax
jl 0x40cac2
call fcn.004258c0
test eax, eax
je 0x40cb83
mov edx, 0x49af7c
mov ecx, eax
call fcn.00425110
push 1
mov ecx, ebp
call fcn.00444d49
push 0x49af84
push 1
push 0
call dword [0x490218]
mov dword [ebp + 0x7d4], eax
test eax, eax
je 0x40cbf1
push 0
lea edx, [ebp + 0x7e4]
push edx
call dword [0x4902e4]
push 0
push 0
push ebp
push 0x40c1b0
push 0
push 0
call fcn.0046e706
mov ecx, dword [ebp + 0x7d4]
add esp, 0x18
push 0
push 0
push 0
mov dword [ebp + 0x7d8], eax
push 0
lea eax, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x44], 0xff676980
mov dword [esp + 0x48], 0xffffffff
call dword [0x490214]
mov edi, dword [0x490210]
push 0
push 0
push 0
push 0
call edi
lea esi, [ebp + 0xf30]
mov dword [ebp + 0x7dc], eax
cmp dword [esi + 0x18], 8
jb 0x40cc18
mov eax, dword [esi + 4]
jmp 0x40cc1b
lea eax, [esi + 4]
push eax
push 0
push 0
push 0
call edi
mov dword [ebp + 0x7e0], eax
xor ebx, ebx
lea esp, [esp]
cmp dword [ebp + 0x7e0], 0
jne 0x40ccd5
cmp ebx, 3
jl 0x40cc5d
call dword [0x490264]
mov edx, 0x49af7c
mov ecx, eax
call fcn.00425110
push 1
mov ecx, ebp
call fcn.00444d49
xor edx, edx
push 0x62
push edx
lea eax, [esp + 0x46]
push eax
mov word [esp + 0x48], dx
call fcn.00471b20
add esp, 0xc
push 0xa
push 0x32
lea ecx, [esp + 0x44]
push ecx
call dword [0x490220]
push eax
call fcn.0046e8ac
lea eax, [esp + 0x4c]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cc93
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x40]
mov ecx, esi
call fcn.00414190
cmp dword [esi + 0x18], 8
jb 0x40ccb9
mov eax, dword [esi + 4]
jmp 0x40ccbc
lea eax, [esi + 4]
push eax
push 0
push 0
push 0
call edi
inc ebx
cmp ebx, 3
mov dword [ebp + 0x7e0], eax
jl 0x40cc30
push 0
push 0
push ebp
push 0x40c2d0
push 0
push 0
call fcn.0046e706
add esp, 0x18
push 0x49afc4
mov dword [ebp + 0xed8], eax
call dword [0x4901bc]
push 0xc0
movzx edx, ax
push 2
mov word [ebp + 0xf52], ax
mov eax, dword [ebp + 4]
push edx
push eax
call dword [0x4903c8]
push 0
push 0
push 0x7f9
mov ecx, ebp
call fcn.004446b7
mov byte [esp + 0xb4], 0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cd50
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xb4], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cd7b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.0046ddb7
add esp, 0xa4
ret 4