Function at 0x406190
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x42e168
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5a4
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
lea ecx, [esp + 0x5a4]
call fcn.00429248
lea eax, [esp + 0x1c]
mov ecx, 0x43c460
push eax
mov dword [esp + 0x5c0], 0
call fcn.0040c590
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esi + 0x68]
mov eax, 0x3c
mov dword [esi + 0x70], ecx
mov edx, dword [esi + 0x6c]
mov ecx, 0x64
mov dword [esp + 0x2d4], eax
mov dword [esp + 0x2d8], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0x334], eax
mov dword [esp + 0xd4], eax
mov dword [esp + 0x474], eax
mov dword [esp + 0x2dc], ecx
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xbc], ecx
mov dword [esp + 0x330], ecx
mov dword [esp + 0x33c], ecx
mov dword [esp + 0xdc], ecx
mov eax, ecx
mov ecx, 0x3c
mov dword [esi + 0x74], edx
mov dword [esp + 0x47c], eax
mov dword [esp + 0xf4], ecx
mov dword [esp + 0xfc], eax
mov dword [esp + 0x354], ecx
mov dword [esp + 0x35c], eax
mov ebx, 0x8c
mov ebp, 0xb4
mov edi, 0xdc
mov edx, 0x104
mov ecx, 0x12c
mov eax, 0x154
mov byte [esp + 0x13], 0
mov dword [esp + 0x2d0], 0x14
mov dword [esp + 0x338], ebx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd8], ebp
mov dword [esp + 0x470], ebp
mov dword [esp + 0x478], edi
mov dword [esp + 0xf0], edi
mov dword [esp + 0xf8], edx
mov dword [esp + 0x350], edx
mov dword [esp + 0x358], ecx
mov dword [esp + 0x110], ecx
mov dword [esp + 0x114], 0x3c
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], 0x64
mov dword [esp + 0x510], eax
mov dword [esp + 0x514], 0x3c
mov dword [esp + 0x518], 0x17c
mov dword [esp + 0x51c], 0x64
mov dword [esp + 0x130], 0x14
mov dword [esp + 0x134], 0x64
mov dword [esp + 0x138], 0x3c
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x370], 0x3c
mov dword [esp + 0x374], 0x64
mov dword [esp + 0x378], 0x64
mov dword [esp + 0x37c], ebx
mov dword [esp + 0x150], 0x64
mov dword [esp + 0x154], 0x64
mov dword [esp + 0x158], ebx
mov dword [esp + 0x15c], ebx
mov dword [esp + 0x490], ebx
mov dword [esp + 0x494], 0x64
mov dword [esp + 0x498], ebp
mov dword [esp + 0x49c], ebx
mov dword [esp + 0x170], ebp
mov dword [esp + 0x174], 0x64
mov dword [esp + 0x178], edi
mov dword [esp + 0x17c], ebx
mov dword [esp + 0x390], edi
mov dword [esp + 0x394], 0x64
mov dword [esp + 0x398], edx
mov dword [esp + 0x39c], ebx
mov dword [esp + 0x190], edx
mov dword [esp + 0x194], 0x64
mov dword [esp + 0x198], ecx
mov dword [esp + 0x19c], ebx
mov dword [esp + 0x590], ecx
mov dword [esp + 0x594], 0x64
mov dword [esp + 0x598], eax
mov dword [esp + 0x59c], ebx
mov dword [esp + 0x1b0], eax
mov dword [esp + 0x1b4], 0x64
mov dword [esp + 0x1b8], 0x17c
mov dword [esp + 0x1bc], ebx
mov dword [esp + 0x3b0], 0x14
mov dword [esp + 0x3b4], ebx
mov dword [esp + 0x3b8], 0x3c
mov dword [esp + 0x3bc], ebp
mov dword [esp + 0x1d0], 0x3c
mov dword [esp + 0x1d4], ebx
mov dword [esp + 0x1d8], 0x64
mov dword [esp + 0x1dc], ebp
mov dword [esp + 0x4b0], 0x64
mov dword [esp + 0x4b4], ebx
mov dword [esp + 0x4b8], ebx
mov dword [esp + 0x4bc], ebp
mov dword [esp + 0x1f0], ebx
mov dword [esp + 0x1f4], ebx
mov dword [esp + 0x1f8], ebp
mov dword [esp + 0x1fc], ebp
mov dword [esp + 0x3d0], ebp
mov dword [esp + 0x3d4], ebx
mov dword [esp + 0x3d8], edi
mov dword [esp + 0x3dc], ebp
mov dword [esp + 0x210], edi
mov dword [esp + 0x214], ebx
mov dword [esp + 0x218], edx
mov dword [esp + 0x21c], ebp
mov dword [esp + 0x530], edx
mov dword [esp + 0x534], ebx
mov dword [esp + 0x538], ecx
mov dword [esp + 0x53c], ebp
mov dword [esp + 0x230], ecx
mov dword [esp + 0x234], ebx
mov dword [esp + 0x238], eax
mov dword [esp + 0x23c], ebp
mov dword [esp + 0x3f0], eax
mov dword [esp + 0x3f4], ebx
mov dword [esp + 0x3f8], 0x17c
mov dword [esp + 0x3fc], ebp
mov dword [esp + 0x250], 0x14
mov dword [esp + 0x254], ebp
mov dword [esp + 0x258], 0x3c
mov dword [esp + 0x25c], edi
mov dword [esp + 0x4d0], 0x3c
mov dword [esp + 0x4d4], ebp
mov dword [esp + 0x4d8], 0x64
mov dword [esp + 0x4dc], edi
mov dword [esp + 0x270], 0x64
mov dword [esp + 0x274], ebp
mov dword [esp + 0x278], ebx
mov dword [esp + 0x27c], edi
mov dword [esp + 0x410], ebx
mov dword [esp + 0x414], ebp
mov dword [esp + 0x418], ebp
mov dword [esp + 0x41c], edi
mov dword [esp + 0x290], ebp
mov dword [esp + 0x294], ebp
mov dword [esp + 0x298], edi
mov dword [esp + 0x29c], edi
mov dword [esp + 0x570], edi
mov dword [esp + 0x574], ebp
mov dword [esp + 0x578], edx
mov dword [esp + 0x57c], edi
mov dword [esp + 0x2b0], edx
mov dword [esp + 0x2b4], ebp
mov dword [esp + 0x2b8], ecx
mov dword [esp + 0x2bc], edi
mov dword [esp + 0x430], ecx
mov dword [esp + 0x434], ebp
mov dword [esp + 0x438], eax
mov dword [esp + 0x43c], edi
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], ebp
mov dword [esp + 0x98], 0x17c
mov dword [esp + 0x9c], edi
mov dword [esp + 0x4f0], 0x14
mov dword [esp + 0x4f4], edi
mov dword [esp + 0x4f8], 0x3c
mov dword [esp + 0x4fc], edx
mov dword [esp + 0x2f0], 0x3c
mov dword [esp + 0x2f4], edi
mov dword [esp + 0x2f8], 0x64
mov dword [esp + 0x2fc], edx
mov dword [esp + 0x450], 0x64
mov dword [esp + 0x454], edi
mov dword [esp + 0x458], ebx
mov dword [esp + 0x45c], edx
mov dword [esp + 0x310], ebx
mov dword [esp + 0x314], edi
mov dword [esp + 0x318], ebp
mov dword [esp + 0x31c], edx
mov dword [esp + 0x550], ebp
mov dword [esp + 0x554], edi
mov dword [esp + 0x558], edi
mov dword [esp + 0x55c], edx
mov dword [esp + 0xa0], edi
mov dword [esp + 0xa4], edi
mov dword [esp + 0xa8], edx
mov dword [esp + 0xac], edx
mov dword [esp + 0xc0], edx
mov dword [esp + 0xc4], edi
mov dword [esp + 0xc8], ecx
mov dword [esp + 0xcc], edx
mov dword [esp + 0xe0], ecx
mov dword [esp + 0xe4], edi
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], edx
mov dword [esp + 0x100], eax
mov dword [esp + 0x104], edi
mov dword [esp + 0x108], 0x17c
mov dword [esp + 0x10c], edx
mov dword [esp + 0x120], 0x14
mov dword [esp + 0x124], edx
mov dword [esp + 0x128], 0x3c
mov dword [esp + 0x12c], ecx
mov dword [esp + 0x140], 0x3c
mov dword [esp + 0x144], edx
mov dword [esp + 0x148], 0x64
mov dword [esp + 0x14c], ecx
mov dword [esp + 0x160], 0x64
mov dword [esp + 0x164], edx
mov dword [esp + 0x168], ebx
mov dword [esp + 0x16c], ecx
mov dword [esp + 0x180], ebx
mov dword [esp + 0x184], edx
mov dword [esp + 0x188], ebp
mov dword [esp + 0x18c], ecx
mov dword [esp + 0x1a0], ebp
mov dword [esp + 0x1a4], edx
mov dword [esp + 0x1a8], edi
mov dword [esp + 0x1ac], ecx
mov dword [esp + 0x1c0], edi
mov dword [esp + 0x1c4], edx
mov dword [esp + 0x1c8], edx
mov dword [esp + 0x1cc], ecx
mov dword [esp + 0x1e0], edx
mov dword [esp + 0x1e4], edx
mov dword [esp + 0x1e8], ecx
mov dword [esp + 0x1ec], ecx
mov dword [esp + 0x200], ecx
mov dword [esp + 0x204], edx
mov dword [esp + 0x208], eax
mov dword [esp + 0x20c], ecx
mov dword [esp + 0x220], eax
mov dword [esp + 0x224], edx
mov dword [esp + 0x228], 0x17c
mov dword [esp + 0x22c], ecx
mov dword [esp + 0x240], 0x14
mov dword [esp + 0x244], ecx
mov dword [esp + 0x248], 0x3c
mov dword [esp + 0x24c], eax
mov dword [esp + 0x260], 0x3c
mov dword [esp + 0x264], ecx
mov dword [esp + 0x268], 0x64
mov dword [esp + 0x26c], eax
mov dword [esp + 0x280], 0x64
mov dword [esp + 0x284], ecx
mov dword [esp + 0x288], ebx
mov dword [esp + 0x28c], eax
mov dword [esp + 0x2a0], ebx
mov dword [esp + 0x2a4], ecx
mov dword [esp + 0x2a8], ebp
mov dword [esp + 0x2ac], eax
mov dword [esp + 0x2c0], ebp
mov dword [esp + 0x2c4], ecx
mov dword [esp + 0x2c8], edi
mov dword [esp + 0x2cc], eax
mov dword [esp + 0x2e0], edi
mov dword [esp + 0x2e4], ecx
mov dword [esp + 0x2e8], edx
mov dword [esp + 0x2ec], eax
mov dword [esp + 0x300], edx
mov dword [esp + 0x304], ecx
mov dword [esp + 0x308], ecx
mov dword [esp + 0x30c], eax
mov dword [esp + 0x320], ecx
mov dword [esp + 0x324], ecx
mov dword [esp + 0x328], eax
mov dword [esp + 0x32c], eax
mov dword [esp + 0x340], eax
mov dword [esp + 0x344], ecx
mov dword [esp + 0x348], 0x17c
mov dword [esp + 0x34c], eax
mov dword [esp + 0x360], 0x14
mov dword [esp + 0x364], eax
mov dword [esp + 0x368], 0x3c
mov dword [esp + 0x36c], 0x17c
mov dword [esp + 0x380], 0x3c
mov dword [esp + 0x384], eax
mov dword [esp + 0x388], 0x64
mov dword [esp + 0x38c], 0x17c
mov dword [esp + 0x3a0], 0x64
mov dword [esp + 0x3a4], eax
mov dword [esp + 0x3a8], ebx
mov dword [esp + 0x3ac], 0x17c
mov dword [esp + 0x3c0], ebx
mov dword [esp + 0x3c4], eax
mov dword [esp + 0x3c8], ebp
mov dword [esp + 0x3cc], 0x17c
mov dword [esp + 0x3e0], ebp
mov dword [esp + 0x3e4], eax
mov dword [esp + 0x3e8], edi
mov dword [esp + 0x3ec], 0x17c
mov dword [esp + 0x400], edi
mov dword [esp + 0x404], eax
mov dword [esp + 0x408], edx
mov dword [esp + 0x40c], 0x17c
mov dword [esp + 0x420], edx
mov dword [esp + 0x424], eax
mov dword [esp + 0x428], ecx
mov dword [esp + 0x42c], 0x17c
mov dword [esp + 0x440], ecx
mov dword [esp + 0x444], eax
mov dword [esp + 0x448], eax
mov dword [esp + 0x44c], 0x17c
mov dword [esp + 0x460], eax
mov dword [esp + 0x464], eax
mov dword [esp + 0x468], 0x17c
mov dword [esp + 0x568], eax
mov dword [esp + 0x580], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x548], ecx
mov dword [esp + 0x560], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x528], edx
mov dword [esp + 0x540], edx
mov dword [esp + 0x4c8], ebx
mov dword [esp + 0x4e0], ebx
mov dword [esp + 0x4e8], ebp
mov dword [esp + 0x500], ebp
push eax
lea edx, [esp + 0x2d4]
mov ebx, 0x17c
mov ebp, 0x1a4
push ecx
push edx
mov dword [esp + 0x478], 0x17c
mov dword [esp + 0x48c], 0x14
mov dword [esp + 0x490], 0x17c
mov dword [esp + 0x494], 0x3c
mov dword [esp + 0x498], 0x1a4
mov dword [esp + 0x4ac], 0x3c
mov dword [esp + 0x4b0], 0x17c
mov dword [esp + 0x4b4], 0x64
mov dword [esp + 0x4b8], 0x1a4
mov dword [esp + 0x4cc], 0x64
mov dword [esp + 0x4d0], 0x17c
mov dword [esp + 0x4d8], 0x1a4
mov dword [esp + 0x4f0], ebx
mov dword [esp + 0x4f8], 0x1a4
mov dword [esp + 0x510], ebx
mov dword [esp + 0x514], edi
mov dword [esp + 0x518], ebp
mov dword [esp + 0x52c], edi
mov dword [esp + 0x530], ebx
mov dword [esp + 0x538], ebp
mov dword [esp + 0x550], ebx
mov dword [esp + 0x558], ebp
mov dword [esp + 0x570], ebx
mov dword [esp + 0x578], ebp
mov dword [esp + 0x590], ebx
mov dword [esp + 0x594], ebx
mov dword [esp + 0x598], ebp
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
mov ebx, 1
je 0x406c95
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push ebx
call edi
test ax, ax
jge 0x406c9b
xor eax, eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
cmp dword [esi + 0x1e0], eax
jne 0x406c9b
mov byte [esp + 0x13], bl
jmp 0x406c9b
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0xb4]
push ecx
push edx
xor ebp, ebp
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x406cd3
push ebx
call edi
test ax, ax
jge 0x406cd3
mov dword [esi + 0x70], ebp
mov dword [esi + 0x74], ebx
cmp dword [esi + 0x1e4], ebp
jne 0x406cd3
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x334]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x406d0d
push ebx
call edi
test ax, ax
jge 0x406d0d
mov dword [esi + 0x70], ebp
mov dword [esi + 0x74], 2
cmp dword [esi + 0x1e8], ebp
jne 0x406d0d
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0xd4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x406d47
push ebx
call edi
test ax, ax
jge 0x406d47
mov dword [esi + 0x70], ebp
mov dword [esi + 0x74], 3
cmp dword [esi + 0x1ec], ebp
jne 0x406d47
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x474]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x406d81
push ebx
call edi
test ax, ax
jge 0x406d81
mov dword [esi + 0x70], ebp
mov dword [esi + 0x74], 4
cmp dword [esi + 0x1f0], ebp
jne 0x406d81
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0xf4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x406dbb
push ebx
call edi
test ax, ax
jge 0x406dbb
mov dword [esi + 0x70], ebp
mov dword [esi + 0x74], 5
cmp dword [esi + 0x1f4], ebp
jne 0x406dbb
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x354]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x406df5
push ebx
call edi
test ax, ax
jge 0x406df5
mov dword [esi + 0x70], ebp
mov dword [esi + 0x74], 6
cmp dword [esi + 0x1f8], ebp
jne 0x406df5
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x114]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x406e2f
push ebx
call edi
test ax, ax
jge 0x406e2f
mov dword [esi + 0x70], ebp
mov dword [esi + 0x74], 7
cmp dword [esi + 0x1fc], ebp
jne 0x406e2f
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x514]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x406e69
push ebx
call edi
test ax, ax
jge 0x406e69
mov dword [esi + 0x70], ebp
mov dword [esi + 0x74], 8
cmp dword [esi + 0x200], ebp
jne 0x406e69
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x134]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x406e9f
push ebx
call edi
test ax, ax
jge 0x406e9f
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebp
cmp dword [esi + 0x204], ebp
jne 0x406e9f
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x374]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x406ed5
push ebx
call edi
test ax, ax
jge 0x406ed5
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
cmp dword [esi + 0x208], ebp
jne 0x406ed5
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x154]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x406f0f
push ebx
call edi
test ax, ax
jge 0x406f0f
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], 2
cmp dword [esi + 0x20c], ebp
jne 0x406f0f
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x494]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x406f49
push ebx
call edi
test ax, ax
jge 0x406f49
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], 3
cmp dword [esi + 0x210], ebp
jne 0x406f49
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x174]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x406f83
push ebx
call edi
test ax, ax
jge 0x406f83
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], 4
cmp dword [esi + 0x214], ebp
jne 0x406f83
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x394]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x406fbd
push ebx
call edi
test ax, ax
jge 0x406fbd
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], 5
cmp dword [esi + 0x218], ebp
jne 0x406fbd
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x194]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x406ff7
push ebx
call edi
test ax, ax
jge 0x406ff7
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], 6
cmp dword [esi + 0x21c], ebp
jne 0x406ff7
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x594]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407031
push ebx
call edi
test ax, ax
jge 0x407031
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], 7
cmp dword [esi + 0x220], ebp
jne 0x407031
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x1b4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x40706b
push ebx
call edi
test ax, ax
jge 0x40706b
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], 8
cmp dword [esi + 0x224], ebp
jne 0x40706b
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x3b4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4070a5
push ebx
call edi
test ax, ax
jge 0x4070a5
mov dword [esi + 0x70], 2
mov dword [esi + 0x74], ebp
cmp dword [esi + 0x228], ebp
jne 0x4070a5
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x1d4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4070df
push ebx
call edi
test ax, ax
jge 0x4070df
mov dword [esi + 0x70], 2
mov dword [esi + 0x74], ebx
cmp dword [esi + 0x22c], ebp
jne 0x4070df
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x4b4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x40711a
push ebx
call edi
test ax, ax
jge 0x40711a
mov eax, 2
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
cmp dword [esi + 0x230], ebp
jne 0x40711a
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x1f4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407158
push ebx
call edi
test ax, ax
jge 0x407158
mov dword [esi + 0x70], 2
mov dword [esi + 0x74], 3
cmp dword [esi + 0x234], ebp
jne 0x407158
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x3d4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407196
push ebx
call edi
test ax, ax
jge 0x407196
mov dword [esi + 0x70], 2
mov dword [esi + 0x74], 4
cmp dword [esi + 0x238], ebp
jne 0x407196
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x214]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4071d4
push ebx
call edi
test ax, ax
jge 0x4071d4
mov dword [esi + 0x70], 2
mov dword [esi + 0x74], 5
cmp dword [esi + 0x23c], ebp
jne 0x4071d4
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x534]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407212
push ebx
call edi
test ax, ax
jge 0x407212
mov dword [esi + 0x70], 2
mov dword [esi + 0x74], 6
cmp dword [esi + 0x240], ebp
jne 0x407212
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x234]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407250
push ebx
call edi
test ax, ax
jge 0x407250
mov dword [esi + 0x70], 2
mov dword [esi + 0x74], 7
cmp dword [esi + 0x244], ebp
jne 0x407250
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x3f4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x40728e
push ebx
call edi
test ax, ax
jge 0x40728e
mov dword [esi + 0x70], 2
mov dword [esi + 0x74], 8
cmp dword [esi + 0x248], ebp
jne 0x40728e
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x254]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4072c8
push ebx
call edi
test ax, ax
jge 0x4072c8
mov dword [esi + 0x70], 3
mov dword [esi + 0x74], ebp
cmp dword [esi + 0x24c], ebp
jne 0x4072c8
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x4d4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407302
push ebx
call edi
test ax, ax
jge 0x407302
mov dword [esi + 0x70], 3
mov dword [esi + 0x74], ebx
cmp dword [esi + 0x250], ebp
jne 0x407302
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x274]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407340
push ebx
call edi
test ax, ax
jge 0x407340
mov dword [esi + 0x70], 3
mov dword [esi + 0x74], 2
cmp dword [esi + 0x254], ebp
jne 0x407340
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x414]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x40737b
push ebx
call edi
test ax, ax
jge 0x40737b
mov eax, 3
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
cmp dword [esi + 0x258], ebp
jne 0x40737b
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x294]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4073b9
push ebx
call edi
test ax, ax
jge 0x4073b9
mov dword [esi + 0x70], 3
mov dword [esi + 0x74], 4
cmp dword [esi + 0x25c], ebp
jne 0x4073b9
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x574]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4073f7
push ebx
call edi
test ax, ax
jge 0x4073f7
mov dword [esi + 0x70], 3
mov dword [esi + 0x74], 5
cmp dword [esi + 0x260], ebp
jne 0x4073f7
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x2b4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407435
push ebx
call edi
test ax, ax
jge 0x407435
mov dword [esi + 0x70], 3
mov dword [esi + 0x74], 6
cmp dword [esi + 0x264], ebp
jne 0x407435
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x434]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407473
push ebx
call edi
test ax, ax
jge 0x407473
mov dword [esi + 0x70], 3
mov dword [esi + 0x74], 7
cmp dword [esi + 0x268], ebp
jne 0x407473
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x94]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4074b1
push ebx
call edi
test ax, ax
jge 0x4074b1
mov dword [esi + 0x70], 3
mov dword [esi + 0x74], 8
cmp dword [esi + 0x26c], ebp
jne 0x4074b1
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x4f4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4074eb
push ebx
call edi
test ax, ax
jge 0x4074eb
mov dword [esi + 0x70], 4
mov dword [esi + 0x74], ebp
cmp dword [esi + 0x270], ebp
jne 0x4074eb
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x2f4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407525
push ebx
call edi
test ax, ax
jge 0x407525
mov dword [esi + 0x70], 4
mov dword [esi + 0x74], ebx
cmp dword [esi + 0x274], ebp
jne 0x407525
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x454]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407563
push ebx
call edi
test ax, ax
jge 0x407563
mov dword [esi + 0x70], 4
mov dword [esi + 0x74], 2
cmp dword [esi + 0x278], ebp
jne 0x407563
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x314]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4075a1
push ebx
call edi
test ax, ax
jge 0x4075a1
mov dword [esi + 0x70], 4
mov dword [esi + 0x74], 3
cmp dword [esi + 0x27c], ebp
jne 0x4075a1
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x554]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4075dc
push ebx
call edi
test ax, ax
jge 0x4075dc
mov eax, 4
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
cmp dword [esi + 0x280], ebp
jne 0x4075dc
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0xa4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x40761a
push ebx
call edi
test ax, ax
jge 0x40761a
mov dword [esi + 0x70], 4
mov dword [esi + 0x74], 5
cmp dword [esi + 0x284], ebp
jne 0x40761a
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0xc4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407658
push ebx
call edi
test ax, ax
jge 0x407658
mov dword [esi + 0x70], 4
mov dword [esi + 0x74], 6
cmp dword [esi + 0x288], ebp
jne 0x407658
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0xe4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407696
push ebx
call edi
test ax, ax
jge 0x407696
mov dword [esi + 0x70], 4
mov dword [esi + 0x74], 7
cmp dword [esi + 0x28c], ebp
jne 0x407696
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x104]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4076d4
push ebx
call edi
test ax, ax
jge 0x4076d4
mov dword [esi + 0x70], 4
mov dword [esi + 0x74], 8
cmp dword [esi + 0x290], ebp
jne 0x4076d4
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x124]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x40770e
push ebx
call edi
test ax, ax
jge 0x40770e
mov dword [esi + 0x70], 5
mov dword [esi + 0x74], ebp
cmp dword [esi + 0x294], ebp
jne 0x40770e
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x144]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407748
push ebx
call edi
test ax, ax
jge 0x407748
mov dword [esi + 0x70], 5
mov dword [esi + 0x74], ebx
cmp dword [esi + 0x298], ebp
jne 0x407748
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x164]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407786
push ebx
call edi
test ax, ax
jge 0x407786
mov dword [esi + 0x70], 5
mov dword [esi + 0x74], 2
cmp dword [esi + 0x29c], ebp
jne 0x407786
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x184]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4077c4
push ebx
call edi
test ax, ax
jge 0x4077c4
mov dword [esi + 0x70], 5
mov dword [esi + 0x74], 3
cmp dword [esi + 0x2a0], ebp
jne 0x4077c4
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x1a4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407802
push ebx
call edi
test ax, ax
jge 0x407802
mov dword [esi + 0x70], 5
mov dword [esi + 0x74], 4
cmp dword [esi + 0x2a4], ebp
jne 0x407802
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x1c4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x40783d
push ebx
call edi
test ax, ax
jge 0x40783d
mov eax, 5
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
cmp dword [esi + 0x2a8], ebp
jne 0x40783d
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x1e4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x40787b
push ebx
call edi
test ax, ax
jge 0x40787b
mov dword [esi + 0x70], 5
mov dword [esi + 0x74], 6
cmp dword [esi + 0x2ac], ebp
jne 0x40787b
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x204]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4078b9
push ebx
call edi
test ax, ax
jge 0x4078b9
mov dword [esi + 0x70], 5
mov dword [esi + 0x74], 7
cmp dword [esi + 0x2b0], ebp
jne 0x4078b9
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x224]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4078f7
push ebx
call edi
test ax, ax
jge 0x4078f7
mov dword [esi + 0x70], 5
mov dword [esi + 0x74], 8
cmp dword [esi + 0x2b4], ebp
jne 0x4078f7
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x244]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407931
push ebx
call edi
test ax, ax
jge 0x407931
mov dword [esi + 0x70], 6
mov dword [esi + 0x74], ebp
cmp dword [esi + 0x2b8], ebp
jne 0x407931
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x264]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x40796b
push ebx
call edi
test ax, ax
jge 0x40796b
mov dword [esi + 0x70], 6
mov dword [esi + 0x74], ebx
cmp dword [esi + 0x2bc], ebp
jne 0x40796b
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x284]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4079a9
push ebx
call edi
test ax, ax
jge 0x4079a9
mov dword [esi + 0x70], 6
mov dword [esi + 0x74], 2
cmp dword [esi + 0x2c0], ebp
jne 0x4079a9
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x2a4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4079e7
push ebx
call edi
test ax, ax
jge 0x4079e7
mov dword [esi + 0x70], 6
mov dword [esi + 0x74], 3
cmp dword [esi + 0x2c4], ebp
jne 0x4079e7
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x2c4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407a25
push ebx
call edi
test ax, ax
jge 0x407a25
mov dword [esi + 0x70], 6
mov dword [esi + 0x74], 4
cmp dword [esi + 0x2c8], ebp
jne 0x407a25
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x2e4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407a63
push ebx
call edi
test ax, ax
jge 0x407a63
mov dword [esi + 0x70], 6
mov dword [esi + 0x74], 5
cmp dword [esi + 0x2cc], ebp
jne 0x407a63
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x304]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407a9e
push ebx
call edi
test ax, ax
jge 0x407a9e
mov eax, 6
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
cmp dword [esi + 0x2d0], ebp
jne 0x407a9e
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x324]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407ade
push ebx
call edi
test ax, ax
jge 0x407ade
mov eax, dword [esi + 0x2d4]
mov dword [esi + 0x70], 6
cmp eax, ebp
mov dword [esi + 0x74], 7
jne 0x407ade
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x344]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407b1e
push ebx
call edi
test ax, ax
jge 0x407b1e
mov eax, dword [esi + 0x2d8]
mov dword [esi + 0x70], 6
cmp eax, ebp
mov dword [esi + 0x74], 8
jne 0x407b1e
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x364]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407b5a
push ebx
call edi
test ax, ax
jge 0x407b5a
mov eax, dword [esi + 0x2dc]
mov dword [esi + 0x70], 7
cmp eax, ebp
mov dword [esi + 0x74], ebp
jne 0x407b5a
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x384]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407b96
push ebx
call edi
test ax, ax
jge 0x407b96
mov eax, dword [esi + 0x2e0]
mov dword [esi + 0x70], 7
cmp eax, ebp
mov dword [esi + 0x74], ebx
jne 0x407b96
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x3a4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407bd6
push ebx
call edi
test ax, ax
jge 0x407bd6
mov eax, dword [esi + 0x2e4]
mov dword [esi + 0x70], 7
cmp eax, ebp
mov dword [esi + 0x74], 2
jne 0x407bd6
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x3c4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407c16
push ebx
call edi
test ax, ax
jge 0x407c16
mov eax, dword [esi + 0x2e8]
mov dword [esi + 0x70], 7
cmp eax, ebp
mov dword [esi + 0x74], 3
jne 0x407c16
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x3e4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407c56
push ebx
call edi
test ax, ax
jge 0x407c56
mov eax, dword [esi + 0x2ec]
mov dword [esi + 0x70], 7
cmp eax, ebp
mov dword [esi + 0x74], 4
jne 0x407c56
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x404]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407c96
push ebx
call edi
test ax, ax
jge 0x407c96
mov eax, dword [esi + 0x2f0]
mov dword [esi + 0x70], 7
cmp eax, ebp
mov dword [esi + 0x74], 5
jne 0x407c96
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x424]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407cd6
push ebx
call edi
test ax, ax
jge 0x407cd6
mov eax, dword [esi + 0x2f4]
mov dword [esi + 0x70], 7
cmp eax, ebp
mov dword [esi + 0x74], 6
jne 0x407cd6
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x444]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407d11
push ebx
call edi
test ax, ax
jge 0x407d11
mov eax, 7
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
cmp dword [esi + 0x2f8], ebp
jne 0x407d11
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x464]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407d51
push ebx
call edi
test ax, ax
jge 0x407d51
mov eax, dword [esi + 0x2fc]
mov dword [esi + 0x70], 7
cmp eax, ebp
mov dword [esi + 0x74], 8
jne 0x407d51
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x484]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407d8d
push ebx
call edi
test ax, ax
jge 0x407d8d
mov eax, dword [esi + 0x300]
mov dword [esi + 0x70], 8
cmp eax, ebp
mov dword [esi + 0x74], ebp
jne 0x407d8d
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x4a4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407dc9
push ebx
call edi
test ax, ax
jge 0x407dc9
mov eax, dword [esi + 0x304]
mov dword [esi + 0x70], 8
cmp eax, ebp
mov dword [esi + 0x74], ebx
jne 0x407dc9
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x4c4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407e09
push ebx
call edi
test ax, ax
jge 0x407e09
mov eax, dword [esi + 0x308]
mov dword [esi + 0x70], 8
cmp eax, ebp
mov dword [esi + 0x74], 2
jne 0x407e09
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x4e4]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407e49
push ebx
call edi
test ax, ax
jge 0x407e49
mov eax, dword [esi + 0x30c]
mov dword [esi + 0x70], 8
cmp eax, ebp
mov dword [esi + 0x74], 3
jne 0x407e49
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x504]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407e89
push ebx
call edi
test ax, ax
jge 0x407e89
mov eax, dword [esi + 0x310]
mov dword [esi + 0x70], 8
cmp eax, ebp
mov dword [esi + 0x74], 4
jne 0x407e89
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x524]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407ec9
push ebx
call edi
test ax, ax
jge 0x407ec9
mov eax, dword [esi + 0x314]
mov dword [esi + 0x70], 8
cmp eax, ebp
mov dword [esi + 0x74], 5
jne 0x407ec9
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x544]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407f09
push ebx
call edi
test ax, ax
jge 0x407f09
mov eax, dword [esi + 0x318]
mov dword [esi + 0x70], 8
cmp eax, ebp
mov dword [esi + 0x74], 6
jne 0x407f09
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x564]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407f49
push ebx
call edi
test ax, ax
jge 0x407f49
mov eax, dword [esi + 0x31c]
mov dword [esi + 0x70], 8
cmp eax, ebp
mov dword [esi + 0x74], 7
jne 0x407f49
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
lea edx, [esp + 0x584]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x407f84
push ebx
call edi
test ax, ax
jge 0x407f84
mov eax, 8
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
cmp dword [esi + 0x320], ebp
jne 0x407f84
mov byte [esp + 0x13], bl
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x68]
cmp eax, ecx
jne 0x407f9c
mov ecx, dword [esi + 0x74]
mov edx, dword [esi + 0x6c]
cmp ecx, edx
je 0x40802f
mov cl, byte [esp + 0x13]
test cl, cl
jne 0x40802f
mov ecx, esi
call fcn.0040a0e0
mov edx, dword [esi + 0x70]
mov edi, dword [esi + 0x38c]
mov dword [esi + 0x68], edx
mov eax, dword [esi + 0x74]
inc edi
push 6
mov ecx, esi
mov dword [esi + 0x6c], eax
mov dword [esi + 0x38c], edi
call fcn.00402300
cmp eax, 5
ja case.default.0x407fd6
jmp dword [eax*4 + 0x40920c]
push ebx
push str.soundd0.wav
jmp 0x40800b
push ebx
push str.soundd1.wav
jmp 0x40800b
push ebx
push str.soundd2.wav
jmp 0x40800b
push ebx
push str.soundd3.wav
jmp 0x40800b
push ebx
push str.soundd4.wav
jmp 0x40800b
push ebx
push str.soundd5.wav
call dword [sym.imp.WINMM.dll_sndPlaySoundA]
lea ecx, [esp + 0x5a0]
mov dword [esp + 0x5bc], 0xffffffff
call fcn.004292ba
xor al, al
jmp 0x4091f3
mov edx, dword [esi + 0x74]
lea ecx, [eax + eax*8]
add ecx, edx
cmp dword [esi + ecx*4 + 0x1e0], ebp
je 0x4091c0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi + 0x39c]
cmp eax, 0x32
jbe 0x408098
call edi
mov ecx, dword [esi + 0x330]
mov dword [esi + 0x39c], eax
cmp byte [esi + 0x398], bl
jne 0x408084
inc ecx
mov eax, ecx
mov dword [esi + 0x330], ecx
cmp eax, 2
jne 0x408098
mov byte [esi + 0x398], 0
jmp 0x408098
dec ecx
mov eax, ecx
mov dword [esi + 0x330], ecx
cmp eax, 0xfffffffe
jne 0x408098
mov byte [esi + 0x398], bl
call edi
sub eax, dword [esi + 0x3a0]
cmp eax, 0x1f4
jbe 0x4080bb
call edi
push 5
mov ecx, esi
mov dword [esi + 0x3a0], eax
call fcn.00402300
mov dword [esi + 0x5c], eax
mov edx, dword [0x43a31c]
lea edi, [esi + 0x3f8]
push edx
push edi
mov ecx, 0x43c460
call fcn.0040d7d0
cmp eax, ebp
je 0x4080ef
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
push eax
push ecx
lea eax, [esp + 0x24]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d030
mov ecx, dword [0x43a314]
push ecx
push edi
mov ecx, 0x43c460
call fcn.0040d7d0
cmp eax, ebp
je 0x40811d
mov edx, dword [eax + 0x20]
push eax
mov eax, dword [eax + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d030
mov edx, dword [0x43a30c]
mov ecx, 0x43c460
push edx
push edi
call fcn.0040d7d0
cmp eax, ebp
je 0x40814b
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
push eax
push ecx
lea eax, [esp + 0x24]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d030
mov ecx, dword [0x43a304]
push ecx
push edi
mov ecx, 0x43c460
call fcn.0040d7d0
cmp eax, ebp
je 0x408179
mov edx, dword [eax + 0x20]
push eax
mov eax, dword [eax + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d030
mov edx, dword [0x43a2fc]
mov ecx, 0x43c460
push edx
push edi
call fcn.0040d7d0
cmp eax, ebp
je 0x4081a7
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
push eax
push ecx
lea eax, [esp + 0x24]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d030
mov ecx, dword [0x43a2f4]
push ecx
push edi
mov ecx, 0x43c460
call fcn.0040d7d0
cmp eax, ebp
je 0x4081d5
mov edx, dword [eax + 0x20]
push eax
mov eax, dword [eax + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d030
mov eax, 0x1e
mov edx, 5
mov dword [esp + 0x3c], eax
mov dword [esp + 0x5c], eax
mov eax, 0x1ef
mov dword [esp + 0x34], edx
mov dword [esp + 0x54], edx
mov ecx, 0x199
mov dword [esp + 0x80], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x78], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x60], ecx
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
mov dword [esp + 0x3c], 0x200
mov dword [esp + 0x44], 0x219
mov dword [esp + 0x5c], 0x1e2
mov dword [esp + 0x64], 0x1fb
mov dword [esp + 0x80], 0x15c
mov dword [esp + 0x88], 0x177
mov dword [esp + 0x50], 0x185
mov dword [esp + 0x58], 0x1a0
mov dword [esp + 0x70], 0x133
mov dword [esp + 0x78], 0x14e
mov dword [esp + 0x90], 0x1bd
mov dword [esp + 0x94], 0xb9
mov dword [esp + 0x98], 0x1e5
call dword [sym.imp.USER32.dll_PtInRect]
mov ebp, dword [sym.imp.WINMM.dll_sndPlaySoundA]
test eax, eax
je 0x408349
mov edx, dword [0x43a2ec]
mov ecx, 0x43c460
push edx
push edi
call fcn.0040d7d0
test eax, eax
je 0x4082e0
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
push eax
push ecx
lea eax, [esp + 0x24]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d030
cmp byte [esi + 0x389], bl
jne 0x4082f7
push ebx
push str.sound_a0.wav
call ebp
mov byte [esi + 0x389], 0
push ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x408349
mov ecx, dword [0x43a2d4]
push ecx
push edi
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x408331
mov edx, dword [eax + 0x20]
push eax
mov eax, dword [eax + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d030
push ebx
push str.sound_b0.wav
mov dword [esi + 0x64], ebx
mov byte [esi + 0x38a], bl
call ebp
mov byte [esi + 0x38a], 0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x54]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x408401
mov edx, dword [0x43a2bc]
mov ecx, 0x43c460
push edx
push edi
call fcn.0040d7d0
test eax, eax
je 0x408394
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
push eax
push ecx
lea eax, [esp + 0x24]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d030
cmp byte [esi + 0x389], bl
jne 0x4083ab
push ebx
push str.sound_a0.wav
call ebp
mov byte [esi + 0x389], 0
push ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x408401
mov ecx, dword [0x43a2b4]
push ecx
push edi
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x4083e5
mov edx, dword [eax + 0x20]
push eax
mov eax, dword [eax + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d030
push ebx
push str.sound_b0.wav
mov dword [esi + 0x64], 2
mov byte [esi + 0x38a], bl
call ebp
mov byte [esi + 0x38a], 0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x74]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4084b9
mov edx, dword [0x43a2ac]
mov ecx, 0x43c460
push edx
push edi
call fcn.0040d7d0
test eax, eax
je 0x40844c
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
push eax
push ecx
lea eax, [esp + 0x24]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d030
cmp byte [esi + 0x389], bl
jne 0x408463
push ebx
push str.sound_a0.wav
call ebp
mov byte [esi + 0x389], 0
push ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x4084b9
mov ecx, dword [0x43a2a4]
push ecx
push edi
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x40849d
mov edx, dword [eax + 0x20]
push eax
mov eax, dword [eax + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d030
push ebx
push str.sound_b0.wav
mov dword [esi + 0x64], 3
mov byte [esi + 0x38a], bl
call ebp
mov byte [esi + 0x38a], 0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x44]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x408571
mov edx, dword [0x43a29c]
mov ecx, 0x43c460
push edx
push edi
call fcn.0040d7d0
test eax, eax
je 0x408504
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
push eax
push ecx
lea eax, [esp + 0x24]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d030
cmp byte [esi + 0x389], bl
jne 0x40851b
push ebx
push str.sound_a0.wav
call ebp
mov byte [esi + 0x389], 0
push ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x408571
mov ecx, dword [0x43a294]
push ecx
push edi
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x408555
mov edx, dword [eax + 0x20]
push eax
mov eax, dword [eax + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d030
push ebx
push str.sound_b0.wav
mov dword [esi + 0x64], 4
mov byte [esi + 0x38a], bl
call ebp
mov byte [esi + 0x38a], 0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x64]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x40863c
cmp byte [esi + 0x399], bl
jne 0x40863c
mov edx, dword [0x43a28c]
mov ecx, 0x43c460
push edx
push edi
call fcn.0040d7d0
test eax, eax
je 0x4085c8
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
push eax
push ecx
lea eax, [esp + 0x24]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d030
cmp byte [esi + 0x389], bl
jne 0x4085df
push ebx
push str.sound_a0.wav
call ebp
mov byte [esi + 0x389], 0
push ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x40863c
mov ecx, dword [0x43a284]
push ecx
push edi
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x408619
mov edx, dword [eax + 0x20]
push eax
mov eax, dword [eax + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d030
push ebx
push str.sound_b0.wav
mov dword [esi + 0x64], 5
mov byte [esi + 0x399], 0
mov byte [esi + 0x38a], bl
call ebp
mov byte [esi + 0x38a], 0
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push ebx
call ebp
test ax, ax
jl 0x408656
mov byte [esi + 0x399], bl
mov byte [esi + 0x38a], bl
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.USER32.dll_PtInRect]
push edx
lea ecx, [esp + 0x84]
push eax
push ecx
call edi
test eax, eax
je 0x408683
push ebx
call ebp
test ax, ax
jge 0x408683
mov dword [esi + 0x64], 6
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call edi
test eax, eax
jne 0x40870a
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x54]
push eax
push ecx
call edi
test eax, eax
jne 0x40870a
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x74]
push eax
push ecx
call edi
test eax, eax
jne 0x40870a
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x44]
push eax
push ecx
call edi
test eax, eax
jne 0x40870a
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x64]
push eax
push ecx
call edi
test eax, eax
jne 0x40870a
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x84]
push eax
push ecx
call edi
test eax, eax
jne 0x40870a
mov byte [esi + 0x389], bl
mov ecx, esi
call fcn.00409e00
xor ebx, ebx
mov dword [esp + 0x28], 0x78
mov dword [esp + 0x2c], ebx
xor ebp, ebp
xor edi, edi
mov edx, dword [esp + 0x2c]
mov eax, dword [esi + 0x70]
cmp edx, eax
jne 0x408737
cmp ebp, dword [esi + 0x74]
je case.default.0x40874b
mov eax, dword [esp + 0x28]
lea ecx, [eax + ebp]
mov eax, dword [esi + ecx*4]
dec eax
cmp eax, 7
ja case.default.0x40874b
jmp dword [eax*4 + 0x409224]
mov edx, dword [0x43a280]
lea eax, [esi + 0x40c]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x408854
jmp 0x408834
mov edx, dword [0x43a27c]
lea eax, [esi + 0x40c]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x408854
jmp 0x408834
mov edx, dword [0x43a278]
lea eax, [esi + 0x40c]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x408854
jmp 0x408834
mov edx, dword [0x43a274]
lea eax, [esi + 0x40c]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x408854
jmp 0x408834
mov edx, dword [0x43a270]
lea eax, [esi + 0x40c]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x408854
jmp 0x408834
mov edx, dword [0x43a26c]
lea eax, [esi + 0x40c]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x408854
jmp 0x408834
mov edx, dword [0x43a264]
lea eax, [esi + 0x40c]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x408854
mov ecx, dword [eax + 0x20]
push eax
mov eax, dword [eax + 0x1c]
lea edx, [ecx + ebx + 0x42]
push edx
lea ecx, [eax + edi + 0x19]
lea edx, [esp + 0x24]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d030
mov eax, dword [0x43a260]
lea ecx, [esi + 0x484]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x40874b
jmp 0x4088c8
mov edx, dword [0x43a258]
lea eax, [esi + 0x420]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x4088ad
mov ecx, dword [eax + 0x20]
push eax
mov eax, dword [eax + 0x1c]
lea edx, [ecx + ebx + 0x3d]
push edx
lea ecx, [eax + edi + 0x13]
lea edx, [esp + 0x24]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d030
mov eax, dword [0x43a260]
lea ecx, [esi + 0x484]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x40874b
mov edx, dword [eax + 0x20]
push eax
lea ecx, [edx + ebx + 0x40]
mov edx, dword [eax + 0x1c]
push ecx
lea ecx, [esp + 0x24]
lea eax, [edx + edi + 0x18]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d030
add edi, 0x28
inc ebp
cmp edi, 0x168
jl 0x408723
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
add eax, 9
inc ebp
add ebx, 0x28
cmp eax, 0xc9
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], eax
jl 0x40871f
mov eax, dword [esi + 0x68]
mov edi, dword [esi + 0x6c]
lea edx, [eax + eax*8]
add edx, edi
mov eax, dword [esi + edx*4 + 0x1e0]
dec eax
cmp eax, 7
ja case.default.0x408936
jmp dword [eax*4 + 0x409244]
mov eax, dword [0x43a280]
lea ecx, [esi + 0x40c]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x4089fe
jmp 0x4089ca
mov edx, dword [0x43a27c]
lea eax, [esi + 0x40c]
push edx
push eax
jmp 0x40894a
mov edx, dword [0x43a278]
lea eax, [esi + 0x40c]
push edx
push eax
jmp 0x40894a
mov edx, dword [0x43a274]
lea eax, [esi + 0x40c]
push edx
push eax
jmp 0x40894a
mov edx, dword [0x43a270]
lea eax, [esi + 0x40c]
push edx
push eax
jmp 0x40894a
mov edx, dword [0x43a26c]
lea eax, [esi + 0x40c]
push edx
push eax
jmp 0x40894a
mov edx, dword [0x43a264]
lea eax, [esi + 0x40c]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x4089fe
mov ecx, dword [esi + 0x70]
mov edx, dword [eax + 0x20]
mov ebx, dword [esi + 0x330]
push eax
add edx, ebx
lea ecx, [ecx + ecx*4]
lea edx, [edx + ecx*8 + 0x42]
mov ecx, dword [esi + 0x74]
push edx
mov edx, dword [eax + 0x1c]
lea ecx, [ecx + ecx*4]
lea eax, [edx + ecx*8 + 0x19]
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d030
mov edx, dword [0x43a260]
lea eax, [esi + 0x484]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408936
jmp 0x408a8c
mov edx, dword [0x43a258]
lea eax, [esi + 0x420]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je 0x408a70
mov ecx, dword [esi + 0x70]
mov edx, dword [eax + 0x20]
mov ebx, dword [esi + 0x330]
push eax
add edx, ebx
lea ecx, [ecx + ecx*4]
lea edx, [edx + ecx*8 + 0x3d]
mov ecx, dword [esi + 0x74]
push edx
mov edx, dword [eax + 0x1c]
lea ecx, [ecx + ecx*4]
lea eax, [edx + ecx*8 + 0x13]
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d030
mov edx, dword [0x43a260]
lea eax, [esi + 0x484]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408936
mov ecx, dword [esi + 0x70]
mov edx, dword [eax + 0x20]
mov ebx, dword [esi + 0x330]
push eax
add edx, ebx
lea ecx, [ecx + ecx*4]
lea edx, [edx + ecx*8 + 0x40]
mov ecx, dword [esi + 0x74]
push edx
mov edx, dword [eax + 0x1c]
lea ecx, [ecx + ecx*4]
lea eax, [edx + ecx*8 + 0x18]
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d030
xor edi, edi
lea ebx, [esi + 0x324]
mov eax, dword [ebx]
dec eax
cmp eax, 7
ja case.default.0x408ad4
jmp dword [eax*4 + 0x409264]
mov edx, dword [0x43a280]
lea eax, [esi + 0x40c]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ad4
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
add ecx, 0x63
push eax
push ecx
lea eax, [edx + edi + 0x196]
jmp 0x408c80
mov edx, dword [0x43a27c]
lea eax, [esi + 0x40c]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ad4
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
add ecx, 0x63
push eax
push ecx
lea eax, [edx + edi + 0x196]
jmp 0x408c80
mov edx, dword [0x43a278]
lea eax, [esi + 0x40c]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ad4
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
add ecx, 0x63
push eax
push ecx
lea eax, [edx + edi + 0x196]
jmp 0x408c80
mov edx, dword [0x43a274]
lea eax, [esi + 0x40c]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ad4
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
add ecx, 0x63
push eax
push ecx
lea eax, [edx + edi + 0x196]
jmp 0x408c80
mov edx, dword [0x43a270]
lea eax, [esi + 0x40c]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ad4
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
add ecx, 0x63
push eax
push ecx
lea eax, [edx + edi + 0x196]
jmp 0x408c80
mov edx, dword [0x43a26c]
lea eax, [esi + 0x40c]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ad4
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
add ecx, 0x63
push eax
push ecx
lea eax, [edx + edi + 0x196]
jmp 0x408c80
mov edx, dword [0x43a264]
lea eax, [esi + 0x40c]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ad4
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
add ecx, 0x63
push eax
push ecx
lea eax, [edx + edi + 0x196]
jmp 0x408c80
mov edx, dword [0x43a258]
lea eax, [esi + 0x420]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ad4
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
add ecx, 0x5d
push eax
push ecx
lea eax, [edx + edi + 0x190]
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d030
add edi, 0x28
add ebx, 4
cmp edi, 0x78
jl 0x408ac8
mov ebx, dword [esi + 0x60]
mov edi, 0xf
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, 0x66666667
mov ecx, edx
imul ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp ecx, 9
mov ebx, edx
ja case.default.0x408ccf
jmp dword [ecx*4 + 0x409284]
mov ecx, dword [str.num0]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ccf
jmp 0x408e2b
mov ecx, dword [str.num1]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ccf
jmp 0x408e2b
mov ecx, dword [str.num2]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ccf
jmp 0x408e2b
mov ecx, dword [str.num3]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ccf
jmp 0x408e2b
mov ecx, dword [str.num4]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ccf
jmp 0x408e2b
mov ecx, dword [str.num5]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ccf
jmp 0x408e2b
mov ecx, dword [str.num6]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ccf
jmp 0x408e2b
mov ecx, dword [str.num7]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ccf
jmp 0x408e2b
mov ecx, dword [str.num8]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ccf
jmp 0x408e2b
mov ecx, dword [0x43a208]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408ccf
mov edx, dword [eax + 0x1c]
mov ecx, dword [eax + 0x20]
sub edx, edi
add ecx, 0xba
push eax
add edx, 0x201
push ecx
lea eax, [esp + 0x24]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d030
add edi, 0xf
cmp edi, 0x69
jle 0x408ca7
mov ebx, dword [esi + 0x390]
mov edi, 0xf
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, 0x66666667
mov ecx, edx
imul ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp ecx, 9
mov ebx, edx
ja case.default.0x408e90
jmp dword [ecx*4 + 0x4092ac]
mov ecx, dword [str.num0]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408e90
jmp 0x408fec
mov ecx, dword [str.num1]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408e90
jmp 0x408fec
mov ecx, dword [str.num2]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408e90
jmp 0x408fec
mov ecx, dword [str.num3]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408e90
jmp 0x408fec
mov ecx, dword [str.num4]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408e90
jmp 0x408fec
mov ecx, dword [str.num5]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408e90
jmp 0x408fec
mov ecx, dword [str.num6]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408e90
jmp 0x408fec
mov ecx, dword [str.num7]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408e90
jmp 0x408fec
mov ecx, dword [str.num8]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408e90
jmp 0x408fec
mov ecx, dword [0x43a208]
lea edx, [esi + 0x498]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x408e90
mov edx, dword [eax + 0x1c]
mov ecx, dword [eax + 0x20]
sub edx, edi
add ecx, 0x1c7
push eax
add edx, 0x217
push ecx
lea eax, [esp + 0x24]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d030
add edi, 0xf
cmp edi, 0x69
jle 0x408e68
push 0x10000
push 0xffffff
push ecx
lea edi, [esi + 0x3a4]
mov ecx, esp
mov dword [esp + 0x34], esp
push edi
call fcn.00423e11
push 0x1c8
push 0x13c
mov ecx, 0x43c460
call fcn.0040c940
mov eax, dword [esi + 0x5c]
cmp eax, 4
ja case.default.0x40905b
jmp dword [eax*4 + 0x4092d4]
mov ecx, dword [0x43a194]
lea edx, [esi + 0x484]
push ecx
push edx
jmp 0x4090cf
mov eax, dword [0x43a204]
lea ecx, [esi + 0x484]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x40905b
mov ecx, dword [esi + 0x68]
push eax
lea edx, [ecx + ecx*4]
mov ecx, dword [eax + 0x20]
lea edx, [ecx + edx*8]
mov ecx, dword [esi + 0x330]
lea edx, [edx + ecx + 0x40]
mov ecx, dword [esi + 0x6c]
push edx
mov edx, dword [eax + 0x1c]
lea ecx, [ecx + ecx*4]
lea eax, [edx + ecx*8 + 0x18]
lea ecx, [esp + 0x24]
push eax
push ecx
jmp 0x409172
mov edx, dword [0x43a200]
lea eax, [esi + 0x484]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x40905b
jmp 0x409147
mov eax, dword [0x43a1fc]
lea ecx, [esi + 0x484]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x40905b
mov ecx, dword [esi + 0x68]
push eax
lea edx, [ecx + ecx*4]
mov ecx, dword [eax + 0x20]
lea edx, [ecx + edx*8]
mov ecx, dword [esi + 0x330]
lea edx, [edx + ecx + 0x40]
mov ecx, dword [esi + 0x6c]
push edx
mov edx, dword [eax + 0x1c]
lea ecx, [ecx + ecx*4]
lea eax, [edx + ecx*8 + 0x18]
lea ecx, [esp + 0x24]
push eax
push ecx
jmp 0x409172
mov edx, dword [str.HGFE]
lea eax, [esi + 0x484]
push edx
push eax
mov ecx, 0x43c460
call fcn.0040d7d0
test eax, eax
je case.default.0x40905b
mov ecx, dword [esi + 0x68]
mov edx, dword [eax + 0x20]
push eax
mov eax, dword [eax + 0x1c]
lea ecx, [ecx + ecx*4]
lea ecx, [edx + ecx*8]
mov edx, dword [esi + 0x330]
lea ecx, [ecx + edx + 0x40]
push ecx
mov ecx, dword [esi + 0x6c]
lea edx, [ecx + ecx*4]
lea ecx, [eax + edx*8 + 0x18]
lea edx, [esp + 0x24]
push ecx
push edx
mov ecx, 0x43c460
call fcn.0040d030
push 0x10000
push 0xffffff
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push edi
call fcn.00423e11
push 0x1c8
push 0x13c
mov ecx, 0x43c460
call fcn.0040c940
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x5a0]
push eax
push ecx
mov ecx, 0x43c460
call fcn.0040ccc0
xor ebp, ebp
cmp dword [esi + 0x38c], 0xa
jne 0x4091d8
mov eax, dword [esi + 0x60]
add eax, 0x64
mov dword [esi + 0x60], eax
mov dword [esi + 0x38c], ebp
lea ecx, [esp + 0x5a0]
mov dword [esp + 0x5bc], 0xffffffff
call fcn.004292ba
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x5b4]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x5b0
ret