Function at 0x40dbf8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x41
push 0
push 0
dec ecx
jne 0x40dc00
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x40f98a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x54]
call fcn.00405b84
mov eax, dword [ebx + 0x3c]
call fcn.00405b84
mov eax, dword [ebx + 0xdc]
call fcn.00409a10
mov eax, dword [ebx + 0xe4]
call fcn.00409a10
mov eax, dword [ebx + 0xe8]
call fcn.00409a10
mov eax, dword [ebx + 0xec]
call fcn.00409a10
mov eax, dword [ebx + 0xe0]
call fcn.00409a10
mov eax, dword [ebx + 0xf0]
call fcn.00409a10
mov eax, dword [ebx + 0xf4]
call fcn.00409a10
mov eax, dword [ebx + 0xf8]
call fcn.00409a10
mov eax, dword [ebx + 0xfc]
call fcn.00409a10
mov eax, dword [ebx + 0x100]
call fcn.00409a10
lea eax, [ebp - 4]
call fcn.00402ff8
lea eax, [ebp - 8]
call fcn.00402ff8
lea eax, [ebp - 0xc]
call fcn.00402ff8
lea eax, [ebp - 0x10]
call fcn.00402ff8
mov eax, ebx
mov edx, 0x40f9a0
call fcn.0040d7d8
mov edx, eax
mov eax, dword [ebx + 0x70]
call fcn.00409450
mov eax, ebx
mov edx, 0x40f9b8
call fcn.0040d7d8
mov edx, eax
mov eax, dword [ebx + 0x6c]
call fcn.00409450
mov eax, dword [ebx + 0xd4]
call fcn.00409430
mov edx, eax
mov eax, dword [ebx + 0x6c]
call fcn.0040860c
mov eax, dword [ebx + 0xd4]
call fcn.00409430
mov edx, eax
mov eax, dword [ebx + 0x70]
call fcn.0040860c
mov ax, word [0x40f9c4]
call fcn.00406834
test al, al
jne 0x40dd29
mov eax, ebx
call fcn.0040dbd0
test al, al
je 0x40dd3d
mov eax, dword [ebx + 0x6c]
mov dl, 1
call fcn.00409450
mov eax, dword [ebx + 0x70]
xor edx, edx
call fcn.0040860c
mov eax, dword [ebx + 0x6c]
call fcn.00409430
test al, al
jne 0x40dd6c
mov eax, dword [ebx + 0x70]
call fcn.00409430
test al, al
jne 0x40dd6c
mov eax, dword [ebx + 0x70]
mov dl, 1
call fcn.00409450
mov eax, dword [ebx + 0xd4]
xor edx, edx
call fcn.00409450
mov eax, dword [ebx + 0x6c]
call fcn.00409430
test al, al
je 0x40dda3
mov eax, dword [ebx + 0x70]
call fcn.00409430
test al, al
je 0x40dda3
mov eax, dword [ebx + 0x6c]
mov dl, 1
call fcn.00409450
mov eax, dword [ebx + 0x6c]
call fcn.00409430
mov edx, eax
xor dl, 1
mov eax, dword [ebx + 0x70]
call fcn.00409450
mov esi, 1
mov ax, word [0x40f9c8]
call fcn.00406834
test al, al
jne 0x40e031
mov ax, word [0x40f9cc]
call fcn.00406834
test al, al
jne 0x40e031
mov ax, word [0x40f9d0]
call fcn.00406834
test al, al
jne 0x40e031
mov ax, word [0x40f9d4]
call fcn.00406834
test al, al
jne 0x40e031
mov ax, word [0x40f9c4]
call fcn.00406834
test al, al
jne 0x40e031
mov eax, ebx
call fcn.0040dbd0
test al, al
je 0x40e05c
jmp 0x40e031
lea edx, [ebp - 0x3c]
mov eax, esi
call fcn.0040773c
mov eax, dword [ebp - 0x3c]
push eax
mov edx, 0x40f9e0
mov eax, 0x80000001
call fcn.004046d8
lea ecx, [ebp - 4]
pop edx
call fcn.00404808
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.00407828
mov edx, dword [ebp - 0x40]
mov eax, dword [ebx + 0xdc]
call fcn.00409a00
mov eax, dword [ebx + 0x100]
xor edx, edx
call fcn.00409a00
lea eax, [ebp - 0x44]
mov ecx, dword [ebp - 4]
mov edx, 0x40fa00
call fcn.004031c8
mov edx, dword [ebp - 0x44]
mov eax, 0x80000002
call fcn.004046d8
lea ecx, [ebp - 8]
mov edx, 0x40fa3c
call fcn.00404808
cmp dword [ebp - 8], 0
je 0x40dee6
lea eax, [ebp - 0x48]
call fcn.00404660
lea eax, [ebp - 0x48]
mov edx, dword [ebp - 8]
call fcn.00403184
mov eax, dword [ebp - 0x48]
call fcn.00407960
test al, al
je 0x40dee6
lea eax, [ebp - 0x50]
call fcn.00404660
lea eax, [ebp - 0x50]
mov edx, dword [ebp - 8]
call fcn.00403184
mov edx, dword [ebp - 0x50]
lea ecx, [ebp - 0x4c]
mov eax, ebx
call fcn.004141b8
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebx + 0xf8]
call fcn.00409a00
jmp 0x40df1e
lea eax, [ebp - 0x58]
mov ecx, dword [ebp - 4]
mov edx, 0x40fa00
call fcn.004031c8
mov edx, dword [ebp - 0x58]
mov eax, 0x80000002
call fcn.004046d8
lea ecx, [ebp - 0x54]
mov edx, 0x40fa50
call fcn.00404808
mov edx, dword [ebp - 0x54]
mov eax, dword [ebx + 0xf8]
call fcn.00409a00
lea eax, [ebp - 0x5c]
mov ecx, dword [ebp - 4]
mov edx, 0x40fa00
call fcn.004031c8
mov edx, dword [ebp - 0x5c]
mov eax, 0x80000002
call fcn.004046d8
lea ecx, [ebp - 8]
mov edx, 0x40fa64
call fcn.00404808
cmp dword [ebp - 8], 0
je 0x40df6b
lea ecx, [ebp - 0x60]
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00414488
mov edx, dword [ebp - 0x60]
mov eax, dword [ebx + 0xfc]
call fcn.00409a00
jmp 0x40dfda
lea eax, [ebp - 0x64]
mov ecx, dword [ebp - 4]
mov edx, 0x40fa00
call fcn.004031c8
mov edx, dword [ebp - 0x64]
mov eax, 0x80000002
call fcn.004046d8
lea ecx, [ebp - 8]
mov edx, 0x40fa50
call fcn.00404808
cmp dword [ebp - 8], 0
je 0x40dfb8
lea ecx, [ebp - 0x68]
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00414488
mov edx, dword [ebp - 0x68]
mov eax, dword [ebx + 0xfc]
call fcn.00409a00
jmp 0x40dfda
lea ecx, [ebp - 0x6c]
mov edi, dword [ebx + 0xf8]
mov edx, dword [edi + 0x1c]
dec edx
mov eax, edi
call fcn.00409a6c
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebx + 0xfc]
call fcn.00409a00
mov eax, dword [ebx + 0x70]
call fcn.00409430
test al, al
je 0x40e005
lea ecx, [ebp - 0x70]
mov edi, dword [ebx + 0xf8]
mov edx, dword [edi + 0x1c]
dec edx
mov eax, edi
call fcn.00409a6c
mov edx, dword [ebp - 0x70]
mov eax, dword [ebx + 0x54]
call fcn.004068d4
mov eax, dword [ebx + 0x6c]
call fcn.00409430
test al, al
je 0x40e030
lea ecx, [ebp - 0x74]
mov edi, dword [ebx + 0xfc]
mov edx, dword [edi + 0x1c]
dec edx
mov eax, edi
call fcn.00409a6c
mov edx, dword [ebp - 0x74]
mov eax, dword [ebx + 0x54]
call fcn.004068d4
inc esi
lea edx, [ebp - 0x78]
mov eax, esi
call fcn.0040773c
mov eax, dword [ebp - 0x78]
push eax
mov edx, 0x40f9e0
mov eax, 0x80000001
call fcn.004046d8
pop edx
call fcn.00404958
test al, al
jne 0x40de1b
mov ax, word [0x40fa78]
call fcn.00406834
test al, al
jne 0x40e08d
mov ax, word [0x40fa7c]
call fcn.00406834
test al, al
jne 0x40e08d
mov ax, word [0x40fa80]
call fcn.00406834
test al, al
je 0x40e2fc
mov eax, dword [ebx + 0x9c]
xor edx, edx
call fcn.0040860c
jmp 0x40e2c1
lea edx, [ebp - 0x80]
mov eax, esi
call fcn.0040773c
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
mov edx, 0x40fa8c
call fcn.004031c8
mov edx, dword [ebp - 0x7c]
mov eax, 0x80000001
call fcn.004046d8
lea ecx, [ebp - 4]
xor edx, edx
call fcn.00404808
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 4]
call fcn.00407828
mov edx, dword [ebp - 0x84]
mov eax, dword [ebx + 0xdc]
call fcn.00409a00
mov eax, dword [ebx + 0x100]
xor edx, edx
call fcn.00409a00
lea eax, [ebp - 0x88]
mov ecx, dword [ebp - 4]
mov edx, 0x40fa00
call fcn.004031c8
mov edx, dword [ebp - 0x88]
mov eax, 0x80000002
call fcn.004046d8
lea ecx, [ebp - 8]
mov edx, 0x40fa3c
call fcn.00404808
cmp dword [ebp - 8], 0
je 0x40e199
lea eax, [ebp - 0x8c]
call fcn.00404660
lea eax, [ebp - 0x8c]
mov edx, dword [ebp - 8]
call fcn.00403184
mov eax, dword [ebp - 0x8c]
call fcn.00407960
test al, al
je 0x40e199
lea eax, [ebp - 0x94]
call fcn.00404660
lea eax, [ebp - 0x94]
mov edx, dword [ebp - 8]
call fcn.00403184
mov edx, dword [ebp - 0x94]
lea ecx, [ebp - 0x90]
mov eax, ebx
call fcn.004141b8
mov edx, dword [ebp - 0x90]
mov eax, dword [ebx + 0xf8]
call fcn.00409a00
jmp 0x40e1dd
lea eax, [ebp - 0x9c]
mov ecx, dword [ebp - 4]
mov edx, 0x40fa00
call fcn.004031c8
mov edx, dword [ebp - 0x9c]
mov eax, 0x80000002
call fcn.004046d8
lea ecx, [ebp - 0x98]
mov edx, 0x40fa50
call fcn.00404808
mov edx, dword [ebp - 0x98]
mov eax, dword [ebx + 0xf8]
call fcn.00409a00
lea eax, [ebp - 0xa0]
mov ecx, dword [ebp - 4]
mov edx, 0x40fa00
call fcn.004031c8
mov edx, dword [ebp - 0xa0]
mov eax, 0x80000002
call fcn.004046d8
lea ecx, [ebp - 8]
mov edx, 0x40fa64
call fcn.00404808
cmp dword [ebp - 8], 0
je 0x40e236
lea ecx, [ebp - 0xa4]
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00414488
mov edx, dword [ebp - 0xa4]
mov eax, dword [ebx + 0xfc]
call fcn.00409a00
jmp 0x40e25e
lea ecx, [ebp - 0xa8]
mov edi, dword [ebx + 0xf8]
mov edx, dword [edi + 0x1c]
dec edx
mov eax, edi
call fcn.00409a6c
mov edx, dword [ebp - 0xa8]
mov eax, dword [ebx + 0xfc]
call fcn.00409a00
mov eax, dword [ebx + 0x70]
call fcn.00409430
test al, al
je 0x40e28f
lea ecx, [ebp - 0xac]
mov edi, dword [ebx + 0xf8]
mov edx, dword [edi + 0x1c]
dec edx
mov eax, edi
call fcn.00409a6c
mov edx, dword [ebp - 0xac]
mov eax, dword [ebx + 0x54]
call fcn.004068d4
mov eax, dword [ebx + 0x6c]
call fcn.00409430
test al, al
je 0x40e2c0
lea ecx, [ebp - 0xb0]
mov edi, dword [ebx + 0xfc]
mov edx, dword [edi + 0x1c]
dec edx
mov eax, edi
call fcn.00409a6c
mov edx, dword [ebp - 0xb0]
mov eax, dword [ebx + 0x54]
call fcn.004068d4
inc esi
lea edx, [ebp - 0xb8]
mov eax, esi
call fcn.0040773c
mov ecx, dword [ebp - 0xb8]
lea eax, [ebp - 0xb4]
mov edx, 0x40fa8c
call fcn.004031c8
mov edx, dword [ebp - 0xb4]
mov eax, 0x80000001
call fcn.00404938
test al, al
jne 0x40e09f
xor esi, esi
jmp 0x40e336
lea eax, [ebp - 0xbc]
push eax
mov eax, dword [ebx + 0x54]
xor ecx, ecx
mov edx, esi
call fcn.00405a10
cmp dword [ebp - 0xbc], 0
jne 0x40e335
mov eax, dword [ebx + 0xdc]
mov edx, esi
call fcn.00409a40
mov eax, dword [ebx + 0x54]
mov edx, esi
call fcn.00405ae8
jmp 0x40e336
inc esi
mov eax, dword [ebx + 0xdc]
cmp esi, dword [eax + 0x1c]
jl 0x40e300
mov eax, dword [ebx + 0xdc]
mov eax, dword [eax + 0x1c]
mov dword [ebx + 0x108], eax
xor esi, esi
lea ecx, [ebp - 0xc4]
lea edi, [esi + 0x100]
mov eax, edi
mov edx, 3
call fcn.004076d0
mov ecx, dword [ebp - 0xc4]
lea eax, [ebp - 0xc0]
mov edx, 0x40fab0
call fcn.004031c8
mov edx, dword [ebp - 0xc0]
mov eax, 0x80000001
call fcn.00404938
test al, al
je 0x40e59e
push 8
lea ecx, [ebp - 0xcc]
mov eax, edi
mov edx, 3
call fcn.004076d0
mov ecx, dword [ebp - 0xcc]
lea eax, [ebp - 0xc8]
mov edx, 0x40fab0
call fcn.004031c8
mov edx, dword [ebp - 0xc8]
mov eax, 0x80000001
call fcn.004046d8
lea ecx, [ebp - 0x18]
mov edx, 0x40fae4
call fcn.00404990
lea ecx, [ebp - 8]
mov edx, 8
mov eax, dword [ebp - 0x18]
call fcn.004076d0
lea eax, [ebp - 0xd0]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004033d4
mov eax, dword [ebp - 0xd0]
push eax
lea eax, [ebp - 0xd4]
push eax
mov ecx, 8
mov edx, 5
mov eax, dword [ebp - 8]
call fcn.004033d4
mov edx, dword [ebp - 0xd4]
pop eax
call fcn.004032c8
jne 0x40e462
lea eax, [ebp - 0xd8]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004033d4
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 8]
mov edx, 0x40faf8
call fcn.004031c8
mov byte [ebp - 0x31], 0
mov eax, dword [ebx + 0xdc]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40e4aa
inc edi
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0xdc]
mov eax, dword [ebx + 0xdc]
mov edx, dword [ebp - 0x14]
call fcn.00409a6c
mov eax, dword [ebp - 0xdc]
mov edx, dword [ebp - 8]
call fcn.004032c8
jne 0x40e4a4
mov byte [ebp - 0x31], 1
inc dword [ebp - 0x14]
dec edi
jne 0x40e47c
cmp byte [ebp - 0x31], 0
je 0x40e59e
mov eax, dword [ebx + 0xe8]
mov edx, dword [ebp - 8]
call fcn.00409a00
push 8
lea ecx, [ebp - 0xe4]
lea edi, [esi + 0x100]
mov eax, edi
mov edx, 3
call fcn.004076d0
mov ecx, dword [ebp - 0xe4]
lea eax, [ebp - 0xe0]
mov edx, 0x40fab0
call fcn.004031c8
mov edx, dword [ebp - 0xe0]
mov eax, 0x80000001
call fcn.004046d8
lea ecx, [ebp - 0x18]
mov edx, 0x40fb08
call fcn.00404990
lea ecx, [ebp - 0xe8]
mov edx, 8
mov eax, dword [ebp - 0x18]
call fcn.004076d0
mov edx, dword [ebp - 0xe8]
mov eax, dword [ebx + 0xe4]
call fcn.00409a00
push 8
lea ecx, [ebp - 0xf0]
mov eax, edi
mov edx, 3
call fcn.004076d0
mov ecx, dword [ebp - 0xf0]
lea eax, [ebp - 0xec]
mov edx, 0x40fab0
call fcn.004031c8
mov edx, dword [ebp - 0xec]
mov eax, 0x80000001
call fcn.004046d8
lea ecx, [ebp - 0x18]
mov edx, 0x40fb20
call fcn.00404990
lea ecx, [ebp - 0xf4]
mov edx, 8
mov eax, dword [ebp - 0x18]
call fcn.004076d0
mov edx, dword [ebp - 0xf4]
mov eax, dword [ebx + 0xec]
call fcn.00409a00
inc esi
cmp esi, 0x64
jne 0x40e352
mov eax, dword [ebx + 0xe4]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40e685
inc edi
xor esi, esi
mov eax, dword [ebx + 0xdc]
mov eax, dword [eax + 0x1c]
dec eax
test eax, eax
jl 0x40e67d
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0xf8]
mov eax, dword [ebx + 0xdc]
mov edx, dword [ebp - 0x14]
call fcn.00409a6c
mov eax, dword [ebp - 0xf8]
push eax
lea ecx, [ebp - 0xfc]
mov eax, dword [ebx + 0xe8]
mov edx, esi
call fcn.00409a6c
mov edx, dword [ebp - 0xfc]
pop eax
call fcn.004032c8
jne 0x40e671
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x104]
mov eax, dword [ebx + 0xec]
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x104]
push eax
lea ecx, [ebp - 0x108]
mov eax, dword [ebx + 0xe4]
mov edx, esi
call fcn.00409a6c
mov edx, dword [ebp - 0x108]
mov eax, ebx
pop ecx
call fcn.004121ac
mov eax, dword [ebp - 0x100]
push eax
mov eax, dword [ebx + 0x54]
mov ecx, 1
mov edx, dword [ebp - 0x14]
call fcn.00405a80
jmp 0x40e67d
inc dword [ebp - 0x14]
dec dword [ebp - 0x38]
jne 0x40e5da
inc esi
dec edi
jne 0x40e5bd
mov esi, dword [ebx + 0x104]
cmp esi, 0x804
jne 0x40e6a0
lea eax, [ebp - 4]
mov edx, 0x40fb34
call fcn.00403090
cmp esi, 0x404
jne 0x40e6b5
lea eax, [ebp - 4]
mov edx, 0x40fb40
call fcn.00403090
cmp esi, 0x412
jne 0x40e6ca
lea eax, [ebp - 4]
mov edx, 0x40fb4c
call fcn.00403090
mov esi, 1
lea edi, [ebx + 0x468]
push 0x40fb58
push dword [ebp - 4]
lea edx, [ebp - 0x110]
mov eax, esi
dec eax
call fcn.0040773c
push dword [ebp - 0x110]
lea eax, [ebp - 0x10c]
mov edx, 3
call fcn.0040323c
mov edx, dword [ebp - 0x10c]
mov eax, 0x80000001
call fcn.00404938
test al, al
je 0x40e7f2
push 8
push 0x40fb58
push dword [ebp - 4]
lea edx, [ebp - 0x118]
mov eax, esi
dec eax
call fcn.0040773c
push dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.0040323c
mov edx, dword [ebp - 0x114]
mov eax, 0x80000001
call fcn.004046d8
lea ecx, [ebp - 0x18]
mov edx, 0x40fb08
call fcn.00404990
lea ecx, [ebp - 0x11c]
mov edx, 8
mov eax, dword [ebp - 0x18]
call fcn.004076d0
mov edx, dword [ebp - 0x11c]
mov eax, edi
call fcn.0040304c
push 8
push 0x40fb58
push dword [ebp - 4]
lea edx, [ebp - 0x124]
mov eax, esi
dec eax
call fcn.0040773c
push dword [ebp - 0x124]
lea eax, [ebp - 0x120]
mov edx, 3
call fcn.0040323c
mov edx, dword [ebp - 0x120]
mov eax, 0x80000001
call fcn.004046d8
lea ecx, [ebp - 0x18]
mov edx, 0x40fb20
call fcn.00404990
lea ecx, [ebp - 0x128]
mov edx, 8
mov eax, dword [ebp - 0x18]
call fcn.004076d0
mov edx, dword [ebp - 0x128]
lea eax, [edi + 4]
call fcn.0040304c
jmp 0x40e801
mov eax, edi
call fcn.00402ff8
lea eax, [edi + 4]
call fcn.00402ff8
inc esi
add edi, 8
cmp esi, 4
jne 0x40e6d5
cmp dword [ebx + 0x104], 0x411
jne 0x40e8ef
mov eax, dword [ebx + 0x8c]
mov edx, 1
call fcn.00409688
mov eax, dword [ebx + 0x8c]
mov edx, 2
call fcn.00409688
lea eax, [ebx + 0x468]
call fcn.00402ff8
lea eax, [ebx + 0x46c]
call fcn.00402ff8
mov edx, 0x40fb8c
mov eax, 0x80000001
call fcn.00404938
test al, al
je 0x40e8ef
push 8
mov edx, 0x40fb8c
mov eax, 0x80000001
call fcn.004046d8
lea ecx, [ebp - 0x18]
mov edx, 0x40fb08
call fcn.00404990
lea ecx, [ebp - 0x12c]
mov edx, 8
mov eax, dword [ebp - 0x18]
call fcn.004076d0
mov edx, dword [ebp - 0x12c]
lea eax, [ebx + 0x468]
call fcn.0040304c
push 8
mov edx, 0x40fb8c
mov eax, 0x80000001
call fcn.004046d8
lea ecx, [ebp - 0x18]
mov edx, 0x40fb20
call fcn.00404990
lea ecx, [ebp - 0x130]
mov edx, 8
mov eax, dword [ebp - 0x18]
call fcn.004076d0
mov edx, dword [ebp - 0x130]
lea eax, [ebx + 0x46c]
call fcn.0040304c
lea eax, [ebp - 0x134]
push eax
mov ecx, dword [ebx + 0x46c]
mov edx, dword [ebx + 0x468]
mov eax, ebx
call fcn.004121ac
mov edx, dword [ebp - 0x134]
mov eax, dword [ebx + 0x90]
call fcn.00408ca0
mov eax, dword [ebx + 0x54]
call fcn.00406d94
test eax, eax
jne 0x40e932
mov eax, dword [ebx + 0x40]
xor edx, edx
call fcn.0040860c
jmp 0x40e93c
mov eax, dword [ebx + 0x40]
mov dl, 1
call fcn.0040860c
mov eax, dword [ebx + 0x54]
call fcn.00406d94
mov esi, eax
mov eax, dword [ebx + 0x54]
call fcn.004095e4
dec eax
cmp esi, eax
jne 0x40e95f
mov eax, dword [ebx + 0x44]
xor edx, edx
call fcn.0040860c
jmp 0x40e969
mov eax, dword [ebx + 0x44]
mov dl, 1
call fcn.0040860c
call fcn.00405420
mov dword [ebp - 0x1c], eax
call fcn.00405420
mov dword [ebp - 0x20], eax
call fcn.00405420
mov dword [ebp - 0x24], eax
call fcn.00405420
mov dword [ebp - 0x28], eax
call fcn.00405420
mov dword [ebp - 0x2c], eax
call fcn.00405420
mov dword [ebp - 0x30], eax
mov edx, 0x40fbc4
mov eax, 0x80000002
call fcn.00404938
test al, al
jne 0x40eaae
mov ax, word [0x40f9c8]
call fcn.00406834
test al, al
jne 0x40ea0a
mov ax, word [0x40f9cc]
call fcn.00406834
test al, al
jne 0x40ea0a
mov ax, word [0x40f9d0]
call fcn.00406834
test al, al
jne 0x40ea0a
mov ax, word [0x40f9d4]
call fcn.00406834
test al, al
jne 0x40ea0a
mov ax, word [0x40f9c4]
call fcn.00406834
test al, al
jne 0x40ea0a
mov eax, ebx
call fcn.0040dbd0
test al, al
je 0x40eaae
mov edx, 0x40fbc4
mov eax, 0x80000002
call fcn.00404738
mov ecx, 0x40fc08
mov edx, 0x40fc1c
call fcn.004048a4
cmp dword [ebx + 0x104], 0x804
jne 0x40ea52
mov edx, 0x40fbc4
mov eax, 0x80000002
call fcn.00404738
mov ecx, 0x40fc30
mov edx, 0x40fa50
call fcn.004048a4
cmp dword [ebx + 0x104], 0x404
jne 0x40ea7c
mov edx, 0x40fbc4
mov eax, 0x80000002
call fcn.00404738
mov ecx, 0x40fc44
mov edx, 0x40fa50
call fcn.004048a4
mov eax, dword [ebx + 0x104]
cmp eax, 0x404
je 0x40eaae
cmp eax, 0x804
je 0x40eaae
mov edx, 0x40fbc4
mov eax, 0x80000002
call fcn.00404738
mov ecx, 0x40fc58
mov edx, 0x40fa50
call fcn.004048a4
cmp dword [ebx + 0x104], 0x404
jne 0x40ebd3
mov edx, 0x40fc64
mov eax, 0x80000002
call fcn.00404938
test al, al
jne 0x40ebd3
mov ax, word [0x40f9c8]
call fcn.00406834
test al, al
jne 0x40eb2f
mov ax, word [0x40f9cc]
call fcn.00406834
test al, al
jne 0x40eb2f
mov ax, word [0x40f9d0]
call fcn.00406834
test al, al
jne 0x40eb2f
mov ax, word [0x40f9d4]
call fcn.00406834
test al, al
jne 0x40eb2f
mov ax, word [0x40f9c4]
call fcn.00406834
test al, al
jne 0x40eb2f
mov eax, ebx
call fcn.0040dbd0
test al, al
je 0x40ebd3
mov edx, 0x40fc64
mov eax, 0x80000002
call fcn.00404738
mov ecx, 0x40fc08
mov edx, 0x40fc1c
call fcn.004048a4
cmp dword [ebx + 0x104], 0x804
jne 0x40eb77
mov edx, 0x40fc64
mov eax, 0x80000002
call fcn.00404738
mov ecx, 0x40fca8
mov edx, 0x40fa50
call fcn.004048a4
cmp dword [ebx + 0x104], 0x404
jne 0x40eba1
mov edx, 0x40fc64
mov eax, 0x80000002
call fcn.00404738
mov ecx, 0x40fcc8
mov edx, 0x40fa50
call fcn.004048a4
mov eax, dword [ebx + 0x104]
cmp eax, 0x404
je 0x40ebd3
cmp eax, 0x804
je 0x40ebd3
mov edx, 0x40fc64
mov eax, 0x80000002
call fcn.00404738
mov ecx, 0x40fce8
mov edx, 0x40fa50
call fcn.004048a4
cmp dword [ebx + 0x104], 0x804
jne 0x40ec8c
mov edx, 0x40fd14
mov eax, 0x80000002
call fcn.00404938
test al, al
jne 0x40ec8c
mov ax, word [0x40f9c8]
call fcn.00406834
test al, al
jne 0x40ec50
mov ax, word [0x40f9cc]
call fcn.00406834
test al, al
jne 0x40ec50
mov ax, word [0x40f9d0]
call fcn.00406834
test al, al
jne 0x40ec50
mov ax, word [0x40f9d4]
call fcn.00406834
test al, al
jne 0x40ec50
mov ax, word [0x40f9c4]
call fcn.00406834
test al, al
jne 0x40ec50
mov eax, ebx
call fcn.0040dbd0
test al, al
je 0x40ec8c
mov edx, 0x40fd14
mov eax, 0x80000002
call fcn.00404738
mov ecx, 0x40fc08
mov edx, 0x40fc1c
call fcn.004048a4
mov edx, 0x40fc64
mov eax, 0x80000002
call fcn.00404738
mov ecx, 0x40fd58
mov edx, 0x40fa50
call fcn.004048a4
mov edx, 0x40fd78
mov eax, 0x80000002
call fcn.004046d8
mov edx, dword [ebp - 0x1c]
call fcn.00404a08
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40ed67
inc edi
xor esi, esi
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x13c]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x13c]
mov ecx, 4
mov edx, 5
call fcn.004033d4
mov eax, dword [ebp - 0x138]
mov edx, 0x40fdb4
call fcn.004032c8
jne 0x40ed5f
cmp dword [ebx + 0x104], 0x404
jne 0x40ed30
lea ecx, [ebp - 0x144]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00407828
mov edx, dword [ebp - 0x140]
mov eax, dword [ebp - 0x24]
call fcn.00409a00
jmp 0x40ed5f
lea ecx, [ebp - 0x14c]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.00407828
mov edx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x20]
call fcn.00409a00
inc esi
dec edi
jne 0x40ecb5
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40ee2b
inc edi
xor esi, esi
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x154]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x154]
mov ecx, 4
mov edx, 5
call fcn.004033d4
mov eax, dword [ebp - 0x150]
mov edx, 0x40fdc4
call fcn.004032c8
jne 0x40ee23
cmp dword [ebx + 0x104], 0x404
jne 0x40edf4
lea ecx, [ebp - 0x15c]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x158]
call fcn.00407828
mov edx, dword [ebp - 0x158]
mov eax, dword [ebp - 0x20]
call fcn.00409a00
jmp 0x40ee23
lea ecx, [ebp - 0x164]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x164]
lea edx, [ebp - 0x160]
call fcn.00407828
mov edx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x24]
call fcn.00409a00
inc esi
dec edi
jne 0x40ed79
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40ee8e
inc edi
xor esi, esi
lea ecx, [ebp - 0x168]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x168]
mov edx, 0x40fdd4
call fcn.004032c8
jne 0x40ee8a
lea ecx, [ebp - 0x170]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x16c]
call fcn.00407828
mov edx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x28]
call fcn.00409a00
inc esi
dec edi
jne 0x40ee39
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40ef0d
inc edi
xor esi, esi
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0x178]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x178]
mov ecx, 4
mov edx, 5
call fcn.004033d4
mov eax, dword [ebp - 0x174]
mov edx, 0x40fde8
call fcn.004032c8
jne 0x40ef09
lea ecx, [ebp - 0x180]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x180]
lea edx, [ebp - 0x17c]
call fcn.00407828
mov edx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x2c]
call fcn.00409a00
inc esi
dec edi
jne 0x40ee9c
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40ef8c
inc edi
xor esi, esi
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0x188]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x188]
mov ecx, 4
mov edx, 5
call fcn.004033d4
mov eax, dword [ebp - 0x184]
mov edx, 0x40fdf8
call fcn.004032c8
jne 0x40ef88
lea ecx, [ebp - 0x190]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x190]
lea edx, [ebp - 0x18c]
call fcn.00407828
mov edx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x30]
call fcn.00409a00
inc esi
dec edi
jne 0x40ef1b
mov eax, dword [ebp - 0x28]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40efbf
inc edi
xor esi, esi
lea ecx, [ebp - 0x194]
mov eax, dword [ebp - 0x28]
mov edx, esi
call fcn.00409a6c
mov edx, dword [ebp - 0x194]
mov eax, dword [ebx + 0xe0]
call fcn.00409a00
inc esi
dec edi
jne 0x40ef9a
mov eax, dword [ebp - 0x20]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40eff2
inc edi
xor esi, esi
lea ecx, [ebp - 0x198]
mov eax, dword [ebp - 0x20]
mov edx, esi
call fcn.00409a6c
mov edx, dword [ebp - 0x198]
mov eax, dword [ebx + 0xe0]
call fcn.00409a00
inc esi
dec edi
jne 0x40efcd
mov eax, dword [ebp - 0x24]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40f025
inc edi
xor esi, esi
lea ecx, [ebp - 0x19c]
mov eax, dword [ebp - 0x24]
mov edx, esi
call fcn.00409a6c
mov edx, dword [ebp - 0x19c]
mov eax, dword [ebx + 0xe0]
call fcn.00409a00
inc esi
dec edi
jne 0x40f000
mov eax, dword [ebp - 0x2c]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40f058
inc edi
xor esi, esi
lea ecx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x2c]
mov edx, esi
call fcn.00409a6c
mov edx, dword [ebp - 0x1a0]
mov eax, dword [ebx + 0xe0]
call fcn.00409a00
inc esi
dec edi
jne 0x40f033
mov eax, dword [ebp - 0x30]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40f08b
inc edi
xor esi, esi
lea ecx, [ebp - 0x1a4]
mov eax, dword [ebp - 0x30]
mov edx, esi
call fcn.00409a6c
mov edx, dword [ebp - 0x1a4]
mov eax, dword [ebx + 0xe0]
call fcn.00409a00
inc esi
dec edi
jne 0x40f066
mov ax, word [0x40f9c8]
call fcn.00406834
test al, al
jne 0x40f0e5
mov ax, word [0x40f9cc]
call fcn.00406834
test al, al
jne 0x40f0e5
mov ax, word [0x40f9d0]
call fcn.00406834
test al, al
jne 0x40f0e5
mov ax, word [0x40f9d4]
call fcn.00406834
test al, al
jne 0x40f0e5
mov ax, word [0x40f9c4]
call fcn.00406834
test al, al
jne 0x40f0e5
mov eax, ebx
call fcn.0040dbd0
test al, al
je 0x40f1dd
mov eax, dword [ebp - 0x20]
call fcn.00409a10
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40f1aa
inc edi
xor esi, esi
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x1a8]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x1a8]
mov ecx, 4
mov edx, 5
call fcn.004033d4
mov eax, dword [ebp - 4]
mov edx, 0x40fe08
call fcn.004032c8
je 0x40f1a2
mov eax, dword [ebp - 4]
mov edx, 0x40fdc4
call fcn.004032c8
je 0x40f1a2
mov eax, dword [ebp - 4]
mov edx, 0x40fdb4
call fcn.004032c8
je 0x40f1a2
mov eax, dword [ebp - 4]
mov edx, 0x40fde8
call fcn.004032c8
je 0x40f1a2
mov eax, dword [ebp - 4]
mov edx, 0x40fdf8
call fcn.004032c8
je 0x40f1a2
lea ecx, [ebp - 0x1b0]
mov eax, dword [ebp - 0x1c]
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x1b0]
lea edx, [ebp - 0x1ac]
call fcn.00407828
mov edx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x20]
call fcn.00409a00
inc esi
dec edi
jne 0x40f0ff
mov eax, dword [ebp - 0x20]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40f1dd
inc edi
xor esi, esi
lea ecx, [ebp - 0x1b4]
mov eax, dword [ebp - 0x20]
mov edx, esi
call fcn.00409a6c
mov edx, dword [ebp - 0x1b4]
mov eax, dword [ebx + 0xe0]
call fcn.00409a00
inc esi
dec edi
jne 0x40f1b8
mov eax, dword [ebp - 0x1c]
call fcn.00407030
mov eax, dword [ebp - 0x20]
call fcn.00407030
mov eax, dword [ebp - 0x24]
call fcn.00407030
mov eax, dword [ebp - 0x28]
call fcn.00407030
mov eax, dword [ebp - 0x2c]
call fcn.00407030
mov eax, dword [ebp - 0x30]
call fcn.00407030
mov eax, dword [ebx + 0xdc]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40f28d
inc edi
xor esi, esi
mov eax, dword [ebx + 0xe0]
mov eax, dword [eax + 0x1c]
dec eax
test eax, eax
jl 0x40f289
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1b8]
mov eax, dword [ebx + 0xe0]
mov edx, dword [ebp - 0x14]
call fcn.00409a6c
mov eax, dword [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x1bc]
mov eax, dword [ebx + 0xdc]
mov edx, esi
call fcn.00409a6c
mov edx, dword [ebp - 0x1bc]
pop eax
call fcn.004032c8
jne 0x40f281
mov eax, dword [ebx + 0xe0]
mov edx, dword [ebp - 0x14]
call fcn.00409a40
inc dword [ebp - 0x14]
dec dword [ebp - 0x38]
jne 0x40f237
inc esi
dec edi
jne 0x40f21e
xor esi, esi
jmp 0x40f35c
lea eax, [ebp - 0x1c0]
push eax
lea ecx, [ebp - 0x1c4]
mov eax, edi
mov edx, esi
call fcn.00409a6c
mov eax, dword [ebp - 0x1c4]
mov ecx, 1
mov edx, 1
call fcn.004033d4
mov eax, dword [ebp - 0x1c0]
mov edx, 0x40fe18
call fcn.004032c8
je 0x40f35b
lea ecx, [ebp - 0x1cc]
mov eax, dword [ebx + 0xe0]
mov edx, esi
call fcn.00409a6c
mov ecx, dword [ebp - 0x1cc]
lea eax, [ebp - 0x1c8]
mov edx, 0x40fa00
call fcn.004031c8
mov edx, dword [ebp - 0x1c8]
mov eax, 0x80000002
call fcn.004046d8
lea ecx, [ebp - 4]
mov edx, 0x40fe24
call fcn.00404808
cmp dword [ebp - 4], 0
je 0x40f349
lea eax, [ebp - 0x1d0]
call fcn.00404660
lea eax, [ebp - 0x1d0]
mov edx, dword [ebp - 4]
call fcn.00403184
mov eax, dword [ebp - 0x1d0]
call fcn.00407960
test al, al
jne 0x40f358
mov eax, dword [ebx + 0xe0]
mov edx, esi
call fcn.00409a40
jmp 0x40f35c
inc esi
jmp 0x40f35c
inc esi
mov edi, dword [ebx + 0xe0]
cmp esi, dword [edi + 0x1c]
jl 0x40f294
mov eax, dword [ebx + 0xe0]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40f530
inc edi
xor esi, esi
lea ecx, [ebp - 0x1d8]
mov eax, dword [ebx + 0xe0]
mov edx, esi
call fcn.00409a6c
mov ecx, dword [ebp - 0x1d8]
lea eax, [ebp - 0x1d4]
mov edx, 0x40fa00
call fcn.004031c8
mov edx, dword [ebp - 0x1d4]
mov eax, 0x80000002
call fcn.004046d8
lea ecx, [ebp - 4]
mov edx, 0x40fa3c
call fcn.00404808
cmp dword [ebp - 4], 0
je 0x40f433
lea eax, [ebp - 0x1dc]
call fcn.00404660
lea eax, [ebp - 0x1dc]
mov edx, dword [ebp - 4]
call fcn.00403184
mov eax, dword [ebp - 0x1dc]
call fcn.00407960
test al, al
je 0x40f433
lea eax, [ebp - 0x1e4]
call fcn.00404660
lea eax, [ebp - 0x1e4]
mov edx, dword [ebp - 4]
call fcn.00403184
mov edx, dword [ebp - 0x1e4]
lea ecx, [ebp - 0x1e0]
mov eax, ebx
call fcn.004141b8
mov edx, dword [ebp - 0x1e0]
mov eax, dword [ebx + 0xf0]
call fcn.00409a00
jmp 0x40f48d
lea ecx, [ebp - 0x1f0]
mov eax, dword [ebx + 0xe0]
mov edx, esi
call fcn.00409a6c
mov ecx, dword [ebp - 0x1f0]
lea eax, [ebp - 0x1ec]
mov edx, 0x40fa00
call fcn.004031c8
mov edx, dword [ebp - 0x1ec]
mov eax, 0x80000002
call fcn.004046d8
lea ecx, [ebp - 0x1e8]
mov edx, 0x40fa50
call fcn.00404808
mov edx, dword [ebp - 0x1e8]
mov eax, dword [ebx + 0xf0]
call fcn.00409a00
lea ecx, [ebp - 0x1f8]
mov eax, dword [ebx + 0xe0]
mov edx, esi
call fcn.00409a6c
mov ecx, dword [ebp - 0x1f8]
lea eax, [ebp - 0x1f4]
mov edx, 0x40fa00
call fcn.004031c8
mov edx, dword [ebp - 0x1f4]
mov eax, 0x80000002
call fcn.004046d8
lea ecx, [ebp - 4]
mov edx, 0x40fa64
call fcn.00404808
cmp dword [ebp - 4], 0
je 0x40f4fc
lea ecx, [ebp - 0x1fc]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00414488
mov edx, dword [ebp - 0x1fc]
mov eax, dword [ebx + 0xf4]
call fcn.00409a00
jmp 0x40f528
lea ecx, [ebp - 0x200]
mov eax, dword [ebx + 0xf0]
mov edx, dword [eax + 0x1c]
dec edx
mov eax, dword [ebx + 0xf0]
call fcn.00409a6c
mov edx, dword [ebp - 0x200]
mov eax, dword [ebx + 0xf4]
call fcn.00409a00
inc esi
dec edi
jne 0x40f380
mov eax, dword [ebx + 0x70]
call fcn.00409430
test al, al
je 0x40f572
mov eax, dword [ebx + 0xf0]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40f572
inc edi
xor esi, esi
lea ecx, [ebp - 0x204]
mov eax, dword [ebx + 0xf0]
mov edx, esi
call fcn.00409a6c
mov edx, dword [ebp - 0x204]
mov eax, dword [ebx + 0x3c]
call fcn.0040962c
inc esi
dec edi
jne 0x40f54d
mov eax, dword [ebx + 0x6c]
call fcn.00409430
test al, al
je 0x40f5b4
mov eax, dword [ebx + 0xf4]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x40f5b4
inc edi
xor esi, esi
lea ecx, [ebp - 0x208]
mov eax, dword [ebx + 0xf4]
mov edx, esi
call fcn.00409a6c
mov edx, dword [ebp - 0x208]
mov eax, dword [ebx + 0x3c]
call fcn.0040962c
inc esi
dec edi
jne 0x40f58f
mov eax, 0x80000002
call fcn.004048e4
mov edx, 0x40fe38
mov eax, 0x80000001
call fcn.004046d8
mov edx, 0x40fe50
call fcn.00404778
test eax, eax
jne 0x40f5ea
mov eax, dword [ebx + 0x9c]
xor edx, edx
call fcn.00409904
jmp 0x40f5fa
mov eax, dword [ebx + 0x9c]
mov edx, 1
call fcn.00409904
mov edx, 0x40fe64
mov eax, 0x80000001
call fcn.004046d8
lea ecx, [ebp - 0x20c]
mov edx, 0x40fe88
call fcn.00404808
mov eax, dword [ebp - 0x20c]
mov edx, 0x40fb34
call fcn.004032c8
jne 0x40f63a
mov eax, dword [ebx + 0xa0]
mov dl, 1
call fcn.00409450
jmp 0x40f647
mov eax, dword [ebx + 0xa0]
xor edx, edx
call fcn.00409450
mov edx, 0x40fe9c
mov eax, 0x80000001
call fcn.004046d8
lea ecx, [ebp - 8]
mov edx, 0x40febc
call fcn.00404808
mov edx, 0x40fe9c
mov eax, 0x80000001
call fcn.004046d8
lea ecx, [ebp - 0xc]
mov edx, 0x40fecc
call fcn.00404808
mov edx, 0x40fe9c
mov eax, 0x80000001
call fcn.004046d8
lea ecx, [ebp - 0x10]
mov edx, 0x40fee4
call fcn.00404808
mov eax, dword [ebp - 8]
mov edx, 0x40fb34
call fcn.004032c8
je 0x40f6b9
mov eax, dword [ebp - 0xc]
mov edx, 0x40fb34
call fcn.004032c8
jne 0x40f6d0
mov eax, dword [ebx + 0x78]
mov dl, 1
call fcn.00409450
mov eax, dword [ebx + 0x7c]
mov edx, 1
call fcn.00409904
mov eax, dword [ebp - 8]
mov edx, 0x40fefc
call fcn.004032c8
je 0x40f6ee
mov eax, dword [ebp - 0xc]
mov edx, 0x40fefc
call fcn.004032c8
jne 0x40f702
mov eax, dword [ebx + 0x78]
mov dl, 1
call fcn.00409450
mov eax, dword [ebx + 0x7c]
xor edx, edx
call fcn.00409904
mov eax, dword [ebp - 8]
mov edx, 0x40ff08
call fcn.004032c8
je 0x40f720
mov eax, dword [ebp - 0xc]
mov edx, 0x40ff08
call fcn.004032c8
jne 0x40f734
mov eax, dword [ebx + 0x78]
xor edx, edx
call fcn.00409450
mov eax, dword [ebx + 0x7c]
xor edx, edx
call fcn.0040860c
mov eax, dword [ebp - 0x10]
mov edx, 0x40fb34
call fcn.004032c8
jne 0x40f760
mov eax, dword [ebx + 0x80]
mov dl, 1
call fcn.00409450
mov eax, dword [ebx + 0x84]
mov edx, 1
call fcn.00409904
mov eax, dword [ebp - 0x10]
mov edx, 0x40fefc
call fcn.004032c8
jne 0x40f789
mov eax, dword [ebx + 0x80]
mov dl, 1
call fcn.00409450
mov eax, dword [ebx + 0x84]
xor edx, edx
call fcn.00409904
mov eax, dword [ebp - 0x10]
mov edx, 0x40ff08
call fcn.004032c8
jne 0x40f7c2
mov eax, dword [ebx + 0x80]
xor edx, edx
call fcn.00409450
mov eax, dword [ebx + 0x84]
mov edx, 1
call fcn.00409904
mov eax, dword [ebx + 0x84]
xor edx, edx
call fcn.0040860c
mov eax, dword [ebx + 0x6c]
call fcn.00409430
mov edx, eax
mov eax, dword [ebx + 0x80]
call fcn.0040860c
mov eax, dword [ebx + 0x6c]
call fcn.00409430
mov edx, eax
mov eax, dword [ebx + 0x84]
call fcn.0040860c
mov eax, dword [ebx + 0x70]
call fcn.00409430
test al, al
je 0x40f8c2
mov ax, word [0x40fa78]
call fcn.00406834
test al, al
jne 0x40f829
mov ax, word [0x40fa7c]
call fcn.00406834
test al, al
jne 0x40f829
mov ax, word [0x40fa80]
call fcn.00406834
test al, al
je 0x40f881
mov edx, 0x40fe9c
mov eax, 0x80000001
call fcn.004046d8
lea ecx, [ebp - 8]
xor edx, edx
call fcn.00404808
mov eax, dword [ebx + 0x78]
mov dl, 1
call fcn.00409450
mov eax, dword [ebp - 8]
mov edx, 0x40fefc
call fcn.004032c8
jne 0x40f865
mov eax, dword [ebx + 0x7c]
xor edx, edx
call fcn.00409904
mov eax, dword [ebp - 8]
mov edx, 0x40fb34
call fcn.004032c8
jne 0x40f881
mov eax, dword [ebx + 0x7c]
mov edx, 1
call fcn.00409904
mov eax, dword [ebx + 0x104]
sub eax, 0x404
je 0x40f8a4
sub eax, 0x400
jne 0x40f8b3
mov eax, dword [ebx + 0x78]
mov edx, 0x40ff14
call fcn.00408ca0
jmp 0x40f901
mov eax, dword [ebx + 0x78]
mov edx, 0x40ff28
call fcn.00408ca0
jmp 0x40f901
mov eax, dword [ebx + 0x78]
mov edx, 0x40ff3c
call fcn.00408ca0
jmp 0x40f901
mov eax, dword [ebx + 0x104]
sub eax, 0x404
je 0x40f8e5
sub eax, 0x400
jne 0x40f8f4
mov eax, dword [ebx + 0x78]
mov edx, 0x40ff50
call fcn.00408ca0
jmp 0x40f901
mov eax, dword [ebx + 0x78]
mov edx, 0x40ff68
call fcn.00408ca0
jmp 0x40f901
mov eax, dword [ebx + 0x78]
mov edx, 0x40ff80
call fcn.00408ca0
mov eax, 0x80000001
call fcn.004048e4
mov eax, dword [ebx + 0x3c]
xor edx, edx
call fcn.00409904
mov eax, dword [ebx + 0x54]
xor edx, edx
call fcn.00406da4
lea eax, [ebx + 0x110]
push eax
push 0x1e
call sub.user32.dll_GetKeyboardLayoutList
mov eax, ebx
call fcn.00413508
mov eax, dword [ebx + 0x70]
call fcn.00409430
mov byte [ebx + 0x18c], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f991
lea eax, [ebp - 0x20c]
mov edx, 0x63
call fcn.0040301c
lea eax, [ebp - 0x7c]
call fcn.00402ff8
lea eax, [ebp - 0x80]
call fcn.00402ff8
lea eax, [ebp - 0x78]
mov edx, 0x10
call fcn.0040301c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040301c
ret