Function at 0x40b3f0
Capabilities:
Get graphical window text
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x446d07
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x24cac
call fcn.0042b690
mov eax, dword [0x459220]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x24cb0], eax
mov al, byte [esi + 0x2ac]
test al, al
push edi
mov dword [esp + 0x20], esi
jne 0x40db11
push 0
push 0x43b
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
push 0
push 0xbc8
mov ecx, esi
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
push 0
push 0x3f7
mov ecx, esi
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
push 1
push 0x3f8
mov ecx, esi
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
call fcn.00443b5e
push 1
mov ecx, esi
call fcn.0043bea1
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x94], eax
mov dword [esp + 0x24cc4], 0
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov byte [esp + 0x24cc4], 1
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xe4], eax
mov byte [esp + 0x24cc4], 2
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xdc], eax
mov byte [esp + 0x24cc4], 3
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x74], eax
mov byte [esp + 0x24cc4], 4
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xd4], eax
mov byte [esp + 0x24cc4], 5
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xcc], eax
mov byte [esp + 0x24cc4], 6
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xf0], eax
mov byte [esp + 0x24cc4], 7
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xe0], eax
mov byte [esp + 0x24cc4], 8
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xf8], eax
mov byte [esp + 0x24cc4], 9
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xd8], eax
mov byte [esp + 0x24cc4], 0xa
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xe8], eax
mov byte [esp + 0x24cc4], 0xb
call fcn.00438e9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xb8], eax
lea eax, [esp + 0x74]
push eax
push 0x415
mov ecx, esi
mov byte [esp + 0x24ccc], 0xc
call fcn.0043e49d
mov ecx, dword [esi + 0x2c8]
mov eax, dword [esp + 0x74]
push ecx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
call fcn.00401c60
lea edx, [esi + 0x4d8]
add esp, 4
add eax, 0x10
push edx
mov dword [edi], eax
call fcn.00402270
mov eax, dword [esp + 0x80]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov edi, esp
push eax
call fcn.00401c60
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.004063e0
add esp, 4
lea eax, [esp + 0xb8]
push eax
push 0x458
mov ecx, esi
call fcn.0043e49d
lea ecx, [esp + 0xfc]
call fcn.004383c3
mov edx, dword [esi + 0x250]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0xe
push edx
mov byte [esp + 0x24cd8], 0xd
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 0
lea ecx, [esi + 0x234]
call fcn.00437ede
lea eax, [esp + 0xfc]
push eax
mov eax, dword [esp + 0x10]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00401c60
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.004069f0
mov eax, dword [esp + 0x10c]
lea esi, [eax*4]
push esi
mov dword [esp + 0x40], eax
call fcn.00438e3f
mov edi, eax
push esi
mov dword [esp + 0x9c], edi
call fcn.00438e3f
push esi
mov dword [esp + 0x90], eax
call fcn.00438e3f
push esi
mov dword [esp + 0xa8], eax
call fcn.00438e3f
push esi
mov dword [esp + 0xa4], eax
call fcn.00438e3f
push esi
mov dword [esp + 0xa4], eax
call fcn.00438e3f
push esi
mov dword [esp + 0xa4], eax
call fcn.00438e3f
mov ebx, eax
push esi
mov dword [esp + 0xe8], ebx
call fcn.00438e3f
mov ecx, dword [esp + 0x5c]
add esp, 0x28
test ecx, ecx
mov dword [esp + 0x70], eax
mov dword [esp + 0x64], 0xffffffff
mov dword [esp + 0x1c], 0
jle 0x40bdaa
lea ecx, [eax - 4]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x7c]
sub ecx, edi
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x90]
sub ecx, edi
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x88]
sub ecx, eax
mov dword [esp + 0x6c], ecx
mov ecx, dword [esp + 0x80]
sub ecx, eax
sub edi, ebx
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x84]
sub ebx, eax
sub ecx, eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x40], ebx
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x48]
call fcn.004383c3
mov eax, dword [esp + 0x1c]
test eax, eax
push 0x3d
lea edx, [esp + 0x4c]
mov byte [esp + 0x24cc8], 0xe
push edx
jl 0x40db3c
cmp eax, dword [esp + 0x10c]
jge 0x40db3c
push ecx
mov ecx, dword [esp + 0x10c]
shl eax, 2
mov esi, dword [ecx + eax]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
sub esi, 0x10
mov dword [esp + 0x6c], eax
mov dword [esp + 0x20], esp
mov ebx, esp
call dword [edx + 0x10]
mov ecx, dword [esi + 0xc]
test ecx, ecx
lea edx, [esi + 0xc]
jl 0x40b856
cmp eax, dword [esi]
jne 0x40b856
mov eax, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x40b888
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
je 0x40cb5d
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, 0x10
mov dword [ebx], eax
call fcn.004034f0
mov eax, dword [esp + 0x5c]
lea ecx, [eax - 1]
mov edi, 1
add esp, 0xc
cmp ecx, edi
jl 0x40bd84
mov esi, dword [esp + 0x64]
mov edx, dword [esp + 0x18]
inc esi
add edx, 4
cmp eax, edi
mov dword [esp + 0x64], esi
mov dword [esp + 0x18], edx
jle 0x40db3c
mov edx, dword [esp + 0x4c]
mov eax, dword [edx + 4]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x18]
mov eax, dword [eax - 0xc]
lea ebx, [ecx + edx]
mov ecx, dword [esp + 0x30]
lea edx, [eax*8 + 8]
push edx
lea esi, [ebx + ecx]
call fcn.00438e3f
mov dword [esi], eax
mov eax, dword [esp + 0x54]
add esp, 4
cmp eax, edi
jle 0x40db3c
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax + 4]
mov eax, dword [ecx - 0xc]
lea edx, [eax*8 + 8]
push edx
call fcn.00438e3f
mov ecx, dword [esp + 0x48]
add esp, 4
mov dword [esi + ecx], eax
mov edx, dword [esi]
push eax
cmp dword [esp + 0x54], edi
push edx
jle 0x40db3c
mov eax, dword [esp + 0x54]
mov eax, dword [eax + 4]
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov edi, esp
push eax
call fcn.00401c60
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.004065b0
mov ecx, dword [esp + 0x30]
mov dword [esi + ecx], eax
mov eax, dword [esp + 0x5c]
add esp, 0xc
test eax, eax
mov dword [ebx], 0
jle 0x40db3c
mov edx, dword [esp + 0x4c]
mov eax, dword [edx]
mov eax, dword [eax - 0xc]
lea ecx, [eax*4 + 4]
push ecx
call fcn.00438e3f
mov esi, eax
mov eax, dword [esp + 0x54]
add esp, 4
test eax, eax
mov dword [esp + 0x3c], esi
jle 0x40db3c
mov edx, dword [esp + 0x4c]
mov eax, dword [edx]
mov eax, dword [eax - 0xc]
lea ecx, [eax + eax + 2]
push ecx
call fcn.00438e3f
add esp, 4
push eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x54]
test eax, eax
push esi
jle 0x40db3c
mov edx, dword [esp + 0x54]
mov eax, dword [edx]
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401c60
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00406890
mov edi, 1
add esp, 0xc
cmp eax, edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], edi
jl 0x40baba
mov eax, dword [esp + 0x50]
test eax, eax
mov edi, 2
mov dword [esp + 0x10], edi
jle 0x40db3c
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
mov edx, dword [ecx - 0xc]
test edx, edx
mov esi, eax
jl 0x40ba46
push 0x44a36c
push ecx
call fcn.0042ac83
add esp, 8
test eax, eax
je 0x40ba42
sub eax, dword [esi]
mov dword [esp + 0x14], eax
js 0x40ba42
mov dword [ebx], 1
jmp 0x40baba
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
test ecx, ecx
jle 0x40db3c
mov ecx, dword [eax]
mov edx, dword [ecx - 0xc]
test edx, edx
mov esi, eax
jl 0x40ba83
push 0x44a368
push ecx
call fcn.0042ac83
add esp, 8
test eax, eax
je 0x40ba7f
sub eax, dword [esi]
mov dword [esp + 0x14], eax
js 0x40ba7f
mov dword [ebx], 2
jmp 0x40baba
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
test ecx, ecx
jle 0x40db3c
mov esi, eax
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jl 0x40baba
push 0x44a364
push eax
call fcn.0042ac83
add esp, 8
test eax, eax
je 0x40baba
sub eax, dword [esi]
mov dword [esp + 0x14], eax
js 0x40baba
mov dword [ebx], 3
lea eax, [edi*4]
push eax
call fcn.00438e3f
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
add esp, 4
xor eax, eax
test edi, edi
jle 0x40bae4
mov edx, dword [ecx]
mov dword [edx + eax*4], 0
inc eax
cmp eax, edi
jl 0x40bad6
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x104]
jge 0x40db3c
mov ecx, dword [esp + 0x100]
mov edx, dword [esp + 0x60]
mov edx, dword [ecx + edx]
mov ecx, dword [esp + 0xc]
lea eax, [edx - 0x10]
lea esi, [ecx - 0x10]
cmp eax, esi
je 0x40bb5b
mov ecx, dword [esi + 0xc]
test ecx, ecx
lea edi, [esi + 0xc]
jl 0x40bb49
mov ecx, dword [eax]
cmp ecx, dword [esi]
jne 0x40bb49
push eax
call fcn.00401c60
add esp, 4
mov ebx, eax
or edx, 0xffffffff
lock xadd dword [edi], edx
dec edx
test edx, edx
jg 0x40bb40
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
lea ecx, [ebx + 0x10]
mov dword [esp + 0xc], ecx
jmp 0x40bb5b
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.00402990
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 4]
mov esi, dword [ecx - 0xc]
mov edx, 1
sub edx, eax
mov eax, dword [ecx - 8]
sub eax, esi
or eax, edx
jge 0x40bb7f
push esi
lea ecx, [esp + 0x10]
call fcn.00401c10
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0042b8ca
add esp, 4
test esi, esi
jl 0x40db32
mov eax, dword [esp + 0xc]
cmp esi, dword [eax - 8]
jg 0x40db32
mov dword [eax - 0xc], esi
mov eax, dword [esp + 0x10]
cmp eax, 1
mov ecx, dword [esp + 0xc]
mov byte [esi + ecx], 0
jne 0x40bbf5
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jl 0x40bca5
push str.n__
push eax
call fcn.0042ac83
add esp, 8
test eax, eax
je 0x40bca5
sub eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
js 0x40bca5
mov edi, dword [esp + 0x18]
mov edx, dword [edi]
mov dword [edx], 1
jmp 0x40bca9
cmp eax, 2
jne 0x40bca5
mov eax, dword [esp + 0xc]
mov edi, dword [eax - 0xc]
xor edx, edx
xor esi, esi
xor ebx, ebx
xor ecx, ecx
test edi, edi
jle 0x40bca5
test ecx, ecx
jl 0x40db32
cmp ecx, edi
jg 0x40db32
mov eax, dword [esp + 0xc]
mov al, byte [ecx + eax]
cmp al, 0x79
jne 0x40bc3d
test esi, esi
jne 0x40bc3a
test edx, edx
jne 0x40bc3a
xor ebx, ebx
inc esi
jmp 0x40bc57
cmp ecx, edi
jg 0x40db32
cmp al, 0x6e
jne 0x40bc57
test esi, esi
jne 0x40bc56
test edx, edx
jne 0x40bc56
mov ebx, 1
inc edx
lea eax, [esi + edx]
cmp eax, 2
jge 0x40bc64
inc ecx
cmp ecx, edi
jl 0x40bc15
mov eax, 1
cmp esi, eax
jne 0x40bc91
cmp edx, eax
jne 0x40bc91
test ebx, ebx
mov edi, dword [esp + 0x18]
mov ecx, dword [edi]
jne 0x40bc84
mov dword [ecx], ebx
mov edx, dword [edi]
mov dword [edx + 4], eax
jmp 0x40bca9
mov dword [ecx], eax
mov edx, dword [edi]
mov dword [edx + 4], 0
jmp 0x40bca9
cmp edx, 2
jne 0x40bca5
mov edi, dword [esp + 0x18]
mov ecx, dword [edi]
mov dword [ecx], eax
mov edx, dword [edi]
mov dword [edx + 4], eax
jmp 0x40bca9
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x6c]
lea esi, [ebx*4 + 4]
push esi
mov dword [eax + edi], ebx
call fcn.00438e3f
mov ecx, dword [esp + 0x3c]
push esi
mov dword [ecx + edi], eax
call fcn.00438e3f
mov edx, dword [esp + 0x64]
add esp, 8
xor esi, esi
test ebx, ebx
mov dword [edx + edi], eax
jl 0x40bd4c
mov edi, dword [esp + 0x2c]
movsx eax, word [edi]
mov ecx, dword [esp + 0x5c]
mov ebx, dword [esp + 0x18]
mov edx, dword [ecx + ebx]
mov dword [edx + esi*4], eax
movsx eax, word [edi]
lea ecx, [eax*4 + 4]
push ecx
call fcn.00438e3f
mov edx, dword [esp + 0x3c]
mov ecx, dword [edx + ebx]
mov dword [ecx + esi*4], eax
xor eax, eax
add esp, 4
cmp word [edi], ax
jl 0x40bd40
mov ecx, ebx
lea esp, [esp]
mov edx, dword [esp + 0x3c]
mov edx, dword [edx + esi*4]
movsx edx, word [edx + eax*2]
mov ebx, dword [esp + 0x38]
mov ebx, dword [ebx + ecx]
mov ebx, dword [ebx + esi*4]
mov dword [ebx + eax*4], edx
movsx edx, word [edi]
inc eax
cmp eax, edx
jle 0x40bd20
mov eax, dword [esp + 0x28]
inc esi
add edi, 2
cmp esi, eax
jle 0x40bce2
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x3c]
xor esi, esi
test edi, edi
jl 0x40bd71
lea ebx, [ebx]
mov eax, dword [ebx + esi*4]
push eax
call fcn.00438e44
add esp, 4
inc esi
cmp esi, edi
jle 0x40bd60
mov eax, dword [esp + 0x2c]
push eax
call fcn.00438e44
push ebx
call fcn.00438e44
add esp, 8
lea ecx, [esp + 0x48]
mov byte [esp + 0x24cc4], 0xd
call fcn.00438415
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x34]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x40b7e7
push 0xc
call fcn.00438e3f
mov edi, eax
add esp, 4
mov dword [esp + 0x38], edi
xor esi, esi
lea esp, [esp]
push 0x14
call fcn.00438e3f
add esp, 4
mov dword [edi + esi*4], eax
inc esi
cmp esi, 3
jl 0x40bdc0
mov esi, edi
mov ecx, 0x3e8
mov edi, 3
nop
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
xor eax, eax
mov ebx, dword [esi]
mov edx, ecx
imul edx, eax
mov word [ebx + eax*2], dx
inc eax
cmp eax, 9
jle 0x40bdf3
add esi, 4
dec edi
jne 0x40bde0
push 0xfa0
mov dword [esp + 0x40], 0xffffffff
call fcn.00438e3f
mov esi, eax
add esp, 4
mov dword [esp + 0x44], esi
xor edi, edi
push 6
call fcn.00438e3f
add esp, 4
mov dword [esi + edi*4], eax
inc edi
cmp edi, 0x3e8
jl 0x40be27
or eax, 0xffffffff
xor edi, edi
xor ecx, ecx
xor edx, edx
mov ebx, dword [esi + eax*4 + 4]
inc eax
cmp edi, ecx
mov word [ebx], di
mov ebx, dword [esi + eax*4]
mov word [ebx + 2], cx
mov ebx, dword [esi + eax*4]
mov word [ebx + 4], dx
jg 0x40be75
cmp ecx, edx
jg 0x40be75
mov ebx, dword [esp + 0x3c]
inc ebx
mov dword [esp + 0x3c], ebx
mov word [esp + ebx*2 + 0x1e720], ax
inc edx
cmp edx, 9
jle 0x40be46
inc ecx
cmp ecx, 9
jle 0x40be44
inc edi
cmp edi, 9
jle 0x40be42
or esi, 0xffffffff
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 0
lea ebx, [ebx]
xor eax, eax
lea edi, [esi + esi*2]
mov dword [esp + 0x18], eax
lea edi, [esp + edi*2 + 0x1eef0]
mov cx, word [esp + 0x1c]
mov dx, word [esp + 0x28]
mov word [esp + 0x1d77c], ax
lea eax, [esp + 0x1d778]
push 2
push eax
mov word [esp + 0x1d780], cx
mov word [esp + 0x1d782], dx
inc esi
add edi, 6
call fcn.00401fc0
xor ecx, ecx
add esp, 8
mov word [esp + esi*2 + 0x1d780], cx
xor eax, eax
jmp 0x40bf00
movsx edx, word [esp + eax*2 + 0x1d778]
mov ebx, dword [esp + 0x38]
mov ebx, dword [ebx + eax*4]
add cx, word [ebx + edx*2]
inc eax
cmp eax, 3
jl 0x40bf00
mov ax, word [esp + 0x1d778]
mov word [esp + esi*2 + 0x1d780], cx
mov cx, word [esp + 0x1d77c]
cmp ax, cx
jne 0x40bf50
mov dword [esp + esi*4 + 0x2b8], 0xffffffff
mov word [esp + esi*2 + 0x1df50], 0
jmp 0x40bfd4
mov dx, word [esp + 0x1d77a]
cmp ax, dx
je 0x40bfa8
cmp dx, cx
je 0x40bfa8
mov ecx, dword [esp + 0x1d77a]
mov eax, 2
mov dword [esp + esi*4 + 0x2b8], eax
mov word [esp + esi*2 + 0x1df50], ax
mov eax, dword [esp + 0x1d778]
lea eax, [eax + eax*4]
shl eax, 1
lea edx, [eax + ecx]
mov word [edi], dx
mov edx, dword [esp + 0x1d77c]
add eax, edx
mov word [edi + 2], ax
lea eax, [ecx + ecx*4]
lea ecx, [edx + eax*2]
mov word [edi + 4], cx
jmp 0x40bfd4
mov eax, dword [esp + 0x1d778]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x1d77c]
lea ecx, [eax + edx*2]
mov dword [esp + esi*4 + 0x2b8], 0
mov word [esp + esi*2 + 0x1df50], 1
mov word [edi], cx
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 9
mov dword [esp + 0x18], eax
jle 0x40beb0
mov eax, dword [esp + 0x28]
inc eax
cmp eax, 9
mov dword [esp + 0x28], eax
jle 0x40bea0
mov eax, dword [esp + 0x1c]
inc eax
cmp eax, 9
mov dword [esp + 0x1c], eax
jle 0x40be92
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx + 0x101c]
dec eax
lea edx, [esp + 0xc]
push edx
lea edi, [eax + 1]
push 0x43d
mov ecx, ebx
mov dword [esp + 0x48], eax
mov dword [esp + 0x2c], edi
call fcn.0043e49d
mov esi, dword [esp + 0xc]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov dword [esp + 0x68], esp
call dword [eax + 0x10]
mov ecx, dword [esi + 0xc]
test ecx, ecx
lea edx, [esi + 0xc]
jl 0x40c069
cmp eax, dword [esi]
jne 0x40c069
mov eax, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x40c0a0
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40c07e
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x68]
lea edx, [ebx + 0xc18]
add eax, 0x10
push edx
mov dword [ecx], eax
call fcn.00402270
mov eax, dword [esp + 0x18]
push eax
call fcn.0042ac4f
add esp, 0x10
cmp eax, 1
mov dword [esp + 0xc4], eax
jge 0x40c0e1
cmp edi, 1
mov dword [esp + 0xc4], edi
jge 0x40c0e1
mov byte [ebx + 0x2ac], 1
mov al, byte [ebx + 0x2ac]
test al, al
jne 0x40d66a
push fcn.00401f70
push fcn.00401f50
push 7
push 4
lea ecx, [esp + 0xac]
push ecx
call fcn.0042ba0d
lea edx, [esp + 0xc]
push edx
push 0x432
mov ecx, ebx
mov byte [esp + 0x24ccc], 0xf
call fcn.0043e49d
mov esi, dword [esp + 0xc]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov dword [esp + 0x2c], esp
call dword [eax + 0x10]
mov ecx, dword [esi + 0xc]
test ecx, ecx
lea edx, [esi + 0xc]
jl 0x40c15b
cmp eax, dword [esi]
jne 0x40c15b
mov eax, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x40c18e
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40c170
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x2c]
add eax, 0x10
add ebx, 0xa88
push ebx
mov dword [ecx], eax
call fcn.00402270
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xa8]
add eax, 0xfffffff0
lea esi, [edx - 0x10]
add esp, 0xc
cmp esi, eax
mov dword [esp + 0x10], eax
je 0x40c265
mov ecx, dword [eax + 0xc]
test ecx, ecx
jl 0x40c254
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x40c254
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40c1f8
cmp eax, dword [esi]
jne 0x40c1f8
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x40c22d
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
jne 0x40c20f
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c248
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0x9c], ebx
jmp 0x40c265
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [esp + 0xa4]
call fcn.00402990
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push eax
push 0x420
call fcn.0043e49d
mov esi, dword [esp + 0xc]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov ebx, esp
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40c2ae
cmp eax, dword [esi]
jne 0x40c2ae
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40c2e1
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40c2c3
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [esp + 0x28]
add eax, 0x70c
push eax
call fcn.00402270
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xac]
add eax, 0xfffffff0
lea esi, [edx - 0x10]
add esp, 0xc
cmp esi, eax
mov dword [esp + 0x10], eax
je 0x40c3b7
mov ecx, dword [eax + 0xc]
test ecx, ecx
jl 0x40c3a6
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x40c3a6
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40c34a
cmp eax, dword [esi]
jne 0x40c34a
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x40c37f
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
jne 0x40c361
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c39a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0xa0], ebx
jmp 0x40c3b7
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [esp + 0xa8]
call fcn.00402990
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push eax
push 0x416
call fcn.0043e49d
mov esi, dword [esp + 0xc]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov ebx, esp
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40c400
cmp eax, dword [esi]
jne 0x40c400
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40c433
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40c415
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [esp + 0x28]
add eax, 0x528
push eax
call fcn.00402270
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xb0]
add eax, 0xfffffff0
lea esi, [edx - 0x10]
add esp, 0xc
cmp esi, eax
mov dword [esp + 0x10], eax
je 0x40c509
mov ecx, dword [eax + 0xc]
test ecx, ecx
jl 0x40c4f8
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x40c4f8
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40c49c
cmp eax, dword [esi]
jne 0x40c49c
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x40c4d1
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
jne 0x40c4b3
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c4ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0xa4], ebx
jmp 0x40c509
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [esp + 0xac]
call fcn.00402990
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push eax
push 0x422
call fcn.0043e49d
mov esi, dword [esp + 0xc]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov ebx, esp
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40c552
cmp eax, dword [esi]
jne 0x40c552
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40c585
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40c567
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [esp + 0x28]
add eax, 0x7fc
push eax
call fcn.00402270
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xb4]
add eax, 0xfffffff0
lea esi, [edx - 0x10]
add esp, 0xc
cmp esi, eax
mov dword [esp + 0x10], eax
je 0x40c65b
mov ecx, dword [eax + 0xc]
test ecx, ecx
jl 0x40c64a
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x40c64a
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40c5ee
cmp eax, dword [esi]
jne 0x40c5ee
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x40c623
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
jne 0x40c605
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c63e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0xa8], ebx
jmp 0x40c65b
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [esp + 0xb0]
call fcn.00402990
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push eax
push 0x41e
call fcn.0043e49d
mov esi, dword [esp + 0xc]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov ebx, esp
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40c6a4
cmp eax, dword [esi]
jne 0x40c6a4
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40c6d7
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40c6b9
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [esp + 0x28]
add eax, 0x66c
push eax
call fcn.00402270
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xb8]
add eax, 0xfffffff0
lea esi, [edx - 0x10]
add esp, 0xc
cmp esi, eax
mov dword [esp + 0x10], eax
je 0x40c7ad
mov ecx, dword [eax + 0xc]
test ecx, ecx
jl 0x40c79c
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x40c79c
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40c740
cmp eax, dword [esi]
jne 0x40c740
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x40c775
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
jne 0x40c757
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c790
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0xac], ebx
jmp 0x40c7ad
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [esp + 0xb4]
call fcn.00402990
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push eax
push 0x443
call fcn.0043e49d
mov esi, dword [esp + 0xc]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov ebx, esp
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40c7f6
cmp eax, dword [esi]
jne 0x40c7f6
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40c829
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40c80b
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [esp + 0x28]
add eax, 0xc68
push eax
call fcn.00402270
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xbc]
add eax, 0xfffffff0
lea esi, [edx - 0x10]
add esp, 0xc
cmp esi, eax
mov dword [esp + 0x10], eax
je 0x40c8ff
mov ecx, dword [eax + 0xc]
test ecx, ecx
jl 0x40c8ee
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x40c8ee
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40c892
cmp eax, dword [esi]
jne 0x40c892
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x40c8c7
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
jne 0x40c8a9
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c8e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0xb0], ebx
jmp 0x40c8ff
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [esp + 0xb8]
call fcn.00402990
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push eax
push 0x423
call fcn.0043e49d
mov esi, dword [esp + 0xc]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov ebx, esp
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40c948
cmp eax, dword [esi]
jne 0x40c948
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40c97b
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40c95d
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [esp + 0x28]
add eax, 0x84c
push eax
call fcn.00402270
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc0]
add eax, 0xfffffff0
lea esi, [edx - 0x10]
add esp, 0xc
cmp esi, eax
mov dword [esp + 0x10], eax
je 0x40ca51
mov ecx, dword [eax + 0xc]
test ecx, ecx
jl 0x40ca40
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x40ca40
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40c9e4
cmp eax, dword [esi]
jne 0x40c9e4
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x40ca19
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
jne 0x40c9fb
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ca34
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0xb4], ebx
jmp 0x40ca51
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [esp + 0xbc]
call fcn.00402990
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push eax
push 0x417
call fcn.0043e49d
mov esi, dword [esp + 0xc]
push 0x258
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x1c], esp
mov ebx, esp
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40ca9a
cmp eax, dword [esi]
jne 0x40ca9a
mov eax, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40cacd
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40caaf
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [esp + 0x28]
add eax, 0x578
push eax
call fcn.00402270
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 0xc]
lea edx, [eax*4 + 8]
push edx
call fcn.00438e3f
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax - 0xc]
lea ecx, [eax*4 + 8]
push ecx
mov dword [esp + 0x70], ebx
call fcn.00438e3f
mov esi, dword [esp + 0x20]
add esp, 0x14
mov edi, eax
push edi
push ebx
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], esp
mov dword [esp + 0x30], esp
call dword [edx + 0x10]
mov ecx, dword [esi + 0xc]
test ecx, ecx
lea edx, [esi + 0xc]
jl 0x40cb4d
cmp eax, dword [esi]
jne 0x40cb4d
mov eax, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x40cb84
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x40cb62
jmp fcn.00401950
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
add eax, 0x10
mov dword [ecx], eax
call fcn.00405f60
add esp, 0xc
test eax, eax
mov dword [esp + 0x60], eax
jge 0x40cbae
mov eax, dword [esp + 0x64]
inc eax
mov dword [ebx], eax
mov dword [esp + 0x60], 0
mov dword [edi], eax
mov ecx, dword [esp + 0x20]
xor esi, esi
add ecx, 0x374
mov dword [esp + 0x34], esi
call fcn.004187c0
mov eax, 1
mov ecx, 2
mov dword [esp + 0x11c], ecx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x114], eax
mov dword [esp + 0x120], eax
xor eax, eax
mov ecx, 0x1b58
lea edi, [esp + 0xfcb8]
rep stosd dword es:[edi], eax
mov ecx, 0x1b58
lea edi, [esp + 0x8f58]
rep stosd dword es:[edi], eax
mov ecx, 0x1b58
lea edi, [esp + 0x21f8]
rep stosd dword es:[edi], eax
mov ecx, 0x1b58
lea edi, [esp + 0x16a18]
rep stosd dword es:[edi], eax
cmp dword [esp + 0x40], esi
mov dword [esp + 0x110], esi
mov dword [esp + 0x118], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], esi
jl 0x40d639
mov ecx, dword [esp + 0x20]
mov al, byte [ecx + 0x2ac]
test al, al
jne 0x40d635
mov eax, dword [esp + 0x2c]
test eax, eax
jl 0x40db3c
cmp eax, dword [ecx + 0x101c]
jge 0x40db3c
mov edx, dword [ecx + 0x1018]
mov esi, dword [edx + eax*4]
lea eax, [edx + eax*4]
push ecx
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
sub esi, 0x10
mov dword [esp + 0x18], esp
mov ebx, esp
call dword [eax + 0x10]
mov ecx, dword [esi + 0xc]
test ecx, ecx
lea edx, [esi + 0xc]
jl 0x40cca6
cmp eax, dword [esi]
jne 0x40cca6
mov eax, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x40ccd8
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
je 0x40cb5d
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, 0x10
mov dword [ebx], eax
lea eax, [esp + 0xf8]
push eax
call fcn.00403750
add esp, 8
mov edx, dword [eax]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea esi, [edx - 0x10]
cmp esi, eax
mov byte [esp + 0x24cc4], 0x10
mov dword [esp + 0x6c], eax
je 0x40cda8
mov ecx, dword [eax + 0xc]
test ecx, ecx
jl 0x40cd9a
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x40cd9a
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [esi + 0xc]
test edx, edx
lea ecx, [esi + 0xc]
jl 0x40cd42
cmp eax, dword [esi]
jne 0x40cd42
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x40cd76
mov ecx, dword [esi + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
mov ebx, eax
test ebx, ebx
je 0x40cb5d
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
shr ecx, 2
add esi, 0x10
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x6c]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cd91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add ebx, 0x10
mov dword [esp + 0xc], ebx
jmp 0x40cda8
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.00402990
mov eax, dword [esp + 0xf4]
add eax, 0xfffffff0
mov byte [esp + 0x24cc4], 0xf
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cdd1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov edx, dword [esp + 0xc]
mov eax, dword [edx - 0xc]
mov dword [esp + 0x30], eax
xor eax, eax
mov ecx, 0xfa
lea edi, [esp + 0x1df50]
rep stosd dword es:[edi], eax
mov ecx, 0x64
lea edi, [esp + 0x128]
rep stosd dword es:[edi], eax
mov ecx, 0x3e8
lea edi, [esp + 0x1258]
xor esi, esi
or ebx, 0xffffffff
rep stosd dword es:[edi], eax
mov dword [esp + 0x48], 0x44a228
mov dword [esp + 0x4c], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x30]
xor edi, edi
cmp ecx, eax
mov byte [esp + 0x24cc4], 0x11
jle 0x40cf07
jmp 0x40ce41
mov edx, dword [esp + 0xc]
test edi, edi
jl 0x40db32
cmp edi, dword [edx - 0xc]
jg 0x40db32
mov cl, byte [edi + edx]
mov byte [esp + 0xc8], cl
mov edx, dword [esp + 0xc8]
push edx
call fcn.00401590
add esp, 4
test eax, eax
jl 0x40cefa
cmp eax, 9
jg 0x40cefa
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx + ebx*4 + 4]
movsx eax, word [edx + eax*2]
inc ebx
add esi, eax
cmp ebx, 2
jne 0x40cefa
mov eax, dword [esp + esi*4 + 0x2b8]
test eax, eax
jl 0x40ceca
lea ecx, [esi + esi*2]
mov edx, eax
lea ecx, [esp + ecx*2 + 0x1eef0]
inc edx
lea ecx, [ecx]
movsx eax, word [ecx]
mov ebx, dword [esp + eax*4 + 0x128]
lea eax, [esp + eax*4 + 0x128]
inc ebx
add ecx, 2
dec edx
mov dword [eax], ebx
jne 0x40ceb0
mov ebx, dword [esp + 0x50]
test ebx, ebx
jl 0x40db3c
mov ecx, ebx
inc ecx
push 0xffffffffffffffff
push ecx
lea ecx, [esp + 0x50]
call fcn.00401780
mov edx, dword [esp + 0x4c]
mov word [edx + ebx*2], si
mov byte [esp + esi + 0x1df50], 1
or ebx, 0xffffffff
xor esi, esi
mov eax, dword [esp + 0x30]
inc edi
cmp edi, eax
jl 0x40ce3d
mov eax, dword [esp + 0x50]
xor esi, esi
dec eax
cmp eax, esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x1c], esi
jl 0x40d013
mov edi, edi
test esi, esi
jl 0x40db3c
cmp esi, dword [esp + 0x50]
jge 0x40db3c
mov eax, dword [esp + 0x4c]
movsx ecx, word [eax + esi*2]
mov ebx, dword [esp + ecx*4 + 0x2b8]
lea edx, [esp + ecx*4 + 0x2b8]
xor eax, eax
test ebx, ebx
jl 0x40cf7b
lea esi, [ecx + ecx*2]
lea esi, [esp + esi*2 + 0x1eef0]
jmp 0x40cf60
movsx edi, word [esi]
cmp dword [esp + edi*4 + 0x128], 1
jle 0x40cf77
mov edi, dword [edx]
inc eax
add esi, 2
cmp eax, edi
jle 0x40cf60
mov esi, dword [esp + 0x1c]
cmp eax, ebx
jle 0x40cfb0
test ebx, ebx
jl 0x40d001
mov edx, dword [edx]
lea ecx, [ecx + ecx*2]
lea ecx, [esp + ecx*2 + 0x1eef0]
inc edx
movsx eax, word [ecx]
mov ebx, dword [esp + eax*4 + 0x128]
lea eax, [esp + eax*4 + 0x128]
dec ebx
add ecx, 2
dec edx
mov dword [eax], ebx
jne 0x40cf94
jmp 0x40d001
mov edi, dword [esp + 0x38]
mov edx, dword [esp + 0x44]
mov esi, dword [edi + 4]
mov edx, dword [edx + ecx*4]
mov edi, dword [edi]
xor eax, eax
mov ecx, dword [esp + eax*8 + 0x114]
mov ebx, dword [esp + eax*8 + 0x110]
movsx ebx, word [edx + ebx*2]
movsx ecx, word [edx + ecx*2]
movsx ebx, word [edi + ebx*2]
movsx ecx, word [esi + ecx*2]
add ecx, ebx
lea ecx, [esp + ecx + 0x1df50]
mov ebx, 0x1010101
mov dword [ecx], ebx
inc eax
cmp eax, 3
mov dword [ecx + 4], ebx
mov word [ecx + 8], bx
jl 0x40cfc2
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x50]
inc esi
dec eax
cmp esi, eax
mov dword [esp + 0x1c], esi
jle 0x40cf20
xor edx, edx
mov dword [esp + 0x34], edx
xor eax, eax
jmp 0x40d020
mov cl, byte [esp + eax + 0x1df50]
test cl, cl
je 0x40d044
movsx ecx, word [esp + eax*2 + 0x1d780]
mov esi, dword [esp + ecx*4 + 0x1258]
lea ecx, [esp + ecx*4 + 0x1258]
inc esi
mov dword [ecx], esi
inc eax
cmp eax, 0x3e8
jl 0x40d020
cmp dword [esp + 0x3c], edx
mov dword [esp + 0x18], edx
jl 0x40d15f
lea ebx, [ebx]
mov edx, dword [esp + 0x18]
movsx edx, word [esp + edx*2 + 0x1e720]
mov ebx, dword [esp + edx*4 + 0x1258]
cmp ebx, 6
jg 0x40d0b0
mov eax, edx
imul eax, eax, 7
add eax, ebx
shl eax, 2
mov edi, dword [esp + eax + 0xfcb8]
mov esi, dword [esp + eax + 0x21f8]
inc edi
mov ecx, edi
cmp esi, ecx
mov dword [esp + eax + 0xfcb8], edi
jge 0x40d0a5
mov dword [esp + eax + 0x21f8], ecx
mov dword [esp + eax + 0x8f58], 0
test ebx, ebx
jle 0x40d0fb
mov esi, edx
imul esi, esi, 0x1c
lea edi, [esp + esi + 0xfcb8]
mov ecx, ebx
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x30], ebx
mov ecx, ebx
lea esp, [esp]
mov eax, dword [esp + esi + 0x8f58]
mov edi, dword [esp + esi + 0x16a18]
inc eax
cmp edi, eax
mov dword [esp + esi + 0x8f58], eax
jge 0x40d0f1
mov dword [esp + esi + 0x16a18], eax
add esi, 4
dec ecx
jne 0x40d0d0
mov dword [esp + 0x30], ecx
lea eax, [ebx + 1]
cmp eax, 6
jg 0x40d14a
imul edx, edx, 7
add edx, eax
shl edx, 2
mov esi, 7
sub esi, eax
xor eax, eax
lea edi, [esp + edx + 0xfcb8]
mov ecx, esi
rep stosd dword es:[edi], eax
mov eax, edx
mov edi, dword [esp + eax + 0x8f58]
mov edx, dword [esp + eax + 0x16a18]
inc edi
mov ecx, edi
cmp edx, ecx
mov dword [esp + eax + 0x8f58], edi
jge 0x40d144
mov dword [esp + eax + 0x16a18], ecx
add eax, 4
dec esi
jne 0x40d121
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jle 0x40d060
mov eax, dword [esp + 0x2c]
inc eax
mov dword [esp + 0x14], eax
cdq
idiv dword [esp + 0xc4]
test edx, edx
jne 0x40d602
xor edi, edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x18], edi
mov esi, dword [esp + 0x64]
xor eax, eax
cmp esi, eax
mov dword [esp + 0x2c], eax
jl 0x40d4b1
mov ebx, dword [esp + 0xc0]
mov edx, dword [esp + 0x90]
mov ecx, dword [esp + 0x84]
sub edx, ebx
mov dword [esp + 0xbc], edx
mov edx, dword [esp + 0x7c]
sub ecx, ebx
sub edx, ebx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x78], edx
mov edx, dword [esp + 0x8c]
sub eax, ebx
sub ecx, ebx
sub edx, ebx
inc esi
mov dword [esp + 0x68], ebx
mov dword [esp + 0xec], eax
mov dword [esp + 0xd0], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x6c], esi
jmp 0x40d210
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xd0]
lea esp, [esp]
mov edx, dword [eax + ebx]
test edx, edx
mov dword [esp + 0x98], edx
jl 0x40d490
cmp edx, 1
jg 0x40d490
mov esi, dword [ecx + ebx]
fld qword [0x449698]
mov eax, dword [esi]
test eax, eax
jl 0x40d2a3
mov edx, dword [esp + 0x28]
mov ecx, dword [edx + ebx]
mov ecx, dword [ecx]
lea edx, [eax + 1]
lea ebx, [ebx]
mov eax, dword [ecx]
test eax, eax
jl 0x40d292
cmp eax, 6
jg 0x40d292
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x70]
mov edi, dword [ebx + edi]
mov ebx, dword [edi]
mov edi, dword [esp + 0x18]
test ebx, ebx
movsx ebx, word [esp + edi*2 + 0x1d780]
jne 0x40d286
imul ebx, ebx, 7
add ebx, eax
fiadd dword [esp + ebx*4 + 0x21f8]
jmp 0x40d292
imul ebx, ebx, 7
add ebx, eax
fiadd dword [esp + ebx*4 + 0x16a18]
add ecx, 4
dec edx
jne 0x40d250
mov ebx, dword [esp + 0x68]
mov edx, dword [esp + 0x98]
cmp edx, 1
jne 0x40d45f
mov eax, dword [ebx]
cmp eax, edx
jg 0x40d319
mov eax, dword [esi + 4]
test eax, eax
jl 0x40d45f
mov edx, dword [esp + 0x28]
mov ecx, dword [edx + ebx]
mov ecx, dword [ecx + 4]
mov esi, dword [esp + 0x1c]
lea edx, [eax + 1]
mov edi, edi
mov eax, dword [ecx]
test eax, eax
jl 0x40d30a
cmp eax, 6
jg 0x40d30a
mov ebx, dword [esp + 0x70]
mov ebx, dword [esi + ebx]
cmp dword [ebx + 4], 0
movsx ebx, word [esp + edi*2 + 0x1d780]
jne 0x40d2fe
imul ebx, ebx, 7
add ebx, eax
fiadd dword [esp + ebx*4 + 0x21f8]
jmp 0x40d30a
imul ebx, ebx, 7
add ebx, eax
fiadd dword [esp + ebx*4 + 0x16a18]
add ecx, 4
dec edx
jne 0x40d2d0
mov ebx, dword [esp + 0x68]
jmp 0x40d45f
cmp eax, 2
jne 0x40d389
mov eax, dword [esi + 4]
test eax, eax
jl 0x40d45f
mov edx, dword [esp + 0x28]
mov ecx, dword [edx + ebx]
mov ecx, dword [ecx + 4]
mov esi, dword [esp + 0x1c]
lea edx, [eax + 1]
mov edi, edi
mov eax, dword [ecx]
test eax, eax
jl 0x40d37a
cmp eax, 6
jg 0x40d37a
mov ebx, dword [esp + 0x70]
mov ebx, dword [esi + ebx]
cmp dword [ebx + 4], 0
movsx ebx, word [esp + edi*2 + 0x1d780]
jne 0x40d36e
imul ebx, ebx, 7
add ebx, eax
fisub dword [esp + ebx*4 + 0x21f8]
jmp 0x40d37a
imul ebx, ebx, 7
add ebx, eax
fisub dword [esp + ebx*4 + 0x16a18]
add ecx, 4
dec edx
jne 0x40d340
mov ebx, dword [esp + 0x68]
jmp 0x40d45f
cmp eax, 3
jne 0x40d45f
mov eax, dword [esi + 4]
fld qword [0x449698]
test eax, eax
jl 0x40d409
mov edx, dword [esp + 0x28]
mov ecx, dword [edx + ebx]
mov ecx, dword [ecx + 4]
mov esi, dword [esp + 0x1c]
lea edx, [eax + 1]
mov eax, dword [ecx]
test eax, eax
jl 0x40d3ee
cmp eax, 6
jg 0x40d3ee
mov ebx, dword [esp + 0x70]
mov ebx, dword [esi + ebx]
cmp dword [ebx + 4], 0
movsx ebx, word [esp + edi*2 + 0x1d780]
jne 0x40d3e2
imul ebx, ebx, 7
add ebx, eax
fiadd dword [esp + ebx*4 + 0x21f8]
jmp 0x40d3ee
imul ebx, ebx, 7
add ebx, eax
fiadd dword [esp + ebx*4 + 0x16a18]
add ecx, 4
dec edx
jne 0x40d3b4
fcom qword [0x449698]
mov ebx, dword [esp + 0x68]
fnstsw ax
test ah, 0x41
jne 0x40d409
fdivp st(1)
jmp 0x40d413
fstp st(0)
fstp st(0)
fld qword [0x44a358]
fld st(0)
call fcn.0042a7e4
mov dword [esp + 0x98], eax
fild dword [esp + 0x98]
fsubr st(1)
fcomp qword [0x44a350]
fnstsw ax
test ah, 1
jne 0x40d43d
fsub qword [0x44a350]
sub esp, 8
fstp qword [esp]
lea edx, [esp + 0x14]
push str._.2f
push edx
call fcn.00403000
mov eax, dword [esp + 0x1c]
push eax
call fcn.0042ab8f
add esp, 0x14
mov ecx, dword [esp + 0xbc]
mov edx, dword [ecx + ebx]
mov eax, dword [esp + 0x78]
mov ecx, dword [eax + ebx]
sub esp, 8
fstp qword [esp]
push edx
mov edx, dword [esp + 0x3c]
mov eax, dword [edx + ebx]
push ecx
push eax
call fcn.004013f0
add esp, 0x14
test al, al
je 0x40d490
inc dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x6c]
add edx, 4
add ebx, 4
dec eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], eax
jne 0x40d1fe
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x60]
push edx
push eax
push ecx
call fcn.004016a0
add esp, 0x10
test al, al
je 0x40d511
mov edx, dword [esp + 0x44]
mov eax, dword [edx + edi*4]
push 0
push 0
push 2
push 0
push 0
push 2
push eax
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x20680]
push edx
call fcn.00403630
push 0x449678
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x2068c]
push ecx
call fcn.00401120
add esp, 0x30
inc edi
cmp edi, 0x3e8
mov dword [esp + 0x18], edi
jl 0x40d182
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x34]
inc eax
push eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x78]
push eax
lea ecx, [esp + 0x9c]
push str._s_05d.txt
push ecx
mov byte [esp + edx + 0x20670], 0
call fcn.00403000
add esp, 0x10
push 1
push ecx
lea edx, [esp + 0x20668]
mov ecx, esp
mov dword [esp + 0x80], esp
push edx
call fcn.00405440
mov esi, dword [esp + 0x9c]
push ecx
add esi, 0xfffffff0
mov dword [esp + 0xc8], esp
mov edi, esp
push esi
mov byte [esp + 0x24cd4], 0x12
call fcn.00401c60
add eax, 0x10
add esp, 4
mov dword [edi], eax
mov byte [esp + 0x24cd0], 0x11
call fcn.004020d0
add esp, 8
mov dword [esp + 0x7c], esp
mov edi, esp
push esi
call fcn.00401c60
mov ecx, dword [esp + 0x28]
add eax, 0x10
add esp, 4
add ecx, 0x374
mov dword [edi], eax
call fcn.00418680
xor eax, eax
mov ecx, 0x1b58
lea edi, [esp + 0xfcb8]
rep stosd dword es:[edi], eax
mov ecx, 0x1b58
lea edi, [esp + 0x8f58]
rep stosd dword es:[edi], eax
mov ecx, 0x1b58
lea edi, [esp + 0x21f8]
rep stosd dword es:[edi], eax
mov ecx, 0x1b58
lea edi, [esp + 0x16a18]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x4c]
test eax, eax
mov byte [esp + 0x24cc4], 0xf
mov dword [esp + 0x48], 0x44a228
je 0x40d623
push eax
call fcn.00438e44
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x40]
mov dword [esp + 0x2c], eax
jle 0x40cc43
mov ebx, dword [esp + 0x5c]
push ebx
call fcn.00438e44
mov eax, dword [esp + 0x14]
push eax
call fcn.00438e44
add esp, 8
push fcn.00401f70
push 7
push 4
lea ecx, [esp + 0xa8]
push ecx
mov byte [esp + 0x24cd4], 0xd
call fcn.0042b9ad
mov edi, dword [esp + 0x44]
xor esi, esi
mov eax, dword [edi + esi*4]
push eax
call fcn.00438e44
add esp, 4
inc esi
cmp esi, 0x3e8
jl 0x40d670
push edi
call fcn.00438e44
mov edi, dword [esp + 0x3c]
add esp, 4
xor esi, esi
mov eax, dword [edi + esi*4]
push eax
call fcn.00438e44
add esp, 4
inc esi
cmp esi, 3
jl 0x40d694
push edi
call fcn.00438e44
mov eax, dword [esp + 0x68]
add esp, 4
test eax, eax
jl 0x40d779
mov esi, dword [esp + 0x8c]
mov eax, dword [esp + 0x70]
mov ebx, dword [esp + 0x88]
mov edx, dword [esp + 0x64]
sub eax, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x7c]
sub eax, esi
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x80]
sub eax, esi
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x84]
sub eax, esi
sub ebx, esi
inc edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x14]
mov eax, dword [eax + esi]
push eax
call fcn.00438e44
mov eax, dword [esi]
push eax
call fcn.00438e44
mov ecx, dword [esp + 0x4c]
mov eax, dword [ecx + esi]
push eax
call fcn.00438e44
mov edx, dword [esp + 0x84]
mov eax, dword [edx + esi]
push eax
call fcn.00438e44
mov eax, dword [ebx + esi]
add esp, 0x10
xor edi, edi
test eax, eax
jl 0x40d75b
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + esi]
mov eax, dword [ecx + edi*4]
push eax
call fcn.00438e44
mov eax, dword [ebx + esi]
add esp, 4
inc edi
cmp edi, eax
jle 0x40d740
mov edx, dword [esp + 0x40]
mov eax, dword [edx + esi]
push eax
call fcn.00438e44
mov eax, dword [esp + 0x28]
add esp, 4
add esi, 4
dec eax
mov dword [esp + 0x24], eax
jne 0x40d702
mov eax, dword [esp + 0x8c]
push eax
call fcn.00438e44
mov ecx, dword [esp + 0x80]
push ecx
call fcn.00438e44
mov edx, dword [esp + 0x88]
push edx
call fcn.00438e44
mov eax, dword [esp + 0x90]
push eax
call fcn.00438e44
mov ecx, dword [esp + 0xd0]
push ecx
call fcn.00438e44
mov edx, dword [esp + 0xa4]
push edx
call fcn.00438e44
mov eax, dword [esp + 0xa0]
push eax
call fcn.00438e44
mov esi, dword [esp + 0x3c]
mov eax, dword [esi + 0x2a8]
add esp, 0x1c
cmp eax, 0x22b8
mov byte [esi + 0x2ac], 1
je 0x40d804
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0x2a8], 0x22b8
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x44a330
call fcn.00405440
mov eax, dword [esi + 0x2bc]
lea edx, [eax + 1]
push eax
lea eax, [esp + 0x1c]
push eax
mov dword [esi + 0x2bc], edx
call fcn.00405e40
mov ecx, dword [eax]
push ecx
lea edx, [esp + 0x1c]
push 0x44a320
push edx
mov byte [esp + 0x24cdc], 0x13
call fcn.00403000
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
add esp, 0x18
mov byte [esp + 0x24cc4], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d872
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xc]
push eax
push 0x517
mov ecx, esi
call fcn.0043e669
push 1
push 0x43b
mov ecx, esi
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
push 1
push 0xbc8
mov ecx, esi
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
push 1
push 0x3f7
mov ecx, esi
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
push 0
push 0x3f8
mov ecx, esi
call fcn.0043e5f9
mov ecx, eax
call fcn.0043e7d5
mov al, byte [esi + 0x2b8]
test al, al
je 0x40d8eb
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x150]
lea ecx, [esp + 0xfc]
mov byte [esp + 0x24cc4], 0xc
call fcn.00438415
mov eax, dword [esp + 0xb8]
add eax, 0xfffffff0
mov byte [esp + 0x24cc4], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d928
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xe8]
add eax, 0xfffffff0
mov byte [esp + 0x24cc4], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d951
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xd8]
add eax, 0xfffffff0
mov byte [esp + 0x24cc4], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d97a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xf8]
add eax, 0xfffffff0
mov byte [esp + 0x24cc4], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d9a3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xe0]
add eax, 0xfffffff0
mov byte [esp + 0x24cc4], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d9cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xf0]
add eax, 0xfffffff0
mov byte [esp + 0x24cc4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d9f5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xcc]
add eax, 0xfffffff0
mov byte [esp + 0x24cc4], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40da1e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xd4]
add eax, 0xfffffff0
mov byte [esp + 0x24cc4], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40da47
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x74]
add eax, 0xfffffff0
mov byte [esp + 0x24cc4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40da6d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xdc]
add eax, 0xfffffff0
mov byte [esp + 0x24cc4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40da96
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xe4]
add eax, 0xfffffff0
mov byte [esp + 0x24cc4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40dabf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x24cc4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40dae5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x94]
add eax, 0xfffffff0
mov dword [esp + 0x24cc4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40db11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x24cbc]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x24cb4]
call fcn.0042aa55
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401250
jmp fcn.004373f3