Function at 0x4164f0
Capabilities:
Change the wallpaper
Check os version
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x487bd5
mov eax, dword fs:[0]
push eax
sub esp, 0x8fc
mov eax, dword [0x49e7c0]
xor eax, esp
mov dword [esp + 0x8f8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49e7c0]
xor eax, esp
push eax
lea eax, [esp + 0x910]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x920]
mov edi, dword [esp + 0x924]
push ebp
mov dword [esp + 0x30], edi
call fcn.0040c020
add esp, 4
test al, 3
je 0x416552
or eax, 0xffffffff
jmp 0x419cac
push 0
mov dword [esp + 0x18], 0
call fcn.0043c0b0
mov esi, eax
xor eax, eax
mov ebx, 7
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x168], eax
mov word [esp + 0x158], ax
mov dword [esp + 0x91c], eax
mov dword [esp + 0x118], ebx
mov dword [esp + 0x114], eax
mov word [esp + 0x104], ax
lea eax, [esp + 0x154]
push eax
lea ecx, [ebp + 0x1f4]
push ecx
mov byte [esp + 0x924], 1
call fcn.00442450
lea eax, [ebp - 1]
add esp, 0xc
cmp eax, 0xc5
ja case.0x4165d1.6
movzx edx, byte [eax + 0x419e44]
jmp dword [edx*4 + 0x419cd4]
xor ebx, ebx
push 0x4c
lea eax, [esp + 0x44]
push ebx
push eax
mov word [esp + 0x518], bx
call fcn.00478270
add esp, 0xc
cmp esi, ebx
mov dword [esp + 0x40], 0x4c
je 0x416607
mov ecx, dword [esi + 4]
mov dword [esp + 0x44], ecx
jmp 0x416611
mov edx, dword [0x4a06a4]
mov dword [esp + 0x44], edx
lea eax, [esp + 0xfc]
push eax
push 0x1c3
mov dword [esp + 0x50], ebx
call fcn.00442450
add esp, 8
push ebx
mov esi, 1
push esi
lea ecx, [esp + 0x104]
call fcn.004022b0
push str..jpg_.jpe_.jpeg_.gif_.png_.bmp_.lzh_.zip_.rar_.cbz_.cbr_.cbl_.html_.htm_.txt
lea ecx, [esp + 0x100]
call fcn.00402650
push ebx
push esi
lea ecx, [esp + 0x104]
call fcn.004022b0
push ebx
push esi
lea ecx, [esp + 0x104]
call fcn.004022b0
mov edi, 8
cmp dword [esp + 0x114], edi
jb 0x416685
mov ecx, dword [esp + 0x100]
mov dword [esp + 0x4c], ecx
jmp 0x416690
lea edx, [esp + 0x100]
mov dword [esp + 0x4c], edx
cmp dword [0x49e4b0], edi
lea eax, [esp + 0x50c]
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x200
jb 0x4166bb
mov ecx, dword [0x49e49c]
mov dword [esp + 0x6c], ecx
jmp 0x4166c3
mov dword [esp + 0x6c], 0x49e49c
cmp dword [esp + 0x168], edi
jb 0x4166d9
mov edx, dword [esp + 0x154]
mov dword [esp + 0x70], edx
jmp 0x4166e4
lea eax, [esp + 0x154]
mov dword [esp + 0x70], eax
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x78], 0x1000
call dword [sym.imp.comdlg32.dll_GetOpenFileNameW]
test eax, eax
jne 0x416704
mov dword [esp + 0x14], esi
jmp case.0x4165d1.62
cmp dword [0x4a0654], ebx
je 0x416715
push ebx
call fcn.0043bb00
add esp, 4
push esi
call fcn.0043c0b0
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x419c43
mov ecx, dword [0x4a06a4]
lea edx, [esp + 0xfc]
push edx
lea eax, [esp + 0x510]
push eax
push ecx
call fcn.00442b50
mov eax, dword [esp + 0x10c]
add esp, 0xc
cmp dword [esp + 0x114], edi
jae 0x41675e
lea eax, [esp + 0x100]
push ebx
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.00459010
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
test esi, esi
je 0x41677d
mov esi, dword [esi + 4]
jmp 0x416783
mov esi, dword [0x4a06a4]
mov ecx, dword [esp + 0x154]
mov eax, 8
cmp dword [esp + 0x168], eax
jae 0x41679f
lea ecx, [esp + 0x154]
cmp dword [0x49e4b0], eax
mov eax, dword [0x49e49c]
jae 0x4167b1
mov eax, 0x49e49c
push ecx
push eax
push 0x200
lea edx, [esp + 0x518]
push edx
push esi
call fcn.00427e00
add esp, 0x14
cmp eax, 1
je 0x4167db
mov dword [esp + 0x14], 1
jmp case.0x4165d1.62
cmp dword [0x4a0654], 0
je 0x4167ee
push 0
call fcn.0043bb00
add esp, 4
push 1
call fcn.0043c0b0
add esp, 4
test eax, eax
je 0x419c43
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [esp + 0x518]
push ecx
mov ecx, eax
call fcn.00459010
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
mov edx, dword [0x4a06a4]
mov eax, dword [0x4a1388]
push 0
push 0x431920
push edx
push 0x1f9
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x4165d1.62
mov ecx, dword [esi + 4]
push 0
push 0x271d
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x4165d1.62
cmp dword [0x49e494], 8
mov eax, dword [0x49e480]
jae 0x416870
mov eax, 0x49e480
lea edx, [esp + 0xfc]
push edx
push eax
call fcn.004425b0
add esp, 8
push 0x5c
push 1
lea ecx, [esp + 0x104]
call fcn.004022b0
lea edi, [ebp - 0xb]
cmp edi, 9
lea eax, [ebp - 0xa]
jbe 0x4168a0
mov eax, dword [esp + 0x2c]
lea ebx, [ebp - 0x15]
cmp ebx, 9
ja 0x4168ab
lea eax, [ebp - 0x14]
push eax
lea eax, [esp + 0x510]
push 0x48bb00
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esp + 0x50c]
push ecx
lea ecx, [esp + 0x100]
call fcn.00402650
cmp edi, 9
mov edi, 8
ja 0x416998
cmp dword [esp + 0x114], edi
mov eax, dword [esp + 0x100]
jae 0x4168fb
lea eax, [esp + 0x100]
push 0
push eax
call fcn.0043f840
add esp, 8
test eax, eax
mov dword [esp + 0x14], eax
je 0x416998
lea edx, [esp + 0xfc]
push edx
push 0x198
call fcn.00442450
push 0x48baf8
lea eax, [esp + 0x108]
push eax
lea ecx, [esp + 0xb8]
push ecx
call fcn.00402820
lea edx, [esp + 0x164]
push edx
push eax
lea eax, [esp + 0xe0]
push eax
mov byte [esp + 0x938], 2
call fcn.0040cd30
add esp, 0x20
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x15c]
mov byte [esp + 0x924], 3
call fcn.00402360
lea ecx, [esp + 0xc4]
call fcn.00401f00
lea ecx, [esp + 0xa8]
mov byte [esp + 0x918], 1
call fcn.00401f00
cmp ebx, 9
ja 0x416a53
cmp dword [esp + 0x114], edi
mov eax, dword [esp + 0x100]
jae 0x4169b8
lea eax, [esp + 0x100]
push eax
call fcn.00439320
add esp, 4
test eax, eax
mov dword [esp + 0x14], eax
je 0x416a53
lea ecx, [esp + 0xfc]
push ecx
push 0x198
call fcn.00442450
push 0x48baf8
lea edx, [esp + 0x108]
push edx
lea eax, [esp + 0x9c]
push eax
call fcn.00402820
lea ecx, [esp + 0x164]
push ecx
push eax
lea edx, [esp + 0xfc]
push edx
mov byte [esp + 0x938], 4
call fcn.0040cd30
add esp, 0x20
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x15c]
mov byte [esp + 0x924], 5
call fcn.00402360
lea ecx, [esp + 0xe0]
call fcn.00401f00
lea ecx, [esp + 0x8c]
mov byte [esp + 0x918], 1
call fcn.00401f00
test esi, esi
jne 0x416a6b
push 1
call fcn.0043c0b0
mov esi, eax
add esp, 4
test esi, esi
je case.0x4165d1.62
cmp dword [esp + 0x168], edi
mov eax, dword [esp + 0x154]
jae 0x416a82
lea eax, [esp + 0x154]
push 0xfa0
push eax
push 2
mov ecx, esi
call fcn.0044d0b0
jmp case.0x4165d1.62
cmp dword [0x4a0654], 0
je 0x416aa9
push 0
call fcn.0043bb00
add esp, 4
push 1
call fcn.0043c0b0
mov edi, eax
add esp, 4
test edi, edi
je 0x419c43
lea esi, [edi + 0x11c]
mov ecx, esi
call fcn.0040ad10
test eax, eax
jbe 0x416b03
mov ecx, esi
call fcn.0041ed60
push eax
mov ecx, 0x4a1344
call fcn.0041ed60
push eax
call fcn.00401c90
add esp, 8
test al, al
je 0x416b03
mov esi, dword [edi + 0x150]
mov ecx, 0x4a1344
add esi, 1
call fcn.0041ed60
mov dword [eax + 0x1c], esi
mov ecx, 0x4a1344
call fcn.0041ed60
cmp dword [eax + 0x18], 8
jb 0x416b18
mov esi, dword [eax + 4]
jmp 0x416b1b
lea esi, [eax + 4]
mov ecx, 0x4a1344
call fcn.0041ed60
add eax, 0x20
push eax
mov ecx, 0x4a1344
call fcn.0041ed60
mov eax, dword [eax + 0x1c]
mov ecx, dword [0x4a05e4]
sub eax, 1
push eax
push ecx
push esi
mov ecx, edi
call fcn.00459010
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
mov edx, dword [0x4a06a4]
push 0
push 0
push 0x10
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x4165d1.62
mov ecx, 0x4a1354
xor edi, edi
call fcn.00401370
test eax, eax
jle 0x416bcf
mov ebp, 8
nop
lea ecx, [esi + 0x11c]
call fcn.0041ed60
cmp dword [eax + 0x18], ebp
jb 0x416b95
mov ebx, dword [eax + 4]
jmp 0x416b98
lea ebx, [eax + 4]
push edi
mov ecx, 0x4a1354
call fcn.004013a0
cmp dword [eax + 0x18], ebp
jb 0x416bad
mov eax, dword [eax + 4]
jmp 0x416bb0
add eax, 4
push ebx
push eax
call fcn.0047863a
add esp, 8
test eax, eax
je 0x416bcf
mov ecx, 0x4a1354
add edi, 1
call fcn.00401370
cmp edi, eax
jl 0x416b80
mov ecx, 0x4a1354
call fcn.00401370
cmp edi, eax
jne 0x416bf8
lea ecx, [esi + 0x11c]
call fcn.0041ed60
push eax
mov ecx, 0x4a1354
call fcn.00405500
jmp case.0x4165d1.62
add eax, 0xffffffff
cmp edi, eax
mov esi, edi
jge 0x416c3b
lea edi, [esi + 1]
push edi
mov ecx, 0x4a1354
call fcn.004013a0
push esi
mov ecx, 0x4a1354
mov ebx, eax
call fcn.004013a0
push 0xffffffffffffffff
push 0
push ebx
mov ecx, eax
call fcn.00402360
mov ecx, 0x4a1354
mov esi, edi
call fcn.00401370
sub eax, 1
cmp esi, eax
jl 0x416c01
mov ecx, 0x4a1354
call fcn.00401370
sub eax, 1
push eax
mov ecx, 0x4a1354
call fcn.004127c0
mov dword [esp + 0x14], 1
jmp case.0x4165d1.62
cmp dword [0x4a0654], 0
je 0x416c73
push 0
call fcn.0043bb00
add esp, 4
push 1
call fcn.0043c0b0
mov edi, eax
xor esi, esi
add esp, 4
cmp edi, esi
je 0x419c43
push edi
call fcn.0043f1e0
add esp, 4
push esi
push esi
push esi
mov ecx, edi
mov dword [edi + 0x118], 2
call fcn.0044d0b0
sub esp, 0x1c
lea eax, [esp + 0x16c]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.00402600
mov ecx, edi
call fcn.00476470
sub esp, 0x1c
lea edx, [esp + 0x16c]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
mov dword [edi + 0x210], esi
call fcn.00402600
mov ecx, edi
call fcn.004764f0
lea ecx, [esp + 0x1a4]
mov byte [edi + 0x214], 0
call fcn.0040bf10
mov ecx, 0x4a1354
mov byte [esp + 0x918], 6
call fcn.00401370
test eax, eax
jle 0x416e53
mov ebp, dword [sym.imp.KERNEL32.dll_FindClose]
lea ebx, [edi + 0x1fc]
nop
push esi
mov ecx, 0x4a1354
call fcn.004013a0
cmp dword [eax + 0x18], 8
jb 0x416d36
mov eax, dword [eax + 4]
jmp 0x416d39
add eax, 4
lea ecx, [esp + 0x2bc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x416d76
xor ecx, ecx
mov dword [esp + 0x2bc], 0x10
mov dword [esp + 0x2dc], ecx
mov dword [esp + 0x2d8], ecx
mov dword [esp + 0x2d0], ecx
mov dword [esp + 0x2d4], ecx
push eax
call ebp
push esi
mov ecx, 0x4a1354
call fcn.004013a0
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x1b0]
call fcn.00402360
mov edx, dword [esp + 0x2bc]
mov eax, dword [esp + 0x2dc]
mov ecx, dword [esp + 0x2d8]
mov dword [esp + 0x1c0], edx
mov edx, dword [esp + 0x2d0]
mov dword [esp + 0x1c4], eax
mov eax, dword [esp + 0x2d4]
mov dword [esp + 0x1c8], ecx
mov ecx, ebx
mov dword [esp + 0x1cc], edx
mov dword [esp + 0x1d0], eax
mov dword [esp + 0x1e4], 0
mov dword [esp + 0x1e8], esi
mov dword [esp + 0x1e0], 0xffffffff
mov dword [esp + 0x1d4], 0xffffff9d
call fcn.0040ad30
mov ecx, esi
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 3
lea edx, [esp + 0x1a4]
mov dword [esp + 0x258], ecx
push edx
mov ecx, ebx
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x260], 0xffffffff
call fcn.00412fa0
mov ecx, 0x4a1354
add esi, 1
call fcn.00401370
cmp esi, eax
jl 0x416d20
mov ecx, edi
call fcn.0044bb60
xor ebx, ebx
mov dword [esp + 0x130], 7
mov dword [esp + 0x12c], ebx
mov word [esp + 0x11c], bx
lea eax, [esp + 0x118]
push eax
mov ecx, edi
mov byte [esp + 0x91c], 7
call fcn.0044d200
mov esi, dword [edi + 0x140]
cmp esi, ebx
je 0x416ea7
mov ecx, esi
call fcn.00411ee0
push esi
call fcn.004775de
add esp, 4
push 0xa0
call fcn.00477736
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, ebx
mov byte [esp + 0x918], 8
je 0x416eee
cmp dword [esp + 0x130], 8
mov edx, dword [edi + 8]
mov ecx, dword [esp + 0x11c]
jae 0x416edf
lea ecx, [esp + 0x11c]
push ebx
push ebx
push edx
push 2
push ecx
mov ecx, eax
call fcn.00411df0
jmp 0x416ef0
xor eax, eax
cmp eax, ebx
mov byte [esp + 0x918], 7
mov dword [edi + 0x140], eax
je 0x416f0f
push eax
call fcn.00408160
add esp, 4
test eax, eax
je 0x416f2c
mov ecx, edi
call fcn.00452fe0
mov eax, dword [edi + 8]
push ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edi, dword [edi + 8]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
lea ecx, [esp + 0x118]
call fcn.00401f00
lea ecx, [esp + 0x1a4]
mov byte [esp + 0x918], 1
call fcn.0040bf40
jmp case.0x4165d1.62
mov ecx, dword [0x4a06a4]
mov edx, dword [0x4a1388]
push 0
push 0x40b9b0
push ecx
push 0x1f7
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x4165d1.62
mov eax, dword [esi + 0x150]
lea ecx, [esi + 0x12c]
push eax
call fcn.00401330
cmp dword [eax + 0x18], 8
jb 0x416f93
mov edi, dword [eax + 4]
jmp 0x416f96
lea edi, [eax + 4]
cmp byte [0x4a0527], 0
mov word [esp + 0x50c], 0
je 0x41706d
xor eax, eax
mov dword [esp + 0x130], ebx
mov dword [esp + 0x12c], eax
mov word [esp + 0x11c], ax
lea ecx, [esp + 0x118]
push ecx
push edi
mov byte [esp + 0x920], 9
call fcn.00442660
mov eax, dword [esp + 0x124]
add esp, 8
cmp dword [esp + 0x130], 8
jae 0x416ff6
lea eax, [esp + 0x11c]
push eax
call fcn.00442030
add esp, 4
lea edx, [edi + eax*2]
push edx
lea eax, [esp + 0x510]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp word [esp + 0x50c], 0
lea eax, [esp + 0x50c]
je 0x417046
movzx ecx, word [eax]
cmp cx, 0x3a
je 0x417038
cmp cx, 0x5c
je 0x417038
cmp cx, 0x2f
jne 0x41703d
mov word [eax], 0x5f
add eax, 2
cmp word [eax], 0
jne 0x417023
push 0x48baf4
lea ecx, [esp + 0x510]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [esp + 0x118]
mov byte [esp + 0x918], 1
call fcn.00401f00
cmp ebp, 4
mov dword [esp + 0x134], str..jpg
mov dword [esp + 0x138], str..png
mov dword [esp + 0x13c], str..gif
mov dword [esp + 0x140], str..bmp
jne 0x417256
push edi
call fcn.00442070
add esp, 4
lea edx, [edi + eax*2]
push edx
lea eax, [esp + 0x510]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp byte [0x4a0526], 0
jne 0x4170e0
lea ecx, [esp + 0x50c]
push ecx
call fcn.004420f0
add esp, 4
mov word [esp + eax*2 + 0x50c], 0
push 0x4c
lea edx, [esp + 0x44]
push 0
push edx
call fcn.00478270
mov dword [esp + 0x4c], 0x4c
mov eax, dword [esi + 4]
add esp, 0xc
cmp byte [0x4a0526], 0
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], str._.jpg_
je 0x41712b
push edi
call fcn.00443f80
add esp, 4
add eax, 1
mov dword [esp + 0x58], eax
jmp 0x417138
mov ecx, dword [0x4a0530]
add ecx, 1
mov dword [esp + 0x58], ecx
cmp dword [0x49e4e4], 0
lea edx, [esp + 0x50c]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], 0x200
mov edi, 8
jne 0x417176
cmp dword [0x49e4b0], edi
jb 0x41716c
mov eax, dword [0x49e49c]
mov dword [esp + 0x6c], eax
jmp 0x417192
mov dword [esp + 0x6c], 0x49e49c
jmp 0x417192
cmp dword [0x49e4e8], edi
jb 0x41718a
mov ecx, dword [0x49e4d4]
mov dword [esp + 0x6c], ecx
jmp 0x417192
mov dword [esp + 0x6c], 0x49e4d4
cmp dword [esp + 0x168], edi
jb 0x4171a8
mov edx, dword [esp + 0x154]
mov dword [esp + 0x70], edx
jmp 0x4171b3
lea eax, [esp + 0x154]
mov dword [esp + 0x70], eax
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x78], 0x806
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
test eax, eax
jne 0x4171d7
mov dword [esp + 0x14], 1
jmp case.0x4165d1.62
lea edx, [esp + 0x50c]
push edx
lea ecx, [esp + 0x100]
call fcn.00402a20
cmp dword [esp + 0x114], edi
mov eax, dword [esp + 0x100]
jae 0x417202
lea eax, [esp + 0x100]
push eax
call fcn.00443f80
add esp, 4
cmp eax, 0xff
jne 0x41722a
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + eax*4 + 0x130]
push ecx
lea ecx, [esp + 0x100]
call fcn.00402650
cmp dword [esp + 0x114], edi
mov eax, dword [esp + 0x100]
jae 0x417241
lea eax, [esp + 0x100]
push 1
push 0
push eax
mov ecx, esi
call fcn.00458c10
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
push fcn.00401f00
push 0x401a10
push 2
push 0x1c
lea edx, [esp + 0x17c]
push edx
call fcn.0047878c
mov byte [esp + 0x918], 0xa
lea ebp, [esp + 0x16c]
lea ebx, [esi + 0x150]
mov dword [esp + 0x1c], 2
mov edi, 8
cmp dword [ebx], 0xffffffff
je 0x4173c5
mov eax, dword [ebx - 8]
test eax, eax
je 0x4173c5
cmp dword [eax + 0x444], 0
je 0x4173c5
cmp dword [0x49e4e4], 0
jne 0x4172d1
cmp dword [0x49e4b0], edi
mov eax, dword [0x49e49c]
jae 0x4172e3
mov eax, 0x49e49c
jmp 0x4172e3
cmp dword [0x49e4e8], edi
mov eax, dword [0x49e4d4]
jae 0x4172e3
mov eax, 0x49e4d4
push eax
lea ecx, [esp + 0x100]
call fcn.00402a20
lea eax, [esp + 0xfc]
push eax
call fcn.00442310
add esp, 4
test al, al
jne 0x417314
push 0x5c
push 1
lea ecx, [esp + 0x104]
call fcn.004022b0
mov ecx, dword [ebx]
push ecx
lea ecx, [esi + 0x12c]
call fcn.00401330
cmp dword [eax + 0x18], edi
jb 0x41732c
mov edi, dword [eax + 4]
jmp 0x41732f
lea edi, [eax + 4]
lea edx, [esp + 0x50c]
push edx
lea ecx, [esp + 0x100]
call fcn.00402650
push edi
call fcn.00442070
add esp, 4
lea eax, [edi + eax*2]
push eax
lea ecx, [esp + 0x100]
call fcn.00402650
cmp byte [0x4a0526], 0
jne 0x4173ad
cmp dword [esp + 0x114], 8
mov eax, dword [esp + 0x100]
jae 0x41737d
lea eax, [esp + 0x100]
push eax
call fcn.004420f0
add esp, 4
push eax
lea ecx, [esp + 0x100]
call fcn.00402760
mov ecx, dword [0x4a0530]
mov edx, dword [esp + ecx*4 + 0x134]
push edx
lea ecx, [esp + 0x100]
call fcn.00402650
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x104]
push eax
mov ecx, ebp
call fcn.00402360
mov edi, 8
add ebx, 4
add ebp, 0x1c
sub dword [esp + 0x1c], 1
jne 0x417293
cmp dword [esp + 0x1a0], edi
mov ecx, dword [esp + 0x18c]
jae 0x4173ed
lea ecx, [esp + 0x18c]
cmp dword [esp + 0x184], edi
mov eax, dword [esp + 0x170]
jae 0x417404
lea eax, [esp + 0x170]
push 1
push ecx
push eax
mov ecx, esi
call fcn.00458c10
push fcn.00401f00
push 2
push 0x1c
lea ecx, [esp + 0x178]
push ecx
mov dword [esp + 0x24], eax
mov byte [esp + 0x928], 1
call fcn.00478729
jmp case.0x4165d1.62
lea edi, [esi + 0x398]
mov ecx, edi
xor ebx, ebx
call fcn.0040ad90
test eax, eax
jle 0x417473
lea esp, [esp]
push ebx
mov ecx, edi
call fcn.004342d0
mov edx, dword [esi + 0x150]
add edx, 1
cmp dword [eax], edx
je 0x417473
mov ecx, edi
add ebx, 1
call fcn.0040ad90
cmp ebx, eax
jl 0x417450
mov ecx, edi
call fcn.0040ad90
cmp ebx, eax
jne 0x41756d
push 0
mov ecx, edi
call fcn.0040ad90
add eax, 1
push eax
mov ecx, edi
call fcn.00438b50
mov ecx, edi
xor ebp, ebp
call fcn.0040ad90
sub eax, 1
test eax, eax
jle 0x4174cc
push ebp
mov ecx, edi
call fcn.004342d0
mov ecx, dword [esi + 0x150]
add ecx, 1
cmp dword [eax], ecx
jg 0x4174cc
mov ecx, edi
add ebp, 1
call fcn.0040ad90
sub eax, 1
cmp ebp, eax
jl 0x4174a6
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x4174d7
xor eax, eax
jmp 0x4174df
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 2
lea ebx, [eax - 1]
cmp ebx, ebp
jle 0x417544
lea edx, [ebx - 1]
mov dword [esp + 0x1c], edx
lea ecx, [ecx]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x417505
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 2
cmp dword [esp + 0x1c], eax
jb 0x41750a
call fcn.0047770d
mov eax, dword [edi + 4]
lea ecx, [eax + ebx*4 - 4]
mov dword [esp + 0x24], ecx
mov ecx, eax
test ecx, ecx
je 0x417527
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x41752c
call fcn.0047770d
mov eax, dword [esp + 0x24]
mov edx, dword [edi + 4]
mov ecx, dword [eax]
sub dword [esp + 0x1c], 1
mov dword [edx + ebx*4], ecx
sub ebx, 1
cmp ebx, ebp
jg 0x4174f0
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x417557
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 2
cmp ebp, eax
jb 0x41755c
call fcn.0047770d
mov edx, dword [esi + 0x150]
mov eax, dword [edi + 4]
add edx, 1
mov dword [eax + ebp*4], edx
jmp 0x4175ca
mov dword [esp + 0x14], 1
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x417580
xor eax, eax
jmp 0x417588
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 2
add eax, 0xffffffff
cmp ebx, eax
jge 0x4175ad
lea esi, [ebx + 1]
push esi
mov ecx, edi
call fcn.004342d0
push ebx
mov ecx, edi
mov ebp, eax
call fcn.004342d0
mov ecx, dword [ebp]
mov dword [eax], ecx
mov ebx, esi
jmp 0x417575
test ecx, ecx
jne 0x4175b5
xor eax, eax
jmp 0x4175bd
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 2
push 0
add eax, 0xffffffff
push eax
mov ecx, edi
call fcn.00438b50
mov eax, dword [0x4a0a70]
test eax, eax
je case.0x4165d1.62
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je case.0x4165d1.62
mov edx, dword [0x4a0a70]
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [0x4a0a70]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp case.0x4165d1.62
push 0xffffffffffffffff
push 0
push 0x49e47c
lea ecx, [esp + 0x108]
call fcn.00402360
mov eax, dword [esp + 0x100]
mov edi, 8
cmp dword [esp + 0x114], edi
jae 0x417639
lea eax, [esp + 0x100]
push eax
call fcn.00442030
add esp, 4
push eax
lea ecx, [esp + 0x100]
call fcn.00402760
push str.wallpaper.bmp
lea ecx, [esp + 0x100]
call fcn.00402650
cmp dword [esp + 0x114], edi
mov cl, byte [0x4a0525]
mov bl, byte [0x4a0526]
mov eax, dword [esp + 0x100]
mov byte [esp + 0x1b], cl
mov byte [0x4a0526], 0
mov byte [0x4a0525], 0
jae 0x417695
lea eax, [esp + 0x100]
push 0
push 0
push eax
mov ecx, esi
call fcn.00458c10
test eax, eax
jne 0x4176c9
cmp dword [esp + 0x114], edi
mov eax, dword [esp + 0x100]
jae 0x4176bc
lea eax, [esp + 0x100]
push 3
push eax
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dl, byte [esp + 0x1b]
mov byte [0x4a0526], bl
mov byte [0x4a0525], dl
jmp case.0x4165d1.62
lea eax, [ebp - 0x28]
mov edx, 1
cmp eax, edx
mov dword [0x4a05c4], eax
jne 0x4176f7
cmp dword [0x4a05dc], edx
jmp 0x417709
cmp eax, 2
jne 0x417715
mov ecx, dword [0x4a05dc]
cmp ecx, eax
je 0x41770b
cmp ecx, 3
jne 0x417715
mov dword [0x4a05dc], 0
xor ecx, ecx
cmp esi, ecx
je case.0x4165d1.62
cmp eax, edx
mov dword [esi + 0x184], eax
jne 0x417731
cmp dword [esi + 0x180], edx
jmp 0x417744
cmp eax, 2
jne 0x41774c
mov eax, dword [esi + 0x180]
cmp eax, 2
je 0x417746
cmp eax, 3
jne 0x41774c
mov dword [esi + 0x180], ecx
push 0
mov ecx, esi
call fcn.00456310
jmp case.0x4165d1.62
mov eax, dword [0x4a05dc]
xor edx, edx
cmp esi, edx
je 0x41779b
mov ecx, dword [esi + 0x180]
cmp ecx, 2
je 0x417806
cmp ecx, 3
je 0x417806
cmp eax, 2
je 0x417787
cmp eax, 3
jne 0x41779b
push 0
mov ecx, esi
mov dword [esi + 0x180], eax
call fcn.00456310
jmp case.0x4165d1.62
mov ecx, 1
cmp dword [0x4a05c4], ecx
jne 0x41781a
cmp eax, 2
mov dword [0x4a05c4], 2
je 0x4177bc
cmp eax, 3
jne 0x4177c2
mov dword [0x4a05dc], edx
cmp esi, edx
je case.0x4165d1.62
mov eax, dword [esi + 0x184]
sub eax, ecx
neg eax
sbb eax, eax
add eax, 2
cmp eax, ecx
mov dword [esi + 0x184], eax
jne 0x4177f1
cmp dword [esi + 0x180], ecx
jne 0x4177f1
mov dword [esi + 0x180], edx
cmp eax, 2
jne 0x41780c
mov eax, dword [esi + 0x180]
cmp eax, 2
je 0x417806
cmp eax, 3
jne 0x41780c
mov dword [esi + 0x180], edx
push 0
mov ecx, esi
call fcn.00456310
jmp case.0x4165d1.62
mov dword [0x4a05c4], ecx
cmp eax, ecx
jmp 0x4177ba
mov ecx, dword [0x4a05dc]
lea eax, [ebp - 0x2b]
cmp ecx, eax
jne 0x41784c
mov edx, 1
cmp ecx, edx
jne 0x417840
mov dword [0x4a05c4], edx
mov dword [0x4a05dc], 0
jmp 0x41786d
cmp eax, 2
mov dword [0x4a05dc], eax
je 0x41785b
cmp eax, 3
jne 0x417868
mov edx, 1
mov dword [0x4a05c4], edx
jmp 0x41786d
mov edx, 1
test esi, esi
je case.0x4165d1.62
mov ecx, dword [esi + 0x180]
cmp ecx, eax
jne 0x4178a1
cmp ecx, edx
jne 0x417889
mov dword [esi + 0x184], edx
push 0
mov ecx, esi
mov dword [esi + 0x180], 0
call fcn.00456310
jmp case.0x4165d1.62
cmp eax, 2
mov dword [esi + 0x180], eax
je 0x4178b1
cmp eax, 3
jne 0x4178b7
mov dword [esi + 0x184], edx
push 0
mov ecx, esi
call fcn.00456310
jmp case.0x4165d1.62
mov ecx, dword [0x4a06a4]
mov edx, dword [0x4a1388]
push 0
push 0x40aa00
push ecx
push 0x1f0
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x4165d1.62
test esi, esi
lea eax, [ebp - 0x30]
mov dword [0x4a05c0], eax
je case.0x4165d1.62
push 0
mov ecx, esi
mov dword [esi + 0x188], eax
call fcn.00456310
jmp case.0x4165d1.62
xor eax, eax
cmp dword [0x4a05c0], eax
sete al
test esi, esi
mov dword [0x4a05c0], eax
je case.0x4165d1.62
xor ecx, ecx
cmp dword [esi + 0x188], ecx
push 0
sete cl
mov dword [esi + 0x188], ecx
mov ecx, esi
call fcn.00456310
jmp case.0x4165d1.62
test esi, esi
lea eax, [ebp - 0x33]
mov dword [0x4a05b8], eax
je case.0x4165d1.62
push 0
mov ecx, esi
mov dword [esi + 0x18c], eax
call fcn.00456310
jmp case.0x4165d1.62
cmp dword [0x4a05b8], 5
jne 0x41797e
mov dword [0x4a05b8], 0
jmp 0x417985
add dword [0x4a05b8], 1
test esi, esi
je case.0x4165d1.62
mov eax, dword [esi + 0x18c]
cmp eax, 5
jne 0x4179b0
push 0
mov ecx, esi
mov dword [esi + 0x18c], 0
call fcn.00456310
jmp case.0x4165d1.62
add eax, 1
push 0
mov ecx, esi
mov dword [esi + 0x18c], eax
call fcn.00456310
jmp case.0x4165d1.62
cmp ebp, 0x3c
jne 0x4179f7
test esi, esi
je 0x417a0a
mov eax, dword [esi + 0x150]
cmp eax, 0xffffffff
je 0x4179f7
push eax
lea ecx, [esi + 0x12c]
call fcn.00401330
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esi + 0x234]
call fcn.00402360
test esi, esi
je 0x417a0a
lea ecx, [esi + 0x11c]
call fcn.0040ad10
test eax, eax
jne 0x417a13
lea edx, [ebp - 0x3a]
mov dword [0x4a05e4], edx
test esi, esi
je case.0x4165d1.62
lea edi, [esi + 0x11c]
mov ecx, edi
call fcn.0040ad10
test eax, eax
jbe case.0x4165d1.62
mov ecx, edi
call fcn.0041ed60
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x108]
call fcn.00402360
mov eax, dword [esp + 0x100]
mov edi, 8
cmp dword [esp + 0x114], edi
jae 0x417a64
lea eax, [esp + 0x100]
push eax
call fcn.00404700
mov eax, dword [esp + 0x104]
add esp, 4
cmp dword [esp + 0x114], edi
jae 0x417a84
lea eax, [esp + 0x100]
mov ecx, dword [esi + 0x150]
push 0
push ecx
add ebp, 0xffffffc6
push ebp
push eax
mov ecx, esi
call fcn.00459010
cmp dword [esp + 0x114], edi
mov eax, dword [esp + 0x100]
jae 0x417ab0
lea eax, [esp + 0x100]
push eax
call fcn.00404840
add esp, 4
jmp case.0x4165d1.62
mov eax, dword [esi + 0x118]
test eax, eax
jne 0x417acf
mov edi, 1
jmp 0x417ade
sub eax, 1
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 2
mov edi, eax
lea ecx, [esi + 0x11c]
call fcn.0041ed60
cmp dword [eax + 0x18], 8
jb 0x417af4
mov eax, dword [eax + 4]
jmp 0x417af7
add eax, 4
mov edx, dword [esi + 0x150]
push 0
push edx
push edi
push eax
mov ecx, esi
call fcn.00459010
jmp case.0x4165d1.62
mov eax, dword [0x4a06a4]
mov ecx, dword [0x4a1388]
push 0
push 0x40a880
push eax
push 0x1de
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x4165d1.62
mov edx, dword [0x4a06a4]
mov eax, dword [0x4a1388]
push 0
push 0x40eeb0
push edx
push 0x1e2
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x4165d1.62
cmp byte [0x4a0625], 0
jne 0x417c9a
mov byte [0x4a0625], 1
call fcn.0041fab0
mov ecx, dword [0x4a06a4]
push 0x96080000
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
xor edi, edi
cmp dword [0x4a0a4c], edi
jne 0x417b9f
mov edx, dword [0x4a06a4]
push edx
call dword [sym.imp.USER32.dll_GetMenu]
mov dword [0x4a0a4c], eax
mov eax, dword [0x4a06a4]
push edi
push eax
call dword [sym.imp.USER32.dll_SetMenu]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
mov dword [esp + 0x138], edi
mov dword [esp + 0x13c], edi
call esi
mov ebp, 1
push ebp
mov dword [esp + 0x140], eax
call esi
lea ecx, [esp + 0x134]
push ecx
push 0x40ac50
push edi
push edi
mov dword [esp + 0x150], eax
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov eax, dword [esp + 0x138]
mov edx, dword [esp + 0x140]
mov ecx, dword [esp + 0x134]
push 0x60
sub edx, eax
push edx
mov edx, dword [esp + 0x144]
sub edx, ecx
push edx
push eax
mov eax, dword [0x4a06a4]
push ecx
push 0xfffffffffffffffe
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, 0x4a06a0
mov bl, 2
lea esp, [esp]
mov eax, dword [esi + 0x24]
cmp eax, ebp
je 0x417c3c
cmp eax, 3
jne 0x417c5a
cmp dword [esi + 0x2c], ebp
je 0x417c5a
test byte [esi + 0x34], bl
je 0x417c5a
mov edx, dword [esi]
mov eax, dword [edx + 0x3c]
mov ecx, esi
call eax
mov eax, dword [esi + 0x14]
cmp eax, edi
je 0x417c65
mov esi, eax
jmp 0x417c81
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x417c4f
mov esi, eax
jmp 0x417c81
mov esi, dword [esi + 0x10]
cmp esi, edi
je 0x417c85
lea esp, [esp]
cmp dword [esi + 0x14], edi
jne 0x417c7e
mov esi, dword [esi + 0x10]
cmp esi, edi
jne 0x417c70
jmp 0x417c85
mov esi, dword [esi + 0x14]
cmp esi, edi
jne 0x417c30
call fcn.00420a00
push ebp
mov ecx, 0x4a06a0
call fcn.00428800
jmp case.0x4165d1.62
mov byte [0x4a0625], 0
call fcn.0041fab0
mov ecx, dword [0x4a06a4]
push 0x16cf0000
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov esi, dword [0x4a06dc]
mov edx, dword [0x4a06d8]
mov ecx, dword [0x4a06e4]
mov eax, dword [0x4a06e0]
push 0x60
sub ecx, esi
push ecx
sub eax, edx
push eax
push esi
push edx
mov edx, dword [0x4a06a4]
push 0xfffffffffffffffe
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [0x4a0650], 0
jne 0x417d1f
mov eax, dword [0x4a0a4c]
test eax, eax
jne 0x417d08
mov ecx, 0x4a06a0
call fcn.004288b0
jmp 0x417d1f
push eax
mov eax, dword [0x4a06a4]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
mov dword [0x4a0a4c], 0
mov esi, 0x4a06a0
mov eax, dword [esi + 0x24]
cmp eax, 1
je 0x417d31
cmp eax, 3
jne 0x417d7e
mov eax, dword [esi + 0x2c]
cmp eax, 2
je 0x417d3e
cmp eax, 3
jne 0x417d7e
test byte [esi + 0x34], 2
je 0x417d7e
mov ecx, dword [esi + 0x10]
mov edi, dword [esi]
mov edx, dword [edi + 0x24]
mov ebx, dword [esi + 0x30]
mov ebp, dword [esi + 0x14]
mov dword [esp + 0x1c], ecx
mov ecx, esi
call edx
mov edx, dword [edi + 0x34]
push eax
mov eax, dword [esp + 0x20]
push ebx
push ebp
push eax
mov ecx, esi
call edx
cmp dword [esi + 4], 0
jne 0x417d7e
mov ecx, dword [esi + 0x28]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push 0
push ecx
mov ecx, esi
call edx
mov eax, dword [esi + 0x18]
test eax, eax
je 0x417d89
mov esi, eax
jmp 0x417db2
mov eax, dword [esi + 0x14]
test eax, eax
je 0x417d94
mov esi, eax
jmp 0x417db2
mov esi, dword [esi + 0x10]
test esi, esi
je 0x417dba
jmp 0x417da0
cmp dword [esi + 0x14], 0
jne 0x417daf
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x417da0
jmp 0x417dba
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x417d24
call fcn.00420a00
push 1
mov ecx, 0x4a06a0
call fcn.00428800
call fcn.00420a00
jmp case.0x4165d1.62
cmp byte [esi + 0x370], 0
je 0x417df7
push 1
push 0
push 0
mov ecx, esi
call fcn.0044fe20
mov byte [esi + 0x370], 0
jmp case.0x4165d1.62
mov byte [esi + 0x370], 1
jmp case.0x4165d1.62
xor eax, eax
cmp dword [0x4a05bc], eax
sete al
test esi, esi
mov dword [0x4a05bc], eax
je case.0x4165d1.62
xor ecx, ecx
cmp dword [esi + 0x174], ecx
push 0
sete cl
mov dword [esi + 0x174], ecx
mov ecx, esi
call fcn.00456310
jmp case.0x4165d1.62
test esi, esi
je 0x417eba
mov eax, dword [esi + 0x19c]
lea edx, [ebp - 0x47]
cmp eax, edx
jne 0x417e5e
fld1
mov ebp, 0x47
fst qword [esi + 0x158]
fstp qword [esi + 0x160]
cmp dword [0x4a05f0], 0
je 0x417eca
test eax, eax
je 0x417eca
xor edi, edi
push edi
push esi
call fcn.0043d4f0
mov ecx, dword [esi + 0x148]
add esp, 8
cmp ecx, edi
je 0x417e8f
add dword [ecx + 4], 0xffffffff
jne 0x417e8f
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x148], edi
mov ecx, dword [esi + 0x14c]
cmp ecx, edi
je 0x417ead
add dword [ecx + 4], 0xffffffff
jne 0x417ead
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x14c], edi
call fcn.0043d490
jmp 0x417eca
lea eax, [ebp - 0x47]
cmp dword [0x4a0580], eax
jne 0x417eca
mov ebp, 0x47
add ebp, 0xffffffb9
test esi, esi
mov dword [0x4a0580], ebp
je case.0x4165d1.62
mov ecx, dword [esi + 0x170]
mov edx, dword [esi + 0x150]
push ecx
push edx
mov ecx, esi
mov dword [esi + 0x19c], ebp
call fcn.00452340
jmp case.0x4165d1.62
mov eax, dword [0x4a0580]
add eax, 1
cmp eax, ebx
mov dword [0x4a0580], eax
jne 0x417f13
xor eax, eax
mov dword [0x4a0580], eax
test esi, esi
je case.0x4165d1.62
push 0
mov ecx, esi
mov dword [esi + 0x19c], eax
call fcn.00456310
jmp case.0x4165d1.62
xor eax, eax
cmp dword [0x4a0574], eax
sete al
mov dword [0x4a0574], eax
jmp case.0x4165d1.62
add ebp, 0xffffffaf
test esi, esi
mov dword [0x4a0568], ebp
je case.0x4165d1.62
push 0
mov ecx, esi
mov dword [esi + 0x1b0], ebp
call fcn.00456310
jmp case.0x4165d1.62
mov eax, dword [0x4a0568]
add eax, 1
cmp eax, ebx
mov dword [0x4a0568], eax
jne 0x417f81
xor eax, eax
mov dword [0x4a0568], eax
test esi, esi
je case.0x4165d1.62
push 0
mov ecx, esi
mov dword [esi + 0x1b0], eax
call fcn.00456310
jmp case.0x4165d1.62
push 1
push 1
mov ecx, esi
call fcn.00455320
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
push 1
push 0xffffffffffffffff
mov ecx, esi
call fcn.00455320
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
cmp dword [0x4a05f0], 0
je 0x418036
cmp dword [esi + 0x19c], 0
je 0x418036
cmp dword [esi + 0x184], 2
je 0x417fe9
cmp dword [esi + 0x180], 1
jne 0x418036
xor edi, edi
push edi
push esi
call fcn.0043d4f0
mov ecx, dword [esi + 0x148]
add esp, 8
cmp ecx, edi
je 0x41800d
add dword [ecx + 4], 0xffffffff
jne 0x41800d
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0x148], edi
mov ecx, dword [esi + 0x14c]
cmp ecx, edi
je 0x41802b
add dword [ecx + 4], 0xffffffff
jne 0x41802b
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0x14c], edi
call fcn.0043d490
add ebp, 0xffffffa3
cmp ebp, ebx
ja case.0x4165d1.62
jmp dword [ebp*4 + 0x419f0c]
push 0
push 1
mov ecx, esi
call fcn.00455320
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
push 0
push 0xffffffffffffffff
mov ecx, esi
call fcn.00455320
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
mov ecx, dword [0x4a0560]
push 0
push ecx
mov ecx, esi
call fcn.00455320
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
mov edx, dword [0x4a0560]
push 0
neg edx
push edx
mov ecx, esi
call fcn.00455320
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
mov eax, dword [0x4a055c]
push 0
push eax
mov ecx, esi
call fcn.00455320
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
mov ecx, dword [0x4a055c]
neg ecx
push 0
push ecx
mov ecx, esi
call fcn.00455320
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
mov edi, dword [0x4a0558]
test edi, edi
jle case.0x4165d1.62
push 0
mov ecx, esi
call fcn.0040b080
lea eax, [eax + edi - 1]
cdq
idiv edi
mov ecx, esi
push eax
call fcn.00455320
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
mov edi, dword [0x4a0558]
test edi, edi
jle case.0x4165d1.62
push 0
mov ecx, esi
call fcn.0040b080
lea eax, [eax + edi - 1]
cdq
idiv edi
mov ecx, esi
neg eax
push eax
call fcn.00455320
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
cmp dword [0x4a05f0], 0
mov ebx, 2
je 0x4181a8
cmp dword [esi + 0x19c], 0
je 0x4181a8
cmp dword [esi + 0x184], ebx
je 0x41815f
cmp dword [esi + 0x180], 1
jne 0x4181a8
mov ecx, dword [esi + 0x148]
test ecx, ecx
je 0x418177
add dword [ecx + 4], 0xffffffff
jne 0x418177
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0x148], 0
mov ecx, dword [esi + 0x14c]
test ecx, ecx
je 0x418199
add dword [ecx + 4], 0xffffffff
jne 0x418199
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0x14c], 0
call fcn.0043d490
mov ecx, esi
call fcn.0040b080
mov edi, 1
sub eax, edi
cmp dword [esi + 0x184], ebx
mov dword [esp + 0x24], eax
je 0x4181ce
cmp dword [esi + 0x180], edi
jne 0x418465
mov ecx, esi
call fcn.0040b080
cmp dword [esi + 0x174], 0
je 0x4181e0
add eax, edi
cmp dword [esi + 0x180], edi
jne 0x418454
test al, 1
jne 0x418465
mov ecx, esi
call fcn.0040b080
sub eax, ebx
test eax, eax
mov dword [esp + 0x24], eax
jle 0x418465
mov dword [esp + 0x1c], 0
lea ebx, [esi + 0x12c]
mov ebp, eax
lea esp, [esp]
push ebp
mov ecx, ebx
call fcn.00401330
cmp dword [eax + 0x30], 0xffffff9d
jne 0x4183d6
xor edi, edi
mov eax, 7
mov dword [esp + 0x130], eax
mov dword [esp + 0x12c], edi
mov word [esp + 0x11c], di
mov dword [esp + 0x184], eax
mov dword [esp + 0x180], edi
mov word [esp + 0x170], di
mov ecx, esi
mov byte [esp + 0x918], 0xc
call fcn.0040b080
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
push eax
lea eax, [ecx + edx + 1]
push eax
lea ecx, [esp + 0x1ac]
push str._d__d:
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [esp + 0x17c]
push edx
push 0x1a5
call fcn.00442450
add esp, 0x18
lea eax, [esp + 0x1a4]
push eax
lea ecx, [esp + 0x11c]
call fcn.00402a20
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x174]
push ecx
lea ecx, [esp + 0x124]
call fcn.00401fd0
sub esp, 0x1c
lea edx, [esp + 0x134]
mov ecx, esp
mov dword [esp + 0x4c], esp
push edx
call fcn.00402600
mov ecx, esi
call fcn.004764f0
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], edi
lea eax, [esi + 0x2e4]
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x44]
push eax
mov eax, dword [esi + 0x1b0]
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x28]
push edx
push esi
push eax
push edi
push edi
push edi
push edi
push 1
push edi
push ebp
mov ecx, ebx
mov byte [esp + 0x954], 0xe
call fcn.00401330
sub esp, 0x58
mov ecx, esp
mov dword [esp + 0xc0], esp
push eax
call fcn.00402790
call fcn.00437300
add esp, 0x90
push ebp
mov ecx, ebx
mov edi, eax
call fcn.00401330
test edi, edi
mov dword [eax + 0x30], edi
jl 0x418394
push ebp
mov ecx, ebx
call fcn.00401330
mov ecx, dword [esp + 0x38]
mov dword [eax + 0x4c], ecx
push ebp
mov ecx, ebx
call fcn.00401330
mov edx, dword [esp + 0x3c]
push ebp
mov ecx, ebx
mov dword [eax + 0x50], edx
call fcn.00401330
mov ecx, dword [esp + 0x34]
mov dword [eax + 0x54], ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x918], 0xd
call fcn.00401000
lea ecx, [esp + 0x14]
mov byte [esp + 0x918], 0xc
call fcn.00401000
lea ecx, [esp + 0x16c]
call fcn.00401f00
lea ecx, [esp + 0x118]
mov byte [esp + 0x918], 1
call fcn.00401f00
mov eax, dword [esp + 0x1c]
add eax, 1
add ebp, 1
cmp eax, 2
mov dword [esp + 0x1c], eax
jl 0x418220
mov eax, dword [esp + 0x24]
mov dword [esp + 0x134], eax
add eax, 1
lea edx, [esp + 0x1b]
mov dword [esp + 0x138], eax
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x13c]
push ecx
mov ecx, esi
call fcn.00448b10
cmp dword [esp + 0x2c], 1
je 0x418448
mov edx, dword [esp + 0x134]
push edx
mov ecx, esi
call fcn.0044a5e0
test al, al
jne 0x418448
mov eax, dword [esp + 0x138]
push eax
mov ecx, esi
call fcn.0044a090
test al, al
je 0x418465
mov ecx, esi
call fcn.0040b080
sub eax, 1
jmp 0x418461
test al, 1
jne 0x418465
mov ecx, esi
call fcn.0040b080
sub eax, ebx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
push 2
push ecx
mov ecx, esi
call fcn.00452340
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
cmp dword [0x4a05f0], 0
je 0x4184e9
cmp dword [esi + 0x19c], 0
je 0x4184e9
cmp dword [esi + 0x184], 2
je 0x4184a0
cmp dword [esi + 0x180], 1
jne 0x4184e9
mov ecx, dword [esi + 0x148]
test ecx, ecx
je 0x4184b8
add dword [ecx + 4], 0xffffffff
jne 0x4184b8
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0x148], 0
mov ecx, dword [esi + 0x14c]
test ecx, ecx
je 0x4184da
add dword [ecx + 4], 0xffffffff
jne 0x4184da
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0x14c], 0
call fcn.0043d490
push 1
push 0
mov ecx, esi
call fcn.00452340
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
mov ecx, dword [esi + 4]
mov edx, dword [0x4a1388]
push 0
push 0x40b560
push ecx
push 0x1df
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x4165d1.62
mov edi, dword [esi + 0x150]
xor eax, eax
mov byte [esp + 0x1b], 0
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x148], eax
mov word [esp + 0x138], ax
mov dword [esp + 0x130], ebx
mov dword [esp + 0x12c], eax
mov word [esp + 0x11c], ax
lea ebp, [esi + 0x12c]
push edi
mov ecx, ebp
mov byte [esp + 0x91c], 0x10
call fcn.00401330
cmp dword [eax + 0x18], 8
jb 0x418579
mov ebx, dword [eax + 4]
jmp 0x41857c
lea ebx, [eax + 4]
mov eax, dword [esi + 0x150]
push eax
mov ecx, ebp
call fcn.00401330
cmp dword [eax + 0x18], 8
jb 0x418595
mov ebp, dword [eax + 4]
jmp 0x418598
lea ebp, [eax + 4]
push ebx
call fcn.00442070
add esp, 4
sub eax, 1
push eax
push ebp
lea ecx, [esp + 0x13c]
call fcn.00402680
cmp dword [esp + 0x920], 0x69
jne 0x4185d3
mov ecx, esi
call fcn.0040b080
sub eax, 1
cmp edi, eax
je 0x418680
add edi, 1
jmp 0x4185de
test edi, edi
je 0x418680
sub edi, 1
lea ebx, [esi + 0x12c]
push edi
mov ecx, ebx
call fcn.00401330
cmp dword [eax + 0x18], 8
jb 0x4185f7
mov ebp, dword [eax + 4]
jmp 0x4185fa
lea ebp, [eax + 4]
push edi
mov ecx, ebx
call fcn.00401330
cmp dword [eax + 0x18], 8
jb 0x41860d
mov ebx, dword [eax + 4]
jmp 0x418610
lea ebx, [eax + 4]
push ebp
call fcn.00442070
add esp, 4
sub eax, 1
push eax
push ebx
lea ecx, [esp + 0x120]
call fcn.00402680
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x138]
push edx
call fcn.0040beb0
add esp, 8
test al, al
je 0x4185b2
cmp byte [esp + 0x1b], 0
jne 0x41867d
cmp dword [esp + 0x920], 0x69
mov byte [esp + 0x1b], 1
je 0x418699
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x120]
push eax
lea ecx, [esp + 0x140]
call fcn.00402360
jmp 0x4185b2
add edi, 1
cmp byte [esp + 0x1b], 0
jne 0x418699
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
mov dword [esp + 0x14], 1
jmp 0x4186a7
push 0
push edi
mov ecx, esi
call fcn.00452340
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x118]
call fcn.00401f00
lea ecx, [esp + 0x134]
mov byte [esp + 0x918], 1
call fcn.00401f00
jmp case.0x4165d1.62
xor edi, edi
mov dword [esp + 0x130], ebx
mov dword [esp + 0x12c], edi
mov word [esp + 0x11c], di
lea ecx, [esi + 0x11c]
mov byte [esp + 0x918], 0x11
call fcn.0041ed60
mov ebx, 8
cmp dword [eax + 0x18], ebx
jb 0x418706
mov eax, dword [eax + 4]
jmp 0x418709
add eax, 4
lea ecx, [esp + 0x118]
push ecx
push eax
call fcn.004425b0
mov eax, dword [esp + 0x124]
add esp, 8
cmp dword [esp + 0x130], ebx
jae 0x418731
lea eax, [esp + 0x11c]
push edi
push edi
push edi
push 2
push eax
lea ecx, [esp + 0x1b8]
call fcn.00411df0
lea edx, [esp + 0x1a4]
push edx
mov byte [esp + 0x91c], 0x12
call fcn.00408160
add esp, 4
test eax, eax
je 0x418773
push edi
call dword [sym.imp.USER32.dll_MessageBeep]
mov dword [esp + 0x14], 0xffffffff
jmp 0x4188a9
lea eax, [esp + 0x1d0]
push 0xb
push eax
call fcn.0043c2a0
add esp, 8
lea ecx, [esp + 0x1d0]
xor edi, edi
call fcn.00401310
test eax, eax
jle 0x4187ec
lea ecx, [esi + 0x11c]
call fcn.0041ed60
cmp dword [eax + 0x18], 8
jb 0x4187ad
mov ebx, dword [eax + 4]
jmp 0x4187b0
lea ebx, [eax + 4]
push edi
lea ecx, [esp + 0x1d4]
call fcn.00401330
cmp dword [eax + 0x18], 8
jb 0x4187c8
mov eax, dword [eax + 4]
jmp 0x4187cb
add eax, 4
push ebx
push eax
call fcn.0047863a
add esp, 8
test eax, eax
je 0x4187ec
lea ecx, [esp + 0x1d0]
add edi, 1
call fcn.00401310
cmp edi, eax
jl 0x418797
cmp ebp, 0x6b
jne 0x418806
lea ecx, [esp + 0x1d0]
call fcn.00401310
mov ebp, eax
mov ebx, 1
jmp 0x41880c
or ebp, 0xffffffff
or ebx, 0xffffffff
add edi, ebx
cmp edi, ebp
je 0x41886a
push edi
lea ecx, [esp + 0x1d4]
call fcn.00401330
test byte [eax + 0x1c], 0x10
jne 0x418866
push edi
lea ecx, [esp + 0x1d4]
call fcn.00401330
cmp dword [eax + 0x18], 8
jb 0x41883d
mov eax, dword [eax + 4]
jmp 0x418840
add eax, 4
push eax
call fcn.004010b0
add esp, 4
cmp eax, 3
je 0x418866
add edi, ebx
cmp edi, ebp
jne 0x418812
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
mov dword [esp + 0x14], 1
jmp 0x4188a9
cmp edi, ebp
jne 0x41887c
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
mov dword [esp + 0x14], 1
jmp 0x4188a9
push edi
lea ecx, [esp + 0x1d4]
call fcn.00401330
cmp dword [eax + 0x18], 8
jb 0x418894
mov eax, dword [eax + 4]
jmp 0x418897
add eax, 4
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.00459010
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x1a4]
call fcn.00411ee0
lea ecx, [esp + 0x118]
mov byte [esp + 0x918], 1
call fcn.00401f00
jmp case.0x4165d1.62
push 1
mov ecx, esi
call fcn.004476a0
jmp case.0x4165d1.62
push 2
mov ecx, esi
call fcn.004476a0
jmp case.0x4165d1.62
push 0
mov ecx, esi
call fcn.004476a0
jmp case.0x4165d1.62
cmp dword [esi + 0x394], 0
mov ecx, esi
jne 0x41890f
push 1
call fcn.004476a0
jmp case.0x4165d1.62
push 0
call fcn.004476a0
jmp case.0x4165d1.62
cmp dword [esi + 0x394], 0
mov ecx, esi
jne 0x41890f
push 2
call fcn.004476a0
jmp case.0x4165d1.62
mov ecx, dword [0x4a06a4]
mov edx, dword [0x4a1388]
push 0
push 0x40ab80
push ecx
push 0x1f6
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x4165d1.62
add ebp, 0xffffff8d
mov dword [0x4a0564], ebp
jmp case.0x4165d1.62
mov eax, dword [0x4a0564]
add eax, 1
cmp eax, 3
mov dword [0x4a0564], eax
jne case.0x4165d1.62
mov dword [0x4a0564], 0
jmp case.0x4165d1.62
xor ebx, ebx
xor edi, edi
cmp ebp, 0x79
jne 0x418998
or ebx, 0xffffffff
jmp 0x4189b8
cmp ebp, 0x7a
jne 0x4189a2
or edi, 0xffffffff
jmp 0x4189b8
cmp ebp, 0x7b
jne 0x4189ae
mov ebx, 1
jmp 0x4189b8
cmp ebp, 0x7c
jne 0x4189b8
mov edi, 1
push 1
lea eax, [esp + 0x138]
push eax
mov ecx, esi
call fcn.00475c60
mov ecx, dword [esp + 0x140]
sub ecx, dword [esp + 0x138]
mov eax, 0x51eb851f
imul ecx, dword [0x4a061c]
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, edi
push ecx
mov ecx, dword [esp + 0x140]
sub ecx, dword [esp + 0x138]
mov eax, 0x51eb851f
imul ecx, dword [0x4a0620]
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, ebx
push eax
mov ecx, esi
call fcn.004568f0
jmp case.0x4165d1.62
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.00449030
push 1
lea eax, [esp + 0x138]
push eax
mov ecx, esi
call fcn.00475c60
mov ebp, dword [esp + 0x13c]
sub ebp, dword [esp + 0x134]
mov ecx, dword [esi + 0x16c]
mov edi, dword [esp + 0x140]
sub edi, dword [esp + 0x138]
mov dword [esp + 0x20], ecx
mov ecx, ebp
imul ecx, dword [0x4a0620]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, edi
imul edx, dword [0x4a061c]
mov ebx, dword [esi + 0x168]
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esi + 0x18c]
cmp edx, 1
jne 0x418aba
xor ebx, ebx
jmp 0x418adc
cmp edx, 2
jne 0x418acd
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], edi
jmp 0x418ae0
cmp edx, 3
jne 0x418ae0
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], ebp
cmp dword [0x4a0610], 0
je 0x418b0b
mov edx, dword [esi + 0x1b8]
sub edx, dword [esi + 0x1c0]
add ebx, edx
mov edx, dword [esi + 0x1bc]
sub edx, dword [esi + 0x1c4]
mov dword [esp + 0x2c], ebx
add dword [esp + 0x20], edx
mov edx, dword [esp + 0x920]
cmp edx, 0x7d
je 0x418e2c
cmp edx, 0x7f
je 0x418e2c
cmp dword [0x4a0614], 0
jne 0x418cb3
cmp dword [esp + 0x20], 0
jg 0x418ca2
mov eax, dword [esi + 0x188]
test eax, eax
jne 0x418bee
test ebx, ebx
jg 0x418bd8
cmp edx, 0x80
jne case.0x4165d1.62
mov eax, dword [esi + 0x18c]
cmp eax, 1
mov ecx, 0x7fffffff
mov edx, ecx
je 0x418b88
cmp eax, 2
jne 0x418b7d
mov edx, dword [esi + 0x16c]
jmp 0x418b8e
cmp eax, 3
jne 0x418b8e
mov edx, dword [esi + 0x16c]
mov ecx, dword [esi + 0x168]
cmp eax, 0xa
mov dword [esi + 0x190], ecx
mov dword [esi + 0x194], edx
je 0x418baf
mov dword [esi + 0x198], eax
mov dword [esi + 0x18c], 0xa
push 0
push 0x5c
call fcn.004164f0
add esp, 8
test eax, eax
mov dword [esp + 0x14], eax
je case.0x4165d1.62
mov eax, dword [esi + 0x198]
mov dword [esi + 0x18c], eax
jmp case.0x4165d1.62
mov eax, dword [esp + 0x1c]
sub eax, edi
neg ecx
push eax
push ecx
mov ecx, esi
call fcn.004568f0
jmp case.0x4165d1.62
cmp eax, 1
jne case.0x4165d1.62
add ebx, ebp
cmp ebx, dword [esp + 0x24]
jl 0x418c8e
cmp dword [esp + 0x920], 0x80
jne case.0x4165d1.62
mov eax, dword [esi + 0x18c]
xor ecx, ecx
cmp eax, 1
mov edx, 0x7fffffff
je 0x418c3e
cmp eax, 2
jne 0x418c33
mov edx, dword [esi + 0x16c]
jmp 0x418c44
cmp eax, 3
jne 0x418c44
mov edx, dword [esi + 0x16c]
mov ecx, dword [esi + 0x168]
cmp eax, 0xa
mov dword [esi + 0x190], ecx
mov dword [esi + 0x194], edx
je 0x418c65
mov dword [esi + 0x198], eax
mov dword [esi + 0x18c], 0xa
push 0
push 0x5c
call fcn.004164f0
add esp, 8
test eax, eax
mov dword [esp + 0x14], eax
je case.0x4165d1.62
mov ecx, dword [esi + 0x198]
mov dword [esi + 0x18c], ecx
jmp case.0x4165d1.62
mov eax, dword [esp + 0x1c]
sub eax, edi
push eax
push ecx
mov ecx, esi
call fcn.004568f0
jmp case.0x4165d1.62
neg eax
push eax
push 0
mov ecx, esi
call fcn.004568f0
jmp case.0x4165d1.62
mov edi, dword [esi + 0x188]
test edi, edi
jne 0x418d6f
test ebx, ebx
jg 0x418f07
cmp dword [esp + 0x20], edi
jg 0x418d59
cmp edx, 0x80
jne case.0x4165d1.62
mov eax, dword [esi + 0x18c]
cmp eax, 1
mov ecx, 0x7fffffff
mov edx, ecx
je 0x418d09
cmp eax, 2
jne 0x418cfe
mov edx, dword [esi + 0x16c]
jmp 0x418d0f
cmp eax, 3
jne 0x418d0f
mov edx, dword [esi + 0x16c]
mov ecx, dword [esi + 0x168]
cmp eax, 0xa
mov dword [esi + 0x190], ecx
mov dword [esi + 0x194], edx
je 0x418d30
mov dword [esi + 0x198], eax
mov dword [esi + 0x18c], 0xa
push 0
push 0x5c
call fcn.004164f0
add esp, 8
test eax, eax
mov dword [esp + 0x14], eax
je case.0x4165d1.62
mov edx, dword [esi + 0x198]
mov dword [esi + 0x18c], edx
jmp case.0x4165d1.62
neg eax
push eax
mov eax, dword [esp + 0x28]
sub eax, ebp
push eax
mov ecx, esi
call fcn.004568f0
jmp case.0x4165d1.62
cmp edi, 1
jne case.0x4165d1.62
lea edx, [ebx + ebp]
cmp edx, dword [esp + 0x24]
jl 0x418ed6
cmp dword [esp + 0x20], 0
jg 0x418e1a
cmp dword [esp + 0x920], 0x80
jne case.0x4165d1.62
mov eax, dword [esi + 0x18c]
xor ecx, ecx
cmp eax, edi
mov edx, 0x7fffffff
je 0x418dca
cmp eax, 2
jne 0x418dbf
mov edx, dword [esi + 0x16c]
jmp 0x418dd0
cmp eax, 3
jne 0x418dd0
mov edx, dword [esi + 0x16c]
mov ecx, dword [esi + 0x168]
cmp eax, 0xa
mov dword [esi + 0x190], ecx
mov dword [esi + 0x194], edx
je 0x418df1
mov dword [esi + 0x198], eax
mov dword [esi + 0x18c], 0xa
push 0
push 0x5c
call fcn.004164f0
add esp, 8
test eax, eax
mov dword [esp + 0x14], eax
je case.0x4165d1.62
mov eax, dword [esi + 0x198]
mov dword [esi + 0x18c], eax
jmp case.0x4165d1.62
neg eax
push eax
neg ebx
push ebx
mov ecx, esi
call fcn.004568f0
jmp case.0x4165d1.62
cmp dword [0x4a0614], 0
jne 0x418eb1
mov edx, dword [esp + 0x20]
add edx, edi
cmp edx, dword [esp + 0x1c]
jl 0x418ca4
mov eax, dword [esi + 0x188]
test eax, eax
jne 0x418e6b
add ebx, ebp
cmp ebx, dword [esp + 0x24]
jge 0x418e78
mov eax, dword [esp + 0x20]
neg eax
push eax
push ecx
mov ecx, esi
call fcn.004568f0
jmp case.0x4165d1.62
cmp eax, 1
jne case.0x4165d1.62
test ebx, ebx
jg 0x418e9b
cmp dword [esp + 0x920], 0x7f
jne case.0x4165d1.62
push 0
push 0x5b
call fcn.004164f0
add esp, 8
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
mov eax, dword [esp + 0x20]
neg eax
neg ecx
push eax
push ecx
mov ecx, esi
call fcn.004568f0
jmp case.0x4165d1.62
mov edx, dword [esi + 0x188]
test edx, edx
jne 0x418ee5
lea edx, [ebx + ebp]
cmp edx, dword [esp + 0x24]
jl 0x418ed6
mov ecx, dword [esp + 0x20]
add ecx, edi
cmp ecx, dword [esp + 0x1c]
jl 0x418e1c
jmp 0x418e78
push 0
push ecx
mov ecx, esi
call fcn.004568f0
jmp case.0x4165d1.62
cmp edx, 1
jne case.0x4165d1.62
test ebx, ebx
jg 0x418f07
mov edx, dword [esp + 0x20]
add edx, edi
cmp edx, dword [esp + 0x1c]
jl 0x418d5b
jmp 0x418e78
neg ecx
push 0
push ecx
mov ecx, esi
call fcn.004568f0
jmp case.0x4165d1.62
cmp dword [0x4a05f0], 0
je 0x4190a0
cmp dword [esi + 0x19c], 0
je 0x4190a0
lea eax, [esp + 0x1a4]
push eax
lea ecx, [esp + 0x170]
push ecx
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esi + 0x188]
lea eax, [esp + 0x140]
push eax
mov eax, dword [esi + 0x184]
lea ecx, [esi + 0x2e4]
push ecx
push 0
push edx
push eax
lea ecx, [esi + 0x150]
push ecx
mov ecx, esi
call fcn.00447a50
lea ebp, [esp + 0x1a4]
lea edi, [esi + 0x148]
xor ebx, ebx
mov eax, dword [edi]
test eax, eax
je 0x419080
mov ecx, dword [eax + 0x454]
cmp ecx, dword [esp + ebx + 0x134]
jne 0x418fac
mov eax, dword [eax + 0x458]
cmp eax, dword [esp + ebx + 0x24]
je 0x419080
mov ecx, dword [edi]
test ecx, ecx
je 0x418fc0
add dword [ecx + 4], 0xffffffff
jne 0x418fc0
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
lea ecx, [esp + 0x150]
push ecx
push 0x1c1
mov dword [edi], 0
call fcn.00442450
mov eax, dword [esp + 0x15c]
add esp, 8
cmp dword [esp + 0x168], 8
jae 0x418ff3
lea eax, [esp + 0x154]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.004029c0
mov ecx, esi
call fcn.004764f0
mov dword [esp + 0x1c], 0
push ebp
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x44]
push eax
mov eax, dword [esi + 0x1b0]
lea ecx, [esp + 0x44]
push ecx
mov ecx, dword [edi + 8]
lea edx, [esp + 0x2c]
push edx
push edi
push esi
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push ecx
lea ecx, [esi + 0x12c]
mov byte [esp + 0x954], 0x13
call fcn.00401330
sub esp, 0x58
mov ecx, esp
mov dword [esp + 0xc0], esp
push eax
call fcn.00402790
call fcn.00437300
add esp, 0x90
lea ecx, [esp + 0x1c]
mov byte [esp + 0x918], 1
call fcn.00401000
add ebx, 4
add edi, 4
add ebp, 0x8c
cmp ebx, 8
jl 0x418f83
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x920]
push 1
lea edx, [esp + 0x11c]
push edx
mov ecx, esi
call fcn.00475c60
fld qword [esi + 0x158]
cmp ebp, 0x81
jne 0x4190c7
fmul qword [0x4a0600]
jmp 0x4190cd
fdiv qword [0x4a0600]
test edi, edi
je 0x4190ea
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
sub esp, 8
mov ecx, esi
fstp qword [esp]
call fcn.0044d420
jmp case.0x4165d1.62
mov eax, dword [esp + 0x120]
sub eax, dword [esp + 0x118]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x124]
sub eax, dword [esp + 0x11c]
sar ecx, 1
cdq
sub eax, edx
sar eax, 1
push eax
push ecx
sub esp, 8
mov ecx, esi
fstp qword [esp]
call fcn.0044d420
jmp case.0x4165d1.62
mov ecx, esi
call fcn.00459e20
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
mov ecx, esi
call fcn.00459ee0
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
lea edi, [esi + 0x11c]
mov ecx, edi
call fcn.0041ed60
push 0xffffffffffffffff
xor ebp, ebp
push ebp
push eax
lea ecx, [esi + 0x234]
call fcn.00402360
mov dword [esp + 0x130], ebx
mov dword [esp + 0x12c], ebp
mov word [esp + 0x11c], bp
mov ecx, edi
mov byte [esp + 0x918], 0x14
call fcn.0041ed60
cmp dword [eax + 0x18], 8
jb 0x419194
mov eax, dword [eax + 4]
jmp 0x419197
add eax, 4
push eax
call fcn.00442070
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4191bd
mov ecx, edi
call fcn.0041ed60
cmp dword [eax + 0x18], 8
jb 0x4191b8
mov eax, dword [eax + 4]
jmp 0x419226
add eax, 4
jmp 0x419226
cmp ebx, 1
je 0x4191e8
mov ecx, edi
call fcn.0041ed60
mov ebp, 8
cmp dword [eax + 0x18], ebp
jb 0x4191d8
mov eax, dword [eax + 4]
jmp 0x4191db
add eax, 4
cmp word [eax + ebx*2 - 2], 0x2f
je 0x4191ed
sub ebx, 1
jmp 0x4191ed
mov ebp, 8
mov ecx, edi
call fcn.0041ed60
cmp dword [eax + 0x18], ebp
jb 0x4191fe
mov eax, dword [eax + 4]
jmp 0x419201
add eax, 4
push ebx
push eax
lea ecx, [esp + 0x120]
call fcn.00402680
cmp dword [esp + 0x130], ebp
mov eax, dword [esp + 0x11c]
jae 0x419226
lea eax, [esp + 0x11c]
push 0
push 0xffffffffffffffff
push 2
push eax
mov ecx, esi
call fcn.00459010
lea ecx, [esp + 0x118]
mov dword [esp + 0x14], eax
mov byte [esp + 0x918], 1
call fcn.00401f00
jmp case.0x4165d1.62
cmp dword [esi + 0x118], 2
jne 0x4192a7
lea ebx, [esi + 0x1fc]
mov ecx, ebx
xor edi, edi
call fcn.0040ad30
test eax, eax
jle 0x4192a7
lea ecx, [ecx]
push edi
mov ecx, ebx
call fcn.0040ad50
test byte [eax + 0xb4], 2
mov ecx, ebx
jne 0x419291
add edi, 1
call fcn.0040ad30
cmp edi, eax
jl 0x419270
jmp 0x4192a7
push edi
call fcn.0040ad50
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esi + 0x234]
call fcn.00402360
lea ecx, [esi + 0x11c]
call fcn.0041ed60
cmp dword [eax + 0x18], 8
jb 0x4192c9
mov ecx, dword [esi + 0x150]
mov eax, dword [eax + 4]
push 0
push ecx
jmp 0x419b4c
mov ecx, dword [esi + 0x150]
push 0
add eax, 4
push ecx
jmp 0x419b4c
mov ecx, esi
call fcn.004589c0
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
cmp dword [esi + 0x118], 0
mov ecx, esi
jne 0x419303
call fcn.00457d20
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
call fcn.00458130
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
push 0
mov ecx, 0x4a1314
call fcn.00405370
add esi, 0x1fc
mov ecx, esi
xor edi, edi
call fcn.0040ad30
test eax, eax
jle 0x419362
push edi
mov ecx, esi
call fcn.0040ad50
test byte [eax + 0xb4], 1
je 0x419354
push edi
mov ecx, esi
call fcn.0040ad50
push eax
mov ecx, 0x4a1314
call fcn.004053a0
mov ecx, esi
add edi, 1
call fcn.0040ad30
cmp edi, eax
jl 0x419330
add ebp, 0xffffff74
mov dword [0x4a0678], ebp
jmp case.0x4165d1.62
lea ecx, [esi + 0x11c]
call fcn.0041ed60
cmp dword [eax + 0x18], 8
jb 0x419389
mov eax, dword [eax + 4]
jmp 0x41938c
add eax, 4
push 0x4a1314
push eax
mov eax, dword [0x4a0678]
push eax
call fcn.00406a10
add esp, 0xc
mov esi, eax
push 0
mov ecx, 0x4a1314
mov dword [esp + 0x18], esi
call fcn.00405370
test esi, esi
jne case.0x4165d1.62
push esi
push 0x88
call fcn.004164f0
add esp, 8
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
add ebp, 0xffffff71
push ebp
mov ecx, esi
call fcn.0045a740
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
mov ecx, 0x4a0e60
call fcn.0040a150
test eax, eax
mov ecx, 0x4a0e60
je 0x419409
push 0
push 0
call fcn.004224e0
jmp case.0x4165d1.62
push 1
push 1
call fcn.004224e0
mov ecx, 0x4a0e60
call fcn.00432fd0
test esi, esi
je case.0x4165d1.62
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push 1
mov ecx, esi
call eax
jmp case.0x4165d1.62
mov ecx, 0x4a0a68
call fcn.0040a150
mov ecx, 0x4a0a68
test eax, eax
je 0x419455
push 0
push 0
call fcn.004224e0
jmp case.0x4165d1.62
push 1
push 1
call fcn.004224e0
jmp case.0x4165d1.62
mov ecx, 0x4a0b40
call fcn.0040a150
mov ecx, 0x4a0b40
jmp 0x419443
mov ecx, 0x4a0be4
call fcn.0040a150
mov ecx, 0x4a0be4
jmp 0x419443
mov ecx, 0x4a0c88
call fcn.0040a150
mov ecx, 0x4a0c88
jmp 0x419443
mov ecx, 0x4a0d2c
call fcn.0040a150
mov ecx, 0x4a0d2c
jmp 0x419443
mov ecx, 0x4a0dd0
call fcn.0040a150
test eax, eax
mov ecx, 0x4a0dd0
jne 0x419447
push 1
push 1
call fcn.004224e0
push 0
push 0x85
call fcn.004164f0
add esp, 8
push 1
mov ecx, 0x4a0dd0
call fcn.00420750
jmp case.0x4165d1.62
mov ecx, 0x4a0f08
call fcn.0040a150
test eax, eax
mov ecx, 0x4a0f08
jne 0x419447
push 1
push 1
call fcn.004224e0
mov ecx, 0x4a0f08
call fcn.00423280
jmp case.0x4165d1.62
xor edi, edi
mov bl, 1
xor esi, esi
jmp 0x419520
mov ecx, dword [0x4a0a5c]
test ecx, ecx
jne 0x41952e
xor eax, eax
jmp 0x419538
mov eax, dword [0x4a0a60]
sub eax, ecx
sar eax, 2
cmp esi, eax
jge 0x41957e
push esi
mov ecx, 0x4a0a58
call fcn.004342d0
mov eax, dword [eax]
cmp dword [eax + 0x28], 1
jne 0x419579
test bl, bl
je 0x419562
push esi
mov ecx, 0x4a0a58
call fcn.004342d0
mov edi, dword [eax]
xor bl, bl
push esi
mov ecx, 0x4a0a58
call fcn.004342d0
mov ecx, dword [0x4a0698]
cmp ecx, dword [eax]
jne 0x419579
mov bl, 1
add esi, 1
jmp 0x419520
cmp dword [edi + 0x2c], 0
jne 0x419597
cmp dword [edi + 0x30], 4
jne 0x419597
push edi
mov ecx, edi
call fcn.004203b0
jmp case.0x4165d1.62
mov edx, dword [edi]
mov eax, dword [edx + 0x28]
push 1
mov ecx, edi
call eax
jmp case.0x4165d1.62
push esi
call fcn.0043bb00
add esp, 4
jmp case.0x4165d1.62
cmp dword [0x4a05f4], 0
je 0x4195cd
mov dword [0x4a05f4], 0
jmp case.0x4165d1.62
test esi, esi
mov dword [0x4a05f4], 1
je case.0x4165d1.62
mov ecx, esi
call fcn.00452fe0
jmp case.0x4165d1.62
cmp dword [0x4a05f0], 0
je 0x419673
test esi, esi
mov dword [0x4a05f0], 0
je case.0x4165d1.62
cmp dword [esi + 0x118], 0
jne 0x419660
cmp dword [esi + 0x19c], 0
je case.0x4165d1.62
mov ecx, dword [esi + 0x148]
test ecx, ecx
je 0x419634
add dword [ecx + 4], 0xffffffff
jne 0x419634
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0x148], 0
mov ecx, dword [esi + 0x14c]
test ecx, ecx
je 0x419656
add dword [ecx + 4], 0xffffffff
jne 0x419656
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0x14c], 0
call fcn.0043d490
push 0
mov ecx, esi
call fcn.00456310
jmp case.0x4165d1.62
test esi, esi
mov dword [0x4a05f0], 1
je case.0x4165d1.62
push 0
mov ecx, esi
call fcn.00456310
jmp case.0x4165d1.62
xor ecx, ecx
cmp dword [0x4a0634], ecx
sete cl
mov dword [0x4a0634], ecx
jmp case.0x4165d1.62
mov edx, dword [0x4a06a4]
push edx
call fcn.00415800
add esp, 4
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
mov eax, dword [0x4a06a4]
push eax
call fcn.004161d0
add esp, 4
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
test edi, edi
je 0x4196f1
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp + 0x134], ecx
mov dword [esp + 0x138], edx
jmp 0x4196ff
lea eax, [esp + 0x134]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, eax
push esi
call fcn.00435e00
mov ecx, dword [0x4a06a4]
mov edx, dword [esp + 0x13c]
mov eax, dword [esp + 0x138]
add esp, 4
push 0
push ecx
push 0
push edx
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push esi
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp case.0x4165d1.62
mov ecx, dword [0x4a06a4]
mov edx, dword [0x4a1388]
push 0
push 0x410cc0
push ecx
push 0x1e0
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x4165d1.62
mov eax, dword [0x4a06a4]
mov ecx, dword [0x4a1388]
push 0
push 0x40b8b0
push eax
push 0x1e1
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x4165d1.62
xor ecx, ecx
cmp esi, ecx
je 0x4197c7
add dword [esi + 0x30c], 1
cmp dword [esi + 0x30c], 3
jle 0x4197a5
mov dword [esi + 0x30c], ecx
mov ecx, esi
call fcn.004564c0
mov edx, dword [esi + 0x30c]
mov ecx, 0x4a0f98
mov dword [0x4a0128], edx
call fcn.00426500
jmp case.0x4165d1.62
mov eax, dword [0x4a0128]
add eax, 1
cmp eax, 3
mov dword [0x4a0128], eax
jle 0x4197df
mov dword [0x4a0128], ecx
mov ecx, 0x4a0f98
call fcn.00426500
jmp case.0x4165d1.62
test esi, esi
je 0x419833
lea eax, [ebp - 0xba]
cmp dword [esi + 0x30c], eax
jne 0x419805
mov ebp, 0xba
add ebp, 0xffffff46
mov ecx, esi
mov dword [esi + 0x30c], ebp
call fcn.004564c0
mov ecx, dword [esi + 0x30c]
mov dword [0x4a0128], ecx
mov ecx, 0x4a0f98
call fcn.00426500
jmp case.0x4165d1.62
lea edx, [ebp - 0xba]
cmp dword [0x4a0128], edx
jne 0x419846
mov ebp, 0xba
add ebp, 0xffffff46
mov ecx, 0x4a0f98
mov dword [0x4a0128], ebp
call fcn.00426500
jmp case.0x4165d1.62
mov ecx, 0x4a0f98
call fcn.0040a150
test eax, eax
mov ecx, 0x4a0f98
jne 0x419447
push 1
push 1
call fcn.004224e0
mov ecx, 0x4a0f98
call fcn.00426500
jmp case.0x4165d1.62
test esi, esi
je 0x4198c7
xor eax, eax
cmp dword [esi + 0x2e4], eax
mov ecx, esi
sete al
mov dword [esi + 0x2e4], eax
call fcn.004564c0
mov ecx, dword [esi + 0x2e4]
mov dword [0x4a0100], ecx
mov ecx, 0x4a1038
call fcn.00425940
jmp case.0x4165d1.62
xor edx, edx
cmp dword [0x4a0100], edx
mov ecx, 0x4a1038
sete dl
mov dword [0x4a0100], edx
call fcn.00425940
jmp case.0x4165d1.62
mov ecx, 0x4a1038
call fcn.0040a150
test eax, eax
mov ecx, 0x4a1038
jne 0x419447
push 1
push 1
call fcn.004224e0
mov ecx, 0x4a1038
call fcn.00425940
jmp case.0x4165d1.62
test esi, esi
je 0x41994d
xor eax, eax
cmp dword [esi + 0x31c], eax
mov ecx, esi
sete al
mov dword [esi + 0x31c], eax
call fcn.004564c0
mov ecx, dword [esi + 0x31c]
mov dword [0x4a0138], ecx
mov ecx, 0x4a10d0
call fcn.00423cf0
jmp case.0x4165d1.62
xor edx, edx
cmp dword [0x4a0138], edx
mov ecx, 0x4a10d0
sete dl
mov dword [0x4a0138], edx
call fcn.00423cf0
jmp case.0x4165d1.62
mov ecx, 0x4a10d0
call fcn.0040a150
test eax, eax
mov ecx, 0x4a10d0
jne 0x419447
push 1
push 1
call fcn.004224e0
mov ecx, 0x4a10d0
call fcn.00423cf0
jmp case.0x4165d1.62
test esi, esi
je 0x4199d3
xor eax, eax
cmp dword [esi + 0x348], eax
mov ecx, esi
sete al
mov dword [esi + 0x348], eax
call fcn.004564c0
mov ecx, dword [esi + 0x348]
mov dword [0x4a0164], ecx
mov ecx, 0x4a1168
call fcn.00426900
jmp case.0x4165d1.62
xor edx, edx
cmp dword [0x4a0164], edx
mov ecx, 0x4a1168
sete dl
mov dword [0x4a0164], edx
call fcn.00426900
jmp case.0x4165d1.62
mov ecx, 0x4a1168
call fcn.0040a150
test eax, eax
mov ecx, 0x4a1168
jne 0x419447
push 1
push 1
call fcn.004224e0
mov ecx, 0x4a1168
call fcn.00426900
jmp case.0x4165d1.62
test esi, esi
je 0x419a59
xor eax, eax
cmp dword [esi + 0x358], eax
mov ecx, esi
sete al
mov dword [esi + 0x358], eax
call fcn.004564c0
mov ecx, dword [esi + 0x358]
mov dword [0x4a0174], ecx
mov ecx, 0x4a1200
call fcn.00426170
jmp case.0x4165d1.62
xor edx, edx
cmp dword [0x4a0174], edx
mov ecx, 0x4a1200
sete dl
mov dword [0x4a0174], edx
call fcn.00426170
jmp case.0x4165d1.62
mov ecx, 0x4a1200
call fcn.0040a150
test eax, eax
mov ecx, 0x4a1200
jne 0x419447
push 1
push 1
call fcn.004224e0
mov ecx, 0x4a1200
call fcn.00426170
jmp case.0x4165d1.62
lea eax, [ebp - 0xc9]
cmp eax, 0x10
ja 0x419b64
add ebp, 0xffffff38
test esi, esi
mov dword [0x4a05e0], ebp
je 0x419c43
cmp dword [esi + 0x118], 2
mov dword [esi + 0x13c], ebp
je 0x419b2f
mov ecx, ebp
push ecx
lea edi, [esi + 0x12c]
push edi
call fcn.0043c2a0
add esp, 8
xor ebx, ebx
mov edi, edi
mov eax, dword [edi + 4]
test eax, eax
je 0x419b0d
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jge 0x419b21
push ebx
mov ecx, edi
call fcn.00401330
mov dword [eax + 0x48], ebx
add ebx, 1
jmp 0x419af0
push 1
mov ecx, esi
call fcn.00456310
jmp case.0x4165d1.62
lea ecx, [esi + 0x11c]
call fcn.0041ed60
cmp dword [eax + 0x18], 8
jb 0x419b45
mov eax, dword [eax + 4]
jmp 0x419b48
add eax, 4
push 0
push 0xffffffffffffffff
mov edx, dword [esi + 0x118]
push edx
push eax
mov ecx, esi
call fcn.00459010
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
lea esi, [ebp - 0x1f5]
cmp esi, 0x63
ja 0x419be5
cmp dword [0x4a0654], 0
je 0x419b82
push 0
call fcn.0043bb00
add esp, 4
push 1
call fcn.0043c0b0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x419c43
push esi
mov ecx, 0x4a1344
call fcn.0040ae60
cmp dword [eax + 0x18], 8
jb 0x419bac
mov edi, dword [eax + 4]
jmp 0x419baf
lea edi, [eax + 4]
push esi
mov ecx, 0x4a1344
call fcn.0040ae60
add eax, 0x20
push eax
push esi
mov ecx, 0x4a1344
call fcn.0040ae60
mov eax, dword [eax + 0x1c]
mov ecx, dword [0x4a05e4]
sub eax, 1
push eax
push ecx
push edi
mov ecx, ebx
call fcn.00459010
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
cmp ebp, 0x3e9
jl 0x419c43
cmp dword [0x4a0654], 0
je 0x419c00
push 0
call fcn.0043bb00
add esp, 4
push 1
call fcn.0043c0b0
mov esi, eax
add esp, 4
test esi, esi
je 0x419c43
add ebp, 0xfffffc17
push ebp
mov ecx, 0x4a1354
call fcn.004013a0
cmp dword [eax + 0x18], 8
jb 0x419c2c
mov eax, dword [eax + 4]
jmp 0x419c2f
add eax, 4
push 0
push 0xffffffffffffffff
push 2
push eax
mov ecx, esi
call fcn.00459010
mov dword [esp + 0x14], eax
jmp case.0x4165d1.62
mov dword [esp + 0x14], 0xffffffff
push 0xffffffffffffffff
call fcn.0040acd0
mov esi, 8
add esp, 4
cmp dword [esp + 0x114], esi
jb 0x419c73
mov edx, dword [esp + 0x100]
push edx
call fcn.004775de
add esp, 4
xor eax, eax
cmp dword [esp + 0x168], esi
mov dword [esp + 0x114], 7
mov dword [esp + 0x110], eax
mov word [esp + 0x100], ax
jb 0x419ca8
mov eax, dword [esp + 0x154]
push eax
call fcn.004775de
add esp, 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x910]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x8f8]
xor ecx, esp
call fcn.004777ea
add esp, 0x908
ret