Function at 0x415c60
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4501a8
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x60
mov eax, dword [0x48100c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], edx
mov edi, ecx
mov dword [ebp - 0x28], edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov esi, dword [ebx + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [edi + 0x1c0]
mov dword [ebp - 0x6c], esi
mov dword [eax + 0x30], edi
cmp ecx, 0x110
ja 0x416b4a
je case.0x416b74.289
lea eax, [ecx - 3]
cmp eax, 0xa0
ja case.0x416b74.275
movzx eax, byte [eax + 0x417414]
jmp dword [eax*4 + 0x4173cc]
cmp edx, dword [edi + 0x22c]
jne case.0x416b74.275
cmp byte [edi + 0x242], 0
je case.0x416b74.275
jmp 0x4173a8
cmp edx, dword [edi + 0x22c]
jne case.0x416b74.275
cmp byte [edi + 0x242], 0
je case.0x416b74.275
mov eax, 1
jmp 0x4173aa
cmp byte [edi + 0x242], 0
je case.0x416b74.275
cmp edx, dword [edi + 0x22c]
jne case.0x416b74.275
cmp dword [ebp - 0x18], 0
je 0x4173a8
mov edi, dword [esi + 8]
mov eax, edi
mov edx, dword [esi]
sub eax, edx
mov esi, dword [esi + 0xc]
dec edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + 4]
mov eax, esi
sub eax, ecx
dec ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x6c]
movups xmm0, xmmword [eax]
movups xmmword [eax + 0x10], xmm0
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax + 0x242]
add eax, edx
mov edx, dword [ebp - 0x6c]
mov dword [edx], eax
mov edx, dword [ebp - 0x28]
movzx eax, byte [edx + 0x242]
add eax, ecx
mov ecx, dword [ebp - 0x6c]
mov dword [ecx + 4], eax
movzx eax, byte [edx + 0x242]
sub edi, eax
inc edi
mov dword [ecx + 8], edi
movzx eax, byte [edx + 0x242]
sub esi, eax
mov eax, dword [ecx + 0x30]
inc esi
mov dword [ecx + 0xc], esi
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0x10], ecx
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
mov dword [eax + 0x14], ecx
mov eax, 0x700
jmp 0x4173aa
cmp edx, dword [edi + 0x22c]
jne case.0x416b74.275
cmp word [ebp - 0x18], 0
je 0x415e65
mov esi, 1
cmp dword [edi + 0x40], esi
jle 0x415e52
push esi
mov ecx, edi
call fcn.00419ea0
test al, al
je 0x415e46
mov edx, dword [edi + 0x250]
mov eax, dword [edi + 0x3c]
lea ecx, [edx + edx*8]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x415e27
push 1
push 0
push edx
mov ecx, edi
call fcn.0041a040
jmp 0x415e46
cmp eax, 0x23
jne 0x415e46
mov eax, dword [ecx + 0x44]
test eax, eax
je 0x415e46
mov edx, dword [eax + 0x14]
cmp dword [ecx + 0x1c], edx
je 0x415e46
push edx
push dword [eax + 4]
mov ecx, edi
call fcn.00418c50
inc esi
cmp esi, dword [edi + 0x40]
jl 0x415df7
mov edx, dword [ebp - 0x68]
mov ecx, dword [ebx + 8]
mov eax, dword [edi + 0x1c0]
push 0
push 0
push edx
push ecx
mov dword [eax + 0x34], edx
push 0xffffffffffffffee
jmp 0x415e7a
mov eax, dword [edi + 0x1c0]
push 0
push 0
push edx
push ecx
mov dword [eax + 0x34], 0
push 0xffffffffffffffed
mov ecx, edi
call fcn.0041ad80
mov dword [edi + 0x250], 0
jmp case.0x416b74.275
push 0
push dword [ebp - 0x18]
push edx
push ecx
push 0xffffffffffffffef
jmp 0x41739b
push 0
push dword [ebp - 0x18]
push edx
push ecx
push 0xffffffffffffffe5
jmp 0x41739b
push 0
push 0
push edx
push ecx
push 0xfffffffffffffffb
mov ecx, edi
call fcn.0041ad80
jmp 0x4173a8
push dword [ebp - 0x18]
mov ecx, edi
call fcn.00414e60
mov esi, eax
mov ecx, edi
push esi
call fcn.00419ea0
test al, al
jne 0x415eee
xor esi, esi
push esi
push esi
push dword [ebp - 0x68]
push dword [ebx + 8]
push 0xffffffffffffffeb
call fcn.0041ad80
jmp 0x4173a8
push 0
push esi
push dword [ebp - 0x68]
mov dword [edi + 0x250], esi
push dword [ebx + 8]
push 0xffffffffffffffeb
call fcn.0041ad80
jmp 0x4173a8
push 0
push 0
push edx
push ecx
push 0xffffffffffffffe7
jmp 0x41739b
cmp dword [ebp - 0x18], 3
jae 0x415f2a
push edx
mov ecx, edi
call fcn.00415030
mov edx, dword [ebp - 0x68]
mov ecx, dword [ebx + 8]
push 0
push 0
push edx
push ecx
push 0xfffffffffffffffd
mov ecx, edi
call fcn.0041ad80
jmp 0x4173a8
mov eax, dword [esi + 4]
mov ecx, edi
push eax
mov dword [ebp - 0x18], eax
call fcn.00419ea0
test al, al
je 0x4173a8
mov edx, dword [esi + 8]
cmp edx, 0xfffffffe
jne 0x415fc7
mov edx, dword [ebp - 0x18]
mov eax, dword [edi + 0x3c]
lea ecx, [edx + edx*8]
mov eax, dword [eax + ecx*8]
cmp eax, 0x1f
jne 0x415fa6
mov eax, dword [ebp - 0x6c]
lea ecx, [edi + 0x110]
add eax, 0x7c
push eax
call fcn.0040aa50
lea ecx, [edi + 0x110]
call fcn.0040abf0
push eax
mov eax, dword [ebp - 0x6c]
mov ecx, edi
push dword [eax + 0x10]
push dword [ebp - 0x68]
push dword [ebx + 8]
push dword [ebp - 0x18]
call fcn.0041ad80
jmp 0x4173a8
cmp eax, 0x1b
jne 0x4173a8
push 0
push edx
push dword [ebp - 0x68]
mov ecx, edi
push dword [ebx + 8]
push dword [esi + 0xc]
call fcn.0041ad80
jmp 0x4173a8
mov eax, dword [ebp - 0x18]
lea ecx, [eax + eax*8]
mov eax, dword [edi + 0x3c]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp eax, 0x1b
jne 0x415ffb
cmp edx, 0xfffffd3a
jne 0x415ffb
push 0
push dword [esi + 0xc]
mov ecx, edi
push dword [ebp - 0x68]
push dword [ebx + 8]
push 0xffffffffffffffeb
call fcn.0041ad80
jmp 0x4173a8
cmp edx, 0xfffffffd
jne 0x416019
push 0
push dword [ebp - 0x18]
mov ecx, edi
push dword [ebp - 0x68]
push dword [ebx + 8]
push 0xfffffffffffffff3
call fcn.0041ad80
jmp 0x4173a8
cmp edx, 0xfffffffc
jne 0x416037
push 0
push dword [ebp - 0x18]
mov ecx, edi
push dword [ebp - 0x68]
push dword [ebx + 8]
push 0xffffffffffffffe6
call fcn.0041ad80
jmp 0x4173a8
cmp eax, 0x19
jne 0x416198
cmp edx, 0xfffffdd8
jne 0x4160ad
push 0
push 0
push 0x130b
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x4173a8
push eax
push dword [esi]
call fcn.00419ed0
mov esi, eax
test esi, esi
je 0x4173a8
push esi
mov ecx, edi
call fcn.00419ea0
test al, al
je 0x4173a8
mov eax, dword [edi + 0x3c]
lea ecx, [esi + esi*8]
push 0
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
push dword [ebp - 0x68]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffdd
call fcn.0041ad80
jmp 0x4173a8
cmp edx, 0xfffffdd9
jne 0x4173a8
push 0
push 0
push 0xb
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x130b
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x4173a8
push eax
push dword [esi]
call fcn.00419ed0
mov dword [ebp - 0x28], eax
test eax, eax
je 0x4173a8
push eax
mov ecx, edi
call fcn.00419ea0
test al, al
je 0x4173a8
mov eax, dword [ebp - 0x6c]
lea esi, [edi + 0x11c]
push esi
push dword [eax]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x6c]
push esi
push 0
push 0x1328
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x28]
mov edx, dword [esi]
mov ecx, dword [edi + 0x120]
push 0
lea esi, [eax + eax*8]
mov eax, dword [edi + 0x128]
sub eax, ecx
push eax
mov eax, dword [edi + 0x124]
sub eax, edx
push eax
mov eax, dword [ebp - 0x6c]
push ecx
push edx
push dword [eax]
mov eax, dword [edi + 0x3c]
push dword [eax + esi*8 + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [edi + 0x3c]
push 5
push dword [eax + esi*8 + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x6c]
push 0
push 1
push 0xb
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push dword [ebp - 0x28]
mov ecx, edi
push dword [ebp - 0x68]
push dword [ebx + 8]
push 0xffffffffffffffdc
call fcn.0041ad80
jmp 0x4173a8
cmp eax, 0xf
jne 0x4164f4
cmp edx, 0xffffff98
je 0x4173a8
cmp edx, 0xffffff99
jne 0x4161d5
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x4161bc
push ecx
call fcn.00417600
push 0
push dword [ebp - 0x18]
mov ecx, edi
push dword [ebp - 0x68]
push dword [ebx + 8]
push 0xffffffffffffffcf
call fcn.0041ad80
jmp 0x4173a8
cmp edx, 0xffffff94
jne 0x4161f4
test byte [ecx + 0x44], 1
je 0x4173a8
mov edx, dword [esi + 0x10]
push ecx
mov ecx, dword [esi]
call fcn.004138a0
jmp 0x4173a8
cmp edx, 0xffffff9b
jne 0x4162a4
mov eax, dword [esi + 0x14]
mov ecx, eax
and ecx, 2
je 0x416227
test byte [esi + 0x18], 2
jne 0x416227
push dword [esi + 0xc]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x68]
push dword [ebx + 8]
push 0xffffffffffffffd3
call fcn.0041ad80
jmp 0x4173a8
test ecx, ecx
jne 0x41624b
test byte [esi + 0x18], 2
je 0x41624b
push dword [esi + 0xc]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x68]
push dword [ebx + 8]
push 0xffffffffffffffd2
call fcn.0041ad80
jmp 0x4173a8
and eax, 0x2000
je 0x416275
test dword [esi + 0x18], 0x2000
jne 0x416275
push dword [esi + 0xc]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x68]
push dword [ebx + 8]
push 0xffffffffffffffd1
call fcn.0041ad80
jmp 0x4173a8
test eax, eax
jne 0x4173a8
test dword [esi + 0x18], 0x2000
je 0x4173a8
push dword [esi + 0xc]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x68]
push dword [ebx + 8]
push 0xffffffffffffffd0
call fcn.0041ad80
jmp 0x4173a8
cmp edx, 0xffffff4c
je 0x4164c9
cmp edx, 0xffffff4b
je 0x4164c9
cmp edx, 0xfffffff4
jne 0x4173a8
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x4162d7
mov eax, 0x20
jmp 0x4173aa
cmp eax, 0x10001
jne 0x4163c2
cmp dword [esi + 0x3c], 0
jne 0x4163c2
mov edi, dword [esi + 0x2c]
mov dword [ebp - 0x20], edi
test edi, edi
je 0x4173a8
mov eax, dword [edi + 0xc]
test eax, eax
je 0x41630b
push eax
push dword [esi + 0x10]
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x416315
mov dword [esi + 0x30], eax
cmp dword [edi + 0x10], 0
je 0x416399
push 1
push dword [esi + 0x10]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [edi + 8]
test eax, eax
je 0x41633b
push eax
lea eax, [esi + 0x14]
push eax
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_FillRect]
mov ecx, dword [edi + 0x10]
mov esi, dword [esi + 0x18]
call fcn.00401760
mov ecx, dword [ebp - 0x6c]
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x28], 0
mov edi, dword [ecx + 0x20]
sub edi, esi
sub edi, eax
lea eax, [ebp - 0x28]
push eax
push dword [ecx + 0x10]
shr edi, 1
add edi, esi
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x6c]
push edi
mov edi, dword [ebp - 0x20]
push dword [eax + 0x14]
push dword [edi + 0x10]
call fcn.004014f0
push dword [ebp - 0x1c]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
jmp 0x4163a4
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
je 0x4163a4
mov dword [esi + 0x34], eax
cmp dword [edi + 0x14], 0
je 0x4164bf
cmp dword [edi + 0x18], 0
je 0x4164bf
mov eax, 0x20
jmp 0x4173aa
cmp eax, 0x30001
jne 0x4173a8
cmp dword [esi + 0x3c], 0
jne 0x4173a8
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x4173a8
mov eax, dword [esi + 0x38]
test eax, eax
js 0x4173a8
mov edx, dword [ecx + 0x14]
test edx, edx
je 0x4173a8
cmp eax, dword [ecx + 0x18]
jg 0x4173a8
lea eax, [eax + eax*4]
lea edi, [edx + eax*4]
mov eax, dword [edi]
mov dword [ebp - 0x20], edi
cmp eax, 0xffffffff
je 0x416414
mov dword [esi + 0x30], eax
cmp dword [edi + 0x10], 0
je 0x41649f
push 1
push dword [esi + 0x10]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [edi + 8]
test eax, eax
je 0x41643e
push eax
lea eax, [esi + 0x14]
push eax
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_FillRect]
mov ecx, dword [edi + 0x10]
mov esi, dword [esi + 0x18]
call fcn.00401760
mov edx, dword [ebp - 0x6c]
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x28], 0
mov edi, dword [edx + 0x20]
sub edi, esi
sub edi, eax
lea eax, [ebp - 0x28]
shr edi, 1
add edi, esi
mov esi, edx
push eax
push dword [esi + 0x10]
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x14]
push edi
mov edi, dword [ebp - 0x20]
add eax, 2
push eax
push dword [edi + 0x10]
call fcn.004014f0
push dword [ebp - 0x1c]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
jmp 0x4164aa
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
je 0x4164aa
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4173a8
push eax
push dword [esi + 0x10]
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, 2
jmp 0x4173aa
movzx ecx, word [esi + 0x10]
movzx eax, word [esi + 0xc]
shl ecx, 0x10
or ecx, eax
xor eax, eax
push ecx
push dword [ebp - 0x18]
cmp edx, 0xffffff4c
push dword [ebp - 0x68]
sete al
push dword [ebx + 8]
add eax, 0xffffffcd
push eax
jmp 0x41739b
cmp eax, 0x1d
jne 0x4173a8
cmp edx, 0xfffffe36
jne 0x41653b
push dword [esi + 0x14]
mov eax, dword [esi + 0x34]
mov ecx, edi
push dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x68]
push dword [ebx + 8]
push 0xffffffffffffffc4
call fcn.0041ad80
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4173a8
push 0xc
push eax
call fcn.0043111f
add esp, 8
jmp 0x4173a8
cmp edx, 0xfffffe60
je 0x41665a
cmp edx, 0xfffffe5f
je 0x41665a
cmp edx, 0xfffffe5e
je 0x416640
cmp edx, 0xfffffe5d
je 0x416640
cmp edx, 0xfffffe3a
jne 0x41659f
test byte [esi + 0xc], 2
mov ecx, edi
push dword [esi + 0x3c]
push dword [ebp - 0x18]
push dword [ebp - 0x68]
push dword [ebx + 8]
je 0x416593
push 0xffffffffffffffc9
call fcn.0041ad80
jmp 0x4173a8
push 0xffffffffffffffc8
call fcn.0041ad80
jmp 0x4173a8
cmp edx, 0xfffffe3d
jne 0x4165c1
push dword [esi + 0x3c]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x68]
push dword [ebx + 8]
push 0xffffffffffffffc7
call fcn.0041ad80
jmp 0x4173a8
cmp edx, 0xfffffffb
jne 0x4165f2
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 8
push 0x110a
push dword [esi]
call edi
test eax, eax
je 0x4173a8
push eax
push 9
push 0x110b
push dword [esi]
call edi
jmp 0x4173a8
cmp edx, 0xfffffff4
jne 0x4173a8
mov eax, dword [esi + 0xc]
cmp eax, 1
je 0x4162cd
cmp eax, 0x10001
jne 0x4173a8
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x4173a8
test byte [esi + 0x28], 0x10
jne 0x416638
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x41662d
mov dword [esi + 0x30], ecx
mov ecx, dword [eax + 4]
cmp ecx, 0xffffffff
je 0x416638
mov dword [esi + 0x34], ecx
mov eax, dword [eax + 8]
jmp 0x4164ad
push dword [esi + 0x10]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x68]
push dword [ebx + 8]
push 0xffffffffffffffc5
call fcn.0041ad80
jmp 0x4173a8
test byte [ecx + 0x44], 1
je 0x41672e
push 0xfffffffffffffff0
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x100
je 0x41672e
push dword [esi + 0x10]
push 4
push 0x110a
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4173a8
push 0
push 0
push 0xb
push dword [esi]
mov edi, eax
mov dword [ebp - 0x64], 8
mov eax, dword [esi + 0x14]
xorps xmm0, xmm0
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], 0xf000
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x64]
mov dword [ebp - 0x60], edi
push eax
push 0
push 0x113f
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 1
push 0x110a
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
test edi, edi
jne 0x4166f2
push eax
push 1
push 0xb
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [ebp - 0x28]
push dword [esi + 0x10]
mov ecx, edi
push dword [ebp - 0x18]
push dword [ebp - 0x68]
push dword [ebx + 8]
push 0xffffffffffffffc6
call fcn.0041ad80
jmp 0x4173a8
mov ecx, dword [edi + 0x220]
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
test ecx, ecx
je 0x4167c9
cmp eax, edx
jne 0x4167c9
cmp si, 1
jne 0x4167c9
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 0x28], 1
xor esi, esi
push esi
mov ecx, edi
call fcn.00419ea0
xor ecx, ecx
test al, al
mov eax, dword [edi + 0x250]
cmove esi, ecx
cmp eax, esi
je 0x416864
test eax, eax
je 0x416823
push eax
mov ecx, edi
call fcn.00419ea0
test al, al
je 0x416823
mov edx, dword [edi + 0x250]
mov eax, dword [edi + 0x3c]
lea ecx, [edx + edx*8]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x416804
push 1
push 0
push edx
mov ecx, edi
call fcn.0041a040
jmp 0x416823
test eax, eax
je 0x416772
push eax
mov ecx, edi
call fcn.00414e60
mov esi, eax
mov ecx, edi
push esi
call fcn.00419ea0
test al, al
je 0x416774
mov ecx, dword [edi + 0x3c]
lea edx, [esi + esi*8]
mov eax, dword [ecx + edx*8 + 0x18]
test eax, eax
je 0x416774
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 0x28], 1
jmp 0x416774
cmp eax, 0x23
jne 0x416823
mov eax, dword [ecx + 0x44]
test eax, eax
je 0x416823
mov edx, dword [eax + 0x14]
cmp dword [ecx + 0x1c], edx
je 0x416823
push edx
push dword [eax + 4]
mov ecx, edi
call fcn.00418c50
test esi, esi
je 0x416864
mov eax, dword [edi + 0x3c]
lea ecx, [esi + esi*8]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x416845
push 1
push 1
push esi
mov ecx, edi
call fcn.0041a040
jmp 0x416864
cmp eax, 0x23
jne 0x416864
mov eax, dword [ecx + 0x44]
test eax, eax
je 0x416864
mov edx, dword [eax + 0x18]
cmp dword [ecx + 0x1c], edx
je 0x416864
push edx
push dword [eax + 4]
mov ecx, edi
call fcn.00418c50
push 0
push esi
push dword [ebp - 0x68]
mov ecx, edi
mov dword [edi + 0x250], esi
push dword [ebx + 8]
push 0xffffffffffffffec
call fcn.0041ad80
mov eax, dword [ebp - 0x28]
test eax, eax
je case.0x416b74.275
jmp 0x4173aa
mov edx, dword [edi + 0x140]
mov ecx, dword [edi + 0x13c]
lea eax, [ecx + edx]
test eax, eax
je 0x4168a5
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], edx
mov edx, dword [edi + 0x148]
mov ecx, dword [edi + 0x144]
lea eax, [ecx + edx]
test eax, eax
je 0x4173a8
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
jmp 0x4173a8
cmp edx, dword [edi + 0x22c]
jne 0x4173a8
test esi, esi
je 0x4173a8
test byte [esi + 0x18], 2
jne 0x4168f5
push dword [esi + 0xc]
mov ecx, edi
push dword [esi + 8]
push edx
call fcn.00414f00
mov edx, dword [ebp - 0x68]
mov ecx, dword [ebx + 8]
push 0
push 0
push edx
push ecx
push 0xfffffffffffffffe
mov ecx, edi
call fcn.0041ad80
jmp 0x4173a8
test esi, esi
je 0x4173a8
test byte [esi + 0x18], 1
jne 0x4173a8
push edx
mov ecx, edi
call fcn.00415030
cmp dword [edi + 0x204], 2
jne 0x41693c
push 1
push 0
push dword [edi + 0x22c]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push dword [ebp - 0x68]
mov ecx, edi
push dword [ebx + 8]
push 0xfffffffffffffffd
call fcn.0041ad80
jmp 0x4173a8
cmp dword [edi + 0x204], 3
je case.0x416b74.275
cmp dword [edi + 0x1fc], 0
je 0x415d29
cmp dword [edi + 0x3c], 0
je 0x416aca
cmp dword [edi + 0x40], 1
mov dword [ebp - 0x6c], 1
jl 0x416aca
mov esi, 0x48
nop
mov eax, dword [edi + 0x3c]
cmp dword [eax + esi + 0xc], 0
je 0x416ab4
mov edx, dword [eax + esi + 4]
test edx, edx
je 0x416ab4
test dword [eax + esi + 0x3c], 0x400
je 0x416ab4
mov ecx, dword [eax + esi]
cmp ecx, 0x1e
je 0x416ab4
cmp ecx, 0x1a
je 0x416ab4
cmp ecx, 0x1c
je 0x416ab4
cmp dword [eax + esi + 0x20], 0xfffffffe
je 0x416ab4
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x416ab4
mov eax, dword [edi + 0x3c]
push dword [eax + esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, dword [edi + 0x22c]
jne 0x416ab4
lea eax, [edi + 0x11c]
push eax
mov eax, dword [edi + 0x3c]
push dword [eax + esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x416ab4
push 2
lea eax, [edi + 0x11c]
push eax
push dword [ebp - 0x68]
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [edi + 0x3c]
cmp dword [esi + eax], 0xa
jne 0x416a93
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov ecx, dword [edi + 0x3c]
push eax
mov dword [ebp - 0x28], eax
push dword [ecx + esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRgn]
test eax, eax
je 0x416a88
push dword [edi + 0x120]
push dword [edi + 0x11c]
push dword [ebp - 0x28]
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 4
push dword [ebp - 0x28]
push dword [ebp - 0x18]
call dword [sym.imp.GDI32.dll_ExtSelectClipRgn]
push dword [ebp - 0x28]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x416ab4
push dword [edi + 0x128]
push dword [edi + 0x124]
push dword [edi + 0x120]
push dword [edi + 0x11c]
push dword [ebp - 0x18]
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov eax, dword [ebp - 0x6c]
add esi, 0x48
inc eax
mov dword [ebp - 0x6c], eax
cmp eax, dword [edi + 0x40]
jle 0x416990
mov edx, dword [ebp - 0x68]
lea esi, [edi + 0x11c]
push esi
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
test eax, eax
je 0x416b35
cmp dword [edi + 0x204], 2
je 0x416af7
push dword [edi + 0x1fc]
push esi
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_FillRect]
jmp 0x416b35
mov esi, dword [ebp - 0x18]
push 4
push esi
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
push 0xcc0020
push dword [edi + 0x21c]
push dword [edi + 0x218]
push 0
push 0
push dword [edi + 0x1e8]
push dword [edi + 0x128]
push dword [edi + 0x124]
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_StretchBlt]
push 0
push dword [ebp - 0x18]
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov eax, 1
jmp 0x4173aa
cmp ecx, 0x214
ja 0x4171cc
je 0x4171b4
lea eax, [ecx - 0x111]
cmp eax, 0xf9
ja case.0x416b74.275
movzx eax, byte [eax + 0x4174f8]
jmp dword [eax*4 + 0x4174b8]
push 0
push dword [ebp - 0x18]
push edx
push ecx
push 0xfffffffffffffff6
jmp 0x41739b
push 0
push dword [ebp - 0x18]
push edx
push ecx
push 0xfffffffffffffff5
jmp 0x41739b
push 0
push dword [ebp - 0x18]
push edx
push ecx
push 0xfffffffffffffff4
jmp 0x41739b
push 0
push dword [edi + 0x250]
push edx
push ecx
push 0xfffffffffffffff3
jmp 0x41739b
push 0
push dword [edi + 0x250]
push edx
push ecx
push 0xfffffffffffffff2
jmp 0x41739b
push 0
push dword [ebp - 0x18]
push edx
push ecx
push 0xfffffffffffffff0
jmp 0x41739b
push esi
push dword [ebp - 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_DefDlgProcW]
jmp 0x4173aa
sub esp, 0x24
mov ecx, edi
call fcn.00415c30
mov eax, dword [ebp - 0x18]
cmp eax, 0xf120
jne 0x416c0f
push 0
push 0
push dword [ebp - 0x68]
mov eax, 0xfffffff9
push dword [ebx + 8]
push eax
jmp 0x41739b
cmp eax, 0xf030
jne 0x416c2b
push 0
push 0
push dword [ebp - 0x68]
mov eax, 0xfffffff8
push dword [ebx + 8]
push eax
jmp 0x41739b
cmp eax, 0xf020
jne 0x416c47
push 0
push 0
push dword [ebp - 0x68]
mov eax, 0xfffffffa
push dword [ebx + 8]
push eax
jmp 0x41739b
cmp eax, 0xf060
jne 0x416c63
push 0
push 0
push dword [ebp - 0x68]
mov eax, 0xfffffffb
push dword [ebx + 8]
push eax
jmp 0x41739b
cmp eax, 0xf010
jne case.0x416b74.275
push 0
push 0
push dword [ebp - 0x68]
mov eax, 0xffffffe8
push dword [ebx + 8]
push eax
jmp 0x41739b
movsx ecx, si
shr esi, 0x10
movsx eax, si
push 0
mov dword [edi + 0x248], eax
mov eax, dword [ebp - 0x18]
push eax
push edx
push dword [ebx + 8]
mov dword [edi + 0x244], ecx
mov dword [edi + 0x24c], eax
push 0xfffffffffffffff1
jmp 0x41739b
movsx ecx, si
shr esi, 0x10
movsx eax, si
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_ChildWindowFromPoint]
test eax, eax
je 0x416d17
push eax
mov ecx, edi
call fcn.00414e60
mov esi, eax
mov ecx, edi
push esi
call fcn.00419ea0
test al, al
je 0x416d17
mov eax, dword [edi + 0x3c]
lea ecx, [esi + esi*8]
test dword [eax + ecx*8 + 0x3c], 0x1000
je 0x416d17
mov eax, dword [edi + 0x1c0]
movzx ecx, word [eax + 0x2c]
movzx eax, word [eax + 0x28]
shl ecx, 0x10
or ecx, eax
push ecx
push 2
push 0xa1
push dword [edi + 0x22c]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x416b74.275
push 0
push 0
push dword [ebp - 0x68]
push dword [ebx + 8]
push 0xfffffffffffffff7
jmp 0x41739b
mov eax, dword [ebp - 0x18]
mov ecx, eax
shr ecx, 0x10
movzx eax, ax
mov dword [ebp - 0x6c], ecx
mov ecx, edi
push eax
mov dword [ebp - 0x28], eax
call fcn.00419ea0
test al, al
je case.0x416b74.275
mov edx, dword [ebp - 0x28]
mov eax, dword [edi + 0x3c]
lea ecx, [edx + edx*8]
lea eax, [eax + ecx*8]
mov ecx, dword [eax]
mov dword [ebp - 0x18], eax
cmp ecx, 5
je 0x416ee8
cmp ecx, 6
je 0x416ee8
cmp ecx, 9
je 0x416e61
cmp ecx, 0xc
je 0x416e61
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x20], 0
cmp word [ebp - 0x20], ax
je 0x416d9f
mov dword [ebp - 0x20], 1
cmp word [ebp - 0x20], ax
jne 0x4173a8
cmp ecx, 0x22
jne 0x416dcf
push 0x80
push edx
mov ecx, edi
call fcn.00419020
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x6c]
push esi
movzx eax, ax
mov ecx, edi
push eax
push dword [ebp - 0x68]
push dword [ebx + 8]
push edx
call fcn.0041ad80
jmp 0x4173a8
cmp ecx, 0x23
jne 0x416e1e
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x44]
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x4173a8
xor eax, eax
cmp dword [ecx + 8], 4
mov ecx, edi
sete al
lea eax, [eax*4 + 4]
push eax
push edx
call fcn.00419020
mov eax, dword [ebp - 0x6c]
mov ecx, edi
push esi
movzx eax, ax
push eax
push dword [ebp - 0x68]
mov eax, dword [ebp - 0x20]
push dword [ebx + 8]
push dword [eax + 4]
call fcn.0041ad80
jmp 0x4173a8
mov ecx, dword [edi + 0x22c]
cmp ecx, dword [ebp - 0x68]
jne 0x416db7
mov ecx, dword [ebp - 0x18]
test dword [ecx + 0x3c], 0x1000
je 0x416db7
mov eax, dword [edi + 0x1c0]
movzx ecx, word [eax + 0x2c]
movzx eax, word [eax + 0x28]
shl ecx, 0x10
or ecx, eax
push ecx
push 2
push 0xa1
push dword [edi + 0x22c]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4173a8
mov eax, dword [ebp - 0x6c]
mov ecx, 0x400
cmp cx, ax
jne 0x416e84
push esi
push edx
push dword [ebp - 0x68]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffb5
call fcn.0041ad80
jmp 0x4173a8
mov ecx, 0x300
cmp cx, ax
jne 0x416ea4
push esi
push edx
push dword [ebp - 0x68]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffb4
call fcn.0041ad80
jmp 0x4173a8
mov ecx, 0x100
cmp cx, ax
jne 0x416ec4
push esi
push edx
push dword [ebp - 0x68]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffb3
call fcn.0041ad80
jmp 0x4173a8
mov ecx, 0x200
cmp cx, ax
jne 0x4173a8
push esi
push edx
push dword [ebp - 0x68]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffb2
call fcn.0041ad80
jmp 0x4173a8
mov eax, dword [ebp - 0x6c]
mov ecx, 1
cmp cx, ax
jne 0x416f0b
push esi
push edx
push dword [ebp - 0x68]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffbf
call fcn.0041ad80
jmp 0x4173a8
mov ecx, 7
cmp cx, ax
jne 0x416f2b
push esi
push edx
push dword [ebp - 0x68]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffbe
call fcn.0041ad80
jmp 0x4173a8
mov ecx, 8
cmp cx, ax
jne 0x416f4b
push esi
push edx
push dword [ebp - 0x68]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffbd
call fcn.0041ad80
jmp 0x4173a8
mov ecx, 3
cmp cx, ax
jne 0x416f6b
push esi
push edx
push dword [ebp - 0x68]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffbc
call fcn.0041ad80
jmp 0x4173a8
mov ecx, 4
cmp cx, ax
jne 0x416f8b
push esi
push edx
push dword [ebp - 0x68]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffbb
call fcn.0041ad80
jmp 0x4173a8
mov ecx, 2
cmp cx, ax
jne 0x4173a8
push esi
push edx
push dword [ebp - 0x68]
mov ecx, edi
push dword [ebx + 8]
push 0xffffffffffffffba
call fcn.0041ad80
jmp 0x4173a8
push dword [ebp - 0x18]
push esi
call dword [sym.imp.USER32.dll_GetMenuItemID]
push esi
push dword [ebp - 0x18]
mov ecx, edi
push dword [ebp - 0x68]
push dword [ebx + 8]
push eax
call fcn.0041ad80
jmp 0x4173a8
push esi
mov ecx, edi
call fcn.00414e60
mov esi, eax
mov ecx, edi
push esi
call fcn.00419ea0
test al, al
je case.0x416b74.275
mov ecx, dword [edi + 0x3c]
lea edx, [esi + esi*8]
cmp dword [ecx + edx*8], 0x17
jne case.0x416b74.275
push 0
push 0
push 0x400
push dword [ecx + edx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, edi
movzx eax, ax
push eax
push dword [ebp - 0x68]
push dword [ebx + 8]
push esi
call fcn.0041ad80
jmp 0x4173a8
cmp dword [edi + 0x3c], 0
je case.0x416b74.275
push esi
mov ecx, edi
call fcn.00414e60
mov esi, eax
mov ecx, edi
push esi
call fcn.00419ea0
test al, al
je case.0x416b74.275
mov eax, dword [edi + 0x3c]
lea ecx, [esi + esi*8]
mov esi, dword [ebp - 0x18]
shl ecx, 3
mov dword [ebp - 0x28], ecx
mov eax, dword [eax + ecx + 0x1c]
cmp eax, 0xffffffff
je 0x41706f
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [ebp - 0x28]
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + ecx + 0x20]
cmp eax, 0xffffffff
je 0x417086
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, dword [ebp - 0x28]
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + ecx + 0x10]
test eax, eax
je case.0x416b74.275
jmp 0x4173aa
cmp dword [edi + 0x3c], 0
je case.0x416b74.275
push esi
mov ecx, edi
call fcn.00414e60
mov esi, eax
mov ecx, edi
push esi
mov dword [ebp - 0x28], esi
call fcn.00419ea0
test al, al
je case.0x416b74.275
mov eax, dword [edi + 0x3c]
lea ecx, [esi + esi*8]
mov esi, dword [ebp - 0x18]
shl ecx, 3
mov dword [ebp - 0x6c], ecx
mov eax, dword [eax + ecx + 0x1c]
cmp eax, 0xffffffff
je 0x4170e4
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + ecx + 0x20]
cmp eax, 0xfffffffe
jne 0x417106
push 1
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x4173aa
cmp eax, 0xffffffff
je 0x417127
push 2
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [edi + 0x3c]
mov ecx, dword [ebp - 0x6c]
push dword [eax + ecx + 0x20]
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x417130
push 1
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [edi + 0x3c]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [eax + ecx + 0x10]
mov dword [ebp - 0x18], edx
test edx, edx
jne 0x417157
push esi
push dword [ebp - 0x28]
mov ecx, edi
call fcn.004199d0
mov dword [ebp - 0x18], eax
test eax, eax
je case.0x416b74.275
mov ecx, dword [edi + 0x3c]
mov eax, dword [ebp - 0x6c]
cmp dword [eax + ecx], 0xa
jne 0x4171a2
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov ecx, dword [edi + 0x3c]
push eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x6c]
push dword [ecx + eax + 4]
call dword [sym.imp.USER32.dll_GetWindowRgn]
mov edi, dword [ebp - 0x18]
test eax, eax
je 0x417197
push edi
push dword [ebp - 0x28]
push esi
call dword [sym.imp.GDI32.dll_FillRgn]
push dword [ebp - 0x28]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x4171a5
mov edi, dword [ebp - 0x18]
test edi, edi
je case.0x416b74.275
mov eax, edi
jmp 0x4173aa
push 0
push 0
push edx
push 0x214
push 0xfffffffffffffffe
mov ecx, edi
call fcn.0041ad80
jmp 0x4173a8
cmp ecx, 0x233
ja 0x417367
je 0x41722a
sub ecx, 0x216
je 0x41720d
sub ecx, 0x1c
jne case.0x416b74.275
push edx
mov ecx, edi
call fcn.00415030
push 0
push 0
push dword [ebp - 0x68]
mov ecx, edi
push 0x232
push 0xffffffffffffffe7
call fcn.0041ad80
jmp 0x4173a8
push 0
push 0
push edx
push 0x216
push 0xffffffffffffffe8
mov ecx, edi
call fcn.0041ad80
mov eax, 1
jmp 0x4173aa
mov eax, dword [ebp - 0x18]
lea ecx, [edi + 0x210]
push ecx
push eax
mov dword [edi + 0x20c], eax
call dword [sym.imp.SHELL32.dll_DragQueryPoint]
test eax, eax
jne 0x417256
push dword [edi + 0x20c]
call dword [sym.imp.SHELL32.dll_DragFinish]
jmp 0x4173a8
xorps xmm0, xmm0
lea ecx, [ebp - 0x24]
movq qword [ebp - 0x24], xmm0
call fcn.0040a9a0
lea ecx, [edi + 0x110]
mov dword [ebp - 4], 0
call fcn.0040aae0
push 0x800
xor esi, esi
lea ecx, [ebp - 0x24]
push esi
push 0x800
call fcn.0040ae60
push eax
push esi
push dword [edi + 0x20c]
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
test eax, eax
je 0x417306
nop
test esi, esi
je 0x4172b6
sub esp, 0x28
lea ecx, [ebp - 0x24]
push 0
push 0x470838
call fcn.0040bb40
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
call fcn.0040abf0
push eax
lea ecx, [edi + 0x110]
call fcn.0040b830
push 0x800
push 0
push 0x800
lea ecx, [ebp - 0x24]
inc esi
call fcn.0040ae60
push eax
push esi
push dword [edi + 0x20c]
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
test eax, eax
jne 0x4172a0
push dword [edi + 0x20c]
call dword [sym.imp.SHELL32.dll_DragFinish]
mov esi, dword [ebp - 0x68]
mov edx, dword [edi + 0x210]
push ecx
push dword [edi + 0x214]
mov ecx, esi
mov dword [ebp - 0x28], 0
call fcn.004130d0
test eax, eax
je 0x41733f
push eax
mov ecx, edi
call fcn.00414e60
mov dword [ebp - 0x28], eax
lea ecx, [edi + 0x110]
call fcn.0040abf0
push eax
push dword [ebp - 0x28]
mov ecx, edi
push esi
push 0x233
push 0xfffffffffffffffc
call fcn.0041ad80
lea ecx, [ebp - 0x24]
call fcn.0040aad0
jmp 0x4173a8
cmp ecx, 0x2a2
je 0x41738e
cmp ecx, 0x400
jne case.0x416b74.275
cmp dword [edi + 0x1ec], 0
je 0x4173a8
movzx eax, word [edi + 0x1ec]
or eax, 0x534b0000
jmp 0x4173aa
push 0
push dword [ebp - 0x18]
push edx
push 0x2a2
push 0xffffffffffffffea
mov ecx, edi
call fcn.0041ad80
mov eax, dword [ebp - 0x20]
mov byte [eax], 1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004310db
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10