Function at 0x4cc63f
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x60e00a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b8
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov ebx, ecx
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x14], ebx
call fcn.00461c65
mov esi, dword [ebp + 0x18]
xor edi, edi
cmp esi, edi
jne 0x4cc6ea
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x64857c
mov dword [esp + 0x24], 7
call fcn.0045b476
test al, al
je 0x4cc6ea
mov esi, ebx
call fcn.004caf0d
movzx eax, al
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x1cc], edi
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x30]
push eax
call fcn.004072d5
lea ecx, [esp + 0x30]
or dword [esp + 0x1cc], 0xffffffff
call fcn.00407363
mov al, 1
jmp 0x4ce14b
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x648584
mov dword [esp + 0x24], 6
call fcn.0045b476
test al, al
je 0x4cc784
push edi
add ebx, 0x10
mov eax, dword [ebx]
push edi
push 0x100
mov ecx, ebx
call dword [eax + 0x7c]
movzx eax, al
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov ecx, dword [ebp + 0x1c]
xor ebx, ebx
lea eax, [esp + 0x30]
inc ebx
push eax
mov dword [esp + 0x1d0], ebx
call fcn.004072d5
or dword [esp + 0x1cc], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.00407363
cmp esi, ebx
jb 0x4cc77d
mov eax, dword [ebp + 0x14]
push edi
call fcn.0040b11c
test al, al
je 0x4cc77d
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push edi
push edi
push dword [ebp + 0xc]
call dword [eax + 0x1f4]
mov al, bl
jmp 0x4ce14b
cmp esi, edi
jne 0x4cc87f
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x648594
mov dword [esp + 0x24], 7
call fcn.0045b476
test al, al
je 0x4cc7d7
mov esi, ebx
call fcn.004caf29
movzx eax, al
push 2
cdq
pop ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x1cc], ecx
jmp 0x4cc6c5
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x64859c
mov dword [esp + 0x24], 6
call fcn.0045b476
test al, al
je 0x4cc82f
push edi
lea ecx, [ebx + 0x10]
mov eax, dword [ecx]
push edi
push 0x101
call dword [eax + 0x7c]
movzx eax, al
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x1cc], 3
jmp 0x4cc6c5
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6485a8
mov dword [esp + 0x24], 6
call fcn.0045b476
test al, al
je 0x4cc87f
mov esi, ebx
call fcn.004caf48
movzx eax, al
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x1cc], 4
jmp 0x4cc6c5
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6485b0
mov dword [esp + 0x24], 5
call fcn.0045b476
test al, al
je 0x4cc925
push edi
add ebx, 0x10
mov eax, dword [ebx]
push edi
push 0x104
mov ecx, ebx
call dword [eax + 0x7c]
movzx eax, al
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x1cc], 5
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x30]
push eax
call fcn.004072d5
or dword [esp + 0x1cc], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.00407363
cmp esi, 1
jb 0x4cc6e3
mov eax, dword [ebp + 0x14]
push edi
call fcn.0040b11c
test al, al
je 0x4cc6e3
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push edi
push edi
push dword [ebp + 0xc]
call dword [eax + 0x1f4]
jmp 0x4cc6e3
cmp esi, edi
jne 0x4cc97b
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x644ca8
mov dword [esp + 0x24], 7
call fcn.0045b476
test al, al
je 0x4cc97b
cmp dword [ebx + 0x154], edi
mov dword [esp + 0x34], edi
setne al
movzx eax, al
cdq
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x1cc], 6
jmp 0x4cc6c5
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6485b8
mov dword [esp + 0x24], 6
call fcn.0045b476
test al, al
je 0x4cc9d5
push edi
add ebx, 0x10
mov eax, dword [ebx]
push edi
push 0x103
mov ecx, ebx
call dword [eax + 0x7c]
movzx eax, al
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x1cc], 7
jmp 0x4cc8d8
cmp esi, edi
jne 0x4cca29
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6485c8
mov dword [esp + 0x24], 8
call fcn.0045b476
test al, al
je 0x4cca29
mov eax, ebx
call fcn.004caf64
movzx eax, al
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x1cc], 8
jmp 0x4cc6c5
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6485d4
mov dword [esp + 0x24], 7
call fcn.0045b476
test al, al
je 0x4cca83
push edi
add ebx, 0x10
mov eax, dword [ebx]
push edi
push 0x105
mov ecx, ebx
call dword [eax + 0x7c]
movzx eax, al
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x1cc], 9
jmp 0x4cc8d8
cmp esi, edi
jne 0x4ccb36
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6494f8
mov dword [esp + 0x24], 0xc
call fcn.0045b476
test al, al
je 0x4ccadd
lea edi, [ebx + 0x10]
call fcn.0051331f
and dword [esp + 0x34], 0
movzx eax, al
cdq
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x1cc], 0xa
jmp 0x4cc6c5
push 0xb
pop esi
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649508
mov dword [esp + 0x24], esi
call fcn.0045b476
test al, al
je 0x4cd316
push edi
add ebx, 0x10
mov eax, dword [ebx]
push edi
push 0x107
mov ecx, ebx
call dword [eax + 0x7c]
movzx eax, al
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x1cc], esi
jmp 0x4cc6c5
cmp esi, 1
jne 0x4ccc5b
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649514
mov dword [esp + 0x24], 0xa
call fcn.0045b476
test al, al
je 0x4ccc61
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 5
jne 0x4ccc29
lea eax, [esp + 0x48]
push eax
call fcn.00406deb
mov dword [esp + 0x1cc], 0xc
mov dword [esp + 0x14], edi
mov byte [esp + 0x1cc], 0xd
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 4]
lea edx, [esp + 0x14]
push edx
add eax, 8
call fcn.00404849
mov eax, dword [esp + 0x18]
pop ecx
cmp eax, edi
je 0x4ccbb3
mov edx, dword [eax - 4]
jmp 0x4ccbb5
xor edx, edx
push edx
lea ecx, [ebx + 0x10]
mov esi, dword [ecx]
push eax
push 0x106
call dword [esi + 0x7c]
movzx eax, al
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x1d0], 0xe
call fcn.004072d5
lea ecx, [esp + 0x30]
mov byte [esp + 0x1cc], 0xd
call fcn.00407363
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push edi
push edi
push dword [ebp + 0xc]
call dword [eax + 0x1f4]
lea ecx, [esp + 0x14]
call fcn.004d2fe1
lea ecx, [esp + 0x48]
call fcn.0040479b
jmp 0x4cc6e3
mov ebx, dword [ebx + 0x154]
push 2
pop eax
cmp ebx, eax
setne cl
mov dword [esp + 0x30], eax
movzx eax, cl
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x1cc], 0xf
jmp 0x4cc6c5
jb 0x4ccd6c
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649520
mov dword [esp + 0x24], 0xa
call fcn.0045b476
test al, al
je 0x4ccd6c
mov esi, dword [ebp + 0x14]
cmp dword [esi], 5
jne 0x4ccd3a
push 1
push 1
push edi
push 0xb
add ebx, 0x10
push ebx
call fcn.0051349f
lea eax, [esp + 0x48]
push eax
mov ecx, esi
call fcn.00406deb
mov dword [esp + 0x1cc], 0x10
mov dword [esp + 0x14], edi
mov byte [esp + 0x1cc], 0x11
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 4]
lea edx, [esp + 0x14]
push edx
add eax, 8
call fcn.00404849
mov eax, dword [esp + 0x18]
pop ecx
cmp eax, edi
je 0x4ccce7
mov ecx, dword [eax - 4]
jmp 0x4ccce9
xor ecx, ecx
mov edx, dword [ebx]
push ecx
push eax
push 0x106
mov ecx, ebx
call dword [edx + 0x7c]
movzx eax, al
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x1d0], 0x12
call fcn.004072d5
lea ecx, [esp + 0x30]
mov byte [esp + 0x1cc], 0x11
call fcn.00407363
jmp 0x4ccc12
mov ebx, dword [ebx + 0x154]
push 2
pop eax
cmp ebx, eax
setne cl
mov dword [esp + 0x30], eax
movzx eax, cl
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x1cc], 0x13
jmp 0x4cc6c5
push 2
pop esi
cmp dword [ebp + 0x18], esi
jne 0x4cd158
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x64952c
mov dword [esp + 0x24], 0xb
call fcn.0045b476
test al, al
je 0x4cd1c6
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x44]
push eax
call fcn.00406deb
mov eax, dword [ebp + 0x14]
push edi
add eax, 0x10
mov dword [esp + 0x1d0], 0x14
call fcn.0040b11c
push ecx
push ecx
mov byte [esp + 0x5c], al
mov eax, esp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], esp
mov dword [eax], 0x649538
mov dword [eax + 4], 9
call fcn.00406a7f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
call fcn.00406ad1
lea ecx, [esp + 0x14]
mov byte [esp + 0x13], al
call fcn.0040479b
cmp byte [esp + 0x13], 0
jne 0x4cd132
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push 9
pop edi
lea ecx, [esp + 0x1c]
mov dword [eax], 0x64954c
mov dword [eax + 4], edi
call fcn.00406a7f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
call fcn.00406ad1
lea ecx, [esp + 0x14]
mov byte [esp + 0x13], al
call fcn.0040479b
cmp byte [esp + 0x13], 0
je 0x4cce56
push 1
push 1
push dword [esp + 0x5c]
push esi
jmp 0x4cd13b
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push 7
pop esi
lea ecx, [esp + 0x1c]
mov dword [eax], 0x649560
mov dword [eax + 4], esi
call fcn.00406a7f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
call fcn.00406ad1
lea ecx, [esp + 0x14]
mov byte [esp + 0x13], al
call fcn.0040479b
cmp byte [esp + 0x13], 0
je 0x4ccea4
push 1
push 1
push dword [esp + 0x5c]
push 0xb
jmp 0x4cd13b
push ecx
push ecx
mov eax, esp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], esp
mov dword [eax], 0x649570
mov dword [eax + 4], 8
call fcn.00406a7f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
call fcn.00406ad1
lea ecx, [esp + 0x14]
mov byte [esp + 0x13], al
call fcn.0040479b
cmp byte [esp + 0x13], 0
je 0x4ccef3
push 1
push 1
push dword [esp + 0x5c]
push 5
jmp 0x4cd13b
push ecx
push ecx
mov eax, esp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], esp
mov dword [eax], 0x649584
mov dword [eax + 4], edi
call fcn.00406a7f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
call fcn.00406ad1
lea ecx, [esp + 0x14]
mov byte [esp + 0x13], al
call fcn.0040479b
cmp byte [esp + 0x13], 0
je 0x4ccf3e
push 1
push 1
push dword [esp + 0x5c]
push 0xa
jmp 0x4cd13b
push ecx
push ecx
mov eax, esp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], esp
mov dword [eax], 0x649598
mov dword [eax + 4], 0xa
call fcn.00406a7f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
call fcn.00406ad1
lea ecx, [esp + 0x14]
mov byte [esp + 0x13], al
call fcn.0040479b
cmp byte [esp + 0x13], 0
je 0x4ccf8d
push 1
push 1
push dword [esp + 0x5c]
push 4
jmp 0x4cd13b
push ecx
push ecx
mov eax, esp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], esp
mov dword [eax], 0x6495b0
mov dword [eax + 4], edi
call fcn.00406a7f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
call fcn.00406ad1
lea ecx, [esp + 0x14]
mov byte [esp + 0x13], al
call fcn.0040479b
cmp byte [esp + 0x13], 0
je 0x4ccfd8
push 1
push 1
push dword [esp + 0x5c]
push 1
jmp 0x4cd13b
push ecx
push ecx
mov eax, esp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], esp
mov dword [eax], 0x6495c4
mov dword [eax + 4], edi
call fcn.00406a7f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
call fcn.00406ad1
lea ecx, [esp + 0x14]
mov byte [esp + 0x13], al
call fcn.0040479b
cmp byte [esp + 0x13], 0
je 0x4cd023
push 1
push 1
push dword [esp + 0x5c]
push 3
jmp 0x4cd13b
push ecx
push ecx
mov eax, esp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], esp
mov dword [eax], 0x6495d8
mov dword [eax + 4], esi
call fcn.00406a7f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
call fcn.00406ad1
lea ecx, [esp + 0x14]
mov byte [esp + 0x13], al
call fcn.0040479b
cmp byte [esp + 0x13], 0
je 0x4cd06e
push 1
push 1
push dword [esp + 0x5c]
push 6
jmp 0x4cd13b
push ecx
push ecx
mov eax, esp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], esp
mov dword [eax], 0x6495e8
mov dword [eax + 4], edi
call fcn.00406a7f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
call fcn.00406ad1
lea ecx, [esp + 0x14]
mov byte [esp + 0x13], al
call fcn.0040479b
cmp byte [esp + 0x13], 0
jne 0x4cce48
push ecx
push ecx
mov eax, esp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], esp
mov dword [eax], 0x6495fc
mov dword [eax + 4], esi
call fcn.00406a7f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
call fcn.00406ad1
lea ecx, [esp + 0x14]
mov byte [esp + 0x13], al
call fcn.0040479b
cmp byte [esp + 0x13], 0
je 0x4cd0f6
push 1
push 1
push dword [esp + 0x5c]
push 8
jmp 0x4cd13b
push ecx
push ecx
mov eax, esp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], esp
mov dword [eax], 0x64960c
mov dword [eax + 4], edi
call fcn.00406a7f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
call fcn.00406ad1
lea ecx, [esp + 0x14]
mov byte [esp + 0x13], al
call fcn.0040479b
cmp byte [esp + 0x13], 0
je 0x4cd148
push 1
push 1
push dword [esp + 0x5c]
push edi
add ebx, 0x10
push ebx
call fcn.0051349f
mov bl, 1
jmp 0x4cd14a
xor bl, bl
lea ecx, [esp + 0x44]
call fcn.0040479b
jmp 0x4cc77d
cmp dword [ebp + 0x18], 1
jne 0x4cd928
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649620
mov dword [esp + 0x24], 0xa
call fcn.0045b476
test al, al
je 0x4cd27e
mov eax, dword [ebp + 0x14]
push edi
call fcn.0040b11c
mov byte [ebx + 0x1cc], al
push ecx
push ecx
lea eax, [ebx + 0x18c]
mov edx, dword [eax]
mov ecx, esp
mov dword [ecx], edx
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
lea ecx, [ebx + 0x10]
mov eax, dword [ecx]
mov dword [esp + 0x20], esp
call dword [eax + 0x40]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00414c63
jmp 0x4cc6e3
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x64962c
mov dword [esp + 0x24], 0xa
call fcn.0045b476
test al, al
je 0x4cd4f3
mov ecx, dword [ebp + 0x14]
push edi
call fcn.00441361
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x4c], eax
push 0x63a6c0
lea eax, [esp + 0x18]
push eax
add ecx, 0x10
call fcn.00406e07
mov dword [esp + 0x1cc], 0x15
mov eax, dword [esp + 0x14]
add eax, 8
push eax
push dword [esp + 0x50]
add ebx, 0x10
mov edx, dword [ebx]
push 0x300
mov ecx, ebx
call dword [edx + 0x7c]
movzx eax, al
cmp eax, edi
setne al
movzx eax, al
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x1d0], 0x16
call fcn.004072d5
mov byte [esp + 0x1cc], 0x15
lea ecx, [esp + 0x30]
call fcn.00407363
lea ecx, [esp + 0x14]
jmp 0x4ccc1f
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649638
mov dword [esp + 0x24], 9
call fcn.0045b476
test al, al
je 0x4cd438
mov ecx, dword [ebp + 0x14]
push 0x63a6c0
lea eax, [esp + 0x18]
push eax
call fcn.00406e07
mov dword [esp + 0x1cc], 0x17
mov eax, dword [esp + 0x14]
add eax, 8
push eax
add ebx, 0x10
mov edx, dword [ebx]
push edi
push 0x301
mov ecx, ebx
call dword [edx + 0x7c]
movzx eax, al
cmp eax, edi
setne al
movzx eax, al
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x1d0], 0x18
call fcn.004072d5
mov byte [esp + 0x1cc], 0x17
jmp 0x4cd26c
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x64860c
mov dword [esp + 0x24], 0xd
call fcn.0045b476
test al, al
je 0x4cd77c
mov dword [esp + 0x14], edi
lea eax, [esp + 0x6c]
add ebx, 0x10
push eax
mov ecx, ebx
mov dword [esp + 0x1d0], 0x19
call fcn.00516d68
mov esi, eax
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov byte [esp + 0x1d0], 0x1a
call fcn.00516d4b
push esi
push eax
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x1d8], 0x1b
call fcn.004c961b
mov byte [esp + 0x1cc], 0x1d
mov ecx, dword [esp + 0x20]
cmp ecx, edi
je 0x4cd39f
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x20], edi
mov byte [esp + 0x1cc], 0x1e
mov ecx, dword [esp + 0x6c]
cmp ecx, edi
je 0x4cd3b8
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x6c], edi
lea eax, [esp + 0x14]
push eax
lea edi, [esp + 0xa4]
call fcn.0050ffd6
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push eax
lea ecx, [esp + 0x20]
call fcn.00429378
lea ecx, [esp + 0x54]
call fcn.00406a7f
push 0
push eax
lea ecx, [esp + 0x60]
call fcn.00406bcb
mov ecx, dword [ebp + 0x1c]
push eax
mov byte [esp + 0x1d0], 0x20
call fcn.004072d5
lea ecx, [esp + 0x58]
mov byte [esp + 0x1cc], 0x1f
call fcn.00407363
lea ecx, [esp + 0x4c]
call fcn.0040479b
mov ecx, edi
mov byte [esp + 0x1cc], 0x19
call fcn.004c983c
lea ecx, [esp + 0x14]
call fcn.004d2fe1
jmp 0x4cc6e3
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649644
mov dword [esp + 0x24], 8
call fcn.0045b476
test al, al
je 0x4cd60f
mov ecx, dword [ebp + 0x14]
push 0x63a6c0
lea eax, [esp + 0x4c]
push eax
call fcn.00406e07
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x1d0], 0x21
call fcn.0042c628
mov byte [esp + 0x1cc], 0x22
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 8]
push edi
add eax, 0xc
push ecx
push eax
lea esi, [ebx + 0x10]
xor eax, eax
call fcn.0050f516
movzx eax, al
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x1d0], 0x23
call fcn.004072d5
lea ecx, [esp + 0x30]
mov byte [esp + 0x1cc], 0x22
call fcn.00407363
lea ecx, [esp + 0x14]
call fcn.00403689
jmp 0x4ccc1b
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649644
mov dword [esp + 0x24], 8
call fcn.0045b476
test al, al
je 0x4cd837
mov ecx, dword [ebp + 0x14]
mov esi, 0x63a6c0
push esi
lea eax, [esp + 0x6c]
push eax
call fcn.00406e07
mov ecx, dword [ebp + 0x14]
push esi
lea eax, [esp + 0x4c]
push eax
add ecx, 0x10
mov dword [esp + 0x1d4], 0x24
call fcn.00406e07
mov dword [esp + 0x14], edi
mov byte [esp + 0x1cc], 0x26
mov eax, dword [esp + 0x68]
mov ecx, dword [eax + 4]
lea edx, [esp + 0x14]
add eax, 8
push edx
call fcn.00404849
pop ecx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x54]
call fcn.00403fec
mov byte [esp + 0x1cc], 0x27
mov eax, dword [eax]
add eax, 0xc
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.00429378
mov eax, dword [esp + 0x4c]
push 1
push dword [esp + 0x28]
lea esi, [ebx + 0x10]
push dword [esp + 0x28]
call fcn.0050f516
lea ecx, [esp + 0x50]
mov bl, al
call fcn.00403689
movzx eax, bl
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x1d0], 0x28
call fcn.004072d5
lea ecx, [esp + 0x30]
mov byte [esp + 0x1cc], 0x26
call fcn.00407363
lea ecx, [esp + 0x14]
call fcn.004d2fe1
lea ecx, [esp + 0x48]
call fcn.0040479b
lea ecx, [esp + 0x68]
jmp 0x4ccc1f
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649650
mov dword [esp + 0x24], 8
call fcn.0045b476
test al, al
je 0x4cd6cc
mov ecx, dword [ebp + 0x14]
push 0x63a6c0
lea eax, [esp + 0x54]
push eax
call fcn.00406e07
push 0x64965c
lea ecx, [esp + 0x54]
mov dword [esp + 0x1d0], 0x29
call fcn.00405154
test eax, eax
jl 0x4cd676
push 7
xor eax, eax
lea ebx, [esp + 0x54]
call fcn.00404e3a
mov ebx, dword [esp + 0x14]
xor edi, edi
mov ecx, dword [esp + 0x50]
add ecx, 8
lea esi, [ebx + 0x10]
call fcn.0050f43b
movzx eax, al
cdq
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x1d0], 0x2a
call fcn.004072d5
mov byte [esp + 0x1cc], 0x29
lea ecx, [esp + 0x30]
call fcn.00407363
lea ecx, [esp + 0x50]
jmp 0x4ccc1f
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649670
mov dword [esp + 0x24], 8
call fcn.0045b476
test al, al
je 0x4cd928
mov ecx, dword [ebp + 0x14]
push 0x63a6c0
lea eax, [esp + 0x54]
push eax
call fcn.00406e07
push 0x64965c
lea ecx, [esp + 0x54]
mov dword [esp + 0x1d0], 0x2b
call fcn.00405154
test eax, eax
jl 0x4cd731
push 7
xor eax, eax
lea ebx, [esp + 0x54]
call fcn.00404e3a
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x50]
add eax, 8
push eax
lea edi, [ebx + 0x10]
call fcn.0050f546
and dword [esp + 0x34], 0
movzx eax, al
cdq
mov dword [esp + 0x30], 2
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x1d0], 0x2c
call fcn.004072d5
mov byte [esp + 0x1cc], 0x2b
jmp 0x4cd6ba
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x64967c
mov dword [esp + 0x24], 8
call fcn.0045b476
test al, al
je 0x4cd925
and dword [esp + 0x14], edi
push 0
push ecx
mov dword [esp + 0x1d4], 0x2d
mov eax, esp
lea esi, [ebx + 0x10]
lea edi, [esp + 0x1c]
mov dword [esp + 0x20], esp
mov dword [eax], 0x6a6728
call fcn.0050f662
test al, al
je 0x4cd829
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push eax
mov ecx, edi
call fcn.00429378
lea eax, [esp + 0x54]
push eax
call fcn.0043ff9c
add esp, 0xc
push 0
push eax
lea ecx, [esp + 0xa8]
call fcn.00406bcb
mov ecx, dword [ebp + 0x1c]
push eax
mov byte [esp + 0x1d0], 0x2f
call fcn.004072d5
lea ecx, [esp + 0xa0]
mov byte [esp + 0x1cc], 0x2e
call fcn.00407363
lea ecx, [esp + 0x4c]
call fcn.0040479b
lea ecx, [esp + 0x14]
call fcn.004d2fe1
jmp 0x4cc6e3
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x64967c
mov dword [esp + 0x24], 8
call fcn.0045b476
test al, al
je 0x4cd928
mov edi, dword [ebp + 0x14]
mov esi, 0x63a6c0
push esi
lea eax, [esp + 0x6c]
push eax
mov ecx, edi
call fcn.00406e07
push esi
lea eax, [esp + 0x4c]
push eax
lea ecx, [edi + 0x10]
mov dword [esp + 0x1d4], 0x30
call fcn.00406e07
lea esi, [esp + 0x48]
call fcn.004ca60c
and dword [esp + 0x14], 0
push eax
push ecx
mov byte [esp + 0x1d4], 0x32
lea eax, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00403fec
lea esi, [ebx + 0x10]
lea edi, [esp + 0x1c]
call fcn.0050f662
test al, al
je 0x4cd5f4
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push eax
mov ecx, edi
call fcn.00429378
lea eax, [esp + 0x54]
push eax
call fcn.0043ff9c
add esp, 0xc
push 0
push eax
lea ecx, [esp + 0xa8]
call fcn.00406bcb
mov ecx, dword [ebp + 0x1c]
push eax
mov byte [esp + 0x1d0], 0x34
call fcn.004072d5
lea ecx, [esp + 0xa0]
mov byte [esp + 0x1cc], 0x33
call fcn.00407363
lea ecx, [esp + 0x4c]
call fcn.0040479b
jmp 0x4cd5f4
push 2
pop esi
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649688
mov dword [esp + 0x24], 0xb
call fcn.0045b476
test al, al
je 0x4ce0fd
mov byte [esp + 0x13], 0
cmp dword [ebp + 0x18], edi
jbe 0x4cd964
mov eax, dword [ebp + 0x14]
push edi
call fcn.0040b11c
mov byte [esp + 0x13], al
mov dword [esp + 0x14], edi
mov dword [esp + 0x1cc], 0x35
push dword [ebx + 0x14]
lea eax, [esp + 0xa4]
push eax
call fcn.004c9551
lea eax, [esp + 0x14]
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x58], 0x62e2dc
mov dword [esp + 0x64], eax
lea eax, [esp + 0x58]
push eax
push edi
lea eax, [esp + 0x180]
push eax
mov byte [esp + 0x1d8], 0x37
call fcn.004c9d3d
cmp byte [esp + 0x13], 0
mov byte [esp + 0x1cc], 0x38
je 0x4cd9d9
mov edi, dword [ebx + 0x14]
call fcn.005051da
mov byte [esp + 0x1a6], 1
push 0
jmp 0x4cd9da
push edi
lea eax, [esp + 0xa4]
lea ecx, [esp + 0x17c]
call fcn.00519bdc
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4cd9fa
mov eax, dword [eax - 4]
jmp 0x4cd9fc
xor eax, eax
test eax, eax
je 0x4ce0c6
xor edi, edi
mov dword [esp + 0xb0], edi
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb8], edi
mov dword [esp + 0xbc], edi
push ecx
push ecx
mov byte [esp + 0x1d4], 0x39
mov eax, esp
mov dword [esp + 0x20], esp
push eax
lea ecx, [esp + 0x20]
call fcn.00429378
lea eax, [esp + 0x54]
push eax
call fcn.0043ff9c
add esp, 0xc
push edi
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x98]
call fcn.00406bcb
mov dword [esp + 0x48], eax
push 0x649694
lea esi, [esp + 0x34]
mov byte [esp + 0x1d0], 0x3b
call fcn.004c8da4
mov byte [esp + 0x1cc], 0x3c
push dword [esp + 0x48]
lea ecx, [esp + 0xb4]
push eax
call fcn.0040726d
mov ecx, esi
mov byte [esp + 0x1cc], 0x3b
call fcn.00407363
lea ecx, [esp + 0x90]
mov byte [esp + 0x1cc], 0x3a
call fcn.00407363
cmp byte [esp + 0x13], 0
je 0x4cdba2
and dword [esp + 0x50], edi
mov byte [esp + 0x1cc], 0x3d
push dword [ebx + 0x14]
lea eax, [esp + 0x34]
push eax
call fcn.004c9551
lea ecx, [esp + 0x50]
lea edi, [esp + 0x30]
mov byte [esp + 0x1cc], 0x3e
call fcn.00510438
mov eax, dword [esp + 0x50]
test eax, eax
je 0x4cdaf7
mov eax, dword [eax - 4]
jmp 0x4cdaf9
xor eax, eax
test eax, eax
je 0x4cdb86
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push eax
lea ecx, [esp + 0x5c]
call fcn.00429378
lea eax, [esp + 0x50]
push eax
call fcn.0043ff9c
add esp, 0xc
push 0
push eax
lea ecx, [esp + 0x28]
call fcn.00406bcb
mov edi, eax
push 0x63b2ec
lea esi, [esp + 0x94]
mov byte [esp + 0x1d0], 0x40
call fcn.004c8da4
push edi
push eax
lea ecx, [esp + 0xb8]
mov byte [esp + 0x1d4], 0x41
call fcn.0040726d
mov ecx, esi
mov byte [esp + 0x1cc], 0x40
call fcn.00407363
lea ecx, [esp + 0x20]
mov byte [esp + 0x1cc], 0x3f
call fcn.00407363
lea ecx, [esp + 0x48]
call fcn.0040479b
lea ecx, [esp + 0x30]
mov byte [esp + 0x1cc], 0x3d
call fcn.004c983c
lea ecx, [esp + 0x50]
call fcn.004d2fe1
xor edi, edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov byte [esp + 0x1cc], 0x42
mov dword [esp + 0x50], edi
mov eax, dword [esp + 0x1b8]
cmp eax, edi
je 0x4cdbce
mov ecx, dword [eax - 4]
jmp 0x4cdbd0
xor ecx, ecx
cmp dword [esp + 0x50], ecx
jge 0x4ce051
mov esi, dword [esp + 0x50]
shl esi, 3
add eax, esi
push eax
lea ecx, [esp + 0x58]
call fcn.004036aa
mov byte [esp + 0x1cc], 0x43
mov eax, dword [esp + 0x1b8]
lea eax, [eax + esi + 4]
push dword [eax]
lea ecx, [esp + 0x78]
mov dword [esp + 0x78], edi
call fcn.0046458f
mov ebx, dword [esp + 0x74]
cmp ebx, edi
je 0x4ce025
mov dword [esp + 0x90], edi
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
mov eax, 0x6a6728
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x1d4], 0x47
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x3c]
lea eax, [ebx + 0x10]
push eax
lea ecx, [esp + 0x6c]
call fcn.004036aa
push 0x64969c
lea ecx, [esp + 0x58]
mov byte [esp + 0x1d0], 0x48
call fcn.00403f0a
test eax, eax
jl 0x4cdcc3
mov eax, dword [esp + 0x48]
add eax, 0xc
push eax
push dword [esp + 0x54]
lea eax, [esp + 0xd0]
push 0x6496a4
push eax
call fcn.00403cff
add esp, 0x10
push dword [eax]
lea ecx, [esp + 0x6c]
call fcn.00403865
lea ecx, [esp + 0xc8]
call fcn.00403689
jmp 0x4cdcce
cmp byte [esp + 0x13], 0
jne 0x4cdff6
cmp dword [esp + 0x24], edi
je 0x4cdfa5
mov eax, dword [esp + 0x44]
cmp dword [eax + 8], edi
je 0x4cdfa5
push edi
push ecx
push ecx
mov ecx, dword [esp + 0x2c]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], ecx
lea eax, [esp + 0x154]
mov dword [esp + 0x98], esp
push eax
call fcn.004c8de1
add esp, 0x10
mov dword [esp + 0x8c], eax
push 0x640538
lea esi, [esp + 0x15c]
mov byte [esp + 0x1d0], 0x49
call fcn.004c8da4
push dword [esp + 0x8c]
lea ecx, [esp + 0x94]
push eax
mov byte [esp + 0x1d4], 0x4a
call fcn.0040726d
mov ecx, esi
mov byte [esp + 0x1cc], 0x49
call fcn.00407363
lea ecx, [esp + 0x148]
mov byte [esp + 0x1cc], 0x48
call fcn.00407363
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0xc8]
call fcn.00404920
push edi
push eax
lea ecx, [esp + 0x140]
call fcn.00406bcb
mov dword [esp + 0x8c], eax
push 0x646fc8
lea esi, [esp + 0x11c]
mov byte [esp + 0x1d0], 0x4c
call fcn.004c8da4
push dword [esp + 0x8c]
lea ecx, [esp + 0x94]
push eax
mov byte [esp + 0x1d4], 0x4d
call fcn.0040726d
mov ecx, esi
mov byte [esp + 0x1cc], 0x4c
call fcn.00407363
lea ecx, [esp + 0x138]
mov byte [esp + 0x1cc], 0x4b
call fcn.00407363
lea ecx, [esp + 0xc4]
mov byte [esp + 0x1cc], 0x48
call fcn.0040479b
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0xd0]
call fcn.00404920
push 0x10
push eax
lea ecx, [esp + 0x130]
call fcn.00406bcb
mov dword [esp + 0x8c], eax
push 0x6496b0
lea esi, [esp + 0x10c]
mov byte [esp + 0x1d0], 0x4f
call fcn.004c8da4
push dword [esp + 0x8c]
mov byte [esp + 0x1d0], 0x50
push eax
lea ecx, [esp + 0x98]
call fcn.0040726d
mov ecx, esi
mov byte [esp + 0x1cc], 0x4f
call fcn.00407363
lea ecx, [esp + 0x128]
mov byte [esp + 0x1cc], 0x4e
call fcn.00407363
lea ecx, [esp + 0xcc]
mov byte [esp + 0x1cc], 0x48
call fcn.0040479b
mov eax, dword [ebx + 0x14]
cmp dword [eax + 8], edi
je 0x4cdf24
mov ebx, eax
add ebx, 0xc
push ebx
lea eax, [esp + 0xe8]
push 0x6496c4
push eax
call fcn.00404faa
add esp, 0xc
push edi
push eax
lea ecx, [esp + 0xf0]
call fcn.00406bcb
mov ebx, eax
push 0x63aa18
lea esi, [esp + 0x16c]
mov byte [esp + 0x1d0], 0x52
call fcn.004c8da4
push ebx
push eax
lea ecx, [esp + 0x98]
mov byte [esp + 0x1d4], 0x53
call fcn.0040726d
mov ecx, esi
mov byte [esp + 0x1cc], 0x52
call fcn.00407363
lea ecx, [esp + 0xe8]
mov byte [esp + 0x1cc], 0x51
call fcn.00407363
lea ecx, [esp + 0xe4]
jmp 0x4cdf98
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x70]
call fcn.00404920
push edi
push eax
lea ecx, [esp + 0xd8]
call fcn.00406bcb
mov ebx, eax
push 0x63aa18
lea esi, [esp + 0xfc]
mov byte [esp + 0x1d0], 0x55
call fcn.004c8da4
push ebx
push eax
lea ecx, [esp + 0x98]
mov byte [esp + 0x1d4], 0x56
call fcn.0040726d
mov ecx, esi
mov byte [esp + 0x1cc], 0x55
call fcn.00407363
lea ecx, [esp + 0xd0]
mov byte [esp + 0x1cc], 0x54
call fcn.00407363
lea ecx, [esp + 0x6c]
mov byte [esp + 0x1cc], 0x48
call fcn.0040479b
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x1c]
call fcn.00404920
push 0x10
push eax
lea ecx, [esp + 0x80]
call fcn.00406bcb
lea ecx, [esp + 0x90]
push ecx
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x1d4], 0x58
call fcn.0040726d
lea ecx, [esp + 0x78]
mov byte [esp + 0x1cc], 0x57
call fcn.00407363
lea ecx, [esp + 0x18]
call fcn.0040479b
lea ecx, [esp + 0x68]
call fcn.00403689
lea ecx, [esp + 0x48]
call fcn.00403689
lea ecx, [esp + 0x44]
call fcn.00403689
lea ecx, [esp + 0x90]
mov byte [esp + 0x1cc], 0x44
call fcn.00407363
push edi
lea ecx, [esp + 0x78]
mov byte [esp + 0x1d0], 0x43
call fcn.0046458f
lea ecx, [esp + 0x54]
mov byte [esp + 0x1cc], 0x42
call fcn.00403689
inc dword [esp + 0x50]
jmp 0x4cdbbe
push 0x6496d4
lea esi, [esp + 0x7c]
call fcn.004c8da4
lea ecx, [esp + 0x30]
push ecx
push eax
lea ecx, [esp + 0xb8]
mov byte [esp + 0x1d4], 0x59
call fcn.0040726d
mov ecx, esi
mov byte [esp + 0x1cc], 0x42
call fcn.00407363
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0xb0]
push eax
call fcn.004072d5
lea ecx, [esp + 0x30]
mov byte [esp + 0x1cc], 0x3a
call fcn.00407363
lea ecx, [esp + 0x4c]
call fcn.0040479b
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1cc], 0x38
call fcn.00407363
lea eax, [esp + 0x178]
push eax
mov byte [esp + 0x1d0], 0x37
call fcn.004d0c35
lea ecx, [esp + 0x5c]
call fcn.004d2fe1
mov byte [esp + 0x1cc], 0x35
lea ecx, [esp + 0xa0]
call fcn.004c983c
jmp 0x4cd829
cmp dword [ebp + 0x18], 1
jne 0x4ce31e
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6496e0
mov dword [esp + 0x24], 0xb
call fcn.0045b476
test al, al
je 0x4ce7c5
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
cmp eax, 0xa
je 0x4ce162
cmp eax, 0xd
jne 0x4ce141
cmp dword [ecx + 4], 1
je 0x4ce162
lea esi, [ebx + 0x10]
call fcn.0050f7ba
xor al, al
mov ecx, dword [esp + 0x1c4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0x649694
lea esi, [esp + 0x7c]
call fcn.004c8da4
push eax
lea eax, [esp + 0xa4]
push eax
push dword [ebp + 0x14]
mov dword [esp + 0x1d8], 0x5a
call fcn.004c8eba
mov ecx, esi
mov byte [esp + 0x1cc], 0x5c
call fcn.00407363
cmp dword [esp + 0xa0], 5
je 0x4ce1c8
lea esi, [ebx + 0x10]
call fcn.0050f7ba
xor bl, bl
or dword [esp + 0x1cc], 0xffffffff
lea ecx, [esp + 0xa0]
call fcn.00407363
jmp 0x4cc77d
push 0x6496d4
lea esi, [esp + 0xd4]
call fcn.004c8da4
push eax
lea eax, [esp + 0x34]
push eax
push dword [ebp + 0x14]
mov byte [esp + 0x1d8], 0x5d
call fcn.004c8eba
mov ecx, esi
mov byte [esp + 0x1cc], 0x5f
call fcn.00407363
push 0x63a6c0
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0xa8]
call fcn.00406e07
mov dword [esp + 0x14], edi
push 1
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x54]
mov byte [esp + 0x1d4], 0x61
call fcn.004c8d33
cmp dword [esp + 0x30], 0xa
je 0x4ce245
cmp dword [esp + 0x30], 0xd
jne 0x4ce255
cmp dword [esp + 0x34], 1
jne 0x4ce255
lea eax, [esp + 0x30]
lea ecx, [ebx + 0x200]
push eax
call fcn.004072d5
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.00429378
push 1
push dword [esp + 0x28]
lea esi, [ebx + 0x10]
push dword [esp + 0x28]
xor eax, eax
call fcn.0050f516
mov byte [esp + 0x13], al
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
lea eax, [esp + 0x58]
lea ecx, [ebx + 0x200]
push eax
mov byte [esp + 0x1d0], 0x62
call fcn.004072d5
lea ecx, [esp + 0x58]
mov byte [esp + 0x1cc], 0x61
call fcn.00407363
movzx eax, byte [esp + 0x13]
cdq
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], 2
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], edx
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x58]
push eax
mov byte [esp + 0x1d0], 0x63
call fcn.004072d5
lea ecx, [esp + 0x58]
mov byte [esp + 0x1cc], 0x61
call fcn.00407363
lea ecx, [esp + 0x14]
call fcn.004d2fe1
lea ecx, [esp + 0x4c]
call fcn.0040479b
lea ecx, [esp + 0x30]
mov byte [esp + 0x1cc], 0x5c
call fcn.00407363
mov bl, 1
jmp 0x4ce1af
cmp dword [ebp + 0x18], esi
jb 0x4ce6e7
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6496ec
mov dword [esp + 0x24], 0xb
call fcn.0045b476
test al, al
je 0x4ce6e7
add ebx, 0x200
cmp dword [ebx], 0xd
mov dword [esp + 0x6c], ebx
jne 0x4ce368
cmp dword [ebx + 4], 1
jne 0x4ce368
mov ecx, ebx
call fcn.004c8e5e
cmp dword [ebx], 0xa
je 0x4ce39e
lea eax, [esp + 0x78]
push edi
push eax
call fcn.004070d8
pop ecx
pop ecx
push eax
mov ecx, ebx
mov dword [esp + 0x1d0], 0x64
call fcn.004072d5
or dword [esp + 0x1cc], 0xffffffff
lea ecx, [esp + 0x78]
call fcn.00407363
mov esi, dword [ebp + 0x14]
lea eax, [esp + 0x74]
push eax
mov ecx, esi
call fcn.00406deb
mov dword [esp + 0x1cc], 0x65
mov dword [esp + 0x14], edi
lea ecx, [esi + 0x10]
mov byte [esp + 0x1cc], 0x66
mov eax, dword [ecx]
cmp eax, 0xc
jne 0x4ce3e4
lea eax, [esp + 0x20]
push eax
call fcn.004c8e27
push eax
lea ecx, [esp + 0x18]
call fcn.0045436f
jmp 0x4ce432
cmp eax, 5
jne 0x4ce432
lea eax, [esp + 0x18]
push eax
call fcn.00406deb
mov byte [esp + 0x1cc], 0x67
mov eax, dword [eax]
mov ecx, dword [eax + 4]
lea edx, [eax + 8]
lea eax, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x2c], 0x642e28
mov dword [eax], edx
mov dword [eax + 4], ecx
call fcn.004bfa5d
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.0040479b
mov ebx, 0x6a6738
mov dword [esp + 0x50], ebx
mov dword [esp + 0x68], ebx
cmp dword [ebp + 0x18], 3
mov byte [esp + 0x1cc], 0x69
jb 0x4ce46e
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0x20]
call fcn.00406deb
push dword [eax]
lea ecx, [esp + 0x54]
call fcn.00404a39
lea ecx, [esp + 0x18]
call fcn.0040479b
cmp dword [ebp + 0x18], 4
jb 0x4ce495
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0x40]
call fcn.00406deb
push dword [eax]
lea ecx, [esp + 0x6c]
call fcn.00404a39
lea ecx, [esp + 0x18]
call fcn.0040479b
lea eax, [esp + 0x30]
push edi
push eax
call fcn.004070d8
pop ecx
pop ecx
push edi
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x24], esp
push eax
lea ecx, [esp + 0x24]
call fcn.00429378
lea eax, [esp + 0xdc]
push eax
call fcn.004c8de1
add esp, 0x10
mov dword [esp + 0x18], eax
push 0x640538
lea esi, [esp + 0x7c]
mov byte [esp + 0x1d0], 0x6b
call fcn.004c8da4
mov byte [esp + 0x1cc], 0x6c
push dword [esp + 0x18]
lea ecx, [esp + 0x34]
push eax
call fcn.0040726d
mov ecx, esi
mov byte [esp + 0x1cc], 0x6b
call fcn.00407363
lea ecx, [esp + 0xd0]
mov byte [esp + 0x1cc], 0x6a
call fcn.00407363
push edi
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x100]
call fcn.00406bcb
mov dword [esp + 0x18], eax
push 0x646fc8
lea esi, [esp + 0x7c]
mov byte [esp + 0x1d0], 0x6d
call fcn.004c8da4
mov byte [esp + 0x1cc], 0x6e
push dword [esp + 0x18]
lea ecx, [esp + 0x34]
push eax
call fcn.0040726d
mov ecx, esi
mov byte [esp + 0x1cc], 0x6d
call fcn.00407363
lea ecx, [esp + 0xf8]
mov byte [esp + 0x1cc], 0x6a
call fcn.00407363
push 0x10
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0xf0]
call fcn.00406bcb
mov dword [esp + 0x18], eax
push 0x6496b0
lea esi, [esp + 0x7c]
mov byte [esp + 0x1d0], 0x6f
call fcn.004c8da4
mov byte [esp + 0x1cc], 0x70
push dword [esp + 0x18]
lea ecx, [esp + 0x34]
push eax
call fcn.0040726d
mov ecx, esi
mov byte [esp + 0x1cc], 0x6f
call fcn.00407363
mov byte [esp + 0x1cc], 0x6a
lea ecx, [esp + 0xe8]
call fcn.00407363
push dword [esp + 0x68]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], ebx
call fcn.00404a39
push edi
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0xd8]
call fcn.00406bcb
mov edi, eax
push 0x63aa18
lea esi, [esp + 0x7c]
mov byte [esp + 0x1d0], 0x72
call fcn.004c8da4
push edi
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x1d4], 0x73
call fcn.0040726d
mov ecx, esi
mov byte [esp + 0x1cc], 0x72
call fcn.00407363
lea ecx, [esp + 0xd0]
mov byte [esp + 0x1cc], 0x71
call fcn.00407363
lea ecx, [esp + 0x48]
call fcn.0040479b
push dword [esp + 0x74]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], ebx
call fcn.00404a39
push 0x10
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x80]
call fcn.00406bcb
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + 0x1d0], 0x75
mov ecx, dword [esp + 0x70]
push eax
call fcn.0040726d
lea ecx, [esp + 0x78]
mov byte [esp + 0x1cc], 0x74
call fcn.00407363
lea ecx, [esp + 0x48]
call fcn.0040479b
lea ecx, [esp + 0x30]
mov byte [esp + 0x1cc], 0x69
call fcn.00407363
lea ecx, [esp + 0x68]
call fcn.0040479b
lea ecx, [esp + 0x50]
call fcn.0040479b
lea ecx, [esp + 0x14]
call fcn.004d2fe1
lea ecx, [esp + 0x74]
jmp 0x4ccc1f
cmp dword [ebp + 0x18], edi
jne 0x4ce9f6
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6496f8
mov dword [esp + 0x24], 0xd
call fcn.0045b476
test al, al
je 0x4ce829
and dword [esp + 0x14], edi
mov dword [esp + 0x1cc], 0x76
push dword [ebx + 0x14]
lea eax, [esp + 0xa4]
push eax
call fcn.004c9551
lea ecx, [esp + 0x14]
lea edi, [esp + 0xa0]
mov byte [esp + 0x1cc], 0x77
call fcn.00510438
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4ce759
mov eax, dword [eax - 4]
jmp 0x4ce75b
xor eax, eax
test eax, eax
je 0x4ce7b8
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push eax
lea ecx, [esp + 0x20]
call fcn.00429378
lea eax, [esp + 0x20]
push eax
call fcn.0043ff9c
add esp, 0xc
push 0
push eax
lea ecx, [esp + 0x80]
call fcn.00406bcb
mov ecx, dword [ebp + 0x1c]
push eax
mov byte [esp + 0x1d0], 0x79
call fcn.004072d5
lea ecx, [esp + 0x78]
mov byte [esp + 0x1cc], 0x78
call fcn.00407363
lea ecx, [esp + 0x18]
call fcn.0040479b
mov byte [esp + 0x1cc], 0x76
jmp 0x4ce0ec
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649708
mov dword [esp + 0x24], 8
call fcn.0045b476
test al, al
je 0x4ce88b
mov eax, dword [ebp + 0x14]
push edi
call fcn.0040b11c
mov ecx, dword [ebp + 0xc]
or dword [ecx + 0xe0], esi
push ecx
push ecx
mov dword [esp + 0x20], esp
test al, al
mov eax, esp
push dword [ebp + 8]
mov dword [eax], 0x100
mov dword [eax + 4], edi
push ecx
je 0x4ce81f
call fcn.0042304e
jmp 0x4cc6e3
call fcn.004235a9
jmp 0x4cc6e3
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649708
mov dword [esp + 0x24], 8
call fcn.0045b476
test al, al
je 0x4ceaaa
mov eax, dword [ebp + 0xc]
call fcn.00454395
movzx eax, al
cdq
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], esi
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], edx
mov dword [esp + 0x1cc], 0x7a
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x58]
push eax
call fcn.004072d5
lea ecx, [esp + 0x58]
jmp 0x4cc6d6
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649714
mov dword [esp + 0x24], 9
call fcn.0045b476
test al, al
je 0x4ce966
mov eax, dword [ebp + 0x14]
cmp dword [eax], 5
je 0x4cc910
mov eax, ebx
call fcn.004d091c
mov ecx, dword [ebx + 0x1d4]
mov eax, 0x80000000
cmp ecx, eax
je 0x4ce8d6
cmp ecx, edi
jne 0x4ce8f3
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x1cc], 0x7b
jmp 0x4ce875
mov ebx, dword [ebx + 0x1d4]
mov edx, ebx
sub edx, eax
neg edx
sbb edx, edx
and edx, ebx
lea esi, [esp + 0x6c]
call fcn.004fb944
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1d0], 0x7c
call fcn.00404920
push edi
push eax
lea ecx, [esp + 0x80]
call fcn.00406bcb
mov ecx, dword [ebp + 0x1c]
push eax
mov byte [esp + 0x1d0], 0x7e
call fcn.004072d5
lea ecx, [esp + 0x78]
mov byte [esp + 0x1cc], 0x7d
call fcn.00407363
lea ecx, [esp + 0x18]
call fcn.0040479b
mov ecx, esi
call fcn.00403689
jmp 0x4cc6e3
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649720
mov dword [esp + 0x24], 0x1a
call fcn.0045b476
test al, al
je 0x4ceed9
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov ecx, dword [ebp + 0x14]
push edi
mov dword [esp + 0x1d0], 0x7f
call fcn.00441361
lea ecx, [esp + 0x18]
push ecx
push eax
lea ecx, [ebx + 0x10]
call fcn.0051779b
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x7c]
push eax
call fcn.004d224e
pop ecx
pop ecx
mov ecx, dword [ebp + 0x1c]
push eax
mov byte [esp + 0x1d0], 0x80
call fcn.004072d5
lea ecx, [esp + 0x78]
mov byte [esp + 0x1cc], 0x7f
call fcn.00407363
lea esi, [esp + 0x18]
call fcn.004295f2
jmp 0x4cc6e3
cmp dword [ebp + 0x18], esi
jne 0x4ce149
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x64973c
mov dword [esp + 0x24], 0x1a
call fcn.0045b476
test al, al
je 0x4ced1d
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], edi
mov esi, dword [ebp + 0x14]
push edi
mov ecx, esi
mov dword [esp + 0x1d0], 0x81
call fcn.00441361
mov dword [esp + 0x18], eax
lea ecx, [esi + 0x10]
lea eax, [esp + 0x6c]
call fcn.004d232c
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x1c]
lea ecx, [ebx + 0x10]
call fcn.00517812
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], 2
mov dword [esp + 0x60], 1
mov dword [esp + 0x64], edi
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x58]
push eax
mov byte [esp + 0x1d0], 0x82
call fcn.004072d5
lea ecx, [esp + 0x58]
mov byte [esp + 0x1cc], 0x81
call fcn.00407363
lea esi, [esp + 0x6c]
jmp 0x4ce9ec
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649758
mov dword [esp + 0x24], 0x11
call fcn.0045b476
test al, al
je 0x4cebb6
mov dword [esp + 0x14], edi
lea ecx, [ebx + 0x10]
lea edx, [esp + 0x14]
mov dword [esp + 0x1cc], 0x83
call fcn.005176e6
mov dword [esp + 0x4c], eax
cmp eax, edi
je 0x4ceba1
mov esi, dword [esp + 0x14]
cmp esi, edi
je 0x4ceb03
mov eax, dword [esi - 4]
jmp 0x4ceb05
xor eax, eax
push eax
lea eax, [esp + 0xa4]
push eax
call fcn.00407152
pop ecx
pop ecx
mov byte [esp + 0x1cc], 0x84
cmp dword [esp + 0x4c], edi
jbe 0x4ceb7d
push esi
lea ecx, [esp + 0x1c]
call fcn.00404920
push 0
push eax
lea ecx, [esp + 0x80]
call fcn.00406bcb
push eax
lea eax, [esp + 0xa4]
mov byte [esp + 0x1d0], 0x86
call fcn.004414b0
lea ecx, [esp + 0x78]
mov byte [esp + 0x1cc], 0x85
call fcn.00407363
lea ecx, [esp + 0x18]
mov byte [esp + 0x1cc], 0x84
call fcn.0040479b
inc edi
add esi, 4
cmp edi, dword [esp + 0x4c]
jb 0x4ceb23
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0xa0]
push eax
call fcn.004072d5
lea ecx, [esp + 0xa0]
mov byte [esp + 0x1cc], 0x83
call fcn.00407363
mov eax, ebx
call fcn.004d091c
lea ecx, [esp + 0x14]
call fcn.004043bc
jmp 0x4cc6e3
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x64976c
mov dword [esp + 0x24], 0xf
call fcn.0045b476
test al, al
je 0x4cf366
mov eax, ebx
call fcn.004d091c
lea eax, [esp + 0x58]
push eax
call fcn.00436b2d
mov dword [esp + 0x1cc], 0x87
mov dword [esp + 0x48], edi
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x4c]
push eax
lea ecx, [ebx + 0x10]
mov byte [esp + 0x1d4], 0x88
call fcn.00517289
lea eax, [esp + 0x78]
push edi
push eax
call fcn.004070d8
pop ecx
pop ecx
mov ecx, dword [ebp + 0x1c]
push eax
mov byte [esp + 0x1d0], 0x89
call fcn.004072d5
lea ecx, [esp + 0x78]
mov byte [esp + 0x1cc], 0x88
call fcn.00407363
mov dword [esp + 0x14], edi
xor ebx, ebx
mov eax, dword [esp + 0x64]
cmp eax, edi
je 0x4cec57
mov ecx, dword [eax - 4]
jmp 0x4cec59
xor ecx, ecx
cmp dword [esp + 0x14], ecx
jge 0x4cecf6
add eax, ebx
push eax
lea ecx, [esp + 0x50]
call fcn.004046c6
mov byte [esp + 0x1cc], 0x8a
mov eax, dword [esp + 0x64]
lea eax, [ebx + eax + 8]
push eax
lea ecx, [esp + 0xa4]
call fcn.00406bf5
mov byte [esp + 0x1cc], 0x8b
mov eax, dword [esp + 0x4c]
add eax, 8
push eax
lea esi, [esp + 0x7c]
call fcn.0040b09e
lea ecx, [esp + 0xa0]
push ecx
push eax
mov eax, dword [ebp + 0x1c]
mov byte [esp + 0x1d4], 0x8c
call fcn.004b33da
mov ecx, esi
mov byte [esp + 0x1cc], 0x8b
call fcn.00407363
lea ecx, [esp + 0xa0]
mov byte [esp + 0x1cc], 0x8a
call fcn.00407363
lea ecx, [esp + 0x4c]
call fcn.0040479b
inc dword [esp + 0x14]
add ebx, 0x18
jmp 0x4cec4a
lea esi, [esp + 0x48]
mov byte [esp + 0x1cc], 0x87
call fcn.0050ea0f
or dword [esp + 0x1cc], 0xffffffff
lea ecx, [esp + 0x58]
call fcn.00438019
jmp 0x4cc6e3
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x64977c
mov dword [esp + 0x24], 7
call fcn.0045b476
test al, al
jne 0x4ced7f
push 0xb
pop esi
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649784
mov dword [esp + 0x24], esi
call fcn.0045b476
test al, al
jne 0x4ced7f
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649790
mov dword [esp + 0x24], esi
call fcn.0045b476
test al, al
je 0x4cf139
mov dword [esp + 0x50], 0x6a6738
mov dword [esp + 0x1cc], 0x8d
mov dword [esp + 0xb0], edi
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb8], edi
mov dword [esp + 0xbc], edi
mov esi, dword [ebp + 0x14]
mov byte [esp + 0x1cc], 0x8e
cmp dword [esi], 5
jne 0x4cedf7
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.00406deb
push dword [eax]
lea ecx, [esp + 0x54]
call fcn.00404a39
lea ecx, [esp + 0x18]
call fcn.0040479b
lea eax, [esi + 0x10]
mov ecx, dword [eax]
cmp ecx, 0xa
je 0x4cee14
cmp ecx, 0xd
jne 0x4cedf3
cmp dword [eax + 4], 1
je 0x4cee14
cmp ecx, edi
je 0x4cee21
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1cc], 0x8d
call fcn.00407363
lea ecx, [esp + 0x50]
jmp 0x4cf35c
push eax
lea ecx, [esp + 0xb4]
call fcn.004072d5
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x1c]
call fcn.00403fec
mov byte [esp + 0x1cc], 0x8f
mov eax, dword [eax]
add eax, 0xc
push eax
call fcn.004fb8f2
pop ecx
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.00403689
lea eax, [esi - 1]
cmp eax, 0x4c
ja 0x4cee5f
mov eax, dword [esi*8 + 0x68c4ac]
jmp 0x4cee61
xor eax, eax
cmp eax, 3
je 0x4cee8f
cmp esi, 0x33
je 0x4cee8f
cmp esi, 0x35
je 0x4cee8f
xor bl, bl
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1cc], 0x8d
call fcn.00407363
lea ecx, [esp + 0x50]
jmp 0x4cd14e
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], edi
lea ecx, [esp + 0xb0]
lea eax, [esp + 0x6c]
mov byte [esp + 0x1cc], 0x90
call fcn.004d232c
mov ecx, dword [ebx + 0x14]
mov eax, dword [ecx]
lea edx, [esp + 0x6c]
push edx
push esi
call dword [eax + 0x28]
push edi
lea ecx, [ebx + 0x10]
mov edx, dword [ecx]
push eax
push 0x200
call dword [edx + 0x7c]
lea esi, [esp + 0x6c]
mov bl, al
call fcn.004295f2
jmp 0x4cee72
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x64979c
mov dword [esp + 0x24], 0xc
call fcn.0045b476
test al, al
je 0x4cef6d
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov esi, 0xff000000
mov dword [esp + 0x4c], esi
cmp eax, 5
jne 0x4cef44
lea eax, [esp + 0x18]
push eax
call fcn.00406deb
push eax
lea edi, [esp + 0x50]
mov dword [esp + 0x1d0], 0x91
call fcn.00459edb
or dword [esp + 0x1d0], 0xffffffff
pop ecx
lea ecx, [esp + 0x18]
call fcn.0040479b
mov ecx, dword [esp + 0x4c]
jmp 0x4cef52
cmp eax, 3
jne 0x4cef58
cmp dword [ecx + 4], 0xf
jne 0x4cef58
mov ecx, dword [ecx + 8]
cmp ecx, esi
je 0x4cef58
mov esi, ecx
push 0
push esi
push 0x206
lea ecx, [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x7c]
jmp 0x4ce14b
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6497ac
mov dword [esp + 0x24], 0xb
call fcn.0045b476
test al, al
je 0x4cefe8
mov dword [esp + 0x14], 0x6a6738
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x1cc], 0x92
cmp dword [ecx], 5
jne 0x4cefc7
lea eax, [esp + 0x18]
push eax
call fcn.00406deb
push dword [eax]
lea ecx, [esp + 0x18]
call fcn.00404a39
lea ecx, [esp + 0x18]
call fcn.0040479b
mov edx, dword [esp + 0x14]
push edi
add edx, 8
lea ecx, [ebx + 0x10]
mov eax, dword [ecx]
push edx
push 0x207
call dword [eax + 0x7c]
mov bl, al
lea ecx, [esp + 0x14]
jmp 0x4cd14e
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6497b8
mov dword [esp + 0x24], 0xb
call fcn.0045b476
test al, al
je 0x4cf038
mov ecx, dword [ebp + 0x14]
push edi
call fcn.00441361
cmp eax, 7
jle 0x4cf01c
push 7
pop eax
jmp 0x4cf024
cmp eax, 1
jge 0x4cf024
xor eax, eax
inc eax
push edi
push eax
push 0x208
lea ecx, [ebx + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x7c]
jmp 0x4ce14b
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6497c4
mov dword [esp + 0x24], 0xa
call fcn.0045b476
test al, al
je 0x4cf4e2
mov dword [esp + 0x14], 0x6a6738
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x1cc], 0x93
cmp dword [ecx], 5
jne 0x4cf103
lea eax, [esp + 0x18]
push eax
call fcn.00406deb
push dword [eax]
lea ecx, [esp + 0x18]
call fcn.00404a39
lea ecx, [esp + 0x18]
call fcn.0040479b
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x70]
call fcn.00403fec
mov byte [esp + 0x1cc], 0x94
mov eax, dword [eax]
add eax, 0xc
push eax
call fcn.004fb8f2
pop ecx
lea ecx, [esp + 0x6c]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1cc], 0x93
call fcn.00403689
push edi
push dword [esp + 0x1c]
add ebx, 0x10
mov eax, dword [ebx]
push 0x205
mov ecx, ebx
call dword [eax + 0x7c]
movzx eax, al
cdq
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], esi
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], edx
mov byte [esp + 0x1cc], 0x95
jmp 0x4cf11b
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], esi
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
mov byte [esp + 0x1cc], 0x96
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x58]
push eax
call fcn.004072d5
mov byte [esp + 0x1cc], 0x93
lea ecx, [esp + 0x58]
jmp 0x4cd270
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6497d0
mov dword [esp + 0x24], 8
call fcn.0045b476
test al, al
je 0x4ce149
mov dword [esp + 0x44], 0x6a6738
mov dword [esp + 0x1cc], 0x97
mov dword [esp + 0x90], edi
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
mov esi, dword [ebp + 0x14]
mov byte [esp + 0x1cc], 0x98
cmp dword [esi], 5
jne 0x4cf344
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.00406deb
push dword [eax]
lea ecx, [esp + 0x48]
call fcn.00404a39
lea ecx, [esp + 0x18]
call fcn.0040479b
lea eax, [esi + 0x10]
mov ecx, dword [eax]
cmp ecx, 0xa
je 0x4cf1df
cmp ecx, 0xd
jne 0x4cf1d6
cmp dword [eax + 4], 1
je 0x4cf1df
cmp ecx, edi
je 0x4cf1ec
jmp 0x4cf344
push eax
lea ecx, [esp + 0x94]
call fcn.004072d5
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], edi
mov byte [esp + 0x1cc], 0x99
xor esi, esi
cmp dword [esp + 0x90], edi
je 0x4cf21b
lea ecx, [esp + 0x90]
lea eax, [esp + 0x6c]
call fcn.004d232c
lea esi, [esp + 0x6c]
push 0x6497dc
lea ecx, [esp + 0x48]
call fcn.0040af82
test al, al
je 0x4cf239
push esi
push edi
push 0x20e
jmp 0x4cf333
push 0x6497e0
lea ecx, [esp + 0x48]
call fcn.0040af82
test al, al
je 0x4cf257
push esi
push edi
push 0x304
jmp 0x4cf333
push 0x6497e8
lea ecx, [esp + 0x48]
call fcn.0040af82
test al, al
je 0x4cf275
push esi
push edi
push 0x305
jmp 0x4cf333
push 0x6497f0
lea ecx, [esp + 0x48]
call fcn.0040af82
test al, al
je 0x4cf293
push esi
push edi
push 0x306
jmp 0x4cf333
push 0x6497f8
lea ecx, [esp + 0x48]
call fcn.0040af82
test al, al
je 0x4cf2b1
push esi
push edi
push 0x307
jmp 0x4cf333
push 0x649800
lea ecx, [esp + 0x48]
call fcn.0040af82
test al, al
je 0x4cf2cc
push esi
push edi
push 0x308
jmp 0x4cf333
push 0x649808
lea ecx, [esp + 0x48]
call fcn.0040af82
test al, al
je 0x4cf2e7
push esi
push edi
push 0x309
jmp 0x4cf333
push 0x642298
lea ecx, [esp + 0x48]
call fcn.0040af82
test al, al
je 0x4cf302
push esi
push edi
push 0x30a
jmp 0x4cf333
push 0x649810
lea ecx, [esp + 0x48]
call fcn.0040af82
test al, al
je 0x4cf319
push esi
push 0x1c
jmp 0x4cf32e
push 0x64981c
lea ecx, [esp + 0x48]
call fcn.0040af82
test al, al
je 0x4cf33b
push esi
push 0x1d
push 0x20c
lea ecx, [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x7c]
lea esi, [esp + 0x6c]
call fcn.004295f2
lea ecx, [esp + 0x90]
mov byte [esp + 0x1cc], 0x97
call fcn.00407363
lea ecx, [esp + 0x44]
call fcn.0040479b
jmp 0x4ce149
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649828
mov dword [esp + 0x24], 0xd
call fcn.0045b476
test al, al
je 0x4cf3ec
mov eax, ebx
call fcn.004d091c
mov eax, dword [ebx + 0x154]
lea ecx, [ebx + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [ecx]
call dword [eax + 0x28]
test al, al
je 0x4cc6e3
cmp dword [esp + 0x18], esi
je 0x4cc6e3
mov ebx, dword [ebx + 0x1e0]
cmp ebx, 0xff
je 0x4cf3c8
cmp ebx, edi
jne 0x4cc6e3
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], esi
mov dword [esp + 0x60], 1
mov dword [esp + 0x64], edi
mov dword [esp + 0x1cc], 0x9a
jmp 0x4ce875
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649838
mov dword [esp + 0x24], 0xe
call fcn.0045b476
test al, al
je 0x4cf489
mov eax, ebx
call fcn.004d091c
mov eax, dword [ebx + 0x154]
lea ecx, [ebx + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [ecx]
call dword [eax + 0x28]
test al, al
je 0x4cc6e3
cmp dword [esp + 0x18], esi
je 0x4cc6e3
mov eax, dword [ebx + 0x1e0]
cmp eax, 0xff
je 0x4cf44d
cmp eax, edi
jne 0x4cc6e3
mov ebx, dword [ebx + 0x1dc]
mov eax, ebx
sub eax, 0x80000000
neg eax
sbb eax, eax
and eax, ebx
cmp eax, edi
setg al
movzx eax, al
cdq
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], esi
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], edx
mov dword [esp + 0x1cc], 0x9b
jmp 0x4ce875
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649848
mov dword [esp + 0x24], 0xc
call fcn.0045b476
test al, al
je 0x4cf4b6
push edi
push edi
push 0x20b
jmp 0x4cef60
push 0xd
pop esi
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649858
mov dword [esp + 0x24], esi
call fcn.0045b476
test al, al
je 0x4cf518
push edi
push edi
push 0x20a
jmp 0x4cef60
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649868
mov dword [esp + 0x24], 0xc
call fcn.0045b476
test al, al
je 0x4cf570
mov ecx, dword [ebp + 0x14]
push edi
call fcn.00441361
push edi
push eax
push 0x209
jmp 0x4cf02b
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649878
mov dword [esp + 0x24], 0x10
call fcn.0045b476
test al, al
je 0x4cf546
push edi
push 0x1c
push 0x20c
jmp 0x4cef60
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x64988c
mov dword [esp + 0x24], 0xe
call fcn.0045b476
test al, al
je 0x4cf652
push edi
push 0x1d
jmp 0x4cf53c
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x64989c
mov dword [esp + 0x24], 0xc
call fcn.0045b476
test al, al
je 0x4cf5eb
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0xd
mov byte [esp + 0x13], 0
jne 0x4cf5b2
cmp dword [eax + 4], 4
jne 0x4cf5b2
push eax
lea ecx, [ebx + 0x218]
call fcn.004072d5
jmp 0x4cf5c2
lea ecx, [ebx + 0x218]
call fcn.00407363
mov byte [esp + 0x13], 1
movzx edx, byte [esp + 0x13]
push edi
lea ecx, [ebx + 0x10]
mov eax, dword [ecx]
push edx
push 0x303
call dword [eax + 0x7c]
mov byte [esp + 0x18], al
push dword [esp + 0x18]
mov ecx, dword [ebp + 0x1c]
call fcn.00461c9f
jmp 0x4cc6e3
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6498ac
mov dword [esp + 0x24], 0x18
call fcn.0045b476
test al, al
je 0x4cf67d
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0xd
jne 0x4cf635
cmp dword [eax + 4], 4
jne 0x4cf635
push eax
lea ecx, [ebx + 0x218]
call fcn.004072d5
add ebx, 0x10
push ebx
call fcn.005181b5
mov byte [esp + 0x4c], al
jmp 0x4cf64c
lea edi, [ebx + 0x10]
call fcn.00518587
lea ecx, [ebx + 0x218]
mov byte [esp + 0x4c], al
call fcn.00407363
push dword [esp + 0x4c]
jmp 0x4cf5de
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6498c8
mov dword [esp + 0x24], esi
call fcn.0045b476
test al, al
je 0x4cf6bf
push dword [ebp + 0x1c]
push ebx
call fcn.004d23eb
jmp 0x4cc6e3
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6498d8
mov dword [esp + 0x24], 0xc
call fcn.0045b476
test al, al
je 0x4cf6e9
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 3
jne 0x4cc6e3
push dword [ebp + 0x1c]
push edi
call fcn.00441361
push eax
push ebx
call fcn.004d2494
jmp 0x4cc6e3
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6498e8
mov dword [esp + 0x24], 0x10
call fcn.0045b476
test al, al
je 0x4ce149
jmp 0x4cc6e3
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x6498fc
mov dword [esp + 0x24], 0x14
call fcn.0045b476
test al, al
je 0x4cf7aa
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 5
jne 0x4cc6e3
push 0x63a6c0
lea eax, [esp + 0x1c]
push eax
call fcn.00406e07
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1d0], 0x9c
call fcn.00403fec
lea ecx, [esp + 0x18]
mov byte [esp + 0x1cc], 0x9e
call fcn.0040479b
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x14]
push eax
mov eax, dword [ecx]
call dword [eax + 0x48c]
push ecx
add eax, 0x120
mov ecx, esp
mov dword [esp + 0x74], esp
push eax
call fcn.004036aa
lea eax, [esp + 0x54]
push eax
call fcn.00452d61
add esp, 0xc
push 1
push esi
lea ecx, [esp + 0x54]
add ebx, 0x10
mov byte [esp + 0x1d4], 0x9f
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x2c]
lea ecx, [esp + 0x4c]
call fcn.00403689
lea ecx, [esp + 0x14]
jmp 0x4ce95c
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649914
mov dword [esp + 0x24], 0xa
call fcn.0045b476
test al, al
je 0x4cf884
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 5
jne 0x4cc6e3
push 0x63a6c0
lea eax, [esp + 0x1c]
push eax
call fcn.00406e07
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1d0], 0xa0
call fcn.00403fec
lea ecx, [esp + 0x18]
mov byte [esp + 0x1cc], 0xa2
call fcn.0040479b
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x50]
call fcn.00404920
mov esi, dword [ebp + 8]
lea eax, [esp + 0x4c]
push eax
push dword [ebp + 0xc]
mov eax, ebx
mov byte [esp + 0x1d4], 0xa3
call fcn.004cb24f
movzx eax, al
cdq
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], 2
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], edx
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x58]
push eax
mov byte [esp + 0x1d0], 0xa4
call fcn.004072d5
lea ecx, [esp + 0x58]
mov byte [esp + 0x1cc], 0xa3
call fcn.00407363
lea ecx, [esp + 0x4c]
call fcn.0040479b
jmp 0x4cf7a1
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], 0x649920
mov dword [esp + 0x24], 0x10
call fcn.0045b476
test al, al
je 0x4ce149
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 5
jne 0x4cc6e3
push 0x63a6c0
lea eax, [esp + 0x58]
push eax
call fcn.00406e07
mov dword [esp + 0x1cc], 0xa5
mov edx, dword [esp + 0x54]
add edx, 8
push edx
lea ecx, [ebx + 0x10]
mov eax, dword [ecx]
push edi
push 0x301
call dword [eax + 0x7c]
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
mov ecx, dword [ebp + 0x1c]
lea eax, [esp + 0x58]
push eax
mov byte [esp + 0x1d0], 0xa6
call fcn.004072d5
lea ecx, [esp + 0x58]
mov byte [esp + 0x1cc], 0xa5
call fcn.00407363
lea ecx, [esp + 0x54]
jmp 0x4ccc1f