Function at 0x415860
Capabilities:
Encrypt data using speck
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x8cccd8]
sub esp, 0x3b8
push ebx
push ebp
push esi
push edi
xor edi, edi
cmp eax, edi
jne 0x415881
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorA]
mov esi, eax
call dword [sym.imp.USER32.dll_GetCursor]
mov ebp, dword [sym.imp.USER32.dll_SetCursor]
mov dword [esp + 0xbc], eax
mov eax, esi
push eax
mov dword [esp + 0xc4], esi
call ebp
call fcn.004a7570
mov eax, 4
mov byte [0x8cc914], 0
call fcn.004afe10
mov ecx, dword [0x728a84]
mov edx, dword [0x7283bc]
mov eax, dword [0x8ccde0]
mov dword [ecx*4 + 0x7288f4], edx
mov ecx, dword [0x8ccde4]
mov edx, dword [0x8ccde8]
mov ebx, dword [0x728a84]
mov dword [esp + 0x158], ecx
mov ecx, dword [0x729428]
mov dword [esp + 0x154], eax
mov eax, dword [0x729424]
mov dword [esp + 0x15c], edx
mov edx, dword [0x72942c]
mov dword [0x8ccde4], ecx
mov ecx, dword [0x8ec08c]
inc ebx
mov dword [0x728a84], ebx
mov dword [0x7283bc], 0x8ffffff2
mov dword [0x8ccde0], eax
mov dword [0x8ccde8], edx
mov eax, dword [ecx]
push 0x8ccde0
call dword [eax + 0x74]
mov al, byte [0x727d98]
mov ecx, dword [0x728820]
mov byte [ecx + 0x728814], al
mov edx, dword [0x728820]
inc edx
test al, al
mov dword [0x728820], edx
je 0x415961
call fcn.00481060
mov eax, dword [0x8ebfd8]
push 0x47435000
push 0x43fa0000
mov byte [0x727d98], 0
mov byte [0x8cbdf4], 1
mov dword [esp + 0xd0], edi
mov dword [esp + 0xf4], edi
mov dword [esp + 0xec], edi
mov dword [esp + 0xa4], edi
call fcn.00412840
cmp dword [esp + 0x3d0], edi
mov dword [esp + 0xc4], 0x320
jne 0x415ac5
jmp 0x4159c0
mov ebx, dword [esp + 0xbc]
push ebx
call ebp
push str.Dancing_with_the_nGovernors_daughter__nChoose_difficulty..._n_Argh._n_Arghhh__n_Arghhhhh___n
mov esi, 0x8ebf58
call fcn.004f7660
mov ecx, dword [0x85c268]
add esp, 4
push edi
push edi
mov eax, 0x55555556
imul ecx
push 0xffffffffffffffff
push edi
push edi
push 0xffffffffffffffff
mov eax, edx
shr eax, 0x1f
add eax, edx
push edi
push str.daughter.pcx
push eax
mov eax, dword [0x85c26c]
cdq
sub eax, edx
sar eax, 1
add eax, 0x1c
push eax
call fcn.00430160
add esp, 0x28
cmp eax, 0xffffffff
mov dword [esp + 0x3cc], eax
mov dword [0x85c158], eax
je 0x415a92
push str.Dancing_with_the_nGovernors_daughter__nChoose_ballroom..._n_Spanish.__4_beats__n_English._n_French._n_Dutch._n
call fcn.004f7660
mov ecx, dword [0x85c268]
add esp, 4
mov eax, 0x55555556
imul ecx
mov eax, dword [0x85c26c]
push edi
push edi
push 0xffffffffffffffff
push edi
mov ecx, edx
push edi
shr ecx, 0x1f
add ecx, edx
cdq
push 0xffffffffffffffff
push edi
sub eax, edx
push str.daughter.pcx
sar eax, 1
push ecx
add eax, 0x1c
push eax
call fcn.00430160
mov ebx, eax
add esp, 0x28
cmp ebx, 0xffffffff
mov dword [esp + 0x3d4], ebx
je 0x4159c0
neg eax
sbb eax, eax
mov ecx, ebx
add eax, 4
shl ecx, 5
mov byte [ecx + 0x862b74], bl
jmp 0x415af1
call fcn.004810e0
call fcn.004a7620
mov eax, dword [0x728a84]
dec eax
mov dword [0x728a84], eax
mov edx, dword [eax*4 + 0x7288f4]
push ebx
mov dword [0x7283bc], edx
call ebp
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3b8
ret
mov esi, dword [0x85c158]
add esi, 3
cmp esi, edi
jle 0x415add
call dword [sym.imp.MSVCR71.dll_rand]
cdq
idiv esi
jmp 0x415adf
xor edx, edx
mov ebx, dword [esp + 0x3d4]
xor eax, eax
cmp edx, 3
setge al
add eax, 3
cmp dword [0x85c158], 0xffffffff
mov dword [0x724aa0], eax
jne 0x415b17
mov edx, dword [esp + 0xbc]
push edx
call ebp
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3b8
ret
cmp eax, 4
jne 0x415b27
mov dword [esp + 0xc4], 0x258
mov eax, dword [esp + 0xc0]
push eax
call ebp
shl ebx, 5
lea eax, [ebx + 0x862b74]
mov dword [esp + 0x50], eax
movsx eax, byte [eax]
cmp eax, 3
ja case.0x415b4a.8792946
jmp dword [eax*4 + 0x418ce0]
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x415b87
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.e_gov_ballroom.NIF
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov ebp, eax
xor edi, edi
jmp 0x415b89
xor ebp, ebp
push 0xc0
mov dword [esp + 0x18], ebp
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x415cf1
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.e_gov_ballroom_lights.nif
jmp 0x415cd9
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x415bec
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.s_gov_ballroom.NIF
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov ebp, eax
xor edi, edi
jmp 0x415bee
xor ebp, ebp
push 0xc0
mov dword [esp + 0x18], ebp
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x415cf1
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.s_gov_ballroom_lights.nif
jmp 0x415cd9
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x415c51
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.d_gov_ballroom.NIF
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov ebp, eax
xor edi, edi
jmp 0x415c53
xor ebp, ebp
push 0xc0
mov dword [esp + 0x18], ebp
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x415cf1
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.d_gov_ballroom_lights.nif
jmp 0x415cd9
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x415cb3
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.f_gov_ballroom.NIF
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov ebp, eax
xor edi, edi
jmp 0x415cb5
xor ebp, ebp
push 0xc0
mov dword [esp + 0x18], ebp
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x415cf1
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.f_gov_ballroom_lights.nif
mov edx, dword [0x8ebfec]
mov esi, eax
xor ebx, ebx
push edx
call fcn.004bb100
mov dword [esp + 0x1c], eax
xor edi, edi
jmp 0x415cf5
mov dword [esp + 0x1c], edi
push 0xc0
call fcn.005354b8
mov esi, eax
add esp, 4
cmp esi, edi
je 0x415d50
mov eax, dword [0x8ebffc]
mov edx, dword [0x729444]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
mov dword [esi + 4], edi
mov dword [esi], 0x6ff14c
push edi
mov dword [esi + 0x1c], edi
inc edx
push eax
mov dword [esi + 0x64], edi
xor ebx, ebx
mov eax, str.fx_candle_flame_dance.nif
mov ecx, esi
mov dword [0x729444], edx
mov dword [esi + 0xbc], edi
call fcn.004be370
mov dword [esp + 0x34], esi
xor edi, edi
jmp 0x415d54
mov dword [esp + 0x34], edi
push 0xc0
call fcn.005354b8
mov esi, eax
add esp, 4
cmp esi, edi
je 0x415daf
mov eax, dword [0x8ebffc]
mov edx, dword [0x729444]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
mov dword [esi + 4], edi
mov dword [esi], 0x6ff14c
push edi
mov dword [esi + 0x1c], edi
inc edx
push eax
mov dword [esi + 0x64], edi
xor ebx, ebx
mov eax, str.fx_fireplace_flames_dance.nif
mov ecx, esi
mov dword [0x729444], edx
mov dword [esi + 0xbc], edi
call fcn.004be370
mov dword [esp + 0x2c], esi
xor edi, edi
jmp 0x415db3
mov dword [esp + 0x2c], edi
push 0xc0
call fcn.005354b8
mov esi, eax
add esp, 4
cmp esi, edi
je 0x415e0e
mov eax, dword [0x8ebffc]
mov edx, dword [0x729444]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
mov dword [esi + 4], edi
mov dword [esi], 0x6ff14c
push edi
mov dword [esi + 0x1c], edi
inc edx
push eax
mov dword [esi + 0x64], edi
xor ebx, ebx
mov eax, str.fx_fireplace_light.nif
mov ecx, esi
mov dword [0x729444], edx
mov dword [esi + 0xbc], edi
call fcn.004be370
mov dword [esp + 0x28], esi
xor edi, edi
jmp 0x415e12
mov dword [esp + 0x28], edi
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
mov eax, 0xbf800000
mov dword [ecx + 0x2c], eax
mov ecx, dword [esp + 0x28]
mov dword [edx + 0x2c], eax
mov dword [ecx + 0x2c], eax
mov ecx, dword [ebp + 0xbc]
cmp ecx, edi
je 0x415e3d
push 1
call fcn.004c0f40
mov ecx, dword [ebp + 0x20]
mov esi, dword [esp + 0x2c]
or ecx, 0x8000
mov dword [ebp + 0x20], ecx
mov ebx, dword [0x8ebfe8]
call fcn.004bf5b0
mov ebx, dword [0x8ebfe8]
mov esi, dword [esp + 0x28]
call fcn.004bf5b0
mov ebx, dword [0x8ebfe8]
mov esi, dword [esp + 0x1c]
call fcn.004bf5b0
mov ebx, dword [0x8ebfe8]
mov esi, ebp
call fcn.004bf5b0
mov ebx, dword [0x8ec008]
call fcn.004bf5b0
lea esi, [esp + 0x114]
call fcn.004d5b20
lea esi, [esp + 0xa0]
lea edi, [esp + 0x7c]
call fcn.00501ac0
cmp dword [esp + 0xa0], 0xb
jb 0x415f23
mov eax, ebp
call fcn.004bb170
mov edx, dword [eax]
push str.f_br_floor_shader
mov ecx, eax
call dword [edx + 0x40]
mov esi, eax
mov eax, ebp
call fcn.004bb170
mov edx, dword [eax]
push str.f_br_floor
mov ecx, eax
call dword [edx + 0x40]
mov ecx, dword [eax + 0xc0]
test ecx, ecx
ja 0x415eea
xor ecx, ecx
jmp 0x415ef2
mov eax, dword [eax + 0xb8]
mov ecx, dword [eax]
mov eax, dword [esi + 0xc0]
test eax, eax
ja 0x415f00
xor eax, eax
jmp 0x415f08
mov edx, dword [esi + 0xb8]
mov eax, dword [edx]
or byte [ecx + 0x20], 1
and byte [eax + 0x20], 0xfe
mov ecx, dword [0x8ebfd8]
push ecx
lea ecx, [esp + 0x118]
call fcn.004d5c30
mov eax, dword [0x724aa0]
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov esi, 3
cmp eax, esi
push 0
push 0
jne 0x415f57
mov edx, dword [0x8ec000]
push str.Player_Character.kfm
push ecx
mov eax, esp
mov dword [eax], edx
jmp 0x415f67
push str.Player_Character_4_4.kfm
push ecx
mov ecx, dword [0x8ec000]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [eax]
test eax, eax
je 0x415f70
inc dword [eax + 4]
call fcn.004afb00
mov ebx, dword [0x724aa0]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x400]
add esp, 0x30
xor edx, edx
test eax, eax
mov eax, dword [esp + 0x3d4]
mov ecx, eax
je 0x415fb5
and ecx, 1
inc ecx
cmp ebx, esi
sete dl
inc edx
push edx
mov edx, eax
imul edx, edx, 0x94
mov edx, dword [edx + 0x85df74]
and edx, esi
jmp 0x415fc7
and ecx, 1
inc ecx
cmp ebx, esi
sete dl
inc edx
push edx
mov edx, dword [esp + 0x3d0]
call fcn.00482c00
mov ebx, dword [esp + 0x3c]
add esp, 4
push 0
push ebx
mov dword [esp + 0x60], eax
call fcn.004be810
mov eax, dword [esp + 0x60]
push 0
push eax
call fcn.004be810
mov ecx, dword [esp + 0x60]
movsx edx, byte [0x86ba73]
movsx eax, byte [ecx]
add esp, 0x10
push edx
push eax
movzx eax, byte [eax*2 + 0x86ba88]
push eax
call fcn.004bd460
push 0xc0
call fcn.005354b8
mov esi, eax
xor edi, edi
add esp, 4
cmp esi, edi
je 0x41606a
mov eax, dword [0x8ec008]
mov edx, dword [0x729444]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
mov dword [esi + 4], edi
mov dword [esi], 0x6ff14c
push edi
mov dword [esi + 0x1c], edi
inc edx
push eax
mov dword [esi + 0x64], edi
xor ebx, ebx
mov eax, str.HeartNormal.dds
mov ecx, esi
mov dword [0x729444], edx
mov dword [esi + 0xbc], edi
call fcn.004be370
mov dword [esp + 0x94], esi
jmp 0x416071
mov dword [esp + 0x94], edi
push 0xc0
call fcn.005354b8
mov esi, eax
add esp, 4
cmp esi, edi
je 0x4160cf
mov eax, dword [0x8ec008]
mov edx, dword [0x729444]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
mov dword [esi + 4], edi
mov dword [esi], 0x6ff14c
push edi
mov dword [esi + 0x1c], edi
inc edx
push eax
mov dword [esi + 0x64], edi
xor ebx, ebx
mov eax, str.HeartBright.dds
mov ecx, esi
mov dword [0x729444], edx
mov dword [esi + 0xbc], edi
call fcn.004be370
mov dword [esp + 0xfc], esi
xor edi, edi
jmp 0x4160d6
mov dword [esp + 0xfc], edi
push 0xc0
call fcn.005354b8
mov esi, eax
add esp, 4
cmp esi, edi
je 0x416134
mov eax, dword [0x8ec008]
mov edx, dword [0x729444]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
mov dword [esi + 4], edi
mov dword [esi], 0x6ff14c
push edi
mov dword [esi + 0x1c], edi
inc edx
push eax
mov dword [esi + 0x64], edi
xor ebx, ebx
mov eax, str.smallheart.nif
mov ecx, esi
mov dword [0x729444], edx
mov dword [esi + 0xbc], edi
call fcn.004be370
mov dword [esp + 0xf8], esi
xor edi, edi
jmp 0x41613b
mov dword [esp + 0xf8], edi
push 0xc0
call fcn.005354b8
mov esi, eax
add esp, 4
cmp esi, edi
je 0x416197
mov eax, dword [0x8ebffc]
mov edx, dword [0x729444]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
mov dword [esi + 4], edi
mov dword [esi], 0x6ff14c
push edi
mov dword [esi + 0x1c], edi
inc edx
push eax
mov dword [esi + 0x64], edi
xor ebx, ebx
mov eax, str.Dance_Steps.kfm
mov ecx, esi
mov dword [0x729444], edx
mov dword [esi + 0xbc], edi
call fcn.004be370
mov dword [esp + 0xa0], esi
jmp 0x41619e
mov dword [esp + 0xa0], edi
mov eax, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
add eax, 0x78
mov esi, eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x40], 0x426a50e5
mov eax, dword [esp + 0x40]
mov dword [esi], eax
mov dword [esp + 0x44], 0xc2a191ec
mov ecx, dword [esp + 0x44]
mov dword [esi + 4], ecx
mov dword [esp + 0x48], 0x43235a1d
mov edx, dword [esp + 0x48]
mov dword [esi + 8], edx
mov esi, dword [esp + 0x58]
push 0xffffffffffffffff
add esi, 0x78
push 0x64
mov dword [esp + 0xc0], esi
mov dword [esi], eax
push str.candle
mov dword [esi + 4], ecx
push ebp
mov dword [esi + 8], edx
call fcn.004c1750
mov ebx, dword [esp + 0x2c]
push 0xffffffffffffffff
push 0x64
push str.fireplace
push ebp
call fcn.004c1750
mov ebx, dword [esp + 0x28]
push 0xffffffffffffffff
push 0x64
push str.fireplace
push ebp
call fcn.004c1750
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x416279
cmp dword [0x724aa0], 3
mov ecx, str.dance_m.kfm
je 0x41624d
mov ecx, str.dance_m_4_4.kfm
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push ecx
mov ecx, dword [0x8ec000]
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [esp + 0xa4], eax
jmp 0x416284
mov dword [esp + 0xa4], 0
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x4162cf
cmp dword [0x724aa0], 3
mov ecx, str.dancer_f.kfm
je 0x4162a8
mov ecx, str.dancer_f_4_4.kfm
mov edx, dword [0x8ec000]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push ecx
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov ebp, eax
jmp 0x4162d1
xor ebp, ebp
mov eax, dword [esp + 0xa4]
push 0
push eax
mov dword [esp + 0x8c], ebp
call fcn.004be810
push 0
push ebp
call fcn.004be810
mov edi, dword [esp + 0x3e4]
or esi, 0xffffffff
add esp, 0x10
cmp edi, esi
mov eax, esi
je 0x416309
mov ecx, dword [esp + 0x50]
movsx eax, byte [ecx]
mov cl, byte [0x727fd8]
test cl, cl
je 0x416327
test eax, eax
jge 0x41631b
xor eax, eax
jmp 0x416339
cmp eax, 4
jle 0x416339
mov eax, 4
jmp 0x416339
test eax, eax
jge 0x41632f
xor eax, eax
jmp 0x416339
cmp eax, 3
jle 0x416339
mov eax, 3
push 0
mov ecx, edi
call fcn.00482160
add esp, 4
cmp edi, esi
mov dword [esp + 0x100], eax
mov eax, esi
je 0x416359
mov edx, dword [esp + 0x50]
movsx eax, byte [edx]
mov cl, byte [0x727fdf]
test cl, cl
je 0x416377
test eax, eax
jge 0x41636b
xor eax, eax
jmp 0x416389
cmp eax, 4
jle 0x416389
mov eax, 4
jmp 0x416389
test eax, eax
jge 0x41637f
xor eax, eax
jmp 0x416389
cmp eax, 3
jle 0x416389
mov eax, 3
call fcn.00482600
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x58]
mov ebx, dword [esp + 0x38]
mov dword [esp + 0xe0], eax
lea eax, [esp + 0x114]
push eax
push ecx
push edi
push ebx
push 0x3c
call fcn.00418dd0
add esp, 0x14
test al, al
je 0x4163f1
push 0xbf800000
push esi
push esi
push 0x8f
xor eax, eax
mov ecx, esi
call fcn.00488840
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x3dc]
lea edx, [esp + 0x124]
push edx
push eax
push edi
add ecx, 0x3d
push ebx
push ecx
call fcn.00418dd0
add esp, 0x24
mov eax, dword [0x8ebfd8]
push 0x47435000
push 0x44160000
call fcn.00412840
mov eax, dword [0x724aa0]
xor ebx, ebx
cmp eax, 3
setne bl
dec ebx
and ebx, 0xfffffffd
add ebx, 0xa2
cmp eax, 3
jne 0x416464
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 3
idiv ecx
mov eax, dword [0x85c158]
lea eax, [edx + eax - 1]
cmp eax, 5
ja case.default.0x41643d
jmp dword [eax*4 + 0x418cf0]
mov edi, 3
jmp 0x41649a
mov edi, 4
jmp 0x41649a
xor edi, edi
jmp 0x41649a
mov edi, 6
jmp 0x41649a
mov edi, 5
jmp 0x41649a
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 3
idiv ecx
mov eax, dword [0x85c158]
mov ecx, edx
cdq
sub eax, edx
sar eax, 1
lea eax, [ecx + eax - 1]
cmp eax, 3
ja case.default.0x416487
jmp dword [eax*4 + 0x418d08]
mov edi, 2
jmp 0x41649a
mov edi, 1
push edi
mov eax, ebx
mov ecx, 0x8e87b0
call fcn.004a0b50
mov eax, dword [0x8eaf04]
test eax, eax
mov ecx, dword [0x8eaf08]
ja 0x4164bc
mov dword [esp + 0x5c], esi
jmp 0x4164c3
mov edx, dword [ecx + 4]
mov dword [esp + 0x5c], edx
cmp eax, 1
ja 0x4164ce
mov dword [esp + 0x54], esi
jmp 0x4164d5
mov eax, dword [ecx + 0x1c]
mov dword [esp + 0x54], eax
mov al, byte [0x8eaeff]
test al, al
jne 0x416539
sub esp, 0x64
mov dword [esp + 0x204], ebx
lea eax, [esp + 0x1fc]
mov ebx, esp
mov dword [0x8eaf00], esi
mov dword [esp + 0x25c], 0x8cccd0
mov dword [esp + 0x1fc], 0x11
mov dword [esp + 0x208], edi
mov dword [esp + 0x234], 0x8c9348
mov dword [esp + 0x20c], 0x64
call fcn.00498530
mov edi, 0x8e87b4
call fcn.004a1410
mov eax, dword [esp + 0xe0]
call fcn.004bb170
mov ebx, dword [esp + 0xa4]
push 0
mov ecx, ebx
call fcn.004bbbd0
mov esi, eax
push 0
mov ecx, ebx
mov dword [esp + 0xac], esi
call fcn.004bbbd0
mov edi, eax
push 0
mov ecx, ebx
mov dword [esp + 0xb0], edi
call fcn.004bbbd0
mov ebx, eax
push 0
mov ecx, ebp
mov dword [esp + 0xb4], ebx
call fcn.004bbbd0
push 0
mov ecx, ebp
mov dword [esp + 0x8c], eax
call fcn.004bbbd0
push 0
mov ecx, ebp
mov dword [esp + 0x90], eax
call fcn.004bbbd0
mov ebp, dword [esp + 0x98]
mov dword [esp + 0x90], eax
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x40]
mov dword [ebp], eax
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x44]
mov dword [ebp + 4], ecx
mov dword [esp + 0x48], 0x44bb8000
mov edx, dword [esp + 0x48]
mov dword [ebp + 8], edx
mov ebp, dword [esp + 0xb8]
mov dword [ebp], eax
mov dword [ebp + 4], ecx
mov dword [ebp + 8], edx
mov ebp, dword [esp + 0xa4]
add esi, 0x78
add ebp, 0x78
mov dword [ebp], eax
mov dword [ebp + 4], ecx
mov dword [ebp + 8], edx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov esi, dword [esp + 0x84]
add esi, 0x78
add edi, 0x78
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
add ebx, 0x78
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov esi, dword [esp + 0x88]
add esi, 0x78
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov esi, dword [esp + 0x8c]
add esi, 0x78
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov esi, dword [esp + 0x90]
add esi, 0x78
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov ebp, dword [sym.imp.MSVCR71.dll_rand]
xor esi, esi
lea ebx, [ebx]
call ebp
and eax, 0x80000003
jns 0x41668e
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 3
ja case.default.0x416697
jmp dword [eax*4 + 0x418d18]
mov eax, dword [esp + esi + 0xa4]
push str.dance_m4.dds
push str.dance_m1.dds
push 0
call fcn.004bb170
push eax
call fcn.004bfe30
add esp, 0x10
push str.dancer3_F.dds
jmp 0x416706
mov eax, dword [esp + esi + 0xa4]
push str.dance_m2.dds
push str.dance_m1.dds
jmp 0x416712
push str.dancer2_F.dds
jmp 0x416706
mov eax, dword [esp + esi + 0xa4]
push str.dance_m3.dds
push str.dance_m1.dds
push 0
call fcn.004bb170
push eax
call fcn.004bfe30
add esp, 0x10
push str.dancer4_F.dds
mov eax, dword [esp + esi + 0x88]
push str.dancer1_F.dds
push 0
call fcn.004bb170
push eax
call fcn.004bfe30
add esp, 0x10
add esi, 4
cmp esi, 0x10
jl 0x416680
mov eax, dword [0x7288e8]
test eax, eax
je 0x4167e5
mov esi, dword [0x7288e0]
test esi, esi
je 0x41676a
mov ecx, dword [esp + 0x34]
lea eax, [esi + 8]
mov eax, dword [eax]
cmp dword [eax], ecx
mov esi, dword [esi]
jne 0x416766
push eax
push 0x7288dc
call fcn.004ab2e0
mov byte [0x8cbdf4], 1
test esi, esi
jne 0x416745
mov eax, dword [0x7288e8]
test eax, eax
je 0x4167e5
mov esi, dword [0x7288e0]
test esi, esi
je 0x4167a5
lea ecx, [ecx]
mov edx, dword [esp + 0x2c]
lea eax, [esi + 8]
mov eax, dword [eax]
cmp dword [eax], edx
mov esi, dword [esi]
jne 0x4167a1
push eax
push 0x7288dc
call fcn.004ab2e0
mov byte [0x8cbdf4], 1
test esi, esi
jne 0x416780
mov eax, dword [0x7288e8]
test eax, eax
je 0x4167e5
mov esi, dword [0x7288e0]
test esi, esi
je 0x4167e5
jmp 0x4167c0
mov ecx, dword [esp + 0x28]
lea eax, [esi + 8]
mov eax, dword [eax]
cmp dword [eax], ecx
mov esi, dword [esi]
jne 0x4167e1
push eax
push 0x7288dc
call fcn.004ab2e0
mov byte [0x8cbdf4], 1
test esi, esi
jne 0x4167c0
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x34]
push 0xffffffffffffffff
push 0x3e8
push str.candle
push esi
call fcn.004c1750
mov ebx, dword [esp + 0x2c]
push 0xffffffffffffffff
push 0x3e8
push str.fireplace
push esi
call fcn.004c1750
mov ebx, dword [esp + 0x28]
push 0xffffffffffffffff
push 0x3e8
push str.fireplace
push esi
call fcn.004c1750
mov eax, dword [0x724aa0]
mov edx, dword [esp + 0x3cc]
xor ebx, ebx
cmp eax, 4
mov dword [esp + 0xd4], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xe8], edx
mov dword [0x72e778], ebx
mov dword [esp + 0x180], 0x8cccd0
mov dword [esp + 0x168], ebx
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
mov dword [esp + 0x178], ebx
mov dword [esp + 0x17c], ebx
mov dword [esp + 0x164], 0x6f7814
mov dword [esp + 0x18c], ebx
mov dword [esp + 0x190], ebx
jne 0x4168b2
call ebp
jmp 0x4168c0
call ebp
cdq
mov ecx, 6
idiv ecx
mov dword [esp + 0x7c], edx
fld qword [0x8ca4b0]
fmul dword [0x715698]
call fcn.005f275c
mov dword [esp + 0x98], eax
xor eax, eax
mov ecx, 0xd8
mov edi, 0x72e780
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
xor edi, edi
mov esi, 0x72e788
lea esp, [esp]
cmp esi, 0x72e7e8
jl 0x416948
mov eax, edi
cdq
sub eax, edx
mov ebp, eax
sar ebp, 1
shl ebp, 0x1d
lea ecx, [ebp - 0x20000000]
mov eax, 0x3c8
call fcn.004dcac0
mov edx, dword [esi - 4]
add edx, eax
lea ecx, [ebp + 0x20000000]
mov eax, 0x3c8
mov dword [esi - 4], edx
call fcn.004dcac0
mov ecx, dword [esi]
mov ebp, dword [sym.imp.MSVCR71.dll_rand]
add ecx, eax
mov dword [esi], ecx
mov ecx, dword [esi]
mov edx, edi
and dl, 1
neg dl
mov dword [esi + 0xc], ebx
sbb edx, edx
and edx, 0x258
add edx, 0xfffffed4
add ecx, edx
mov eax, ecx
mov dword [esi], ecx
mov ecx, dword [esi - 4]
mov edx, edi
and edx, 0x80000001
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
jns 0x416980
dec edx
or edx, 0xfffffffe
inc edx
inc edx
mov dword [esi - 8], edx
mov dword [esi + 0x24], ebx
add esi, 0x30
inc edi
cmp esi, 0x72eae8
jl 0x416900
mov ecx, dword [0x85c158]
lea eax, [ecx + ecx*2]
mov edx, eax
mov eax, 0x2b
sub eax, edx
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x3cc]
lea esi, [ecx + eax + 1]
cmp esi, ebx
mov dword [0x8cc910], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0x50], 0x1770
mov dword [esp + 0x110], esi
jle 0x416a03
call ebp
cdq
idiv esi
mov dword [esp + 0x60], edx
jmp 0x416a07
mov dword [esp + 0x60], ebx
mov ecx, dword [esp + 0xbc]
push ecx
mov dword [esp + 0x6c], 1
mov dword [esp + 0x70], 0xfffffffd
mov dword [esp + 0x34], 5
mov dword [esp + 0x108], ebx
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0xb8], ebx
mov dword [esp + 0x50], ebx
call dword [sym.imp.USER32.dll_SetCursor]
test byte [0x8ef61c], 1
jne 0x416a62
or dword [0x8ef61c], 1
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x8ef618], eax
call dword [sym.imp.WINMM.dll_timeGetTime]
fld qword [0x8ca4b0]
mov edx, dword [0x8ef618]
fmul dword [0x715698]
sub eax, edx
mov dword [esp + 0x7c], eax
call fcn.005f275c
mov dword [esp + 0x148], eax
mov eax, dword [esp + 0x78]
cmp eax, 0xe0000000
jl 0x416acf
cmp eax, 0x20000000
jg 0x416acf
cmp byte [0x8cc914], 1
mov ebp, dword [esp + 0x14]
je 0x416ac6
mov eax, ebp
call fcn.004bb170
mov edx, dword [eax]
push str.dance_hide_01
mov ecx, eax
call dword [edx + 0x40]
test eax, eax
je 0x416ac6
or byte [eax + 0x20], 1
mov byte [0x8cc914], 1
jmp 0x416afe
mov al, byte [0x8cc914]
test al, al
mov ebp, dword [esp + 0x14]
je 0x416af7
mov eax, ebp
call fcn.004bb170
mov edx, dword [eax]
push str.dance_hide_01
mov ecx, eax
call dword [edx + 0x40]
test eax, eax
je 0x416af7
and byte [eax + 0x20], 0xfe
mov byte [0x8cc914], 0
push 0
push 0
push 0
lea eax, [esp + 0x210]
call fcn.004dc670
add esp, 0xc
push 0
push 0xffffffffffffffff
push 0x3e8
push eax
push 0
push 0x3e8
push 0xfffffd44
mov ecx, ebp
call fcn.004bc350
lea esi, [esp + 0x144]
lea edi, [esp + 0x194]
call fcn.00501ac0
cmp dword [esp + 0x144], 0xb
jb 0x416d3e
mov ecx, dword [esp + 0x11c]
mov eax, dword [0x8ec000]
mov edx, dword [ecx]
push 1
push eax
call dword [edx + 0x70]
mov ecx, dword [esp + 0x11c]
push 1
xor edi, edi
push edi
call fcn.00535550
mov ecx, dword [esp + 0x11c]
mov eax, dword [0x8ebfec]
mov edx, dword [ecx]
push 1
push eax
call dword [edx + 0x70]
mov ecx, dword [esp + 0x11c]
push 1
push edi
call fcn.00535550
mov ecx, dword [0x8ebfec]
mov edx, dword [ecx]
push str.f_br_floor_shader
call dword [edx + 0x40]
mov ebx, eax
or byte [ebx + 0x20], 1
cmp dword [ebp + 0x50], edi
je 0x416c48
jmp 0x416bc0
mov ecx, dword [0x8cc4e0]
call fcn.00552c40
cmp dword [0x8cc4cc], edi
jne 0x416c3a
mov eax, dword [0x8cc4c8]
cmp dword [eax + 0xc], edi
jbe 0x416c3a
mov ecx, dword [0x8cc4e0]
push edi
call fcn.00552ba0
test eax, eax
jne 0x416c3a
mov ecx, dword [0x8cc4c8]
mov eax, dword [ecx + 4]
mov edx, dword [eax]
cmp edx, edi
mov esi, ecx
mov dword [ecx + 4], edx
je 0x416c06
mov dword [edx + 4], edi
jmp 0x416c09
mov dword [ecx + 8], edi
mov edx, dword [ecx]
mov edi, dword [eax + 8]
push eax
call dword [edx + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [0x8cc4e0]
dec eax
mov dword [esi + 0xc], eax
mov dword [0x8cc4cc], edi
mov eax, dword [0x8cc4cc]
add eax, 8
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
call fcn.00546910
xor edi, edi
mov eax, dword [0x8cc4cc]
cmp dword [ebp + 0x50], edi
jne 0x416bc0
mov eax, dword [ebp + 0xbc]
cmp eax, edi
je 0x416c62
cmp dword [0x7283a0], 1
jg 0x416c62
call fcn.004bb170
jmp 0x416c65
mov eax, dword [ebp + 0x1c]
lea ecx, [esp + 0x114]
push ecx
call fcn.004d5d60
and byte [ebx + 0x20], 0xfe
mov eax, dword [0x8ec000]
mov ecx, dword [esp + 0x11c]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x140]
push eax
call dword [edx + 0x74]
mov eax, dword [esp + 0x13c]
cmp eax, edi
je 0x416cb2
mov esi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec esi
mov edx, esi
cmp edx, edi
mov dword [eax], esi
jne 0x416cb2
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x11c]
push 1
push edi
call fcn.00535550
mov edx, dword [0x8ebfec]
mov ecx, dword [esp + 0x11c]
mov eax, dword [ecx]
push edx
lea edx, [esp + 0x144]
push edx
call dword [eax + 0x74]
mov eax, dword [esp + 0x140]
cmp eax, edi
je 0x416cfe
mov esi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec esi
mov edx, esi
cmp edx, edi
mov dword [eax], esi
jne 0x416cfe
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x11c]
push 1
push edi
call fcn.00535550
mov ecx, dword [0x8ebfe8]
mov eax, dword [0x8ec000]
mov edx, dword [ecx]
push 1
push eax
call dword [edx + 0x70]
mov ecx, dword [0x8ebfe8]
mov eax, dword [0x8ebfec]
mov edx, dword [ecx]
push 1
push eax
call dword [edx + 0x70]
mov ecx, dword [0x8ebfe8]
call fcn.00535bb0
mov eax, dword [0x8ef510]
mov ecx, dword [0x8cc90c]
mov ebx, dword [esp + 0x18]
sub eax, ecx
test bl, 0x20
mov edi, eax
mov dword [esp + 0x70], edi
je 0x416d80
fld qword [0x8ca4b0]
fmul dword [0x7157e4]
call fcn.005f275c
mov ecx, eax
mov eax, dword [esp + 0x74]
sub eax, ecx
sub eax, dword [esp + 0x98]
mov edi, eax
mov dword [esp + 0x70], edi
mov edx, dword [0x8eaf04]
test edx, edx
mov ecx, dword [0x8eaf08]
ja 0x416d95
or eax, 0xffffffff
jmp 0x416d98
mov eax, dword [ecx + 4]
cmp edi, eax
jl 0x416da3
or ebx, 1
mov dword [esp + 0x18], ebx
test bl, 8
mov dword [esp + 0x74], 0
je 0x4173ce
mov esi, dword [esp + 0x54]
cmp edi, esi
jl 0x4173ce
test bl, 0x20
mov ebp, dword [0x724aa0]
mov edi, dword [esp + 0x4c]
jne 0x416e4a
inc edi
cmp edi, edx
mov dword [esp + 0x4c], edi
jb 0x416ddd
or esi, 0xffffffff
jmp 0x416de4
lea eax, [edi + edi*2]
mov esi, dword [ecx + eax*8 + 4]
lea eax, [edi + 1]
cmp eax, edx
mov dword [esp + 0x5c], esi
jae 0x416dff
lea edx, [eax + eax*2]
mov eax, dword [ecx + edx*8 + 4]
cmp eax, 0xffffffff
mov dword [esp + 0x54], eax
jne 0x416e2d
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xd0]
lea eax, [eax + eax*2]
cdq
sub eax, edx
sar eax, 1
cmp ecx, eax
jle 0x416e22
mov ecx, eax
mov dword [esp + 0xd0], ecx
or ebx, 0x20
add ecx, esi
mov dword [esp + 0x54], ecx
jmp 0x416e8d
mov ecx, dword [esp + 0xec]
sub eax, esi
test ecx, ecx
mov dword [esp + 0xd0], eax
jne 0x416e91
mov dword [esp + 0xec], eax
jmp 0x416e91
mov ecx, dword [esp + 0xd0]
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
add ecx, eax
mov eax, edi
cdq
idiv ebp
mov dword [esp + 0x5c], esi
add esi, ecx
mov dword [esp + 0xd0], ecx
mov dword [esp + 0x54], esi
test edx, edx
jne 0x416e85
test bl, 0x40
je 0x416e82
or ebx, 4
jmp 0x416e85
or ebx, 0x40
or ebx, 0x40
inc edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x18], ebx
mov eax, edi
cdq
idiv ebp
test edx, edx
jne 0x417283
mov ebp, dword [esp + 0xc4]
mov dword [esp + 0x74], 1
xor ebx, ebx
mov eax, 0x72e78c
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x41700d
mov ecx, dword [eax + 0x10]
dec ecx
cmp ecx, 5
ja case.default.0x416ecc
jmp dword [ecx*4 + 0x418d28]
test bl, 1
mov esi, dword [eax]
mov ecx, dword [eax + 8]
je 0x416f19
sub ecx, 2
and ecx, 7
shl ecx, 2
mov edx, dword [ecx + 0x7272f0]
mov ecx, dword [ecx + 0x727350]
imul edx, edx, 0x245
imul ecx, ecx, 0x245
add esi, edx
mov edx, dword [eax + 4]
add edx, ecx
mov dword [eax], esi
mov dword [eax + 4], edx
jmp case.default.0x416ecc
test bl, 1
mov esi, dword [eax]
mov ecx, dword [eax + 8]
je 0x416edd
add ecx, 2
and ecx, 7
shl ecx, 2
mov edx, dword [ecx + 0x7272f0]
mov ecx, dword [ecx + 0x727350]
imul edx, edx, 0x245
imul ecx, ecx, 0x245
add esi, edx
mov edx, dword [eax + 4]
add edx, ecx
mov dword [eax], esi
mov dword [eax + 4], edx
jmp case.default.0x416ecc
test bl, 1
mov esi, dword [eax]
mov ecx, dword [eax + 8]
je 0x416f64
sub ecx, 4
jmp 0x416f64
test bl, 1
mov esi, dword [eax]
mov ecx, dword [eax + 8]
je 0x416f55
and ecx, 7
shl ecx, 2
mov edx, dword [ecx + 0x7272f0]
mov ecx, dword [ecx + 0x727350]
imul edx, ebp
imul ecx, ebp
add esi, edx
mov edx, dword [eax + 4]
add edx, ecx
mov dword [eax], esi
mov dword [eax + 4], edx
jmp case.default.0x416ecc
test bl, 1
mov edx, dword [eax + 8]
mov edi, dword [eax]
lea ecx, [edx + 3]
jne 0x416f9a
lea ecx, [edx - 1]
and ecx, 7
shl ecx, 2
mov esi, dword [ecx + 0x7272f0]
mov ecx, dword [ecx + 0x727350]
imul esi, esi, 0x12c
imul ecx, ecx, 0x12c
add edi, esi
mov esi, dword [eax + 4]
add esi, ecx
add edx, 2
jmp 0x416ffc
test bl, 1
mov edx, dword [eax + 8]
mov edi, dword [eax]
lea ecx, [edx - 3]
jne 0x416fd4
lea ecx, [edx + 1]
and ecx, 7
shl ecx, 2
mov esi, dword [ecx + 0x7272f0]
mov ecx, dword [ecx + 0x727350]
imul esi, esi, 0x12c
imul ecx, ecx, 0x12c
add edi, esi
mov esi, dword [eax + 4]
add esi, ecx
add edx, 0xfffffffe
and edx, 7
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], edx
mov edx, dword [eax + 8]
mov dword [eax + 0xc], edx
add eax, 0x30
inc ebx
cmp eax, 0x72eaec
jl 0x416eb4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x417283
mov ebx, dword [esp + 0x60]
mov esi, eax
mov eax, dword [esp + 0x68]
movsx ecx, byte [eax + ebx*8 + 0x724a50]
xor edi, edi
or esi, 2
inc eax
cmp eax, 8
mov dword [esp + 0x6c], edi
mov dword [esp + 0x18], esi
mov dword [0x72e79c], ecx
mov dword [esp + 0x68], eax
jl 0x4170e1
mov edx, dword [0x85c158]
mov eax, dword [esp + 0x3cc]
mov edi, dword [esp + 0x110]
lea ecx, [edx + eax + 6]
cmp edi, ecx
jge 0x417080
inc edi
mov dword [esp + 0x110], edi
nop
test edi, edi
mov esi, edi
jl 0x4170ae
cmp edi, 0xa
jle 0x41709d
mov esi, 0xa
call dword [sym.imp.MSVCR71.dll_rand]
cdq
idiv esi
mov ecx, edx
jmp 0x4170b0
test edi, edi
jle 0x4170ae
call dword [sym.imp.MSVCR71.dll_rand]
cdq
idiv esi
mov ecx, edx
jmp 0x4170b0
xor ecx, ecx
cmp ecx, ebx
mov dword [esp + 0x60], ecx
je 0x417080
mov eax, 0x55555556
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jl 0x417080
mov eax, dword [0x72e7ac]
and eax, 0xfffffffb
mov dword [esp + 0x68], 0
mov dword [0x72e7ac], eax
xor edi, edi
test byte [esp + 0x18], 0x20
je 0x4170f0
mov dword [esp + 0x68], edi
mov dword [esp + 0x60], edi
mov edx, dword [0x72e7ac]
mov ecx, dword [0x72e7dc]
mov ebx, dword [0x72e79c]
mov eax, 0xfffffff4
and edx, eax
and ecx, eax
mov eax, dword [0x72e794]
mov dword [0x72e7ac], edx
mov edx, dword [0x72e790]
mov dword [0x72e7dc], ecx
mov ecx, dword [0x72e78c]
mov esi, ebx
sub esi, 3
mov dword [0x72e784], ecx
mov dword [0x72e788], edx
je 0x417143
dec esi
jne 0x41714f
lea esi, [eax - 2]
jmp 0x417146
lea esi, [eax + 2]
and esi, 7
mov dword [0x72e798], esi
lea esi, [ebx - 3]
cmp esi, 3
ja case.default.0x41715b
jmp dword [esi*4 + 0x418d40]
mov esi, eax
and esi, 7
mov esi, dword [esi*4 + 0x7272f0]
imul esi, ebp
add esi, ecx
and eax, 7
mov ecx, dword [eax*4 + 0x727350]
imul ecx, ebp
add ecx, edx
mov dword [0x72e788], ecx
mov dword [0x72e784], esi
xor edx, edx
mov eax, 0x72e79c
jmp 0x417240
lea esi, [eax - 4]
and esi, 7
mov esi, dword [esi*4 + 0x7272f0]
imul esi, ebp
add eax, 0xfffffffc
and eax, 7
mov eax, dword [eax*4 + 0x727350]
add esi, ecx
imul eax, ebp
jmp 0x417221
lea esi, [eax - 1]
and esi, 7
mov esi, dword [esi*4 + 0x7272f0]
imul esi, esi, 0x12c
add esi, ecx
dec eax
and eax, 7
mov ecx, dword [eax*4 + 0x727350]
imul ecx, ecx, 0x12c
add ecx, edx
mov dword [0x72e788], ecx
mov dword [0x72e784], esi
xor edx, edx
mov eax, 0x72e79c
jmp 0x417240
lea esi, [eax + 1]
and esi, 7
mov esi, dword [esi*4 + 0x7272f0]
imul esi, esi, 0x12c
add esi, ecx
inc eax
and eax, 7
mov eax, dword [eax*4 + 0x727350]
imul eax, eax, 0x12c
add eax, edx
mov dword [0x72e788], eax
mov dword [0x72e784], esi
xor edx, edx
mov eax, 0x72e79c
jmp 0x417240
mov ebx, dword [0x72e79c]
lea ecx, [ecx]
test dl, 1
mov dword [eax], ebx
je case.0x417253.3
mov ecx, dword [0x72e79c]
dec ecx
cmp ecx, 5
ja case.0x417253.3
jmp dword [ecx*4 + 0x418d50]
mov dword [eax], 1
jmp case.0x417253.3
mov dword [eax], 2
jmp case.0x417253.3
mov dword [eax], 6
jmp case.0x417253.3
mov dword [eax], 5
add eax, 0x30
inc edx
cmp eax, 0x72eafc
jl 0x417237
mov eax, dword [esp + 0x4c]
cdq
idiv dword [0x724aa0]
cmp edx, 1
jne 0x4172c7
mov eax, dword [0x72e778]
test eax, eax
je 0x4172bd
mov esi, dword [0x72e7ac]
mov ecx, dword [0x72e7dc]
mov eax, 8
or esi, eax
or ecx, eax
mov dword [0x72e7ac], esi
mov dword [0x72e7dc], ecx
mov dword [0x72e778], 0
xor edi, edi
cmp edx, 2
jne 0x4173d0
mov al, byte [0x72e7dc]
mov ecx, dword [0x72e7dc]
test al, 8
mov eax, dword [0x72e7cc]
je 0x4173b2
or ecx, 0x10
cmp eax, edi
mov dword [0x72e7dc], ecx
je 0x4173c6
mov edx, dword [esp + 0x80]
mov ecx, dword [esp + 0xcc]
mov eax, dword [esp + 0x3c]
inc edx
inc ecx
cmp eax, 0xffffffff
mov dword [esp + 0x80], edx
mov dword [esp + 0xcc], ecx
jne 0x4173c6
cmp ecx, dword [esp + 0xe8]
jle 0x4173c6
mov dword [esp + 0x3c], 0x14
mov dword [esp + 0xb4], edi
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 3
idiv ecx
sub edx, edi
je 0x41737a
dec edx
je 0x41736a
dec edx
jne 0x41739c
push 0xbf800000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x98
jmp 0x417388
push 0xbf800000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x97
jmp 0x417388
push 0xbf800000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x96
mov esi, dword [esp + 0x3dc]
or ecx, 0xffffffff
xor eax, eax
call fcn.00488840
add esp, 0x10
inc dword [esp + 0xe8]
mov dword [esp + 0xcc], edi
mov dword [0x72e7a4], edi
jmp 0x4173d0
and ecx, 0xffffffef
cmp eax, edi
mov dword [0x72e7dc], ecx
je 0x4173c6
mov dword [esp + 0x80], edi
mov dword [0x72e7a4], edi
jmp 0x4173d0
xor edi, edi
xor esi, esi
mov dword [esp + 0x64], esi
jmp 0x4173e0
lea esi, [esi + esi*2]
shl esi, 4
mov eax, dword [esi + 0x72e780]
test eax, eax
je 0x417ba6
mov eax, dword [esi + 0x72e79c]
cmp eax, 0xffffffff
mov dword [esp + 0x160], 0
jne 0x417415
mov edx, dword [esp + 0x38]
fld dword [edx + 0x2c]
xor ebx, ebx
jmp 0x417434
mov ecx, dword [esp + 0x38]
call fcn.004bc7a0
xor ebx, ebx
cmp eax, ebx
je 0x41742d
xor edi, edi
call fcn.004bae90
jmp 0x417434
fld dword [esp + 0x160]
fmul dword [0x715698]
call fcn.005f275c
mov ebp, eax
mov eax, dword [esp + 0x18]
and eax, 8
mov dword [esp + 0xf4], ebp
mov dword [esp + 0xdc], eax
je 0x41750c
mov edi, dword [esp + 0x5c]
cmp dword [esp + 0x70], edi
jl 0x41750c
mov eax, ebp
cdq
idiv dword [0x724aa0]
mov ecx, eax
mov eax, dword [esp + 0x70]
sub eax, edi
imul eax, ebp
cdq
idiv dword [0x724aa0]
mov edx, dword [esp + 0x54]
sub edx, edi
mov edi, edx
cdq
idiv edi
mov edi, eax
mov eax, dword [esp + 0x4c]
cdq
idiv dword [0x724aa0]
imul edx, ecx
lea eax, [edi + edx]
cmp eax, ebp
mov dword [esi + 0x72e7a0], eax
jl 0x4174b6
lea eax, [ebp - 1]
mov dword [esi + 0x72e7a0], eax
cmp dword [esi + 0x72e7a0], ebx
jge 0x4174c4
mov dword [esi + 0x72e7a0], ebx
cmp dword [esp + 0x74], ebx
je 0x4174d8
cmp dword [esi + 0x72e7a0], ecx
jle 0x4174d8
mov dword [esi + 0x72e7a0], ecx
cmp dword [esp + 0x64], ebx
jne 0x417791
mov eax, dword [0x72e7a0]
cmp eax, 0x96
mov dword [esp + 0xe4], ebx
jl 0x4174ff
lea ecx, [ebp - 0x96]
cmp eax, ecx
jle 0x41751c
mov dword [esp + 0xe4], 1
jmp 0x41751c
cmp dword [esp + 0x64], ebx
mov dword [esi + 0x72e7a0], ebx
jne 0x417791
mov ecx, dword [esi + 0x72e7ac]
test cl, 1
jne 0x41761f
mov eax, ebp
cdq
idiv dword [0x724aa0]
cmp dword [esi + 0x72e7a0], eax
jl 0x41761f
mov eax, dword [esi + 0x72e79c]
cmp dword [esi + 0x72e7a4], eax
je 0x4175e2
cmp eax, ebx
je 0x4175e2
movsx edx, byte [0x86bb2d]
mov ecx, dword [esp + 0x68]
shl edx, 1
cmp ecx, edx
jl 0x4175da
cmp dword [esp + 0x3c], 0x14
jne 0x41757a
cmp dword [0x85c158], ebx
jne 0x4175da
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x3cc]
mov eax, edi
call fcn.004a7740
mov eax, dword [esi + 0x72e7ac]
mov edx, dword [0x85c158]
mov ecx, 4
or eax, 6
sub ecx, edx
cmp ecx, 2
mov dword [esi + 0x72e7ac], eax
jge 0x4175b4
mov ecx, 2
jmp 0x4175be
cmp ecx, 4
jle 0x4175be
mov ecx, 4
mov eax, edi
cdq
idiv ecx
mov dword [esp + 0x3c], 0x15
mov dword [esp + 0xb4], ebx
sub edi, eax
mov dword [esp + 0x30], edi
jmp 0x417618
mov dword [esi + 0x72e7a4], eax
jmp 0x417618
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x80]
and cl, 8
neg cl
lea eax, [edx + eax + 3]
cdq
sbb ecx, ecx
add ecx, 2
idiv ecx
mov ecx, dword [esp + 0x30]
add ecx, eax
cmp ecx, dword [esp + 0x104]
mov dword [esp + 0x30], ecx
jle 0x417618
mov dword [esp + 0x104], ecx
or dword [esi + 0x72e7ac], 1
mov ecx, dword [esp + 0x6c]
mov eax, ebp
imul eax, ecx
cdq
idiv dword [0x724aa0]
mov edx, dword [esi + 0x72e7a0]
add eax, 0x64
cmp edx, eax
jl 0x417791
cmp ecx, 1
jne case.0x417758.3
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x60]
movsx ecx, byte [eax + ecx*8 + 0x724a50]
mov dword [esi + 0x72e7a8], ecx
mov eax, dword [0x72e790]
mov edx, dword [0x72e78c]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x72e79c]
dec eax
cmp eax, 5
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x20], edx
ja case.default.0x417689
jmp dword [eax*4 + 0x418d68]
mov eax, dword [esi + 0x72e794]
add eax, 2
jmp 0x4176a4
mov eax, dword [esi + 0x72e794]
sub eax, 2
mov edi, dword [esp + 0x20]
and eax, 7
shl eax, 2
mov edx, dword [eax + 0x7272f0]
mov eax, dword [eax + 0x727350]
imul edx, edx, 0x245
add edi, edx
imul eax, eax, 0x245
mov dword [esp + 0x20], edi
jmp 0x417742
mov eax, dword [esi + 0x72e794]
inc eax
jmp 0x4176de
mov eax, dword [esi + 0x72e794]
dec eax
mov edi, dword [esp + 0x20]
and eax, 7
shl eax, 2
mov edx, dword [eax + 0x7272f0]
mov eax, dword [eax + 0x727350]
imul edx, edx, 0x12c
add edi, edx
imul eax, eax, 0x12c
mov dword [esp + 0x20], edi
jmp 0x417742
mov eax, dword [esi + 0x72e794]
jmp 0x417719
mov eax, dword [esi + 0x72e794]
sub eax, 4
mov edx, dword [esp + 0xc4]
mov ebx, dword [esp + 0x20]
and eax, 7
shl eax, 2
mov edi, dword [eax + 0x7272f0]
mov eax, dword [eax + 0x727350]
imul edi, edx
add ebx, edi
imul eax, edx
mov dword [esp + 0x20], ebx
add dword [esp + 0x24], eax
mov dword [0x72e7d8], ecx
mov eax, dword [esi + 0x72e7a8]
dec eax
cmp eax, 5
ja case.0x417758.3
jmp dword [eax*4 + 0x418d80]
mov dword [0x72e7d8], 1
jmp case.0x417758.3
mov dword [0x72e7d8], 2
jmp case.0x417758.3
mov dword [0x72e7d8], 6
jmp case.0x417758.3
mov dword [0x72e7d8], 5
inc dword [esp + 0x6c]
mov eax, dword [esp + 0x64]
cdq
sub eax, edx
sar eax, 1
test al, 1
jne 0x417ba6
mov eax, dword [esp + 0x64]
test al, 1
push 0
push 0xffffffffffffffff
push 0
push 0
jne 0x41780d
cmp eax, 2
jge 0x4177de
mov ecx, dword [esi + 0x72e794]
mov edx, dword [esi + 0x72e790]
mov eax, dword [esi + 0x72e78c]
sub ecx, 4
shl ecx, 0x1d
push ecx
mov ecx, dword [esp + 0x4c]
push 0
push edx
push eax
push ecx
jmp 0x41785e
mov edx, dword [esi + 0x72e794]
mov ecx, dword [esi + 0x72e790]
sub edx, 4
shl edx, 0x1d
push edx
mov edx, dword [esi + 0x72e78c]
push 0
push ecx
push edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov eax, dword [esp + eax*4 + 0xc0]
jmp 0x41785d
cmp eax, 2
jl 0x41783f
mov ecx, dword [esi + 0x72e794]
mov edx, dword [esi + 0x72e790]
shl ecx, 0x1d
push ecx
mov ecx, dword [esi + 0x72e78c]
push 0
push edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov edx, dword [esp + eax*4 + 0x9c]
push ecx
push edx
jmp 0x41785e
mov eax, dword [esi + 0x72e794]
mov ecx, dword [esi + 0x72e790]
mov edx, dword [esi + 0x72e78c]
shl eax, 0x1d
push eax
mov eax, dword [esp + 0x6c]
push 0
push ecx
push edx
push eax
mov edx, 0x3e8
call fcn.004bc2e0
mov ecx, dword [esi + 0x72e79c]
test ecx, ecx
mov ebx, eax
jne 0x41787f
mov ecx, dword [esi + 0x72e7a0]
push ecx
push 0
jmp 0x4178a2
mov eax, dword [esi + 0x72e7ac]
test al, 8
mov edx, dword [esi + 0x72e7a0]
push edx
je 0x417896
add ecx, 0x28
push ecx
jmp 0x4178a2
and al, 2
neg al
sbb eax, eax
and eax, 0x14
add eax, ecx
push eax
mov ecx, ebx
call fcn.004bc4e0
cmp dword [esp + 0x64], 1
jne 0x417ba6
mov edi, dword [0x72e7d8]
test edi, edi
je 0x417a1c
mov eax, dword [esp + 0x18]
test eax, eax
je 0x417a1c
mov eax, ebp
cdq
idiv dword [0x724aa0]
add eax, dword [0x72e7d0]
cdq
idiv ebp
lea eax, [ebp + ebp]
mov esi, edx
cdq
idiv dword [0x724aa0]
mov ecx, eax
cmp esi, ecx
jge 0x417a1c
xor edx, edx
mov eax, 0x80000000
div ecx
mov ecx, eax
imul ecx, esi
mov eax, 0x64
call fcn.004dcac0
mov esi, eax
mov eax, dword [esp + 0x3cc]
test eax, eax
jne 0x417974
lea eax, [edi + 0x5a]
xor edi, edi
mov ecx, ebx
call fcn.004bc830
dec eax
cmp esi, 0x32
jge 0x417947
lea ecx, [esi + esi]
push ecx
push eax
mov eax, dword [0x72e7d8]
add eax, 0x5a
mov edi, ebx
call fcn.004bc570
jmp 0x417a16
mov edx, dword [0x72e7d8]
push eax
add edx, 0x5a
push edx
mov ecx, ebx
call fcn.004bc4e0
lea eax, [esi + esi - 0x64]
push eax
mov eax, dword [0x72e7d8]
push 0
add eax, 0xa
mov edi, ebx
call fcn.004bc570
jmp 0x417a16
cmp edi, 5
je 0x4179db
cmp edi, 6
je 0x4179db
cmp edi, 4
je 0x4179db
cmp edi, 3
je 0x4179db
cmp dword [0x724aa0], 4
je 0x4179db
mov ecx, dword [0x85c158]
inc ecx
cmp ecx, 2
jge 0x4179a4
mov ecx, 2
jmp 0x4179ae
cmp ecx, 4
jle 0x4179ae
mov ecx, 4
mov edx, dword [0x72e7dc]
and dl, 8
neg dl
lea ebp, [edi + 0xa]
mov edi, dword [0x72e7cc]
lea eax, [esi + esi]
sbb edx, edx
and edx, 0x28
add edi, edx
cdq
idiv ecx
push eax
mov eax, dword [0x72e7d0]
push 0
push eax
push edi
jmp 0x4179ff
mov eax, dword [0x72e7dc]
mov ecx, dword [0x72e7cc]
and al, 8
neg al
push esi
push 0
lea ebp, [edi + 0xa]
sbb eax, eax
and eax, 0x28
add eax, ecx
mov ecx, dword [0x72e7d0]
push ecx
push eax
mov ecx, ebx
call fcn.004bc4e0
mov edi, eax
mov eax, ebp
call fcn.004bc570
mov ebp, dword [esp + 0xf4]
mov edi, dword [0x72e7d8]
mov eax, dword [esp + 0xdc]
test eax, eax
mov eax, dword [esp + 0x3c]
je 0x417aca
cmp eax, 0xffffffff
jne 0x417ad3
test byte [esp + 0x18], 0x20
jne 0x417ba6
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x417ba6
test edi, edi
je 0x417ba6
mov eax, ebp
cdq
sub eax, edx
mov edx, eax
mov eax, dword [0x72e7d0]
sar edx, 1
cmp eax, edx
jl 0x417a6b
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x12c
jge 0x417ba6
mov ecx, dword [0x85c158]
mov edx, 3
sub edx, ecx
jns 0x417a8e
xor edx, edx
jmp 0x417a98
cmp edx, 3
jle 0x417a98
mov edx, 3
mov ecx, 0x12c
sub ecx, eax
imul ecx, edx
imul ecx, ecx, 0x21
mov eax, 0x1b4e81b5
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push 0
mov eax, 0x16
mov edi, ebx
call fcn.004bc570
jmp 0x417ba6
cmp eax, 0xffffffff
je 0x417ba6
mov ecx, ebx
mov dword [esp + 0x134], 0
call fcn.004bc7a0
test eax, eax
je 0x417af2
xor edi, edi
call fcn.004bae90
jmp 0x417af9
fld dword [esp + 0x134]
fmul dword [0x7157e4]
call fcn.005f275c
mov ebp, dword [esp + 0xb4]
mov ecx, 1
sub ecx, eax
mov eax, ecx
cdq
sub eax, edx
mov esi, eax
sar esi, 1
mov eax, ebp
sub eax, esi
cdq
mov edi, eax
xor edi, edx
sub edi, edx
mov eax, esi
sub eax, edi
imul eax, eax, 0x190
cdq
idiv ecx
test eax, eax
jge 0x417b3b
xor eax, eax
jmp 0x417b45
cmp eax, 0x64
jle 0x417b45
mov eax, 0x64
mov esi, dword [esp + 0x3c]
push eax
push ebp
mov eax, esi
mov edi, ebx
call fcn.004bc570
test byte [0x85c164], 4
jne 0x417b67
add ebp, 0x19
mov dword [esp + 0xb4], ebp
mov eax, esi
mov ecx, ebx
mov dword [esp + 0x130], 0
call fcn.004bc7a0
test eax, eax
je 0x417b88
xor edi, edi
call fcn.004bae90
jmp 0x417b8f
fld dword [esp + 0x130]
fmul dword [0x715698]
call fcn.005f275c
cmp ebp, eax
jl 0x417ba6
mov dword [esp + 0x3c], 0xffffffff
mov esi, dword [esp + 0x64]
inc esi
cmp esi, 0x12
mov dword [esp + 0x64], esi
jl 0x4173e0
cmp dword [esp + 0x3c], 0x15
mov esi, dword [esp + 0xc8]
jne 0x417bd1
test esi, esi
jne 0x417bd9
mov esi, 1
jmp 0x417bd9
test esi, esi
je 0x417ca6
mov ebx, dword [esp + 0x100]
mov eax, 0x438
mov ecx, ebx
mov dword [esp + 0x138], 0
call fcn.004bc7a0
test eax, eax
je 0x417c04
xor edi, edi
call fcn.004bae90
jmp 0x417c0b
fld dword [esp + 0x138]
fmul dword [0x715698]
call fcn.005f275c
mov edi, eax
cmp esi, edi
jge 0x417c20
mov eax, esi
jmp 0x417c25
lea eax, [edi + edi]
sub eax, esi
push eax
push 0x438
push 0
push 0
push 0xe0000000
push 0
push 0x6d6
push 0xfffff92a
push ebx
mov edx, 0x3e8
call fcn.004bc2e0
mov ecx, dword [esp + 0xe0]
push esi
push 0x438
push 0
push 0
push 0xe0000000
push 0
push 0x6d6
push 0xfffff92a
push ecx
mov edx, 0x3e8
call fcn.004bc2e0
fld qword [0x8ca498]
fmul dword [0x715698]
call fcn.005f275c
add esi, eax
lea edx, [edi + edi]
cmp esi, edx
mov dword [esp + 0xc8], esi
jl 0x417d0b
mov dword [esp + 0xc8], 0
jmp 0x417d0b
mov eax, dword [0x8ca494]
mov ecx, dword [esp + 0x100]
push eax
push 0x3e9
push 0
push 0
push 0xe0000000
push 0
push 0x6d6
push 0xfffff92a
push ecx
mov edx, 0x3e8
call fcn.004bc2e0
mov edx, dword [0x8ca494]
mov eax, dword [esp + 0xe0]
push edx
push 0x3e9
push 0
push 0
push 0xe0000000
push 0
push 0x6d6
push 0xfffff92a
push eax
mov edx, 0x3e8
call fcn.004bc2e0
test byte [0x85c164], 4
mov ebx, dword [esp + 0x50]
jne 0x417e0d
mov eax, 0xea60
cdq
idiv ebx
mov ecx, dword [esp + 0x108]
mov ebp, dword [esp + 0xf0]
push 0
mov esi, eax
mov eax, 0x1f40
cdq
idiv ebx
mov edx, dword [0x72e7b4]
push esi
mov edi, eax
mov eax, dword [esp + 0x28]
lea eax, [edx + eax*2]
push edi
push ecx
add eax, dword [0x72e784]
cdq
and edx, 3
add eax, edx
mov ecx, eax
sar ecx, 2
mov eax, ebp
call fcn.004893a0
mov edx, dword [0x72e788]
mov ecx, dword [esp + 0x11c]
add ebp, eax
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x34]
push 0
push esi
mov esi, dword [esp + 0xf0]
lea eax, [edx + eax*2]
push edi
add eax, dword [0x72e7b8]
cdq
and edx, 3
add eax, edx
push ecx
mov ecx, eax
sar ecx, 2
mov eax, esi
mov dword [esp + 0x110], ebp
call fcn.004893a0
mov ecx, dword [esp + 0xd8]
mov ebp, dword [esp + 0x98]
add esi, eax
push 0
mov dword [esp + 0xfc], esi
mov esi, dword [0x72e798]
push 0x38e38e3
push 0x3cae75
mov dword [esp + 0x138], eax
shl esi, 0x1d
push ecx
mov eax, ebp
mov ecx, esi
call fcn.004893a0
add ebp, eax
mov dword [esp + 0xe8], eax
mov al, byte [esp + 0x48]
add esp, 0x30
test al, 1
mov dword [esp + 0x78], ebp
jne 0x417e11
mov ebp, esi
mov dword [esp + 0x78], ebp
jmp 0x417e11
mov ebp, dword [esp + 0x78]
mov edx, ebx
imul edx, edx, 0x5d34
mov ecx, 0x16c1564e
sub ecx, edx
lea edi, [ebx - 0x1b58]
mov eax, ebx
imul edi, edi, 0x9b58
cdq
push 0x2aaaaaaa
sub eax, edx
mov edx, dword [esp + 0xf4]
push 0
sar eax, 1
push eax
push 0x258
mov eax, ecx
mov ecx, dword [esp + 0xe8]
add edi, ebp
push edx
call fcn.004892c0
mov eax, dword [0x72e788]
mov ecx, dword [0x72e784]
mov edx, dword [esp + 0x30]
add esp, 0x14
push 0
push 0xffffffffffffffff
push 0
push 0
push ebp
push 0
push eax
push ecx
push edx
mov edx, 0x4b0
call fcn.004bc2e0
test byte [0x85c164], 4
mov esi, dword [0x85c158]
mov ebp, dword [esp + 0x30]
jne 0x417ef9
lea ecx, [esi + 2]
imul ecx, ebp
mov eax, 0x4b0
sub eax, ecx
lea eax, [eax + eax*4]
cmp eax, 0x866
jge 0x417eb3
mov eax, 0x866
jmp 0x417ebf
cmp eax, 0xfa0
jle 0x417ebf
mov eax, 0xfa0
cmp ebx, eax
jle 0x417eca
sub ebx, 5
mov dword [esp + 0x50], ebx
mov eax, 0x4ae
sub eax, ecx
lea eax, [eax + eax*4]
cmp eax, 0x866
jge 0x417ee2
mov eax, 0x866
jmp 0x417eee
cmp eax, 0xfa0
jle 0x417eee
mov eax, 0xfa0
cmp ebx, eax
jge 0x417ef9
add ebx, 0xa
mov dword [esp + 0x50], ebx
cmp ebp, 5
jge 0x417f1b
cmp esi, 2
jge 0x417f1b
test esi, esi
mov dword [0x8cc910], 1
jne 0x417f1b
or dword [0x85c164], 0x10000
mov eax, 0x1f4
cdq
lea ecx, [esi + 1]
idiv ecx
cmp ebp, eax
jle 0x417f34
mov dword [0x8cc910], 0
mov ebx, dword [0x8cc92c]
xor edx, edx
xor edi, edi
xor eax, eax
cmp ebx, 4
sete dl
cmp esi, edx
jle 0x417f61
mov ecx, dword [0x8cc910]
test ecx, ecx
jne 0x417f61
test byte [0x86baac], 2
jne 0x418006
mov edx, dword [0x72e7a8]
mov ebx, dword [esp + 0xe4]
mov ecx, 0x10
lea eax, [esp + 0x40]
mov byte [esp + 0x40], 0xff
mov byte [esp + 0x41], 5
mov byte [esp + 0x42], 0xff
mov byte [esp + 0x43], 1
mov byte [esp + 0x44], 0xff
mov byte [esp + 0x45], 2
mov byte [esp + 0x46], 4
mov byte [esp + 0x47], 6
mov byte [esp + 0x48], 3
sub eax, ecx
mov esi, 9
jmp 0x417fb0
test edx, edx
je 0x417fc5
movsx ebp, byte [eax + ecx]
cmp edx, ebp
jne 0x417fc5
mov ebp, 1
shl ebp, cl
or edi, ebp
cmp dword [esp + 0x6c], 2
je 0x417ff9
movsx ebp, byte [eax + ecx]
cmp edx, ebp
jne 0x417ff9
mov ebp, dword [esp + 0x18]
xor ebp, 0x4000
test ebx, ebx
mov dword [esp + 0x18], ebp
je 0x417ff9
test ebp, 0x4000
je 0x417ff9
mov ebp, 1
shl ebp, cl
not ebp
and edi, ebp
inc ecx
dec esi
jne 0x417fb0
mov ebp, dword [esp + 0x30]
mov eax, 1
push 4
push eax
push edi
mov word [0x86e330], 0
call fcn.00473ad0
add esp, 0xc
cmp ebp, 0xa
mov ecx, ebp
jge 0x418029
mov ecx, 0xa
jmp 0x418036
cmp ebp, 0x3e8
jle 0x418036
mov ecx, 0x3e8
mov eax, 0xfa0
cdq
idiv ecx
mov esi, dword [esp + 0xd4]
inc esi
mov dword [esp + 0xd4], esi
cmp esi, eax
jle 0x41805c
mov dword [esp + 0xd4], 0
mov eax, dword [esp + 0x70]
cmp eax, dword [esp + 0x5c]
jle 0x41818c
mov ebp, dword [esp + 0x80]
mov ebx, dword [esp + 0x94]
xor esi, esi
test ebp, ebp
jle 0x4180dc
xor edi, edi
push 0x33b40000
push 0x41200000
lea ecx, [edi + 0x40000000]
mov eax, 0x20
call fcn.004dcac0
mov ecx, 0x2c
sub ecx, eax
push ecx
mov eax, 0x28
mov ecx, edi
call fcn.004dcac0
mov ecx, eax
mov eax, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
lea ecx, [ecx + eax*8]
mov eax, dword [0x85c26c]
cdq
sub eax, edx
sar eax, 1
add ecx, eax
push ecx
push ebx
call fcn.004bc130
inc esi
add edi, 0x20000000
cmp esi, ebp
jl 0x418080
mov ebp, dword [esp + 0x30]
mov eax, 0x55555556
imul ebp
mov esi, edx
shr esi, 0x1f
add esi, edx
jns 0x4180f4
xor esi, esi
jmp 0x4180fe
cmp esi, 0x50
jle 0x4180fe
mov esi, 0x50
mov ecx, dword [esp + 0x54]
mov edi, dword [esp + 0x5c]
sub ecx, edi
cmp ecx, 0xa
jge 0x418114
mov ecx, 0xa
jmp 0x418121
cmp ecx, 0x2710
jle 0x418121
mov ecx, 0x2710
xor edx, edx
mov eax, 0x80000000
div ecx
mov ecx, eax
mov eax, dword [esp + 0x70]
sub eax, edi
imul ecx, eax
mov eax, esi
call fcn.004dcac0
mov ecx, eax
mov eax, 0x66666667
imul ebp
sar edx, 2
mov eax, edx
shr eax, 0x1f
add ecx, edx
lea eax, [eax + ecx + 0x28]
cmp eax, 0xa
jge 0x41815d
mov eax, 0xa
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0xdc], eax
mov eax, dword [0x85c26c]
fild dword [esp + 0xdc]
push 0x33b40000
push ecx
cdq
fstp dword [esp]
sub eax, edx
push 0x2c
sar eax, 1
push eax
push ebx
call fcn.004bc130
fld qword [0x8ca4b0]
fmul dword [0x7157e4]
call fcn.005f275c
mov ecx, dword [esp + 0x148]
neg ecx
sub ecx, eax
mov dword [esp + 0x74], ecx
lea esp, [esp]
mov esi, str.Dance
call fcn.0042e410
mov ebp, eax
cmp ebp, 0x2c8
jl 0x418225
cmp ebp, 0x2d4
jg 0x418225
lea eax, [ebp - 0x2c8]
cmp eax, 8
ja case.default.0x4181d7
jmp dword [eax*4 + 0x418d98]
mov ebp, 0x124
jmp case.default.0x4181d7
mov ebp, 0x126
jmp case.default.0x4181d7
mov ebp, 0x121
jmp case.default.0x4181d7
mov ebp, 0x125
jmp case.default.0x4181d7
mov ebp, 0x10c
jmp case.default.0x4181d7
mov ebp, 0x127
jmp case.default.0x4181d7
mov ebp, 0x123
jmp case.default.0x4181d7
mov ebp, 0x128
jmp case.default.0x4181d7
mov ebp, 0x122
mov dword [0x86e35c], 0
cmp ebp, 0x123
jg 0x4184e2
je 0x4184d6
cmp ebp, 0x68
jg 0x41847d
je 0x418468
test ebp, ebp
je 0x41854b
cmp ebp, 0x1b
je 0x4182ba
cmp ebp, 0x50
jne case.default.0x4184f7
mov eax, dword [0x85c164]
xor eax, 4
sub esp, 0x64
test al, 4
mov dword [0x85c164], eax
mov esi, 0x8cccd0
mov ebx, esp
je 0x4184a5
lea eax, [esp + 0x28c]
mov dword [esp + 0x2ec], esi
mov dword [esp + 0x28c], 0x31
mov dword [esp + 0x294], 0
call fcn.00498530
mov edi, 0x8e87b4
call fcn.004a1410
mov dword [esp + 0x288], esi
jmp 0x41854b
mov ebx, dword [0x85c164]
xor ebx, 4
sub esp, 0x64
mov dword [0x85c164], ebx
mov esi, 0x8cccd0
lea eax, [esp + 0x2f4]
mov ebx, esp
mov dword [esp + 0x354], esi
mov dword [esp + 0x2f4], 0x31
mov dword [esp + 0x2fc], 0
call fcn.00498530
mov edi, 0x8e87b4
call fcn.004a1410
mov ebx, dword [0x8ebfe8]
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x2f0], esi
call fcn.004bf620
mov ebx, dword [0x8ebfe8]
mov edi, dword [esp + 0x28]
call fcn.004bf620
mov ebx, dword [0x8ebfe8]
mov edi, dword [esp + 0x1c]
call fcn.004bf620
mov ebx, dword [0x8ebfe8]
mov edi, dword [esp + 0x14]
call fcn.004bf620
mov ebx, dword [0x8ec008]
call fcn.004bf620
mov al, byte [0x727d98]
mov ecx, dword [0x728820]
mov byte [ecx + 0x728814], al
mov edx, dword [0x728820]
inc edx
mov ebx, 1
cmp al, bl
mov dword [0x728820], edx
je 0x4183b0
mov ecx, dword [0x8cb7c0]
mov edx, dword [0x8cb7c4]
mov byte [ecx + 0xb4], bl
mov byte [edx + 0xb4], bl
mov eax, dword [0x8ebfe8]
push eax
call fcn.00536dc0
mov ecx, dword [0x8ebfe8]
push ecx
mov ecx, dword [0x8cb7c4]
call fcn.00536dc0
mov ecx, dword [0x8ccbe8]
push ebx
push 0
push 0
push 9
mov byte [0x727d98], bl
mov byte [0x8cbdf4], bl
call fcn.004b2890
call fcn.004810e0
mov ebx, dword [0x8ebfe8]
mov esi, dword [esp + 0x2c]
call fcn.004bf5b0
mov ebx, dword [0x8ebfe8]
mov esi, dword [esp + 0x28]
call fcn.004bf5b0
mov ebx, dword [0x8ebfe8]
mov esi, dword [esp + 0x1c]
call fcn.004bf5b0
mov ebx, dword [0x8ebfe8]
mov esi, dword [esp + 0x14]
call fcn.004bf5b0
mov ebx, dword [0x8ec008]
call fcn.004bf5b0
sub esp, 0x64
lea eax, [esp + 0x35c]
mov ebx, esp
mov dword [esp + 0x3bc], 0x8cccd0
mov dword [esp + 0x35c], 0x32
call fcn.00498530
mov edi, 0x8e87b4
call fcn.004a1410
mov eax, dword [0x85c164]
xor eax, 4
mov dword [esp + 0x358], 0x8cccd0
mov dword [0x85c164], eax
jmp 0x41854b
mov al, byte [0x7283bb]
test al, al
sete dl
mov byte [0x7283bb], dl
jmp 0x41854b
mov eax, ebp
sub eax, 0x113
je 0x41825c
sub eax, 0xe
je 0x4184d6
dec eax
jne case.default.0x4184f7
mov dword [0x72e7a4], 3
jmp 0x41854b
lea eax, [esp + 0x3c4]
mov dword [esp + 0x424], esi
mov dword [esp + 0x3c4], 0x32
call fcn.00498530
mov edi, 0x8e87b4
call fcn.004a1410
mov dword [esp + 0x3c0], esi
jmp 0x41854b
mov dword [0x72e7a4], 4
jmp 0x41854b
cmp ebp, 0x2d2
jg 0x418537
je 0x41852e
lea eax, [ebp - 0x124]
cmp eax, 4
ja case.default.0x4184f7
jmp dword [eax*4 + 0x418dbc]
mov dword [0x72e7a4], 5
jmp 0x41854b
mov dword [0x72e7a4], 6
jmp 0x41854b
mov dword [0x72e7a4], 2
jmp 0x41854b
mov dword [0x72e7a4], 1
jmp 0x41854b
mov byte [0x7283bb], 0
jmp 0x41854b
cmp ebp, 0x2d3
je 0x418544
or ebp, 0xffffffff
jmp 0x41854b
mov byte [0x7283bb], 1
mov bl, byte [0x85c164]
test bl, 4
mov edx, dword [0x72e7a0]
jne 0x4185bb
test ebp, ebp
jle 0x4185b3
mov ecx, dword [0x85c158]
mov eax, 0xa
sub eax, ecx
lea eax, [eax + eax*4]
shl eax, 2
cmp edx, eax
jl 0x418589
mov eax, dword [esp + 0xf4]
lea ecx, [ecx + ecx*4 - 0x19]
lea ecx, [eax + ecx*4]
cmp edx, ecx
jle 0x4185aa
cmp dword [esp + 0x9c], 2
jge 0x4185aa
mov eax, dword [0x72e7a4]
cmp eax, dword [0x72e79c]
jne 0x4185aa
mov dword [0x72e778], 1
inc dword [esp + 0x9c]
test ebp, ebp
jne 0x4181b0
jmp 0x4185c5
mov dword [0x72e7a4], 0
test bl, 0x20
je 0x418604
mov ecx, dword [esp + 0x4c]
push edx
push ecx
push 0x6fd89c
mov esi, 0x8ebf58
call fcn.004f7660
mov edx, dword [0x85c11c]
add esp, 0xc
push 0
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push edx
push 4
push 4
push 0x86bb48
xor eax, eax
call fcn.004b0b40
add esp, 0x20
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
mov edi, dword [esp + 0x7c]
mov edi, edi
test byte [0x8ef61c], 1
jne 0x418627
or dword [0x8ef61c], 1
call esi
mov dword [0x8ef618], eax
call esi
mov edx, dword [0x8ef618]
sub eax, edi
sub eax, edx
cmp eax, 0xa
jl 0x418610
test byte [0x85c164], 4
je 0x41864e
push 0xff000000
call fcn.004b0230
add esp, 4
push 0
push 0
push 0
call fcn.004d1a40
mov eax, dword [esp + 0x24]
add esp, 0xc
test al, 0x10
jne 0x418670
or eax, 0x10
mov dword [esp + 0x18], eax
jmp 0x418764
test al, 8
jne 0x418764
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call ebp
sub esp, 0x64
mov esi, 0x8cccd0
lea eax, [esp + 0x1fc]
mov ebx, esp
mov dword [esp + 0x25c], esi
mov dword [esp + 0x1fc], 0x1d
mov dword [esp + 0x234], 0x8c9348
mov dword [esp + 0x204], 1
call fcn.00498530
mov edi, 0x8e87b4
call fcn.004a1410
mov dword [esp + 0x1f8], esi
mov eax, dword [0x8eaec4]
sub eax, dword [0x8eaec8]
jns 0x4186e1
add eax, 0x64
test eax, eax
je 0x4186eb
push 1
call ebp
jmp 0x4186d1
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
call esi
test eax, eax
mov dword [esp + 0x7c], eax
fild dword [esp + 0x7c]
jge 0x418705
fadd qword [0x7155a0]
fadd qword [0x7158e0]
fstp qword [esp + 0x148]
fld qword [0x8ca4b0]
fmul dword [0x715698]
call fcn.005f275c
mov dword [esp + 0x98], eax
call esi
test eax, eax
mov dword [esp + 0x7c], eax
fild dword [esp + 0x7c]
jge 0x41873e
fadd qword [0x7155a0]
fcomp qword [esp + 0x148]
fnstsw ax
test ah, 0x41
je 0x418759
mov eax, dword [0x8ef510]
cmp eax, dword [0x8cc90c]
jle 0x418712
mov eax, dword [esp + 0x18]
or eax, 8
mov dword [esp + 0x18], eax
mov cl, byte [0x8ccc27]
test cl, cl
jne 0x418776
test al, 4
je 0x416a47
mov eax, dword [0x7288e8]
test eax, eax
mov word [0x86e330], 0
je 0x418833
mov esi, dword [0x7288e0]
test esi, esi
je 0x4187c1
mov edi, dword [esp + 0x34]
lea ebx, [ebx]
lea eax, [esi + 8]
mov eax, dword [eax]
cmp dword [eax], edi
mov esi, dword [esi]
jne 0x4187bd
push eax
push 0x7288dc
call fcn.004ab2e0
mov byte [0x8cbdf4], 1
test esi, esi
jne 0x4187a0
mov eax, dword [0x7288e8]
test eax, eax
je 0x418833
mov esi, dword [0x7288e0]
test esi, esi
je 0x4187f9
mov edi, dword [esp + 0x2c]
lea eax, [esi + 8]
mov eax, dword [eax]
cmp dword [eax], edi
mov esi, dword [esi]
jne 0x4187f5
push eax
push 0x7288dc
call fcn.004ab2e0
mov byte [0x8cbdf4], 1
test esi, esi
jne 0x4187d8
mov eax, dword [0x7288e8]
test eax, eax
je 0x418833
mov esi, dword [0x7288e0]
test esi, esi
je 0x418833
mov ebp, dword [esp + 0x28]
lea eax, [esi + 8]
mov eax, dword [eax]
cmp dword [eax], ebp
mov esi, dword [esi]
jne 0x41882d
push eax
push 0x7288dc
call fcn.004ab2e0
mov byte [0x8cbdf4], 1
test esi, esi
jne 0x418810
jmp 0x418837
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x34]
push 0xffffffffffffffff
push 0x64
push str.candle
push esi
call fcn.004c1750
mov ebx, dword [esp + 0x2c]
push 0xffffffffffffffff
push 0x64
push str.fireplace
push esi
call fcn.004c1750
push 0xffffffffffffffff
push 0x64
push str.fireplace
push esi
mov ebx, ebp
call fcn.004c1750
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x84]
add edi, 0x78
mov dword [esp + 0x40], 0x426a50e5
mov eax, dword [esp + 0x40]
mov dword [ebx + 0x78], eax
mov dword [esp + 0x44], 0xc2a191ec
mov ecx, dword [esp + 0x44]
mov dword [ebx + 0x7c], ecx
mov dword [esp + 0x48], 0x43235a1d
mov edx, dword [esp + 0x48]
mov dword [ebx + 0x80], edx
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov edi, dword [esp + 0x88]
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], ecx
mov dword [edi + 0x80], edx
add edi, 0x78
mov edi, dword [esp + 0x8c]
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], ecx
mov dword [edi + 0x80], edx
add edi, 0x78
mov edi, dword [esp + 0x90]
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], ecx
mov dword [edi + 0x80], edx
add edi, 0x78
mov edi, dword [esp + 0xa4]
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], ecx
mov dword [edi + 0x80], edx
add edi, 0x78
mov edi, dword [esp + 0xa8]
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], ecx
mov dword [edi + 0x80], edx
add edi, 0x78
mov edi, dword [esp + 0xac]
mov dword [edi + 0x78], eax
add edi, 0x78
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov edi, dword [esp + 0xb0]
add edi, 0x78
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov edi, dword [esp + 0x58]
mov dword [edi + 0x78], eax
mov al, byte [0x8cc914]
test al, al
mov dword [edi + 0x7c], ecx
mov dword [edi + 0x80], edx
je 0x41897f
mov eax, esi
call fcn.004bb170
mov edx, dword [eax]
push str.dance_hide_01
mov ecx, eax
call dword [edx + 0x40]
test eax, eax
je 0x41897f
and byte [eax + 0x20], 0xfe
mov al, byte [0x8ccc27]
test al, al
mov byte [0x8cc914], 0
jne 0x4189d2
mov eax, dword [esp + 0x30]
cmp eax, 0x32
jg 0x4189a7
lea eax, [esp + 0x114]
push eax
push esi
push edi
push ebx
push 0x46
jmp 0x4189ca
cmp eax, 0xfa
jge 0x4189bd
lea ecx, [esp + 0x114]
push ecx
push esi
push edi
push ebx
push 0x47
jmp 0x4189ca
lea edx, [esp + 0x114]
push edx
push esi
push edi
push ebx
push 0x48
call fcn.00418dd0
add esp, 0x14
call fcn.004810e0
mov ecx, dword [esp + 0x158]
mov eax, dword [esp + 0x154]
mov edx, dword [esp + 0x15c]
mov dword [0x8ccde4], ecx
mov ecx, dword [0x8ec08c]
mov dword [0x8ccde0], eax
mov dword [0x8ccde8], edx
mov eax, dword [ecx]
push 0x8ccde0
call dword [eax + 0x74]
mov edi, dword [esp + 0x34]
push str.candle
push esi
mov eax, edi
call fcn.004c1820
mov ebx, dword [esp + 0x2c]
push str.fireplace
push esi
mov eax, ebx
call fcn.004c1820
push str.fireplace
push esi
mov eax, ebp
call fcn.004c1820
mov eax, dword [0x7288e8]
test eax, eax
je 0x418ae1
mov esi, dword [0x7288e0]
test esi, esi
je 0x418a74
lea eax, [esi + 8]
mov eax, dword [eax]
cmp dword [eax], edi
mov esi, dword [esi]
jne 0x418a70
push eax
push 0x7288dc
call fcn.004ab2e0
mov byte [0x8cbdf4], 1
test esi, esi
jne 0x418a53
mov eax, dword [0x7288e8]
test eax, eax
je 0x418ae1
mov esi, dword [0x7288e0]
test esi, esi
je 0x418aa8
lea eax, [esi + 8]
mov eax, dword [eax]
cmp dword [eax], ebx
mov esi, dword [esi]
jne 0x418aa4
push eax
push 0x7288dc
call fcn.004ab2e0
mov byte [0x8cbdf4], 1
test esi, esi
jne 0x418a87
mov eax, dword [0x7288e8]
test eax, eax
je 0x418ae1
mov esi, dword [0x7288e0]
test esi, esi
je 0x418ae1
jmp 0x418ac0
lea eax, [esi + 8]
mov eax, dword [eax]
cmp dword [eax], ebp
mov esi, dword [esi]
jne 0x418add
push eax
push 0x7288dc
call fcn.004ab2e0
mov byte [0x8cbdf4], 1
test esi, esi
jne 0x418ac0
mov ebp, dword [esp + 0x2c]
mov ebx, dword [0x8ebfe8]
mov edi, ebp
call fcn.004bf620
mov esi, dword [esp + 0x28]
mov ebx, dword [0x8ebfe8]
mov edi, esi
call fcn.004bf620
mov ebx, dword [0x8ebfe8]
mov edi, dword [esp + 0x1c]
call fcn.004bf620
mov ebx, dword [0x8ebfe8]
mov edi, dword [esp + 0x14]
call fcn.004bf620
mov ebx, dword [0x8ec008]
call fcn.004bf620
mov ecx, dword [esp + 0x94]
test ecx, ecx
je 0x418b3d
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0xfc]
test ecx, ecx
je 0x418b4e
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0xf8]
test ecx, ecx
je 0x418b5f
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x418b75
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx]
push 1
call dword [eax]
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x58]
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0xa4]
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0xa8]
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0xac]
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0xb0]
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x84]
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x88]
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x8c]
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x90]
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0xa0]
test ecx, ecx
je 0x418c1d
mov edx, dword [ecx]
push 1
call dword [edx]
or dword [0x86baac], 2
call fcn.004a7620
mov eax, dword [0x728a84]
dec eax
mov dword [0x728a84], eax
mov eax, dword [eax*4 + 0x7288f4]
mov dword [0x7283bc], eax
mov eax, dword [0x85c164]
test eax, 0x10000
jne 0x418c58
cmp dword [esp + 0x30], 0x32
jge 0x418c58
or eax, 0x40000
and eax, 0xfffeffff
lea ecx, [esp + 0x164]
mov dword [0x85c164], eax
mov dword [esp + 0x164], 0x6f7814
call fcn.004f64c0
lea ecx, [esp + 0x164]
mov dword [esp + 0x164], 0x6f7864
call fcn.004f24a0
mov eax, dword [esp + 0x180]
add eax, 0xfffffff8
je 0x418cac
cmp eax, 0x8cccc8
je 0x418cac
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
lea eax, [esp + 0x114]
mov dword [esp + 0x180], 0x8cccd0
call fcn.004d5b80
mov ecx, dword [esp + 0xbc]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3b8
ret