Function at 0x48c0c0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2b4
mov eax, dword [0x72ed74]
push ebx
push ebp
mov ebp, dword [esp + 0x2c0]
push esi
mov dword [0x72e774], ebp
mov cl, byte [eax + 0xf0]
push edi
mov byte [esp + 0x2b], cl
call fcn.004e4740
xor edi, edi
cmp ebp, 0xffffffff
jne 0x48c190
xor ebp, ebp
push str.Choose_Town__n_Spanish._n_English._n_French._n_Dutch._n
mov esi, 0x8ebf58
mov dword [esp + 0x2cc], ebp
call fcn.004f7660
add esp, 4
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
call fcn.00430160
add esp, 0x28
cmp al, 0xff
mov byte [0x862b74], al
je 0x48c182
push str.Choose_Prosperity__n_Poor_n_Rich_n
mov dword [0x72e774], edi
call fcn.004f7660
mov ecx, dword [0x85c268]
add esp, 4
push edi
push edi
mov eax, 0x55555556
imul ecx
push 0xffffffffffffffff
push edi
push edi
push 0xffffffffffffffff
mov eax, edx
push edi
shr eax, 0x1f
push edi
add eax, edx
push eax
push edi
call fcn.00430160
add esp, 0x28
dec eax
neg eax
sbb eax, eax
and eax, 0xffffff39
add eax, 0xc7
cmp eax, 0xffffffff
mov dword [0x862b7c], eax
jne 0x48c190
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2b4
ret
mov esi, dword [0x8cccd8]
cmp esi, edi
jne 0x48c1a8
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorA]
mov esi, eax
call dword [sym.imp.USER32.dll_GetCursor]
mov ecx, esi
push ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], esi
call dword [sym.imp.USER32.dll_SetCursor]
call fcn.00491440
mov edx, dword [0x8cb7d0]
add edx, 0x10
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [esp + 0x8c], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x90], ecx
mov ecx, dword [edx + 0xc]
push str.data_sneak.ini
lea edx, [esp + 0x68]
push edx
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], ecx
mov dword [esp + 0x74], edi
mov dword [esp + 0x80], 1
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], edi
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], 0x71298c
call fcn.004fa530
mov ebx, str.SNEAK
lea esi, [esp + 0x64]
call fcn.004fac30
mov eax, dword [esp + 0x2d0]
mov ecx, dword [esp + 0x2d4]
lea edx, [esp + 0x58]
push edx
mov edi, str.AmbientRed
mov ebx, esi
mov dword [0x8ccb18], eax
mov dword [0x72808c], ecx
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.004fadb0
lea eax, [esp + 0x5c]
push eax
mov edi, str.AmbientGreen
call fcn.004fadb0
lea ecx, [esp + 0x60]
push ecx
mov edi, str.AmbientBlue
call fcn.004fadb0
lea edx, [esp + 0x40]
push edx
mov edi, str.DirRed
call fcn.004fadb0
lea eax, [esp + 0x44]
push eax
mov edi, str.DirGreen
call fcn.004fadb0
lea ecx, [esp + 0x48]
push ecx
mov edi, str.DirBlue
call fcn.004fadb0
lea edx, [esp + 0x30]
push edx
mov edi, str.IntesityMod
call fcn.004fadb0
lea eax, [esp + 0x38]
push eax
mov edi, str.RedGreenMod
call fcn.004fadb0
lea ecx, [esp + 0x10]
push ecx
mov edi, str.Ambient
call fcn.004fadb0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x38]
push edx
push eax
mov ecx, dword [esp + 0x38]
mov eax, dword [0x8ccc58]
push ecx
call fcn.004dd250
mov ecx, dword [0x8ec08c]
lea eax, [esp + 0x9c]
mov dword [esp + 0x9c], 0x3d4ccccd
mov dword [esp + 0xa0], 0x3d4ccccd
mov dword [esp + 0xa4], 0x3eb33333
mov edx, dword [ecx]
push eax
call dword [edx + 0x74]
xor eax, eax
mov ecx, 0xe
mov edi, 0x8c4d60
push 0xc0
rep stosd dword es:[edi], eax
call fcn.005354b8
mov esi, eax
xor edi, edi
add esp, 4
cmp esi, edi
je 0x48c40c
mov eax, dword [0x8ec000]
mov edx, dword [0x729444]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
mov dword [esi + 4], edi
mov dword [esi], 0x6ff14c
push edi
mov dword [esi + 0x1c], edi
inc edx
push eax
mov dword [esi + 0x64], edi
xor ebx, ebx
mov eax, str.fx_torch_fire.nif
mov ecx, esi
mov dword [0x729444], edx
mov dword [esi + 0xbc], edi
call fcn.004be370
mov eax, dword [esi + 4]
inc eax
mov dword [esp + 0x34], esi
mov dword [esi + 4], eax
mov ecx, dword [0x8ccc58]
push 1
push ecx
call fcn.004de580
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c412
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_dock.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d5c], eax
xor edi, edi
jmp 0x48c418
mov dword [esp + 0x34], edi
jmp 0x48c3c5
mov dword [0x8c4d5c], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c451
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_sign.nif
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d44], eax
xor edi, edi
jmp 0x48c457
mov dword [0x8c4d44], edi
mov edx, dword [0x8ebffc]
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push 9
or ecx, 0xffffffff
call fcn.004814c0
mov edx, dword [0x8ebffc]
push edi
push edi
push edi
push 0xffffffffffffffff
push 1
push 9
or ecx, 0xffffffff
mov dword [0x8c4d48], eax
call fcn.004814c0
mov edx, dword [0x8ebffc]
push edi
push edi
push edi
push 0xffffffffffffffff
push 2
push 9
or ecx, 0xffffffff
mov dword [0x8c4d4c], eax
call fcn.004814c0
shl ebp, 5
mov dword [0x8c4d50], eax
movsx eax, byte [ebp + 0x862b74]
add esp, 0x48
sub eax, edi
mov dword [esp + 0x14], ebp
push 0xc0
je 0x48cf20
sub eax, 2
je 0x48cbb2
dec eax
mov eax, dword [ebp + 0x862b7c]
je 0x48c848
cmp eax, 0x50
jl 0x48c507
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c53b
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_2h.nif
push edx
jmp 0x48c529
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c53b
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_2h_d.nif
push ecx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d68], eax
xor edi, edi
jmp 0x48c541
mov dword [0x8c4d68], edi
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x862b7c]
mov ebp, 0x78
cmp eax, ebp
push 0xc0
jl 0x48c57d
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c5b1
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_1h.nif
push ecx
jmp 0x48c59f
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c5b1
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_1h_d.nif
push edx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d6c], eax
xor edi, edi
jmp 0x48c5b7
mov dword [0x8c4d6c], edi
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x862b7c], 0x50
push 0xc0
jl 0x48c5ed
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c621
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_2hb.nif
push ecx
jmp 0x48c60f
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c621
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_2hb_d.nif
push edx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d90], eax
xor edi, edi
jmp 0x48c627
mov dword [0x8c4d90], edi
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x862b7c], ebp
push 0xc0
jl 0x48c65c
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c690
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_1hb.nif
push ecx
jmp 0x48c67e
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c690
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_1hb_d.nif
push edx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d94], eax
xor edi, edi
jmp 0x48c696
mov dword [0x8c4d94], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c6cf
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_wall.nif
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d70], eax
xor edi, edi
jmp 0x48c6d5
mov dword [0x8c4d70], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c70e
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_block.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d64], eax
xor edi, edi
jmp 0x48c714
mov dword [0x8c4d64], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c75c
cmp dword [esp + 0x2d4], edi
mov ecx, str.jail.nif
jne 0x48c738
mov ecx, str.ts_e_gov.nif
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push ecx
mov ecx, dword [0x8ebfec]
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d84], eax
xor edi, edi
jmp 0x48c762
mov dword [0x8c4d84], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c79b
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_tav.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d88], eax
xor edi, edi
jmp 0x48c7a1
mov dword [0x8c4d88], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c7da
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_obj_1.nif
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d78], eax
xor edi, edi
jmp 0x48c7e0
mov dword [0x8c4d78], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c819
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_church.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d58], eax
xor edi, edi
jmp 0x48c81f
mov dword [0x8c4d58], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d29e
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_courtyard.nif
jmp 0x48d285
cmp eax, 0x50
jl 0x48c871
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c8a5
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_d_2sh_a.nif
push edx
jmp 0x48c893
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c8a5
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_d_2sh_a_d.nif
push ecx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d68], eax
xor edi, edi
jmp 0x48c8ab
mov dword [0x8c4d68], edi
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x862b7c]
mov ebp, 0x78
cmp eax, ebp
push 0xc0
jl 0x48c8e7
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c91b
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_d_1sh.nif
push ecx
jmp 0x48c909
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c91b
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_d_1sh_d.nif
push edx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d6c], eax
xor edi, edi
jmp 0x48c921
mov dword [0x8c4d6c], edi
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x862b7c], 0x50
push 0xc0
jl 0x48c957
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c98b
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_d_2sh_b.nif
push ecx
jmp 0x48c979
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c98b
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_d_2sh_b_d.nif
push edx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d90], eax
xor edi, edi
jmp 0x48c991
mov dword [0x8c4d90], edi
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x862b7c], ebp
push 0xc0
jl 0x48c9c6
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c9fa
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_d_1shb.nif
push ecx
jmp 0x48c9e8
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48c9fa
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_d_1shb_d.nif
push edx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d94], eax
xor edi, edi
jmp 0x48ca00
mov dword [0x8c4d94], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48ca39
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_d_wall.nif
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d70], eax
xor edi, edi
jmp 0x48ca3f
mov dword [0x8c4d70], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48ca78
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_d_blck.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d64], eax
xor edi, edi
jmp 0x48ca7e
mov dword [0x8c4d64], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cac6
cmp dword [esp + 0x2d4], edi
mov ecx, str.jail.nif
jne 0x48caa2
mov ecx, str.ts_d_gov.nif
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push ecx
mov ecx, dword [0x8ebfec]
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d84], eax
xor edi, edi
jmp 0x48cacc
mov dword [0x8c4d84], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cb05
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_d_tav.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d88], eax
xor edi, edi
jmp 0x48cb0b
mov dword [0x8c4d88], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cb44
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_d_obj_01.nif
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d78], eax
xor edi, edi
jmp 0x48cb4a
mov dword [0x8c4d78], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cb83
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_church.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d58], eax
xor edi, edi
jmp 0x48cb89
mov dword [0x8c4d58], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d29e
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_d_courtyard.nif
jmp 0x48d285
cmp dword [ebp + 0x862b7c], 0x50
jl 0x48cbdf
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cc13
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_f_2sha.nif
push edx
jmp 0x48cc01
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cc13
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_f_2sha_d.nif
push ecx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d68], eax
xor edi, edi
jmp 0x48cc19
mov dword [0x8c4d68], edi
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x862b7c]
mov ebp, 0x78
cmp eax, ebp
push 0xc0
jl 0x48cc55
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cc89
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_f_1sha.nif
push ecx
jmp 0x48cc77
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cc89
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_f_1sha_d.nif
push edx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d6c], eax
xor edi, edi
jmp 0x48cc8f
mov dword [0x8c4d6c], edi
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x862b7c], 0x50
push 0xc0
jl 0x48ccc5
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48ccf9
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_f_2shb.nif
push ecx
jmp 0x48cce7
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48ccf9
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_f_2shb_d.nif
push edx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d90], eax
xor edi, edi
jmp 0x48ccff
mov dword [0x8c4d90], edi
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x862b7c], ebp
push 0xc0
jl 0x48cd34
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cd68
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_f_1shb.nif
push ecx
jmp 0x48cd56
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cd68
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_f_1shb_d.nif
push edx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d94], eax
xor edi, edi
jmp 0x48cd6e
mov dword [0x8c4d94], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cda7
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_f_wall.nif
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d70], eax
xor edi, edi
jmp 0x48cdad
mov dword [0x8c4d70], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cde6
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_f_block.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d64], eax
xor edi, edi
jmp 0x48cdec
mov dword [0x8c4d64], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48ce34
cmp dword [esp + 0x2d4], edi
mov ecx, str.jail.nif
jne 0x48ce10
mov ecx, str.ts_f_gov.nif
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push ecx
mov ecx, dword [0x8ebfec]
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d84], eax
xor edi, edi
jmp 0x48ce3a
mov dword [0x8c4d84], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48ce73
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_f_tav.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d88], eax
xor edi, edi
jmp 0x48ce79
mov dword [0x8c4d88], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48ceb2
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_f_obj_1.nif
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d78], eax
xor edi, edi
jmp 0x48ceb8
mov dword [0x8c4d78], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cef1
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_church.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d58], eax
xor edi, edi
jmp 0x48cef7
mov dword [0x8c4d58], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d29e
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_f_courtyard.nif
jmp 0x48d285
cmp dword [ebp + 0x862b7c], 0x50
jl 0x48cf4d
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cf81
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_s_2sha.nif
push edx
jmp 0x48cf6f
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cf81
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_s_2sha_d.nif
push ecx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d68], eax
xor edi, edi
jmp 0x48cf87
mov dword [0x8c4d68], edi
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x862b7c]
mov ebp, 0x78
cmp eax, ebp
push 0xc0
jl 0x48cfc3
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cff7
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_s_1sha.nif
push ecx
jmp 0x48cfe5
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48cff7
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_s_1sha_d.nif
push edx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d6c], eax
xor edi, edi
jmp 0x48cffd
mov dword [0x8c4d6c], edi
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x862b7c], 0x50
push 0xc0
jl 0x48d033
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d067
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_s_2shb.nif
push ecx
jmp 0x48d055
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d067
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_s_2shb_d.nif
push edx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d90], eax
xor edi, edi
jmp 0x48d06d
mov dword [0x8c4d90], edi
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x862b7c], ebp
push 0xc0
jl 0x48d0a2
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d0d6
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_s_1shb.nif
push ecx
jmp 0x48d0c4
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d0d6
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_s_1shb_d.nif
push edx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4d94], eax
xor edi, edi
jmp 0x48d0dc
mov dword [0x8c4d94], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d115
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_s_wall.nif
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d70], eax
xor edi, edi
jmp 0x48d11b
mov dword [0x8c4d70], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d154
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_s_block.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d64], eax
xor edi, edi
jmp 0x48d15a
mov dword [0x8c4d64], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d1a2
cmp dword [esp + 0x2d4], edi
mov ecx, str.jail.nif
jne 0x48d17e
mov ecx, str.ts_s_gov.nif
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push ecx
mov ecx, dword [0x8ebfec]
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d84], eax
xor edi, edi
jmp 0x48d1a8
mov dword [0x8c4d84], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d1e1
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_s_tav.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d88], eax
xor edi, edi
jmp 0x48d1e7
mov dword [0x8c4d88], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d220
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_s_obj_1.nif
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d78], eax
xor edi, edi
jmp 0x48d226
mov dword [0x8c4d78], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d25f
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_s_church.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d58], eax
xor edi, edi
jmp 0x48d265
mov dword [0x8c4d58], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d29e
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_s_courtyard.nif
mov ecx, dword [0x8ebfec]
mov esi, eax
xor ebx, ebx
push ecx
call fcn.004bb100
mov dword [0x8c4d54], eax
xor edi, edi
jmp 0x48d2a4
mov dword [0x8c4d54], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d2dd
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_obj_2.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d60], eax
xor edi, edi
jmp 0x48d2e3
mov dword [0x8c4d60], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d31c
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_grnd.dds
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d74], eax
xor edi, edi
jmp 0x48d322
mov dword [0x8c4d74], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d35b
mov edx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_e_hide_1.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d7c], eax
xor edi, edi
jmp 0x48d361
mov dword [0x8c4d7c], edi
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d39a
mov ecx, dword [0x8ebfec]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.ts_palm.nif
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov dword [0x8c4d80], eax
xor edi, edi
jmp 0x48d3a0
mov dword [0x8c4d80], edi
cmp dword [esp + 0x2d4], edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
je 0x48d3c6
mov edx, dword [0x8ebffc]
push str.pc_sneak_rags.kfm
push ecx
mov eax, esp
mov dword [eax], edx
jmp 0x48d3d6
push str.pc_sneak_base.kfm
push ecx
mov ecx, dword [0x8ebffc]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [eax]
cmp eax, edi
je 0x48d3df
inc dword [eax + 4]
call fcn.004afb00
mov edx, dword [0x8ccc58]
mov cl, byte [edx + 0x24c]
add esp, 0x30
sub esp, 0xc
test cl, cl
mov ecx, esp
mov dword [0x8c4cf0], eax
mov dword [esp + 0x2c], 0xbf800000
mov dword [esp + 0x28], 0x3f800000
push eax
je 0x48d4be
mov dword [esp + 0x28], 0x3f800000
mov edx, dword [esp + 0x28]
mov dword [ecx], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x30]
mov dword [ecx + 8], edx
call fcn.004bddd0
sub esp, 0xc
mov eax, esp
mov dword [esp + 0x24], 0x3f800000
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [esp + 0x28], 0x3f800000
mov edx, dword [esp + 0x28]
mov dword [eax + 4], edx
mov edx, dword [0x8c4d48]
mov dword [esp + 0x2c], 0xbf800000
mov ecx, dword [esp + 0x2c]
push edx
mov dword [eax + 8], ecx
call fcn.004bddd0
sub esp, 0xc
mov eax, esp
mov dword [esp + 0x24], 0x3f800000
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [esp + 0x28], 0x3f800000
mov edx, dword [esp + 0x28]
mov dword [eax + 4], edx
mov edx, dword [0x8c4d4c]
mov dword [esp + 0x2c], 0xbf800000
mov ecx, dword [esp + 0x2c]
push edx
mov dword [eax + 8], ecx
call fcn.004bddd0
mov dword [esp + 0x18], 0x3f800000
jmp 0x48d561
mov dword [esp + 0x28], 0xbf800000
mov edx, dword [esp + 0x28]
mov dword [ecx], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x30]
mov dword [ecx + 8], edx
call fcn.004bddd0
sub esp, 0xc
mov eax, esp
mov dword [esp + 0x24], 0xbf800000
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [esp + 0x28], 0x3f800000
mov edx, dword [esp + 0x28]
mov dword [eax + 4], edx
mov edx, dword [0x8c4d48]
mov dword [esp + 0x2c], 0xbf800000
mov ecx, dword [esp + 0x2c]
push edx
mov dword [eax + 8], ecx
call fcn.004bddd0
sub esp, 0xc
mov eax, esp
mov dword [esp + 0x24], 0xbf800000
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [esp + 0x28], 0x3f800000
mov edx, dword [esp + 0x28]
mov dword [eax + 4], edx
mov edx, dword [0x8c4d4c]
mov dword [esp + 0x2c], 0xbf800000
mov ecx, dword [esp + 0x2c]
push edx
mov dword [eax + 8], ecx
call fcn.004bddd0
mov dword [esp + 0x18], 0xbf800000
mov ecx, dword [esp + 0x18]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov dword [esp + 0x28], 0x3f800000
mov edx, dword [esp + 0x28]
mov dword [eax + 4], edx
mov edx, dword [0x8c4d50]
mov dword [esp + 0x2c], 0xbf800000
mov ecx, dword [esp + 0x2c]
push edx
mov dword [eax + 8], ecx
call fcn.004bddd0
mov eax, dword [esp + 0x14]
movsx eax, byte [eax + 0x862b74]
dec eax
push 0xc0
je 0x48d63b
dec eax
je 0x48d609
dec eax
je 0x48d5ec
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d66d
mov ecx, dword [0x8ebffc]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.twn_grd_s.kfm
push ecx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4c70], eax
jmp 0x48d673
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d66d
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.twn_grd_d.kfm
jmp 0x48d656
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d66d
mov ecx, dword [0x8ebffc]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.twn_grd_f.kfm
push ecx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4c70], eax
jmp 0x48d673
call fcn.005354b8
add esp, 4
cmp eax, edi
je 0x48d66d
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push edi
push edi
push edi
push edi
push str.twn_grd_e.kfm
mov edx, dword [0x8ebffc]
push edx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
mov dword [0x8c4c70], eax
jmp 0x48d673
mov dword [0x8c4c70], edi
mov esi, 4
xor ebx, ebx
lea ebx, [ebx]
mov ecx, dword [0x8c4c70]
push ebx
call fcn.004bbbd0
mov dword [esi + 0x8c4c70], eax
add esi, 4
cmp esi, 0x80
jb 0x48d680
push 0xc0
call fcn.005354b8
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x48d6f8
mov eax, dword [0x8ebfec]
mov edi, dword [0x729444]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
push ebx
mov dword [esi + 4], ebx
push ebx
mov dword [esi], 0x6ff14c
mov dword [esi + 0x1c], ebx
push ebx
mov dword [esi + 0x64], ebx
inc edi
mov dword [esi + 0xbc], ebx
push eax
xor ebx, ebx
mov eax, str.columnfire.nif
mov ecx, esi
mov dword [0x729444], edi
call fcn.004be370
mov dword [0x8c4c68], esi
jmp 0x48d6fe
mov dword [0x8c4c68], ebx
push 0xc0
call fcn.005354b8
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x48d753
mov eax, dword [0x8ebfec]
mov edi, dword [0x729444]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
push ebx
mov dword [esi + 4], ebx
push ebx
mov dword [esi], 0x6ff14c
mov dword [esi + 0x1c], ebx
push ebx
mov dword [esi + 0x64], ebx
inc edi
mov dword [esi + 0xbc], ebx
push eax
xor ebx, ebx
mov eax, str.Ground.nif
mov ecx, esi
mov dword [0x729444], edi
call fcn.004be370
jmp 0x48d755
xor esi, esi
mov ecx, dword [0x8ccc58]
mov eax, esi
mov dword [0x8c4c64], esi
call fcn.004dda40
mov eax, dword [0x8c4d5c]
mov ecx, dword [0x8ccc58]
call fcn.004dda40
mov eax, dword [0x8c4d58]
mov ecx, dword [0x8ccc58]
call fcn.004dda40
mov eax, dword [0x8c4d54]
mov ecx, dword [0x8ccc58]
call fcn.004dda40
xor esi, esi
lea ebx, [ebx]
cmp esi, 0x14
je 0x48d7ba
mov eax, dword [esi + 0x8c4d60]
cmp eax, ebx
je 0x48d7ba
mov ecx, dword [0x8ccc58]
call fcn.004dda40
add esi, 4
cmp esi, 0x38
jb 0x48d7a0
push 0xc0
call fcn.005354b8
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x48d81d
mov eax, dword [0x8ebfec]
mov edi, dword [0x729444]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
push ebx
mov dword [esi + 4], ebx
push ebx
mov dword [esi], 0x6ff14c
mov dword [esi + 0x1c], ebx
push ebx
mov dword [esi + 0x64], ebx
inc edi
mov dword [esi + 0xbc], ebx
push eax
xor ebx, ebx
mov eax, str.SneakDEMO_light_rig.nif
mov ecx, esi
mov dword [0x729444], edi
call fcn.004be370
mov dword [0x8c4c60], esi
jmp 0x48d823
mov dword [0x8c4c60], ebx
cmp dword [esp + 0x2d4], ebx
je 0x48d849
mov eax, dword [0x8c4d84]
mov ebx, dword [esp + 0x34]
push 0xffffffffffffffff
push 0x3e8
push str.fx_torchfire
push eax
call fcn.004c1750
xor ebx, ebx
mov ebp, dword [esp + 0x50]
lea ecx, [ecx]
push ebp
call dword [sym.imp.USER32.dll_SetCursor]
call fcn.00489430
xor eax, eax
mov ecx, 0x240
mov edi, 0x8c7a98
rep stosd dword es:[edi], eax
mov al, byte [0x8c8869]
cmp al, 4
mov dword [0x8c4cf4], 0xffffffff
je 0x48d8c6
test al, al
je 0x48d8c6
mov al, byte [0x8c7f61]
test al, al
jne 0x48d8c6
mov byte [0x8c7f61], 1
xor esi, esi
jmp 0x48d8a0
mov ecx, dword [esi + 0x727350]
mov edx, dword [esi + 0x7272f0]
push 6
add ecx, 0x19
push ecx
add edx, 0x19
push edx
call fcn.004898a0
add esi, 8
add esp, 0xc
cmp esi, 0x20
jl 0x48d8a0
xor eax, eax
mov ecx, 0x220
mov edi, 0x8c43c0
rep stosd dword es:[edi], eax
mov eax, dword [0x72808c]
cmp eax, ebx
je 0x48d950
mov ecx, dword [0x8c4d1c]
cmp ecx, ebx
mov edx, dword [0x8c4d18]
mov dword [0x8c43cc], ecx
mov dword [0x8c43d0], edx
mov dword [0x8c43dc], 0x80000000
je 0x48d850
cmp eax, ebx
je 0x48d9d9
mov eax, dword [0x8eed78]
mov ecx, 0x8eed78
mov dword [esp + 0x18], 0x46a7f800
mov dword [esp + 0x1c], 0x46a7f800
mov dword [esp + 0x20], 0
call dword [eax + 0x18]
test al, al
jne 0x48d9a2
push ebx
push str.The_audio_manager_has_not_been_properly_initialized_yet
mov eax, 1
call fcn.004887a0
add esp, 8
jmp 0x48da4b
mov dword [0x8c43cc], ebx
xor edx, edx
jmp 0x48d960
mov eax, 0x10
mov ecx, edx
cmp byte [ecx + 0x8c7d98], 0
je 0x48d979
cmp byte [ecx + 0x8c86a0], 0
jne 0x48d989
add eax, 3
add ecx, 0x90
cmp eax, 0x22
jle 0x48d967
jmp 0x48d998
cmp eax, ebx
mov dword [0x8c43cc], eax
mov dword [0x8c43d0], edx
jne 0x48d9d9
inc edx
cmp edx, ebx
jle 0x48d960
jmp 0x48d850
mov eax, dword [esp + 0x18]
push 1
push 0xffffffffffffffff
push 0xbf800000
push 0x8c9894
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
sub esp, 0xc
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [esp + 0x44]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x48]
push ecx
mov dword [ecx + 8], eax
mov eax, esp
push 0xc8
jmp 0x48da3c
mov edx, dword [0x8eed78]
mov ecx, 0x8eed78
mov dword [esp + 0x18], 0x46a7f800
mov dword [esp + 0x1c], 0x46a7f800
mov dword [esp + 0x20], 0
call dword [edx + 0x18]
test al, al
je 0x48d938
mov ecx, dword [esp + 0x18]
push 1
push 0xffffffffffffffff
push 0xbf800000
push 0x8c9890
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x48]
push ecx
mov dword [eax + 8], ecx
mov eax, esp
push 0xc6
or edx, 0xffffffff
push 0x8e87b0
mov dword [eax], ebx
call fcn.0049f880
mov edx, dword [0x8c4d20]
mov eax, dword [0x8c4d24]
imul edx, edx, 0x3e8
imul eax, eax, 0x3e8
sub edx, 0x1f4
mov dword [esp + 0x10], edx
mov edx, dword [0x8eed78]
fild dword [esp + 0x10]
sub eax, 0x1f4
mov dword [esp + 0x10], eax
mov ecx, 0x8eed78
fild dword [esp + 0x10]
mov dword [esp + 0x20], 0
fstp dword [esp + 0x18]
fstp dword [esp + 0x1c]
call dword [edx + 0x18]
test al, al
jne 0x48dab4
push ebx
push str.The_audio_manager_has_not_been_properly_initialized_yet
mov eax, 1
call fcn.004887a0
add esp, 8
jmp 0x48daf8
mov ecx, dword [esp + 0x18]
push 1
push 0xffffffffffffffff
push 0xbf800000
push 0x8c989c
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x48]
push ecx
mov dword [eax + 8], ecx
mov eax, esp
push 0xc0
or edx, 0xffffffff
push 0x8e87b0
mov dword [eax], ebx
call fcn.0049f880
mov esi, dword [0x8c43d0]
mov edx, dword [0x8c43cc]
mov edi, dword [0x8c4324]
mov ecx, esi
imul ecx, ecx, 0x3e8
mov eax, edx
imul eax, eax, 0x3e8
mov dword [0x8c43c8], ecx
mov dword [0x8c43f0], edi
mov dword [0x85c134], ecx
mov dword [0x8c43c4], eax
mov dword [0x85c138], eax
mov ecx, 0x900
xor eax, eax
mov edi, 0x8c4d98
mov dword [0x8c26c4], esi
mov dword [0x8c4d2c], ebx
mov ebx, dword [sym.imp.MSVCR71.dll_rand]
mov dword [0x8c26c8], edx
mov dword [0x8c4d38], 0xe38e38e
mov dword [0x8c4d30], 0xfa0
rep stosd dword es:[edi], eax
mov esi, 0x8c4d98
mov edi, 0x30
lea ebx, [ebx]
call ebx
cdq
mov ecx, 0xa
idiv ecx
add esi, 4
add edx, ecx
dec edi
mov dword [esi - 4], edx
jne 0x48db80
cmp esi, 0x8c7198
jl 0x48db75
mov edx, dword [0x85c158]
mov ebp, 1
add edx, 5
cmp edx, ebp
jle 0x48dc66
mov esi, 0x8c4410
call ebx
cdq
mov ecx, 0x18
idiv ecx
add edx, 0xc
mov dword [esi], edx
call ebx
cdq
mov ecx, 0x18
idiv ecx
mov edi, dword [esi]
lea ecx, [edx + 0xc]
lea edx, [edi + edi*2]
shl edx, 4
mov al, byte [edx + ecx + 0x8c7a98]
test al, al
mov dword [esi + 4], ecx
je 0x48dbb8
mov eax, dword [0x8c43d0]
mov edx, dword [0x8c43cc]
sub eax, ecx
sub edx, edi
jns 0x48dbfd
neg edx
test eax, eax
jge 0x48dc03
neg eax
cmp edx, eax
jle 0x48dc0c
lea eax, [eax + edx*2]
jmp 0x48dc0f
lea eax, [edx + eax*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, 8
jle 0x48dbb8
mov eax, edi
imul eax, eax, 0x3e8
mov dword [esi + 8], eax
mov dword [esi - 8], eax
mov eax, ecx
imul eax, eax, 0x3e8
mov dword [esi + 0xc], eax
mov dword [esi - 4], eax
call ebx
cdq
mov ecx, 0x3e8
idiv ecx
mov eax, dword [0x85c158]
mov dword [esi - 0xc], 1
inc ebp
add eax, 5
add esi, 0x44
cmp ebp, eax
mov dword [esi - 0x1c], edx
mov edx, dword [0x72809c]
mov dword [esi - 0x20], edx
jl 0x48dbb8
xor eax, eax
mov ecx, 0x700
mov edi, 0x8c26d8
rep stosd dword es:[edi], eax
mov eax, dword [0x8cb7c0]
lea ecx, [eax + 0xf4]
mov edx, dword [ecx]
mov dword [0x8ccdbc], edx
mov edx, dword [ecx + 4]
mov dword [0x8ccdc0], edx
mov ecx, dword [ecx + 8]
mov edx, dword [0x8cb7c4]
mov dword [0x8ccdc4], ecx
add edx, 0xe8
mov ecx, dword [edx]
mov dword [0x8ccdb0], ecx
mov ecx, dword [edx + 4]
mov dword [0x8ccdb4], ecx
mov edx, dword [edx + 8]
mov ebp, 9
xor ebx, ebx
lea esi, [eax + 0x38]
mov eax, dword [0x8ccc58]
mov dword [0x8ccdb8], edx
mov ecx, ebp
mov edi, 0x8e86f8
push 0xbf490fdb
rep movsd dword es:[edi], dword [esi]
mov cl, byte [eax + 0x24c]
test cl, cl
push ebx
mov dword [0x8c98b0], ebx
mov dword [0x8c98ac], ebx
push 0x3f5f66f3
je 0x48dd7d
lea ecx, [esp + 0xb4]
call fcn.0053ef10
mov eax, dword [0x8cb7c0]
mov edx, dword [esp + 0x40]
lea edi, [eax + 0x38]
mov ecx, ebp
lea esi, [esp + 0xa8]
rep movsd dword es:[edi], dword [esi]
lea ecx, [eax + 0xf4]
mov dword [ecx], edx
mov edx, dword [esp + 0x44]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x48]
mov dword [ecx + 8], edx
mov edx, dword [eax + 0xc0]
mov esi, 2
push ebx
add edx, esi
mov edi, 0x3f800000
push ebx
mov ecx, eax
mov dword [eax + 0xe4], edi
mov dword [eax + 0xc0], edx
call fcn.00535550
mov eax, dword [0x8cb7c4]
mov dword [eax + 0xe4], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], 0x3e4ccccd
mov dword [esp + 0x24], 0x3ee66666
jmp 0x48ddfa
lea ecx, [esp + 0xd8]
call fcn.0053ef10
mov eax, dword [0x8cb7c0]
mov edx, dword [esp + 0x40]
lea edi, [eax + 0x38]
mov ecx, ebp
lea esi, [esp + 0xcc]
rep movsd dword es:[edi], dword [esi]
lea ecx, [eax + 0xf4]
mov dword [ecx], edx
mov edx, dword [esp + 0x44]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x48]
mov dword [ecx + 8], edx
mov edx, dword [eax + 0xc0]
mov esi, 2
add edx, esi
mov dword [eax + 0xe4], 0x3ecccccd
mov dword [eax + 0xc0], edx
mov eax, dword [0x8cb7c4]
mov dword [eax + 0xe4], 0x3e800000
mov dword [esp + 0x18], 0x3da3d70a
mov dword [esp + 0x20], 0x3da3d70a
mov dword [esp + 0x24], 0x3e800000
mov edx, dword [esp + 0x58]
lea ecx, [eax + 0xe8]
mov dword [ecx], edx
mov edx, dword [esp + 0x5c]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x60]
mov dword [ecx + 8], edx
add dword [eax + 0xc0], esi
mov ecx, dword [esp + 0x18]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x2c], 0
mov edx, dword [esp + 0x2c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 8], ecx
mov ecx, dword [0x8cb7d0]
mov dword [eax + 0xc], edx
call fcn.0050ce10
cmp dword [0x8ccb18], ebx
mov eax, 8
mov dword [0x8c431c], ebp
mov ecx, 0xa
mov dword [0x8c42e4], 0x191
mov dword [0x8c4328], 5
mov ebp, 1
mov dword [0x8c4320], eax
je 0x48ded9
mov dword [0x8c4324], 0x11
mov dword [0x8c4318], ebp
mov dword [0x8c4310], 0xf
mov dword [0x8c4304], 3
mov dword [0x8c4300], eax
mov dword [0x8c42fc], 6
mov dword [0x8c42f8], 7
mov dword [0x72809c], 0x15
mov dword [0x8c42e8], 0x16
jmp 0x48df64
mov edi, 6
mov edx, 7
mov dword [0x8c4324], edi
mov dword [0x8c4318], edx
mov dword [0x8c4310], 0x1b
mov dword [0x8c430c], 0x19
mov dword [0x8c42dc], 0xb
mov dword [0x8c42d8], 0xc
mov dword [0x8c4314], ecx
mov dword [0x8c4304], ebx
mov dword [0x8c4300], 0xd
mov dword [0x8c42fc], ebp
mov dword [0x8c42f8], esi
mov dword [0x72809c], 4
mov dword [0x8c42ec], eax
mov dword [0x8c42e8], 0x14
mov dword [0x8c42e0], ecx
mov dword [0x8c42f4], edi
mov dword [0x8c42f0], edx
mov dword [0x8c4d28], ecx
mov ecx, dword [0x8c4cf0]
mov eax, 3
mov dword [0x8c4308], 0x192
mov dword [0x8c4d04], ebx
mov dword [0x8c26d0], ebx
mov dword [0x8c26cc], ebx
mov dword [0x8c43bc], 0xfffff830
mov dword [esp + 0x10], 0
call fcn.004bc7a0
cmp eax, ebx
je 0x48dfb1
fld dword [eax + 0xc]
jmp 0x48dfb5
fld dword [esp + 0x10]
fmul dword [0x715698]
call fcn.005f275c
mov ecx, dword [0x8c4cf0]
mov dword [0x8c43b8], eax
mov eax, 0x15
mov dword [esp + 0x10], 0
call fcn.004bc7a0
cmp eax, ebx
je 0x48dfe6
fld dword [eax + 0xc]
jmp 0x48dff0
fld dword [esp + 0x10]
lea ebx, [ebx]
fmul dword [0x715698]
call fcn.005f275c
mov ecx, dword [0x8c4cf0]
mov dword [0x8c43b4], eax
mov eax, 4
mov dword [esp + 0x10], 0
call fcn.004bc7a0
cmp eax, ebx
je 0x48e021
fld dword [eax + 0xc]
jmp 0x48e025
fld dword [esp + 0x10]
fmul dword [0x715698]
call fcn.005f275c
mov dword [0x8c43b0], eax
mov eax, dword [esp + 0x4c]
push eax
mov dword [esp + 0x18], ebp
mov dword [0x8c26c0], ebx
mov byte [esp + 0x2e], 0
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [0x8ccc58]
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
call fcn.004de4a0
test byte [0x8ef61c], 1
jne 0x48e075
or dword [0x8ef61c], ebp
call esi
mov dword [0x8ef618], eax
call esi
mov esi, dword [0x8ef618]
mov ecx, dword [0x8c26c4]
sub eax, esi
mov dword [esp + 0x80], eax
mov eax, dword [0x8c4cf0]
push ecx
mov ecx, dword [0x8c26c8]
call fcn.004a4440
mov al, byte [0x85c164]
add esp, 4
test al, 4
jne 0x48e0b3
call fcn.00489dd0
call fcn.00489950
mov ebx, dword [0x8c43dc]
lea ecx, [ebx + 0x40000000]
test ecx, ecx
mov edi, 0x3e8
jns 0x48e0d3
mov edi, 0xfffffc18
and ecx, 0x7fffffff
test ecx, 0x40000000
je 0x48e0e4
mov edx, 0x7fffffff
sub edx, ecx
mov ecx, edx
mov eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov esi, ebp
mov dword [esp + 0x2c], esi
jle 0x48e113
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov edi, eax
cdq
xor eax, edx
sub eax, edx
add esi, esi
cmp eax, 0x7d00
jg 0x48e0f8
mov dword [esp + 0x2c], esi
test ebx, ebx
mov esi, 0x3e8
mov ebp, ebx
jns 0x48e12b
and ebx, 0x7fffffff
mov esi, 0xfffffc18
mov ebp, ebx
test ebp, 0x40000000
je 0x48e13c
mov eax, 0x7fffffff
sub eax, ebp
mov ebp, eax
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov ebx, 1
jle 0x48e167
nop
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov esi, eax
cdq
xor eax, edx
sub eax, edx
add ebx, ebx
cmp eax, 0x7d00
jg 0x48e150
mov edx, dword [esp + 0x14]
push edx
mov edx, edi
call fcn.00495330
imul eax, dword [esp + 0x30]
add eax, dword [0x8c43c8]
push eax
mov edx, esi
mov ecx, ebp
call fcn.00495330
imul eax, ebx
add eax, dword [0x8c43c4]
push eax
call fcn.0048f0c0
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, 1
jle 0x48e1a8
dec eax
mov dword [esp + 0x14], eax
mov ecx, dword [0x8c4d28]
mov eax, dword [0x85c158]
inc ecx
test eax, eax
mov dword [0x8c4d28], ecx
jne case.default.0x48e1f7
cmp ecx, 0x80
jle case.default.0x48e1f7
mov eax, 0x2aaaaaab
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cdq
mov ecx, 6
idiv ecx
mov byte [0x86bb48], 0
cmp edx, 4
ja case.default.0x48e1f7
jmp dword [edx*4 + 0x48ef98]
test byte [0x8ccb14], 1
jne case.default.0x48e1f7
push str.Try_climbing_over_walls.
jmp 0x48e24f
test byte [0x8ccb14], 2
jne case.default.0x48e1f7
push str.You_can_hide_behind_the_hay_bales.
jmp 0x48e24f
test byte [0x8ccb14], 4
jne case.default.0x48e1f7
push str.Sneak_up_behind_guards_to_knock_them_out_
jmp 0x48e24f
push str.White_arrow_signs_point_to_your_destination.
jmp 0x48e24f
test byte [0x8ccb14], 8
jne case.default.0x48e1f7
push str.Hold_down_shift_key_to_run.
mov esi, 0x8ebf58
call fcn.004f7660
mov al, byte [0x86bb48]
add esp, 4
test al, al
je case.default.0x48e1f7
mov eax, dword [0x8c4d28]
cdq
mov ecx, 0xc0
idiv ecx
cmp edx, 0x40
jge case.default.0x48e1f7
mov edx, dword [0x85c268]
mov eax, dword [0x85c26c]
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0x4b
add edx, 0xffffffe8
push edx
cdq
sub eax, edx
sar eax, 1
push eax
push 0x86bb48
xor eax, eax
mov dword [0x85c11c], 0x4b
call fcn.004b0b40
add esp, 0x20
push str.Sneak
call fcn.0042e1a0
mov ebx, eax
mov eax, dword [0x86db5c]
add esp, 4
test eax, eax
je 0x48e324
push ebx
push str.Sneak
lea eax, [esp + 0x1c8]
push str._s__03X
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
mov ecx, dword [0x86db5c]
mov edx, dword [ecx]
add esp, 0x10
lea eax, [esp + 0x1c0]
push eax
mov edi, ecx
call dword [edx + 4]
mov ecx, dword [edi + 8]
mov esi, dword [ecx + eax*4]
test esi, esi
je 0x48e324
mov eax, dword [esi + 4]
mov edx, dword [edi]
push eax
lea ecx, [esp + 0x1c4]
push ecx
mov ecx, edi
call dword [edx + 8]
test al, al
jne 0x48e321
mov esi, dword [esi]
test esi, esi
jne 0x48e302
jmp 0x48e324
mov ebx, dword [esi + 8]
add ebx, 0xffffffe5
cmp ebx, 0xf8
ja case.0x48e33a.28
movzx edx, byte [ebx + 0x48efbc]
jmp dword [edx*4 + 0x48efac]
mov eax, dword [0x8c26c4]
mov ecx, eax
neg eax
shl eax, 1
mov dword [esp + 0x88], eax
mov eax, dword [0x8c26c8]
neg ecx
mov ebx, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x84], ecx
neg ebx
mov edx, 0x8c4d98
mov eax, 0x8c83a0
mov dword [esp + 0x10], 0x30
jmp 0x48e380
mov esi, dword [0x8c26c4]
mov ecx, dword [esp + 0x84]
mov ebp, edx
lea edx, [esi + esi]
mov dword [esp + 0x54], esi
mov esi, dword [esp + 0x88]
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x38], 0x30
lea ecx, [ecx]
cmp byte [eax], 1
jne 0x48e3e9
test ebx, ebx
mov eax, ecx
mov edi, esi
mov edx, ebx
jge 0x48e3c3
mov edx, dword [esp + 0x2c]
test ecx, ecx
jge 0x48e3cf
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x3c]
cmp edx, eax
lea eax, [eax + edx*2]
jg 0x48e3d9
lea eax, [edi + edx]
cdq
sub eax, edx
sar eax, 1
cmp eax, 6
jge 0x48e3e9
add eax, 0xa
mov dword [ebp], eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x54]
mov edi, dword [esp + 0x3c]
add esi, 2
add ebp, 4
inc eax
inc ecx
dec edx
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x38]
sub edi, 2
dec edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], edx
jne 0x48e3b0
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
inc ebx
dec esi
dec ecx
mov edx, ebp
mov dword [esp + 0x2c], esi
mov dword [esp + 0x10], ecx
jne 0x48e380
jmp case.0x48e33a.28
mov eax, dword [0x85c164]
xor eax, 4
sub esp, 0x64
test al, 4
mov dword [0x85c164], eax
mov esi, 0x8cccd0
mov ebx, esp
je 0x48e48f
lea eax, [esp + 0x154]
mov dword [esp + 0x1b4], esi
mov dword [esp + 0x154], 0x31
mov dword [esp + 0x15c], 0
call fcn.00498530
mov edi, 0x8e87b4
call fcn.004a1410
mov dword [esp + 0x150], esi
jmp case.0x48e33a.28
lea eax, [esp + 0x1bc]
mov dword [esp + 0x21c], esi
mov dword [esp + 0x1bc], 0x32
call fcn.00498530
mov edi, 0x8e87b4
call fcn.004a1410
mov dword [esp + 0x1b8], esi
jmp case.0x48e33a.28
mov ecx, dword [0x8ccbe8]
push 1
push 0
push 0
push 9
call fcn.004b2890
test byte [0x85c164], 8
jne 0x48e527
mov edi, dword [esp + 0x80]
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
lea esp, [esp]
test byte [0x8ef61c], 1
jne 0x48e507
or dword [0x8ef61c], 1
call esi
mov dword [0x8ef618], eax
call esi
sub eax, dword [0x8ef618]
sub eax, edi
cmp eax, 0x1f
jge 0x48e527
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
test byte [0x85c164], 8
je 0x48e4f0
mov esi, dword [0x8c4d14]
mov eax, dword [0x8c43c4]
mov edi, dword [0x8c4d10]
mov ecx, esi
imul ecx, ecx, 0x3e8
sub eax, ecx
cdq
mov ecx, eax
mov eax, dword [0x8c43c8]
xor ecx, edx
sub ecx, edx
mov edx, edi
imul edx, edx, 0x3e8
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [0x8c26c8]
add ecx, eax
mov eax, dword [0x8c26c4]
sub eax, edi
sub edx, esi
jns 0x48e572
neg edx
test eax, eax
jge 0x48e578
neg eax
cmp edx, eax
jle 0x48e581
lea eax, [eax + edx*2]
jmp 0x48e584
lea eax, [edx + eax*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, 1
jg 0x48e707
cmp ecx, 0x3e7
jge 0x48e707
mov ebp, dword [0x8c43dc]
lea ecx, [ebp + 0x40000000]
test ecx, ecx
mov edi, 0x3e8
jns 0x48e5be
mov edi, 0xfffffc18
and ecx, 0x7fffffff
test ecx, 0x40000000
je 0x48e5cf
mov eax, 0x7fffffff
sub eax, ecx
mov ecx, eax
mov eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov esi, 1
mov dword [esp + 0x10], esi
jle 0x48e601
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov edi, eax
cdq
xor eax, edx
sub eax, edx
add esi, esi
cmp eax, 0x7d00
jg 0x48e5e6
mov dword [esp + 0x10], esi
test ebp, ebp
mov esi, 0x3e8
jns 0x48e615
mov esi, 0xfffffc18
and ebp, 0x7fffffff
test ebp, 0x40000000
je 0x48e626
mov edx, 0x7fffffff
sub edx, ebp
mov ebp, edx
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov ebx, 1
jle 0x48e657
lea esp, [esp]
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov esi, eax
cdq
xor eax, edx
sub eax, edx
add ebx, ebx
cmp eax, 0x7d00
jg 0x48e640
mov eax, dword [esp + 0x14]
push eax
mov edx, edi
call fcn.00495330
imul eax, dword [esp + 0x14]
add eax, dword [0x8c43c8]
push eax
mov edx, esi
mov ecx, ebp
call fcn.00495330
imul eax, ebx
add eax, dword [0x8c43c4]
push eax
call fcn.0048f0c0
mov eax, dword [0x72808c]
add esp, 0xc
test eax, eax
mov esi, 0x8ebf58
je 0x48e6a4
push str.You_escape_the_clutches_of_your_captors_to_enjoy_a_happy_reunion_with_your_crew._n
call fcn.004f7660
jmp 0x48e6b5
push str.You_leave_town._n
call fcn.004f7660
mov byte [0x8c8398], 0xff
add esp, 4
push 0
push 0x20
call fcn.00487950
mov eax, dword [0x85c268]
mov ecx, dword [0x85c26c]
push 0
push 0
push 0xffffffffffffffff
push 0
cdq
push 0
push 0xffffffffffffffff
and edx, 3
add eax, edx
push 0
sar eax, 2
push str.snapall
push eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
call fcn.00430160
add esp, 0x30
mov byte [esp + 0x2a], 1
mov esi, dword [0x8c4d24]
mov eax, dword [0x8c43c4]
mov edi, dword [0x8c4d20]
mov edx, esi
imul edx, edx, 0x3e8
sub eax, edx
add eax, 0x5dc
cdq
mov ecx, eax
mov eax, dword [0x8c43c8]
xor ecx, edx
sub ecx, edx
mov edx, edi
imul edx, edx, 0x3e8
sub eax, edx
add eax, 0x1f4
cdq
xor eax, edx
sub eax, edx
add ecx, eax
mov eax, dword [0x72808c]
test eax, eax
jne 0x48e8e5
mov eax, dword [0x8c26c8]
mov edx, dword [0x8c26c4]
sub eax, esi
sub edx, edi
inc eax
jns 0x48e76a
neg eax
test edx, edx
jge 0x48e770
neg edx
cmp eax, edx
jle 0x48e779
lea eax, [edx + eax*2]
jmp 0x48e77c
lea eax, [eax + edx*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, 1
jg 0x48e8e5
cmp ecx, 0x14c
jge 0x48e8e5
mov ebp, dword [0x8c43dc]
lea ecx, [ebp + 0x40000000]
test ecx, ecx
mov edi, 0x3e8
jns 0x48e7b6
mov edi, 0xfffffc18
and ecx, 0x7fffffff
test ecx, 0x40000000
je 0x48e7c7
mov eax, 0x7fffffff
sub eax, ecx
mov ecx, eax
mov eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov esi, 1
mov dword [esp + 0x10], esi
jle 0x48e7fb
mov edi, edi
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov edi, eax
cdq
xor eax, edx
sub eax, edx
add esi, esi
cmp eax, 0x7d00
jg 0x48e7e0
mov dword [esp + 0x10], esi
test ebp, ebp
mov esi, 0x3e8
jns 0x48e80f
mov esi, 0xfffffc18
and ebp, 0x7fffffff
test ebp, 0x40000000
je 0x48e820
mov edx, 0x7fffffff
sub edx, ebp
mov ebp, edx
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov ebx, 1
jle 0x48e84a
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov esi, eax
cdq
xor eax, edx
sub eax, edx
add ebx, ebx
cmp eax, 0x7d00
jg 0x48e833
mov eax, dword [esp + 0x14]
push eax
mov edx, edi
call fcn.00495330
imul eax, dword [esp + 0x14]
add eax, dword [0x8c43c8]
push eax
mov edx, esi
mov ecx, ebp
call fcn.00495330
imul eax, ebx
add eax, dword [0x8c43c4]
push eax
call fcn.0048f0c0
add esp, 0xc
push str.You_avoid_the_guards_and_arrive_at_the_tavern._n
mov esi, 0x8ebf58
call fcn.004f7660
add esp, 4
push 0
push 0x20
call fcn.00487950
mov eax, dword [0x85c268]
mov ecx, dword [0x85c26c]
push 0
push 0
push 0xffffffffffffffff
push 0
cdq
push 0
push 0xffffffffffffffff
and edx, 3
add eax, edx
push 0
sar eax, 2
push str.snapall
push eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
call fcn.00430160
add esp, 0x30
mov byte [0x8c8398], 1
mov byte [esp + 0x2a], 1
mov eax, dword [0x8c43c4]
add eax, 0xffffaa10
cdq
mov ecx, eax
mov eax, dword [0x8c43c8]
xor ecx, edx
add eax, 0xffffb3d4
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
add ecx, eax
mov eax, dword [0x72808c]
test eax, eax
jne 0x48e949
mov edx, dword [0x8c26c4]
mov eax, dword [0x8c26c8]
add edx, 0xffffffed
add eax, 0xffffffea
jns 0x48e925
neg eax
test edx, edx
jge 0x48e92b
neg edx
cmp eax, edx
jle 0x48e934
lea eax, [edx + eax*2]
jmp 0x48e937
lea eax, [eax + edx*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, 1
jge 0x48e949
cmp ecx, 0xf9
jl 0x48e97c
mov al, byte [esp + 0x2a]
test al, al
jne 0x48eac4
cmp dword [0x8c26cc], 0x1b58
jg 0x48eac4
mov al, byte [0x8ccc27]
test al, al
jne 0x48eac4
mov ebp, 1
jmp 0x48e04f
mov ebp, dword [0x8c43dc]
lea ecx, [ebp + 0x40000000]
test ecx, ecx
mov edi, 0x3e8
jns 0x48e99c
mov edi, 0xfffffc18
and ecx, 0x7fffffff
test ecx, 0x40000000
je 0x48e9ad
mov edx, 0x7fffffff
sub edx, ecx
mov ecx, edx
mov eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov esi, 1
mov dword [esp + 0x10], esi
jle 0x48e9df
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov edi, eax
cdq
xor eax, edx
sub eax, edx
add esi, esi
cmp eax, 0x7d00
jg 0x48e9c4
mov dword [esp + 0x10], esi
test ebp, ebp
mov esi, 0x3e8
jns 0x48e9f3
mov esi, 0xfffffc18
and ebp, 0x7fffffff
test ebp, 0x40000000
je 0x48ea04
mov eax, 0x7fffffff
sub eax, ebp
mov ebp, eax
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov ebx, 1
jle 0x48ea2e
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov esi, eax
cdq
xor eax, edx
sub eax, edx
add ebx, ebx
cmp eax, 0x7d00
jg 0x48ea17
mov edx, dword [esp + 0x14]
push edx
mov edx, edi
call fcn.00495330
imul eax, dword [esp + 0x14]
add eax, dword [0x8c43c8]
push eax
mov edx, esi
mov ecx, ebp
call fcn.00495330
imul eax, ebx
add eax, dword [0x8c43c4]
push eax
call fcn.0048f0c0
add esp, 0xc
push str.You_avoid_the_guards_and_arrive_at_the_Governors_mansion._n
mov esi, 0x8ebf58
call fcn.004f7660
add esp, 4
push 0
push 0x20
call fcn.00487950
mov eax, dword [0x85c268]
mov ecx, dword [0x85c26c]
push 0
push 0
push 0xffffffffffffffff
cdq
push 0
push 0
push 0xffffffffffffffff
and edx, 3
add eax, edx
sar eax, 2
push 0
push str.snapall
push eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
call fcn.00430160
add esp, 0x30
mov byte [0x8c8398], 0
mov eax, dword [0x8c26cc]
mov edi, 0x3e8
cmp eax, edi
jle 0x48ec2b
push str.The_guards_have_been_alerted__You_are_dragged_off_to_prison._n
mov esi, 0x8ebf58
call fcn.004f7660
add esp, 4
push 0
push 0x20
call fcn.00487950
mov eax, dword [esp + 0x2d0]
add esp, 8
cmp eax, 0xffffffff
jne 0x48ec2b
mov ebp, dword [0x8c43dc]
lea ecx, [ebp + 0x40000000]
test ecx, ecx
jns 0x48eb1f
mov edi, 0xfffffc18
and ecx, 0x7fffffff
test ecx, 0x40000000
je 0x48eb30
mov edx, 0x7fffffff
sub edx, ecx
mov ecx, edx
mov eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov esi, 1
mov dword [esp + 0x10], esi
jle 0x48eb62
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov edi, eax
cdq
xor eax, edx
sub eax, edx
add esi, esi
cmp eax, 0x7d00
jg 0x48eb47
mov dword [esp + 0x10], esi
test ebp, ebp
mov esi, 0x3e8
jns 0x48eb76
mov esi, 0xfffffc18
and ebp, 0x7fffffff
test ebp, 0x40000000
je 0x48eb87
mov eax, 0x7fffffff
sub eax, ebp
mov ebp, eax
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov ebx, 1
jle 0x48ebb7
lea ebx, [ebx]
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov esi, eax
cdq
xor eax, edx
sub eax, edx
add ebx, ebx
cmp eax, 0x7d00
jg 0x48eba0
mov edx, dword [esp + 0x14]
push edx
mov edx, edi
call fcn.00495330
imul eax, dword [esp + 0x14]
add eax, dword [0x8c43c8]
push eax
mov edx, esi
mov ecx, ebp
call fcn.00495330
imul eax, ebx
add eax, dword [0x8c43c4]
push eax
call fcn.0048f0c0
mov eax, dword [0x85c268]
mov ecx, dword [0x85c26c]
add esp, 0xc
push 0
push 0
push 0xffffffffffffffff
cdq
push 0
push 0
push 0xffffffffffffffff
and edx, 3
add eax, edx
sar eax, 2
push 0
push str.snapall
push eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
call fcn.00430160
add esp, 0x28
mov eax, dword [0x8ccc58]
call fcn.004de4a0
mov eax, dword [esp + 0x2d4]
test eax, eax
mov ebx, dword [esp + 0x34]
je 0x48ec57
mov ecx, dword [0x8c4d84]
push str.fx_torchfire
push ecx
mov eax, ebx
call fcn.004c1820
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x90]
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0xa4]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0xa8]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov ecx, dword [0x8cb7d0]
call fcn.0050ce10
push 0x4b0
call fcn.004ae1f0
mov eax, dword [0x8ccb18]
add esp, 4
test eax, eax
mov byte [0x8cbdf4], 1
je 0x48ed0b
mov ecx, dword [0x8c4c44]
test ecx, ecx
je 0x48ecbb
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [0x8c4c48]
test ecx, ecx
je 0x48eccb
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x8c4c4c]
test ecx, ecx
je 0x48ecdb
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [0x8c4c50]
test ecx, ecx
je 0x48eceb
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x8c4c54]
test ecx, ecx
je 0x48ecfb
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [0x8c4c58]
test ecx, ecx
je 0x48ed0b
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x8c4d60]
test ecx, ecx
je 0x48ed1b
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [0x8c4d64]
test ecx, ecx
je 0x48ed2b
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x8c4d68]
test ecx, ecx
je 0x48ed3b
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [0x8c4d6c]
test ecx, ecx
je 0x48ed4b
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x8c4d70]
test ecx, ecx
je 0x48ed5b
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [0x8c4d74]
test ecx, ecx
je 0x48ed6b
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x8c4d78]
test ecx, ecx
je 0x48ed7b
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [0x8c4d7c]
test ecx, ecx
je 0x48ed8b
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x8c4d80]
test ecx, ecx
je 0x48ed9b
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [0x8c4d84]
test ecx, ecx
je 0x48edab
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x8c4d88]
test ecx, ecx
je 0x48edbb
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [0x8c4d90]
test ecx, ecx
je 0x48edcb
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x8c4d94]
test ecx, ecx
je 0x48eddb
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [0x8c4d5c]
test ecx, ecx
je 0x48edeb
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x8c4d58]
test ecx, ecx
je 0x48edfb
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [0x8c4d54]
test ecx, ecx
je 0x48ee0b
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x8c4d44]
test ecx, ecx
je 0x48ee1b
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [0x8c4c60]
test ecx, ecx
je 0x48ee2b
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x8c4c64]
test ecx, ecx
je 0x48ee3b
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [0x8c4c68]
test ecx, ecx
je 0x48ee4b
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [0x8c4cf0]
test ecx, ecx
je 0x48ee5b
mov edx, dword [ecx]
push 1
call dword [edx]
xor esi, esi
lea ecx, [ecx]
mov ecx, dword [esi + 0x8c4c70]
test ecx, ecx
je 0x48ee70
mov eax, dword [ecx]
push 1
call dword [eax]
add esi, 4
cmp esi, 0x80
jb 0x48ee60
call fcn.00491500
mov edx, dword [0x8ccdbc]
mov eax, dword [0x8cb7c0]
mov esi, dword [eax + 0xc0]
lea ecx, [eax + 0xf4]
mov dword [ecx], edx
mov edx, dword [0x8ccdc0]
mov dword [ecx + 4], edx
mov edx, dword [0x8ccdc4]
mov dword [ecx + 8], edx
mov ecx, dword [0x8cb7c4]
inc esi
mov dword [eax + 0xc0], esi
mov esi, dword [0x8ccdb0]
lea edx, [ecx + 0xe8]
mov dword [edx], esi
mov esi, dword [0x8ccdb4]
mov dword [edx + 4], esi
mov esi, dword [0x8ccdb8]
mov dword [edx + 8], esi
mov edx, dword [ecx + 0xc0]
inc edx
lea edi, [eax + 0x38]
mov al, byte [esp + 0x2b]
test al, al
mov dword [ecx + 0xc0], edx
mov ecx, 9
mov esi, 0x8e86f8
rep movsd dword es:[edi], dword [esi]
je 0x48ef50
mov esi, dword [0x72ed74]
mov al, byte [esi + 0xf0]
test al, al
jne 0x48ef50
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
lea edi, [esi + 8]
push 1
mov byte [esi + 0xf0], 1
mov eax, dword [ecx]
push edx
call dword [eax + 0x70]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x1c]
mov eax, dword [ecx]
push 1
push edx
call dword [eax + 0x70]
mov ecx, dword [esi + 0x1c]
call fcn.00535990
mov ecx, dword [esi + 0x1c]
call fcn.00535bb0
mov ecx, dword [edi]
call fcn.00535990
mov ecx, dword [edi]
call fcn.00535bb0
mov ecx, dword [0x8c26cc]
xor eax, eax
cmp ecx, 0x3e8
setle al
test ebx, ebx
mov esi, eax
je 0x48ef74
dec dword [ebx + 4]
jne 0x48ef74
mov edx, dword [ebx]
push 1
mov ecx, ebx
call dword [edx]
lea edi, [esp + 0x64]
call fcn.004fa4e0
mov eax, dword [esp + 0x4c]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x2b4
ret