Function at 0x4c8c30
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x412636
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x403fb8
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x4c], edi
call fcn.00437c60
mov ebx, dword [fcn.004012ac]
mov esi, eax
call ebx
push esi
mov dword [ebp - 0x20], esi
call fcn.00437c18
mov esi, eax
call ebx
imul esi, esi, 2
jo 0x4c8a92
cmp esi, edi
jle 0x4c897b
push esi
call dword [fcn.00401374]
mov edi, dword [fcn.004015bc]
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push esi
push eax
lea edx, [ebp - 0x2c]
push ecx
push edx
call dword [fcn.00401574]
push eax
call fcn.00437c94
call ebx
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x1c]
push eax
push ecx
call dword [fcn.00401464]
lea ecx, [ebp - 0x2c]
call dword [fcn.0040162c]
jmp 0x4c8981
mov edi, dword [fcn.004015bc]
push 0
lea eax, [ebp - 0x4c]
push 0x80
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0x1c]
push eax
push ecx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x4c], 0x4008
call dword [fcn.004014b4]
lea edx, [ebp - 0x3c]
push edx
call dword [fcn.00401220]
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
lea ecx, [ebp - 0x3c]
call dword [fcn.00401214]
mov eax, dword [ebp - 0x1c]
mov esi, dword [fcn.00401224]
push eax
call esi
mov ecx, dword [ebp - 0x1c]
sub eax, 1
jo 0x4c8a92
push eax
push ecx
call dword [fcn.004015b8]
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
mov edx, dword [ebp - 0x1c]
push 1
push edx
push 0x437cb4
push 0
call dword [fcn.0040150c]
mov ebx, eax
mov eax, dword [ebp - 0x1c]
push eax
call esi
cmp ebx, eax
jne 0x4c8a18
mov edx, 0x43352c
lea ecx, [ebp - 0x1c]
call dword [fcn.00401528]
push 0x4c8a7e
jmp 0x4c8a74
mov ecx, dword [ebp - 0x1c]
push ecx
call esi
mov edx, dword [ebp - 0x1c]
sub eax, ebx
jo 0x4c8a92
push eax
push edx
call dword [fcn.004015b8]
mov edx, eax
lea ecx, [ebp - 0x2c]
call edi
push eax
call dword [fcn.00401270]
mov edx, eax
lea ecx, [ebp - 0x1c]
call edi
lea ecx, [ebp - 0x2c]
call dword [fcn.0040162c]
push 0x4c8a7e
jmp 0x4c8a74
lea ecx, [ebp - 0x28]
call dword [fcn.0040162c]
ret
call dword [fcn.004014f8]
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 0x18
push 0x412636
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x180
call fcn.00412630
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x403fc8
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [fcn.0040130c]
mov dword [ebp - 4], 3
call fcn.004c88d0
mov edx, eax
lea ecx, [ebp - 0x5c]
call dword [fcn.004015bc]
push eax
call dword [fcn.00401270]
mov edx, eax
lea ecx, [ebp - 0x60]
call dword [fcn.004015bc]
push eax
call dword [fcn.0040125c]
mov edx, eax
mov ecx, 0x5c82f0
call dword [fcn.004015bc]
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x5c]
push ecx
push 2
call dword [fcn.00401538]
add esp, 0xc
mov dword [ebp - 4], 4
mov edx, 0x437cbc
mov ecx, 0x5c89dc
call dword [fcn.00401528]
mov dword [ebp - 4], 5
call 0x55b170
mov dword [ebp - 4], 6
call fcn.004304fc
call dword [fcn.004012ac]
mov dword [ebp - 4], 7
mov word [0x5c81d4], 0xffff
mov dword [ebp - 4], 8
cmp dword [0x5cb640], 0
jne 0x4c8bb5
push 0x5cb640
push 0x435814
call dword [0x401514]
mov dword [ebp - 0x158], 0x5cb640
jmp 0x4c8bbf
mov dword [ebp - 0x158], 0x5cb640
mov edx, dword [ebp - 0x158]
mov eax, dword [edx]
mov dword [ebp - 0x118], eax
lea ecx, [ebp - 0x84]
push ecx
mov edx, dword [ebp - 0x118]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x118]
push ecx
call dword [eax + 0x14]
fnclex
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jge 0x4c8c1a
push 0x14
push 0x435804
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x11c]
push eax
call dword [fcn.004012b8]
mov dword [ebp - 0x15c], eax
jmp 0x4c8c24
mov dword [ebp - 0x15c], 0
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x120], ecx
push 1
push 0x43264c
call fcn.004d9690
mov edx, eax
lea ecx, [ebp - 0x5c]
call dword [fcn.004015bc]
push eax
mov edx, dword [ebp - 0x120]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x120]
push ecx
call dword [eax + 0x64]
fnclex
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jge 0x4c8c8e
push 0x64
push 0x435824
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x124]
push eax
call dword [fcn.004012b8]
mov dword [ebp - 0x160], eax
jmp 0x4c8c98
mov dword [ebp - 0x160], 0
lea ecx, [ebp - 0x5c]
call dword [fcn.0040162c]
lea ecx, [ebp - 0x84]
call dword [fcn.00401630]
mov dword [ebp - 4], 9
push 2
push 0x42f034
call fcn.004db860
mov dword [ebp - 4], 0xa
push 2
push 0x42f070
call fcn.004db860
mov dword [ebp - 4], 0xb
call 0x5a0940
mov dword [ebp - 4], 0xc
mov ecx, dword [0x5c82f0]
push ecx
push 0x438648
call dword [fcn.00401394]
test eax, eax
jne 0x4c8e2b
mov dword [ebp - 4], 0xd
mov edx, dword [0x5c80e0]
push edx
call fcn.00563020
movsx esi, ax
neg esi
sbb esi, esi
inc esi
mov eax, dword [0x5c80e4]
push eax
call fcn.00563020
movsx ecx, ax
neg ecx
sbb ecx, ecx
inc ecx
or esi, ecx
test esi, esi
jne 0x4c8e26
mov dword [ebp - 4], 0xe
call fcn.004314ac
mov dword [ebp - 0x10c], eax
call dword [fcn.004012ac]
cmp dword [ebp - 0x10c], 0
je 0x4c8dbf
mov dword [ebp - 4], 0xf
call 0x5a42a0
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xd4], 0xb
mov eax, 0x10
call fcn.00412630
mov edx, esp
mov eax, dword [ebp - 0xd4]
mov dword [edx], eax
mov ecx, dword [ebp - 0xd0]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0xcc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0xc8]
mov dword [edx + 0xc], ecx
push 0
push 0
call 0x599a20
jmp 0x4ca3c5
mov dword [ebp - 4], 0x13
push 0x438408
call dword [fcn.004014e8]
mov dword [ebp - 0x10c], eax
mov edx, dword [0x5c80cc]
push edx
call dword [fcn.004014e8]
mov dword [ebp - 0x110], eax
push 0x438648
call dword [fcn.004014e8]
mov dword [ebp - 0x114], eax
push 1
push 0
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
push 0
call fcn.0042fbc4
call dword [fcn.004012ac]
jmp 0x4ca3c5
jmp 0x4ca3c5
mov dword [ebp - 4], 0x19
mov word [0x5c8318], 0
mov dword [ebp - 4], 0x1a
call fcn.00438334
mov dword [ebp - 0x10c], eax
call dword [fcn.004012ac]
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 0x1b
cmp dword [ebp - 0x38], 3
jne 0x4c8e7d
mov dword [ebp - 4], 0x1c
push 0
call fcn.00438380
call dword [fcn.004012ac]
mov dword [ebp - 4], 0x1e
mov ecx, dword [0x5c82f0]
push ecx
push 0x438418
call dword [fcn.00401394]
test eax, eax
jne 0x4c8eaf
mov dword [ebp - 4], 0x1f
mov word [0x5c82f4], 0xffff
jmp 0x4c91dc
mov dword [ebp - 4], 0x20
mov edx, dword [0x5c82f0]
push edx
push 0x438424
call dword [fcn.00401394]
test eax, eax
jne 0x4c9198
mov dword [ebp - 4], 0x21
mov word [0x5c82f4], 0xffff
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x130], 0xa
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x54], 1
jmp 0x4c8f16
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x12c]
jo 0x4ca458
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp - 0x130]
jg 0x4c914e
mov dword [ebp - 4], 0x23
push 0x1f4
call fcn.004379dc
call dword [fcn.004012ac]
mov dword [ebp - 4], 0x24
push 0x438430
lea edx, [ebp - 0x5c]
push edx
call dword [fcn.00401574]
push eax
push 0
call fcn.0042fde0
mov dword [ebp - 0x10c], eax
call dword [fcn.004012ac]
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x5c]
call dword [fcn.0040162c]
mov dword [ebp - 4], 0x25
cmp dword [ebp - 0x30], 0
je 0x4c8fa0
mov dword [ebp - 4], 0x26
mov ecx, dword [ebp - 0x2c]
add ecx, 1
jo 0x4ca458
mov dword [ebp - 0x2c], ecx
jmp 0x4ca3c5
mov dword [ebp - 4], 0x29
push 0x438448
lea edx, [ebp - 0x5c]
push edx
call dword [fcn.00401574]
push eax
push 0
call fcn.0042fde0
mov dword [ebp - 0x10c], eax
call dword [fcn.004012ac]
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x5c]
call dword [fcn.0040162c]
mov dword [ebp - 4], 0x2a
cmp dword [ebp - 0x3c], 0
je 0x4c9004
mov dword [ebp - 4], 0x2b
mov ecx, dword [ebp - 0x34]
add ecx, 1
jo 0x4ca458
mov dword [ebp - 0x34], ecx
jmp 0x4ca3c5
mov dword [ebp - 4], 0x2e
cmp dword [0x5cb640], 0
jne 0x4c9030
push 0x5cb640
push 0x435814
call dword [0x401514]
mov dword [ebp - 0x164], 0x5cb640
jmp 0x4c903a
mov dword [ebp - 0x164], 0x5cb640
mov edx, dword [ebp - 0x164]
mov eax, dword [edx]
mov dword [ebp - 0x118], eax
lea ecx, [ebp - 0x84]
push ecx
mov edx, dword [ebp - 0x118]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x118]
push ecx
call dword [eax + 0x14]
fnclex
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jge 0x4c9095
push 0x14
push 0x435804
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x11c]
push eax
call dword [fcn.004012b8]
mov dword [ebp - 0x168], eax
jmp 0x4c909f
mov dword [ebp - 0x168], 0
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x120], ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x120]
push edx
call dword [ecx + 0x68]
fnclex
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jge 0x4c90f8
push 0x68
push 0x435824
mov eax, dword [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x124]
push ecx
call dword [fcn.004012b8]
mov dword [ebp - 0x16c], eax
jmp 0x4c9102
mov dword [ebp - 0x16c], 0
mov dx, word [ebp - 0x108]
mov word [ebp - 0x128], dx
lea ecx, [ebp - 0x84]
call dword [fcn.00401630]
movsx eax, word [ebp - 0x128]
test eax, eax
je 0x4c9142
mov dword [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x40]
add ecx, 1
jo 0x4ca458
mov dword [ebp - 0x40], ecx
jmp 0x4ca3c5
mov dword [ebp - 4], 0x32
jmp 0x4c8f04
mov dword [ebp - 4], 0x33
call fcn.004caa30
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 0x34
cmp dword [ebp - 0x44], 2
jl 0x4c916f
jmp 0x4ca3c5
mov dword [ebp - 4], 0x37
mov word [0x5c8318], 0xffff
mov dword [ebp - 4], 0x38
mov edx, 0x438418
mov ecx, 0x5c82f0
call dword [fcn.00401528]
jmp 0x4c91dc
mov dword [ebp - 4], 0x39
mov edx, dword [0x5c82f0]
push edx
push 0x4388b8
call dword [fcn.00401394]
test eax, eax
jne 0x4c91dc
mov dword [ebp - 4], 0x3a
mov edx, 0x438418
mov ecx, 0x5c82f0
call dword [fcn.00401528]
mov dword [ebp - 4], 0x3b
mov word [0x5c8a04], 0xffff
mov dword [ebp - 4], 0x3d
mov eax, dword [0x5c82f0]
push eax
push 0x43352c
call dword [fcn.00401394]
test eax, eax
jne 0x4c92bf
mov dword [ebp - 4], 0x3e
call fcn.004db570
test eax, eax
je 0x4c92bf
mov dword [ebp - 4], 0x3f
call fcn.004314ac
mov dword [ebp - 0x10c], eax
call dword [fcn.004012ac]
cmp dword [ebp - 0x10c], 0
jne 0x4c92bf
mov dword [ebp - 4], 0x40
push 0x438408
call dword [fcn.004014e8]
mov dword [ebp - 0x110], eax
call 0x5643a0
mov edx, eax
lea ecx, [ebp - 0x5c]
call dword [fcn.004015bc]
push eax
call dword [fcn.004014e8]
mov dword [ebp - 0x114], eax
push 1
push 0
push 0
mov ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x110]
push edx
push 0
call fcn.0042fbc4
mov dword [ebp - 0x10c], eax
call dword [fcn.004012ac]
xor eax, eax
cmp dword [ebp - 0x10c], 0x20
setg al
neg eax
mov word [ebp - 0x118], ax
lea ecx, [ebp - 0x5c]
call dword [fcn.0040162c]
movsx ecx, word [ebp - 0x118]
test ecx, ecx
je 0x4c92bf
jmp 0x4ca3c5
mov dword [ebp - 4], 0x46
mov edx, dword [0x5c82f0]
push edx
push 0x4388c4
call dword [fcn.00401394]
test eax, eax
jne 0x4c92f3
mov dword [ebp - 4], 0x47
mov edx, 0x43352c
mov ecx, 0x5c82f0
call dword [fcn.00401528]
mov dword [ebp - 4], 0x49
call 0x55ea10
mov dword [ebp - 4], 0x4a
call 0x5b1170
mov dword [ebp - 4], 0x4b
call 0x5a4790
mov dword [ebp - 4], 0x4c
call 0x5a4250
mov dword [ebp - 4], 0x4d
mov eax, dword [0x5c80e4]
push eax
call fcn.00563020
movsx ecx, ax
test ecx, ecx
jne 0x4c9468
mov dword [ebp - 4], 0x4e
mov edx, dword [0x5c82f0]
push edx
push 0x438648
call dword [fcn.00401394]
test eax, eax
je 0x4c9463
mov dword [ebp - 4], 0x4f
push 0xffffffffffffffff
mov eax, dword [0x5c80e4]
push eax
call fcn.005611d0
mov edx, eax
lea ecx, [ebp - 0x60]
call dword [fcn.004015bc]
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x60], 0
push 0
push 0
mov edx, dword [ebp - 0x148]
lea ecx, [ebp - 0x5c]
call dword [fcn.004015bc]
push eax
push 0x4388f4
push 0x6d
lea edx, [ebp - 0x94]
push edx
call fcn.004d80b0
mov dword [ebp - 0xbc], 0x80020004
mov dword [ebp - 0xc4], 0xa
mov dword [ebp - 0xac], 0x80020004
mov dword [ebp - 0xb4], 0xa
mov dword [ebp - 0xcc], 0x438908
mov dword [ebp - 0xd4], 8
lea edx, [ebp - 0xd4]
lea ecx, [ebp - 0xa4]
call dword [fcn.0040157c]
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0xb4]
push ecx
lea edx, [ebp - 0xa4]
push edx
push 0x30
lea eax, [ebp - 0x94]
push eax
call dword [fcn.00401308]
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 2
call dword [fcn.00401538]
add esp, 0xc
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0xb4]
push ecx
lea edx, [ebp - 0xa4]
push edx
lea eax, [ebp - 0x94]
push eax
push 4
call dword [fcn.00401230]
add esp, 0x14
jmp 0x4ca3c5
mov dword [ebp - 4], 0x53
mov ecx, dword [0x5c80e0]
push ecx
call fcn.00563020
movsx edx, ax
test edx, edx
jne 0x4c95ae
mov dword [ebp - 4], 0x54
mov eax, dword [0x5c82f0]
push eax
push 0x438648
call dword [fcn.00401394]
test eax, eax
je 0x4c95a9
mov dword [ebp - 4], 0x55
push 0xffffffffffffffff
mov ecx, dword [0x5c80e0]
push ecx
call fcn.005611d0
mov edx, eax
lea ecx, [ebp - 0x60]
call dword [fcn.004015bc]
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x60], 0
push 0
push 0
mov edx, dword [ebp - 0x14c]
lea ecx, [ebp - 0x5c]
call dword [fcn.004015bc]
push eax
push 0x438918
push 0x6d
lea eax, [ebp - 0x94]
push eax
call fcn.004d80b0
mov dword [ebp - 0xbc], 0x80020004
mov dword [ebp - 0xc4], 0xa
mov dword [ebp - 0xac], 0x80020004
mov dword [ebp - 0xb4], 0xa
mov dword [ebp - 0xcc], 0x438908
mov dword [ebp - 0xd4], 8
lea edx, [ebp - 0xd4]
lea ecx, [ebp - 0xa4]
call dword [fcn.0040157c]
lea ecx, [ebp - 0xc4]
push ecx
lea edx, [ebp - 0xb4]
push edx
lea eax, [ebp - 0xa4]
push eax
push 0x30
lea ecx, [ebp - 0x94]
push ecx
call dword [fcn.00401308]
lea edx, [ebp - 0x60]
push edx
lea eax, [ebp - 0x5c]
push eax
push 2
call dword [fcn.00401538]
add esp, 0xc
lea ecx, [ebp - 0xc4]
push ecx
lea edx, [ebp - 0xb4]
push edx
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x94]
push ecx
push 4
call dword [fcn.00401230]
add esp, 0x14
jmp 0x4ca3c5
mov dword [ebp - 4], 0x59
call fcn.004db570
test eax, eax
jne 0x4c97c8
mov dword [ebp - 4], 0x5a
push 0xffffffffffffffff
call fcn.004db210
mov edx, eax
lea ecx, [ebp - 0x80]
call dword [fcn.004015bc]
mov dword [ebp - 0xbc], 0x80020004
mov dword [ebp - 0xc4], 0xa
mov dword [ebp - 0xac], 0x80020004
mov dword [ebp - 0xb4], 0xa
mov dword [ebp - 0xcc], 0x4389ec
mov dword [ebp - 0xd4], 8
lea edx, [ebp - 0xd4]
lea ecx, [ebp - 0xa4]
call dword [fcn.0040157c]
mov edx, dword [ebp - 0x80]
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x80], 0
push 0x438930
mov edx, dword [ebp - 0x150]
lea ecx, [ebp - 0x5c]
call dword [fcn.004015bc]
push eax
call dword [fcn.0040128c]
mov edx, eax
lea ecx, [ebp - 0x60]
call dword [fcn.004015bc]
push eax
push 0x438968
call dword [fcn.0040128c]
mov edx, eax
lea ecx, [ebp - 0x64]
call dword [fcn.004015bc]
push eax
push 0x43264c
call dword [fcn.0040128c]
mov edx, eax
lea ecx, [ebp - 0x68]
call dword [fcn.004015bc]
push eax
push 0x438974
call dword [fcn.0040128c]
mov edx, eax
lea ecx, [ebp - 0x6c]
call dword [fcn.004015bc]
push eax
push 0x438968
call dword [fcn.0040128c]
mov edx, eax
lea ecx, [ebp - 0x70]
call dword [fcn.004015bc]
push eax
push 0x4334b4
call dword [fcn.0040128c]
mov edx, eax
lea ecx, [ebp - 0x74]
call dword [fcn.004015bc]
push eax
push 0x4389d4
call dword [fcn.0040128c]
mov edx, eax
lea ecx, [ebp - 0x78]
call dword [fcn.004015bc]
push eax
push 0x43264c
call dword [fcn.0040128c]
mov edx, eax
lea ecx, [ebp - 0x7c]
call dword [fcn.004015bc]
push eax
push 0x4389e4
call dword [fcn.0040128c]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x94], 8
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0xb4]
push ecx
lea edx, [ebp - 0xa4]
push edx
push 0x31
lea eax, [ebp - 0x94]
push eax
call dword [fcn.00401308]
xor ecx, ecx
cmp eax, 2
sete cl
neg ecx
mov word [ebp - 0x118], cx
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x78]
push ecx
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0xa
call dword [fcn.00401538]
add esp, 0x2c
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0xb4]
push ecx
lea edx, [ebp - 0xa4]
push edx
lea eax, [ebp - 0x94]
push eax
push 4
call dword [fcn.00401230]
add esp, 0x14
movsx ecx, word [ebp - 0x118]
test ecx, ecx
je 0x4c97c8
jmp 0x4ca3c5
mov dword [ebp - 4], 0x5f
mov edx, dword [0x5c82f0]
push edx
push 0x438418
call dword [fcn.00401394]
test eax, eax
jne 0x4c98e4
mov dword [ebp - 4], 0x60
mov word [0x5c81d4], 0
mov dword [ebp - 4], 0x61
cmp dword [0x5cb640], 0
jne 0x4c9825
push 0x5cb640
push 0x435814
call dword [0x401514]
mov dword [ebp - 0x170], 0x5cb640
jmp 0x4c982f
mov dword [ebp - 0x170], 0x5cb640
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax]
mov dword [ebp - 0x118], ecx
cmp dword [0x5c8ac8], 0
jne 0x4c9862
push 0x5c8ac8
push 0x420cf8
call dword [0x401514]
mov dword [ebp - 0x174], 0x5c8ac8
jmp 0x4c986c
mov dword [ebp - 0x174], 0x5c8ac8
mov edx, dword [ebp - 0x174]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x84]
push ecx
call dword [fcn.0040131c]
push eax
mov edx, dword [ebp - 0x118]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x118]
push ecx
call dword [eax + 0xc]
fnclex
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jge 0x4c98c9
push 0xc
push 0x435804
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x11c]
push eax
call dword [fcn.004012b8]
mov dword [ebp - 0x178], eax
jmp 0x4c98d3
mov dword [ebp - 0x178], 0
lea ecx, [ebp - 0x84]
call dword [fcn.00401630]
jmp 0x4ca3c5
mov dword [ebp - 4], 0x63
mov word [0x5c80a0], 0xffff
mov dword [ebp - 4], 0x64
mov word [0x5c80a2], 0
mov dword [ebp - 4], 0x65
mov dword [0x5c80a8], 0
mov dword [ebp - 4], 0x66
mov word [0x5c80ac], 0
mov dword [ebp - 4], 0x67
mov word [0x5c80a4], 0
mov dword [ebp - 4], 0x68
mov word [0x5c8320], 0
mov dword [ebp - 4], 0x69
mov ecx, dword [0x5c82f0]
push ecx
call dword [fcn.00401224]
cmp eax, 3
jle 0x4c9bad
mov dword [ebp - 4], 0x6a
push 3
mov edx, dword [0x5c82f0]
push edx
call dword [fcn.00401594]
mov edx, eax
lea ecx, [ebp - 0x5c]
call dword [fcn.004015bc]
push eax
push 0x438d38
call dword [fcn.00401394]
neg eax
sbb eax, eax
inc eax
neg eax
mov word [ebp - 0x118], ax
lea ecx, [ebp - 0x5c]
call dword [fcn.0040162c]
movsx eax, word [ebp - 0x118]
test eax, eax
je 0x4c9bad
mov dword [ebp - 4], 0x6b
mov word [0x5c83fc], 0xffff
mov dword [ebp - 4], 0x6c
mov word [0x5c83c4], 0xffff
mov dword [ebp - 4], 0x6d
mov word [0x5c8320], 0xffff
mov dword [ebp - 4], 0x6e
push 4
mov ecx, dword [0x5c82f0]
push ecx
call dword [fcn.00401594]
mov edx, eax
lea ecx, [ebp - 0x5c]
call dword [fcn.004015bc]
push eax
push 0x438d44
call dword [fcn.00401394]
neg eax
sbb eax, eax
inc eax
neg eax
mov word [ebp - 0x118], ax
lea ecx, [ebp - 0x5c]
call dword [fcn.0040162c]
movsx edx, word [ebp - 0x118]
test edx, edx
je 0x4c9a50
mov dword [ebp - 4], 0x6f
mov edx, 0x43352c
mov ecx, 0x5c82f0
call dword [fcn.00401528]
jmp 0x4c9bad
mov dword [ebp - 4], 0x71
mov eax, dword [0x5c82f0]
push eax
call dword [fcn.00401224]
sub eax, 3
jo 0x4ca458
push eax
mov ecx, dword [0x5c82f0]
push ecx
call dword [fcn.004015b8]
mov edx, eax
lea ecx, [ebp - 0x5c]
call dword [fcn.004015bc]
push eax
call dword [fcn.00401270]
mov edx, eax
lea ecx, [ebp - 0x64]
call dword [fcn.004015bc]
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x64], 0
push 0x438d6c
mov edx, dword [ebp - 0x154]
lea ecx, [ebp - 0x60]
call dword [fcn.004015bc]
push eax
call fcn.004d7850
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 3
call dword [fcn.00401538]
add esp, 0x10
mov dword [ebp - 4], 0x72
mov edx, 0x43352c
mov ecx, 0x5c82f0
call dword [fcn.00401528]
mov dword [ebp - 4], 0x73
mov word [ebp - 0x50], 0xffff
mov dword [ebp - 4], 0x74
mov word [0x5c80a0], 0xffff
mov dword [ebp - 4], 0x75
cmp dword [0x5c8b9c], 0
jne 0x4c9b38
push 0x5c8b9c
push 0x423a5c
call dword [0x401514]
mov dword [ebp - 0x17c], 0x5c8b9c
jmp 0x4c9b42
mov dword [ebp - 0x17c], 0x5c8b9c
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax]
mov dword [ebp - 0x118], ecx
push 0
mov edx, dword [ebp - 0x118]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x118]
push ecx
call dword [eax + 0x718]
fnclex
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jge 0x4c9b9e
push 0x718
push 0x439084
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x11c]
push eax
call dword [fcn.004012b8]
mov dword [ebp - 0x180], eax
jmp 0x4c9ba8
mov dword [ebp - 0x180], 0
jmp 0x4ca3c5
mov dword [ebp - 4], 0x7a
mov ecx, dword [0x5c82f0]
push ecx
push 0x43352c
call dword [fcn.00401394]
test eax, eax
jne 0x4c9c0d
mov dword [ebp - 4], 0x7b
push 0
push 0
push 1
push 0x433610
push 0x5c82e8
push 0x14
push 0
call dword [fcn.00401408]
add esp, 0x1c
mov dword [ebp - 4], 0x7c
mov dword [0x5c82ec], 0
mov dword [ebp - 4], 0x7d
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0x7f
cmp dword [ebp - 0x28], 0
je 0x4c9ca7
mov dword [ebp - 4], 0x80
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0x81
movsx edx, word [ebp - 0x50]
test edx, edx
jne 0x4c9ca2
mov dword [ebp - 4], 0x82
mov dword [ebp - 0x110], 0
xor edx, edx
lea ecx, [ebp - 0x5c]
call dword [fcn.00401528]
mov dword [ebp - 0x10c], 0x30
push 0xffffffffffffffff
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x5c]
push ecx
push 0x43264c
lea edx, [ebp - 0x10c]
push edx
mov eax, dword [0x5c82dc]
mov ecx, 0x34
sub ecx, dword [eax + 0x14]
mov edx, dword [0x5c82dc]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + ecx*4]
push ecx
call fcn.004c8560
lea ecx, [ebp - 0x5c]
call dword [fcn.0040162c]
jmp 0x4ca1d3
mov dword [ebp - 4], 0x85
mov edx, dword [0x5c82f0]
push edx
push 0x43352c
call dword [fcn.00401394]
test eax, eax
jne 0x4c9cca
xor eax, eax
test eax, eax
je 0x4c9ccf
jmp 0x4ca1d3
mov dword [ebp - 4], 0x88
cmp dword [0x5c8360], 0
jne 0x4c9e03
mov dword [ebp - 4], 0x89
cmp dword [0x5c8bb0], 0
jne 0x4c9d0f
push 0x5c8bb0
push 0x4183c8
call dword [0x401514]
mov dword [ebp - 0x184], 0x5c8bb0
jmp 0x4c9d19
mov dword [ebp - 0x184], 0x5c8bb0
mov ecx, dword [ebp - 0x184]
mov edx, dword [ecx]
mov dword [ebp - 0x118], edx
mov dword [ebp - 0xdc], 0x80020004
mov dword [ebp - 0xe4], 0xa
mov dword [ebp - 0xcc], 1
mov dword [ebp - 0xd4], 3
mov eax, 0x10
call fcn.00412630
mov eax, esp
mov ecx, dword [ebp - 0xe4]
mov dword [eax], ecx
mov edx, dword [ebp - 0xe0]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0xdc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0xd8]
mov dword [eax + 0xc], edx
mov eax, 0x10
call fcn.00412630
mov eax, esp
mov ecx, dword [ebp - 0xd4]
mov dword [eax], ecx
mov edx, dword [ebp - 0xd0]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0xcc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0xc8]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x118]
push edx
call dword [ecx + 0x2b0]
fnclex
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jge 0x4c9df9
push 0x2b0
push 0x439eb4
mov eax, dword [ebp - 0x118]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [fcn.004012b8]
mov dword [ebp - 0x188], eax
jmp 0x4c9e03
mov dword [ebp - 0x188], 0
mov dword [ebp - 4], 0x8b
call 0x599890
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 0x8c
cmp dword [ebp - 0x4c], 0xffffffff
jne 0x4c9f6b
mov dword [ebp - 4], 0x8d
mov dword [ebp - 0xac], 0x80020004
mov dword [ebp - 0xb4], 0xa
mov dword [ebp - 0x9c], 0x80020004
mov dword [ebp - 0xa4], 0xa
mov dword [ebp - 0x8c], 0x80020004
mov dword [ebp - 0x94], 0xa
mov edx, dword [0x5c82dc]
push edx
lea eax, [ebp - 0x58]
push eax
call dword [0x40156c]
mov ecx, dword [ebp - 0x58]
mov edx, 0x36
sub edx, dword [ecx + 0x14]
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax + 0xc]
lea edx, [ecx + edx*4]
mov dword [ebp - 0xcc], edx
mov dword [ebp - 0xd4], 0x4008
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0xa4]
push ecx
lea edx, [ebp - 0x94]
push edx
push 0x34
lea eax, [ebp - 0xd4]
push eax
call dword [fcn.00401308]
mov dword [ebp - 0x10c], eax
lea ecx, [ebp - 0x58]
push ecx
call dword [0x401610]
xor edx, edx
cmp dword [ebp - 0x10c], 6
sete dl
neg edx
mov word [ebp - 0x118], dx
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0xa4]
push ecx
lea edx, [ebp - 0x94]
push edx
push 3
call dword [fcn.00401230]
add esp, 0x10
movsx eax, word [ebp - 0x118]
test eax, eax
je 0x4c9f66
mov dword [ebp - 4], 0x8e
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xd4], 0xb
mov eax, 0x10
call fcn.00412630
mov ecx, esp
mov edx, dword [ebp - 0xd4]
mov dword [ecx], edx
mov eax, dword [ebp - 0xd0]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0xcc]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0xc8]
mov dword [ecx + 0xc], eax
push 0
push 0
call 0x599a20
mov word [ebp - 0x24], ax
jmp 0x4ca1d3
mov dword [ebp - 4], 0x91
cmp dword [ebp - 0x4c], 0x50f
jge 0x4ca0c7
mov dword [ebp - 4], 0x92
mov dword [ebp - 0xac], 0x80020004
mov dword [ebp - 0xb4], 0xa
mov dword [ebp - 0x9c], 0x80020004
mov dword [ebp - 0xa4], 0xa
mov dword [ebp - 0x8c], 0x80020004
mov dword [ebp - 0x94], 0xa
mov ecx, dword [0x5c82dc]
push ecx
lea edx, [ebp - 0x58]
push edx
call dword [0x40156c]
mov eax, dword [ebp - 0x58]
mov ecx, 0x37
sub ecx, dword [eax + 0x14]
mov edx, dword [ebp - 0x58]
mov eax, dword [edx + 0xc]
lea ecx, [eax + ecx*4]
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0xd4], 0x4008
lea edx, [ebp - 0xb4]
push edx
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x94]
push ecx
push 0x34
lea edx, [ebp - 0xd4]
push edx
call dword [fcn.00401308]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x58]
push eax
call dword [0x401610]
xor ecx, ecx
cmp dword [ebp - 0x10c], 6
sete cl
neg ecx
mov word [ebp - 0x118], cx
lea edx, [ebp - 0xb4]
push edx
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x94]
push ecx
push 3
call dword [fcn.00401230]
add esp, 0x10
movsx edx, word [ebp - 0x118]
test edx, edx
je 0x4ca0c2
mov dword [ebp - 4], 0x93
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xd4], 0xb
mov eax, 0x10
call fcn.00412630
mov eax, esp
mov ecx, dword [ebp - 0xd4]
mov dword [eax], ecx
mov edx, dword [ebp - 0xd0]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0xcc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0xc8]
mov dword [eax + 0xc], edx
push 0
push 0
call 0x599a20
mov word [ebp - 0x24], ax
jmp 0x4ca1d3
mov dword [ebp - 4], 0x96
call 0x59b580
cmp eax, 2
jne 0x4ca1d3
mov dword [ebp - 4], 0x97
mov dword [ebp - 0xac], 0x80020004
mov dword [ebp - 0xb4], 0xa
mov dword [ebp - 0x9c], 0x80020004
mov dword [ebp - 0xa4], 0xa
mov dword [ebp - 0x8c], 0x80020004
mov dword [ebp - 0x94], 0xa
mov eax, dword [0x5c82dc]
push eax
lea ecx, [ebp - 0x58]
push ecx
call dword [0x40156c]
mov edx, dword [ebp - 0x58]
mov eax, 0x38
sub eax, dword [edx + 0x14]
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx + 0xc]
lea eax, [edx + eax*4]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xd4], 0x4008
lea ecx, [ebp - 0xb4]
push ecx
lea edx, [ebp - 0xa4]
push edx
lea eax, [ebp - 0x94]
push eax
push 0x34
lea ecx, [ebp - 0xd4]
push ecx
call dword [fcn.00401308]
mov dword [ebp - 0x10c], eax
lea edx, [ebp - 0x58]
push edx
call dword [0x401610]
xor eax, eax
cmp dword [ebp - 0x10c], 6
sete al
neg eax
mov word [ebp - 0x118], ax
lea ecx, [ebp - 0xb4]
push ecx
lea edx, [ebp - 0xa4]
push edx
lea eax, [ebp - 0x94]
push eax
push 3
call dword [fcn.00401230]
add esp, 0x10
movsx ecx, word [ebp - 0x118]
test ecx, ecx
je 0x4ca1d3
mov dword [ebp - 4], 0x98
call 0x59ad90
mov dword [ebp - 4], 0x9f
mov word [0x5c81d4], 0
mov dword [ebp - 4], 0xa0
cmp dword [0x5cb640], 0
jne 0x4ca20f
push 0x5cb640
push 0x435814
call dword [0x401514]
mov dword [ebp - 0x18c], 0x5cb640
jmp 0x4ca219
mov dword [ebp - 0x18c], 0x5cb640
mov edx, dword [ebp - 0x18c]
mov eax, dword [edx]
mov dword [ebp - 0x118], eax
cmp dword [0x5c8b9c], 0
jne 0x4ca24c
push 0x5c8b9c
push 0x423a5c
call dword [0x401514]
mov dword [ebp - 0x190], 0x5c8b9c
jmp 0x4ca256
mov dword [ebp - 0x190], 0x5c8b9c
mov ecx, dword [ebp - 0x190]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 0x84]
push eax
call dword [fcn.0040131c]
push eax
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x118]
push eax
call dword [edx + 0xc]
fnclex
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jge 0x4ca2b3
push 0xc
push 0x435804
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
call dword [fcn.004012b8]
mov dword [ebp - 0x194], eax
jmp 0x4ca2bd
mov dword [ebp - 0x194], 0
lea ecx, [ebp - 0x84]
call dword [fcn.00401630]
mov dword [ebp - 4], 0xa1
movsx eax, word [0x5c82f8]
test eax, eax
je 0x4ca3c5
mov dword [ebp - 4], 0xa2
cmp dword [0x5cb640], 0
jne 0x4ca30b
push 0x5cb640
push 0x435814
call dword [0x401514]
mov dword [ebp - 0x198], 0x5cb640
jmp 0x4ca315
mov dword [ebp - 0x198], 0x5cb640
mov ecx, dword [ebp - 0x198]
mov edx, dword [ecx]
mov dword [ebp - 0x118], edx
cmp dword [0x5c8b9c], 0
jne 0x4ca348
push 0x5c8b9c
push 0x423a5c
call dword [0x401514]
mov dword [ebp - 0x19c], 0x5c8b9c
jmp 0x4ca352
mov dword [ebp - 0x19c], 0x5c8b9c
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x84]
push edx
call dword [fcn.0040131c]
push eax
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x118]
push edx
call dword [ecx + 0x10]
fnclex
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jge 0x4ca3af
push 0x10
push 0x435804
mov eax, dword [ebp - 0x118]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [fcn.004012b8]
mov dword [ebp - 0x1a0], eax
jmp 0x4ca3b9
mov dword [ebp - 0x1a0], 0
lea ecx, [ebp - 0x84]
call dword [fcn.00401630]
push 0x4ca447
jmp 0x4ca43d
lea ecx, [ebp - 0x48]
call dword [fcn.0040162c]
ret
call dword [fcn.004014f8]
int3