Function at 0x4ad4c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x28], ebx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4aea82
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 1], 0
jne 0x4ae91b
cmp byte [0x4baf64], 0
jne 0x4ae91b
cmp dword [0x4baddc], 0xffffffff
jne 0x4addaf
lea ecx, [ebp - 0x84]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0x1f4
lea eax, [ebp - 0x94]
push eax
mov ecx, 0x253
xor edx, edx
mov eax, 0xa
call fcn.004103b8
lea eax, [ebp - 0x94]
pop edx
call fcn.0046fe44
test al, al
je 0x4ad890
mov eax, dword [0x4baf2c]
mov edx, 0x4aea9c
call fcn.00403fc8
jne 0x4ad782
mov ecx, dword [ebp + 8]
add ecx, dword [0x4badc8]
sub ecx, dword [0x4badc0]
sub ecx, 5
add ecx, dword [0x4baf5c]
mov edx, dword [ebp + 0xc]
add edx, dword [0x4baf58]
add edx, 5
mov eax, ebx
call fcn.00496f14
movsx eax, ax
mov dword [0x4baddc], eax
cmp dword [0x4baddc], 0xffffffff
je 0x4aea56
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
cmp dword [edx + eax*8 + 0x18], 1
je 0x4ad5ea
mov edx, dword [0x4bae08]
cmp dword [edx + eax*8 + 0x10], 5
jne 0x4ad626
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0
mov ecx, 0x4aeab0
mov edx, 0x4aeab0
mov eax, ebx
call fcn.004a8ef4
mov dword [0x4baddc], 0xffffffff
jmp 0x4aea56
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.00499118
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.004a09a8
mov dword [0x4baddc], 0xffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0
mov ecx, 0x4aeac8
mov edx, 0x4aeac8
mov eax, ebx
call fcn.004a8ef4
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0
mov ecx, 0x4aeae0
mov edx, 0x4aeae0
mov eax, ebx
call fcn.004a8ef4
dec dword [0x4baea8]
lea edx, [ebp - 0x98]
mov eax, dword [0x4baea8]
call fcn.004087d0
mov ecx, dword [ebp - 0x98]
mov edx, 0x4aeafc
mov eax, ebx
call fcn.004935c8
cmp dword [0x4baea8], 0
jne 0x4ad6e1
mov edx, 0x4aeb18
mov eax, ebx
call fcn.004a2cd0
mov eax, ebx
call fcn.004aa5ac
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.004a0538
imul eax, dword [ebp - 0x20], 0xb
mov edx, dword [0x4badf8]
movzx edx, byte [edx + eax*2]
imul edx, edx, 0x27
mov ecx, dword [0x4badf4]
movzx edx, byte [ecx + edx*2 + 0x2b]
mov ecx, dword [0x4badf8]
lea eax, [ecx + eax*2]
movzx eax, word [eax + edx*2 + 2]
mov edx, dword [0x4badf0]
movsx eax, word [edx + eax*4 + 2]
add eax, 0xffffffb0
mov dword [0x4badcc], eax
mov eax, dword [0x4bae6c]
add eax, dword [0x4badc0]
cmp eax, dword [0x4badcc]
jle 0x4ad747
mov dword [0x4badcc], eax
mov eax, dword [0x4bae70]
sub eax, dword [0x4badc4]
cmp eax, dword [0x4badcc]
jge 0x4ad75f
mov dword [0x4badcc], eax
mov eax, dword [0x4badcc]
add eax, dword [0x4badc8]
sar eax, 1
jns 0x4ad771
adc eax, 0
mov dword [0x4badd0], eax
mov eax, ebx
call fcn.004a2840
jmp 0x4aea56
mov eax, dword [0x4baf2c]
mov edx, 0x4aeb2c
call fcn.00403fc8
jne 0x4ad864
mov ecx, dword [ebp + 8]
add ecx, dword [0x4badc8]
sub ecx, dword [0x4badc0]
sub ecx, 5
add ecx, dword [0x4baf5c]
mov edx, dword [ebp + 0xc]
add edx, dword [0x4baf58]
add edx, 5
mov eax, ebx
call fcn.00496f14
movsx eax, ax
mov dword [0x4baddc], eax
cmp dword [0x4baddc], 0xffffffff
jne 0x4ad7ee
mov ecx, dword [ebp + 8]
add ecx, dword [0x4baf5c]
mov edx, dword [ebp + 0xc]
add edx, dword [0x4baf58]
mov eax, ebx
call fcn.004a30c4
jmp 0x4ad846
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movzx eax, byte [edx + eax*8]
imul eax, eax, 0x4c
mov edx, dword [0x4bae04]
cmp dword [edx + eax*8 + 0x10], 1
je 0x4ad823
mov dword [0x4baddc], 0xffffffff
jmp 0x4aea56
mov ecx, dword [ebp + 8]
add ecx, dword [0x4baf5c]
mov edx, dword [ebp + 0xc]
add edx, dword [0x4baf58]
mov eax, ebx
call fcn.004a30c4
mov dword [0x4baddc], 0xffffffff
cmp dword [0x4baea4], 0
jne 0x4aea56
mov edx, 0x4aeb18
mov eax, ebx
call fcn.004a2cd0
jmp 0x4aea56
mov ecx, dword [ebp + 8]
add ecx, dword [0x4badc8]
sub ecx, dword [0x4badc0]
sub ecx, 5
mov edx, dword [ebp + 0xc]
add edx, 5
mov eax, ebx
call fcn.00496f14
movsx eax, ax
mov dword [0x4baddc], eax
jmp 0x4ada75
lea ecx, [ebp - 0x84]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
call fcn.004103a0
lea edx, [ebp - 0x84]
mov eax, 0x4baf30
call fcn.0046fe44
test al, al
je 0x4ad8cf
cmp dword [0x4baea8], 0
jle 0x4ad8cf
mov edx, 0x4aea9c
mov eax, ebx
call fcn.004a2cd0
jmp 0x4aea56
lea ecx, [ebp - 0x84]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
call fcn.004103a0
lea edx, [ebp - 0x84]
mov eax, 0x4baf40
call fcn.0046fe44
test al, al
je 0x4ad90e
cmp dword [0x4baea4], 0
jle 0x4ad90e
mov edx, 0x4aeb2c
mov eax, ebx
call fcn.004a2cd0
jmp 0x4aea56
mov eax, dword [0x4baf2c]
mov edx, 0x4aea9c
call fcn.00403fc8
jne 0x4ada3e
mov ecx, dword [ebp + 8]
add ecx, dword [0x4baf54]
mov edx, dword [ebp + 0xc]
add edx, dword [0x4baf50]
mov eax, ebx
call fcn.00496f14
movsx eax, ax
mov dword [0x4baddc], eax
cmp dword [0x4baddc], 0xffffffff
je 0x4aea56
mov eax, dword [0x4bae68]
cmp eax, dword [0x4baddc]
jne 0x4ad96d
mov dword [0x4baddc], 0xffffffff
jmp 0x4aea56
mov edx, dword [0x4baddc]
mov eax, dword [0x4baf90]
call fcn.00470128
mov edx, 0x4baf90
call fcn.004700d4
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.004a09a8
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0
mov ecx, 0x4aeac8
mov edx, 0x4aeac8
mov eax, ebx
call fcn.004a8ef4
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0
mov ecx, 0x4aeae0
mov edx, 0x4aeae0
mov eax, ebx
call fcn.004a8ef4
mov dword [0x4baddc], 0xffffffff
dec dword [0x4baea8]
lea edx, [ebp - 0x9c]
mov eax, dword [0x4baea8]
call fcn.004087d0
mov ecx, dword [ebp - 0x9c]
mov edx, 0x4aeafc
mov eax, ebx
call fcn.004935c8
cmp dword [0x4baea8], 0
jne 0x4aea56
mov edx, 0x4aeb18
mov eax, ebx
call fcn.004a2cd0
jmp 0x4aea56
mov eax, dword [0x4baf2c]
mov edx, 0x4aeb2c
call fcn.00403fc8
jne 0x4ada60
mov edx, 0x4aeb18
mov eax, ebx
call fcn.004a2cd0
jmp 0x4aea56
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, ebx
call fcn.00496f14
movsx eax, ax
mov dword [0x4baddc], eax
cmp dword [0x4baddc], 0xffffffff
je 0x4ae91b
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov eax, dword [edx + eax*8 + 0x10]
test eax, eax
je 0x4adda0
mov edx, dword [0x4baddc]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [0x4bae08]
cmp eax, 5
je 0x4adda0
mov edx, dword [0x4baddc]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [0x4bae08]
cmp eax, 6
je 0x4adda0
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x10]
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.00499668
mov byte [0x4b9770], al
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
cmp dword [edx + eax*8 + 0x10], 2
jne 0x4adb29
mov edx, dword [0x4baddc]
mov eax, dword [0x4baf90]
call fcn.00470128
cmp eax, 0xffffffff
je 0x4adb29
mov edx, 0x4baf90
call fcn.004700d4
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
cmp dword [edx + eax*8 + 0x10], 1
jne 0x4adc7d
mov eax, dword [0x4baddc]
cmp eax, dword [0x4bae78]
jne 0x4adc36
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.00499118
mov eax, ebx
call fcn.004aa5ac
mov dword [0x4bae78], 0xffffffff
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movzx eax, byte [edx + eax*8]
imul eax, eax, 0x4c
mov edx, dword [0x4bae04]
mov eax, dword [edx + eax*8 + 0x10]
test eax, eax
jle 0x4adc0c
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], 1
cmp byte [0x4bafc1], 0
je 0x4adbb5
dec dword [0x4baeac]
cmp byte [0x4b97a0], 0
jne 0x4adc04
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movzx eax, byte [edx + eax*8]
imul eax, eax, 0x4c
mov edx, dword [0x4bae04]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 0x18]
lea edx, [edx + edx*2]
mov eax, dword [eax + edx*4 + 0x194]
mov edx, eax
shl eax, 6
sub eax, edx
mov edx, dword [0x4bae00]
movzx eax, byte [edx + eax*2]
sub dword [0x4baeac], eax
inc dword [ebp - 0x18]
dec dword [ebp - 0x38]
jne 0x4adba6
lea edx, [ebp - 0xa0]
mov eax, dword [0x4bafc4]
add eax, dword [0x4baeac]
call fcn.004087d0
mov ecx, dword [ebp - 0xa0]
mov edx, 0x4aeb40
mov eax, ebx
call fcn.004935c8
jmp 0x4adc7d
cmp byte [0x4baded], 0
jne 0x4adc4e
mov dword [0x4baddc], 0xffffffff
jmp 0x4aea56
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.004a0ad0
test al, al
je 0x4adc6e
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.00499118
jmp 0x4adc7d
mov dword [0x4baddc], 0xffffffff
jmp 0x4aea56
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
cmp dword [edx + eax*8 + 0x10], 4
jne 0x4adca8
mov dword [0x4bae68], 0xffffffff
xor edx, edx
mov dword [0x4baf74], edx
mov edx, dword [0x4bae08]
mov dword [edx + eax*8 + 0x10], 3
lea ecx, [ebp - 0xc]
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.00499de0
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov dword [edx + eax*8 + 4], ecx
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 8]
mov dword [edx + eax*8 + 8], ecx
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
cmp byte [edx + eax*8 + 0x14], 0
je 0x4add46
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0
mov ecx, 0x4aeb5c
mov edx, 0x4aeb5c
mov eax, ebx
call fcn.004a8ef4
jmp 0x4add73
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0
mov ecx, 0x4aeb74
mov edx, 0x4aeb74
mov eax, ebx
call fcn.004a8ef4
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov byte [edx + eax*8 + 0x14], 0
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.004a0538
mov eax, ebx
call fcn.004a2840
jmp 0x4ae91b
mov dword [0x4baddc], 0xffffffff
jmp 0x4ae91b
lea ecx, [ebp - 0x84]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0x1f4
lea eax, [ebp - 0x94]
push eax
mov ecx, 0x320
mov edx, 0x190
mov eax, 0x258
call fcn.004103b8
lea eax, [ebp - 0x94]
pop edx
call fcn.0046fe44
test al, al
je 0x4adf81
cmp dword [0x4bae68], 0xffffffff
jne 0x4adf81
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, dword [0x4baf74]
cdq
cmp edx, dword [esp + 4]
jne 0x4ade29
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x4ade31
jmp 0x4aea56
pop edx
pop eax
jg 0x4aea56
mov eax, dword [0x4baddc]
mov dword [0x4bae68], eax
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov dword [edx + eax*8 + 4], 0x267
lea eax, [ebp - 0xa4]
mov edx, dword [0x4baddc]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [0x4bae08]
movzx edx, byte [ecx + edx*8]
imul edx, edx, 0x4c
mov ecx, dword [0x4bae04]
lea edx, [ecx + edx*8 + 0x14]
call fcn.00403e5c
mov edx, dword [ebp - 0xa4]
mov eax, dword [0x4bad9c]
call fcn.004b1524
shl eax, 2
mov edx, dword [0x4bad9c]
mov edx, dword [edx + 0x14]
mov ecx, 0x1e0
sub ecx, dword [edx + eax*8 + 0x10]
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov dword [edx + eax*8 + 8], ecx
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov dword [edx + eax*8 + 0x10], 4
mov dword [0x4baddc], 0xffffffff
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, dword [0x4baebc]
cdq
cmp edx, dword [esp + 4]
jne 0x4adf01
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x4adf35
jmp 0x4adf05
pop edx
pop eax
jle 0x4adf35
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x84], eax
xor eax, eax
mov dword [ebp - 0x80], eax
fild qword [ebp - 0x84]
fild dword [0x4baeb4]
fdiv dword [0x4aeb80]
faddp st(1)
call fcn.00402a5c
mov dword [0x4baf74], eax
jmp 0x4adf45
call sub.kernel32.dll_GetTickCount
add eax, dword [0x4baeb4]
mov dword [0x4baf74], eax
mov dword [0x4baf20], 0xffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0
mov ecx, 0x4aeb8c
mov edx, 0x4aeb8c
mov eax, ebx
call fcn.004a8ef4
jmp 0x4ae914
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x10]
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.00499668
test al, al
je 0x4ae914
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movzx eax, byte [edx + eax*8]
imul eax, eax, 0x4c
mov edx, dword [0x4bae04]
mov eax, dword [edx + eax*8 + 0x10]
test eax, eax
jl 0x4ae02e
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], 0
lea edi, [ebp - 0x80]
mov edx, dword [edi]
mov eax, dword [0x4bae24]
call fcn.00470128
mov esi, eax
cmp esi, 0xffffffff
je 0x4ae023
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movzx eax, byte [edx + eax*8]
imul eax, eax, 0x4c
mov edx, dword [0x4bae04]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 0x18]
lea edx, [edx + edx*2]
mov eax, dword [eax + edx*4 + 0x194]
mov edx, dword [0x4bae28]
cmp eax, dword [edx + esi*4]
jne 0x4aea56
inc dword [ebp - 0x18]
add edi, 4
dec dword [ebp - 0x38]
jne 0x4adfd2
mov byte [ebp - 0x29], 1
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movzx eax, byte [edx + eax*8]
imul eax, eax, 0x4c
mov edx, dword [0x4bae04]
mov eax, dword [edx + eax*8 + 0x10]
test eax, eax
jle 0x4ae07c
mov dword [ebp - 0x38], eax
lea edi, [ebp - 0x7c]
mov eax, dword [edi]
mov edx, dword [0x4bae24]
call fcn.00470068
test al, al
jne 0x4ae074
mov byte [ebp - 0x29], 0
add edi, 4
dec dword [ebp - 0x38]
jne 0x4ae05f
cmp byte [ebp - 0x29], 0
jne 0x4ae116
cmp byte [0x4badec], 0
jne 0x4ae0c4
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movzx eax, byte [edx + eax*8]
imul eax, eax, 0x4c
mov edx, dword [0x4bae04]
mov ecx, dword [edx + eax*8 + 0x10]
lea edx, [ebp - 0x7c]
mov eax, ebx
call fcn.004a0db8
test al, al
je 0x4aea56
cmp byte [0x4badec], 2
jne 0x4ae116
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movzx eax, byte [edx + eax*8]
imul eax, eax, 0x4c
mov edx, dword [0x4bae04]
mov ecx, dword [edx + eax*8 + 0x10]
lea edx, [ebp - 0x7c]
mov eax, ebx
call fcn.004a0db8
test al, al
jne 0x4ae116
mov ecx, dword [0x4baddc]
lea edx, [ebp - 0x7c]
mov eax, ebx
call fcn.004a0e4c
test al, al
je 0x4aea56
lea edx, [ebp - 0x7c]
mov eax, ebx
call fcn.004a24fc
test al, al
je 0x4ae156
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0
mov ecx, 0x4aeba8
mov edx, 0x4aeba8
mov eax, ebx
call fcn.004a8ef4
jmp 0x4aea56
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movsx ecx, word [ebp - 0x10]
mov dword [edx + eax*8 + 4], ecx
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movsx ecx, word [ebp - 0xe]
mov dword [edx + eax*8 + 8], ecx
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov dword [edx + eax*8 + 0x10], 1
mov eax, dword [0x4bae1c]
call fcn.00405240
push eax
mov eax, 0x4bae74
mov ecx, 1
mov edx, dword [0x46fe28]
call fcn.004053fc
add esp, 4
mov eax, dword [0x4bae1c]
call fcn.00405248
test eax, eax
jl 0x4ae1f2
inc eax
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, dword [0x4bae1c]
mov eax, dword [eax + esi*4]
mov edx, dword [0x4bae74]
mov dword [edx + esi*4], eax
inc esi
dec dword [ebp - 0x38]
jne 0x4ae1db
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movzx eax, byte [edx + eax*8]
imul eax, eax, 0x4c
mov edx, dword [0x4bae04]
mov eax, dword [edx + eax*8 + 0x10]
test eax, eax
jle 0x4ae482
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], 1
lea edi, [ebp - 0x7c]
mov edx, dword [edi]
mov eax, 0x4bae14
call fcn.00470198
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movzx eax, byte [edx + eax*8]
imul eax, eax, 0x4c
mov edx, dword [0x4bae04]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 0x18]
lea edx, [edx + edx*2]
mov edx, dword [eax + edx*4 + 0x194]
mov eax, 0x4bae18
call fcn.00470198
mov eax, 0x4bae20
mov edx, dword [0x4baddc]
call fcn.00470198
lea ecx, [ebp - 0x28]
mov edx, dword [edi]
mov eax, ebx
call fcn.0049fb7c
mov eax, dword [ebp - 0x28]
call fcn.00405248
inc eax
jne 0x4ae2e3
mov eax, ebx
call fcn.004a0484
mov esi, eax
mov dword [0x4bae5c], esi
mov eax, 0x4bae1c
mov edx, esi
call fcn.00470198
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov ecx, dword [0x4bae5c]
mov dword [edx + eax*8 + 0xc], ecx
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.004a0538
mov dword [ebp - 0x1c], 0xffffffff
jmp 0x4ae473
mov eax, dword [ebp - 0x28]
call fcn.00470260
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
call fcn.00470128
lea edx, [ebp - 0x28]
call fcn.004700d4
mov eax, 0x4bae1c
mov edx, dword [ebp - 0x1c]
call fcn.00470198
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov ecx, dword [ebp - 0x1c]
mov dword [edx + eax*8 + 0xc], ecx
mov eax, dword [0x4bae1c]
call fcn.00405248
test eax, eax
jl 0x4ae41c
inc eax
mov dword [ebp - 0x3c], eax
xor esi, esi
mov eax, dword [0x4bae1c]
mov eax, dword [eax + esi*4]
mov edx, dword [ebp - 0x28]
call fcn.00470068
test al, al
je 0x4ae412
mov eax, dword [0x4bae20]
mov eax, dword [eax + esi*4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
cmp dword [edx + eax*8 + 0x10], 6
je 0x4ae3e0
mov eax, dword [0x4bae14]
mov eax, dword [eax + esi*4]
mov edx, dword [0x4bae7c]
call fcn.00470068
test al, al
jne 0x4ae3e0
mov eax, dword [0x4bae20]
mov eax, dword [eax + esi*4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
cmp byte [edx + eax*8 + 0x16], 0
jne 0x4ae3e0
cmp dword [ebp - 0x1c], 1
jne 0x4ae3e0
mov eax, dword [0x4bae20]
mov eax, dword [eax + esi*4]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0
mov ecx, 0x4aebc0
mov edx, 0x4aebc0
mov eax, ebx
call fcn.004a8ef4
mov eax, dword [0x4bae1c]
mov edx, dword [ebp - 0x1c]
mov dword [eax + esi*4], edx
mov eax, dword [0x4bae20]
mov eax, dword [eax + esi*4]
cmp eax, 0xffffffff
je 0x4ae412
mov edx, dword [0x4bae20]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov ecx, dword [ebp - 0x1c]
mov dword [edx + eax*8 + 0xc], ecx
inc esi
dec dword [ebp - 0x3c]
jne 0x4ae33f
push 0
lea eax, [ebp - 0x28]
mov ecx, 1
mov edx, dword [0x46fe28]
call fcn.004053fc
add esp, 4
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.004a0538
test al, al
je 0x4ae473
mov byte [0x4baf64], 1
mov byte [0x4badd4], 2
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.004aa128
mov dword [0x4baddc], 0xffffffff
mov eax, ebx
call fcn.004ab084
jmp 0x4aea56
inc dword [ebp - 0x18]
add edi, 4
dec dword [ebp - 0x38]
jne 0x4ae22a
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.004a1130
test al, al
je 0x4ae635
mov edx, dword [0x4bae24]
mov eax, dword [ebp - 0x7c]
call fcn.00470068
test al, al
jne 0x4ae635
mov eax, ebx
call fcn.004a1360
test al, al
jne 0x4ae635
mov ecx, 0xbb8
mov edx, 0x4aebd4
mov eax, ebx
call fcn.00494bf4
mov eax, dword [0x4bae1c]
call fcn.00405248
test eax, eax
jl 0x4ae5b3
inc eax
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, dword [0x4bae1c]
mov eax, dword [eax + esi*4]
cmp eax, dword [ebp - 0x1c]
jne 0x4ae5a9
mov eax, dword [0x4bae20]
cmp dword [eax + esi*4], 0xffffffff
je 0x4ae5a9
mov eax, dword [0x4bae14]
mov eax, dword [eax + esi*4]
mov edx, dword [0x4bae7c]
call fcn.00470068
test al, al
jne 0x4ae5a9
mov eax, dword [0x4bae20]
mov eax, dword [eax + esi*4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov eax, dword [edx + eax*8 + 8]
mov edx, dword [0x4badc8]
sub edx, dword [0x4badc0]
sub edx, 0x28
cmp eax, edx
jle 0x4ae5a9
mov eax, dword [0x4bae20]
mov eax, dword [eax + esi*4]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov eax, dword [edx + eax*8 + 8]
mov edx, dword [0x4badc8]
add edx, dword [0x4badc4]
add edx, 0xa
cmp eax, edx
jge 0x4ae5a9
mov eax, dword [0x4bae20]
mov eax, dword [eax + esi*4]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0
mov ecx, 0x4aebec
mov edx, 0x4aebec
mov eax, ebx
call fcn.004a8ef4
inc esi
dec dword [ebp - 0x38]
jne 0x4ae4e2
mov eax, dword [0x4bae74]
call fcn.00405248
test eax, eax
jl 0x4ae609
inc eax
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, dword [0x4bae74]
mov eax, dword [eax + esi*4]
mov edx, dword [0x4bae1c]
mov dword [edx + esi*4], eax
mov edx, dword [0x4bae20]
mov edx, dword [edx + esi*4]
cmp edx, 0xffffffff
je 0x4ae603
mov ecx, dword [0x4bae20]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [0x4bae08]
mov edi, dword [0x4bae1c]
mov dword [ecx + edx*8 + 0xc], eax
inc esi
dec dword [ebp - 0x38]
jne 0x4ae5c7
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.00499118
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov dword [edx + eax*8 + 0xc], 0xffffffff
jmp 0x4ae81d
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
cmp byte [edx + eax*8 + 0x15], 0
je 0x4ae68a
mov edx, dword [0x4bae08]
mov byte [edx + eax*8 + 0x15], 0
mov eax, dword [0x4baddc]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0
mov ecx, 0x4aec00
mov edx, 0x4aec18
mov eax, ebx
call fcn.004a8ef4
mov eax, dword [0x4baddc]
mov dword [0x4bae78], eax
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movzx eax, byte [edx + eax*8]
imul eax, eax, 0x4c
mov edx, dword [0x4bae04]
mov eax, dword [edx + eax*8 + 0x10]
test eax, eax
jle 0x4ae7f8
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], 1
lea edi, [ebp - 0x7c]
cmp byte [0x4bafc1], 0
je 0x4ae6db
inc dword [0x4baeac]
cmp byte [0x4b97a0], 0
jne 0x4ae72a
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movzx eax, byte [edx + eax*8]
imul eax, eax, 0x4c
mov edx, dword [0x4bae04]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 0x18]
lea edx, [edx + edx*2]
mov eax, dword [eax + edx*4 + 0x194]
mov edx, eax
shl eax, 6
sub eax, edx
mov edx, dword [0x4bae00]
movzx eax, byte [edx + eax*2]
add dword [0x4baeac], eax
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movzx eax, byte [edx + eax*8]
imul eax, eax, 0x4c
mov edx, dword [0x4bae04]
lea eax, [edx + eax*8]
mov edx, dword [ebp - 0x18]
lea edx, [edx + edx*2]
mov eax, dword [eax + edx*4 + 0x194]
mov edx, eax
shl eax, 6
sub eax, edx
mov edx, dword [0x4bae00]
movzx eax, byte [edx + eax*2]
add dword [0x4baeb0], eax
lea edx, [ebp - 0xa8]
mov eax, dword [0x4bafc4]
add eax, dword [0x4baeac]
call fcn.004087d0
mov ecx, dword [ebp - 0xa8]
mov edx, 0x4aeb40
mov eax, ebx
call fcn.004935c8
mov edx, dword [edi]
mov eax, dword [0x4bae24]
call fcn.00470128
mov esi, eax
inc esi
je 0x4ae7e9
mov edx, dword [edi]
mov eax, dword [0x4bae14]
call fcn.00470128
mov edx, dword [0x4bae20]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x4ae7e9
mov eax, esi
shl eax, 3
sub eax, esi
mov edx, dword [0x4bae08]
cmp dword [edx + eax*8 + 0x10], 6
jne 0x4ae7e9
mov edx, esi
mov eax, ebx
call fcn.00499118
mov edx, esi
mov eax, ebx
call fcn.004a09a8
inc dword [ebp - 0x18]
add edi, 4
dec dword [ebp - 0x38]
jne 0x4ae6cc
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.004aa128
mov dword [0x4baddc], 0xffffffff
mov eax, ebx
call fcn.004a1678
mov eax, ebx
call fcn.004aa838
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0
mov ecx, 0x4aec30
mov edx, 0x4aec30
mov eax, ebx
call fcn.004a8ef4
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.004a0538
test al, al
je 0x4ae889
mov byte [0x4baf64], 1
mov byte [0x4badd4], 2
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.004aa128
mov dword [0x4baddc], 0xffffffff
mov eax, ebx
call fcn.004ab084
jmp 0x4aea56
imul eax, dword [ebp - 0x20], 0xb
mov edx, dword [0x4badf8]
movzx edx, byte [edx + eax*2]
imul edx, edx, 0x27
mov ecx, dword [0x4badf4]
movzx edx, byte [ecx + edx*2 + 0x2b]
mov ecx, dword [0x4badf8]
lea eax, [ecx + eax*2]
movzx eax, word [eax + edx*2 + 2]
mov edx, dword [0x4badf0]
movsx eax, word [edx + eax*4 + 2]
add eax, 0xffffffb0
mov dword [0x4badcc], eax
mov eax, dword [0x4bae6c]
add eax, dword [0x4badc0]
cmp eax, dword [0x4badcc]
jle 0x4ae8de
mov dword [0x4badcc], eax
mov eax, dword [0x4bae70]
sub eax, dword [0x4badc4]
cmp eax, dword [0x4badcc]
jge 0x4ae8f6
mov dword [0x4badcc], eax
mov eax, dword [0x4badcc]
add eax, dword [0x4badc8]
sar eax, 1
jns 0x4ae908
adc eax, 0
mov dword [0x4badd0], eax
mov eax, ebx
call fcn.004a2840
mov eax, ebx
call fcn.004ab830
cmp byte [ebp - 1], 1
jne 0x4aea56
mov eax, dword [0x4baf2c]
mov edx, 0x4aeb18
call fcn.00403fc8
je 0x4ae942
mov edx, 0x4aeb18
mov eax, ebx
call fcn.004a2cd0
cmp dword [0x4baddc], 0xffffffff
je 0x4aea56
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
xor edx, edx
xor eax, eax
call fcn.004103a0
lea eax, [ebp - 0x84]
push eax
push 0
mov ecx, 0x4aec44
mov edx, 0x4aec44
mov eax, ebx
call fcn.004a8ef4
cmp byte [0x4bade4], 0
je 0x4ae9aa
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.00499cfc
mov edx, dword [0x4baddc]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [0x4bae08]
mov byte [ecx + edx*8], al
jmp 0x4ae9ea
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
movzx eax, byte [edx + eax*8]
imul eax, eax, 0x4c
mov edx, dword [0x4bae04]
mov edx, dword [edx + eax*8 + 4]
mov eax, ebx
call fcn.00499b84
mov edx, dword [0x4baddc]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov ecx, dword [0x4bae08]
mov byte [ecx + edx*8], al
lea ecx, [ebp - 0xc]
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.00499de0
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov dword [edx + eax*8 + 4], ecx
mov eax, dword [0x4baddc]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x4bae08]
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 8]
mov dword [edx + eax*8 + 8], ecx
mov dword [0x4baf9c], 0xffffffff
push 0x4baee0
lea ecx, [ebp - 0x10]
mov edx, dword [0x4baddc]
mov eax, ebx
call fcn.00499668
mov byte [0x4b9770], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aea89
lea eax, [ebp - 0xa8]
mov edx, 5
call fcn.00403c5c
lea eax, [ebp - 0x28]
mov edx, dword [0x46fe28]
call fcn.00405408
ret