Function at 0x4862d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c5c87
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa4
mov eax, dword [0x51eea4]
xor eax, dword [esp + 0xb0]
push ebx
push ebp
push esi
mov ebp, ecx
mov dword [esp + 0xac], eax
push edi
mov dword [esp + 0x44], ebp
xor ebx, ebx
lea esi, [ebp + 4]
mov dword [esp + 0xbc], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea eax, [ebp + 0x74]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
lea eax, [ebp + 0x7c]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
lea eax, [ebp + 0x8c]
mov dword [eax], ecx
mov dword [eax + 4], ecx
lea eax, [ebp + 0x94]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [ebp + 0xa0], ebx
mov dword [ebp + 0xa4], ebx
mov dword [ebp + 0xa8], ebx
mov dword [ebp + 0xac], ebx
mov dword [ebp + 0xb0], ebx
mov dword [ebp + 0xb4], ebx
mov dword [ebp + 0xb8], ebx
mov dword [ebp + 0xbc], ebx
xor eax, eax
mov dword [ebp + 0xc8], eax
mov dword [ebp + 0xcc], eax
mov dword [ebp + 0xd4], ebx
mov dword [ebp + 0xd8], ebx
mov dword [ebp + 0xdc], ebx
mov dword [ebp + 0xe4], ebx
mov dword [ebp + 0xe8], ebx
mov dword [ebp + 0xec], ebx
mov dword [ebp + 0xf4], ebx
mov dword [ebp + 0xf8], ebx
mov dword [ebp + 0xfc], ebx
mov dword [ebp + 0x104], ebx
mov dword [ebp + 0x108], ebx
mov dword [ebp + 0x14c], ebx
push 0xa
mov ecx, esi
mov byte [esp + 0xc0], 0xf
call fcn.0047bd90
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4863ee
push eax
call fcn.004ade5d
add esp, 4
mov edi, dword [esp + 0xe4]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], edi
cmp edi, ebx
je 0x48649c
mov eax, dword [esp + 0xe8]
mov ecx, dword [esp + 0x1c]
sub eax, edi
sar eax, 2
cmp ecx, eax
jae 0x48649c
mov edx, dword [esi + 4]
cmp edx, ebx
jne 0x48642d
xor ecx, ecx
jmp 0x486435
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
cmp edx, ebx
je 0x48646d
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x48646d
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x10]
mov edi, dword [esi + 8]
push ecx
push esi
push edx
push 1
push edi
call fcn.0047b030
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
mov edi, dword [esp + 0xe4]
jmp 0x486483
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 8]
push ecx
push 1
push ecx
mov ecx, esp
mov dword [ecx], eax
mov ecx, esi
call fcn.0043c790
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
inc ecx
add eax, 4
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], eax
jmp 0x486406
fld dword [0x4f7038]
fmul dword [0x4f70bc]
fstp dword [ebp + 0x15c]
call fcn.0043f0a0
mov ecx, eax
call fcn.00481fe0
mov esi, eax
fld dword [esi + 4]
fmul dword [0x4f3084]
call fcn.004adeb4
mov dword [ebp + 0x128], eax
mov dword [ebp + 0x12c], edx
fld dword [esi + 8]
fmul dword [0x4f3084]
call fcn.004adeb4
mov dword [ebp + 0x140], eax
mov dword [ebp + 0x144], edx
mov dword [ebp + 0x148], 0x42000000
mov dword [ebp + 0x150], 0x41a00000
mov edx, dword [esi + 0x10]
mov dword [ebp + 0x154], edx
mov eax, dword [esi + 0x14]
lea ecx, [esp + 0x48]
push ecx
mov dword [ebp + 0x9c], eax
call fcn.00437070
mov ecx, eax
call fcn.00437010
mov eax, dword [eax]
lea edx, [esp + 0x40]
push edx
mov ecx, eax
call fcn.00437210
mov eax, dword [esp + 0x48]
cmp eax, ebx
mov byte [esp + 0xbc], 0x10
je 0x48655e
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov eax, edx
mov dword [esp + 0x10], eax
jne 0x48655e
mov edx, dword [ecx]
push 1
call dword [edx]
mov esi, dword [esp + 0x40]
mov eax, dword [esi + 0x28]
push eax
mov ecx, esi
call fcn.0043a8b0
lea edi, [ebp + 0x14]
add esi, 0x30c
mov ecx, 0x15
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0x2c]
imul eax, eax, 0x3e8
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul dword [ebp + 0x30]
call fcn.004adeb4
mov ecx, dword [ebp + 0x128]
sub ecx, eax
mov eax, dword [ebp + 0x12c]
sbb eax, edx
mov edx, dword [esp + 0xc4]
mov dword [ebp + 0x128], ecx
mov dword [ebp + 0x12c], eax
mov eax, dword [esp + 0xcc]
xor ecx, ecx
cmp eax, 1
setg cl
mov dword [ebp + 0x74], edx
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], 0xbf800000
mov dword [ebp + 0x7c], edx
dec ecx
and ecx, eax
mov eax, dword [esp + 0xc8]
mov dword [ebp], ecx
mov dword [ebp + 0x78], eax
mov eax, dword [esp + 0x14]
lea ecx, [ebp + 0x7c]
mov dword [ecx + 4], eax
call fcn.00465170
fst dword [ebp + 0x84]
mov eax, dword [esp + 0xd8]
fstp dword [ebp + 0x88]
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0xd4]
mov dword [ebp + 0x94], eax
cmp dword [ebp], 1
mov dword [ebp + 0x8c], ecx
mov ecx, dword [esp + 0xdc]
mov dword [ebp + 0x90], edx
mov dword [ebp + 0x98], ecx
jne 0x486755
mov eax, dword [ebp + 0x90]
mov edx, dword [ebp + 0x8c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
xor eax, eax
lea ecx, [ebp + 0x94]
fld dword [esp + eax*4 + 0x1c]
inc eax
fadd dword [ecx]
add ecx, 4
cmp eax, 2
fstp dword [esp + eax*4 + 0x18]
jb 0x486667
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x10], ecx
fld dword [esp + 0x10]
fmul dword [0x4f2588]
mov dword [esp + 0x14], edx
fst dword [esp + 0x10]
fld dword [esp + 0x14]
fmul dword [0x4f2588]
fst dword [esp + 0x14]
fxch st(1)
fstp dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [ebp + 0x74], eax
fstp dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x78], ecx
lea ecx, [esp + 0x10]
call fcn.00465170
fst dword [ebp + 0x84]
fcos
fstp dword [ebp + 0x7c]
fld dword [ebp + 0x84]
fsin
fstp dword [ebp + 0x80]
fld dword [ebp + 0x84]
fsub dword [0x4f7038]
fabs
fcomp dword [0x4f26c8]
fnstsw ax
test ah, 5
jnp 0x48671c
fld dword [0x4f7038]
fmul dword [0x4f70b8]
fsubr dword [ebp + 0x84]
fabs
fcomp dword [0x4f26c8]
fnstsw ax
test ah, 5
jp 0x48671f
mov dword [ebp + 0x7c], ebx
fld dword [ebp + 0x84]
fabs
fcomp dword [0x4f26c8]
fnstsw ax
test ah, 5
jnp 0x48674f
fld dword [ebp + 0x84]
fsub dword [0x4f7034]
fabs
fcomp dword [0x4f26c8]
fnstsw ax
test ah, 5
jp 0x486755
mov dword [ebp + 0x80], ebx
mov esi, 0xf
mov eax, str.data_objects_catapult_body.xml
mov dword [ebp + 0x158], ebx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x486774
sub eax, edx
push eax
push str.data_objects_catapult_body.xml
lea ecx, [esp + 0x2c]
call fcn.00402cd0
push ebx
push ebx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0xcc], 0x11
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov eax, dword [eax]
cmp eax, ebx
mov byte [esp + 0xbc], 0x12
je 0x4867bd
inc dword [eax + 4]
mov ecx, dword [ebp + 0xa0]
cmp ecx, ebx
mov dword [ebp + 0xa0], eax
je 0x4867e0
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebx
mov dword [ecx + 4], edx
jne 0x4867e0
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov byte [esp + 0xbc], 0x11
je 0x486809
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov eax, edx
mov dword [esp + 0x1c], eax
jne 0x486809
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x3c]
mov edi, 0x10
cmp eax, edi
mov byte [esp + 0xbc], 0x10
jb 0x48682b
mov eax, dword [esp + 0x28]
push eax
call fcn.004ade5d
add esp, 4
mov edx, dword [ebp + 0x78]
mov eax, dword [ebp + 0x74]
mov ecx, dword [ebp + 0xa0]
push 0xc3fa0000
push edx
push eax
call fcn.00424870
mov eax, dword [ebp + 0xa0]
cmp eax, ebx
push 1
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov dword [ecx], eax
je 0x48685d
inc dword [eax + 4]
mov byte [esp + 0xc8], 0x13
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0xc8], 0x10
call dword [edx + 0x10]
mov eax, str.data_objects_catapult_wheel.xml
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x486890
sub eax, esi
push eax
push str.data_objects_catapult_wheel.xml
lea ecx, [esp + 0x2c]
call fcn.00402cd0
push ebx
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0xcc], 0x14
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov eax, dword [eax]
cmp eax, ebx
mov byte [esp + 0xbc], 0x15
je 0x4868d9
inc dword [eax + 4]
mov ecx, dword [ebp + 0xb8]
cmp ecx, ebx
mov dword [ebp + 0xb8], eax
je 0x4868fc
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebx
mov dword [ecx + 4], edx
jne 0x4868fc
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov byte [esp + 0xbc], 0x14
je 0x486925
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov eax, edx
mov dword [esp + 0x1c], eax
jne 0x486925
mov edx, dword [ecx]
push 1
call dword [edx]
cmp dword [esp + 0x3c], edi
mov byte [esp + 0xbc], 0x10
jb 0x486940
mov eax, dword [esp + 0x28]
push eax
call fcn.004ade5d
add esp, 4
mov ecx, dword [ebp + 0x38]
dec ecx
test ecx, ecx
jg 0x486957
call fcn.00437070
cmp dword [eax + 8], 0xfffffffe
jne 0x486ae4
mov ecx, dword [ebp + 0xb8]
lea edx, [esp + 0x24]
push edx
call fcn.00426af0
push 1
push ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xc8], 0x16
mov byte [esp + 0x24], 0x2e
call fcn.00401760
mov ecx, dword [esp + 0x3c]
cmp ecx, edi
mov edi, dword [esp + 0x28]
mov edx, edi
jae 0x486997
lea edx, [esp + 0x28]
mov esi, dword [esp + 0x38]
add esi, edx
cmp ecx, 0x10
mov edx, edi
jae 0x4869a8
lea edx, [esp + 0x28]
add edx, eax
cmp ecx, 0x10
mov ecx, edi
jae 0x4869b5
lea ecx, [esp + 0x28]
cmp edx, ebx
jne 0x4869bd
xor eax, eax
jmp 0x4869c1
mov eax, edx
sub eax, ecx
cmp esi, ebx
jne 0x4869c9
xor ecx, ecx
jmp 0x4869cd
sub esi, edx
mov ecx, esi
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00402850
mov eax, dword [esp + 0x3c]
cmp eax, 0x10
mov edi, dword [esp + 0x28]
mov ecx, edi
jae 0x4869eb
lea ecx, [esp + 0x28]
mov edx, dword [esp + 0x38]
add ecx, edx
cmp eax, 0x10
mov esi, edi
jae 0x4869fc
lea esi, [esp + 0x28]
cmp eax, 0x10
lea edx, [edx + esi - 1]
mov esi, edi
jae 0x486a0b
lea esi, [esp + 0x28]
cmp edx, ebx
jne 0x486a13
xor eax, eax
jmp 0x486a17
mov eax, edx
sub eax, esi
cmp ecx, ebx
jne 0x486a1f
xor ecx, ecx
jmp 0x486a21
sub ecx, edx
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00402850
mov edx, dword [ebp + 0x38]
mov eax, dword [ebp + 0x3c]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [ebp + 0x40]
mov dword [ecx + 4], eax
lea eax, [esp + 0x28]
push 0x4f1300
push eax
mov dword [ecx + 8], edx
call fcn.004ae68f
add esp, 0x14
call fcn.00437070
cmp dword [eax + 8], 0xfffffffe
jne 0x486a73
push 2
lea ecx, [esp + 0x20]
push 0x4f1300
push ecx
call fcn.004ae68f
add esp, 0xc
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x486a80
sub eax, edx
push eax
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x2c]
call fcn.00402620
mov eax, str..png
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x486aa0
sub eax, edx
push eax
push str..png
lea ecx, [esp + 0x2c]
call fcn.00402620
mov ecx, dword [ebp + 0xb8]
lea eax, [esp + 0x24]
push eax
call fcn.0042c070
cmp dword [esp + 0x3c], 0x10
mov byte [esp + 0xbc], 0x10
jb 0x486ae4
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004ade5d
add esp, 4
mov eax, dword [ebp + 0xb8]
cmp eax, ebx
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov dword [ecx], eax
je 0x486afa
inc dword [eax + 4]
mov ecx, dword [ebp + 0xa0]
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp + 0xb8]
call fcn.00481fe0
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0xb8]
mov dword [esp + 0x10], eax
call fcn.00481fe0
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push 0x3f800000
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0xb8]
push edx
push eax
call fcn.00424870
mov eax, dword [ebp + 0xb8]
cmp eax, ebx
push 1
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov dword [ecx], eax
je 0x486b5c
inc dword [eax + 4]
mov byte [esp + 0xc8], 0x17
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0xc8], 0x10
call dword [edx + 0x10]
mov esi, 0xf
mov eax, str.data_objects_catapult_wing.xml
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x486b91
sub eax, edx
push eax
push str.data_objects_catapult_wing.xml
lea ecx, [esp + 0x2c]
call fcn.00402cd0
push ebx
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0xcc], 0x18
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov eax, dword [eax]
cmp eax, ebx
mov byte [esp + 0xbc], 0x19
je 0x486bda
inc dword [eax + 4]
mov ecx, dword [ebp + 0xa4]
cmp ecx, ebx
mov dword [ebp + 0xa4], eax
je 0x486bfd
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebx
mov dword [ecx + 4], edx
jne 0x486bfd
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov byte [esp + 0xbc], 0x18
je 0x486c26
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov eax, edx
mov dword [esp + 0x1c], eax
jne 0x486c26
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x3c]
mov edi, 0x10
cmp eax, edi
mov byte [esp + 0xbc], 0x10
jb 0x486c48
mov eax, dword [esp + 0x28]
push eax
call fcn.004ade5d
add esp, 4
mov eax, str.data_objects_catapult_wing.xml
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x486c60
sub eax, edx
push eax
push str.data_objects_catapult_wing.xml
lea ecx, [esp + 0x2c]
call fcn.00402cd0
push ebx
push ebx
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0xcc], 0x1a
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov eax, dword [eax]
cmp eax, ebx
mov byte [esp + 0xbc], 0x1b
je 0x486ca9
inc dword [eax + 4]
mov ecx, dword [ebp + 0xa8]
cmp ecx, ebx
mov dword [ebp + 0xa8], eax
je 0x486ccc
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebx
mov dword [ecx + 4], edx
jne 0x486ccc
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov byte [esp + 0xbc], 0x1a
je 0x486cf3
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov dword [esp + 0x1c], edx
jne 0x486cf3
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esp + 0x3c], edi
mov byte [esp + 0xbc], 0x10
jb 0x486d0e
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004ade5d
add esp, 4
mov eax, dword [ebp + 0xa4]
cmp eax, ebx
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov dword [ecx], eax
je 0x486d24
inc dword [eax + 4]
mov ecx, dword [ebp + 0xa0]
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [ebp + 0xa8]
cmp eax, ebx
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov dword [ecx], eax
je 0x486d45
inc dword [eax + 4]
mov ecx, dword [ebp + 0xa0]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [ebp + 0xa4]
call fcn.00481fe0
mov ecx, dword [eax + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [ebp + 0xa4]
call fcn.00481fe0
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0xa4]
push 0xbf800000
push eax
push edx
mov dword [esp + 0x28], edx
call fcn.00424870
mov ecx, dword [ebp + 0xa4]
call fcn.00481fe0
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0xa8]
mov dword [esp + 0x10], eax
call fcn.00481fe0
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push 0xbf800000
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0xa8]
push edx
push eax
call fcn.00424870
mov ecx, dword [ebp + 0x2c]
dec ecx
test ecx, ecx
jg 0x486de5
mov edx, dword [ebp + 0x20]
dec edx
test edx, edx
jg 0x486de5
call fcn.00437070
cmp dword [eax + 8], 0xfffffffe
jne 0x486fa4
mov ecx, dword [ebp + 0xa4]
lea eax, [esp + 0x24]
push eax
call fcn.00426af0
push 1
push ebx
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x30]
mov byte [esp + 0xc8], 0x1c
mov byte [esp + 0x24], 0x31
call fcn.00401760
mov ecx, dword [esp + 0x3c]
cmp ecx, 0x10
mov edi, dword [esp + 0x28]
mov edx, edi
jae 0x486e26
lea edx, [esp + 0x28]
mov esi, dword [esp + 0x38]
add esi, edx
cmp ecx, 0x10
mov edx, edi
jae 0x486e37
lea edx, [esp + 0x28]
add edx, eax
cmp ecx, 0x10
mov ecx, edi
jae 0x486e44
lea ecx, [esp + 0x28]
cmp edx, ebx
jne 0x486e4c
xor eax, eax
jmp 0x486e50
mov eax, edx
sub eax, ecx
cmp esi, ebx
jne 0x486e58
xor ecx, ecx
jmp 0x486e5c
sub esi, edx
mov ecx, esi
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00402850
sub esp, 0xc
lea edx, [ebp + 0x20]
mov ecx, dword [edx]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov edx, dword [edx + 8]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [esp + 0x28]
push 0x4f1300
push eax
call fcn.004ae68f
mov edx, dword [ebp + 0x2c]
mov eax, dword [ebp + 0x30]
add esp, 8
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [ebp + 0x34]
mov dword [ecx + 4], eax
lea eax, [esp + 0x1c]
push 0x4f1300
push eax
mov dword [ecx + 8], edx
call fcn.004ae68f
add esp, 0x14
call fcn.00437070
cmp dword [eax + 8], 0xfffffffe
jne 0x486ee6
push 3
lea ecx, [esp + 0x20]
push 0x4f1300
push ecx
call fcn.004ae68f
push 2
lea edx, [esp + 0x20]
push 0x4f1300
push edx
call fcn.004ae68f
add esp, 0x18
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x486ef0
sub eax, edx
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
call fcn.00402620
mov eax, 0x4f2b9c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x486f10
sub eax, edx
push eax
push 0x4f2b9c
lea ecx, [esp + 0x2c]
call fcn.00402620
lea eax, [esp + 0x10]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x486f30
sub eax, edx
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x2c]
call fcn.00402620
mov eax, str..png
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x486f50
sub eax, edx
push eax
push str..png
lea ecx, [esp + 0x2c]
call fcn.00402620
mov ecx, dword [ebp + 0xa4]
lea edx, [esp + 0x24]
push edx
call fcn.0042c070
mov ecx, dword [ebp + 0xa8]
lea eax, [esp + 0x24]
push eax
call fcn.0042c070
mov eax, dword [esp + 0x3c]
mov edi, 0x10
cmp eax, edi
jb 0x486fa9
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004ade5d
add esp, 4
jmp 0x486fa9
mov edi, 0x10
mov eax, dword [ebp + 0xa4]
cmp eax, ebx
push 1
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov dword [ecx], eax
je 0x486fc3
inc dword [eax + 4]
mov byte [esp + 0xc8], 0x1d
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0xc8], 0x10
call dword [edx + 0x10]
mov ecx, dword [ebp + 0xa8]
call fcn.0040d980
push eax
lea ecx, [esp + 0x50]
call fcn.0040de60
mov ecx, dword [ebp + 0xa8]
lea eax, [esp + 0x4c]
push eax
mov byte [esp + 0x78], 1
mov dword [esp + 0x60], 0
call fcn.0042adf0
mov eax, dword [ebp + 0xa8]
cmp eax, ebx
push 1
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov dword [ecx], eax
je 0x48702b
inc dword [eax + 4]
mov byte [esp + 0xc8], 0x1e
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0xc8], 0x10
call dword [edx + 0x10]
mov esi, 0xf
mov eax, str.data_objects_catapult_sight.xml
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x487060
sub eax, edx
push eax
push str.data_objects_catapult_sight.xml
lea ecx, [esp + 0x2c]
call fcn.00402cd0
push ebx
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0xcc], 0x1f
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov eax, dword [eax]
cmp eax, ebx
mov byte [esp + 0xbc], 0x20
je 0x4870a9
inc dword [eax + 4]
mov ecx, dword [ebp + 0xac]
cmp ecx, ebx
mov dword [ebp + 0xac], eax
je 0x4870cc
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebx
mov dword [ecx + 4], edx
jne 0x4870cc
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov byte [esp + 0xbc], 0x1f
je 0x4870f5
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov eax, edx
mov dword [esp + 0x1c], eax
jne 0x4870f5
mov edx, dword [ecx]
push 1
call dword [edx]
cmp dword [esp + 0x3c], edi
mov byte [esp + 0xbc], 0x10
jb 0x487110
mov eax, dword [esp + 0x28]
push eax
call fcn.004ade5d
add esp, 4
mov eax, dword [ebp + 0xac]
cmp eax, ebx
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov dword [ecx], eax
je 0x487126
inc dword [eax + 4]
mov ecx, dword [ebp + 0xa0]
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [ebp + 0xac]
cmp eax, ebx
push 1
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov dword [ecx], eax
je 0x48714b
inc dword [eax + 4]
mov byte [esp + 0xc8], 0x21
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0xc8], 0x10
call dword [edx + 0x10]
mov eax, str.data_objects_catapult_sight_direction.xml
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
lea edx, [eax + 1]
jmp 0x487180
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x487180
sub eax, edx
push eax
push str.data_objects_catapult_sight_direction.xml
lea ecx, [esp + 0x2c]
call fcn.00402cd0
push ebx
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0xcc], 0x22
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov eax, dword [eax]
cmp eax, ebx
mov byte [esp + 0xbc], 0x23
je 0x4871c9
inc dword [eax + 4]
mov ecx, dword [ebp + 0xb0]
cmp ecx, ebx
mov dword [ebp + 0xb0], eax
je 0x4871ec
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebx
mov dword [ecx + 4], edx
jne 0x4871ec
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov byte [esp + 0xbc], 0x22
je 0x487215
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov eax, edx
mov dword [esp + 0x1c], eax
jne 0x487215
mov edx, dword [ecx]
push 1
call dword [edx]
cmp dword [esp + 0x3c], edi
mov byte [esp + 0xbc], 0x10
jb 0x487230
mov eax, dword [esp + 0x28]
push eax
call fcn.004ade5d
add esp, 4
mov eax, dword [ebp + 0xb0]
cmp eax, ebx
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov dword [ecx], eax
je 0x487246
inc dword [eax + 4]
mov ecx, dword [ebp + 0xa0]
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [ebp + 0xb0]
cmp eax, ebx
push 1
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov dword [ecx], eax
je 0x48726b
inc dword [eax + 4]
mov byte [esp + 0xc8], 0x24
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0xc8], 0x10
call dword [edx + 0x10]
cmp dword [ebp + 0x50], ebx
jne 0x4872b7
call fcn.00437070
cmp dword [eax + 8], 0xfffffffe
jle 0x4872b7
mov ecx, dword [ebp + 0xac]
push 1
push 1
push ebx
call fcn.00424960
mov ecx, dword [ebp + 0xb0]
push 1
push 1
push ebx
call fcn.00424960
mov eax, str.data_objects_catapult_tail.xml
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
lea edx, [eax + 1]
jmp 0x4872d0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4872d0
sub eax, edx
push eax
push str.data_objects_catapult_tail.xml
lea ecx, [esp + 0x2c]
call fcn.00402cd0
push ebx
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0xcc], 0x25
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov eax, dword [eax]
cmp eax, ebx
mov byte [esp + 0xbc], 0x26
je 0x487319
inc dword [eax + 4]
mov ecx, dword [ebp + 0xb4]
cmp ecx, ebx
mov dword [ebp + 0xb4], eax
je 0x48733c
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebx
mov dword [ecx + 4], edx
jne 0x48733c
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov byte [esp + 0xbc], 0x25
je 0x487365
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov eax, edx
mov dword [esp + 0x1c], eax
jne 0x487365
mov edx, dword [ecx]
push 1
call dword [edx]
cmp dword [esp + 0x3c], edi
mov byte [esp + 0xbc], 0x10
jb 0x487380
mov eax, dword [esp + 0x28]
push eax
call fcn.004ade5d
add esp, 4
mov ecx, dword [ebp + 0x14]
dec ecx
test ecx, ecx
jg 0x487397
call fcn.00437070
cmp dword [eax + 8], 0xfffffffe
jne 0x487524
mov ecx, dword [ebp + 0xb4]
lea edx, [esp + 0x24]
push edx
call fcn.00426af0
push 1
push ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xc8], 0x27
mov byte [esp + 0x24], 0x2e
call fcn.00401760
mov ecx, dword [esp + 0x3c]
cmp ecx, 0x10
mov edi, dword [esp + 0x28]
mov edx, edi
jae 0x4873d8
lea edx, [esp + 0x28]
mov esi, dword [esp + 0x38]
add esi, edx
cmp ecx, 0x10
mov edx, edi
jae 0x4873e9
lea edx, [esp + 0x28]
add edx, eax
cmp ecx, 0x10
mov ecx, edi
jae 0x4873f6
lea ecx, [esp + 0x28]
cmp edx, ebx
jne 0x4873fe
xor eax, eax
jmp 0x487402
mov eax, edx
sub eax, ecx
cmp esi, ebx
jne 0x48740a
xor ecx, ecx
jmp 0x48740e
sub esi, edx
mov ecx, esi
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00402850
mov eax, dword [esp + 0x3c]
cmp eax, 0x10
mov edi, dword [esp + 0x28]
mov ecx, edi
jae 0x48742c
lea ecx, [esp + 0x28]
mov edx, dword [esp + 0x38]
add ecx, edx
cmp eax, 0x10
mov esi, edi
jae 0x48743d
lea esi, [esp + 0x28]
cmp eax, 0x10
lea edx, [edx + esi - 1]
mov esi, edi
jae 0x48744c
lea esi, [esp + 0x28]
cmp edx, ebx
jne 0x487454
xor eax, eax
jmp 0x487458
mov eax, edx
sub eax, esi
cmp ecx, ebx
jne 0x487460
xor ecx, ecx
jmp 0x487462
sub ecx, edx
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00402850
sub esp, 0xc
lea eax, [ebp + 0x14]
mov edx, dword [eax]
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ecx + 4], edx
mov dword [ecx + 8], eax
lea ecx, [esp + 0x1c]
push 0x4f1300
push ecx
call fcn.004ae68f
add esp, 0x14
call fcn.00437070
cmp dword [eax + 8], 0xfffffffe
jne 0x4874b6
push 2
lea edx, [esp + 0x14]
push 0x4f1300
push edx
call fcn.004ae68f
add esp, 0xc
lea eax, [esp + 0x10]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4874c0
sub eax, edx
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
call fcn.00402620
mov eax, str..png
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4874e0
sub eax, edx
push eax
push str..png
lea ecx, [esp + 0x2c]
call fcn.00402620
mov ecx, dword [ebp + 0xb4]
lea edx, [esp + 0x24]
push edx
call fcn.0042c070
cmp dword [esp + 0x3c], 0x10
mov byte [esp + 0xbc], 0x10
jb 0x487524
mov eax, dword [esp + 0x28]
push eax
call fcn.004ade5d
add esp, 4
mov ecx, dword [ebp + 0xb4]
push 0xbf800000
push ebx
push ebx
call fcn.00424870
mov eax, dword [ebp + 0xb4]
cmp eax, ebx
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
mov dword [ecx], eax
je 0x48754c
inc dword [eax + 4]
mov ecx, dword [ebp + 0xa0]
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [ebp + 0xb4]
cmp eax, ebx
push 1
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
mov dword [ecx], eax
je 0x487571
inc dword [eax + 4]
mov byte [esp + 0xc8], 0x28
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0xc8], 0x10
call dword [edx + 0x10]
mov ecx, dword [ebp + 0xbc]
cmp ecx, ebx
mov dword [ebp + 0xbc], ebx
je 0x4875b0
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebx
mov dword [ecx + 4], edx
jne 0x4875b0
mov eax, dword [ecx]
push 1
call dword [eax]
lea esi, [ebp + 0xd0]
push 3
mov ecx, esi
mov dword [ebp + 0xc0], ebx
mov dword [ebp + 0xc4], ebx
call fcn.00452520
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x487603
mov edi, dword [esi + 8]
mov esi, eax
cmp esi, edi
je 0x4875ee
jmp 0x4875e0
mov ecx, esi
call fcn.004224e0
add esi, 4
cmp esi, edi
jne 0x4875e0
mov eax, dword [ebp + 0xd4]
lea esi, [ebp + 0xd0]
push eax
call fcn.004ade5d
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea esi, [ebp + 0xe0]
push 3
mov ecx, esi
call fcn.00452520
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x487653
mov edi, dword [esi + 8]
mov esi, eax
cmp esi, edi
je 0x48763e
jmp 0x487630
mov ecx, esi
call fcn.004224e0
add esi, 4
cmp esi, edi
jne 0x487630
mov eax, dword [ebp + 0xe4]
lea esi, [ebp + 0xe0]
push eax
call fcn.004ade5d
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [ebp + 0x14c]
cmp ecx, ebx
mov dword [ebp + 0x14c], ebx
je 0x48767f
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebx
mov dword [ecx + 4], edx
jne 0x48767f
mov edx, dword [ecx]
push 1
call dword [edx]
lea esi, [ebp + 0xf0]
push 0xa
mov ecx, esi
mov dword [ebp + 0x110], ebx
mov dword [ebp + 0x114], ebx
mov dword [ebp + 0x118], ebx
mov dword [ebp + 0x11c], ebx
mov dword [ebp + 0x120], ebx
mov dword [ebp + 0x124], ebx
mov byte [ebp + 0x130], bl
mov dword [ebp + 0x138], 0x107a4000
mov dword [ebp + 0x13c], 0x5af3
call fcn.00485800
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4876dc
push eax
call fcn.004ade5d
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x100], eax
call fcn.00437070
cmp dword [eax + 8], 0xfffffffe
jne 0x487703
mov dword [ebp + 0x100], 2
cmp dword [ebp + 0x100], ebx
mov dword [esp + 0x1c], ebx
jle 0x48778b
mov ecx, ebp
call fcn.00485ea0
mov edx, dword [esi + 4]
cmp edx, ebx
mov dword [esp + 0x10], eax
jne 0x487729
xor ecx, ecx
jmp 0x487731
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
cmp edx, ebx
je 0x487762
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x487762
mov ecx, dword [esp + 0x44]
mov edi, dword [esi + 8]
push ecx
push esi
lea edx, [esp + 0x18]
push edx
push 1
push edi
call fcn.0047b030
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x487778
mov eax, dword [esi + 8]
lea ecx, [esp + 0x10]
push ecx
push 1
push ecx
mov ecx, esp
mov dword [ecx], eax
mov ecx, esi
call fcn.00485560
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebp + 0x100]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x487713
mov ecx, dword [ebp + 0x104]
cmp ecx, ebx
mov dword [ebp + 0x104], ebx
je 0x4877ae
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebx
mov dword [ecx + 4], edx
jne 0x4877ae
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [ebp + 0x108]
cmp ecx, ebx
mov dword [ebp + 0x108], ebx
je 0x4877d1
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebx
mov dword [ecx + 4], edx
jne 0x4877d1
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx + 4]
dec eax
mov byte [esp + 0xbc], 0xf
mov dword [ecx + 4], eax
jne 0x4877ec
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0xe4]
cmp eax, ebx
je 0x487800
push eax
call fcn.004ade5d
add esp, 4
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0xb0]
xor ecx, dword [esp + 0xc0]
mov eax, ebp
call fcn.004ae650
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret 0x2c