Function at 0x489dd0
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x8c26cc]
sub esp, 0x64
push ebx
push ebp
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x489e84
cmp dword [0x8c45e4], edi
jne 0x489e84
mov edx, dword [0x8c4d18]
lea eax, [esp + 0x4c]
imul edx, edx, 0x3e8
push eax
mov eax, dword [0x8c4d1c]
imul eax, eax, 0x3e8
lea ecx, [esp + 0x4c]
push ecx
push edi
push edx
push eax
call fcn.004aec50
add esp, 0x14
test al, al
jne 0x489e84
mov eax, dword [0x8c4d1c]
mov ecx, dword [0x8c4d18]
mov dword [0x8c45ec], eax
imul eax, eax, 0x3e8
mov dword [0x8c45f0], ecx
imul ecx, ecx, 0x3e8
mov dword [0x8c45f4], eax
mov dword [0x8c45e4], eax
mov dword [0x8c45f8], ecx
mov dword [0x8c45e8], ecx
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 0x3e8
idiv ecx
mov dword [0x8c45e0], 1
mov dword [0x8c4614], edx
mov edx, dword [0x72809c]
mov dword [0x8c4610], edx
mov esi, dword [0x8c4d14]
cmp esi, 0xffffffff
mov ecx, dword [0x8c26c4]
mov edx, dword [0x8c26c8]
je 0x489ea8
test byte [0x8c4d28], 0xf
jne 0x489fe8
lea eax, [ecx + ecx]
mov ebx, 0xfffffffe
sub ebx, eax
add eax, 2
mov dword [esp + 0x24], eax
lea eax, [ecx*4]
mov ebp, 0xfffffffc
sub ebp, eax
mov dword [esp + 0x14], edi
add eax, 4
mov edi, edx
mov dword [esp + 0x34], eax
neg edi
lea eax, [edx + edx]
mov dword [esp + 0x2c], 0x1869f
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebp
shl edi, 1
mov dword [esp + 0x1c], 0x8c83a0
mov dword [esp + 0x20], eax
jmp 0x489f01
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
cdq
mov esi, 3
or ecx, 0xffffffff
idiv esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], edx
cmp dword [esp + 0x38], 1
je 0x489f3a
mov eax, ecx
cdq
mov esi, 3
idiv esi
cmp edx, 1
jne 0x489f8c
test ecx, ecx
jl 0x489f48
mov edx, dword [esp + 0x1c]
cmp byte [edx + ecx], 0
jne 0x489f8c
test edi, edi
mov eax, ebx
mov esi, ebp
mov edx, edi
jge 0x489f56
mov edx, dword [esp + 0x20]
test ebx, ebx
jge 0x489f62
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
cmp edx, eax
lea eax, [eax + edx*2]
jg 0x489f6c
lea eax, [esi + edx]
cdq
sub eax, edx
mov edx, dword [esp + 0x2c]
sar eax, 1
cmp eax, edx
jge 0x489f8c
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x14]
mov dword [0x8c4d14], eax
mov dword [0x8c4d10], ecx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
sub edx, 4
mov dword [esp + 0x18], edx
mov edx, 2
inc ecx
sub eax, edx
add ebp, 4
add ebx, edx
cmp ecx, 0x30
mov dword [esp + 0x10], eax
jl 0x489f24
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x20]
inc eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
add eax, 0x30
sub esi, edx
add edi, edx
cmp eax, 0x8c8ca0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], esi
jl 0x489ef9
mov esi, dword [0x8c4d14]
xor edi, edi
cmp esi, dword [0x8c4d0c]
mov ecx, dword [0x8c4d10]
jne 0x48a002
cmp ecx, dword [0x8c4d08]
je 0x48a0d6
cmp esi, 0xffffffff
mov dword [0x8c4d0c], esi
mov dword [0x8c4d08], ecx
jne 0x48a02e
mov eax, 4
mov dword [0x8c4d00], esi
mov dword [0x8c4cfc], ecx
mov dword [0x8ccb24], eax
jmp 0x48a0e5
mov eax, 0xfffffffc
mov dword [0x8ccb24], eax
mov edx, dword [0x8c4cf8]
add edx, eax
cmp edx, edi
mov dword [0x8c4cf8], edx
jg 0x48a063
neg eax
mov dword [0x8c4d00], esi
mov dword [0x8c4cfc], ecx
mov dword [0x8ccb24], eax
mov dword [0x8c4cf8], edi
mov ebx, dword [0x8c43f0]
mov dword [esp + 0x18], edi
lea ecx, [ecx]
mov ebp, dword [esp + 0x18]
xor esi, esi
cmp ebp, esi
je 0x48a111
imul ebp, ebp, 0x44
cmp dword [ebp + 0x8c43c0], esi
je 0x48bfa7
mov esi, dword [ebp + 0x8c43f0]
cmp esi, dword [0x8c42ec]
jne 0x48ae1f
mov eax, dword [ebp + 0x8c43e4]
test eax, eax
jne 0x48a0b7
mov al, byte [ebp + 0x8c43ec]
test al, al
jns 0x48ae1f
cmp esi, 0xffffffff
mov dword [esp + 0x40], 0
jne 0x48ade2
mov edx, dword [0x8c4c70]
fld dword [edx + 0x2c]
jmp 0x48ae00
mov eax, dword [0x8ccb24]
cmp eax, edi
je 0x48a063
jle 0x48a038
mov ecx, dword [0x8c4cf8]
add ecx, eax
cmp ecx, 0x64
mov dword [0x8c4cf8], ecx
jl 0x48a063
mov dword [0x8ccb24], edi
mov dword [0x8c4cf8], 0x64
jmp 0x48a063
cmp ebx, 0xffffffff
mov ecx, dword [0x8c4cf0]
mov dword [esp + 0x38], 0
jne 0x48a129
fld dword [ecx + 0x2c]
jmp 0x48a143
mov eax, ebx
call fcn.004bc7a0
cmp eax, esi
mov ebx, dword [0x8c43f0]
je 0x48a13f
fld dword [eax + 0xc]
jmp 0x48a143
fld dword [esp + 0x38]
fmul dword [0x715698]
mov edi, dword [0x8c42dc]
call fcn.005f275c
cmp ebx, dword [0x8c4320]
mov dword [esp + 0x1c], eax
je 0x48a168
cmp ebx, dword [0x8c431c]
jne 0x48a17c
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [esp + 0x1c], eax
add dword [0x8c43f4], 0x14
mov ecx, dword [0x8c43ec]
test cl, 0x44
je 0x48a18e
mov eax, 0x19
jmp 0x48a19d
mov eax, dword [0x8ccb1c]
neg eax
sbb eax, eax
and eax, 0x14
add eax, 0x28
mov edx, dword [0x8c43f4]
add edx, eax
cmp dword [0x8c4d04], esi
mov ebp, ebx
mov dword [0x8c43f4], edx
mov dword [esp + 0x20], ebp
je 0x48a26e
cmp ebp, edi
je 0x48a1e0
cmp ebp, dword [0x8c42d8]
je 0x48a1e0
mov ebx, edi
and ecx, 0xfffffffb
mov dword [0x8c43f4], esi
mov dword [0x8c43f0], ebx
mov dword [0x8c43ec], ecx
cmp ebx, edi
jne 0x48a245
cmp edi, 0xffffffff
mov dword [esp + 0x34], 0
jne 0x48a1fc
mov edx, dword [0x8c4cf0]
fld dword [edx + 0x2c]
jmp 0x48a220
mov ecx, dword [0x8c4cf0]
mov eax, edi
call fcn.004bc7a0
cmp eax, esi
mov ebx, dword [0x8c43f0]
je 0x48a218
fld dword [eax + 0xc]
jmp 0x48a220
fld dword [esp + 0x34]
lea esp, [esp]
fmul dword [0x715698]
call fcn.005f275c
cmp dword [0x8c43f4], eax
jle 0x48a245
mov ebx, dword [0x8c42d8]
mov dword [0x8c43f0], ebx
mov dword [0x8c43f4], esi
mov eax, dword [0x8c4d04]
inc eax
cmp eax, 0x64
mov dword [0x8c4d04], eax
jle 0x48a25f
mov dword [0x8c26cc], 0x1869f
or dword [0x85c164], 0x800
jmp 0x48a8b7
mov edi, dword [0x85c164]
and edi, 0xfffff7ff
test cl, 0x10
mov dword [0x85c164], edi
je 0x48a2b5
cmp edx, 0xfa
jle 0x48a299
mov eax, edi
or eax, 0x800
mov dword [0x85c164], eax
mov ebx, dword [0x8c4310]
and ecx, 0xfffffff9
mov ebp, ebx
mov dword [0x8c43f0], ebx
mov dword [0x8c43ec], ecx
jmp 0x48a8b7
test cl, 0x40
je 0x48a32c
mov eax, dword [esp + 0x1c]
mov ebp, 0x14
and ecx, 0xfffffff9
cmp edx, eax
mov ebx, ebp
mov dword [esp + 0x20], ebp
mov dword [0x8c43f0], ebx
mov dword [0x8c43ec], ecx
jl 0x48a8b7
mov edi, dword [0x8c43dc]
mov eax, ecx
and eax, 0xffffffbf
mov dword [0x8c43ec], eax
mov eax, 0x460
mov ecx, edi
mov dword [0x8c43f4], esi
call fcn.004dcac0
mov edx, dword [0x8c43c4]
add edx, eax
lea ecx, [edi + 0x40000000]
mov eax, 0x460
mov dword [0x8c43c4], edx
call fcn.004dcac0
add dword [0x8c43c8], eax
mov ecx, dword [0x8c43ec]
cmp ebx, dword [0x728094]
je 0x48a348
cmp ebx, dword [0x728098]
je 0x48a348
mov ebx, dword [0x8c4324]
mov dword [0x8c43f0], ebx
mov eax, dword [0x8c43f8]
and ecx, 0xfffffdf9
cmp eax, esi
mov dword [0x8c43ec], ecx
jne 0x48a472
push str.Sneak
push 0x187
call fcn.0042d4d0
fcom dword [0x715554]
add esp, 8
fnstsw ax
test ah, 0x41
jne 0x48a415
fcomp dword [0x70de8c]
fnstsw ax
test ah, 0x41
jne 0x48a417
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
js 0x48a3d6
mov eax, dword [0x8ca4dc]
fld dword [0x715554]
lea ecx, [eax + eax*4]
shl ecx, 6
fld dword [ecx + 0x8cac00]
fucompp
fnstsw ax
test ah, 0x44
jp 0x48a3d6
fld dword [0x715554]
fld dword [ecx + 0x8cac10]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x48a3fa
mov ecx, dword [0x8c43ec]
mov eax, dword [0x8ccb14]
mov ebx, dword [0x8c4328]
or ecx, 4
or eax, 8
mov dword [0x8c43ec], ecx
mov dword [0x8ccb14], eax
jmp 0x48a400
mov ebx, dword [0x8c4318]
mov eax, dword [0x8c43ec]
or eax, 2
mov dword [0x8c43f0], ebx
mov dword [0x8c43ec], eax
jmp 0x48a478
fstp st(0)
push str.Sneak
push 0x187
call fcn.0042d4d0
fcom dword [0x715554]
add esp, 8
fnstsw ax
test ah, 5
jp 0x48a462
fchs
fcomp dword [0x70de8c]
fnstsw ax
test ah, 0x41
jne 0x48a464
mov eax, dword [0x8c43ec]
mov ebx, dword [0x8c4314]
or eax, 0x202
mov dword [0x8c43f0], ebx
mov dword [0x8c43ec], eax
jmp 0x48a478
fstp st(0)
mov ebx, dword [0x8c4324]
mov dword [0x8c43f0], ebx
jmp 0x48a478
dec eax
mov dword [0x8c43f8], eax
mov ecx, dword [0x8c43ec]
test cl, 2
mov eax, dword [0x8c43bc]
mov edi, dword [0x728098]
jne 0x48a492
cmp ebx, edi
jne 0x48a4b7
test ch, 1
je 0x48a6ec
cmp ebx, edi
je 0x48a4b7
mov ebx, edi
mov dword [0x8c43f4], esi
mov dword [0x8c43f0], ebx
mov dword [0x8c43f8], 0x64
test ch, 1
je 0x48a6ec
cmp ebx, dword [0x728094]
jne 0x48a5a0
mov ecx, dword [0x8c4cf0]
xor edi, edi
mov eax, ebx
call fcn.004bc830
cmp dword [0x8c43f4], eax
jl 0x48a595
mov edi, dword [0x8c8ca0]
mov ecx, edi
sar ecx, 0x1c
inc ecx
sar ecx, 1
and ecx, 7
mov edx, dword [ecx*4 + 0x7272f0]
imul edx, edx, 0x3e8
mov ecx, dword [ecx*4 + 0x727350]
mov eax, 0x66666667
imul ecx, ecx, 0x3e8
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [0x8c8ca8]
imul eax, eax, 0x3e8
sub eax, edx
mov dword [0x8c43c4], eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [0x8c8ca4]
imul eax, eax, 0x3e8
sub eax, ecx
mov ebx, 0x15
mov dword [0x8c43c8], eax
mov eax, dword [0x8c43bc]
mov dword [0x8c43dc], edi
mov dword [0x8c43e0], esi
mov dword [0x8c43f0], ebx
mov dword [0x8c43f8], esi
mov dword [0x8c4d30], 0x36b0
mov dword [0x8ccb10], 0x80000000
jmp 0x48a6ec
mov eax, dword [0x8c43bc]
mov ebx, dword [0x8c43f0]
cmp ebx, dword [0x728098]
jne 0x48a6cb
mov ebp, dword [0x8c43f4]
mov ecx, dword [0x8c4cf0]
xor edi, edi
mov eax, ebx
mov dword [esp + 0x30], ebp
call fcn.004bc830
cmp ebp, eax
jl 0x48a67e
mov eax, dword [0x8c43dc]
mov ecx, dword [0x8c43c4]
sar eax, 0x1c
inc eax
sar eax, 1
and eax, 7
mov edx, dword [eax*4 + 0x7272f0]
imul edx, edx, 0x3e8
lea edi, [edx + ecx]
mov ecx, dword [eax*4 + 0x727350]
mov edx, dword [0x8c43c8]
imul ecx, ecx, 0x3e8
add edx, ecx
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x10624dd3
imul edi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*2]
shl eax, 4
cmp byte [ebx + eax + 0x8c83a0], 4
je 0x48a661
mov edx, dword [0x8c43c8]
mov eax, dword [0x8c43ec]
add edx, ecx
and eax, 0xfffffeff
mov dword [0x8c43c4], edi
mov dword [0x8c43c8], edx
mov dword [0x8c43ec], eax
mov dword [0x8c43f8], esi
mov ebx, dword [0x8c4324]
mov eax, dword [0x8c43bc]
mov ebp, dword [esp + 0x20]
mov dword [0x8c43f0], ebx
mov dword [0x8ccb10], esi
jmp 0x48a6ec
fild dword [esp + 0x30]
mov eax, dword [0x8c43f0]
mov ecx, dword [0x8c4cf0]
xor edi, edi
fstp dword [esp + 0x28]
call fcn.004bc830
mov dword [esp + 0x30], eax
fild dword [esp + 0x30]
fdivr dword [esp + 0x28]
fsubr dword [0x70deb0]
fmul dword [0x715834]
call fcn.005f275c
mov ebx, dword [0x8c43f0]
mov ebp, dword [esp + 0x20]
mov dword [0x8ccb10], eax
mov eax, dword [0x8c43bc]
jmp 0x48a6ec
mov ecx, dword [0x728094]
cmp ebx, ecx
je 0x48a6e2
mov ebx, 0x15
mov dword [0x8c43f0], ebx
jmp 0x48a6ec
or dword [0x85c164], 0x800
mov ecx, dword [0x8c4324]
add eax, 0x1e
cmp ebx, ecx
mov dword [0x8c43bc], eax
jne 0x48a748
cmp eax, esi
jle 0x48a7a7
mov ecx, dword [0x8c43b8]
mov ebx, 3
mov dword [0x8c43f4], eax
sub eax, ecx
mov dword [0x8c43f0], ebx
js 0x48a7a7
cdq
idiv dword [0x8c43b4]
mov ebx, 0x15
mov dword [0x8c43f0], ebx
add edx, ecx
mov dword [0x8c43bc], edx
sub edx, ecx
mov dword [0x8c43f4], edx
jmp 0x48a7a7
cmp eax, esi
jle 0x48a79d
mov edx, dword [0x8c43b8]
cmp eax, edx
mov edi, dword [0x8c43b4]
jge 0x48a765
lea ecx, [edx + edx]
sub ecx, eax
add ecx, edi
jmp 0x48a76c
lea ecx, [edi + edx]
cmp eax, ecx
jge 0x48a76e
mov eax, ecx
mov ecx, dword [0x8c43b0]
add ecx, edi
add ecx, edx
cmp eax, ecx
jge 0x48a79d
mov ecx, eax
sub ecx, edi
sub ecx, edx
mov ebx, 4
add eax, 0xa
mov dword [0x8c43f0], ebx
mov dword [0x8c43f4], ecx
mov dword [0x8c43bc], eax
jmp 0x48a7a7
mov dword [0x8c43bc], 0xfffffa24
mov eax, dword [0x8c43ec]
test ah, 1
jne 0x48a88e
push str.Sneak
push 0x186
call fcn.0042d4d0
fcom dword [0x715554]
add esp, 8
fnstsw ax
test ah, 0x41
jne 0x48a804
fcomp dword [0x70de8c]
fnstsw ax
test ah, 0x41
jne 0x48a806
mov eax, dword [0x8c43e0]
cmp eax, 0x38e38e3
jge 0x48a888
mov edx, eax
add edx, 0x5b05b0
mov dword [0x8c43e0], edx
jmp 0x48a888
fstp st(0)
push str.Sneak
push 0x186
call fcn.0042d4d0
fcom dword [0x715554]
add esp, 8
fnstsw ax
test ah, 5
jp 0x48a84c
fchs
fcomp dword [0x70de8c]
fnstsw ax
test ah, 0x41
jne 0x48a84e
mov eax, dword [0x8c43e0]
cmp eax, 0xfc71c71d
jle 0x48a888
add eax, 0xffa4fa50
mov dword [0x8c43e0], eax
jmp 0x48a888
fstp st(0)
mov ecx, dword [0x8c43e0]
cmp ecx, esi
jle 0x48a85f
mov eax, 1
jmp 0x48a867
xor eax, eax
cmp ecx, esi
setge al
dec eax
imul eax, eax, 0x38e38e3
mov edx, eax
mov eax, 0x66666667
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x8c43e0], ecx
mov ebx, dword [0x8c43f0]
mov eax, dword [0x8c43e0]
mov edx, dword [0x8c43dc]
add edx, eax
cmp eax, esi
mov dword [0x8c43dc], edx
je 0x48a8b7
cmp dword [0x8c43bc], esi
jge 0x48a8b7
mov dword [0x8c43bc], 0xfffffa24
mov ecx, dword [esp + 0x1c]
cmp dword [0x8c43f4], ecx
jge 0x48a8c7
cmp ebx, ebp
je 0x48a92b
cmp ebx, dword [0x8c4320]
mov dword [0x8c43f4], esi
jne 0x48a8f1
mov edx, dword [0x8c43dc]
add edx, 2
and edx, reloc.OLEAUT32.dll_VariantInit
jns 0x48a8eb
dec edx
or edx, 0xfffffff8
inc edx
mov dword [0x8c43dc], edx
cmp ebx, dword [0x8c431c]
jne 0x48a912
mov eax, dword [0x8c43dc]
add eax, 6
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x48a90d
dec eax
or eax, 0xfffffff8
inc eax
mov dword [0x8c43dc], eax
cmp ebx, dword [0x8c4310]
jne 0x48a92b
mov edx, dword [0x8c43ec]
and edx, 0xffffffef
mov dword [0x8c43ec], edx
jmp 0x48a931
mov edx, dword [0x8c43ec]
mov ecx, dword [0x8c43dc]
cmp ecx, dword [0x8c43e8]
jne 0x48a975
cmp ebx, dword [0x8c4320]
je 0x48a94f
cmp ebx, dword [0x8c431c]
jne 0x48a975
test dl, 2
je 0x48a969
test dl, 4
je 0x48a961
mov ebx, dword [0x8c4328]
jmp 0x48a96f
mov ebx, dword [0x8c4318]
jmp 0x48a96f
mov ebx, dword [0x8c4324]
mov dword [0x8c43f0], ebx
cmp ebx, dword [0x8c4318]
je 0x48a997
cmp ebx, dword [0x8c4328]
je 0x48a997
cmp ebx, dword [0x8c4314]
jne 0x48ad85
mov edx, dword [0x8c43ec]
mov eax, ecx
sar eax, 0x1c
inc eax
sar eax, 1
mov dword [esp + 0x14], ecx
and eax, 7
mov ecx, edx
and ecx, 0x200
mov dword [esp + 0x28], eax
mov dword [esp + 0x3c], ecx
je 0x48a9c7
xor eax, 4
mov dword [esp + 0x28], eax
sub dword [esp + 0x14], 0x80000000
test dl, 4
mov dword [esp + 0x10], 0x10
je 0x48a9de
mov dword [esp + 0x10], 0x20
jmp 0x48a9ef
mov eax, dword [0x8ccb1c]
test eax, eax
je 0x48a9ef
mov dword [esp + 0x10], 0x15
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
lea ecx, [ebp + 0x40000000]
mov eax, edi
mov dword [esp + 0x30], ecx
call fcn.004dcac0
mov edx, dword [0x8c43c8]
mov esi, eax
mov eax, edi
mov ecx, ebp
add esi, edx
call fcn.004dcac0
mov ecx, dword [0x8c43c4]
lea ecx, [eax + ecx + 0x1f4]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
lea ecx, [esi + 0x1f4]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
cmp esi, 0xfffffe0c
jge 0x48aa5b
or ebp, 0xffffffff
lea eax, [edi + edi*2]
shl eax, 4
lea esi, [eax + ebp]
mov dword [esp + 0x20], eax
cmp byte [esi + 0x8c83a0], 4
je 0x48ab96
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
call fcn.004dcac0
mov edx, dword [0x8c43c4]
mov ecx, dword [esp + 0x30]
add eax, edx
mov dword [0x8c43c4], eax
mov eax, dword [esp + 0x10]
call fcn.004dcac0
mov ecx, dword [0x8c43c8]
add ecx, eax
cmp dword [esi*4 + 0x8c4d98], 0x1869f
mov dword [0x8c43c8], ecx
jne 0x48ad85
mov eax, dword [0x8ccb14]
mov ecx, dword [0x8c43ec]
mov ebx, dword [0x728094]
or eax, 2
or ecx, 0x100
xor edx, edx
mov dword [0x8ccb14], eax
mov dword [0x8c43ec], ecx
mov dword [0x8c43f4], edx
mov dword [0x8c43f0], ebx
mov dword [0x8c43f8], 0x3e8
mov dword [0x8c8ca8], edi
mov dword [0x8c8ca4], ebp
xor eax, eax
jmp 0x48ab10
mov ecx, dword [eax*4 + 0x7272f0]
mov esi, dword [eax*4 + 0x727350]
add ecx, edi
lea ecx, [ecx + ecx*2]
shl ecx, 4
add ecx, esi
cmp byte [ecx + ebp + 0x8c83a0], 1
je 0x48ab3f
add eax, 2
cmp eax, 8
jb 0x48ab10
jmp 0x48ad85
mov ecx, eax
imul edi, edi, 0x3e8
imul ebp, ebp, 0x3e8
shl ecx, 0x1d
mov dword [0x8c8ca0], ecx
add ecx, 0x80000000
mov dword [0x8c43dc], ecx
mov ecx, dword [eax*4 + 0x7272f0]
mov eax, dword [eax*4 + 0x727350]
imul ecx, ecx, 0x258
imul eax, eax, 0x258
add ecx, edi
add eax, ebp
mov dword [0x8c43e0], edx
mov dword [0x8c43c4], ecx
mov dword [0x8c43c8], eax
jmp 0x48ad85
mov ecx, dword [0x8c43c4]
add ecx, 0x1f4
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x8c43c8]
add edx, 0x1f4
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, ebp
sub eax, esi
mov dword [esp + 0x1c], esi
mov esi, edi
sub esi, ecx
mov dword [esp + 0x24], ecx
call fcn.004dca00
mov ecx, dword [esp + 0x24]
shl eax, 0x1d
cmp edi, ecx
jne 0x48abfb
cmp ebp, dword [esp + 0x1c]
jne 0x48abfb
mov eax, dword [0x8c43dc]
test ebp, ebp
jl 0x48accf
mov ecx, dword [esp + 0x28]
test cl, 1
jne 0x48accf
sub eax, dword [0x8c43dc]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xaaaaaaa
jge 0x48accf
mov edx, dword [esp + 0x20]
lea eax, [edx + ebp]
mov edx, dword [eax*4 + 0x8c4d98]
mov esi, 1
cmp edx, esi
jne 0x48accf
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x48ad79
mov eax, edi
cdq
mov edi, 3
idiv edi
cmp edx, esi
jne 0x48ad85
mov eax, dword [ecx*4 + 0x727350]
mov ecx, dword [esp + 0x20]
lea edx, [eax + ecx]
cmp byte [edx + ebp + 0x8c83a0], 1
jg 0x48ad85
mov ecx, dword [esp + 0x20]
sub ecx, eax
cmp byte [ecx + ebp + 0x8c83a0], 1
jg 0x48ad85
mov eax, dword [0x8c43ec]
mov ecx, dword [0x8c43dc]
or eax, 0x40
mov dword [0x8c43ec], eax
mov eax, dword [0x8ccb14]
add ecx, 0x10000000
and ecx, 0xc0000000
or eax, esi
mov dword [0x8c43f4], 0
mov dword [0x8c43dc], ecx
mov dword [0x8ccb14], eax
jmp 0x48ad85
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
lea edi, [ebp + 0x40000000]
mov eax, esi
mov ecx, edi
call fcn.004dcac0
mov edx, dword [0x8c43c8]
lea ecx, [eax + edx + 0x1f4]
mov eax, 0x10624dd3
imul ecx
mov eax, dword [esp + 0x24]
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [eax + eax*2]
shl edx, 4
cmp byte [ecx + edx + 0x8c83a0], 4
mov eax, esi
je 0x48ad2e
mov ecx, edi
call fcn.004dcac0
add eax, dword [0x8c43c8]
mov dword [0x8c43c8], eax
jmp 0x48ad85
mov ecx, ebp
call fcn.004dcac0
mov edi, dword [0x8c43c4]
lea ecx, [eax + edi + 0x1f4]
mov eax, 0x10624dd3
imul ecx
mov ecx, dword [esp + 0x1c]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*2]
shl eax, 4
cmp byte [eax + ecx + 0x8c83a0], 4
je 0x48ad79
mov eax, esi
mov ecx, ebp
call fcn.004dcac0
add eax, edi
mov dword [0x8c43c4], eax
jmp 0x48ad85
mov ebx, dword [0x8c4324]
mov dword [0x8c43f0], ebx
mov ecx, dword [0x8c43c4]
add ecx, 0x1f4
mov eax, 0x10624dd3
imul ecx
mov ecx, dword [0x8c43c8]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [0x8c26c8], eax
add ecx, 0x1f4
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [0x8c26c4], eax
mov dword [0x8ccb1c], 0
mov dword [0x8c26bc], 0xffff
jmp 0x48bfa7
mov ecx, dword [0x8c4c70]
mov eax, esi
call fcn.004bc7a0
test eax, eax
je 0x48adf8
fld dword [eax + 0xc]
jmp 0x48ae00
fld dword [esp + 0x40]
lea esp, [esp]
fmul dword [0x715698]
call fcn.005f275c
cmp dword [ebp + 0x8c43f4], eax
jl 0x48ae1f
mov esi, dword [0x8c42e8]
mov dword [ebp + 0x8c43f0], esi
cmp esi, dword [0x8c4304]
jne 0x48ae37
mov al, byte [ebp + 0x8c43ec]
test al, al
jns 0x48ae37
mov esi, dword [0x8c4300]
cmp esi, 0xffffffff
mov dword [esp + 0x44], 0
jne 0x48ae4e
mov eax, dword [0x8c4c70]
fld dword [eax + 0x2c]
jmp 0x48ae70
mov ecx, dword [0x8c4c70]
mov eax, esi
call fcn.004bc7a0
test eax, eax
je 0x48ae64
fld dword [eax + 0xc]
jmp 0x48ae70
fld dword [esp + 0x44]
jmp 0x48ae70
fmul dword [0x715698]
call fcn.005f275c
mov ecx, dword [0x8c26cc]
cmp ecx, 0x1f4
mov dword [esp + 0x10], eax
jge 0x48aeb0
add ecx, 0xc7
mov eax, 0x51eb851f
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x85c158]
lea ecx, [ecx + edx + 4]
jmp 0x48aeb9
mov ecx, dword [0x85c158]
add ecx, 7
mov edi, dword [ebp + 0x8c43c8]
mov ebx, dword [0x8c43c8]
mov esi, dword [0x8c43c4]
mov eax, edi
sub eax, ebx
mov ebx, dword [ebp + 0x8c43c4]
mov edx, ebx
sub edx, esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x3c], ebx
jns 0x48aee5
neg edx
test eax, eax
jge 0x48aeeb
neg eax
cmp edx, eax
jle 0x48aef4
lea eax, [eax + edx*2]
jmp 0x48aef7
lea eax, [edx + eax*2]
cdq
sub eax, edx
mov edx, dword [0x8c26bc]
sar eax, 1
cmp eax, edx
mov dword [esp + 0x48], eax
jge 0x48af0f
mov dword [0x8c26bc], eax
mov eax, dword [0x8ccb18]
test eax, eax
je 0x48af19
inc ecx
imul ecx, ecx, 0x3e8
mov eax, 0xb60b60b7
imul ecx
add edx, ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [ebp + 0x8c43f8]
mov eax, edx
shr eax, 0x1f
add eax, edx
test ecx, ecx
mov dword [esp + 0x28], eax
je 0x48af55
dec ecx
mov dword [ebp + 0x8c43f8], ecx
mov ecx, dword [ebp + 0x8c43f4]
shl eax, 3
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov dword [ebp + 0x8c43f4], ecx
mov esi, ecx
mov ecx, dword [ebp + 0x8c43ec]
test cl, 0x20
je 0x48b068
mov eax, dword [0x8c42e4]
mov dword [ebp + 0x8c43f0], eax
mov eax, dword [esp + 0x10]
cmp esi, eax
jle 0x48bfa1
mov edx, eax
dec edx
mov dword [ebp + 0x8c43f4], edx
add ebx, 0x1f4
mov eax, 0x10624dd3
imul ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
lea esi, [eax + eax*2]
add edi, 0x1f4
mov eax, 0x10624dd3
imul edi
sar edx, 6
shl esi, 4
mov eax, edx
add esi, edx
mov edx, dword [0x8c4d28]
shr eax, 0x1f
add eax, esi
mov esi, dword [eax*4 + 0x8c4d98]
add edx, 0xfffffff6
cmp esi, edx
jle 0x48bfa1
fild dword [esp + 0x3c]
mov eax, dword [0x8c4308]
push 0xffffffffffffffff
push 0xbf800000
push 0
fstp dword [esp + 0x5c]
fild dword [esp + 0x3c]
mov edx, dword [esp + 0x5c]
push 0xffffffffffffffff
push 0xffffffffffffffff
and ecx, 0xffffffdf
fstp dword [esp + 0x68]
push 0xffffffffffffffff
or ecx, 0x100
push 0xffffffffffffffff
mov dword [ebp + 0x8c43ec], ecx
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov dword [ebp + 0x8c43f0], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x80], 0
mov edx, dword [esp + 0x80]
mov dword [ecx + 4], eax
push 0xbf
mov dword [ebp + 0x8c43f4], 0
mov dword [ecx + 8], edx
call fcn.004889e0
add esp, 0x2c
jmp 0x48bfa1
test ch, 4
je 0x48b122
mov eax, dword [0x8c43c8]
mov ecx, dword [0x8c43c4]
sub eax, edi
sub ecx, ebx
call fcn.004dcb20
sub eax, 0x80000000
mov dword [ebp + 0x8c43dc], eax
mov eax, dword [0x8c4d28]
add eax, 0xfffffff6
mov dword [esp + 0x3c], eax
lea ecx, [ebx + 0x1f4]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ebx, [eax + eax*2]
lea ecx, [edi + 0x1f4]
mov eax, 0x10624dd3
imul ecx
mov eax, dword [esp + 0x3c]
sar edx, 6
shl ebx, 4
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
mov dword [ecx*4 + 0x8c4d98], eax
mov eax, dword [ebp + 0x8c43f0]
mov ecx, dword [0x8c42e0]
cmp eax, ecx
je 0x48b0fc
mov edx, ecx
inc edx
cmp eax, edx
je 0x48bfa1
mov eax, ecx
jmp 0x48b150
cmp esi, dword [esp + 0x10]
jle 0x48bfa1
mov ecx, dword [0x8c42e0]
inc ecx
mov dword [ebp + 0x8c43f0], ecx
mov dword [ebp + 0x8c43f4], 0
jmp 0x48bfa1
test ch, 1
mov eax, dword [esp + 0x10]
je 0x48b165
cmp esi, eax
mov edx, dword [0x8c4308]
mov dword [ebp + 0x8c43f0], edx
jle 0x48bfa1
mov eax, dword [0x8c4304]
and ecx, 0xfffffeff
mov dword [ebp + 0x8c43ec], ecx
mov dword [ebp + 0x8c43f0], eax
mov dword [ebp + 0x8c43f4], 0
jmp 0x48bfa1
cmp esi, eax
jl 0x48b268
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 0x8c43f0]
mov ecx, dword [0x8c42fc]
sub esi, edx
cmp eax, ecx
mov dword [ebp + 0x8c43f4], esi
jne 0x48b1a5
mov ecx, dword [ebp + 0x8c43dc]
add ecx, 2
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x48b19f
dec ecx
or ecx, 0xfffffff8
inc ecx
mov dword [ebp + 0x8c43dc], ecx
cmp eax, dword [0x8c42f8]
jne 0x48b1c9
mov edx, dword [ebp + 0x8c43dc]
add edx, 6
and edx, reloc.OLEAUT32.dll_VariantInit
jns 0x48b1c3
dec edx
or edx, 0xfffffff8
inc edx
mov dword [ebp + 0x8c43dc], edx
cmp eax, dword [0x8c4304]
jne 0x48b1fa
call dword [sym.imp.MSVCR71.dll_rand]
and eax, 0x80000001
jns 0x48b1e3
dec eax
or eax, 0xfffffffe
inc eax
je 0x48b1fa
mov eax, dword [ebp + 0x8c43f8]
test eax, eax
jne 0x48b1fa
mov eax, dword [0x72809c]
mov dword [ebp + 0x8c43f0], eax
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x48b227
mov eax, dword [ebp + 0x8c43ec]
test al, al
js 0x48b227
mov ecx, dword [0x8c26cc]
test ecx, ecx
je 0x48b227
or eax, 0x80
jmp 0x48b232
mov eax, dword [ebp + 0x8c43ec]
and eax, 0xffffff7f
mov ecx, dword [0x72809c]
mov dword [ebp + 0x8c43ec], eax
mov eax, dword [ebp + 0x8c43f0]
cmp eax, ecx
je 0x48b250
cmp eax, dword [0x8c42e8]
jne 0x48b268
mov edx, dword [ebp + 0x8c43c4]
mov eax, dword [ebp + 0x8c43c8]
mov dword [ebp + 0x8c43d4], edx
mov dword [ebp + 0x8c43d8], eax
mov ecx, dword [ebp + 0x8c43e8]
mov eax, dword [ebp + 0x8c43dc]
cmp eax, ecx
jne 0x48b2c6
mov ecx, dword [ebp + 0x8c43f0]
cmp ecx, dword [0x8c42fc]
je 0x48b28e
cmp ecx, dword [0x8c42f8]
jne 0x48b2c6
mov ecx, dword [ebp + 0x8c43e4]
test ecx, ecx
jne 0x48b2ba
mov cl, byte [ebp + 0x8c43ec]
test cl, cl
js 0x48b2ba
mov ecx, dword [0x8c26cc]
test ecx, ecx
jne 0x48b2ba
mov ecx, dword [0x72809c]
mov dword [ebp + 0x8c43f0], ecx
jmp 0x48b2c6
mov edx, dword [0x8c42e8]
mov dword [ebp + 0x8c43f0], edx
mov ecx, dword [ebp + 0x8c43f0]
cmp ecx, dword [0x72809c]
je 0x48b2e0
cmp ecx, dword [0x8c42e8]
jne 0x48b7b4
mov ecx, dword [eax*4 + 0x7272f0]
mov edi, dword [ebp + 0x8c43c4]
inc ecx
imul ecx, ecx, 0x1f4
add ecx, edi
mov ebx, dword [ebp + 0x8c43c8]
mov eax, 0x10624dd3
imul ecx
mov eax, dword [ebp + 0x8c43dc]
mov ecx, dword [eax*4 + 0x727350]
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
inc ecx
imul ecx, ecx, 0x1f4
add ecx, ebx
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
add edi, 0x1f4
shr ecx, 0x1f
add ecx, edx
mov eax, 0x10624dd3
imul edi
sar edx, 6
mov edi, edx
add ebx, 0x1f4
shr edi, 0x1f
add edi, edx
mov eax, 0x10624dd3
imul ebx
sar edx, 6
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
cmp edi, esi
jne 0x48b36a
cmp ebx, ecx
je 0x48b3b5
lea eax, [esi + esi*2]
shl eax, 4
mov dl, byte [eax + ecx + 0x8c83a0]
add eax, ecx
cmp dl, 4
je 0x48b518
cmp dword [eax*4 + 0x8c4d98], 0x1869f
je 0x48b518
test esi, esi
jle 0x48b518
test ecx, ecx
jle 0x48b518
cmp esi, 0x30
jge 0x48b518
cmp ecx, 0x30
jge 0x48b518
mov eax, dword [ebp + 0x8c43e8]
mov esi, dword [eax*4 + 0x727350]
lea ecx, [eax + 2]
and ecx, 7
shl ecx, 2
mov edx, dword [ecx + 0x727350]
mov ecx, dword [ecx + 0x7272f0]
imul edx, edx, 0x3e8
add esi, ebx
imul ecx, ecx, 0x3e8
imul esi, esi, 0x3e8
mov eax, 0x66666667
imul edx
sar edx, 1
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
sub eax, dword [ebp + 0x8c43c8]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x8c43e8]
mov esi, dword [eax*4 + 0x7272f0]
mov eax, 0x66666667
imul ecx
add esi, edi
imul esi, esi, 0x3e8
sar edx, 1
mov ecx, edx
add esi, edx
mov edx, dword [ebp + 0x8c43c4]
shr ecx, 0x1f
add ecx, esi
mov esi, dword [esp + 0x3c]
sub ecx, edx
mov eax, esi
call fcn.004dcb20
mov ecx, dword [ebp + 0x8c4400]
push 0
push 0x71c71c7
mov esi, eax
mov eax, dword [ebp + 0x8c43fc]
push 0xb60b60
push ecx
mov ecx, esi
call fcn.004893a0
mov ecx, dword [ebp + 0x8c43fc]
add ecx, eax
mov dword [ebp + 0x8c4400], eax
mov eax, esi
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add esp, 0x10
cmp eax, 0x71c71c7
mov dword [ebp + 0x8c43fc], ecx
jge 0x48b496
mov eax, dword [ebp + 0x8c43e8]
mov dword [ebp + 0x8c43dc], eax
mov eax, dword [esp + 0x28]
call fcn.004dcac0
mov edx, dword [ebp + 0x8c43c4]
add edx, eax
mov eax, dword [ebp + 0x8c43fc]
lea ecx, [eax + 0x40000000]
mov eax, dword [esp + 0x28]
mov dword [ebp + 0x8c43c4], edx
mov esi, edx
call fcn.004dcac0
mov ecx, dword [ebp + 0x8c43c8]
add ecx, eax
lea edx, [esi + 0x1f4]
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
mov dword [ebp + 0x8c43c8], ecx
je 0x48b4f4
and dword [ebp + 0x8c43ec], 0xfffffffe
add ecx, 0x1f4
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ebx, ecx
je 0x48b57a
and dword [ebp + 0x8c43ec], 0xfffffffe
jmp 0x48b57a
call dword [sym.imp.MSVCR71.dll_rand]
and eax, 0x80000003
jns 0x48b52a
dec eax
or eax, 0xfffffffc
inc eax
shl eax, 1
mov ecx, dword [eax*4 + 0x7272f0]
mov edx, dword [eax*4 + 0x727350]
add ecx, edi
lea esi, [ecx + ecx*2]
add edx, ebx
shl esi, 4
add esi, edx
cmp byte [esi + 0x8c83a0], 4
mov dword [ebp + 0x8c43e8], eax
je 0x48b518
cmp dword [esi*4 + 0x8c4d98], 0x1869f
je 0x48b518
test ecx, ecx
jle 0x48b518
test edx, edx
jle 0x48b518
cmp ecx, 0x30
jge 0x48b518
cmp edx, 0x30
jge 0x48b518
mov dword [ebp + 0x8c43dc], eax
mov eax, dword [ebp + 0x8c43ec]
test al, 1
mov dword [esp + 0x30], eax
jne 0x48b7b4
mov eax, dword [ebp + 0x8c43c8]
mov ecx, dword [ebp + 0x8c43c4]
mov edx, ebx
imul edx, edx, 0x3e8
sub eax, edx
mov edx, edi
imul edx, edx, 0x3e8
sub ecx, edx
jns 0x48b5b0
neg ecx
test eax, eax
jge 0x48b5b6
neg eax
cmp ecx, eax
jle 0x48b5bf
lea eax, [eax + ecx*2]
jmp 0x48b5c2
lea eax, [ecx + eax*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x14d
jge 0x48b7b4
mov dword [esp + 0x28], 0x7fffffff
or esi, 0xffffffff
mov dword [esp + 0x14], 0
jmp 0x48b5f0
mov edx, dword [esp + 0x14]
mov ecx, dword [edx + 0x7272f0]
mov edx, dword [edx + 0x727350]
lea eax, [edi + ecx]
add edx, ebx
cmp eax, 4
jl 0x48b6db
cmp eax, 0x2c
jge 0x48b6db
cmp edx, 4
jl 0x48b6db
cmp edx, 0x2c
jge 0x48b6db
lea eax, [eax + eax*2]
shl eax, 4
add edx, eax
cmp byte [edx + 0x8c83a0], 1
jne 0x48b6db
mov edx, dword [edx*4 + 0x8c4d98]
cmp edx, dword [esp + 0x28]
mov dword [esp + 0x3c], edx
jge 0x48b6db
mov eax, dword [0x8c26cc]
test eax, eax
jne 0x48b6ca
mov edx, dword [esp + 0x14]
lea eax, [edi + ecx*2]
lea ecx, [eax + eax*2]
mov eax, dword [edx + 0x727350]
lea eax, [eax + ecx*8]
cmp byte [ebx + eax*2 + 0x8c83a0], 1
je 0x48b6ca
lea eax, [esi + 2]
and eax, 7
shl eax, 2
mov edx, dword [eax + 0x7272f0]
add edx, edi
lea ecx, [edx + edx*2]
mov edx, dword [eax + 0x727350]
shl ecx, 4
add ecx, edx
cmp byte [ecx + ebx + 0x8c83a0], 1
je 0x48b6ca
mov eax, esi
and eax, 7
shl eax, 2
mov edx, dword [eax + 0x7272f0]
mov ecx, dword [eax + 0x727350]
add edx, edi
lea edx, [edx + edx*2]
shl edx, 4
add edx, ecx
cmp byte [edx + ebx + 0x8c83a0], 1
jne 0x48b6db
mov ecx, dword [esp + 0x3c]
lea eax, [esi + 1]
mov dword [ebp + 0x8c43e8], eax
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x14]
add edx, 8
add esi, 2
mov dword [esp + 0x14], edx
lea edx, [esi + 1]
cmp edx, 8
jl 0x48b5f0
mov eax, dword [esp + 0x30]
or eax, 1
mov dword [ebp + 0x8c43ec], eax
cmp dword [0x8c26cc], 0x1f4
jge 0x48b73c
mov eax, dword [ebp + 0x8c43e8]
shl eax, 2
mov ecx, dword [eax + 0x7272f0]
mov edx, dword [eax + 0x727350]
add ecx, edi
lea ecx, [ecx + ecx*2]
shl ecx, 4
add ecx, edx
mov edx, dword [0x8c4d28]
add ecx, ebx
mov dword [ecx*4 + 0x8c4d98], edx
mov eax, dword [ebp + 0x8c43f8]
test eax, eax
jne 0x48b790
mov eax, dword [ebp + 0x8c43e8]
cmp eax, dword [ebp + 0x8c43dc]
jne 0x48b7b4
mov esi, dword [0x8ccb18]
neg esi
sbb esi, esi
and esi, 3
add esi, 3
test esi, esi
jle 0x48b775
call dword [sym.imp.MSVCR71.dll_rand]
cdq
idiv esi
test edx, edx
jne 0x48b7b4
mov eax, dword [0x8c26cc]
test eax, eax
jne 0x48b7b4
lea ecx, [edi + edi*2]
shl ecx, 4
add ecx, ebx
cmp dword [ecx*4 + 0x8c4d98], 0xa
jle 0x48b7b4
mov edx, dword [ebp + 0x8c43c4]
mov eax, dword [ebp + 0x8c43c8]
mov ecx, dword [0x8c4304]
mov dword [ebp + 0x8c43d4], edx
mov dword [ebp + 0x8c43d8], eax
mov dword [ebp + 0x8c43f0], ecx
mov eax, dword [ebp + 0x8c43e4]
test eax, eax
je 0x48b7c5
dec eax
mov dword [ebp + 0x8c43e4], eax
mov ecx, dword [ebp + 0x8c43c4]
mov esi, dword [ebp + 0x8c43c8]
lea edx, [ecx + 0x1f4]
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov ebx, dword [0x8c43c8]
mov edi, edx
shr edi, 0x1f
add edi, edx
lea edx, [esi + 0x1f4]
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x14], eax
sub ecx, dword [0x8c43c4]
sub esi, ebx
mov eax, esi
mov esi, ecx
mov dword [esp + 0x24], eax
neg eax
neg esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], esi
call fcn.004dca00
mov edx, dword [ebp + 0x8c43dc]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 2
jge 0x48ba48
mov ecx, dword [0x8c43ec]
mov eax, ecx
and al, 0x44
neg al
mov dword [esp + 0x10], 0
sbb eax, eax
and eax, 4
add eax, 5
cdq
sub eax, edx
sar eax, 1
test eax, eax
jl 0x48ba48
mov ebx, 0x64
jmp 0x48b880
mov eax, dword [ebp + 0x8c43dc]
mov edx, dword [esp + 0x10]
shl eax, 2
mov esi, dword [eax + 0x7272f0]
mov eax, dword [eax + 0x727350]
imul esi, edx
imul eax, edx
add eax, dword [esp + 0x14]
add esi, edi
lea edx, [esi + esi*2]
shl edx, 4
add edx, eax
cmp byte [edx + 0x8c83a0], 4
mov dword [esp + 0x3c], eax
je 0x48ba48
cmp dword [edx*4 + 0x8c4d98], 0x1869f
je 0x48ba48
cmp dword [esp + 0x10], 0
je 0x48b8f1
cmp dword [0x8ccb18], 0
je 0x48b8f1
cmp byte [edx + 0x8c7198], 0
je 0x48b8f1
test cl, 4
je 0x48ba48
mov edx, dword [ebp + 0x8c43e4]
test edx, edx
jg 0x48b9dd
cmp dword [0x8c26c8], esi
jne 0x48b9dd
cmp dword [0x8c26c4], eax
jne 0x48b9dd
mov eax, dword [0x8c26cc]
cmp eax, 0x2bc
jge 0x48b92d
add eax, 0xc8
mov dword [0x8c26cc], eax
fild dword [ebp + 0x8c43c4]
push 0xffffffffffffffff
push 0xbf800000
push 0
push 0xffffffffffffffff
fstp dword [esp + 0x6c]
fild dword [ebp + 0x8c43c8]
mov ecx, dword [esp + 0x6c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
fstp dword [esp + 0x7c]
mov edx, dword [esp + 0x7c]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov dword [esp + 0x8c], 0
mov ecx, dword [esp + 0x8c]
mov dword [eax + 4], edx
push 0xb0
mov dword [ebp + 0x8c43e4], ebx
mov dword [0x8c26d0], ebx
mov dword [eax + 8], ecx
call fcn.004889e0
mov edx, dword [0x8c26c4]
xor eax, eax
mov ecx, 0x240
mov edi, 0x8c7a98
rep stosd dword es:[edi], eax
mov eax, 0x2020202
mov ecx, 0x900
mov edi, 0x8c4d98
push 5
rep stosd dword es:[edi], eax
mov eax, dword [0x8c26c8]
push edx
push eax
mov dword [0x8c4cf4], 0x63
call fcn.004898a0
mov ecx, dword [0x8c43ec]
mov edi, dword [esp + 0x60]
mov eax, dword [esp + 0x74]
add esp, 0x38
cmp dword [esp + 0x10], 1
jg 0x48ba1d
cmp dword [0x8c26c8], esi
jne 0x48ba1d
cmp dword [0x8c26c4], eax
jne 0x48ba1d
cmp dword [esp + 0x48], 0x4e2
jge 0x48ba1d
test cl, 0x40
jne 0x48ba1d
or dword [ebp + 0x8c43ec], 0x400
mov ecx, dword [0x8c43ec]
mov dword [0x8c4d04], 1
mov eax, dword [esp + 0x10]
inc eax
mov edx, ecx
and dl, 0x44
neg dl
mov dword [esp + 0x10], eax
sbb edx, edx
and edx, 4
add edx, 5
mov eax, edx
cdq
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
cmp edx, eax
jle 0x48b880
mov eax, dword [0x8c26cc]
test eax, eax
jne 0x48bb94
mov eax, dword [ebp + 0x8c43f0]
cmp eax, dword [0x8c42fc]
je 0x48bb94
cmp eax, dword [0x8c42f8]
je 0x48bb94
mov esi, dword [esp + 0x30]
test esi, esi
mov ebx, dword [esp + 0x24]
mov eax, ebx
mov ecx, esi
jge 0x48ba87
mov ecx, dword [esp + 0x20]
test ebx, ebx
jge 0x48ba8f
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jle 0x48ba98
lea eax, [eax + ecx*2]
jmp 0x48ba9b
lea eax, [ecx + eax*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x1f4
jge 0x48bbea
or dword [ebp + 0x8c43ec], 0x20
mov dword [ebp + 0x8c43f4], 0xfffffbe6
mov eax, dword [0x8c43ec]
mov ecx, dword [0x8c43c4]
or eax, 0x10
mov dword [0x8c43ec], eax
mov eax, dword [0x8c43c8]
xor esi, esi
mov dword [0x8c43f4], esi
mov edx, dword [ebp + 0x8c43c4]
sub eax, dword [ebp + 0x8c43c8]
sub ecx, edx
call fcn.004dcb20
mov ecx, dword [esp + 0x14]
sub eax, 0x80000000
mov dword [0x8c43dc], eax
lea eax, [edi + edi*2]
shl eax, 4
add eax, ecx
mov dword [eax*4 + 0x8c4d98], esi
mov eax, dword [0x8ccb14]
or eax, 4
xor edx, edx
mov dword [0x8ccb14], eax
mov dword [esp + 0x24], edx
jmp 0x48bb30
mov edi, dword [esp + 0x28]
jmp 0x48bb30
mov eax, dword [edx + 0x727350]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x48], eax
add esi, eax
mov eax, dword [edx + 0x7272f0]
lea edx, [eax + eax*2]
add eax, edi
lea eax, [eax + eax*2]
shl edx, 4
mov ecx, 1
shl eax, 4
lea esp, [esp]
lea edi, [eax + esi]
cmp byte [edi + 0x8c83a0], 4
je 0x48bb84
lea ebx, [ecx + 0x64]
mov dword [edi*4 + 0x8c4d98], ebx
mov ebx, dword [esp + 0x48]
inc ecx
add eax, edx
add esi, ebx
cmp ecx, 4
jle 0x48bb60
mov edx, dword [esp + 0x24]
add edx, 8
cmp edx, 0x20
mov dword [esp + 0x24], edx
jl 0x48bb21
mov ebx, dword [0x8c43f0]
cmp dword [0x8c4d28], 0x64
jle 0x48bfa7
mov eax, dword [0x8c26d0]
test eax, eax
jne 0x48bbbe
mov ecx, dword [0x85c158]
test ecx, ecx
je 0x48bfa7
cmp dword [0x8c4d30], 0x1770
jl 0x48bd09
test eax, eax
jne 0x48bd09
mov eax, dword [0x85c158]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
add esi, 3
jmp 0x48bd0e
test esi, esi
mov eax, ebx
mov ecx, esi
jge 0x48bbf6
mov ecx, dword [esp + 0x20]
test ebx, ebx
jge 0x48bbfe
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jle 0x48bc07
lea eax, [eax + ecx*2]
jmp 0x48bc0a
lea eax, [ecx + eax*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x7d0
jge 0x48bc7a
mov edi, dword [ebp + 0x8c43dc]
mov eax, ebx
call fcn.004dca00
cmp eax, edi
jne 0x48bc7a
mov ebx, dword [0x8c43f0]
cmp ebx, 0x15
je 0x48bc80
test byte [0x8c43ec], 4
mov dword [ebp + 0x8c43f4], 0
jne 0x48bc6e
mov eax, dword [ebp + 0x8c43ec]
mov ecx, dword [0x8c4304]
or eax, 0x80
mov dword [ebp + 0x8c43f8], 0x64
mov dword [ebp + 0x8c43f0], ecx
mov dword [ebp + 0x8c43ec], eax
jmp 0x48bc7a
add edi, 2
and edi, 7
mov dword [ebp + 0x8c43e8], edi
mov ebx, dword [0x8c43f0]
mov esi, dword [esp + 0x30]
test esi, esi
mov eax, dword [esp + 0x24]
mov ecx, esi
jge 0x48bc92
mov ecx, dword [esp + 0x20]
test eax, eax
jge 0x48bc9a
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jle 0x48bca3
lea eax, [eax + ecx*2]
jmp 0x48bca6
lea eax, [ecx + eax*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0xbb8
jge 0x48bb9a
mov eax, dword [esp + 0x24]
mov edi, dword [ebp + 0x8c43dc]
call fcn.004dca00
cmp eax, edi
jne 0x48bb9a
mov edx, dword [0x8c43dc]
sar edx, 0x1c
inc edx
sar edx, 1
and edx, 7
cmp edx, edi
jne 0x48bb9a
cmp ebx, 0x15
je 0x48bb9a
test byte [0x8c43ec], 0x40
jne 0x48bb9a
mov dword [0x8ccb1c], 1
jmp 0x48bb9a
mov esi, 6
mov eax, dword [0x8c26c4]
mov edi, dword [esp + 0x14]
mov ecx, dword [0x8c26c8]
mov edx, dword [esp + 0x28]
sub eax, edi
sub ecx, edx
jns 0x48bd29
neg ecx
test eax, eax
jge 0x48bd2f
neg eax
cmp ecx, eax
jle 0x48bd38
lea eax, [eax + ecx*2]
jmp 0x48bd3b
lea eax, [ecx + eax*2]
cdq
sub eax, edx
mov ecx, eax
mov eax, 0x30
cdq
idiv esi
sar ecx, 1
cmp ecx, eax
jle 0x48bfa7
cmp dword [0x8c26c0], 0x7d0
jle 0x48bfa7
xor edi, edi
mov esi, dword [sym.imp.MSVCR71.dll_rand]
call esi
cdq
mov ecx, 0x28
idiv ecx
add edx, 4
mov dword [ebp + 0x8c43cc], edx
call esi
cdq
mov ecx, 0x28
idiv ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x70], 0
lea eax, [edx + 4]
mov edx, dword [ebp + 0x8c43cc]
imul edx, edx, 0x3e8
mov dword [ebp + 0x8c43d0], eax
imul eax, eax, 0x3e8
mov dword [esp + 0x48], edx
lea edx, [esp + 0x68]
fild dword [esp + 0x48]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x2c]
push eax
fstp dword [esp + 0x6c]
push ecx
fild dword [esp + 0x50]
mov ecx, dword [0x8ebfd8]
push edx
fstp dword [esp + 0x78]
call fcn.00537240
fld dword [0x70deb0]
fsub dword [esp + 0x2c]
fstp dword [esp + 0x2c]
fild dword [0x72837c]
fmul dword [esp + 0x4c]
call fcn.005f275c
fild dword [0x728380]
mov esi, eax
fmul dword [esp + 0x2c]
call fcn.005f275c
mov ecx, dword [0x85c158]
lea edx, [ecx + ecx*4 + 5]
inc edi
shl edx, 1
cmp edi, edx
jge 0x48bea8
mov edx, dword [ebp + 0x8c43cc]
mov ecx, dword [ebp + 0x8c43d0]
lea ebx, [edx + edx*2]
shl ebx, 4
cmp byte [ebx + ecx + 0x8c7a98], 0
je 0x48bd64
test esi, esi
jl 0x48be5b
cmp esi, dword [0x85c26c]
jge 0x48be5b
test eax, eax
jl 0x48be5b
cmp eax, dword [0x85c268]
jl 0x48bd64
mov eax, dword [0x8c26c4]
sub eax, ecx
mov ecx, dword [0x8c26c8]
sub ecx, edx
jns 0x48be6e
neg ecx
test eax, eax
jge 0x48be74
neg eax
cmp ecx, eax
jle 0x48be7d
lea eax, [eax + ecx*2]
jmp 0x48be80
lea eax, [ecx + eax*2]
mov edx, dword [0x8c4d30]
xor ecx, ecx
cmp edx, 0x1770
setge cl
cdq
sub eax, edx
sar eax, 1
lea ecx, [ecx + ecx + 4]
cmp eax, ecx
jl 0x48bd64
mov ecx, dword [0x85c158]
lea edx, [ecx + ecx*4 + 5]
shl edx, 1
cmp edi, edx
jge 0x48bfa1
mov ebx, 1
mov edi, ebx
mov esi, 0x8c4410
cmp dword [esp + 0x18], edi
je 0x48beff
mov ecx, dword [esi + 4]
mov eax, dword [ebp + 0x8c43d0]
mov edx, dword [esi]
sub eax, ecx
mov ecx, dword [ebp + 0x8c43cc]
sub ecx, edx
jns 0x48bee1
neg ecx
test eax, eax
jge 0x48bee7
neg eax
cmp ecx, eax
jle 0x48bef0
lea eax, [eax + ecx*2]
jmp 0x48bef3
lea eax, [ecx + eax*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, 3
jge 0x48beff
xor ebx, ebx
add esi, 0x44
inc edi
cmp esi, 0x8c4c4c
jl 0x48bec2
test ebx, ebx
je 0x48bfa1
mov eax, dword [ebp + 0x8c43cc]
imul eax, eax, 0x3e8
mov dword [ebp + 0x8c43d4], eax
mov dword [ebp + 0x8c43c4], eax
mov eax, dword [ebp + 0x8c43d0]
imul eax, eax, 0x3e8
mov dword [ebp + 0x8c43d8], eax
mov dword [ebp + 0x8c43c8], eax
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 0x3e8
idiv ecx
mov eax, dword [ebp + 0x8c43e4]
test eax, eax
mov dword [ebp + 0x8c43f4], edx
jne 0x48bf82
mov al, byte [ebp + 0x8c43ec]
test al, al
js 0x48bf82
mov eax, dword [0x8c26cc]
test eax, eax
jne 0x48bf82
mov edx, dword [0x72809c]
mov dword [ebp + 0x8c43f0], edx
jmp 0x48bf8d
mov eax, dword [0x8c42e8]
mov dword [ebp + 0x8c43f0], eax
mov dword [ebp + 0x8c43c0], 1
mov dword [0x8c26c0], 0
mov ebx, dword [0x8c43f0]
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 0x20
mov dword [esp + 0x18], eax
jl 0x48a070
mov ecx, dword [0x8c26bc]
mov dword [0x8c26c0], ecx
mov ecx, dword [0x8c26cc]
test ecx, ecx
je 0x48c01e
mov eax, dword [0x8c26d0]
test eax, eax
mov dword [0x8c98b0], 1
je 0x48c002
mov eax, dword [0x8c26c8]
mov esi, dword [0x8c26c4]
lea edx, [eax + eax*2]
shl edx, 4
add edx, esi
cmp dword [edx*4 + 0x8c4d98], 0x1869f
jne 0x48c009
dec ecx
mov dword [0x8c26cc], ecx
test ecx, ecx
jne 0x48c01e
call fcn.004a4920
neg al
sbb eax, eax
and eax, 2
mov dword [0x8c98b0], eax
mov eax, dword [0x8c26d0]
test eax, eax
je 0x48c02d
dec eax
mov dword [0x8c26d0], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret