Function at 0x4d68d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edx, eax
add edx, 0x10f
cmp byte [edx], 0
je 0x4c15eb
lea eax, [ebp - 0x20]
call fcn.00403e70
mov eax, dword [0x4ea490]
mov eax, dword [eax]
mov edx, dword [ebp - 0x20]
call fcn.004ae640
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4c15eb
lea edx, [eax + 0x10f]
mov eax, dword [ebp - 4]
lea eax, [eax + 0x15]
mov ecx, 0xf
call fcn.00402d04
je 0x4c15f0
mov eax, dword [ebp - 4]
mov byte [eax + 0x10f], 0
jmp 0x4c1672
mov edx, dword [ebp - 4]
add edx, 0x15
lea eax, [ebp - 0x10]
call fcn.00403e70
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2d], 0
je 0x4c160e
push 0x4d1dab
jmp 0x4c1613
push 0x4d1dbd
push dword [ebp - 0x20]
push 0x4d1dcf
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403f8c
mov edx, dword [ebp - 0x14]
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.004bb124
mov eax, dword [ebp - 8]
cmp byte [eax + 0x2d], 0
je 0x4c1648
push 0x4d1dab
jmp 0x4c164d
push 0x4d1dbd
push dword [ebp - 0x10]
push 0x4d1dec
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403f8c
mov edx, dword [ebp - 0x14]
mov ecx, 2
mov eax, dword [ebp - 8]
call fcn.004bb124
jmp 0x4d6990
push ebp
mov ebp, esp
mov ecx, 0x5d
push 0
push 0
dec ecx
jne 0x4d68d8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x48]
mov edx, dword [0x45464c]
call fcn.00404490
xor eax, eax
push ebp
push 0x4da34d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4d6d7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x317], 0
je 0x4d6950
mov eax, dword [ebp - 4]
call fcn.004c368c
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x31c]
jne 0x4d6948
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
cmp eax, dword [ebp - 4]
je 0x4d6948
mov eax, dword [ebp - 4]
cmp dword [eax + 0x31c], 0
jne 0x4d6950
mov eax, dword [ebp - 4]
call fcn.004dd394
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6ac], 0
je 0x4d697b
xor ecx, ecx
mov edx, 0x4da364
mov eax, dword [ebp - 4]
push eax
call fcn.004bb124
pop eax
mov byte [eax + 0x5d4], 1
mov byte [eax + 0x6ac], 0
cmp dword [eax + 0x5f8], 0
jne 0x4d6991
inc dword [eax + 0x5f8]
push eax
jmp 0x4c159c
pop eax
cmp byte [eax + 0x52f], 0
je 0x4d69d7
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x530]
cmp eax, 0x4e20
jbe 0x4d69d7
mov eax, dword [ebp - 4]
mov byte [eax + 0x52f], 0
xor ecx, ecx
mov edx, 0x4da390
mov eax, dword [ebp - 4]
call fcn.004bb124
mov ecx, 0x4da3a8
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
mov eax, dword [ebp - 4]
cmp byte [eax + 0x684], 0
je 0x4d6a23
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x688]
jbe 0x4d6a23
mov eax, dword [ebp - 4]
mov byte [eax + 0x684], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x694]
push eax
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x690]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x68c]
mov eax, dword [ebp - 4]
call fcn.004bcd1c
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x574]
cmp eax, 0xbb8
jbe 0x4d6b09
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x574], eax
mov eax, dword [ebp - 4]
call fcn.004da734
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.004b5db0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jl 0x4d6a9b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2f0], 0
jne 0x4d6aa5
mov eax, dword [ebp - 4]
mov byte [eax + 0x2f0], 1
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x2f4], eax
jmp 0x4d6aa5
mov eax, dword [ebp - 4]
mov byte [eax + 0x2f0], 0
cmp dword [ebp - 0x28], 3
jl 0x4d6ac0
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x2f4]
cmp eax, 0xbb8
ja 0x4d6adb
cmp dword [ebp - 0x28], 2
jne 0x4d6b09
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x2f4]
cmp eax, 0x2710
jbe 0x4d6b09
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x2f4]
cmp eax, 0x4e20
jae 0x4d6b09
mov eax, 8
call fcn.00402b78
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 4]
call fcn.004c2f90
mov eax, dword [0x4ea080]
mov eax, dword [eax]
cmp byte [eax + 0x41], 0
je 0x4d6b42
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2f8]
mov eax, dword [0x4ea080]
mov eax, dword [eax]
call fcn.004910f4
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004b84c8
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x578]
cmp eax, 0x3e8
jbe 0x4d6d4f
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x578], eax
call fcn.0040a548
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x22]
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x1e]
call fcn.0040a1bc
mov eax, dword [0x4ea614]
cmp byte [eax], 0
je 0x4d6bf5
movzx eax, word [ebp - 0x1e]
mov edx, dword [0x4ea6b4]
cmp eax, dword [edx]
je 0x4d6bad
movzx eax, word [ebp - 0x1e]
mov edx, dword [0x4ea284]
cmp eax, dword [edx]
jne 0x4d6bf5
cmp word [ebp - 0x20], 0
jne 0x4d6bf5
cmp word [ebp - 0x22], 0x1e
ja 0x4d6bf5
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x5b8]
cmp eax, 0xea60
jbe 0x4d6bf5
mov eax, dword [ebp - 4]
call fcn.004ca994
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x5b8], eax
call fcn.0040a57c
mov eax, dword [ebp - 4]
fstp qword [eax + 0x5b0]
wait
mov eax, dword [ebp - 4]
cmp dword [eax + 0x320], 0
je 0x4d6c43
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4d6c43
mov eax, dword [ebp - 4]
call fcn.004bef8c
mov byte [ebp - 0x29], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x580]
cmp al, byte [ebp - 0x29]
je 0x4d6c43
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0x29]
mov byte [eax + 0x580], dl
mov eax, dword [ebp - 4]
call fcn.004bf124
mov eax, dword [0x4ea080]
mov eax, dword [eax]
cmp byte [eax + 0x41], 0
je 0x4d6d1f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [0x4ea080]
mov edx, dword [edx]
cmp eax, dword [edx + 8]
jne 0x4d6d29
mov eax, dword [ebp - 4]
cmp dword [eax + 0x320], 0
je 0x4d6d29
mov eax, dword [0x4ea080]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.00490438
test al, al
jne 0x4d6d29
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x320]
mov eax, dword [0x4ea080]
mov eax, dword [eax]
call fcn.00491160
test al, al
je 0x4d6d29
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x320]
mov eax, dword [0x4ea080]
mov eax, dword [eax]
call fcn.004911d0
test al, al
je 0x4d6d29
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x320]
mov eax, dword [0x4ea080]
mov eax, dword [eax]
call fcn.00491290
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
mov eax, dword [eax + 4]
push eax
mov ecx, dword [0x4ea64c]
mov ecx, dword [ecx]
mov eax, dword [0x4ea490]
mov eax, dword [eax]
mov edx, 0xd3
call fcn.004af728
mov eax, dword [0x4ea080]
mov eax, dword [eax]
call fcn.004911b4
dec eax
jg 0x4d6d29
mov eax, dword [0x4ea080]
mov eax, dword [eax]
call fcn.00491408
jmp 0x4d6d29
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b84c8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x404], 0
je 0x4d6d4f
mov eax, dword [ebp - 4]
mov byte [eax + 0x404], 0
mov eax, dword [ebp - 4]
call fcn.004d6870
mov eax, dword [ebp - 4]
call fcn.004bf0c4
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x57c]
cmp eax, 0x1f4
jb 0x4d6d72
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x57c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d6d90
xor eax, eax
push ebp
push 0x4da1cc
push dword fs:[eax]
mov dword fs:[eax], esp
jmp case.0x4d70a5.10124
movzx eax, word [ebp - 0x48]
cmp eax, 0x273c
jg 0x4d7086
je 0x4d95fe
cmp eax, 0x40e
jg 0x4d6eea
je 0x4d7ce5
cmp eax, 0x3f9
jg 0x4d6e89
je 0x4d7b16
cmp eax, 0x3ef
jg 0x4d6e50
je 0x4d799c
cmp eax, 0x3ea
jg 0x4d6e2b
je 0x4d7948
cmp eax, 0x52
jg 0x4d6e14
je 0x4d7ca7
sub eax, 0x50
je 0x4d7924
dec eax
je 0x4d793b
jmp case.0x4d7303.10308
sub eax, 0x3e8
je 0x4d78a9
dec eax
je 0x4d78f9
jmp case.0x4d7303.10308
sub eax, 0x3eb
je 0x4d795b
dec eax
je 0x4d7972
dec eax
je case.0x4d70a5.10124
dec eax
je 0x4d7989
jmp case.0x4d7303.10308
add eax, 0xfffffc10
cmp eax, 8
ja case.0x4d7303.10308
jmp dword [eax*4 + 0x4d6e65]
add eax, 0xfffffc05
cmp eax, 0x12
ja case.0x4d7303.10308
jmp dword [eax*4 + 0x4d6e9e]
cmp eax, 0x2712
jg 0x4d6fcd
je 0x4d8563
cmp eax, 0xbc2
jg 0x4d6f65
je 0x4d73dd
cmp eax, 0x413
jg 0x4d6f3a
je 0x4d7d86
sub eax, 0x40f
je 0x4d7cf5
dec eax
je 0x4d7d05
dec eax
je 0x4d7d15
dec eax
je 0x4d7d42
jmp case.0x4d7303.10308
sub eax, 0x414
je 0x4d7d25
dec eax
je 0x4d7d32
sub eax, 0x37
je case.0x4d70a5.10124
sub eax, 0x771
je 0x4d76ae
jmp case.0x4d7303.10308
cmp eax, 0xbc9
jg 0x4d6f9a
je 0x4d76fd
sub eax, 0xbc3
je 0x4d7472
dec eax
je 0x4d77ee
dec eax
je 0x4d7517
dec eax
sub eax, 3
jb 0x4d75bc
jmp case.0x4d7303.10308
add eax, 0xfffff436
sub eax, 2
jb 0x4d75bc
add eax, 0xfffffffc
sub eax, 2
jb 0x4d75bc
sub eax, 4
je 0x4d788b
sub eax, 0x1b3b
je case.0x4d6fdb.10013
jmp case.0x4d7303.10308
add eax, 0xffffd8ed
cmp eax, 0x28
ja case.0x4d7303.10308
jmp dword [eax*4 + 0x4d6fe2]
cmp eax, 0x279e
jg 0x4d7230
je 0x4d9ce4
add eax, 0xffffd8c3
cmp eax, 0x60
ja case.0x4d7303.10308
jmp dword [eax*4 + 0x4d70ac]
cmp eax, 0x2841
jg 0x4d72e4
je 0x4d9fa7
cmp eax, 0x27a9
jg 0x4d728b
je 0x4d8e09
add eax, 0xffffd861
cmp eax, 9
ja case.0x4d7303.10308
jmp dword [eax*4 + 0x4d7263]
cmp eax, 0x27dd
jg 0x4d72bf
je 0x4d949a
sub eax, 0x27d8
je 0x4d91b4
dec eax
je 0x4d9254
dec eax
je 0x4d9358
sub eax, 2
je 0x4d93fd
jmp case.0x4d7303.10308
sub eax, 0x283d
je 0x4d9f44
dec eax
je 0x4d8169
dec eax
je 0x4d9f51
dec eax
je 0x4d9f6d
jmp case.0x4d7303.10308
cmp eax, 0x2860
jg 0x4d7382
je case.0x4d7303.10331
add eax, 0xffffd7be
cmp eax, 0x1d
ja case.0x4d7303.10308
jmp dword [eax*4 + 0x4d730a]
cmp eax, 0x28ad
jg 0x4d73b6
je 0x4d9538
sub eax, 0x28a0
je 0x4d820a
dec eax
je 0x4d7d99
sub eax, 9
je 0x4d94bd
dec eax
je 0x4d94ec
jmp case.0x4d7303.10308
sub eax, 0x28ae
je 0x4d9509
dec eax
je 0x4d8e97
dec eax
je 0x4d9fe3
sub eax, 0x54
je 0x4d9fff
jmp case.0x4d7303.10308
mov eax, dword [ebp - 4]
cmp byte [eax + 0x304], 0
jne 0x4d7400
movzx eax, word [ebp - 0x46]
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004caeb8
test al, al
jne 0x4d7433
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x80]
call fcn.004091f0
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
mov edx, 0x4da3e4
call fcn.00403f18
mov ecx, dword [ebp - 0x7c]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x88]
call fcn.004091f0
mov ecx, dword [ebp - 0x88]
lea eax, [ebp - 0x84]
mov edx, 0x4da3f4
call fcn.00403f18
mov ecx, dword [ebp - 0x84]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
cmp byte [eax + 0x304], 0
jne 0x4d7490
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004caf08
test al, al
jne 0x4d74cf
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x90]
call fcn.004091f0
mov ecx, dword [ebp - 0x90]
lea eax, [ebp - 0x8c]
mov edx, 0x4da3e4
call fcn.00403f18
mov ecx, dword [ebp - 0x8c]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x98]
call fcn.004091f0
mov ecx, dword [ebp - 0x98]
lea eax, [ebp - 0x94]
mov edx, 0x4da3f4
call fcn.00403f18
mov ecx, dword [ebp - 0x94]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
mov eax, dword [ebp - 4]
inc dword [eax + 0x5f8]
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
cmp byte [eax + 0x304], 0
jne 0x4d7535
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004cb11c
test al, al
jne 0x4d7574
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa0]
call fcn.004091f0
mov ecx, dword [ebp - 0xa0]
lea eax, [ebp - 0x9c]
mov edx, 0x4da3e4
call fcn.00403f18
mov ecx, dword [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa8]
call fcn.004091f0
mov ecx, dword [ebp - 0xa8]
lea eax, [ebp - 0xa4]
mov edx, 0x4da3f4
call fcn.00403f18
mov ecx, dword [ebp - 0xa4]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
mov eax, dword [ebp - 4]
inc dword [eax + 0x5f8]
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
cmp byte [eax + 0x304], 0
jne 0x4d766f
mov eax, dword [ebp - 0x40]
push eax
movzx eax, word [ebp - 0x46]
push eax
movzx edx, word [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004cb7f8
test al, al
je 0x4d7630
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xb0]
call fcn.004091f0
mov ecx, dword [ebp - 0xb0]
lea eax, [ebp - 0xac]
mov edx, 0x4da3f4
call fcn.00403f18
mov ecx, dword [ebp - 0xac]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
mov eax, dword [ebp - 4]
inc dword [eax + 0x5f8]
jmp case.0x4d70a5.10124
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xb8]
call fcn.004091f0
mov ecx, dword [ebp - 0xb8]
lea eax, [ebp - 0xb4]
mov edx, 0x4da3e4
call fcn.00403f18
mov ecx, dword [ebp - 0xb4]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc0]
call fcn.004091f0
mov ecx, dword [ebp - 0xc0]
lea eax, [ebp - 0xbc]
mov edx, 0x4da3e4
call fcn.00403f18
mov ecx, dword [ebp - 0xbc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
cmp byte [eax + 0x304], 0
jne case.0x4d70a5.10124
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc8]
call fcn.004091f0
mov ecx, dword [ebp - 0xc8]
lea eax, [ebp - 0xc4]
mov edx, 0x4da3f4
call fcn.00403f18
mov ecx, dword [ebp - 0xc4]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
cmp byte [eax + 0x304], 0
jne 0x4d77af
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x3c]
push eax
movzx edx, word [ebp - 0x46]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004cbcec
test al, al
je 0x4d7770
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xd0]
call fcn.004091f0
mov ecx, dword [ebp - 0xd0]
lea eax, [ebp - 0xcc]
mov edx, 0x4da3f4
call fcn.00403f18
mov ecx, dword [ebp - 0xcc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
mov eax, dword [ebp - 4]
inc dword [eax + 0x5f8]
jmp case.0x4d70a5.10124
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xd8]
call fcn.004091f0
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 0xd4]
mov edx, 0x4da3e4
call fcn.00403f18
mov ecx, dword [ebp - 0xd4]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xe0]
call fcn.004091f0
mov ecx, dword [ebp - 0xe0]
lea eax, [ebp - 0xdc]
mov edx, 0x4da3e4
call fcn.00403f18
mov ecx, dword [ebp - 0xdc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
cmp byte [eax + 0x304], 0
jne 0x4d784c
movzx eax, word [ebp - 0x46]
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004cc248
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xe8]
call fcn.004091f0
mov ecx, dword [ebp - 0xe8]
lea eax, [ebp - 0xe4]
mov edx, 0x4da3f4
call fcn.00403f18
mov ecx, dword [ebp - 0xe4]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xf0]
call fcn.004091f0
mov ecx, dword [ebp - 0xf0]
lea eax, [ebp - 0xec]
mov edx, 0x4da3e4
call fcn.00403f18
mov ecx, dword [ebp - 0xec]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
cmp dword [ebp - 0x30], 0
je case.0x4d70a5.10124
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
mov bx, 0xfffa
call fcn.004030dc
jmp case.0x4d70a5.10124
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.004c5a2c
test al, al
je 0x4d78da
push 0
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, 0x258
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, 0x259
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
cmp eax, dword [ebp - 0x40]
jne case.0x4d70a5.10124
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
cmp eax, dword [ebp - 0x3c]
jne case.0x4d70a5.10124
mov eax, dword [ebp - 4]
call fcn.004c5cb0
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004da8e8
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
call fcn.004d0edc
jmp case.0x4d70a5.10124
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.004dabd4
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x44]
mov dl, byte [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.004dac70
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x44]
mov dl, byte [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.004db01c
jmp case.0x4d70a5.10124
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004db3b0
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x3c]
push eax
movzx eax, word [ebp - 0x46]
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004db7e0
jmp case.0x4d70a5.10124
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004db9a4
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
mov byte [eax + 0x5d7], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x5d5], 1
jmp case.0x4d70a5.10124
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004dba10
jmp case.0x4d70a5.10124
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004dbaa4
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x30]
push eax
mov dx, word [ebp - 0x3c]
mov ax, word [ebp - 0x40]
call fcn.00407b18
mov ecx, eax
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004dbb7c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x30]
push eax
mov dx, word [ebp - 0x3c]
mov ax, word [ebp - 0x40]
call fcn.00407b18
mov ecx, eax
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004dbccc
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x30]
push eax
mov dx, word [ebp - 0x3c]
mov ax, word [ebp - 0x40]
call fcn.00407b18
mov ecx, eax
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004dbe1c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x30]
push eax
mov dx, word [ebp - 0x3c]
mov ax, word [ebp - 0x40]
call fcn.00407b18
mov ecx, eax
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004dbfc0
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x30]
push eax
mov dx, word [ebp - 0x3c]
mov ax, word [ebp - 0x40]
call fcn.00407b18
mov ecx, eax
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004dc2b8
jmp case.0x4d70a5.10124
push 0
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x30]
push eax
movzx edx, word [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004dca10
jmp case.0x4d70a5.10124
mov dx, word [ebp - 0x3c]
mov ax, word [ebp - 0x40]
call fcn.00407b18
push eax
push 0
mov eax, dword [ebp - 0x30]
push eax
movzx edx, word [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004dca10
jmp case.0x4d70a5.10124
cmp dword [ebp - 0x44], 0
jle case.0x4d70a5.10124
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004c5bb0
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
cmp dword [ebp - 0x40], 0
jne 0x4d7b42
mov eax, dword [ebp - 4]
call fcn.004c3c10
jmp 0x4d7b4c
mov eax, dword [ebp - 4]
mov byte [eax + 0xb0], 1
mov eax, dword [ebp - 4]
cmp byte [eax + 0xb0], 0
je 0x4d7b74
push 1
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0x293
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0x293
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
lea edx, [ebp - 0xf4]
mov eax, dword [ebp - 0x30]
call fcn.00408f0c
mov edx, dword [ebp - 0xf4]
mov eax, dword [ebp - 4]
call fcn.004dccb4
jmp case.0x4d70a5.10124
lea edx, [ebp - 0xf8]
mov eax, dword [ebp - 0x30]
call fcn.00408f0c
mov edx, dword [ebp - 0xf8]
mov eax, dword [ebp - 4]
call fcn.004dce48
jmp case.0x4d70a5.10124
lea edx, [ebp - 0xfc]
mov eax, dword [ebp - 0x30]
call fcn.00408f0c
mov edx, dword [ebp - 0xfc]
mov eax, dword [ebp - 4]
call fcn.004dcfb8
jmp case.0x4d70a5.10124
lea edx, [ebp - 0x100]
mov eax, dword [ebp - 0x30]
call fcn.00408f0c
mov edx, dword [ebp - 0x100]
mov eax, dword [ebp - 4]
call fcn.004dd0a8
jmp case.0x4d70a5.10124
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004dd79c
jmp case.0x4d70a5.10124
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004dd958
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
call fcn.004dd450
jmp case.0x4d70a5.10124
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004ddb04
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
call fcn.004ddc8c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x30]
push eax
mov dx, word [ebp - 0x3c]
mov ax, word [ebp - 0x40]
call fcn.00407b18
mov ecx, eax
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004dc664
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
call fcn.004de550
jmp case.0x4d70a5.10124
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004dcaf8
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004de654
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
call fcn.004de8e0
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
call fcn.004debdc
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
call fcn.004debf0
jmp case.0x4d70a5.10124
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.004dedb4
jmp case.0x4d70a5.10124
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.004defb8
jmp case.0x4d70a5.10124
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.004df1ec
jmp case.0x4d70a5.10124
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.004df2e8
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
call fcn.004df3ac
jmp case.0x4d70a5.10124
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.004df604
jmp case.0x4d70a5.10124
mov edx, 0x4da3fc
lea eax, [ebp - 0x12c]
call fcn.00402a18
mov eax, dword [ebp - 4]
lea edx, [eax + 0x15]
lea eax, [ebp - 0x12c]
mov cl, 0x25
call fcn.004029e8
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x104]
call fcn.00403e70
mov eax, dword [ebp - 0x104]
call fcn.004e4274
jmp case.0x4d70a5.10124
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004df804
jmp case.0x4d70a5.10124
cmp dword [ebp - 0x44], 0
je case.0x4d70a5.10124
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004df84c
mov edx, 0x24
mov eax, dword [ebp - 0x44]
call fcn.004027b8
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x24], 0
je 0x4d7dd8
mov dword [ebp - 0x28], 1
jmp 0x4d7e02
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6a4]
dec eax
je 0x4d7deb
sub eax, 2
je 0x4d7df2
jmp 0x4d7dfb
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x4d7e02
mov dword [ebp - 0x28], 1
jmp 0x4d7e02
mov dword [ebp - 0x28], 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x25], 0
je 0x4d7e16
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x28]
push eax
mov ax, word [ebp - 0x28]
push eax
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 4]
mov cx, word [eax + 0x24]
mov edx, dword [ebp - 4]
mov ax, 0x33
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
lea eax, [ebp - 0x140]
mov edx, dword [ebp - 4]
add edx, 4
call fcn.00403e70
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.00456504
mov ecx, dword [ebp - 0x13c]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
mov eax, dword [ebp - 4]
call fcn.004d677c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
call fcn.004da8e8
mov eax, dword [ebp - 4]
call fcn.004d6870
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 8]
push eax
xor ecx, ecx
mov edx, 0x36
mov eax, dword [ebp - 4]
call fcn.004cad6c
mov eax, dword [0x4ea160]
mov eax, dword [eax]
call fcn.00407b24
push eax
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [0x4ea160]
mov cx, word [ecx]
mov edx, dword [0x4ea108]
mov edx, dword [edx]
mov ax, 0x452
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [0x4ea694]
mov ax, word [eax]
mov word [ebp - 0x18], ax
mov eax, dword [0x4ea694]
mov eax, dword [eax]
call fcn.00407b24
mov word [ebp - 0x16], ax
lea ecx, [ebp - 0x144]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004565b0
mov ecx, dword [ebp - 0x144]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x24], 0
je 0x4d7fa1
mov dword [ebp - 0x28], 1
jmp 0x4d7fcb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6a4]
dec eax
je 0x4d7fb4
sub eax, 2
je 0x4d7fbb
jmp 0x4d7fc4
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x4d7fcb
mov dword [ebp - 0x28], 1
jmp 0x4d7fcb
mov dword [ebp - 0x28], 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x25], 0
je 0x4d7fdf
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x27a
mov eax, dword [ebp - 4]
call fcn.004cad6c
mov eax, dword [ebp - 4]
call fcn.004d6870
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 8]
push eax
xor ecx, ecx
mov edx, 0x36
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x24], 0
je 0x4d804c
mov dword [ebp - 0x28], 1
jmp 0x4d8076
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6a4]
dec eax
je 0x4d805f
sub eax, 2
je 0x4d8066
jmp 0x4d806f
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x4d8076
mov dword [ebp - 0x28], 1
jmp 0x4d8076
mov dword [ebp - 0x28], 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x25], 0
je 0x4d808a
xor eax, eax
mov dword [ebp - 0x28], eax
mov ax, word [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 4]
mov cx, word [eax + 0x6a4]
xor edx, edx
mov ax, 0x2e
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
push 0
push 0
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [eax + 0x2f]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x30]
mov ax, 0x34
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
lea ecx, [ebp - 0x148]
mov eax, dword [ebp - 4]
add eax, 0x198
mov edx, 0x28
call fcn.004565b0
mov ecx, dword [ebp - 0x148]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x26c]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x23c]
call fcn.00407b04
movzx eax, ax
push eax
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x24b]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x24a]
call fcn.00407b04
movzx eax, ax
push eax
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x249]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x248]
call fcn.00407b04
movzx eax, ax
push eax
push 0
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x24c]
xor edx, edx
call fcn.00407b04
xor edx, edx
call fcn.00407b18
mov ecx, eax
mov edx, 0x2f0
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
call fcn.004c145c
push eax
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0x2fe
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
call fcn.004da9e4
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
mov ax, word [eax + 0x1a6]
push eax
mov eax, dword [ebp - 0x38]
mov ax, word [eax + 0x1a8]
push eax
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 0x38]
mov cx, word [eax + 0x1a4]
mov edx, dword [ebp - 0x38]
mov ax, 0x35
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x28]
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x2c]
push eax
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 4]
mov cx, word [eax + 0x24]
mov edx, dword [ebp - 4]
mov ax, 0x1c
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
call fcn.004ba23c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x14c]
lea eax, [ebp - 0xc]
mov edx, 8
call fcn.004565b0
mov ecx, dword [ebp - 0x14c]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
jne 0x4d8341
cmp word [ebp - 0x48], 0x271d
je 0x4d8341
cmp word [ebp - 0x48], 0x271f
je 0x4d8341
cmp word [ebp - 0x48], 0x2720
jne case.0x4d70a5.10124
mov ax, word [ebp - 0x48]
sub ax, 0x271d
je 0x4d835f
sub ax, 2
je 0x4d83b9
dec ax
je 0x4d8413
jmp 0x4d846a
mov ax, word [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
mov dl, byte [eax + 0x2a4]
mov al, byte [ebp - 0x46]
call fcn.00407b04
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 9
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
jmp 0x4d84bf
mov ax, word [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
mov dl, byte [eax + 0x2a4]
mov al, byte [ebp - 0x46]
call fcn.00407b04
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 6
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
jmp 0x4d84bf
mov ax, word [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
mov dl, byte [eax + 0x2a4]
mov al, byte [ebp - 0x46]
call fcn.00407b04
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 7
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
jmp 0x4d84bf
mov ax, word [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
mov dl, byte [eax + 0x2a4]
mov al, byte [ebp - 0x46]
call fcn.00407b04
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0xa
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
call fcn.004ba25c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov edx, 8
call fcn.004565b0
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.004bf180
and eax, 0xff
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x30], 0
je 0x4d854a
push dword [ebp - 0x30]
push 0x4da41c
lea edx, [ebp - 0x158]
mov eax, dword [ebp - 0x28]
call fcn.004091c0
push dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00403f8c
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.00456504
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 0x1c]
call fcn.00403ed4
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
je case.0x4d70a5.10124
mov ax, word [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
mov dl, byte [eax + 0x2a4]
mov al, byte [ebp - 0x46]
call fcn.00407b04
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0xb
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
call fcn.004ba25c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x15c]
lea eax, [ebp - 0xc]
mov edx, 8
call fcn.004565b0
mov ecx, dword [ebp - 0x15c]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
je case.0x4d70a5.10124
mov ax, word [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
mov dl, byte [eax + 0x2a4]
mov al, byte [ebp - 0x46]
call fcn.00407b04
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0xd
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
call fcn.004ba25c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x160]
lea eax, [ebp - 0xc]
mov edx, 8
call fcn.004565b0
mov ecx, dword [ebp - 0x160]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
je case.0x4d70a5.10124
mov ax, word [ebp - 0x40]
push eax
mov ax, word [ebp - 0x46]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x27d
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
je case.0x4d70a5.10124
mov ax, word [ebp - 0x40]
push eax
mov ax, word [ebp - 0x46]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0xe
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
je case.0x4d70a5.10124
mov ax, word [ebp - 0x40]
push eax
mov ax, word [ebp - 0x46]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x12
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
je case.0x4d70a5.10124
mov ax, word [ebp - 0x40]
push eax
mov ax, word [ebp - 0x46]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x13
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
je case.0x4d70a5.10124
mov ax, word [ebp - 0x40]
push eax
mov ax, word [ebp - 0x46]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x18
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
je case.0x4d70a5.10124
mov ax, word [ebp - 0x40]
push eax
mov ax, word [ebp - 0x46]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0xf
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
je case.0x4d70a5.10124
mov ax, word [ebp - 0x40]
push eax
mov ax, word [ebp - 0x46]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x10
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
je case.0x4d70a5.10124
mov ax, word [ebp - 0x40]
push eax
mov ax, word [ebp - 0x46]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 8
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
je case.0x4d70a5.10124
mov ax, word [ebp - 0x40]
push eax
mov ax, word [ebp - 0x46]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x11
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
lea edx, [ebp - 0x164]
mov eax, dword [ebp - 0x3c]
call fcn.004091c0
mov ecx, dword [ebp - 0x164]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x40]
call fcn.00407b24
push eax
mov ax, word [ebp - 0x44]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x40]
mov edx, dword [ebp - 0x38]
mov ax, 0x27e
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
lea ecx, [ebp - 0x168]
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.004565b0
mov ecx, dword [ebp - 0x168]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x38]
mov edx, 0x27f
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
cmp word [ebp - 0x46], 0
jbe case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
jne 0x4d8be1
cmp dword [ebp - 0x3c], 0
je 0x4d8b67
mov eax, dword [ebp - 0x3c]
cmp byte [eax + 0x23a], 0
jne 0x4d8b5c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004bc7bc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004bc74c
mov eax, dword [ebp - 4]
call fcn.004bf0a0
cmp eax, 2
jl 0x4d8b82
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x5f4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x320]
mov eax, dword [0x4ea080]
mov eax, dword [eax]
call fcn.00490400
test al, al
je 0x4d8bb9
cmp dword [ebp - 0x3c], 0
je 0x4d8bb9
mov eax, dword [ebp - 0x3c]
mov byte [eax + 0x2b0], 1
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 0x3c]
mov dword [edx + 0x2b4], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x370], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x374], edx
mov eax, dword [ebp - 4]
dec dword [eax + 0x254]
mov eax, dword [ebp - 4]
dec dword [eax + 0x25c]
cmp dword [ebp - 0x38], 0
je 0x4d8c58
mov eax, dword [ebp - 0x38]
mov ax, word [eax + 0x1a8]
push eax
mov ax, word [ebp - 0x46]
push eax
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 0x38]
mov cx, word [eax + 0x1a4]
mov edx, dword [ebp - 0x38]
mov ax, 0x1f
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
call fcn.004ba25c
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
cmp word [ebp - 0x48], 0x272b
jne 0x4d8c69
mov dword [ebp - 0x4c], 1
jmp 0x4d8c6e
xor eax, eax
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x16c]
lea eax, [ebp - 0x58]
mov edx, 0x10
call fcn.004565b0
mov ecx, dword [ebp - 0x16c]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
cmp dword [ebp - 0x3c], 1
jne 0x4d8ced
mov ax, word [ebp - 0x40]
push eax
mov ax, word [ebp - 0x46]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x22
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
jmp 0x4d8d35
mov ax, word [ebp - 0x40]
push eax
mov ax, word [ebp - 0x46]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x20
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
call fcn.004ba25c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x170]
lea eax, [ebp - 0xc]
mov edx, 8
call fcn.004565b0
mov ecx, dword [ebp - 0x170]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov ax, word [ebp - 0x40]
push eax
mov ax, word [ebp - 0x46]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x21
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
call fcn.004ba25c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x174]
lea eax, [ebp - 0xc]
mov edx, 8
call fcn.004565b0
mov ecx, dword [ebp - 0x174]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov ax, word [ebp - 0x40]
push eax
mov ax, word [ebp - 0x46]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x1b
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
call fcn.004ba25c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x178]
lea eax, [ebp - 0xc]
mov edx, 8
call fcn.004565b0
mov ecx, dword [ebp - 0x178]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
cmp dword [ebp - 0x44], 0
je case.0x4d70a5.10124
cmp dword [ebp - 0x40], 0
je case.0x4d70a5.10124
mov eax, dword [ebp - 0x40]
call fcn.00407b24
push eax
push 0
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x40]
mov edx, dword [ebp - 0x44]
mov ax, 0x450
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x40]
call fcn.004ba25c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x17c]
lea eax, [ebp - 0xc]
mov edx, 8
call fcn.004565b0
mov ecx, dword [ebp - 0x17c]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
mov byte [eax + 0x5d7], 1
push 0
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
xor ecx, ecx
mov edx, 0x322
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
cmp word [ebp - 0x48], 0x285b
jne 0x4d8fc1
mov ax, word [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
mov dl, byte [eax + 0x2a4]
mov al, byte [ebp - 0x46]
call fcn.00407b04
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x321
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
jmp 0x4d9016
mov ax, word [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
mov dl, byte [eax + 0x2a4]
mov al, byte [ebp - 0x46]
call fcn.00407b04
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x327
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
call fcn.004ba25c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov edx, 8
call fcn.004565b0
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.004bf180
and eax, 0xff
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x30], 0
je 0x4d90a1
push dword [ebp - 0x30]
push 0x4da41c
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 0x28]
call fcn.004091c0
push dword [ebp - 0x188]
lea eax, [ebp - 0x184]
mov edx, 3
call fcn.00403f8c
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x180]
call fcn.00456504
mov edx, dword [ebp - 0x180]
lea eax, [ebp - 0x1c]
call fcn.00403ed4
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
cmp word [ebp - 0x48], 0x285a
jne 0x4d9104
push 0
push 0
lea eax, [ebp - 0x138]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x38]
mov ax, 0x320
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
jmp 0x4d9144
push 0
push 0
lea eax, [ebp - 0x138]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x38]
mov ax, 0x326
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
push 0
push 0
lea eax, [ebp - 0x138]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x38]
mov ax, 0x1e
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov ax, word [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
mov dl, byte [eax + 0x2a4]
mov al, byte [ebp - 0x46]
call fcn.00407b04
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x14
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
call fcn.004ba25c
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x58]
mov edx, 0x10
call fcn.004565b0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov ax, word [ebp - 0x40]
push eax
push 0
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x15
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x40]
call fcn.00407b24
mov word [ebp - 0x18], ax
mov word [ebp - 0x16], 0
mov ax, word [ebp - 0x40]
push eax
mov ax, word [ebp - 0x3c]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x46]
mov edx, dword [ebp - 0x44]
mov ax, 0x324
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004565b0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
movzx eax, word [ebp - 0x46]
push eax
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x3c]
push eax
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x325
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
cmp dword [ebp - 0x3c], 0
je case.0x4d70a5.10124
mov eax, dword [ebp - 0x3c]
mov ax, word [eax + 0x24]
mov word [ebp - 0x14], ax
mov eax, dword [ebp - 0x3c]
mov ax, word [eax + 0x28]
mov word [ebp - 0x12], ax
mov ax, word [ebp - 0x3c]
mov word [ebp - 0x10], ax
mov eax, dword [ebp - 0x3c]
call fcn.00407b24
mov word [ebp - 0xe], ax
mov ax, word [ebp - 0x40]
push eax
mov ax, word [ebp - 0x46]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x16
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov edx, 8
call fcn.004565b0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
cmp dword [ebp - 0x3c], 0
je case.0x4d70a5.10124
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
movzx eax, word [ebp - 0x46]
mov dword [ebp - 0x4c], eax
mov ax, word [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax + 0x2c]
push eax
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov ax, 0x17
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0x58]
mov edx, 0x10
call fcn.004565b0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x3c]
push eax
push 0
mov ecx, dword [ebp - 0x38]
mov edx, 0x2cc
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
movzx eax, word [eax + 0x1a4]
push eax
mov eax, dword [ebp - 0x38]
movzx eax, word [eax + 0x1a8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x38]
mov edx, 0x44c
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x38]
mov edx, 0x44d
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
movzx eax, word [eax + 0x1a4]
push eax
mov eax, dword [ebp - 0x38]
movzx eax, word [eax + 0x1a8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x38]
mov edx, 0x44f
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x38]
mov edx, 0x44e
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.004bf180
and eax, 0xff
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x38]
mov edx, 0x290
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
lea eax, [ebp - 0x138]
push eax
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.004bf180
xor ecx, ecx
mov cl, al
mov edx, dword [ebp - 0x38]
mov ax, 0x2a
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
lea edx, [ebp - 0x18c]
mov eax, dword [ebp - 0x30]
call fcn.00456504
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
push 0
push 0
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4c]
mov cx, word [ebp - 0x44]
mov ax, 0x2c
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
push 0
push 0
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [eax + 0x34]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4c]
mov ax, 0x2d
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004cab38
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x30]
push eax
push 0
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [eax + 0x2f]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x30]
mov ax, 0x34
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
lea ecx, [ebp - 0x190]
mov eax, dword [ebp - 4]
add eax, 0x198
mov edx, 0x28
call fcn.004565b0
mov ecx, dword [ebp - 0x190]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x26c]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x23c]
call fcn.00407b04
movzx eax, ax
push eax
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x24b]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x24a]
call fcn.00407b04
movzx eax, ax
push eax
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x249]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x248]
call fcn.00407b04
movzx eax, ax
push eax
push 0
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x24c]
xor edx, edx
call fcn.00407b04
xor edx, edx
call fcn.00407b18
mov ecx, eax
mov edx, 0x2f0
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
movzx eax, word [ebp - 0x48]
cmp eax, 0x2776
jg 0x4d97e7
je 0x4d99e2
sub eax, 0x272e
je 0x4d980e
dec eax
je 0x4d98aa
dec eax
je 0x4d985c
sub eax, 0x44
je 0x4d98f8
jmp 0x4d9abb
sub eax, 0x2777
je 0x4d9946
dec eax
je 0x4d9a30
dec eax
je 0x4d9994
sub eax, 0x15
je 0x4d9a7b
jmp 0x4d9abb
push 0
push 1
lea eax, [ebp - 0x138]
push eax
mov dl, 0xff
xor eax, eax
call fcn.00407b04
mov ecx, eax
mov edx, dword [ebp - 0x38]
mov ax, 0x28
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
jmp 0x4d9abb
push 0
push 1
lea eax, [ebp - 0x138]
push eax
mov dl, 0x97
xor eax, eax
call fcn.00407b04
mov ecx, eax
mov edx, dword [ebp - 0x38]
mov ax, 0x28
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
jmp 0x4d9abb
push 0
push 1
lea eax, [ebp - 0x138]
push eax
mov dl, 0xff
mov al, 0xfc
call fcn.00407b04
mov ecx, eax
mov edx, dword [ebp - 0x38]
mov ax, 0x67
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
jmp 0x4d9abb
push 0
push 1
lea eax, [ebp - 0x138]
push eax
mov dl, 0x38
mov al, 0xff
call fcn.00407b04
mov ecx, eax
mov edx, dword [ebp - 0x38]
mov ax, 0x64
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
jmp 0x4d9abb
push 0
push 1
lea eax, [ebp - 0x138]
push eax
mov dl, 0xff
mov al, 0xdb
call fcn.00407b04
mov ecx, eax
mov edx, dword [ebp - 0x38]
mov ax, 0x64
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
jmp 0x4d9abb
push 0
push 1
lea eax, [ebp - 0x138]
push eax
mov dl, 0xfc
mov al, 0xff
call fcn.00407b04
mov ecx, eax
mov edx, dword [ebp - 0x38]
mov ax, 0x64
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
jmp 0x4d9abb
push 0
push 1
lea eax, [ebp - 0x138]
push eax
mov dl, 0xff
mov al, 0xc4
call fcn.00407b04
mov ecx, eax
mov edx, dword [ebp - 0x38]
mov ax, 0x64
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
jmp 0x4d9abb
push 0
push 1
lea eax, [ebp - 0x138]
push eax
mov dl, 0xff
mov al, 0xd4
call fcn.00407b04
mov ecx, eax
mov edx, dword [ebp - 0x38]
mov ax, 0x68
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
jmp 0x4d9abb
push 0
push 1
lea eax, [ebp - 0x138]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x38]
mov ax, 0x283
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
call fcn.00456504
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x284
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x40]
push eax
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, 0x285
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x40]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x286
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x40]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x29c
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x40]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x2bc
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004dc120
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x40]
push eax
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, 0x2c8
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x287
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x288
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x289
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
movzx eax, word [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x40]
call fcn.00407b24
movzx eax, ax
push eax
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x28a
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x28b
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x2c9
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x2ca
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x3c]
push eax
push 0
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, 0x28c
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x3c]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x29d
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x29e
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x29f
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x3c]
push eax
movzx eax, word [ebp - 0x46]
push eax
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, 0x262
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x3c]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x263
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
cmp dword [ebp - 0x44], 0
je case.0x4d70a5.10124
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004d0dac
mov eax, dword [ebp - 0x44]
call fcn.00402f00
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x40]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0x264
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x40]
push eax
push 0
push 0
xor ecx, ecx
mov edx, 0x266
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
call fcn.004d112c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
call fcn.004d1418
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x1bc]
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x1be]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x1b8]
mov edx, 0x26e
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
mov edx, 0x28d
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
movzx eax, word [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x44]
call fcn.00407b24
movzx eax, ax
push eax
push 0
push 0
mov ecx, dword [ebp - 0x38]
mov edx, 0x29
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
movzx eax, word [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x44]
call fcn.00407b24
movzx eax, ax
push eax
movzx eax, word [ebp - 0x46]
push eax
push 0
mov ecx, dword [ebp - 0x38]
mov edx, 0x291
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0x279
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x40]
push eax
movzx eax, word [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x3c]
call fcn.00407b24
movzx eax, ax
push eax
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x280
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
movzx eax, word [ebp - 0x46]
push eax
movzx eax, word [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x40]
call fcn.00407b24
movzx eax, ax
push eax
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x282
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x2a4]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x38]
mov edx, 0x28e
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x28f
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0x29a
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 4]
call fcn.004de5a4
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0x2fa
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x2fb
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x2fd
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, 0x2fc
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, 0x2ff
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0x451
mov eax, dword [ebp - 4]
call fcn.004cad6c
jmp case.0x4d70a5.10124
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
push 0
push 0
lea eax, [ebp - 0x138]
push eax
mov cx, word [ebp - 0x46]
mov edx, dword [ebp - 0x38]
mov ax, 0x4b0
call fcn.004546f8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x138]
mov dword [eax + 0x550], edx
mov edx, dword [ebp - 0x134]
mov dword [eax + 0x554], edx
mov edx, dword [ebp - 0x130]
mov dword [eax + 0x558], edx
lea ecx, [ebp - 0x194]
lea eax, [ebp - 0x58]
mov edx, 0x10
call fcn.004565b0
lea eax, [ebp - 0x194]
push eax
lea edx, [ebp - 0x198]
mov eax, dword [ebp - 0x30]
call fcn.00456504
mov edx, dword [ebp - 0x198]
pop eax
call fcn.00403ed4
mov ecx, dword [ebp - 0x194]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x550]
mov eax, dword [ebp - 4]
call fcn.004cab38
jmp case.0x4d70a5.10124
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.004c9280
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.004030dc
test al, al
jne 0x4d6da3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5d4], 0
jne 0x4da0ea
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5d6], 0
jne 0x4da0ea
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5d5], 0
je 0x4da1bf
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5d9], 0
je 0x4da140
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5e0]
mov ecx, 0xff
call fcn.00403ea8
lea edx, [ebp - 0x298]
mov eax, dword [ebp - 4]
add eax, 4
mov cl, 0x10
call fcn.00402a34
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5e4]
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5e8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
call fcn.004bb300
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5d6], 0
je 0x4da16b
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0x210
mov eax, dword [ebp - 4]
call fcn.004cad6c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5d7], 0
jne 0x4da1b2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5d5], 0
je 0x4da1b2
lea eax, [ebp - 0x29c]
mov edx, dword [ebp - 4]
add edx, 0x58c
call fcn.00403e70
mov edx, dword [ebp - 0x29c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x5c0]
mov eax, dword [0x4ea3dc]
mov eax, dword [eax]
call fcn.0048d448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4da2e9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4da2e1
mov eax, dword [ebp - 4]
call fcn.004c936c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da354
lea eax, [ebp - 0x2e8]
mov edx, 6
call fcn.00403c70
lea eax, [ebp - 0x2a4]
mov edx, 3
call fcn.00403c70
lea eax, [ebp - 0x198]
mov edx, 0x18
call fcn.00403c70
lea eax, [ebp - 0x104]
mov edx, 0x23
call fcn.00403c70
lea eax, [ebp - 0x48]
mov edx, dword [0x45464c]
call fcn.0040455c
lea eax, [ebp - 0x1c]
call fcn.00403c4c
ret