Function at 0x498d90
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x5b1a15
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4d0
mov eax, dword [0x620368]
mov ecx, dword [esp + 0x4e4]
mov edx, dword [esp + 0x4e8]
xor eax, esp
push ebx
mov dword [esp + 0x4d0], eax
mov eax, dword [esp + 0x4e4]
push ebp
push esi
mov dword [esp + 0x5c], eax
mov al, byte [0x628a34]
xor ebx, ebx
or esi, 0xffffffff
test al, 1
push edi
mov dword [esp + 0x68], ecx
mov dword [esp + 0x5c], edx
jne 0x498e3e
or dword [0x628a34], 1
mov ecx, 0x628a28
mov dword [esp + 0x4e8], ebx
call fcn.00411ab0
mov dword [0x628a2c], eax
mov byte [eax + 0x2d], 1
mov eax, dword [0x628a2c]
mov dword [eax + 4], eax
mov eax, dword [0x628a2c]
mov dword [eax], eax
mov eax, dword [0x628a2c]
mov dword [eax + 8], eax
push 0x5ba020
mov dword [0x628a30], ebx
call fcn.0057b37d
add esp, 4
mov dword [esp + 0x4e8], esi
cmp byte [0x628a24], bl
mov edi, 0xf
mov ebp, 0x10
jne 0x49a6af
push 5
push 0x5cc1a4
lea ecx, [esp + 0x3c]
mov byte [0x628a24], 1
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.004041a0
push esi
push ebx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 1
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 0x19
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 2
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x498ed5
mov eax, dword [esp + 0x18]
push eax
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x498efb
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0057ad56
add esp, 4
push 4
push 0x5c1b5c
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.004041a0
push esi
push ebx
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 3
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 1
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x54]
push ecx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 4
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x498f75
mov edx, dword [esp + 0x18]
push edx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x498f9b
mov eax, dword [esp + 0x38]
push eax
call fcn.0057ad56
add esp, 4
push 5
push 0x5cc19c
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.004041a0
push esi
push ebx
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 5
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 1
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x54]
push eax
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 6
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499015
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x49903b
mov edx, dword [esp + 0x38]
push edx
call fcn.0057ad56
add esp, 4
push 5
push 0x5cc194
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.004041a0
push esi
push ebx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 7
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 8
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x4990b5
mov eax, dword [esp + 0x18]
push eax
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x4990db
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0057ad56
add esp, 4
push 4
push 0x5cc18c
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.004041a0
push esi
push ebx
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 9
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 2
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x54]
push ecx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0xa
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499155
mov edx, dword [esp + 0x18]
push edx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x49917b
mov eax, dword [esp + 0x38]
push eax
call fcn.0057ad56
add esp, 4
push 5
push 0x5cc184
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.004041a0
push esi
push ebx
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 0xb
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 2
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x54]
push eax
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0xc
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x4991f5
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x49921b
mov edx, dword [esp + 0x38]
push edx
call fcn.0057ad56
add esp, 4
push 5
push 0x5cc17c
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.004041a0
push esi
push ebx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 0xd
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 2
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0xe
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499295
mov eax, dword [esp + 0x18]
push eax
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x4992bb
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0057ad56
add esp, 4
push 3
push 0x5cc178
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.004041a0
push esi
push ebx
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 3
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x54]
push ecx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x10
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499331
mov edx, dword [esp + 0x18]
push edx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x499357
mov eax, dword [esp + 0x38]
push eax
call fcn.0057ad56
add esp, 4
push 4
push 0x5cc170
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.004041a0
push esi
push ebx
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 0x11
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 3
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x54]
push eax
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x12
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x4993d1
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x4993f7
mov edx, dword [esp + 0x38]
push edx
call fcn.0057ad56
add esp, 4
push 4
push 0x5cc168
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.004041a0
push esi
push ebx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 0x13
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 3
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x14
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499471
mov eax, dword [esp + 0x18]
push eax
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x499497
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0057ad56
add esp, 4
push 4
push 0x5cc160
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.004041a0
push esi
push ebx
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 0x15
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 0x20
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x54]
push ecx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x16
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499511
mov edx, dword [esp + 0x18]
push edx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x499537
mov eax, dword [esp + 0x38]
push eax
call fcn.0057ad56
add esp, 4
push 0x5cc158
lea ecx, [esp + 0x38]
call fcn.00404c90
push esi
push ebx
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 0x17
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 0xb
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x54]
push eax
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x18
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x4995a3
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x4995c9
mov edx, dword [esp + 0x38]
push edx
call fcn.0057ad56
add esp, 4
push 0x5cc148
lea ecx, [esp + 0x38]
call fcn.00404c90
push esi
push ebx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 0x19
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 0xe
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x1a
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499635
mov eax, dword [esp + 0x18]
push eax
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x49965b
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0057ad56
add esp, 4
push 0x5cc138
lea ecx, [esp + 0x38]
call fcn.00404c90
push esi
push ebx
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 0x1b
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x54]
push ecx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x1c
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x4996c3
mov edx, dword [esp + 0x18]
push edx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x4996e9
mov eax, dword [esp + 0x38]
push eax
call fcn.0057ad56
add esp, 4
push 0x5cc128
lea ecx, [esp + 0x38]
call fcn.00404c90
push esi
push ebx
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 0x1d
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], ebp
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x54]
push eax
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x1e
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499751
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x499777
mov edx, dword [esp + 0x38]
push edx
call fcn.0057ad56
add esp, 4
push 0x5cc118
lea ecx, [esp + 0x38]
call fcn.00404c90
push esi
push ebx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 0x1f
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 0xd
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x20
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x4997e3
mov eax, dword [esp + 0x18]
push eax
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x499809
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0057ad56
add esp, 4
push 0x5cc108
lea ecx, [esp + 0x38]
call fcn.00404c90
push esi
push ebx
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 0x21
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 0xd
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x54]
push ecx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x22
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499875
mov edx, dword [esp + 0x18]
push edx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x49989b
mov eax, dword [esp + 0x38]
push eax
call fcn.0057ad56
add esp, 4
push 0x5cc0f8
lea ecx, [esp + 0x38]
call fcn.00404c90
push esi
push ebx
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 0x23
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 0xd
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x54]
push eax
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x24
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499907
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x49992d
mov edx, dword [esp + 0x38]
push edx
call fcn.0057ad56
add esp, 4
push 0x5cc0e8
lea ecx, [esp + 0x38]
call fcn.00404c90
push esi
push ebx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 0x25
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 5
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x26
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499999
mov eax, dword [esp + 0x18]
push eax
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x4999bf
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0057ad56
add esp, 4
push 0x5cc0d8
lea ecx, [esp + 0x38]
call fcn.00404c90
push esi
push ebx
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 0x27
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 5
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x54]
push ecx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x28
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499a2b
mov edx, dword [esp + 0x18]
push edx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x499a51
mov eax, dword [esp + 0x38]
push eax
call fcn.0057ad56
add esp, 4
push 0x5cc0c8
lea ecx, [esp + 0x38]
call fcn.00404c90
push esi
push ebx
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x4f4], 0x29
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403eb0
mov dword [esp + 0x30], 5
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x54]
push eax
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x2a
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499abd
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x499ae3
mov edx, dword [esp + 0x38]
push edx
call fcn.0057ad56
add esp, 4
push 0x5cc0b8
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 5
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x2b
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x2c
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499b42
mov eax, dword [esp + 0x18]
push eax
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x499b68
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0057ad56
add esp, 4
push 0x5cc0ac
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0xb
call fcn.00404c90
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x2d
call fcn.00443d80
push eax
lea ecx, [esp + 0x54]
push ecx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x2e
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499bc7
mov edx, dword [esp + 0x18]
push edx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x499bed
mov eax, dword [esp + 0x38]
push eax
call fcn.0057ad56
add esp, 4
push 0x5cc0a0
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0xb
call fcn.00404c90
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x2f
call fcn.00443d80
push eax
lea eax, [esp + 0x54]
push eax
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x30
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499c4c
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x499c72
mov edx, dword [esp + 0x38]
push edx
call fcn.0057ad56
add esp, 4
push 0x5cc094
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0xb
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x31
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x32
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499cd1
mov eax, dword [esp + 0x18]
push eax
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x499cf7
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0057ad56
add esp, 4
push 0x5cc084
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 6
call fcn.00404c90
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x33
call fcn.00443d80
push eax
lea ecx, [esp + 0x54]
push ecx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x34
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499d56
mov edx, dword [esp + 0x18]
push edx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x499d7c
mov eax, dword [esp + 0x38]
push eax
call fcn.0057ad56
add esp, 4
push 0x5cc070
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 6
call fcn.00404c90
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x35
call fcn.00443d80
push eax
lea eax, [esp + 0x54]
push eax
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x36
call fcn.00447280
cmp dword [esp + 0x2c], ebp
jb 0x499ddb
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0057ad56
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x4e8], esi
jb 0x499e01
mov edx, dword [esp + 0x38]
push edx
call fcn.0057ad56
add esp, 4
push 0x5cc060
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 7
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x37
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x38
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cc050
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 7
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x39
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x3a
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cc044
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 8
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x3b
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x3c
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cc034
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 8
call fcn.00404c90
lea eax, [esp + 0x10]
mov dword [esp + 0x4e8], 0x3d
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x3e
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cc028
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0xc
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x3f
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x40
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cc01c
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0xc
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x41
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x42
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cc010
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0xc
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x43
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
mov byte [esp + 0x4ec], 0x44
push edx
mov ecx, 0x628a28
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cc000
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 9
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x45
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x46
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cbff0
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 9
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x47
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x48
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cbfe0
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0xa
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x49
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x4a
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
mov dword [esp + 0x10], 0xa
push 0x5cbfd0
lea ecx, [esp + 0x38]
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x4b
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x4c
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cbfc8
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0x21
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x4d
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x4e
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cbfbc
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0x22
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x4f
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x50
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cbfb0
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0x23
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x51
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x52
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cbfa4
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0x24
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x53
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x54
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cbf98
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0x25
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x55
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x56
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cbf8c
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0x26
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x57
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x58
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cbf84
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0xab
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x59
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x5a
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cbf7c
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0xac
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x5b
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x5c
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cbf74
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0xad
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x5d
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x5e
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cbf6c
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0xae
call fcn.00404c90
mov dword [esp + 0x4e8], 0x5f
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x60
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
push 0x5cbf64
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0xaf
call fcn.00404c90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4f0], 0x61
call fcn.00443d80
push eax
lea edx, [esp + 0x54]
push edx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x62
call fcn.00447280
lea ecx, [esp + 0x14]
call fcn.00507820
lea ecx, [esp + 0x34]
mov dword [esp + 0x4e8], esi
call fcn.00507820
lea ecx, [esp + 0xa0]
call fcn.004fbea0
mov ecx, dword [esp + 0x5c]
lea eax, [esp + 0x6c]
push eax
push ecx
mov ecx, dword [0x62448c]
lea edx, [esp + 0xa8]
push edx
mov dword [esp + 0x4f4], 0x63
call fcn.0053daa0
test al, al
jne 0x49a701
lea ecx, [esp + 0xa0]
mov dword [esp + 0x4e8], esi
call fcn.004fc200
xor al, al
jmp 0x49a9d2
lea ecx, [esp + 0x8c]
call fcn.004fb880
mov eax, dword [esp + 0x6c]
push eax
lea ecx, [esp + 0xa4]
mov byte [esp + 0x4ec], 0x64
call fcn.004fc080
push eax
lea ecx, [esp + 0x94]
call fcn.004fbd70
mov ecx, dword [esp + 0x60]
push 1
call fcn.0049f020
test byte [0x628a34], 2
mov dword [esp + 0x64], ebx
mov byte [esp + 0x5b], bl
jne 0x49a77d
mov edx, dword [0x628a34]
or edx, 2
push 0x5b9fc0
mov dword [0x628a34], edx
mov dword [0x628a20], edi
mov dword [0x628a1c], ebx
mov byte [0x628a0c], bl
call fcn.0057b37d
add esp, 4
test byte [0x628a34], 4
jne 0x49a7b4
mov edx, dword [0x628a34]
or edx, 4
push 0x5b9f90
mov dword [0x628a34], edx
mov dword [0x628a04], edi
mov dword [0x628a00], ebx
mov byte [0x6289f0], bl
call fcn.0057b37d
add esp, 4
push ebx
push 0x5bb9c6
mov ecx, 0x628a08
call fcn.004041a0
push ebx
push 0x5bb9c6
mov ecx, 0x6289ec
call fcn.004041a0
lea ecx, [esp + 0x8c]
call fcn.004fb840
cmp eax, ebx
mov dword [esp + 0x50], eax
mov dword [esp + 0x10], ebx
jbe 0x49a961
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x90]
call fcn.004fb870
cmp dword [eax + 0x18], ebp
jb 0x49a80b
mov eax, dword [eax + 4]
jmp 0x49a80e
add eax, 4
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0x1e0]
push ecx
lea edx, [esp + 0x2e4]
push edx
lea ecx, [esp + 0x3e8]
push ecx
push 0x5cbf58
push eax
call fcn.0057cdba
add esp, 0x18
lea edx, [esp + 0x2dc]
push edx
lea ecx, [esp + 0x74]
call fcn.00404c90
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x60]
push ecx
mov ecx, 0x628a28
mov byte [esp + 0x4f0], 0x65
call fcn.004ef660
cmp dword [esp + 0x88], ebp
mov byte [esp + 0x4e8], 0x64
jb 0x49a884
mov edx, dword [esp + 0x74]
push edx
call fcn.0057ad56
add esp, 4
mov eax, dword [0x628a2c]
cmp eax, dword [esp + 0x5c]
mov dword [esp + 0x88], edi
mov dword [esp + 0x84], ebx
mov byte [esp + 0x74], bl
je 0x49a946
mov eax, dword [esp + 0x68]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x49a8b0
mov ecx, dword [esp + 0x68]
sub eax, edx
push eax
push ecx
mov ecx, 0x6289ec
call fcn.004041a0
lea eax, [esp + 0x1dc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x49a8d3
sub eax, edx
push eax
lea edx, [esp + 0x1e0]
push edx
mov ecx, 0x6289ec
call fcn.00403fc0
cmp dword [0x628a04], ebp
mov eax, dword [0x6289f0]
jae 0x49a901
mov eax, 0x6289f0
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x64]
push eax
xor eax, eax
mov ax, word [edx + 0x28]
push eax
push 1
call fcn.0049e470
mov ecx, dword [esp + 0x5c]
mov eax, dword [ecx + 0x28]
cmp eax, 5
je 0x49a935
cmp eax, 0x19
jne 0x49a946
mov byte [esp + 0x5b], 1
jmp 0x49a946
push esi
push ebx
push 0x6289ec
mov ecx, 0x628a08
call fcn.00403eb0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x50]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jb 0x49a7f0
cmp byte [esp + 0x5b], bl
jne 0x49a99c
push 0x5bb9c6
push 0x628a08
call fcn.00498100
add esp, 8
test al, al
je 0x49a99c
cmp dword [0x628a20], ebp
mov eax, dword [0x628a0c]
jae 0x49a989
mov eax, 0x628a0c
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
push edx
push eax
push 0x19
push 1
call fcn.0049e470
mov ecx, dword [esp + 0x60]
push 0xd
push 1
call fcn.0049c6a0
lea ecx, [esp + 0x8c]
mov byte [esp + 0x4e8], 0x63
call fcn.004fb8a0
lea ecx, [esp + 0xa0]
mov dword [esp + 0x4e8], esi
call fcn.004fc200
mov al, 1
mov ecx, dword [esp + 0x4e0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x4d0]
pop ebx
xor ecx, esp
call fcn.0057b3d4
add esp, 0x4dc
ret 0xc