Function at 0x4351c0
Capabilities:
Encode data using xor
Inspect section memory permissions
Log keystrokes via polling

Disassembly:
sub esp, 0x1ac
cmp dword [0x728398], 3
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x1b], 0
jne 0x4351e5
mov ebx, dword [0x72ed74]
push 2
call fcn.004e5cc0
mov eax, dword [0x86e574]
mov ecx, dword [0x86e578]
push eax
push ecx
call fcn.004a89d0
mov edx, dword [0x727524]
mov eax, dword [0x727520]
imul edx, edx, 0x3e8
mov ecx, dword [0x72ed78]
imul eax, eax, 0x3e8
add esp, 8
push edx
push eax
push ecx
call fcn.004e91f0
mov eax, dword [0x8cc984]
mov ecx, dword [eax + 0x4c58]
test ecx, ecx
mov dl, byte [0x727538]
je 0x435242
test dl, dl
jne 0x43523e
or byte [ecx + 0x20], 1
jmp 0x435242
and byte [ecx + 0x20], 0xfe
test dl, dl
sete dl
mov byte [eax + 9], dl
mov eax, dword [0x8cc974]
test eax, eax
mov edi, 0x40
je 0x435300
push eax
push str._NUM
mov esi, 0x8ebf58
call fcn.004f7660
mov eax, dword [0x8cc974]
add esp, 8
test eax, eax
jle 0x4352af
mov al, byte [0x8cc981]
test al, al
je 0x4352a3
push str.You_have_reached_the_forts_gates_
call fcn.004f7660
mov eax, dword [0x86e580]
mov ecx, dword [0x86e57c]
mov dword [0x85c128], eax
mov dword [0x85c124], ecx
jmp 0x4352cf
push str.The_broken_defenders_scatter_and_run_
call fcn.004f7660
jmp 0x4352cf
push str.The_remnants_of_your_crew_withdraw_from_the_battle.
call fcn.004f7660
mov edx, dword [0x870a5c]
mov eax, dword [0x870a8c]
mov dword [0x85c128], edx
mov dword [0x85c124], eax
mov eax, dword [0x85c164]
mov ecx, dword [0x85c11c]
or eax, edi
add esp, 4
mov dword [0x85c164], eax
mov eax, dword [0x85c268]
push 0
push 0xffffffffffffffff
cdq
push 4
sub eax, edx
push 0xffffffffffffffff
sar eax, 1
push ecx
sub eax, 8
push eax
jmp 0x4353b3
mov eax, dword [0x8cc960]
test eax, eax
je 0x43533e
mov al, byte [0x8cc958]
test al, al
je 0x435319
mov eax, 5
jmp 0x435329
mov edx, dword [0x86e5d4]
shl edx, 5
movsx eax, byte [edx + 0x862b74]
push eax
push str._NATIONALITY_Turn
mov esi, 0x8ebf58
call fcn.004f7660
add esp, 8
jmp 0x435350
push str.Pirate_Turn
mov esi, 0x8ebf58
call fcn.004f7660
add esp, 4
mov eax, dword [0x8cc97c]
test eax, eax
jne 0x4353cd
mov ecx, dword [0x85c26c]
mov eax, 0x55555556
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x18
jle 0x435384
push 0xa
push ecx
mov eax, 0x18
call fcn.00488110
add esp, 8
jmp 0x4353a3
push 0
push 0x80000000
push 0x18
push ecx
push 0xa
push ecx
push 0
push 0
push 0
push 0
push 0
call fcn.004af500
add esp, 0x2c
mov eax, dword [0x85c11c]
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push eax
push 0xc
mov eax, dword [0x85c26c]
cdq
sub eax, edx
sar eax, 1
push eax
xor eax, eax
push 0x86bb48
call fcn.004b0b40
add esp, 0x20
mov dword [esp + 0x28], 0
jmp 0x4353e0
mov eax, dword [esp + 0x28]
shl eax, 4
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
lea eax, [ecx + edx]
mov dword [esp + 0x38], eax
imul eax, eax, 0x14c
cmp word [eax + 0x8709ea], 0
mov dword [esp + 0x10], eax
je 0x435ca8
mov eax, dword [esp + 0x28]
test eax, eax
mov ebx, dword [esp + 0x10]
je 0x43547b
test byte [ebx + 0x870a08], 2
jne 0x435456
cmp word [ebx + 0x8709f0], 0
je 0x43547b
call dword [sym.imp.MSVCR71.dll_rand]
and eax, 0x80000001
jns 0x43544b
dec eax
or eax, 0xfffffffe
inc eax
je 0x43547b
dec word [ebx + 0x8709f0]
jmp 0x43547b
cmp word [ebx + 0x8709f0], 0xc
jge 0x43547b
call dword [sym.imp.MSVCR71.dll_rand]
and eax, 0x80000001
jns 0x435472
dec eax
or eax, 0xfffffffe
inc eax
je 0x43547b
inc word [ebx + 0x8709f0]
test byte [0x85c164], 0x20
je 0x435521
mov eax, dword [esp + 0x30]
push eax
push str._NUM
mov esi, 0x8ebf58
call fcn.004f7660
mov ecx, dword [ebx + 0x870a08]
add esp, 8
test cl, 0x20
je 0x4354c2
mov edi, 0x86bb48
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4354b0
mov dx, word [0x700d10]
mov word [edi], dx
test cl, 0x10
je 0x4354e1
mov edi, 0x86bb48
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4354d0
mov ax, word [0x7011f0]
mov word [edi], ax
mov ecx, dword [ebx + 0x870a18]
mov edx, dword [ebx + 0x870a8c]
mov eax, dword [ebx + 0x870a5c]
push 0
push 0xc
push 0x3e8
push 0x40000000
push 0xc0000000
push 0
add ecx, 0x190
push ecx
push edx
push eax
or eax, 0xffffffff
mov ecx, 0x86bb48
call fcn.004af0b0
add esp, 0x24
mov eax, dword [esp + 0x38]
imul eax, eax, 0x53
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
lea esi, [ecx + edx]
shl esi, 2
mov ecx, dword [esi + 0x870a5c]
test ecx, ecx
je 0x435c96
mov eax, dword [esp + 0x28]
test eax, eax
mov ebx, dword [esp + 0x10]
je 0x435598
movsx edx, word [ebx + 0x8709f0]
mov eax, dword [esp + 0x3c]
cmp eax, edx
jl 0x435598
mov edx, dword [esp + 0x38]
imul edx, edx, 0xa6
add edx, eax
mov ax, word [edx*2 + 0x870aec]
cmp ax, 0x77
je 0x435598
cmp ax, 0x70
je 0x435598
test byte [0x85c164], 0x20
je 0x435c96
mov eax, dword [esi + 0x870a8c]
mov edi, dword [0x72ed78]
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
push 0
sub esp, 8
mov dword [esp + 0x28], ecx
fstp dword [esp + 4]
mov al, 1
fild dword [esp + 0x28]
fstp dword [esp]
call fcn.004e8db0
call fcn.005f275c
mov ecx, dword [esp + 0x3c]
test ecx, ecx
mov dword [esp + 0x1c], eax
jne 0x4355de
mov dword [ebx + 0x870a18], eax
mov edi, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
imul edi, edi, 0xa6
lea eax, [edi + ecx]
shl eax, 1
mov dword [esp + 0x24], eax
movsx eax, word [eax + 0x870aec]
movsx ebp, ax
cmp ebp, 0x64
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], ebp
jne 0x435643
mov ax, word [ebx + 0x8709e8]
movsx edx, ax
imul edx, edx, 7
cmp byte [edx + 0x727418], 5
jge 0x435634
cmp word [ebx + 0x8709ec], bp
jge 0x435634
test byte [ebx + 0x870a08], 0x40
je 0x435643
cmp ax, 4
je 0x435643
mov ebp, 0x65
mov dword [esp + 0x2c], ebp
mov eax, dword [0x727520]
mov ecx, dword [ebx + 0x870a5c]
imul eax, eax, 0x3e8
sub ecx, eax
add ecx, 0x2134
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
and eax, 0x8000000f
jns 0x43567b
dec eax
or eax, 0xfffffff0
inc eax
mov edx, dword [0x727524]
mov ecx, dword [ebx + 0x870a8c]
imul edx, edx, 0x3e8
shl eax, 4
mov dword [esp + 0x20], eax
sub ecx, edx
add ecx, 0x2134
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
and eax, 0x8000000f
jns 0x4356b9
dec eax
or eax, 0xfffffff0
inc eax
mov ecx, dword [esp + 0x20]
cmp byte [ecx + eax + 0x873978], 1
jne 0x4356f6
mov ax, word [ebx + 0x8709e8]
cmp ax, 4
je 0x4356f6
cmp ax, 3
je 0x4356f6
cmp ebp, 0x64
je 0x4356ee
cmp ebp, 0x6e
jne 0x4356f6
mov dword [esp + 0x2c], 0xd2
jmp 0x4356f6
mov dword [esp + 0x2c], 0xc8
cmp word [ebx + 0x8709e8], 3
jne 0x435710
cmp word [esp + 0x14], 0x64
jne 0x435710
mov dword [esp + 0x2c], 0x65
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x435876
cmp word [edi*2 + 0x870aec], 0x77
je 0x435876
mov ecx, dword [esp + 0x10]
mov cx, word [ecx + 0x8709ec]
cmp cx, 0x64
jge 0x435876
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x870a08]
test ah, 0x10
mov ebx, dword [esp + 0x30]
je 0x43575d
mov dword [esp + 0x20], 0
jmp 0x43576e
mov eax, dword [0x8cc96c]
lea eax, [eax + ebx*2]
add eax, ebx
imul eax, eax, 0x1e
mov dword [esp + 0x20], eax
mov edi, dword [esp + 0x28]
test edi, edi
mov ebp, dword [0x8cc95c]
jne 0x435787
cmp ebx, ebp
jne 0x435787
mov edx, 0x46
jmp 0x43579e
movsx eax, cx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov edx, 0x32
sub edx, eax
test edi, edi
jne 0x4357a9
cmp ebx, ebp
jne 0x4357a9
mov ebx, 0x190
jmp 0x4357b6
movsx ecx, cx
shl ecx, 2
mov ebx, 0xfa
sub ebx, ecx
mov eax, dword [esp + 0x40]
mov edi, dword [eax*4 + 0x870a8c]
mov ebp, dword [eax*4 + 0x870a5c]
push 0
push 0
push 0x3fc90fdb
lea eax, [esp + 0x60]
call fcn.004dc670
mov eax, dword [esp + 0x2c]
add esp, 0xc
push eax
push 0xffffffffffffffff
push edx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x60]
push ecx
mov ecx, dword [0x86e374]
sub edx, ebx
push edx
push edi
push ebp
call fcn.004bc350
mov ebp, eax
mov eax, dword [esp + 0x28]
test eax, eax
je 0x435819
mov eax, dword [0x86e5d4]
shl eax, 5
movsx ebx, byte [eax + 0x862b74]
jmp 0x43581e
mov ebx, 4
mov ecx, dword [esp + 0x10]
movsx ecx, word [ecx + 0x8709ec]
mov eax, 0x51eb851f
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, 3
sub edi, eax
jns 0x435847
xor edi, edi
jmp 0x435851
cmp edi, 3
jle 0x435851
mov edi, 3
mov ecx, dword [ebp + 0xbc]
test ecx, ecx
mov ebx, dword [ebx*4 + 0x727694]
je 0x435869
push edi
push ebx
call fcn.004bd020
mov eax, dword [ebp + 0x1c]
push edi
push ebx
call fcn.004c0090
add esp, 8
mov ecx, dword [esp + 0x10]
mov bx, word [ecx + 0x8709e8]
xor ebp, ebp
test bx, bx
je 0x43588e
cmp bx, 1
jne 0x4358a5
mov edi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
lea eax, [edi + ecx]
cdq
mov ebp, 3
idiv ebp
mov ebp, edx
jmp 0x4358ad
mov edi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x4358d8
mov edx, ecx
imul edx, edx, 0x14c
cmp word [edx + 0x8709e8], 9
jne 0x4358d8
mov al, byte [esp + 0x1b]
test al, al
jne 0x4358d8
xor ebp, ebp
mov byte [esp + 0x1b], 1
jmp 0x4358ef
cmp bx, 9
jne 0x4358ef
lea ebp, [edi + ecx]
and ebp, 0x80000003
jns 0x4358ee
dec ebp
or ebp, 0xfffffffc
inc ebp
inc ebp
mov ecx, dword [esi + 0x870a2c]
lea eax, [ecx + ecx*4]
cdq
sub eax, edx
mov edx, eax
sar edx, 1
mov eax, 0x64
sub eax, edx
mov edx, 0
sets dl
dec edx
and eax, edx
test ecx, ecx
mov dword [esp + 0x20], eax
je 0x435b65
test eax, eax
jle 0x435a26
mov eax, dword [esp + 0x38]
lea eax, [eax + eax*2]
lea edi, [edi + eax*4]
mov eax, dword [edi*4 + 0x8de320]
inc ecx
test eax, eax
mov dword [esi + 0x870a2c], ecx
jne 0x43598a
mov ecx, dword [esp + 0x10]
movsx eax, word [ecx + 0x8709e8]
lea edx, [ebp + eax*4]
add edx, eax
mov ecx, dword [edx*4 + 0x86e390]
push 0
call fcn.004bbbd0
mov ecx, dword [edi*4 + 0x8de320]
mov ebx, eax
cmp ecx, ebx
je 0x43598a
test ecx, ecx
je 0x43597c
dec dword [ecx + 4]
jne 0x43597c
mov eax, dword [ecx]
push 1
call dword [eax]
test ebx, ebx
mov dword [edi*4 + 0x8de320], ebx
je 0x43598a
inc dword [ebx + 4]
mov ecx, dword [esp + 0x20]
push 0
push ecx
mov ecx, dword [edi*4 + 0x8de320]
call fcn.004c28d0
mov edx, dword [esi + 0x870abc]
sub edx, 0x80000000
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
push 0
push 0
fmul qword [0x715728]
push ecx
lea eax, [esp + 0x1a4]
fstp dword [esp]
call fcn.004dc670
mov eax, dword [esp + 0x30]
movsx ecx, word [eax + 0x870b04]
mov eax, dword [esp + 0x1c]
add esp, 0xc
push ecx
movsx ecx, word [eax + 0x8709e8]
mov edx, dword [esp + 0x30]
imul ecx, ecx, 7
movsx eax, byte [ecx + 0x72741e]
mov ebx, dword [esp + 0x20]
imul eax, eax, 0x64
mov ecx, dword [esi + 0x870a5c]
push edx
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esi + 0x870a8c]
lea edx, [esp + 0x1a4]
push edx
push ebx
push eax
push ecx
mov ecx, dword [edi*4 + 0x8de320]
call fcn.004bc350
jmp 0x435a67
test ecx, ecx
je 0x435b65
test eax, eax
jg 0x435b65
mov eax, dword [esp + 0x38]
lea edx, [eax + eax*2]
lea edi, [edi + edx*4]
mov ecx, dword [edi*4 + 0x8de320]
test ecx, ecx
lea edi, [edi*4 + 0x8de320]
je 0x435a63
dec dword [ecx + 4]
jne 0x435a5d
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi], 0
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
cmp word [ebp + 0x870aec], 0x77
je 0x435ad6
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x435ad6
mov ecx, dword [esi + 0x870abc]
sub ecx, 0x80000000
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
push 0
push 0
fmul qword [0x715728]
push ecx
lea eax, [esp + 0xf0]
fstp dword [esp]
call fcn.004dc670
mov ecx, dword [esi + 0x870a5c]
add esp, 0xc
push 0
push 0xffffffffffffffff
push 0xc8
mov edx, eax
mov eax, dword [esi + 0x870a8c]
push edx
push ebx
add eax, 0x1e
push eax
push ecx
mov ecx, 0x8ce3d8
call fcn.004bc350
cmp word [ebp + 0x870aec], 0x70
jne 0x435c96
mov edx, dword [esp + 0x10]
mov ax, word [edx + 0x8709e8]
movsx ecx, ax
imul ecx, ecx, 7
mov dl, byte [ecx + 0x72741b]
test dl, dl
je 0x435c96
cmp ax, 5
je 0x435c96
cmp ax, 8
mov edi, dword [esi + 0x870abc]
mov dword [esp + 0x1c], edi
fild dword [esp + 0x1c]
push 0
push 0
push ecx
fmul qword [0x715728]
fstp dword [esp]
jne 0x435bf1
lea eax, [esp + 0x180]
call fcn.004dc670
movsx edx, word [ebp + 0x870b04]
add esp, 0xc
lea eax, [edx + edx - 0x4d8]
push eax
push 0xffffffffffffffff
push 0x96
lea ecx, [esp + 0x180]
push ecx
jmp 0x435c18
mov ecx, dword [esi + 0x870abc]
sub ecx, 0x80000000
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
push 0
push 0
fmul qword [0x715728]
push ecx
lea eax, [esp + 0xa8]
fstp dword [esp]
call fcn.004dc670
mov edx, dword [esp + 0x30]
movsx eax, word [edx + 0x870b04]
add esp, 0xc
push eax
movsx ecx, bx
mov edx, dword [esp + 0x30]
mov eax, ecx
imul eax, eax, 7
movsx eax, byte [eax + 0x72741e]
mov ebx, dword [esp + 0x20]
imul eax, eax, 0x64
push edx
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esi + 0x870a8c]
lea edx, [esp + 0xa8]
push edx
mov edx, dword [esi + 0x870a5c]
push ebx
push eax
lea eax, [ebp + ecx*4]
add eax, ecx
mov ecx, dword [eax*4 + 0x86e390]
push edx
call fcn.004bc350
jmp 0x435a67
cmp ax, 4
je 0x435c3d
lea eax, [esp + 0x138]
call fcn.004dc670
movsx edx, word [ebp + 0x870b04]
add esp, 0xc
shl edx, 1
push edx
push 0xffffffffffffffff
push 0x96
push eax
add ebx, 0xbb
push ebx
lea ecx, [edi + 0x40000000]
mov eax, 0x4b
call fcn.004dcac0
add eax, dword [esi + 0x870a8c]
push eax
mov eax, 0x4b
jmp 0x435c7e
lea eax, [esp + 0xcc]
call fcn.004dc670
movsx ecx, word [ebp + 0x870b04]
add esp, 0xc
push ecx
push 0xffffffffffffffff
mov edx, eax
push 0x12c
push edx
add ebx, 0x7d
push ebx
lea ecx, [edi + 0x40000000]
mov eax, 0x96
call fcn.004dcac0
add eax, dword [esi + 0x870a8c]
push eax
mov eax, 0x96
mov ecx, edi
call fcn.004dcac0
add eax, dword [esi + 0x870a5c]
mov ecx, 0x8cee58
push eax
call fcn.004bc350
mov eax, dword [esp + 0x3c]
inc eax
cmp eax, 0xc
mov dword [esp + 0x3c], eax
jl 0x435534
mov eax, dword [esp + 0x30]
inc eax
cmp eax, 0x10
mov dword [esp + 0x30], eax
jl 0x4353f3
mov eax, dword [esp + 0x28]
inc eax
cmp eax, 2
mov dword [esp + 0x28], eax
jl 0x4353e0
xor ebp, ebp
xor ebx, ebx
mov eax, dword [ebx*4 + 0x8701e0]
cmp eax, ebp
je 0x435f03
cmp dword [ebx*4 + 0x86f1e0], ebp
jne 0x435d34
mov ecx, dword [ebx*4 + 0x86f9e0]
mov edi, dword [0x72ed78]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
push 1
sub esp, 8
mov dword [esp + 0x40], eax
fstp dword [esp + 4]
fild dword [esp + 0x40]
mov al, 1
fstp dword [esp]
call fcn.004e8db0
call fcn.005f275c
cmp eax, ebp
mov dword [ebx*4 + 0x86f1e0], eax
jne 0x435d34
mov dword [ebx*4 + 0x8701e0], ebp
jmp 0x435f03
cmp dword [ebx*4 + 0x86e9e0], 1
jne 0x435dd9
mov edx, dword [ebx*4 + 0x86f9e0]
mov esi, dword [ebx*4 + 0x8701e0]
push ebp
call fcn.00432680
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
xor edx, edx
add esp, 4
cmp eax, 2
setle dl
dec edx
and eax, edx
cmp eax, 0x19
jg 0x435d86
cmp eax, ebp
jge 0x435d8d
xor edx, edx
jmp 0x435d8f
mov edx, 0x19
jmp 0x435d8f
mov edx, eax
push ebp
push ebp
push 0x3f490fdb
lea eax, [esp + 0x60]
call fcn.004dc670
mov ecx, dword [ebx*4 + 0x86f1e0]
add esp, 0xc
push ebp
push 0xffffffffffffffff
push 0x57
push eax
mov eax, dword [ebx*4 + 0x86f9e0]
push ecx
mov ecx, dword [ebx*4 + 0x8701e0]
push eax
movzx eax, word [ebx*2 + 0x86e5e0]
imul eax, eax, 0x1a
add eax, edx
push ecx
mov ecx, dword [eax*4 + 0x873368]
call fcn.004bc350
cmp dword [ebx*4 + 0x86e9e0], 2
jne 0x435e96
mov esi, ebx
and esi, 3
mov ecx, esi
shl ecx, 0x1e
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
push ebp
push ebp
fmul qword [0x715728]
push ecx
lea eax, [esp + 0x114]
fstp dword [esp]
call fcn.004dc670
mov ecx, dword [ebx*4 + 0x86f9e0]
add esp, 0xc
push ebp
push 0xffffffffffffffff
push 0x32
mov edx, eax
mov eax, dword [ebx*4 + 0x86f1e0]
push edx
mov edx, dword [ebx*4 + 0x8701e0]
push eax
push ecx
mov ecx, dword [0x86e384]
add edx, 0xfa
push edx
call fcn.004bc350
neg esi
shl esi, 0x1e
mov dword [esp + 0x14], esi
fild dword [esp + 0x14]
push ebp
push ebp
fmul qword [0x715728]
push ecx
lea eax, [esp + 0x15c]
fstp dword [esp]
call fcn.004dc670
mov ecx, dword [ebx*4 + 0x86f1e0]
mov edx, dword [ebx*4 + 0x86f9e0]
add esp, 0xc
push ebp
push 0xffffffffffffffff
push 0x32
push eax
mov eax, dword [ebx*4 + 0x8701e0]
push ecx
mov ecx, dword [0x86e388]
push edx
push eax
call fcn.004bc350
mov esi, dword [ebx*4 + 0x8701e0]
cmp esi, dword [0x727528]
jne 0x435f03
mov edx, dword [ebx*4 + 0x86f9e0]
cmp edx, dword [0x72752c]
jne 0x435f03
mov ecx, ebx
and ecx, 3
shl ecx, 0x1e
add ecx, 0x20000000
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
push ebp
push ebp
fmul qword [0x715728]
push ecx
lea eax, [esp + 0x84]
fstp dword [esp]
call fcn.004dc670
mov ecx, dword [ebx*4 + 0x86f1e0]
add esp, 0xc
push ebp
push 0xffffffffffffffff
push 0x78
push eax
add ecx, 0xa
push ecx
mov ecx, dword [0x86e380]
push edx
push esi
call fcn.004bc350
inc ebx
cmp ebx, 0x200
jl 0x435cd0
push 0
push 0
push 0x40060a92
lea eax, [esp + 0x84]
call fcn.004dc670
mov ecx, dword [0x86e5d8]
mov edx, eax
mov eax, dword [0x72752c]
add esp, 0xc
imul eax, eax, 0x3e8
push 0
push 0xffffffffffffffff
push 0x15e
push edx
lea edx, [eax + ecx + 0x14e]
mov eax, dword [0x727528]
mov ecx, dword [0x86e380]
inc eax
imul eax, eax, 0x3e8
push 0
push edx
add eax, dword [0x86e5dc]
push eax
call fcn.004bc350
mov ebp, dword [0x8cc95c]
cmp ebp, 0xffffffff
je 0x436584
mov eax, dword [0x8cc974]
test eax, eax
jne 0x436584
mov dword [esp + 0x34], ebp
imul ebp, ebp, 0x14c
lea ecx, [esp + 0x38]
fild dword [ebp + 0x870a5c]
push ecx
mov ecx, dword [0x8ebfd8]
lea edx, [esp + 0x18]
fstp dword [esp + 0x4c]
push edx
fild dword [ebp + 0x870a8c]
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x28], ebp
fstp dword [esp + 0x58]
fild dword [ebp + 0x870a18]
fstp dword [esp + 0x5c]
call fcn.00537240
fld dword [0x70deb0]
mov byte [esp + 0x1b], al
fsub dword [esp + 0x38]
fstp dword [esp + 0x38]
fild dword [0x72837c]
fmul dword [esp + 0x14]
call fcn.005f275c
mov ebx, eax
mov al, byte [esp + 0x1b]
test al, al
je 0x43655d
fild dword [0x728380]
fmul dword [esp + 0x38]
call fcn.005f275c
movsx edx, word [ebp + 0x8709ea]
imul edx, dword [0x86e36c]
movsx ecx, word [ebp + 0x8709e8]
push ecx
push edx
mov edi, eax
push str._NUM__LAND_PARTY
mov esi, 0x8ebf58
add edi, 8
call fcn.004f7660
add esp, 0xc
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0x50
lea eax, [edi - 0x40]
push eax
push ebx
push 0x86bb48
xor eax, eax
mov dword [0x85c11c], 0x50
call fcn.004b0b40
movsx ecx, word [ebp + 0x8709ec]
mov eax, 0x51eb851f
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 0x20
cmp eax, 3
ja case.default.0x436080
jmp dword [eax*4 + 0x436a08]
push 0x6f7896
jmp 0x4360a8
push str.Angry_
jmp 0x4360a8
push str.Wavering_
jmp 0x4360a8
push str.Panicked_
jmp 0x4360a8
push str.Routed_
mov esi, 0x8ebf58
call fcn.004f7660
mov ecx, dword [0x8cc960]
mov edx, dword [0x8cc95c]
shl ecx, 4
add ecx, edx
imul ecx, ecx, 0x14c
mov ax, word [ecx + 0x870a04]
add esp, 4
cmp ax, 1
jle 0x4360ec
movsx edx, ax
push edx
push str._NUM_moves
call fcn.004f7680
add esp, 8
jmp 0x4360f9
push str.1_move
call fcn.004f7680
add esp, 4
mov eax, dword [0x8cc960]
xor esi, esi
cmp eax, esi
mov dword [0x85c11c], 0x43
jne 0x436133
cmp dword [0x8cc974], esi
jne 0x436133
push esi
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0x43
add edi, 0xffffffce
push edi
push ebx
push 0x86bb48
xor eax, eax
call fcn.004b0b40
add esp, 0x20
mov dword [esp + 0x10], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], esi
mov byte [esp + 0x40], 3
mov byte [esp + 0x41], 0
mov byte [esp + 0x42], 1
mov byte [esp + 0x43], 2
mov byte [esp + 0x44], 5
mov byte [esp + 0x45], 8
mov byte [esp + 0x46], 7
mov byte [esp + 0x47], 6
jmp 0x436170
mov ecx, dword [esp + 0x1c]
movsx ebx, word [ecx + 0x8709fa]
mov eax, dword [esp + 0x24]
movsx ebp, word [ecx + 0x8709f8]
mov esi, dword [eax*4 + 0x727350]
mov cl, byte [esp + eax + 0x40]
mov edi, dword [eax*4 + 0x7272f0]
add ebx, esi
mov esi, 1
shl esi, cl
mov ecx, dword [esp + 0x2c]
add ebp, edi
push ebx
or ecx, esi
push ebp
xor edi, edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], ecx
call fcn.00431db0
add esp, 8
cmp eax, 0xffffffff
je 0x4361d7
mov ecx, dword [esp + 0x24]
mov cl, byte [esp + ecx + 0x40]
mov eax, 1
shl eax, cl
or dword [esp + 0x10], eax
jmp 0x436244
push ebx
push ebp
mov edi, 1
call fcn.00431db0
add esp, 8
cmp eax, 0xffffffff
je 0x43621c
imul eax, eax, 0x14c
test byte [eax + 0x871ec8], 2
je 0x43621c
mov edx, dword [esp + 0x24]
mov cl, byte [esp + edx + 0x40]
mov eax, edi
mov edi, dword [esp + 0x10]
shl eax, cl
mov ecx, dword [esp + 0x2c]
or edi, eax
not eax
and ecx, eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], ecx
mov eax, ebp
shl eax, 4
cmp byte [eax + ebx + 0x873978], 2
jne 0x436244
mov eax, dword [esp + 0x24]
mov cl, byte [esp + eax + 0x40]
mov eax, dword [esp + 0x10]
mov edx, 1
shl edx, cl
or eax, edx
mov dword [esp + 0x10], eax
test ebp, ebp
jl 0x43624d
cmp ebp, 0x10
jl 0x436251
or dword [esp + 0x10], esi
test ebx, ebx
jl 0x43625a
cmp ebx, 0x10
jl 0x43625e
or dword [esp + 0x10], esi
mov eax, dword [0x8cc960]
test eax, eax
jne 0x4362fd
test ebp, ebp
jl 0x4362fd
cmp ebp, 0xf
setle al
test al, al
je 0x4362fd
test ebx, ebx
jl 0x4362fd
cmp ebx, 0xf
setle al
test al, al
je 0x4362fd
mov eax, dword [0x8cc95c]
imul eax, eax, 0x14c
mov ecx, dword [eax + 0x870a1c]
test ecx, ecx
jne 0x4362fd
test byte [eax + 0x870a08], 0x70
jne 0x4362fd
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov esi, dword [0x8cc984]
and ecx, edi
neg ecx
sbb cl, cl
inc cl
push 0x3f800000
mov edi, 2
push ecx
push ebx
push ebp
call fcn.004aa2b0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov esi, dword [0x8cc984]
and edx, ecx
neg edx
sbb dl, dl
inc dl
push 0x3f800000
mov edi, 3
push edx
push ebx
push ebp
call fcn.004aa2b0
mov eax, dword [esp + 0x24]
inc eax
cmp eax, 8
mov dword [esp + 0x24], eax
jl 0x436170
mov ecx, dword [esp + 0x1c]
mov dl, byte [ecx + 0x870a08]
xor eax, eax
test dl, 0x60
mov dword [0x86e58c], eax
mov dword [esp + 0x20], 0x186a0
mov dword [esp + 0x40], 0xffffffff
jne 0x436499
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x871eb6
jmp 0x436350
mov edx, dword [esp + 0x28]
cmp word [edx - 0xe], 0xffff
je 0x436478
mov eax, edx
cmp word [eax], 0
je 0x436478
mov ecx, edx
test byte [ecx + 0x12], 2
je 0x436478
cmp word [edx - 0xa], 0x64
jge 0x436478
mov ecx, dword [esp + 0x1c]
mov edi, dword [edx + 0x96]
mov esi, dword [ecx + 0x870a8c]
mov ebx, dword [edx + 0x66]
mov ebp, dword [ecx + 0x870a5c]
mov eax, edi
mov ecx, ebx
sub eax, esi
sub ecx, ebp
jns 0x4363a7
neg ecx
test eax, eax
jge 0x4363ad
neg eax
cmp ecx, eax
jle 0x4363b6
lea eax, [eax + ecx*2]
jmp 0x4363b9
lea eax, [ecx + eax*2]
mov ecx, dword [esp + 0x1c]
cdq
sub eax, edx
movsx edx, word [ecx + 0x8709e8]
imul edx, edx, 7
movsx ecx, byte [edx + 0x72741c]
imul ecx, ecx, 0x3e8
sar eax, 1
add ecx, 0x29a
cmp eax, ecx
mov dword [esp + 0x30], eax
jg 0x436478
mov edx, dword [esp + 0x34]
push edx
push 0
push ebp
mov eax, edi
mov ecx, ebx
mov edx, esi
call fcn.004319c0
add esp, 0xc
test eax, eax
je 0x436478
mov esi, dword [0x86e588]
mov eax, dword [0x86e58c]
cmp esi, eax
jne 0x43641d
test byte [0x8cc96c], 4
je 0x436455
mov edx, dword [esp + 0x1c]
xor ecx, ecx
cmp esi, eax
movsx eax, word [edx + 0x870a00]
setne cl
push str.lb_target.dds
shl eax, 0x1d
dec ecx
and ecx, 0xf
add ecx, 0x2d
push ecx
mov ecx, dword [0x86e370]
push eax
push edi
push ebx
push ecx
xor al, al
call fcn.004c2190
mov eax, dword [0x86e58c]
mov ecx, dword [esp + 0x30]
cmp ecx, dword [esp + 0x20]
jge 0x436467
mov dword [esp + 0x20], ecx
mov dword [esp + 0x40], eax
mov edx, dword [esp + 0x24]
mov dword [eax*4 + 0x86e590], edx
inc eax
mov dword [0x86e58c], eax
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
add eax, 0x14c
inc esi
cmp eax, 0x873376
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], eax
jl 0x436350
cmp dword [0x86e588], 0xffffffff
jne 0x4364ab
mov eax, dword [esp + 0x40]
mov dword [0x86e588], eax
mov word [0x86e330], 0
call fcn.00431470
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
test ax, ax
je 0x4364db
push 7
push 0
push 0x10
call fcn.00473ad0
add esp, 0xc
jmp 0x436584
push 0x10
call esi
test ax, ax
jne 0x43653c
mov eax, dword [0x86e58c]
test eax, eax
mov cl, byte [0x8cc96c]
jne 0x4364fe
mov eax, dword [esp + 0x10]
or eax, 0xffef0010
jmp 0x43650c
test cl, 4
je 0x436510
mov eax, dword [esp + 0x10]
or eax, 0xffff0000
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
or eax, 0x100010
test cl, 4
je 0x436527
mov ecx, eax
not ecx
shl ecx, 0x10
or eax, ecx
mov edx, dword [esp + 0x10]
push 5
and eax, edx
push 0
push eax
call fcn.00473ad0
add esp, 0xc
jmp 0x436584
mov ecx, dword [0x86e58c]
xor eax, eax
cmp ecx, 2
jge 0x43654e
mov eax, 0x20
push 6
push 0
push eax
call fcn.00473ad0
add esp, 0xc
jmp 0x436584
mov al, byte [0x8cc980]
test al, al
je 0x43657d
mov edx, dword [ebp + 0x870a5c]
mov eax, dword [ebp + 0x870a8c]
mov dword [0x85c128], edx
mov dword [0x85c124], eax
mov byte [0x8cc980], 1
cmp dword [0x727534], 0xffffffff
je 0x4366fe
mov eax, dword [0x8ccc18]
imul eax, eax, 0x4b
cdq
and edx, 0x3ff
add eax, edx
sar eax, 0xa
push 0
mov dword [esp + 0x38], eax
mov eax, dword [0x8cbdd8]
push 0x86e460
mov ebp, 0x4b
push eax
mov dword [0x85c11c], ebp
mov dword [0x8cbde0], eax
call fcn.0050ac80
fild dword [0x72837c]
fmul st(1)
fidiv dword [0x8ccc18]
fimul dword [esp + 0x34]
fmul dword [0x715790]
call fcn.005f275c
fstp st(0)
mov ebx, 0xa
sub ebx, eax
mov eax, dword [0x85c26c]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp ebx, esi
jge 0x436603
mov ebx, esi
mov eax, dword [0x8ccc18]
mov edi, dword [0x8cbdd8]
imul eax, eax, 0x4b
cdq
and edx, 0x3ff
add eax, edx
sar eax, 0xa
mov ecx, 0x86e460
mov dword [0x85c11c], ebp
mov dword [esp + 0x14], eax
mov dword [0x8cbde0], edi
call fcn.0050ae30
fimul dword [0x728380]
fidiv dword [0x8ccc1c]
fadd dword [0x715588]
fimul dword [esp + 0x14]
fmul dword [0x715790]
call fcn.005f275c
mov ecx, 8
sub ecx, eax
mov eax, dword [0x85c268]
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
sar edi, 3
sub esi, eax
sub edi, 8
sub esi, 2
cmp ebx, ecx
jle 0x436692
push edi
mov eax, ecx
push esi
mov ecx, ebx
call fcn.00488110
add esp, 8
jmp 0x4366af
push 0
push 0x80000000
push ecx
push ebx
push edi
push esi
push 0
push 0
push 0
push 0
push 0
call fcn.004af500
add esp, 0x2c
mov eax, dword [0x85c268]
cdq
push 0
push 0xffffffffffffffff
push 4
and edx, 7
add eax, edx
sar eax, 3
push 0xffffffffffffffff
push ebp
push eax
mov eax, dword [0x85c26c]
cdq
sub eax, edx
sar eax, 1
push eax
push 0x86e460
xor eax, eax
mov dword [0x85c11c], ebp
call fcn.004b0b40
mov ecx, dword [0x85c164]
add esp, 0x20
test cl, 4
jne 0x4368b8
dec dword [0x727534]
jmp 0x436704
mov ecx, dword [0x85c164]
test cl, 4
jne 0x4368b8
mov esi, dword [0x85c128]
cmp esi, 0xffffffff
je 0x4367ee
mov eax, dword [0x86e578]
mov edi, dword [0x85c124]
mov ebp, dword [0x86e574]
sub esi, eax
sub edi, ebp
mov eax, edi
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov eax, esi
cdq
xor eax, edx
sub eax, edx
add ecx, eax
mov eax, esi
test eax, eax
mov edx, edi
jge 0x43674d
neg eax
test edx, edx
jge 0x436753
neg edx
cmp eax, edx
jle 0x436760
lea edx, [edx + eax*2]
mov dword [esp + 0x20], edx
jmp 0x436767
lea eax, [eax + edx*2]
mov dword [esp + 0x20], eax
mov eax, dword [0x86e56c]
cdq
mov ebp, eax
xor ebp, edx
sub ebp, edx
lea ebx, [ebp + 0xa]
mov eax, 0x66666667
imul ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
cdq
sub eax, edx
mov edx, dword [esp + 0x14]
sar eax, 1
cmp edx, eax
mov dword [esp + 0x34], ebx
jl 0x4369f4
add ebp, 0xfffffff6
js 0x436a00
cmp ebp, 0x190
jle 0x4367bd
mov ebp, 0x190
mov eax, esi
imul eax, ebp
cdq
inc ecx
idiv ecx
mov edx, dword [0x86e578]
mov dword [0x86e56c], ebp
add edx, eax
mov eax, edi
imul eax, ebp
mov dword [0x86e578], edx
cdq
idiv ecx
add dword [0x86e574], eax
mov ecx, dword [0x85c164]
mov eax, dword [0x86e56c]
test eax, eax
jne 0x436844
mov eax, dword [0x86e568]
test eax, eax
jne 0x436844
mov eax, dword [0x8cc960]
test eax, eax
mov edx, dword [0x86e5d0]
je 0x436825
mov esi, eax
shl esi, 4
add esi, edx
imul esi, esi, 0x14c
test byte [esi + 0x870a08], 2
je 0x436849
shl eax, 4
add eax, edx
imul eax, eax, 0x14c
movsx ecx, word [eax + 0x8709e8]
xor al, al
call fcn.0043a020
mov ecx, dword [0x85c164]
mov eax, dword [0x8cc960]
mov esi, dword [0x86e5d0]
and cl, 0x40
neg cl
sbb ecx, ecx
shl eax, 4
add eax, esi
imul eax, eax, 0x14c
mov dl, byte [eax + 0x870a08]
and ecx, 0x2ee0
add ecx, 0x4e20
test dl, 0x20
je 0x43687d
mov ecx, 0x2710
mov edx, dword [0x86e564]
mov esi, dword [0x86e570]
push 0
push 0x12c
push 0x1e
push edx
mov edx, dword [0x85c0fc]
imul edx, edx, 0x3e8
mov eax, esi
sub eax, edx
call fcn.004893a0
add esp, 0x10
add esi, eax
mov dword [0x86e564], eax
mov dword [0x86e570], esi
mov eax, dword [0x86e570]
mov ebp, dword [0x8cc97c]
mov edi, dword [0x870a18]
cdq
sub eax, edx
mov esi, eax
xor eax, eax
sar esi, 1
test ebp, ebp
setne al
mov ecx, 0x55555555
dec eax
and eax, edi
add eax, 0x1f4
mov dword [esp + 0x14], eax
mov eax, esi
call fcn.004dcac0
mov ebx, eax
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov edi, ebx
mov ebp, 1
jle 0x43691b
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov edi, eax
cdq
xor eax, edx
sub eax, edx
add ebp, ebp
cmp eax, 0x7d00
jg 0x436904
push 0x20000000
push 0
push 0x15555555
push 0x40000000
mov eax, esi
mov ecx, 0x15555555
call fcn.004dcac0
add eax, dword [esp + 0x24]
push eax
mov eax, ebx
mov ecx, 0x80000000
call fcn.004dcac0
mov ecx, dword [0x86e574]
sub ecx, eax
push ecx
mov edx, edi
mov ecx, 0x3fffffff
call fcn.00495330
mov ecx, eax
mov eax, dword [0x86e578]
imul ecx, ebp
sub eax, ecx
push eax
call fcn.004ad540
mov edx, dword [0x8ccbd4]
add esp, 0x1c
push edx
call fcn.004ae1f0
add esp, 4
call fcn.00433890
test byte [0x85c164], 4
je 0x4369db
push str.Paused
mov esi, 0x8ebf58
call fcn.004f7660
mov eax, dword [0x85c11c]
add esp, 4
push 0
push 0xffffffffffffffff
push 4
push 0xff000000
push eax
mov eax, dword [0x85c268]
cdq
sub eax, edx
sar eax, 1
sub eax, 0xc
push eax
mov eax, dword [0x85c26c]
cdq
sub eax, edx
sar eax, 1
push eax
push 0x86bb48
xor eax, eax
call fcn.004b0b40
add esp, 0x20
push 0
push 0
push 0
call fcn.004d1a40
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1ac
ret
mov ebp, dword [esp + 0x34]
test ebp, ebp
jge 0x4367b0
xor ebp, ebp
jmp 0x4367bd