Function at 0x5202b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ba74c
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x5f8800]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movsx eax, word [esi + 0x1425e0]
mov edi, dword [esi + 0x189300]
dec eax
mov dword [ebp - 0x148], edi
cmp eax, 7
ja case.default.0x5202fc
jmp dword [eax*4 + 0x523780]
movsx eax, word [esi + 0x1424d8]
movsx ecx, word [esi + 0x1424d6]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push 0
push eax
mov dword [ebp - 0x138], ecx
push ecx
mov ecx, dword [esi + 0x14a9ac]
mov dword [ebp - 0x13c], eax
call fcn.0057e2f0
mov eax, dword [esi + 0x142480]
cmp eax, 0xffffffff
je 0x5203b0
mov eax, dword [esi + eax*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [eax + 0x22]
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x13c]
sub eax, edx
add eax, 0x40
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x138]
sub eax, edx
add eax, 0x3d
push eax
mov eax, dword [esi + 0x142480]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057e2f0
mov eax, dword [esi + 0x142484]
cmp eax, 0xffffffff
je 0x520425
mov eax, dword [esi + eax*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [eax + 0x22]
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x13c]
sub eax, edx
add eax, 0x40
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x138]
sub eax, edx
add eax, 0x6a
push eax
mov eax, dword [esi + 0x142484]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057e2f0
mov eax, dword [esi + 0x142488]
cmp eax, 0xffffffff
je 0x52049c
mov eax, dword [esi + eax*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [eax + 0x22]
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x13c]
sub eax, edx
add eax, 0x40
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x138]
sub eax, edx
add eax, 0x97
push eax
mov eax, dword [esi + 0x142488]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057e2f0
mov eax, dword [esi + 0x14248c]
cmp eax, 0xffffffff
je 0x520511
mov eax, dword [esi + eax*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [eax + 0x22]
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x13c]
sub eax, edx
add eax, 0x6d
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x138]
sub eax, edx
add eax, 0x3d
push eax
mov eax, dword [esi + 0x14248c]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057e2f0
mov eax, dword [esi + 0x142490]
cmp eax, 0xffffffff
je 0x520586
mov eax, dword [esi + eax*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [eax + 0x22]
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x13c]
sub eax, edx
add eax, 0x6d
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x138]
sub eax, edx
add eax, 0x6a
push eax
mov eax, dword [esi + 0x142490]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057e2f0
mov eax, dword [esi + 0x142494]
cmp eax, 0xffffffff
je 0x5205f8
mov eax, dword [esi + eax*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [eax + 0x22]
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov edi, 3
idiv edi
mov eax, dword [ebp - 0x13c]
sub eax, edx
add eax, 0x6d
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
idiv edi
mov eax, dword [ebp - 0x138]
sub eax, edx
add eax, 0x97
push eax
mov eax, dword [esi + 0x142494]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057e2f0
mov eax, dword [ebp - 0x138]
movsx ecx, word [ebp + 8]
lea edx, [eax + 0x41]
mov dword [ebp - 0x158], edx
cmp ecx, edx
jl 0x520654
add eax, 0x9e
cmp ecx, eax
mov ecx, dword [ebp - 0x13c]
jg 0x52065a
movsx edi, word [ebp + 0xc]
lea edx, [ecx + 0xb7]
cmp edi, edx
jl 0x52065a
lea eax, [ecx + 0xcb]
cmp edi, eax
jg 0x52065a
mov ecx, 0x1e
mov eax, 0x10
push ecx
push eax
push eax
push str.Try_Now_
push edx
push dword [ebp - 0x158]
jmp 0x52372d
mov ecx, dword [ebp - 0x13c]
lea edx, [ecx + 0xb7]
mov eax, 6
mov ecx, 0x14
push ecx
push eax
push eax
push str.Try_Now_
push edx
push dword [ebp - 0x158]
jmp 0x52372d
movsx eax, word [esi + 0x1424d8]
movsx ecx, word [esi + 0x1424d6]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push 0
push eax
mov dword [ebp - 0x138], ecx
push ecx
mov ecx, dword [esi + 0x14a9ac]
mov dword [ebp - 0x13c], eax
call fcn.0057e2f0
mov eax, dword [esi + 0x142480]
cmp eax, 0xffffffff
je 0x52072b
mov eax, dword [esi + eax*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [eax + 0x22]
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x13c]
sub eax, edx
add eax, 0x40
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x138]
sub eax, edx
add eax, 0x3d
push eax
mov eax, dword [esi + 0x142480]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057e2f0
mov eax, dword [esi + 0x142484]
cmp eax, 0xffffffff
je 0x5207a0
mov eax, dword [esi + eax*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [eax + 0x22]
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x13c]
sub eax, edx
add eax, 0x40
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x138]
sub eax, edx
add eax, 0x6a
push eax
mov eax, dword [esi + 0x142484]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057e2f0
mov eax, dword [esi + 0x142488]
cmp eax, 0xffffffff
je 0x520817
mov eax, dword [esi + eax*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [eax + 0x22]
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x13c]
sub eax, edx
add eax, 0x40
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x138]
sub eax, edx
add eax, 0x97
push eax
mov eax, dword [esi + 0x142488]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057e2f0
mov eax, dword [esi + 0x14248c]
cmp eax, 0xffffffff
je 0x52088c
mov eax, dword [esi + eax*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [eax + 0x22]
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x13c]
sub eax, edx
add eax, 0x6d
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x138]
sub eax, edx
add eax, 0x3d
push eax
mov eax, dword [esi + 0x14248c]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057e2f0
mov eax, dword [esi + 0x142490]
cmp eax, 0xffffffff
je 0x520901
mov eax, dword [esi + eax*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [eax + 0x22]
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x13c]
sub eax, edx
add eax, 0x6d
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x138]
sub eax, edx
add eax, 0x6a
push eax
mov eax, dword [esi + 0x142490]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057e2f0
mov eax, dword [esi + 0x142494]
cmp eax, 0xffffffff
je 0x520978
mov eax, dword [esi + eax*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [eax + 0x22]
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x13c]
sub eax, edx
add eax, 0x6d
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x138]
sub eax, edx
add eax, 0x97
push eax
mov eax, dword [esi + 0x142494]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057e2f0
mov eax, dword [ebp - 0x13c]
mov ecx, esi
push 6
push 6
push 0x14
add eax, 0xb7
push str.Creating...
push eax
mov eax, dword [ebp - 0x138]
add eax, 0x41
push eax
call fcn.0045dd00
mov eax, edi
sub eax, dword [esi + 0x1424c0]
cmp eax, 0x3e8
jbe 0x5209bb
mov dword [esi + 0x1424c0], edi
inc byte [esi + 0x1424e0]
cmp byte [esi + 0x1424e0], 5
jl case.default.0x5202fc
movsx eax, byte [esi + 0x142526]
mov ecx, dword [esi + eax*4 + 0x186c50]
mov eax, dword [ecx + 4]
cmp eax, 1
jne 0x520a0b
push 0
lea eax, [ecx + 8]
mov ecx, esi
push eax
push 0
push 0
push 0
push 0
push 0xa28
push 0xfa314dc
call fcn.00493690
push 0x1a
mov ecx, esi
call fcn.00415190
jmp case.default.0x5202fc
test eax, eax
jne case.default.0x5202fc
push 0x1a
mov ecx, esi
call fcn.00415190
jmp case.default.0x5202fc
cmp byte [esi + 0x1424e0], 0
je 0x520aae
mov al, byte [esi + 0x1424e0]
mov byte [ebp - 0x141], al
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
movsx ecx, byte [ebp - 0x141]
cdq
add ecx, ecx
idiv ecx
movsx ax, byte [ebp - 0x141]
movzx ecx, word [esi + 0x1424d6]
add cx, 5
sub ax, dx
movzx eax, ax
add cx, ax
movzx eax, cx
mov dword [ebp - 0x13c], eax
mov al, byte [esi + 0x1424e0]
mov byte [ebp - 0x141], al
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
movsx ecx, byte [ebp - 0x141]
cdq
add ecx, ecx
idiv ecx
movsx ax, byte [ebp - 0x141]
movzx ecx, word [esi + 0x1424d8]
add cx, 8
sub ax, dx
movzx eax, ax
add cx, ax
movzx eax, cx
jmp 0x520ac2
movzx eax, word [esi + 0x1424d6]
mov dword [ebp - 0x13c], eax
movzx eax, word [esi + 0x1424d8]
mov ecx, dword [ebp - 0x13c]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
mov dword [ebp - 0x138], eax
cwde
push 1
movsx ecx, cx
push eax
push ecx
mov ecx, dword [esi + 0x14a978]
mov dword [ebp - 0x14c], eax
call fcn.0057e2f0
mov eax, dword [esi + 0x142480]
cmp eax, 0xffffffff
je 0x520b66
mov eax, dword [esi + eax*4 + 0x18558c]
push edi
movsx eax, word [eax + 0x22]
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x14c]
sub eax, edx
add eax, 0x40
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov edi, dword [ebp - 0x13c]
movsx eax, di
sub eax, edx
add eax, 0x3d
push eax
mov eax, dword [esi + 0x142480]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057ec90
mov edi, dword [ebp - 0x148]
mov eax, dword [esi + 0x142484]
cmp eax, 0xffffffff
je 0x520bd6
mov eax, dword [esi + eax*4 + 0x18558c]
push edi
movsx eax, word [eax + 0x22]
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x14c]
sub eax, edx
add eax, 0x40
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov edi, dword [ebp - 0x13c]
movsx eax, di
sub eax, edx
add eax, 0x6a
push eax
mov eax, dword [esi + 0x142484]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057ec90
mov edi, dword [ebp - 0x148]
mov eax, dword [esi + 0x142488]
cmp eax, 0xffffffff
je 0x520c42
mov eax, dword [esi + eax*4 + 0x18558c]
push edi
movsx eax, word [eax + 0x22]
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x14c]
sub eax, edx
add eax, 0x40
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [ebp - 0x13c]
movsx eax, cx
sub eax, edx
add eax, 0x97
push eax
mov eax, dword [esi + 0x142488]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057ec90
mov eax, dword [esi + 0x14248c]
cmp eax, 0xffffffff
je 0x520caf
mov eax, dword [esi + eax*4 + 0x18558c]
push edi
movsx eax, word [eax + 0x22]
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [ebp - 0x138]
movsx eax, cx
sub eax, edx
add eax, 0x6d
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [ebp - 0x13c]
movsx eax, cx
sub eax, edx
add eax, 0x3d
push eax
mov eax, dword [esi + 0x14248c]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057ec90
mov eax, dword [esi + 0x142490]
cmp eax, 0xffffffff
je 0x520d1c
mov eax, dword [esi + eax*4 + 0x18558c]
push edi
movsx eax, word [eax + 0x22]
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [ebp - 0x138]
movsx eax, cx
sub eax, edx
add eax, 0x6d
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [ebp - 0x13c]
movsx eax, cx
sub eax, edx
add eax, 0x6a
push eax
mov eax, dword [esi + 0x142490]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057ec90
mov eax, dword [esi + 0x142494]
cmp eax, 0xffffffff
je 0x520d86
mov eax, dword [esi + eax*4 + 0x18558c]
push edi
movsx eax, word [eax + 0x22]
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov edi, 3
idiv edi
mov ecx, dword [ebp - 0x138]
movsx eax, cx
sub eax, edx
add eax, 0x6d
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
idiv edi
mov ecx, dword [ebp - 0x13c]
movsx eax, cx
sub eax, edx
add eax, 0x97
push eax
mov eax, dword [esi + 0x142494]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057ec90
mov eax, dword [ebp - 0x13c]
movsx ecx, word [ebp + 8]
cwde
lea edx, [eax + 0x41]
cmp ecx, edx
jl 0x520dd8
add eax, 0x9e
cmp ecx, eax
jg 0x520dd8
mov eax, dword [ebp - 0x138]
movsx edi, word [ebp + 0xc]
cwde
lea ecx, [eax + 0xb7]
cmp edi, ecx
jl 0x520dd8
add eax, 0xcb
cmp edi, eax
jg 0x520dd8
mov edi, 0x1e
mov eax, 0x10
push edi
push eax
push eax
push str.Try_Now_
push ecx
push edx
jmp 0x52372d
mov ecx, dword [ebp - 0x138]
mov edi, 0x14
push edi
mov eax, 6
movsx ecx, cx
push eax
push eax
push str.Try_Now_
add ecx, 0xb7
push ecx
push edx
jmp 0x52372d
cmp byte [esi + 0x1424e0], 0
je 0x520e8d
mov al, byte [esi + 0x1424e0]
mov byte [ebp - 0x141], al
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
movsx ecx, byte [ebp - 0x141]
cdq
add ecx, ecx
idiv ecx
movsx ax, byte [ebp - 0x141]
movzx ecx, word [esi + 0x1424d6]
add cx, 5
sub ax, dx
movzx eax, ax
add cx, ax
movzx eax, cx
mov dword [ebp - 0x13c], eax
mov al, byte [esi + 0x1424e0]
mov byte [ebp - 0x141], al
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
movsx ecx, byte [ebp - 0x141]
cdq
add ecx, ecx
idiv ecx
movsx ax, byte [ebp - 0x141]
movzx ecx, word [esi + 0x1424d8]
add cx, 8
sub ax, dx
movzx eax, ax
add cx, ax
movzx eax, cx
jmp 0x520ea1
movzx eax, word [esi + 0x1424d6]
mov dword [ebp - 0x13c], eax
movzx eax, word [esi + 0x1424d8]
mov ecx, dword [ebp - 0x13c]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
mov dword [ebp - 0x138], eax
push 1
cwde
movsx ecx, cx
push eax
push ecx
mov ecx, dword [esi + 0x14a978]
call fcn.0057e2f0
mov eax, dword [esi + 0x142480]
cmp eax, 0xffffffff
je 0x520f42
mov eax, dword [esi + eax*4 + 0x18558c]
push edi
movsx eax, word [eax + 0x22]
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov edi, dword [ebp - 0x138]
movsx eax, di
sub eax, edx
add eax, 0x40
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov edi, dword [ebp - 0x13c]
movsx eax, di
sub eax, edx
add eax, 0x3d
push eax
mov eax, dword [esi + 0x142480]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057ec90
mov edi, dword [ebp - 0x148]
mov eax, dword [esi + 0x142484]
cmp eax, 0xffffffff
je 0x520fb5
mov eax, dword [esi + eax*4 + 0x18558c]
push edi
movsx eax, word [eax + 0x22]
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov edi, dword [ebp - 0x138]
movsx eax, di
sub eax, edx
add eax, 0x40
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov edi, dword [ebp - 0x13c]
movsx eax, di
sub eax, edx
add eax, 0x6a
push eax
mov eax, dword [esi + 0x142484]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057ec90
mov edi, dword [ebp - 0x148]
mov eax, dword [esi + 0x142488]
cmp eax, 0xffffffff
je 0x521024
mov eax, dword [esi + eax*4 + 0x18558c]
push edi
movsx eax, word [eax + 0x22]
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [ebp - 0x138]
movsx eax, cx
sub eax, edx
add eax, 0x40
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [ebp - 0x13c]
movsx eax, cx
sub eax, edx
add eax, 0x97
push eax
mov eax, dword [esi + 0x142488]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057ec90
mov eax, dword [esi + 0x14248c]
cmp eax, 0xffffffff
je 0x521091
mov eax, dword [esi + eax*4 + 0x18558c]
push edi
movsx eax, word [eax + 0x22]
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [ebp - 0x138]
movsx eax, cx
sub eax, edx
add eax, 0x6d
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [ebp - 0x13c]
movsx eax, cx
sub eax, edx
add eax, 0x3d
push eax
mov eax, dword [esi + 0x14248c]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057ec90
mov eax, dword [esi + 0x142490]
cmp eax, 0xffffffff
je 0x5210fe
mov eax, dword [esi + eax*4 + 0x18558c]
push edi
movsx eax, word [eax + 0x22]
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [ebp - 0x138]
movsx eax, cx
sub eax, edx
add eax, 0x6d
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [ebp - 0x13c]
movsx eax, cx
sub eax, edx
add eax, 0x6a
push eax
mov eax, dword [esi + 0x142490]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057ec90
mov eax, dword [esi + 0x142494]
cmp eax, 0xffffffff
je 0x52116d
mov eax, dword [esi + eax*4 + 0x18558c]
push edi
movsx eax, word [eax + 0x22]
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [ebp - 0x138]
movsx eax, cx
sub eax, edx
add eax, 0x6d
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [ebp - 0x13c]
movsx eax, cx
sub eax, edx
add eax, 0x97
push eax
mov eax, dword [esi + 0x142494]
mov eax, dword [esi + eax*4 + 0x18558c]
movsx ecx, word [eax + 0x20]
mov ecx, dword [esi + ecx*4 + 0x14adbc]
call fcn.0057ec90
mov eax, dword [ebp - 0x138]
mov ecx, esi
push 6
push 6
cwde
push 0x14
add eax, 0xb7
push str.Creating...
push eax
mov eax, dword [ebp - 0x13c]
cwde
add eax, 0x41
push eax
call fcn.0045dd00
mov eax, edi
sub eax, dword [esi + 0x1424c0]
cmp eax, 0x3e8
jbe 0x5211b2
mov dword [esi + 0x1424c0], edi
inc byte [esi + 0x1424e0]
cmp byte [esi + 0x1424e0], 5
jl case.default.0x5202fc
push 0
push 0
push 0
push 0
push 0
push 0
push 0xa19
push 0xfa314dc
mov ecx, esi
call fcn.00493690
push 0x1a
mov ecx, esi
call fcn.00415190
push 0
push 0
push 0x2a
push 0x45
mov ecx, esi
call fcn.0045cfc0
jmp case.default.0x5202fc
movzx ecx, word [esi + 0x1424d8]
movzx eax, word [esi + 0x1424d6]
push 0
push 0
push 0
movsx edi, cx
mov dword [ebp - 0x13c], eax
push edi
cwde
push eax
mov dword [ebp - 0x138], ecx
mov ecx, esi
push 0x3e
call fcn.0043d1d0
mov ecx, dword [ebp - 0x13c]
push 0
push 0
push 8
push edi
movsx eax, cx
mov ecx, esi
push eax
push 0x46
call fcn.0043d1d0
mov ecx, dword [ebp - 0x13c]
add edi, 0x2e
push 0
push 0
push str.Name
movsx eax, cx
mov ecx, esi
push edi
add eax, 0x31
push eax
call fcn.0045d450
mov eax, dword [ebp - 0x13c]
mov ecx, esi
push 0
push 0
push str.Max.Skill
push edi
movsx edi, ax
lea eax, [edi + 0xb0]
push eax
call fcn.0045d450
mov edx, dword [ebp - 0x138]
xor ecx, ecx
movsx eax, dx
add eax, 0x3f
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x140], eax
nop
movsx eax, word [esi + 0x1424de]
add eax, 0x61a97
add eax, ecx
cmp dword [esi + eax*4], 0
lea eax, [esi + eax*4]
mov dword [ebp - 0x158], eax
je 0x5213f5
push 0x78
lea eax, [ebp - 0x88]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x158]
add esp, 0xc
mov ecx, esi
mov eax, dword [eax]
push 1
push 0
add eax, 8
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x78
lea eax, [ebp - 0x100]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movsx eax, word [esi + 0x1424de]
add eax, dword [ebp - 0x14c]
mov eax, dword [esi + eax*4 + 0x186a5c]
push dword [eax + 0x24]
lea eax, [ebp - 0x100]
push 0x5d3054
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
movsx ecx, word [ebp + 8]
lea eax, [edi + 0x1e]
add esp, 0x24
cmp ecx, eax
jl 0x521371
lea eax, [edi + 0xb4]
cmp ecx, eax
mov ecx, dword [ebp - 0x140]
jg 0x521377
movsx edx, word [ebp + 0xc]
cmp edx, ecx
jl 0x521377
lea eax, [ecx + 0xe]
cmp edx, eax
jg 0x521377
mov eax, 0xffffff
jmp 0x52139b
mov ecx, dword [ebp - 0x140]
movsx eax, word [esi + 0x1424de]
add eax, dword [ebp - 0x14c]
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 4], 1
mov eax, 0x781e22
je 0x52139b
mov eax, 0x19192d
push 0
push eax
mov dword [ebp - 0x160], eax
mov edx, esi
lea eax, [ebp - 0x88]
mov dword [ebp - 0x150], edi
push eax
push ecx
mov eax, 0x1e
mov ecx, edx
add eax, edi
push eax
call fcn.0045d450
push 0
push dword [ebp - 0x160]
lea eax, [ebp - 0x100]
mov ecx, esi
push eax
mov eax, dword [ebp - 0x140]
push eax
mov eax, edi
add eax, 0xbe
push eax
call fcn.0045d450
add dword [ebp - 0x140], 0xf
mov ecx, dword [ebp - 0x14c]
inc ecx
mov dword [ebp - 0x14c], ecx
cmp ecx, 0xd
jl 0x5212a0
movzx eax, word [esi + 0x1424de]
cmp ax, 1
jl 0x521462
cwde
cmp dword [esi + eax*4 + 0x186a58], 0
je 0x521462
mov eax, dword [ebp - 0x13c]
mov edi, dword [ebp - 0x148]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
cwde
push 0
push 0
push 1
lea ecx, [eax + 0xe6]
mov eax, dword [ebp - 0x138]
push edi
cwde
push 0x17
add eax, 0xda
mov dword [ebp - 0x150], ecx
push eax
push ecx
mov ecx, dword [esi + 0x14aa00]
call fcn.0057e2f0
jmp 0x52149f
mov eax, dword [ebp - 0x13c]
mov edi, dword [ebp - 0x148]
push 1
cwde
push edi
push 5
push 5
lea ecx, [eax + 0xe6]
mov eax, dword [ebp - 0x138]
push 5
cwde
push 0x17
add eax, 0xda
mov dword [ebp - 0x150], ecx
push eax
push ecx
mov ecx, dword [esi + 0x14aa00]
call fcn.0057ef00
mov eax, dword [ebp - 0x138]
mov ecx, dword [esi + 0x14aa00]
movsx edx, ax
movsx eax, word [esi + 0x1424de]
add edx, 0xee
cmp dword [esi + eax*4 + 0x186a90], 0
je 0x5214e5
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
mov edi, dword [ebp - 0x150]
push 0x18
push edx
push edi
call fcn.0057e2f0
jmp 0x5214fd
push 1
push edi
mov edi, dword [ebp - 0x150]
push 5
push 5
push 5
push 0x18
push edx
push edi
call fcn.0057ef00
cmp byte [ebp + 0x14], 0
je 0x521590
mov ecx, esi
call fcn.004973c0
cmp eax, 0x1a
jne 0x521590
movsx ecx, word [ebp + 8]
cmp ecx, edi
jl 0x521590
mov eax, dword [ebp - 0x13c]
cwde
add eax, 0xfa
cmp ecx, eax
jg 0x521590
mov ecx, dword [ebp - 0x138]
mov dx, word [ebp + 0xc]
movsx eax, cx
movsx edi, dx
add eax, 0xda
cmp edi, eax
jl 0x521557
movsx eax, cx
add eax, 0xee
cmp edi, eax
jg 0x521557
dec word [esi + 0x1424de]
movsx eax, cx
movsx edx, dx
add eax, 0xee
cmp edx, eax
jl 0x521590
movsx eax, cx
add eax, 0x102
cmp edx, eax
jg 0x521590
movzx ecx, word [esi + 0x1424de]
movsx eax, cx
cmp dword [esi + eax*4 + 0x186a90], 0
je 0x521590
lea eax, [ecx + 1]
mov word [esi + 0x1424de], ax
mov di, word [ebp + 0x10]
test di, di
je 0x5215cb
mov ecx, esi
call fcn.004973c0
cmp eax, 0x1a
jne 0x5215cb
movsx ecx, di
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub word [esi + 0x1424de], cx
xor eax, eax
mov word [esi + 0x14a904], ax
movzx edx, word [esi + 0x1424de]
movsx eax, dx
mov edi, edx
cmp dword [esi + eax*4 + 0x186a8c], 0
jne 0x52162e
dec edx
movzx eax, dx
mov word [esi + 0x1424de], dx
mov edi, eax
cmp dx, 1
jl 0x52162e
nop dword [eax]
nop dword [eax + eax]
movzx edi, ax
movsx eax, dx
cmp dword [esi + eax*4 + 0x186a8c], 0
jne 0x52162e
lea ecx, [edx - 1]
movzx eax, cx
movzx edx, cx
mov edi, eax
mov word [esi + 0x1424de], cx
mov dword [ebp - 0x158], edi
cmp cx, 1
jge 0x521600
test di, di
jns 0x52163c
xor eax, eax
mov word [esi + 0x1424de], ax
xorps xmm0, xmm0
mov dword [ebp - 0x10c], 0
push 0x20
movups xmmword [ebp - 0x11c], xmm0
mov dword [ebp - 0x108], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SKILLDLG2]
mov dword [ebp - 0x11c], eax
add esp, 4
mov dword [ebp - 0x10c], 0x18
mov dword [ebp - 0x108], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d306c]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x15c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x5216c5
mov eax, dword [eax]
mov edi, dword [ebp - 0x13c]
movsx ecx, word [esi + 0x1424da]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0x138]
cwde
add eax, 0x109
push eax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
mov ecx, dword [ebp - 0x108]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x52173a
mov edx, dword [ebp - 0x11c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x521730
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x523751
push ecx
push edx
call fcn.005aa4e8
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x10c], 0
push 0x20
movups xmmword [ebp - 0x11c], xmm0
mov dword [ebp - 0x108], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SKILLDLG3]
mov dword [ebp - 0x11c], eax
add esp, 4
mov dword [ebp - 0x10c], 0x18
mov dword [ebp - 0x108], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d3088]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x15c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x5217c3
mov eax, dword [eax]
movsx ecx, word [esi + 0x1424da]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0x138]
cwde
add eax, 0x118
push eax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
mov ecx, dword [ebp - 0x108]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x521832
mov edx, dword [ebp - 0x11c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x521828
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x523756
push ecx
push edx
call fcn.005aa4e8
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x10c], 0
push 0x20
movups xmmword [ebp - 0x11c], xmm0
mov dword [ebp - 0x108], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SKILLDLG4]
mov dword [ebp - 0x11c], eax
add esp, 4
mov dword [ebp - 0x10c], 0x18
mov dword [ebp - 0x108], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d30a4]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x15c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x5218bb
mov eax, dword [eax]
movsx ecx, word [esi + 0x1424da]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0x138]
cwde
add eax, 0x127
push eax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
xorps xmm0, xmm0
mov dword [ebp - 0x10c], 0
push 0x20
movups xmmword [ebp - 0x11c], xmm0
mov dword [ebp - 0x108], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SKILLDLG5]
mov dword [ebp - 0x11c], eax
add esp, 4
mov dword [ebp - 0x10c], 0x18
mov dword [ebp - 0x108], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d30c0]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 3
push eax
lea eax, [ebp - 0x15c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x521984
mov eax, dword [eax]
movsx ecx, word [esi + 0x1424da]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0x138]
cwde
add eax, 0x136
push eax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
mov ecx, dword [ebp - 0x108]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x5219f3
mov edx, dword [ebp - 0x11c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x5219e9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52375b
push ecx
push edx
call fcn.005aa4e8
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x10c], 0
push 0x20
movups xmmword [ebp - 0x11c], xmm0
mov dword [ebp - 0x108], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SKILLDLG6]
mov dword [ebp - 0x11c], eax
add esp, 4
mov dword [ebp - 0x10c], 0x18
mov dword [ebp - 0x108], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d30dc]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x15c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x521a7c
mov eax, dword [eax]
movsx ecx, word [esi + 0x1424da]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0x138]
cwde
add eax, 0x154
push eax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
mov ecx, dword [ebp - 0x108]
cmp ecx, 0xf
jbe case.default.0x5202fc
mov edx, dword [ebp - 0x11c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x521ade
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x523760
push ecx
push edx
call fcn.005aa4e8
add esp, 8
jmp case.default.0x5202fc
movzx ecx, word [esi + 0x1424d8]
movzx eax, word [esi + 0x1424d6]
movzx edx, word [esi + 0x1424da]
push 0
push 0
push 0
movsx edi, cx
mov dword [ebp - 0x13c], eax
push edi
cwde
push eax
mov dword [ebp - 0x140], ecx
mov ecx, esi
push 0x3e
mov dword [ebp - 0x158], edx
call fcn.0043d1d0
mov ecx, dword [ebp - 0x13c]
push 0
push 0
push 8
push edi
movsx eax, cx
mov ecx, esi
push eax
push 0x46
call fcn.0043d1d0
movsx eax, byte [esi + 0x1424e0]
push 0
mov ecx, dword [esi + eax*4 + 0x186a5c]
movzx eax, byte [ecx + 0x30]
push eax
movzx eax, word [ecx + 0x2c]
push eax
mov eax, dword [ebp - 0x140]
add eax, 0x5e
push eax
mov eax, dword [ebp - 0x13c]
add eax, 0x42
push eax
push 0
push dword [ecx + 0x28]
mov ecx, esi
push 0x12c
call fcn.0047dec0
push 0x78
lea eax, [ebp - 0x88]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movsx eax, byte [esi + 0x1424e0]
add esp, 0xc
mov ecx, esi
mov eax, dword [esi + eax*4 + 0x186a5c]
push 1
push 0
add eax, 8
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x88]
mov ecx, esi
push 0
push 0xffffff
push eax
lea eax, [edi + 0x30]
mov edi, dword [ebp - 0x13c]
push eax
movsx eax, di
add eax, 0x71
push eax
call fcn.0045d450
xorps xmm0, xmm0
mov dword [ebp - 0x10c], 0
movups xmmword [ebp - 0x11c], xmm0
mov dword [ebp - 0x108], 0
push 0x20
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SKILLDLG7]
mov dword [ebp - 0x11c], eax
add esp, 4
mov dword [ebp - 0x10c], 0x18
mov dword [ebp - 0x108], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d30f8]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 5
push eax
lea eax, [ebp - 0x154]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov ecx, dword [eax]
add ecx, 0x20
cmp dword [ecx + 0x14], 0xf
jbe 0x521c7d
mov ecx, dword [ecx]
movsx eax, byte [esi + 0x1424e0]
mov eax, dword [esi + eax*4 + 0x186a5c]
push dword [eax + 0x24]
push dword [eax + 0x20]
lea eax, [ebp - 0x88]
push ecx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x108]
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x521ce3
mov edx, dword [ebp - 0x11c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x521cd9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x523765
push ecx
push edx
call fcn.005aa4e8
add esp, 8
push 0
push 0x19192d
lea eax, [ebp - 0x88]
mov ecx, esi
push eax
mov eax, dword [ebp - 0x140]
cwde
add eax, 0x4e
push eax
movsx eax, di
add eax, 0x71
push eax
call fcn.0045d450
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x10c], 0
push str.DRAW_DIALOGBOX_SKILLDLG8
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x108], 0
movups xmmword [ebp - 0x11c], xmm0
call fcn.0040b5c0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 6
push eax
lea eax, [ebp - 0x154]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x521d66
mov eax, dword [eax]
push 0
push 0x19192d
push eax
mov eax, dword [ebp - 0x140]
mov ecx, esi
cwde
add eax, 0x62
push eax
movsx eax, di
add eax, 0x71
push eax
call fcn.0045d450
mov ecx, dword [ebp - 0x108]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x521dc8
mov edx, dword [ebp - 0x11c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x521dbe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52376a
push ecx
push edx
call fcn.005aa4e8
add esp, 8
movsx eax, byte [esi + 0x1424e0]
mov dword [ebp - 0x138], 4
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 0xb4], 0
je 0x521e63
push 1
push 0
add eax, 0x31
mov ecx, esi
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
movsx eax, byte [esi + 0x1424e0]
add esp, 0xc
mov ecx, 0x19192d
mov eax, dword [esi + eax*4 + 0x186a5c]
push 0
cmp dword [eax + 0xd0], 1
mov eax, 0x969696
cmovne ecx, eax
lea eax, [ebp - 0x88]
push ecx
push eax
mov eax, dword [ebp - 0x140]
mov ecx, esi
cwde
add eax, 0x71
push eax
movsx eax, di
add eax, 0x7b
push eax
call fcn.0045d450
mov dword [ebp - 0x138], 5
movsx eax, byte [esi + 0x1424e0]
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 0xb8], 0
je 0x521f05
push 1
push 0
add eax, 0x46
mov ecx, esi
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
movsx eax, byte [esi + 0x1424e0]
add esp, 0xc
mov ecx, 0x19192d
mov eax, dword [esi + eax*4 + 0x186a5c]
push 0
cmp dword [eax + 0xd4], 1
mov eax, 0x969696
cmovne ecx, eax
lea eax, [ebp - 0x88]
push ecx
mov ecx, dword [ebp - 0x138]
push eax
mov eax, dword [ebp - 0x140]
cwde
shl ecx, 4
add eax, 0x35
sub ecx, dword [ebp - 0x138]
add eax, ecx
mov ecx, esi
push eax
movsx eax, di
add eax, 0x7b
push eax
call fcn.0045d450
inc dword [ebp - 0x138]
movsx eax, byte [esi + 0x1424e0]
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 0xbc], 0
je 0x521fa7
push 1
push 0
add eax, 0x5b
mov ecx, esi
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
movsx eax, byte [esi + 0x1424e0]
add esp, 0xc
mov ecx, 0x19192d
mov eax, dword [esi + eax*4 + 0x186a5c]
push 0
cmp dword [eax + 0xd8], 1
mov eax, 0x969696
cmovne ecx, eax
lea eax, [ebp - 0x88]
push ecx
mov ecx, dword [ebp - 0x138]
push eax
mov eax, dword [ebp - 0x140]
cwde
shl ecx, 4
add eax, 0x35
sub ecx, dword [ebp - 0x138]
add eax, ecx
mov ecx, esi
push eax
movsx eax, di
add eax, 0x7b
push eax
call fcn.0045d450
inc dword [ebp - 0x138]
movsx eax, byte [esi + 0x1424e0]
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 0xc0], 0
je 0x522049
push 1
push 0
add eax, 0x70
mov ecx, esi
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
movsx eax, byte [esi + 0x1424e0]
add esp, 0xc
mov ecx, 0x19192d
mov eax, dword [esi + eax*4 + 0x186a5c]
push 0
cmp dword [eax + 0xdc], 1
mov eax, 0x969696
cmovne ecx, eax
lea eax, [ebp - 0x88]
push ecx
mov ecx, dword [ebp - 0x138]
push eax
mov eax, dword [ebp - 0x140]
cwde
shl ecx, 4
add eax, 0x35
sub ecx, dword [ebp - 0x138]
add eax, ecx
mov ecx, esi
push eax
movsx eax, di
add eax, 0x7b
push eax
call fcn.0045d450
inc dword [ebp - 0x138]
movsx eax, byte [esi + 0x1424e0]
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 0xc4], 0
je 0x5220ed
push 1
push 0
add eax, 0x85
mov ecx, esi
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
movsx eax, byte [esi + 0x1424e0]
add esp, 0xc
mov ecx, 0x969696
mov eax, dword [esi + eax*4 + 0x186a5c]
push 0
cmp dword [eax + 0xe0], 1
mov eax, 0x19192d
cmovne eax, ecx
mov ecx, dword [ebp - 0x138]
push eax
lea eax, [ebp - 0x88]
shl ecx, 4
sub ecx, dword [ebp - 0x138]
push eax
mov eax, dword [ebp - 0x140]
cwde
add eax, 0x35
add eax, ecx
mov ecx, esi
push eax
movsx eax, di
add eax, 0x7b
push eax
call fcn.0045d450
inc dword [ebp - 0x138]
movsx eax, byte [esi + 0x1424e0]
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 0xc8], 0
je 0x52218b
push 1
push 0
add eax, 0x9a
mov ecx, esi
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x140]
add esp, 0xc
mov ecx, dword [ebp - 0x138]
cwde
shl ecx, 4
sub ecx, dword [ebp - 0x138]
push 0
lea edx, [eax + 0x35]
movsx eax, byte [esi + 0x1424e0]
add edx, ecx
movsx ecx, di
add ecx, 0x7b
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 0xe4], 1
lea eax, [ebp - 0x88]
jne 0x52217c
push 0x19192d
jmp 0x522181
push 0x969696
push eax
push edx
push ecx
mov ecx, esi
call fcn.0045d450
movsx eax, byte [esi + 0x1424e0]
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 4], 1
jne 0x52270d
mov eax, dword [ebp - 0x140]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
cwde
push 0
push 1
lea ecx, [eax + 0xe4]
movsx eax, di
mov edi, dword [ebp - 0x148]
add eax, 0x61
push edi
push 2
push ecx
mov dword [ebp - 0x138], ecx
mov ecx, dword [esi + 0x14a978]
push eax
mov dword [ebp - 0x150], eax
call fcn.0057e2f0
mov ecx, dword [ebp - 0x13c]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push 2
push dword [ebp - 0x138]
movsx eax, cx
mov ecx, dword [esi + 0x14a978]
add eax, 0x8e
push eax
mov dword [ebp - 0x14c], eax
call fcn.0057e2f0
mov ecx, dword [ebp - 0x13c]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push 2
push dword [ebp - 0x138]
movsx eax, cx
mov ecx, dword [esi + 0x14a978]
add eax, 0xbb
push eax
mov dword [ebp - 0x160], eax
call fcn.0057e2f0
mov edx, dword [ebp - 0x140]
push 0
mov ecx, dword [esi + 0x14a978]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x148]
movsx edi, dx
push 2
add edi, 0x111
push edi
push dword [ebp - 0x150]
call fcn.0057e2f0
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x148]
push 2
push edi
push dword [ebp - 0x14c]
mov ecx, dword [esi + 0x14a978]
call fcn.0057e2f0
push 0
mov ecx, dword [esi + 0x14a978]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x148]
push 2
push edi
push dword [ebp - 0x160]
call fcn.0057e2f0
mov ecx, dword [esi + 0x142480]
mov edi, dword [ebp - 0x148]
cmp ecx, 0xffffffff
je 0x522323
mov ecx, dword [esi + ecx*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [ecx + 0x22]
movsx ecx, word [ecx + 0x20]
push 0xffffffffffffffff
push 0
push 0
mov ecx, dword [esi + ecx*4 + 0x14adbc]
push 1
push edi
push eax
push dword [ebp - 0x138]
push dword [ebp - 0x150]
call fcn.0057e2f0
mov ecx, dword [esi + 0x142484]
cmp ecx, 0xffffffff
je 0x522365
mov ecx, dword [esi + ecx*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [ecx + 0x22]
movsx ecx, word [ecx + 0x20]
push 0xffffffffffffffff
push 0
push 0
mov ecx, dword [esi + ecx*4 + 0x14adbc]
push 1
push edi
push eax
push dword [ebp - 0x138]
push dword [ebp - 0x14c]
call fcn.0057e2f0
mov ecx, dword [esi + 0x142488]
cmp ecx, 0xffffffff
je 0x5223a7
mov ecx, dword [esi + ecx*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [ecx + 0x22]
movsx ecx, word [ecx + 0x20]
push 0xffffffffffffffff
push 0
push 0
mov ecx, dword [esi + ecx*4 + 0x14adbc]
push 1
push edi
push eax
push dword [ebp - 0x138]
push dword [ebp - 0x160]
call fcn.0057e2f0
mov ecx, dword [esi + 0x14248c]
cmp ecx, 0xffffffff
je 0x5223f5
mov ecx, dword [esi + ecx*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [ecx + 0x22]
movsx ecx, word [ecx + 0x20]
push 0xffffffffffffffff
push 0
push 0
mov ecx, dword [esi + ecx*4 + 0x14adbc]
push 1
push edi
push eax
mov eax, dword [ebp - 0x140]
cwde
add eax, 0x111
push eax
mov eax, dword [ebp - 0x13c]
cwde
add eax, 0x61
push eax
call fcn.0057e2f0
mov ecx, dword [esi + 0x142490]
cmp ecx, 0xffffffff
je 0x522445
mov ecx, dword [esi + ecx*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [ecx + 0x22]
movsx ecx, word [ecx + 0x20]
push 0xffffffffffffffff
push 0
push 0
mov ecx, dword [esi + ecx*4 + 0x14adbc]
push 1
push edi
push eax
mov eax, dword [ebp - 0x140]
cwde
add eax, 0x111
push eax
mov eax, dword [ebp - 0x13c]
cwde
add eax, 0x8e
push eax
call fcn.0057e2f0
mov ecx, dword [esi + 0x142494]
cmp ecx, 0xffffffff
je 0x522499
mov ecx, dword [esi + ecx*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [ecx + 0x22]
movsx ecx, word [ecx + 0x20]
push 0xffffffffffffffff
push 0
push 0
mov ecx, dword [esi + ecx*4 + 0x14adbc]
push 1
push edi
mov edi, dword [ebp - 0x13c]
push eax
mov eax, dword [ebp - 0x140]
cwde
add eax, 0x111
push eax
movsx eax, di
add eax, 0xbb
push eax
call fcn.0057e2f0
jmp 0x52249f
mov edi, dword [ebp - 0x13c]
push str.DRAW_DIALOGBOX_SKILLDLG15
lea ecx, [ebp - 0x11c]
call fcn.0040f9f0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 7
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x5224cf
mov eax, dword [eax]
mov ecx, dword [ebp - 0x158]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0x140]
movsx edx, cx
cwde
add eax, 0x12a
movsx ecx, di
add ecx, edx
push eax
push ecx
movsx eax, di
mov dword [ebp - 0x150], ecx
mov ecx, esi
push eax
call fcn.0045d060
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_SKILLDLG16
lea ecx, [ebp - 0x11c]
call fcn.0040f9f0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 8
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x522547
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0x140]
mov ecx, esi
cwde
add eax, 0x139
push eax
push dword [ebp - 0x150]
movsx eax, di
push eax
call fcn.0045d060
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_SKILLDLG17
lea ecx, [ebp - 0x11c]
call fcn.0040f9f0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 9
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x5225b0
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0x140]
mov ecx, esi
cwde
add eax, 0x148
push eax
push dword [ebp - 0x150]
movsx eax, di
push eax
call fcn.0045d060
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
movsx ecx, word [ebp + 8]
movsx eax, di
add eax, 0x1f
cmp ecx, eax
jl 0x52263f
movsx eax, di
add eax, 0x5e
cmp ecx, eax
jg 0x52263f
mov ecx, dword [ebp - 0x140]
mov ax, word [ebp + 0xc]
movsx edx, cx
add edx, 0x15a
cwde
mov dword [ebp - 0x138], edx
cmp eax, edx
jl 0x52263f
mov edi, dword [ebp - 0x13c]
movsx eax, cx
movsx ecx, word [ebp + 0xc]
add eax, 0x16d
cmp ecx, eax
jg 0x52263f
mov ecx, 6
lea eax, [ecx + 0xe]
jmp 0x52265b
mov eax, dword [ebp - 0x140]
movsx edx, ax
mov eax, 7
add edx, 0x15a
xor ecx, ecx
mov dword [ebp - 0x138], edx
push eax
push ecx
push ecx
push str.Back
movsx eax, di
mov ecx, esi
push edx
add eax, 0x18
push eax
call fcn.0045dd00
cmp byte [esi + 0x1424e4], 1
movsx ecx, di
jne 0x52268b
mov edx, dword [ebp - 0x138]
xor eax, eax
lea edi, [eax + 7]
jmp 0x5226e7
mov dx, word [ebp + 8]
lea eax, [ecx + 0x9f]
movsx ecx, dx
cmp ecx, eax
jl 0x5226d7
movsx ecx, di
movsx eax, dx
add ecx, 0xfe
mov edx, dword [ebp - 0x138]
cmp eax, ecx
jg 0x5226dd
movsx ecx, word [ebp + 0xc]
cmp ecx, edx
jl 0x5226dd
mov eax, dword [ebp - 0x140]
cwde
add eax, 0x16d
cmp ecx, eax
jg 0x5226dd
mov eax, 6
movsx ecx, di
lea edi, [eax + 0xe]
jmp 0x5226e7
mov edx, dword [ebp - 0x138]
mov eax, 0xa
movsx ecx, di
mov edi, eax
movzx edi, di
add ecx, 0x98
push edi
movzx eax, ax
push eax
push eax
mov dword [ebp - 0x150], str.Manufacture
push dword [ebp - 0x150]
push edx
push ecx
jmp 0x52372d
push str.DRAW_DIALOGBOX_SKILLDLG18
lea ecx, [ebp - 0x11c]
call fcn.0040f9f0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 0xa
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x52273d
mov eax, dword [eax]
mov ecx, dword [ebp - 0x158]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0x140]
movsx edx, cx
cwde
add eax, 0x10c
movsx ecx, di
add ecx, edx
push eax
push ecx
movsx eax, di
mov dword [ebp - 0x158], ecx
mov ecx, esi
push eax
call fcn.0045d060
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_SKILLDLG19
lea ecx, [ebp - 0x11c]
call fcn.0040f9f0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 0xb
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x5227b5
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0x140]
mov ecx, esi
cwde
add eax, 0x11b
push eax
push dword [ebp - 0x158]
movsx eax, di
push eax
call fcn.0045d060
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_SKILLDLG20
lea ecx, [ebp - 0x11c]
call fcn.0040f9f0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 0xc
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x52281e
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0x140]
mov ecx, esi
cwde
add eax, 0x12a
push eax
push dword [ebp - 0x158]
movsx eax, di
push eax
call fcn.0045d060
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
movsx ecx, word [ebp + 8]
movsx eax, di
add eax, 0x1f
cmp ecx, eax
jl 0x5228c0
movsx eax, di
add eax, 0x5e
cmp ecx, eax
jg 0x5228c0
mov ecx, dword [ebp - 0x140]
movsx eax, word [ebp + 0xc]
movsx edx, cx
add edx, 0x15a
cmp eax, edx
jl 0x5228c0
movsx eax, cx
movsx ecx, word [ebp + 0xc]
add eax, 0x16d
cmp ecx, eax
jg 0x5228c0
movsx ecx, di
mov eax, 6
mov edi, 0x14
mov dword [ebp - 0x150], str.Back
push edi
push eax
push eax
push dword [ebp - 0x150]
add ecx, 0x18
push edx
push ecx
jmp 0x52372d
mov eax, dword [ebp - 0x140]
movsx ecx, di
mov edi, 7
movsx edx, ax
add ecx, 0x18
push edi
add edx, 0x15a
mov dword [ebp - 0x150], str.Back
xor eax, eax
push eax
push eax
push dword [ebp - 0x150]
push edx
push ecx
jmp 0x52372d
movzx ecx, word [esi + 0x1424d8]
movzx eax, word [esi + 0x1424d6]
push 0
push 0
push 0
movsx edi, cx
mov dword [ebp - 0x140], eax
push edi
cwde
push eax
mov dword [ebp - 0x138], ecx
mov ecx, esi
push 0x3e
call fcn.0043d1d0
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 8
push edi
movsx eax, cx
mov ecx, esi
push eax
push 0x46
call fcn.0043d1d0
movsx eax, byte [esi + 0x1424e0]
push 0
mov ecx, dword [esi + eax*4 + 0x186a5c]
movzx eax, byte [ecx + 0x30]
push eax
movzx eax, word [ecx + 0x2c]
push eax
mov eax, dword [ebp - 0x138]
add eax, 0x5e
push eax
mov eax, dword [ebp - 0x140]
add eax, 0x42
push eax
push 0
push dword [ecx + 0x28]
mov ecx, esi
push 0x12c
call fcn.0047dec0
push 0x78
lea eax, [ebp - 0x88]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movsx eax, byte [esi + 0x1424e0]
add esp, 0xc
mov ecx, esi
mov eax, dword [esi + eax*4 + 0x186a5c]
push 1
push 0
add eax, 8
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x88]
mov ecx, esi
push 0
push 0xffffff
push eax
lea eax, [edi + 0x30]
mov edi, dword [ebp - 0x140]
push eax
movsx eax, di
add eax, 0x71
push eax
call fcn.0045d450
xorps xmm0, xmm0
mov dword [ebp - 0x10c], 0
push 0x18
movups xmmword [ebp - 0x11c], xmm0
mov dword [ebp - 0x108], 0
push str.DRAW_DIALOGBOX_SKILLDLG7
lea ecx, [ebp - 0x11c]
call fcn.0040b5c0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x15c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov ecx, dword [eax]
add ecx, 0x20
cmp dword [ecx + 0x14], 0xf
jbe 0x522a4c
mov ecx, dword [ecx]
movsx eax, byte [esi + 0x1424e0]
mov eax, dword [esi + eax*4 + 0x186a5c]
push dword [eax + 0x24]
push dword [eax + 0x20]
lea eax, [ebp - 0x88]
push ecx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x108]
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x522ab2
mov edx, dword [ebp - 0x11c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x522aa8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52376f
push ecx
push edx
call fcn.005aa4e8
add esp, 8
push 0
push 0x19192d
lea eax, [ebp - 0x88]
mov ecx, esi
push eax
mov eax, dword [ebp - 0x138]
cwde
add eax, 0x4e
push eax
movsx eax, di
add eax, 0x71
push eax
call fcn.0045d450
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x10c], 0
push str.DRAW_DIALOGBOX_SKILLDLG8
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x108], 0
movups xmmword [ebp - 0x11c], xmm0
call fcn.0040b5c0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x15c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x522b35
mov eax, dword [eax]
push 0
push 0x19192d
push eax
mov eax, dword [ebp - 0x138]
mov ecx, esi
cwde
add eax, 0x62
push eax
movsx eax, di
add eax, 0x71
push eax
call fcn.0045d450
mov ecx, dword [ebp - 0x108]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x522b97
mov edx, dword [ebp - 0x11c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x522b8d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x523774
push ecx
push edx
call fcn.005aa4e8
add esp, 8
movsx eax, byte [esi + 0x1424e0]
mov edi, 4
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 0xb4], 0
je 0x522c2c
push 1
push 0
add eax, 0x31
mov ecx, esi
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
movsx eax, byte [esi + 0x1424e0]
add esp, 0xc
mov ecx, 0x19192d
mov eax, dword [esi + eax*4 + 0x186a5c]
push 0
cmp dword [eax + 0xd0], 1
mov eax, 0x787878
cmovne ecx, eax
lea eax, [ebp - 0x88]
push ecx
push eax
mov eax, dword [ebp - 0x138]
mov ecx, esi
cwde
add eax, 0x71
push eax
mov eax, dword [ebp - 0x140]
cwde
add eax, 0x7b
push eax
call fcn.0045d450
mov edi, 5
movsx eax, byte [esi + 0x1424e0]
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 0xb8], 0
je 0x522cc1
push 1
push 0
add eax, 0x46
mov ecx, esi
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
movsx eax, byte [esi + 0x1424e0]
add esp, 0xc
mov ecx, 0x19192d
mov eax, dword [esi + eax*4 + 0x186a5c]
push 0
cmp dword [eax + 0xd4], 1
mov eax, 0x787878
cmovne ecx, eax
lea eax, [ebp - 0x88]
push ecx
push eax
mov eax, dword [ebp - 0x138]
mov ecx, edi
cwde
shl ecx, 4
add eax, 0x35
sub ecx, edi
add eax, ecx
mov ecx, esi
push eax
mov eax, dword [ebp - 0x140]
cwde
add eax, 0x7b
push eax
call fcn.0045d450
inc edi
movsx eax, byte [esi + 0x1424e0]
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 0xbc], 0
je 0x522d56
push 1
push 0
add eax, 0x5b
mov ecx, esi
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
movsx eax, byte [esi + 0x1424e0]
add esp, 0xc
mov ecx, 0x19192d
mov eax, dword [esi + eax*4 + 0x186a5c]
push 0
cmp dword [eax + 0xd8], 1
mov eax, 0x787878
cmovne ecx, eax
lea eax, [ebp - 0x88]
push ecx
push eax
mov eax, dword [ebp - 0x138]
mov ecx, edi
cwde
shl ecx, 4
add eax, 0x35
sub ecx, edi
add eax, ecx
mov ecx, esi
push eax
mov eax, dword [ebp - 0x140]
cwde
add eax, 0x7b
push eax
call fcn.0045d450
inc edi
movsx eax, byte [esi + 0x1424e0]
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 0xc0], 0
je 0x522deb
push 1
push 0
add eax, 0x70
mov ecx, esi
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
movsx eax, byte [esi + 0x1424e0]
add esp, 0xc
mov ecx, 0x19192d
mov eax, dword [esi + eax*4 + 0x186a5c]
push 0
cmp dword [eax + 0xdc], 1
mov eax, 0x787878
cmovne ecx, eax
lea eax, [ebp - 0x88]
push ecx
push eax
mov eax, dword [ebp - 0x138]
mov ecx, edi
cwde
shl ecx, 4
add eax, 0x35
sub ecx, edi
add eax, ecx
mov ecx, esi
push eax
mov eax, dword [ebp - 0x140]
cwde
add eax, 0x7b
push eax
call fcn.0045d450
inc edi
movsx eax, byte [esi + 0x1424e0]
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 0xc4], 0
je 0x522e86
push 1
push 0
add eax, 0x85
mov ecx, esi
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
movsx eax, byte [esi + 0x1424e0]
add esp, 0xc
mov ecx, 0x787878
mov eax, dword [esi + eax*4 + 0x186a5c]
push 0
cmp dword [eax + 0xe0], 1
mov eax, 0x19192d
cmovne eax, ecx
mov ecx, edi
push eax
lea eax, [ebp - 0x88]
shl ecx, 4
push eax
mov eax, dword [ebp - 0x138]
sub ecx, edi
cwde
add eax, 0x35
add eax, ecx
mov ecx, esi
push eax
mov eax, dword [ebp - 0x140]
cwde
add eax, 0x7b
push eax
call fcn.0045d450
inc edi
movsx eax, byte [esi + 0x1424e0]
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 0xc8], 0
je 0x522f22
push 1
push 0
add eax, 0x9a
mov ecx, esi
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x138]
mov ecx, edi
cwde
add esp, 0xc
shl ecx, 4
sub ecx, edi
lea edx, [eax + 0x35]
mov eax, dword [ebp - 0x140]
add edx, ecx
movsx ecx, ax
movsx eax, byte [esi + 0x1424e0]
add ecx, 0x7b
push 0
mov eax, dword [esi + eax*4 + 0x186a5c]
cmp dword [eax + 0xe4], 1
lea eax, [ebp - 0x88]
jne 0x522f13
push 0x19192d
jmp 0x522f18
push 0x787878
push eax
push edx
push ecx
mov ecx, esi
call fcn.0045d450
mov eax, dword [ebp - 0x138]
mov edi, dword [ebp - 0x148]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
cwde
push 0
push 1
push edi
lea ecx, [eax + 0xe4]
mov eax, dword [ebp - 0x140]
push 2
cwde
add eax, 0x61
mov dword [ebp - 0x13c], ecx
push ecx
mov ecx, dword [esi + 0x14a978]
push eax
mov dword [ebp - 0x158], eax
call fcn.0057e2f0
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push 2
push dword [ebp - 0x13c]
movsx eax, cx
mov ecx, dword [esi + 0x14a978]
add eax, 0x8e
push eax
mov dword [ebp - 0x150], eax
call fcn.0057e2f0
mov ecx, dword [ebp - 0x140]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push edi
push 2
push dword [ebp - 0x13c]
movsx eax, cx
mov ecx, dword [esi + 0x14a978]
add eax, 0xbb
push eax
mov dword [ebp - 0x14c], eax
call fcn.0057e2f0
mov edx, dword [ebp - 0x138]
push 0
mov ecx, dword [esi + 0x14a978]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x148]
movsx edi, dx
push 2
add edi, 0x111
push edi
push dword [ebp - 0x158]
call fcn.0057e2f0
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x148]
push 2
mov ecx, dword [esi + 0x14a978]
push edi
push dword [ebp - 0x150]
call fcn.0057e2f0
push 0
mov ecx, dword [esi + 0x14a978]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x148]
push 2
push edi
push dword [ebp - 0x14c]
call fcn.0057e2f0
mov ecx, dword [esi + 0x142480]
mov edi, dword [ebp - 0x148]
cmp ecx, 0xffffffff
je 0x5230a6
mov ecx, dword [esi + ecx*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [ecx + 0x22]
movsx ecx, word [ecx + 0x20]
push 0xffffffffffffffff
push 0
push 0
mov ecx, dword [esi + ecx*4 + 0x14adbc]
push 1
push edi
push eax
push dword [ebp - 0x13c]
push dword [ebp - 0x158]
call fcn.0057e2f0
mov ecx, dword [esi + 0x142484]
cmp ecx, 0xffffffff
je 0x5230e8
mov ecx, dword [esi + ecx*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [ecx + 0x22]
movsx ecx, word [ecx + 0x20]
push 0xffffffffffffffff
push 0
push 0
mov ecx, dword [esi + ecx*4 + 0x14adbc]
push 1
push edi
push eax
push dword [ebp - 0x13c]
push dword [ebp - 0x150]
call fcn.0057e2f0
mov ecx, dword [esi + 0x142488]
cmp ecx, 0xffffffff
je 0x52312a
mov ecx, dword [esi + ecx*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [ecx + 0x22]
movsx ecx, word [ecx + 0x20]
push 0xffffffffffffffff
push 0
push 0
mov ecx, dword [esi + ecx*4 + 0x14adbc]
push 1
push edi
push eax
push dword [ebp - 0x13c]
push dword [ebp - 0x14c]
call fcn.0057e2f0
mov ecx, dword [esi + 0x14248c]
cmp ecx, 0xffffffff
je 0x523178
mov ecx, dword [esi + ecx*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [ecx + 0x22]
movsx ecx, word [ecx + 0x20]
push 0xffffffffffffffff
push 0
push 0
mov ecx, dword [esi + ecx*4 + 0x14adbc]
push 1
push edi
push eax
mov eax, dword [ebp - 0x138]
cwde
add eax, 0x111
push eax
mov eax, dword [ebp - 0x140]
cwde
add eax, 0x61
push eax
call fcn.0057e2f0
mov ecx, dword [esi + 0x142490]
cmp ecx, 0xffffffff
je 0x5231c8
mov ecx, dword [esi + ecx*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [ecx + 0x22]
movsx ecx, word [ecx + 0x20]
push 0xffffffffffffffff
push 0
push 0
mov ecx, dword [esi + ecx*4 + 0x14adbc]
push 1
push edi
push eax
mov eax, dword [ebp - 0x138]
cwde
add eax, 0x111
push eax
mov eax, dword [ebp - 0x140]
cwde
add eax, 0x8e
push eax
call fcn.0057e2f0
mov ecx, dword [esi + 0x142494]
cmp ecx, 0xffffffff
je 0x523218
mov ecx, dword [esi + ecx*4 + 0x18558c]
push 0
push 0
push 0xffffffffffffffff
movsx eax, word [ecx + 0x22]
movsx ecx, word [ecx + 0x20]
push 0xffffffffffffffff
push 0
push 0
mov ecx, dword [esi + ecx*4 + 0x14adbc]
push 1
push edi
push eax
mov eax, dword [ebp - 0x138]
cwde
add eax, 0x111
push eax
mov eax, dword [ebp - 0x140]
cwde
add eax, 0xbb
push eax
call fcn.0057e2f0
push 0x19
xorps xmm0, xmm0
mov dword [ebp - 0x10c], 0
push str.DRAW_DIALOGBOX_SKILLDLG29
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x108], 0
movups xmmword [ebp - 0x11c], xmm0
call fcn.0040b5c0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x15c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x523274
mov eax, dword [eax]
push 0
push 0x191937
push eax
mov eax, dword [ebp - 0x138]
mov ecx, esi
cwde
add eax, 0x12a
push eax
mov eax, dword [ebp - 0x140]
cwde
add eax, 0x20
push eax
call fcn.0045d450
mov ecx, dword [ebp - 0x108]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x5232dc
mov edx, dword [ebp - 0x11c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x5232d2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x523779
push ecx
push edx
call fcn.005aa4e8
add esp, 8
push 0x19
xorps xmm0, xmm0
mov dword [ebp - 0x10c], 0
push str.DRAW_DIALOGBOX_SKILLDLG30
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x108], 0
movups xmmword [ebp - 0x11c], xmm0
call fcn.0040b5c0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x15c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x523338
mov eax, dword [eax]
push 0
push 0x191937
push eax
mov eax, dword [ebp - 0x138]
mov ecx, esi
cwde
add eax, 0x139
push eax
mov eax, dword [ebp - 0x140]
cwde
add eax, 0x20
push eax
call fcn.0045d450
mov eax, dword [ebp - 0x108]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xf
jbe 0x523387
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x11c]
push eax
call fcn.0047d060
add esp, 0xc
mov eax, edi
sub eax, dword [esi + 0x1424c0]
cmp eax, 0x3e8
jbe 0x5233b5
mov dword [esi + 0x1424c0], edi
mov al, byte [esi + 0x1424e1]
inc al
mov byte [esi + 0x1424e1], al
cmp al, 7
jl 0x5233b5
mov byte [esi + 0x1424e1], 7
cmp byte [esi + 0x1424e1], 4
jne case.default.0x5202fc
movsx eax, byte [esi + 0x1424e0]
mov ecx, esi
push 0
mov eax, dword [esi + eax*4 + 0x186a5c]
add eax, 8
push eax
push 0
push 0
push 0
push 0
push 0xa23
push 0xfa314dc
call fcn.00493690
inc byte [esi + 0x1424e1]
jmp case.default.0x5202fc
movzx ecx, word [esi + 0x1424d8]
movzx eax, word [esi + 0x1424d6]
push 0
push 0
push 0
movsx edi, cx
mov dword [ebp - 0x158], eax
cwde
push edi
push eax
mov dword [ebp - 0x150], ecx
mov ecx, esi
push 0x3e
mov dword [ebp - 0x13c], eax
call fcn.0043d1d0
push 0
push 0
push 8
push edi
push dword [ebp - 0x13c]
mov ecx, esi
push 0x46
call fcn.0043d1d0
movsx eax, byte [esi + 0x1424e0]
push 0
mov ecx, dword [esi + eax*4 + 0x186a5c]
movzx eax, byte [ecx + 0x30]
push eax
movzx eax, word [ecx + 0x2c]
push eax
mov eax, dword [ebp - 0x150]
add eax, 0x5e
push eax
mov eax, dword [ebp - 0x158]
add eax, 0x42
push eax
push 0
push dword [ecx + 0x28]
mov ecx, esi
push 0x12c
call fcn.0047dec0
push 0x78
lea eax, [ebp - 0x88]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movsx eax, byte [esi + 0x1424e0]
add esp, 0xc
mov ecx, esi
mov eax, dword [esi + eax*4 + 0x186a5c]
push 1
push 0
add eax, 8
push eax
call fcn.0052f9e0
lea eax, [esi + 0x18966d]
push eax
lea eax, [ebp - 0x88]
push 0x5c7a40
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x88]
mov ecx, esi
push 0
push 0xffffff
push eax
lea eax, [edi + 0x30]
push eax
mov eax, dword [ebp - 0x13c]
add eax, 0x71
push eax
call fcn.0045d450
cmp byte [esi + 0x1424e2], 1
jne 0x523659
push str.DRAW_DIALOGBOX_SKILLDLG31
lea ecx, [ebp - 0x11c]
call fcn.0040f9f0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 0x11
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
mov ecx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x523532
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x13c]
lea eax, [edi + 0x94]
push 0
push 0x191937
push ecx
add edx, 0x2b
mov ecx, esi
push eax
push edx
mov dword [ebp - 0x14c], edx
call fcn.0045d450
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
cmp dword [esi + 0x142480], 0xc
lea ecx, [ebp - 0x11c]
jne 0x5235d7
push str.DRAW_DIALOGBOX_SKILLDLG32
call fcn.0040f9f0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 0x12
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x5235a3
mov eax, dword [eax]
movsx ecx, byte [esi + 0x1424e3]
lea edx, [esi + 0x18d57f]
push ecx
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
push edx
call eax
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c]
call fcn.00411640
mov edx, dword [ebp - 0x14c]
jmp 0x523639
push str.DRAW_DIALOGBOX_SKILLDLG33
call fcn.0040f9f0
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 0x13
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x523601
mov eax, dword [eax]
movsx ecx, byte [esi + 0x1424e3]
lea edx, [esi + 0x18d57f]
add ecx, 0x64
push ecx
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
push edx
call eax
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c]
call fcn.00411640
mov edx, dword [ebp - 0x13c]
add edx, 0x20
push 0
push 0x191937
lea eax, [esi + 0x18d57f]
mov ecx, esi
push eax
mov eax, 0xa3
add eax, edi
push eax
push edx
call fcn.0045d450
jmp 0x5236bb
push str.DRAW_DIALOGBOX_SKILLDLG34
lea ecx, [ebp - 0x134]
call fcn.0040f9f0
lea eax, [ebp - 0x134]
mov dword [ebp - 4], 0x14
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x523689
mov eax, dword [eax]
push 0
push 0x191937
push eax
lea eax, [edi + 0xc1]
mov ecx, esi
push eax
mov eax, dword [ebp - 0x13c]
add eax, 0x2b
push eax
call fcn.0045d450
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
mov ecx, dword [ebp - 0x158]
movsx edx, word [ebp + 8]
movsx eax, cx
add eax, 0x1f
cmp edx, eax
jl 0x52370e
movsx eax, cx
add eax, 0x5e
cmp edx, eax
jg 0x52370e
mov edx, dword [ebp - 0x150]
movsx eax, word [ebp + 0xc]
movsx edi, dx
add edi, 0x15a
cmp eax, edi
jl 0x52370e
movsx eax, dx
movsx edx, word [ebp + 0xc]
add eax, 0x16d
cmp edx, eax
jg 0x52370e
push 0x14
push 6
push 6
push str.Back
push edi
jmp 0x523726
mov eax, dword [ebp - 0x150]
push 7
push 0
push 0
cwde
push str.Back
add eax, 0x15a
push eax
movsx eax, cx
add eax, 0x22
push eax
mov ecx, esi
call fcn.0045dd00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005aa550
mov esp, ebp
pop ebp
ret 0x10
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
nop
and dword [edx], ecx
push edx
add byte [eax], al
push cs
push edx
add cl, bh
adc dword [edx], edx
in eax, dx
sbb dl, byte [edx]
imul byte [eax]
push edx
add dl, bh
xor edx, dword [edx]
add eax, dword [ebx]
push edx
add byte [esi + 6], bh
push edx
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ba825
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5f8800]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp word [esi + 0x145954], 3
jne 0x5237f6
cmp dword [esi + 0x18c0ec], 0
je 0x5238a1
mov ecx, dword [esi + 0x18c0f0]
call fcn.00576b00
test al, al
jne 0x5238a1
xor edi, edi
mov dword [ebp - 0x60], edi
cmp dword [esi + 0x145834], edi
jne 0x523811
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [esi + 0x145834], eax
jmp 0x523827
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [esi + 0x145834]
cdq
mov edi, eax
xor edi, edx
sub edi, edx
mov dword [ebp - 0x60], edi
movzx eax, word [esi + 0x14584a]
mov dx, word [ebp + 8]
mov dword [ebp - 0x4c], eax
cmp ax, dx
jge 0x523883
movsx ecx, word [esi + 0x14584e]
cwde
add ecx, eax
movsx eax, dx
cmp ecx, eax
jle 0x523883
movzx eax, word [esi + 0x14584c]
mov dx, word [ebp + 0xc]
cmp ax, dx
jge 0x523883
movsx ecx, word [esi + 0x145850]
cwde
add ecx, eax
movsx eax, dx
cmp ecx, eax
jle 0x523883
xor edi, edi
mov eax, 0x51eb851f
mul edi
mov dword [ebp - 0x60], edi
mov dword [esi + 0x145834], edi
shr edx, 5
jmp 0x5238c8
movsx eax, word [esi + 0x145954]
sub eax, 1
je 0x5238af
sub eax, 1
je 0x5238af
sub eax, 1
je 0x5238af
cmp edi, 0xea60
jbe 0x5238af
push 0x3f
mov ecx, esi
call fcn.00415190
jmp case.default.0x524275
cmp edi, 0x1f40
jae 0x5238c3
mov eax, 0x51eb851f
mul edi
shr edx, 5
jmp 0x5238c8
mov edx, 0x50
xor ecx, ecx
mov eax, 7
cmp byte [esi + 0x18bfbe], cl
cmovne eax, ecx
mov ecx, dword [ebp - 0x4c]
sub ax, word [esi + 0x145850]
sub ax, word [esi + 0x142a6c]
add ax, dx
movzx ecx, cx
add ax, word [0x5fd398]
movzx edi, ax
mov word [esi + 0x14584c], ax
mov eax, dword [ebp - 0x60]
movsx edx, di
movsx ecx, cx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x64], ecx
cmp eax, 0x1b58
jb 0x52392e
mov eax, dword [esi + 0x189300]
push eax
push 6
push edx
push ecx
mov ecx, dword [esi + 0x14aa00]
call fcn.0057ebe0
jmp 0x52398a
cmp eax, 0x1388
jb 0x52394d
mov eax, dword [esi + 0x189300]
push eax
push 6
push edx
push ecx
mov ecx, dword [esi + 0x14aa00]
call fcn.0057ec90
jmp 0x52398a
cmp eax, 0x7d0
mov eax, dword [esi + 0x189300]
jb 0x52396c
push eax
push 6
push edx
push ecx
mov ecx, dword [esi + 0x14aa00]
call fcn.0057ece0
jmp 0x52398a
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push eax
push 6
push edx
push ecx
mov ecx, dword [esi + 0x14aa00]
call fcn.0057e2f0
movsx eax, word [esi + 0x145954]
cmp eax, 3
ja case.default.0x52399a
jmp dword [eax*4 + 0x52484c]
lea ecx, [esi + 0x145894]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5239b0
mov eax, dword [ebp - 0x64]
sub ecx, edx
lea edx, [eax + 0xde]
lea ecx, [eax + 0xf]
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], ecx
je 0x523a41
push 0
push 0x32
push 0
push 4
lea eax, [esi + 0x145854]
push eax
mov eax, dword [ebp - 0x50]
add eax, 0xf
push eax
push edx
push ecx
mov ecx, esi
call fcn.0045d060
push 0
push 0x32
push 0
push 4
lea eax, [esi + 0x145894]
mov ecx, esi
push eax
movsx eax, di
add eax, 0x1e
push eax
push dword [ebp - 0x64]
push dword [ebp - 0x60]
call fcn.0045d060
lea edx, [esi + 0x1458d4]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x50], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x523a20
sub ecx, dword [ebp - 0x50]
je case.default.0x52399a
push 0
push 0x32
push 0
push 4
movsx eax, di
push edx
add eax, 0x2d
push eax
push dword [ebp - 0x64]
jmp 0x523a9d
lea ecx, [esi + 0x1458d4]
lea eax, [ecx + 1]
mov dword [ebp - 0x58], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x523a50
lea eax, [esi + 0x145854]
push 0
push 0x32
push 0
push 4
push eax
mov eax, dword [ebp - 0x50]
sub ecx, dword [ebp - 0x58]
je 0x523a98
add eax, 0xf
mov ecx, esi
push eax
push edx
push dword [ebp - 0x60]
call fcn.0045d060
push 0
push 0x32
push 0
push 4
lea eax, [esi + 0x1458d4]
push eax
movsx eax, di
add eax, 0x2d
push eax
push dword [ebp - 0x64]
jmp 0x523a9d
add eax, 0x1e
push eax
push edx
push dword [ebp - 0x60]
mov ecx, esi
call fcn.0045d060
movsx eax, word [esi + 0x145954]
sub eax, 1
je 0x523fde
sub eax, 1
je 0x523d75
sub eax, 1
jne 0x524265
mov eax, dword [ebp - 0x4c]
movsx edx, word [ebp + 8]
movzx ecx, ax
movsx eax, cx
add eax, 0xf
mov dword [ebp - 0x64], eax
cmp edx, eax
jle 0x523c2b
movsx eax, cx
add eax, 0x3c
cmp edx, eax
jge 0x523c2b
movsx ecx, word [ebp + 0xc]
movsx eax, di
add eax, 0x3c
mov dword [ebp - 0x50], eax
cmp ecx, eax
jle 0x523c2b
movsx eax, di
add eax, 0x4b
cmp ecx, eax
jge 0x523c2b
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SNB_MENU6]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5da014]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 8
push eax
lea eax, [ebp - 0x5c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x523b86
mov eax, dword [eax]
push 0
push 0xffffff
push eax
push dword [ebp - 0x50]
mov ecx, esi
push dword [ebp - 0x64]
call fcn.0045d450
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SNB_MENU6]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5da014]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 9
push eax
lea eax, [ebp - 0x5c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x523c1b
mov eax, dword [eax]
push 0
push 0xffffff
push eax
push dword [ebp - 0x50]
jmp 0x5240ad
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SNB_MENU6]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5da014]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x5c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x523c9c
mov eax, dword [eax]
push 0
push 0x320004
push eax
movsx eax, di
mov ecx, esi
add eax, 0x3c
push eax
push dword [ebp - 0x64]
call fcn.0045d450
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x523cf0
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x523ce6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52481e
push ecx
push edx
call fcn.005aa4e8
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SNB_MENU6]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5da014]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x5c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x523d61
mov eax, dword [eax]
push 0
push 0x320004
push eax
movsx eax, di
add eax, 0x3c
push eax
jmp 0x5240ad
mov eax, dword [ebp - 0x4c]
movsx edx, word [ebp + 8]
movzx ecx, ax
movsx eax, cx
add eax, 0xf
mov dword [ebp - 0x64], eax
cmp edx, eax
jle 0x523e49
movsx eax, cx
add eax, 0x3c
cmp edx, eax
jge 0x523e49
movsx ecx, word [ebp + 0xc]
movsx eax, di
add eax, 0x3c
mov dword [ebp - 0x50], eax
cmp ecx, eax
jle 0x523e49
movsx eax, di
add eax, 0x4b
cmp ecx, eax
jge 0x523e49
push str.DRAW_DIALOGBOX_SNB_MENU4
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 4
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x523deb
mov eax, dword [eax]
push 0
push 0xffffff
push eax
push dword [ebp - 0x50]
mov ecx, esi
push dword [ebp - 0x64]
call fcn.0045d450
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_SNB_MENU4
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 5
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x523e39
mov eax, dword [eax]
push 0
push 0xffffff
push eax
push dword [ebp - 0x50]
jmp 0x5240ad
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SNB_MENU4]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d9ff8]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 6
push eax
lea eax, [ebp - 0x5c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x523eba
mov eax, dword [eax]
push 0
push 0x320004
push eax
movsx eax, di
mov ecx, esi
add eax, 0x3c
push eax
push dword [ebp - 0x64]
call fcn.0045d450
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x523f0e
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x523f04
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x524823
push ecx
push edx
call fcn.005aa4e8
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SNB_MENU4]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d9ff8]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 7
push eax
lea eax, [ebp - 0x5c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x523f7f
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4c]
push 0
push 0x320004
push eax
movsx eax, di
add eax, 0x3c
push eax
movzx eax, cx
mov ecx, esi
cwde
add eax, 0x10
push eax
call fcn.0045d450
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x524265
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x52425b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x524828
jmp 0x52425b
mov eax, dword [ebp - 0x4c]
movsx edx, word [ebp + 8]
movzx ecx, ax
movsx eax, cx
add eax, 0xf
mov dword [ebp - 0x64], eax
cmp edx, eax
jle 0x5240d3
movsx eax, cx
add eax, 0x3c
cmp edx, eax
jge 0x5240d3
movsx ecx, word [ebp + 0xc]
movsx eax, di
add eax, 0x3c
mov dword [ebp - 0x50], eax
cmp ecx, eax
jle 0x5240d3
movsx eax, di
add eax, 0x4b
cmp ecx, eax
jge 0x5240d3
push str.DRAW_DIALOGBOX_SNB_MENU3
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x524054
mov eax, dword [eax]
push 0
push 0xffffff
push eax
push dword [ebp - 0x50]
mov ecx, esi
push dword [ebp - 0x64]
call fcn.0045d450
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_SNB_MENU3
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 1
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x5240a2
mov eax, dword [eax]
push 0
push 0xffffff
push eax
push dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
movzx eax, cx
mov ecx, esi
cwde
add eax, 0x10
push eax
call fcn.0045d450
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
jmp 0x524265
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SNB_MENU3]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d9fdc]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x5c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x524144
mov eax, dword [eax]
push 0
push 0x320004
push eax
movsx eax, di
mov ecx, esi
add eax, 0x3c
push eax
push dword [ebp - 0x64]
call fcn.0045d450
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x524198
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x52418e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52482d
push ecx
push edx
call fcn.005aa4e8
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SNB_MENU3]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d9fdc]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 3
push eax
lea eax, [ebp - 0x5c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x524209
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4c]
push 0
push 0x320004
push eax
movsx eax, di
add eax, 0x3c
push eax
movzx eax, cx
mov ecx, esi
cwde
add eax, 0x10
push eax
call fcn.0045d450
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x524265
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x52425b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x524832
push ecx
push edx
call fcn.005aa4e8
add esp, 8
movsx eax, word [esi + 0x145954]
cmp eax, 3
ja case.default.0x524275
jmp dword [eax*4 + 0x52485c]
mov eax, dword [ebp - 0x4c]
movsx edx, word [ebp + 8]
movzx ecx, ax
movsx eax, cx
add eax, 0xc3
mov dword [ebp - 0x50], eax
cmp edx, eax
jle 0x524427
movsx eax, cx
add eax, 0xeb
cmp edx, eax
jge 0x524427
movsx ecx, word [ebp + 0xc]
movsx eax, di
add eax, 0x3c
mov dword [ebp - 0x58], eax
cmp ecx, eax
jle 0x524427
movsx eax, di
add eax, 0x4b
cmp ecx, eax
jge 0x524427
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SNB_MENU1]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5da030]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x68]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x52433d
mov eax, dword [eax]
mov edi, dword [ebp - 0x58]
mov ecx, esi
push 0
push 0xffffff
push eax
push edi
push dword [ebp - 0x50]
call fcn.0045d450
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SNB_MENU1]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5da030]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x5c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x5243d3
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4c]
push 0
push 0xffffff
push eax
movzx eax, cx
mov ecx, esi
cwde
push edi
add eax, 0xc4
push eax
call fcn.0045d450
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe case.default.0x524275
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x5247f7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x524837
jmp 0x5247f7
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SNB_MENU1]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5da030]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x5c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x524498
mov eax, dword [eax]
push 0
push 0x320004
push eax
movsx eax, di
mov ecx, esi
add eax, 0x3c
push eax
push dword [ebp - 0x50]
call fcn.0045d450
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x5244ec
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x5244e2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52483c
push ecx
push edx
call fcn.005aa4e8
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SNB_MENU1]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5da030]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x5c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x52455d
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4c]
push 0
push 0x320004
push eax
movsx eax, di
add eax, 0x3c
push eax
movzx eax, cx
mov ecx, esi
cwde
add eax, 0xc4
push eax
call fcn.0045d450
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe case.default.0x524275
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x5247f7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x524841
jmp 0x5247f7
mov eax, dword [ebp - 0x4c]
movsx edx, word [ebp + 8]
movzx ecx, ax
movsx eax, cx
add eax, 0xc3
mov dword [ebp - 0x50], eax
cmp edx, eax
jle 0x5246aa
movsx eax, cx
add eax, 0xeb
cmp edx, eax
jge 0x5246aa
movsx ecx, word [ebp + 0xc]
movsx eax, di
add eax, 0x3c
mov dword [ebp - 0x58], eax
cmp ecx, eax
jle 0x5246aa
movsx eax, di
add eax, 0x4b
cmp ecx, eax
jge 0x5246aa
push str.DRAW_DIALOGBOX_SNB_MENU7
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x10
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x524631
mov eax, dword [eax]
mov edi, dword [ebp - 0x58]
mov ecx, esi
push 0
push 0xffffff
push eax
push edi
push dword [ebp - 0x50]
call fcn.0045d450
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_SNB_MENU7
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x11
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x524680
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4c]
push 0
push 0xffffff
push eax
movzx eax, cx
mov ecx, esi
cwde
push edi
add eax, 0xc4
push eax
call fcn.0045d450
lea ecx, [ebp - 0x2c]
call fcn.00411640
jmp case.default.0x524275
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SNB_MENU7]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5da04c]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x5c]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov ecx, dword [eax]
add ecx, 0x20
cmp dword [ecx + 0x14], 0xf
jbe 0x52471b
mov ecx, dword [ecx]
push 0
push 0x320004
push ecx
movsx edi, di
mov ecx, esi
add edi, 0x3c
push edi
push dword [ebp - 0x50]
call fcn.0045d450
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
push 0x20
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x34], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_SNB_MENU7]
mov dword [ebp - 0x48], eax
add esp, 4
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x34], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5da04c]
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x54]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x5247b4
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4c]
push 0
push 0x320004
push eax
movzx eax, cx
mov ecx, esi
cwde
push edi
add eax, 0xc4
push eax
call fcn.0045d450
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe case.default.0x524275
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x5247f7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x524846
push ecx
push edx
call fcn.005aa4e8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005aa550
mov esp, ebp
pop ebp
ret 8
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
nop
mov eax, dword [0xa1005239]
cmp dword [edx], edx
mov eax, dword [0xa1005239]
cmp dword [edx], edx
jl 0x5248a0
push edx
add byte [edx + eax*2 + 0x52], bh
add byte [edx + eax*2 + 0x52], bh
add byte [edi - 0x33ffadbb], dh
int3
mov bh, 0x87
xchg byte [0xb78b0014], dh
invalid