Function at 0x1004cec0
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x1013cba8]
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
cmp esi, dword [eax]
jne 0x1004e10e
mov al, byte [edi + 0x23]
and al, 0xf
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
cmp al, 1
jne 0x1004cf8f
mov ecx, dword [edi + 0x64]
cmp ecx, 0xffffffff
je 0x1004cf8f
mov eax, ecx
and eax, 0xff000000
cmp eax, 0x1000000
jne 0x1004cf8f
lea edx, [ebp - 0x10]
call fcn.1003bde0
cmp eax, 0xffffffff
je 0x1004cf8f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
and eax, 0x20
je 0x1004cf8f
call dword [0x10121524]
cmp dword [0x59e814], 0
jle 0x1004e10e
mov edx, 0x32
mov ecx, 0x59e814
call fcn.1003d220
cmp eax, 0xffffffff
je 0x1004e10e
mov ecx, dword [0x59e818]
add eax, eax
mov eax, dword [ecx + eax*8 + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call dword [0x1012171c]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
test byte [edi + 0x23], 0xf
jne 0x1004cff3
mov ecx, dword [edi + 0x64]
mov eax, ecx
shr eax, 0x18
test al, al
jne 0x1004cff3
lea edx, [ebp - 0x10]
call fcn.1003bde0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x20], 1
jne 0x1004cff3
cmp dword [edi + 0x18], 0
jne 0x1004cff3
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
call dword [0x10120ea0]
test eax, eax
je 0x1004cff3
movzx esi, word [eax + 8]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call dword [0x10120e98]
cmp esi, 1
ja 0x1004e10e
mov esi, dword [ebp - 0x1c]
cmp dword [0x51d430], 0
jne 0x1004d1ae
mov ecx, edi
call fcn.1006ce00
test al, al
jne 0x1004d1ae
mov edi, dword [edi + 0x78]
cmp edi, 0xffffffff
je 0x1004d1ab
lea edx, [ebp - 0x10]
mov ecx, edi
call fcn.1006e7b0
cmp eax, 0xffffffff
je 0x1004d037
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x38], esi
mov dword [eax + 0x3c], 0
cmp dword [0x51c714], 0
mov byte [ebp - 1], 0
je 0x1004d18f
lea edx, [ebp - 0x10]
mov ecx, edi
call fcn.1006e7b0
cmp eax, 0xffffffff
je 0x1004d18f
mov esi, dword [ebp - 0x10]
mov dword [esi + 0x44], 0
mov dword [esi + 0x28], 0
test byte [esi + 0x10], 1
jne 0x1004d0b2
mov eax, dword [esi + 0x14]
and eax, 0xffffff
lea ecx, [eax + eax*4]
mov eax, dword [0x51c7c8]
lea eax, [eax + ecx*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call dword [0x101214a4]
mov dword [esi + 0x18], eax
test eax, eax
jne 0x1004d0aa
push str._nError:_exec_script_proc:_script_load_failed_
call fcn.10016d10
add esp, 4
jmp 0x1004d18f
or dword [esi + 0x10], 1
mov byte [ebp - 1], 1
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1004d18f
mov ecx, 0x124
test word [eax + 0x80], cx
jne 0x1004d18f
mov eax, dword [esi + 0x64]
test eax, eax
jle 0x1004d0e8
push 0x28
push eax
mov edx, esi
mov ecx, 4
call fcn.100cd950
mov cl, byte [ebp - 1]
mov dword [ebp - 0x20], eax
test cl, cl
jne 0x1004d104
test eax, eax
jne 0x1004d104
mov eax, dword [esi + 0x58]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x1004d18f
cmp eax, 0xffffffff
je 0x1004d18f
cmp dword [esi + 0x3c], 0
jne 0x1004d119
mov eax, dword [esi + 0x34]
mov dword [esi + 0x3c], eax
or dword [esi + 0x10], 4
test cl, cl
je 0x1004d165
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
call dword [0x10121218]
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x1004d147
mov eax, dword [esi + 0x58]
mov ecx, 1
test eax, eax
cmove eax, ecx
mov dword [ebp - 0x20], eax
mov dword [esi + 0x2c], 0
mov eax, dword [ebp - 0x34]
call dword [0x10121224]
mov edx, 0xffffffff
mov eax, dword [ebp - 0x34]
call dword [0x10121570]
mov dword [esi + 0x2c], 4
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
call dword [0x101216d0]
mov edx, esi
mov ecx, 4
push 0x29
push 0
call fcn.100cd950
mov dword [esi + 0x38], 0
lea edx, [ebp - 0x10]
mov ecx, edi
call fcn.1006e7b0
cmp eax, 0xffffffff
je 0x1004d1ab
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x44], 0
jne 0x1004e10e
mov edi, dword [ebp - 0x18]
or eax, 0xffffffff
mov dword [ebp - 0x34], 0
push 0x1d3
mov edx, eax
lea ecx, [ebp - 0x34]
call fcn.10017610
cmp eax, 0xffffffff
je 0x1004e10e
call dword [0x10121540]
cmp eax, 0xffffffff
je 0x1004e10e
mov eax, dword [0x1013ca80]
lea ecx, [edi + 0x2c]
mov dword [eax], ecx
mov dword [0x59e81c], edi
mov dword [0x59e7ec], 0
mov eax, dword [0x1013ca84]
mov dword [eax], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call dword [0x101214f4]
xor esi, esi
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x10], esi
cmp dword [0x51d430], esi
jne 0x1004d240
mov ecx, edi
call fcn.1006ce00
test al, al
je 0x1004d432
mov eax, dword [ebp - 0x18]
call dword [0x1012153c]
mov esi, eax
mov dword [ebp - 0x50], esi
test esi, esi
je 0x1004d2e6
mov ecx, 9
call fcn.100cb410
test al, al
je 0x1004d2db
mov ecx, dword [0x10182300]
mov dword [ecx + 0x88], 5
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], 1
mov dword [ecx + 0x10], 0x473b2e
mov dword [ecx + 0x14], 0
call fcn.100cb290
mov ecx, dword [0x10182300]
test ecx, ecx
je 0x1004d2db
mov eax, dword [ecx + 0x84]
test eax, eax
jle 0x1004d2af
dec eax
mov dword [ecx + 0x84], eax
mov eax, dword [0x1013d39c]
sub eax, 1
mov dword [0x1013d39c], eax
jns 0x1004d2ca
mov dword [0x10182300], 0
jmp 0x1004d2db
imul eax, eax, 0x9c
add eax, dword [0x101552d4]
mov dword [0x10182300], eax
push 1
mov edx, esi
mov ecx, edi
call fcn.1001e450
mov eax, dword [ebp - 0x18]
call dword [0x10121538]
mov esi, eax
mov dword [ebp - 0x54], esi
test esi, esi
je 0x1004d38c
mov ecx, 9
call fcn.100cb410
test al, al
je 0x1004d381
mov ecx, dword [0x10182300]
mov dword [ecx + 0x88], 5
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], 1
mov dword [ecx + 0x10], 0x473b2e
mov dword [ecx + 0x14], 0
call fcn.100cb290
mov ecx, dword [0x10182300]
test ecx, ecx
je 0x1004d381
mov eax, dword [ecx + 0x84]
test eax, eax
jle 0x1004d355
dec eax
mov dword [ecx + 0x84], eax
mov eax, dword [0x1013d39c]
sub eax, 1
mov dword [0x1013d39c], eax
jns 0x1004d370
mov dword [0x10182300], 0
jmp 0x1004d381
imul eax, eax, 0x9c
add eax, dword [0x101552d4]
mov dword [0x10182300], eax
push 1
mov edx, esi
mov ecx, edi
call fcn.1001e450
mov eax, dword [ebp - 0x18]
call dword [0x10121528]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x1004d432
mov ecx, 9
call fcn.100cb410
test al, al
je 0x1004d427
mov ecx, dword [0x10182300]
mov dword [ecx + 0x88], 5
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], 1
mov dword [ecx + 0x10], 0x473b2e
mov dword [ecx + 0x14], 0
call fcn.100cb290
mov ecx, dword [0x10182300]
test ecx, ecx
je 0x1004d427
mov eax, dword [ecx + 0x84]
test eax, eax
jle 0x1004d3fb
dec eax
mov dword [ecx + 0x84], eax
mov eax, dword [0x1013d39c]
sub eax, 1
mov dword [0x1013d39c], eax
jns 0x1004d416
mov dword [0x10182300], 0
jmp 0x1004d427
imul eax, eax, 0x9c
add eax, dword [0x101552d4]
mov dword [0x10182300], eax
push 1
mov edx, esi
mov ecx, edi
call fcn.1001e450
push dword [ebp - 0x34]
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
push edi
push esi
call fcn.10046540
mov eax, dword [0x101558f4]
mov ecx, 6
cmp eax, 2
jl 0x1004d488
test eax, eax
je 0x1004d488
cmp dword [0x1013cf04], 0x2bc
jl 0x1004d488
mov edx, ecx
mov ecx, str.LOOT2.FRM
call fcn.10016460
mov dword [0x10174fe4], eax
test eax, eax
jne 0x1004d488
push str.LOOT2.FRM
push str._nError:_Graphic_file__s_of_the_expanded_inventory_was_not_found.
call fcn.10016d10
add esp, 8
mov ecx, 2
call fcn.100458d0
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x48], eax
cmp dword [0x51d430], eax
jne 0x1004d62f
mov al, byte [edi + 0x23]
and al, 0xf
cmp al, 1
jne 0x1004d62f
test byte [edi + 0x44], 0x81
je 0x1004d62f
mov edx, dword [edi + 0x28]
lea eax, [ebp - 0x3c]
mov ecx, dword [edi + 4]
push eax
push 1
call fcn.10017590
mov edx, dword [ebp - 0x3c]
mov esi, eax
xor ecx, ecx
mov dword [ebp - 0x20], esi
test esi, esi
jle 0x1004d50a
mov edi, eax
mov esi, dword [edx + ecx*4]
test byte [esi + 0x44], 0x81
jne 0x1004d4fc
mov eax, dword [edx + edi*4 - 4]
dec edi
mov dword [edx + ecx*4], eax
dec ecx
mov eax, dword [ebp - 0x3c]
mov dword [eax + edi*4], esi
mov edx, dword [ebp - 0x3c]
inc ecx
cmp ecx, edi
jl 0x1004d4e1
mov dword [ebp - 0x20], edi
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
cmp esi, 1
jne 0x1004d520
mov ecx, edx
call fcn.10017580
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1004d62f
jle 0x1004d62f
movaps xmm0, xmmword [0x10132a60]
lea eax, [ebp - 0x80]
push eax
push ecx
mov ecx, 0x600007a
movaps xmmword [ebp - 0x80], xmm0
call fcn.10017c60
mov esi, eax
test esi, esi
je 0x1004d5a2
lea eax, [ebp - 0x7c]
push eax
push ecx
mov ecx, 0x600007b
call fcn.10017c60
test eax, eax
je 0x1004d5a2
mov edx, dword [0x10174fec]
mov ecx, dword [0x1013cbc4]
push 0
push 0
push eax
mov ecx, dword [ecx]
lea edx, [edx + 0x1b4]
push esi
push 0xffffffffffffffff
push 0x149
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x14
push 0xa2
call fcn.10016d90
cmp eax, 0xffffffff
je 0x1004d5a2
push 0x451978
mov edx, 0x451970
mov ecx, eax
call fcn.10017a20
lea eax, [ebp - 0x78]
push eax
push ecx
mov ecx, 0x600007c
call fcn.10017c60
mov esi, eax
test esi, esi
je 0x1004d613
lea eax, [ebp - 0x74]
push eax
push ecx
mov ecx, 0x600007d
call fcn.10017c60
test eax, eax
je 0x1004d613
mov edx, dword [0x10174fec]
mov ecx, dword [0x1013cbc4]
push 0
push 0
push eax
mov ecx, dword [ecx]
lea edx, [edx + 0x1c8]
push esi
push 0xffffffffffffffff
push 0x151
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x14
push 0xa2
call fcn.10016d90
cmp eax, 0xffffffff
je 0x1004d613
push 0x451978
mov edx, 0x451970
mov ecx, eax
call fcn.10017a20
mov esi, dword [ebp - 0x20]
xor eax, eax
test esi, esi
jle 0x1004d62f
mov ecx, dword [ebp - 0x3c]
nop
cmp dword [ecx + eax*4], edi
je 0x1004d62c
inc eax
cmp eax, esi
jl 0x1004d620
jmp 0x1004d62f
mov dword [ebp - 0x48], eax
mov eax, dword [0x1013ca84]
mov byte [ebp - 1], 0
mov dword [ebp - 0x4c], 0xa
mov dword [ebp - 0x58], 0
mov ecx, dword [eax]
test ecx, ecx
js 0x1004d651
cmp ecx, 0xa
jl 0x1004d652
int3
mov eax, dword [0x1013ca80]
or edx, 0xffffffff
mov ecx, dword [ecx*4 + 0x59e7ec]
push 2
push dword [eax]
call fcn.10046bb0
mov eax, dword [0x1013cca8]
mov esi, dword [eax]
test esi, esi
js 0x1004d67a
cmp esi, 0xa
jl 0x1004d67b
int3
mov eax, dword [0x1013cbc4]
mov esi, dword [esi*4 + 0x59e844]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
call dword [0x10120fb4]
cmp dword [0x10174fec], 0
mov ecx, dword [eax + 0x2c]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0x44], 0
je 0x1004d6be
mov eax, dword [0x10174fe4]
mov eax, dword [eax + 0x3e]
mov edi, dword [eax + 0xc]
jmp 0x1004d6d2
lea eax, [ebp - 0x44]
push eax
push ecx
mov ecx, 0x6000072
call fcn.10017c60
mov edx, dword [ebp - 8]
mov edi, eax
test edi, edi
je 0x1004d714
mov eax, dword [ebp - 0x38]
imul ecx, edx, 0x25
push edx
add ecx, 0xb0
add eax, ecx
push eax
mov eax, dword [0x10174fe8]
push edx
add eax, 0x40
push 0x120
push eax
lea eax, [ecx + edi]
push eax
call fcn.1003eed0
mov eax, dword [ebp - 0x44]
add esp, 0x18
test eax, eax
je 0x1004d714
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
call dword [0x10120e98]
mov eax, dword [0x5190e4]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
je 0x1004d739
test esi, esi
jg 0x1004d730
mov eax, dword [ebp - 0x24]
call dword [0x101210f8]
jmp 0x1004d739
mov eax, dword [ebp - 0x24]
call dword [0x101210f0]
mov eax, dword [0x5190e8]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
je 0x1004d794
cmp dword [0x10174ff0], 0
mov edi, dword [0x519054]
mov ecx, dword [0x1013cad8]
jne 0x1004d768
cmp dword [0x10174fec], 0
jne 0x1004d768
xor eax, eax
jmp 0x1004d774
mov eax, dword [ecx]
mov eax, dword [eax]
sub eax, 0xc
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ecx]
add eax, edi
mov ecx, dword [ecx]
sub ecx, esi
cmp ecx, eax
jg 0x1004d78b
mov eax, dword [ebp - 0x24]
call dword [0x101210f8]
jmp 0x1004d794
mov eax, dword [ebp - 0x24]
call dword [0x101210f0]
or edx, 0xffffffff
cmp dword [0x10174ff0], 0
mov dword [ebp - 0xc], edx
jne 0x1004d7ac
cmp dword [0x10174fec], 0
je 0x1004d7da
mov eax, dword [0x1013cad8]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
test cl, 1
lea ecx, [eax + 1]
cmove ecx, eax
mov eax, 6
cmp ecx, 6
mov edx, ecx
cmovg edx, eax
sub ecx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [0x1013cad8]
not esi
mov eax, dword [0x519054]
xor edi, edi
mov dword [ebp - 0x24], eax
mov eax, dword [ecx]
add esi, dword [eax]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], eax
jle 0x1004d8a7
nop
test esi, esi
js 0x1004d8a7
cmp edi, edx
jne 0x1004d814
xor eax, eax
sub esi, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x38]
add eax, 0x29
imul eax, dword [ebp - 8]
add ecx, 0xb4
add eax, ecx
mov ecx, dword [0x1013cad8]
mov dword [ebp - 0x14], eax
cmp edi, edx
jl 0x1004d83c
add eax, dword [0x10174fe8]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx]
mov eax, dword [eax + 8]
mov ecx, dword [eax + esi*8]
lea eax, [eax + esi*8]
mov dword [ebp - 0x2c], eax
test ecx, ecx
je 0x1004d861
mov ecx, dword [ecx + 0x64]
lea edx, [ebp - 0x5c]
call fcn.1003bde0
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax + 0x7c]
jmp 0x1004d864
or ecx, 0xffffffff
push dword [ebp - 8]
mov edx, dword [ebp - 0x14]
push 0x28
push 0x38
call fcn.10017820
mov ecx, dword [ebp - 0x2c]
xor eax, eax
cmp edi, 0xffffffff
sete al
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
push eax
push dword [ebp - 8]
push dword [ebp - 0x14]
call fcn.10044a00
mov eax, dword [ebp - 0x28]
inc edi
add eax, 0x30
dec esi
mov dword [ebp - 0x28], eax
cmp edi, dword [ebp - 0x24]
jge 0x1004d8a7
mov edx, dword [ebp - 0xc]
jmp 0x1004d800
mov eax, dword [0x1013cbc4]
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x1004d8f1
test eax, eax
js 0x1004d8bc
cmp eax, 0x32
jl 0x1004d8bd
int3
mov eax, dword [eax*4 + 0x6add90]
cmp eax, 0xffffffff
je 0x1004d8f1
test eax, eax
js 0x1004d8d2
cmp eax, 0x32
jl 0x1004d8d3
int3
mov ecx, dword [eax*4 + 0x6ade58]
test ecx, ecx
je 0x1004d8f1
cmp dword [0x51e3e0], 0
je 0x1004d8f1
push 0
lea edx, [ecx + 8]
call fcn.100416a0
mov ecx, dword [ebp - 0x18]
mov edx, 2
mov ecx, dword [ecx + 0x20]
call fcn.100445b0
mov ecx, dword [0x1013cbc4]
mov ecx, dword [ecx]
call fcn.10075420
mov eax, dword [0x10176038]
mov ecx, eax
or eax, 0x10000
xor ecx, eax
mov dword [0x10176038], eax
je 0x1004d92a
xor ecx, ecx
call fcn.100b6470
mov eax, 0
call dword [0x10121534]
nop word [eax + eax]
mov eax, dword [0x1013cc2c]
cmp dword [eax], 0
jne 0x1004df02
call fcn.1003b910
mov dword [ebp - 8], eax
cmp eax, 0x11
je 0x1004d967
cmp eax, 0x18
je 0x1004d967
cmp eax, 0x144
jne 0x1004d96d
call dword [0x1012100c]
mov eax, dword [0x1013cc2c]
cmp dword [eax], 0
jne 0x1004df02
cmp byte [0x1013ca24], 0
mov eax, dword [0x1013cca8]
mov edi, dword [eax]
mov eax, dword [0x1013ca84]
mov dword [ebp - 0x38], edi
mov esi, dword [eax]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], esi
je 0x1004da0d
cmp eax, 0x148
je 0x1004d9a9
cmp eax, 0x150
jne 0x1004da12
mov ecx, dword [0x10174fe8]
mov eax, dword [0x1013cbc4]
lea edi, [ecx + 0x122]
mov eax, dword [eax]
lea esi, [ecx + edi]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
call dword [0x10120fb4]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 8]
lea eax, [edx + 0x145]
add edx, 0x25
push eax
lea eax, [ecx + 0x50]
add ecx, edi
add eax, esi
push eax
call fcn.100174a0
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x38]
test eax, eax
je 0x1004da0a
xor eax, eax
cmp dword [ebp - 8], 0x148
setne al
lea eax, [eax*4 + 0x18d]
mov dword [ebp - 8], eax
jmp 0x1004da0d
mov eax, dword [ebp - 8]
cmp eax, 0x150
jg 0x1004e21b
cmp eax, 0x150
je 0x1004e1d0
cmp eax, 0x148
jg 0x1004e1c0
je 0x1004e184
cmp eax, 0x41
je 0x1004da42
cmp eax, 0x61
jne 0x1004e3b5
mov eax, 0x51d430
cmp dword [eax], 0
jne 0x1004def0
mov eax, dword [ebp - 0x1c]
cmp byte [eax + 0x67], 1
je 0x1004da65
mov dword [ebp - 0x14], 0
jmp 0x1004dbdc
mov ecx, eax
call fcn.10088050
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1004da84
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
mov ecx, dword [ecx + 0x64]
call fcn.1003bde0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0x14], eax
cmp dword [ecx + 0x64], 0x1000000
jne 0x1004db51
mov eax, dword [0x1013cd38]
cmp ecx, dword [eax]
jne 0x1004db51
xor edx, edx
mov dword [ebp - 0x28], edx
cmp dword [0x10176d18], edx
je 0x1004dadc
mov eax, dword [0x66be40]
cmp eax, 0xffffffff
je 0x1004dac8
mov edx, dword [eax*4 + 0x10176350]
mov dword [ebp - 0x28], edx
mov eax, dword [0x66be44]
cmp eax, 0xffffffff
je 0x1004dadc
add edx, dword [eax*4 + 0x10176350]
mov dword [ebp - 0x28], edx
mov ecx, 2
call fcn.10024b60
test eax, eax
je 0x1004db4b
cmp byte [0x10174fad], 0
je 0x1004db06
mov ecx, dword [0x1013cd38]
xor edx, edx
mov ecx, dword [ecx]
call fcn.10024740
mov ecx, eax
jmp 0x1004db3c
mov eax, dword [0x1013cd38]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp byte [eax + 0x67], 1
jne 0x1004db3a
mov ecx, eax
call fcn.10088050
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1004db35
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0xc]
mov ecx, dword [ecx + 0x64]
call fcn.1003bde0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x24]
jmp 0x1004db3c
xor ecx, ecx
mov edx, dword [ebp - 0x28]
mov eax, ecx
neg eax
shl eax, 2
sub eax, ecx
lea edx, [edx + eax*2]
add dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x1c]
xor eax, eax
cmp byte [ecx + 0x67], 1
jne 0x1004db7c
call fcn.10088050
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1004db76
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
mov ecx, dword [ecx + 0x64]
call fcn.1003bde0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xe0]
add eax, dword [ebp - 0x14]
cmp dword [0x1013d3d0], 0xc
mov dword [ebp - 0x14], eax
jne 0x1004dbca
mov eax, dword [ebp - 0x1c]
call dword [0x10121538]
test eax, eax
je 0x1004dba9
mov eax, dword [eax + 0x64]
cmp eax, dword [0x1013d3cc]
jne 0x1004dba9
mov eax, dword [ebp - 0x14]
inc eax
jmp 0x1004dbca
mov eax, dword [ebp - 0x1c]
call dword [0x1012153c]
test eax, eax
je 0x1004dbc7
mov eax, dword [eax + 0x64]
cmp eax, dword [0x1013d3cc]
mov eax, dword [ebp - 0x14]
jne 0x1004dbca
inc eax
jmp 0x1004dbca
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov edx, eax
push 0xc
call fcn.100c65c0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov ecx, eax
call fcn.1001e1f0
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub dword [ebp - 0x14], eax
call fcn.100b3df0
test al, al
je 0x1004e119
mov ecx, dword [ebp - 0x18]
call fcn.1001e1f0
cmp eax, dword [ebp - 0x14]
jg 0x1004e119
mov edx, dword [ebp - 0x18]
cmp byte [edx + 0x67], 1
jne 0x1004dc3b
mov eax, dword [edx + 0x44]
shr eax, 7
not al
test al, 1
je 0x1004dc3b
mov eax, dword [ebp - 0x18]
call dword [0x10121538]
test eax, eax
je 0x1004dc3b
mov ecx, dword [ebp - 0x18]
mov edx, eax
push 0x2000000
call fcn.1004ca30
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
call fcn.1001df30
test esi, esi
js 0x1004dc4f
cmp esi, 0xa
jl 0x1004dc50
int3
mov eax, dword [0x1013ca80]
mov ecx, dword [esi*4 + 0x59e7ec]
push 2
push dword [eax]
or eax, 0xffffffff
mov edx, eax
call fcn.10046bb0
test edi, edi
js 0x1004dc73
cmp edi, 0xa
jl 0x1004dc74
int3
mov eax, dword [0x1013cbc4]
mov esi, dword [edi*4 + 0x59e844]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
call dword [0x10120fb4]
cmp dword [0x10174fec], 0
mov ecx, dword [eax + 0x2c]
mov edi, dword [eax + 0x18]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x30], 0
je 0x1004dcb7
mov eax, dword [0x10174fe4]
mov eax, dword [eax + 0x3e]
mov edx, dword [eax + 0xc]
jmp 0x1004dcc8
lea eax, [ebp - 0x30]
push eax
push ecx
mov ecx, 0x6000072
call fcn.10017c60
mov edx, eax
test edx, edx
je 0x1004dd0a
mov eax, dword [ebp - 0x38]
imul ecx, edi, 0x25
push edi
add ecx, 0xb0
add eax, ecx
push eax
mov eax, dword [0x10174fe8]
push edi
add eax, 0x40
push 0x120
push eax
lea eax, [ecx + edx]
push eax
call fcn.1003eed0
mov eax, dword [ebp - 0x30]
add esp, 0x18
test eax, eax
je 0x1004dd0a
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
call dword [0x10120e98]
mov eax, 0x5190e4
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x1004dd31
test esi, esi
jg 0x1004dd28
mov eax, dword [ebp - 0xc]
call dword [0x101210f8]
jmp 0x1004dd31
mov eax, dword [ebp - 0xc]
call dword [0x101210f0]
mov eax, 0x5190e8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x1004dd8f
cmp dword [0x10174ff0], 0
mov eax, 0x519054
mov ecx, dword [0x1013cad8]
mov edi, dword [eax]
jne 0x1004dd63
cmp dword [0x10174fec], 0
jne 0x1004dd63
xor eax, eax
jmp 0x1004dd6f
mov eax, dword [ecx]
mov eax, dword [eax]
sub eax, 0xc
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ecx]
add eax, edi
mov ecx, dword [ecx]
sub ecx, esi
cmp ecx, eax
jg 0x1004dd86
mov eax, dword [ebp - 0xc]
call dword [0x101210f8]
jmp 0x1004dd8f
mov eax, dword [ebp - 0xc]
call dword [0x101210f0]
mov edx, dword [0x1013cad8]
or edi, 0xffffffff
cmp dword [0x10174ff0], 0
mov dword [ebp - 0x44], edi
jne 0x1004ddad
cmp dword [0x10174fec], 0
je 0x1004ddd9
mov eax, dword [edx]
mov eax, dword [eax]
mov ecx, eax
test ecx, ecx
jns 0x1004ddba
add ecx, 1
sar ecx, 1
test al, 1
lea eax, [ecx + 1]
cmove eax, ecx
mov ecx, 6
cmp eax, 6
mov edi, eax
cmovg edi, ecx
sub eax, edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x5c], eax
mov eax, 0x519054
not esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [edx]
add esi, dword [eax]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0xc], eax
jle 0x1004dea6
nop dword [eax]
test esi, esi
js 0x1004dea6
cmp ecx, edi
jne 0x1004de14
xor eax, eax
sub esi, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
mov edi, dword [ebp - 0x38]
add eax, 0x29
imul eax, dword [ebp - 0x28]
add edi, 0xb4
add edi, eax
cmp ecx, dword [ebp - 0x44]
jl 0x1004de31
add edi, dword [0x10174fe8]
mov eax, dword [edx]
mov eax, dword [eax + 8]
mov ecx, dword [eax + esi*8]
lea eax, [eax + esi*8]
mov dword [ebp - 0x2c], eax
test ecx, ecx
je 0x1004de56
mov ecx, dword [ecx + 0x64]
lea edx, [ebp - 0x40]
call fcn.1003bde0
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x7c]
jmp 0x1004de59
or ecx, 0xffffffff
push dword [ebp - 0x28]
mov edx, edi
push 0x28
push 0x38
call fcn.10017820
mov ecx, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x14], 0xffffffff
sete al
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
push eax
push dword [ebp - 0x28]
push edi
call fcn.10044a00
mov ecx, dword [ebp - 0x14]
dec esi
mov eax, dword [ebp - 0x24]
inc ecx
add eax, 0x30
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], eax
cmp ecx, dword [ebp - 0xc]
jge 0x1004dea6
mov edx, dword [0x1013cad8]
mov edi, dword [ebp - 0x44]
jmp 0x1004de00
mov eax, dword [0x1013cbc4]
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x1004def0
test eax, eax
js 0x1004debb
cmp eax, 0x32
jl 0x1004debc
int3
mov eax, dword [eax*4 + 0x6add90]
cmp eax, 0xffffffff
je 0x1004def0
test eax, eax
js 0x1004ded1
cmp eax, 0x32
jl 0x1004ded2
int3
mov ecx, dword [eax*4 + 0x6ade58]
test ecx, ecx
je 0x1004def0
cmp dword [0x51e3e0], 0
je 0x1004def0
push 0
lea edx, [ecx + 8]
call fcn.100416a0
mov edi, dword [ebp - 8]
cmp edi, 0x1b
je 0x1004df02
cmp byte [ebp - 1], 0
je 0x1004d940
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x1004df29
mov ecx, dword [ebp - 0x3c]
call fcn.10017580
xor esi, esi
mov eax, dword [ebp + esi*4 - 0x80]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
call dword [0x10120e98]
inc esi
cmp esi, 4
jb 0x1004df13
cmp dword [0x51d430], 0
mov esi, dword [ebp - 0x18]
jne 0x1004df40
mov ecx, esi
call fcn.1006ce00
test al, al
je 0x1004df95
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x1004df5d
or dword [eax + 0x24], 0x1000000
mov edx, eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
mov ecx, esi
call fcn.1001dce0
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x1004df7a
or dword [eax + 0x24], 0x2000000
mov edx, eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
mov ecx, esi
call fcn.1001dce0
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x1004df95
or dword [edx + 0x24], 0x4000000
mov ecx, esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
call fcn.1001dce0
mov edi, dword [ebp - 0x34]
mov edx, esi
mov ecx, edi
call fcn.1001df30
mov dword [ebp - 0x40], edi
mov edx, 0
mov eax, dword [ebp - 0x40]
call dword [0x101213d0]
cmp dword [0x51d430], 0
je 0x1004e07b
cmp byte [ebp - 1], 0
jne 0x1004e07b
mov edi, dword [ebp - 0x58]
test edi, edi
jle 0x1004e07b
mov ecx, esi
call fcn.1006ce40
test al, al
jne 0x1004e07b
mov ecx, dword [ebp - 0x1c]
mov edx, 0xa
call fcn.10023ee0
mov esi, 0x12c
sub esi, eax
cmp esi, edi
push esi
push str._nStealing_max_experience:__d
cmovl edi, esi
call fcn.10016d10
add esp, 8
mov edx, 1
mov ecx, edi
call fcn.10022580
lea edx, [ebp - 0x70]
mov dword [ebp - 0x70], 0x1d
mov ecx, 0x59e814
call fcn.1003d2c0
cmp eax, 1
jne 0x1004e05f
mov eax, dword [0x1013cfd0]
cmp eax, 0xffffffff
cmove eax, edi
push eax
push dword [ebp - 0x64]
lea eax, [ebp - 0x148]
push eax
call fcn.1000d880
lea eax, [ebp - 0x148]
add esp, 0xc
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
call dword [0x1012171c]
mov eax, dword [0x1013cfd0]
mov edx, 0xffffffff
cmp byte [0x10175301], 0
mov esi, dword [ebp - 0x18]
cmovne eax, edx
mov dword [0x1013cfd0], eax
mov eax, dword [ebp - 0x60]
call dword [0x101216cc]
mov ecx, dword [0x10176038]
mov eax, ecx
and ecx, 0xbffeffff
mov dword [0x10176038], ecx
xor ecx, eax
je 0x1004e0a3
xor ecx, ecx
call fcn.100b6470
call fcn.100464e0
call fcn.10045590
cmp dword [0x51d430], 0
je 0x1004e0f0
cmp byte [ebp - 1], 0
je 0x1004e0f0
mov eax, dword [0x1013cc14]
cmp dword [eax], 0
jbe 0x1004e0f0
mov esi, dword [esi + 0x78]
cmp esi, 0xffffffff
je 0x1004e0f0
mov edx, dword [ebp - 0x1c]
mov ecx, esi
push 0
call fcn.1006ed50
mov edx, 4
mov ecx, esi
call fcn.1006edb0
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.1006e7b0
mov dword [0x10174fa8], 0
mov dword [0x10174fa4], 0
mov dword [0x10174fa0], 0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp dword [0x59e814], 0
mov dword [ebp - 0x70], 0x1f
jle 0x1004def0
mov edx, 0x1f
mov ecx, 0x59e814
call fcn.1003d220
mov edx, eax
cmp edx, 0xffffffff
je 0x1004def0
shl edx, 4
add edx, dword [0x59e818]
push 0
mov eax, dword [edx + 8]
mov ecx, dword [edx + 4]
mov dword [ebp - 0x68], eax
movzx eax, byte [0x6ab718]
push eax
push 0
push eax
push 0x75
mov dword [ebp - 0x6c], ecx
mov ecx, dword [edx + 0xc]
xor edx, edx
push 0xa9
push 0
mov dword [ebp - 0x64], ecx
call fcn.100171e0
jmp 0x1004def0
test edi, edi
js 0x1004e18d
cmp edi, 0xa
jl 0x1004e18e
int3
mov ecx, dword [edi*4 + 0x59e844]
test ecx, ecx
jle 0x1004def8
test edi, edi
js 0x1004e1a6
cmp edi, 0xa
jl 0x1004e1a7
int3
dec ecx
or eax, 0xffffffff
mov dword [edi*4 + 0x59e844], ecx
push 2
mov edx, eax
call fcn.100465f0
jmp 0x1004def8
cmp eax, 0x149
je 0x1004e29f
jmp 0x1004e3b5
test edi, edi
js 0x1004e1d9
cmp edi, 0xa
jl 0x1004e1da
int3
call fcn.100456c0
add eax, dword [edi*4 + 0x59e844]
mov ecx, 0x519054
add eax, dword [ecx]
mov ecx, dword [0x1013cad8]
mov ecx, dword [ecx]
cmp eax, dword [ecx]
jge 0x1004def8
test edi, edi
js 0x1004e206
cmp edi, 0xa
jl 0x1004e207
int3
mov ecx, dword [edi*4 + 0x59e844]
inc ecx
test edi, edi
js 0x1004e218
cmp edi, 0xa
jl 0x1004e1a8
int3
cmp eax, 0x191
jg 0x1004e394
je 0x1004e33b
sub eax, 0x151
je 0x1004e29c
sub eax, 0x3c
jne 0x1004e3b2
test esi, esi
js 0x1004e245
cmp esi, 0xa
jl 0x1004e246
int3
cmp dword [esi*4 + 0x59e7ec], 0
jle 0x1004def8
test esi, esi
js 0x1004e25d
cmp esi, 0xa
jl 0x1004e25e
int3
mov ecx, dword [esi*4 + 0x59e7ec]
dec ecx
test esi, esi
js 0x1004e26f
cmp esi, 0xa
jl 0x1004e270
int3
mov eax, dword [0x1013ca80]
push 2
mov dword [esi*4 + 0x59e7ec], ecx
push dword [eax]
or eax, 0xffffffff
mov edx, eax
call fcn.10046bb0
mov ecx, dword [0x1013cbc4]
mov ecx, dword [ecx]
call fcn.10016cc0
jmp 0x1004def8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x1004def0
cmp eax, 0x149
jne 0x1004e2bf
mov eax, dword [ebp - 0x48]
lea edx, [ecx - 1]
add eax, 0xffffffff
cmovns edx, eax
jmp 0x1004e2ca
mov edx, dword [ebp - 0x48]
xor eax, eax
inc edx
cmp edx, ecx
cmovge edx, eax
mov eax, dword [ebp - 0x3c]
push 2
mov dword [ebp - 0x48], edx
mov esi, dword [eax + edx*4]
mov eax, dword [0x1013ca80]
mov dword [ebp - 0x18], esi
lea ecx, [esi + 0x2c]
mov dword [eax], ecx
mov eax, 0x59e81c
push ecx
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [0x1013ca84]
mov dword [eax], 0
mov eax, 0x59e7ec
mov dword [eax], 0
or eax, 0xffffffff
mov edx, eax
call fcn.10046bb0
test edi, edi
js 0x1004e315
cmp edi, 0xa
jl 0x1004e316
int3
mov ecx, dword [edi*4 + 0x59e844]
or eax, 0xffffffff
push 2
mov edx, eax
call fcn.100465f0
mov ecx, dword [esi + 0x20]
mov edx, 2
call fcn.100445b0
jmp 0x1004def0
test esi, esi
js 0x1004e344
cmp esi, 0xa
jl 0x1004e345
int3
call fcn.100456f0
mov edx, dword [0x1013ca80]
mov ecx, 0x519054
add eax, dword [ecx]
mov ecx, dword [edx]
add eax, dword [esi*4 + 0x59e7ec]
cmp eax, dword [ecx]
jge 0x1004def8
test esi, esi
js 0x1004e371
cmp esi, 0xa
jl 0x1004e372
int3
mov ecx, dword [esi*4 + 0x59e7ec]
inc ecx
test esi, esi
js 0x1004e383
cmp esi, 0xa
jl 0x1004e384
int3
push 2
mov dword [esi*4 + 0x59e7ec], ecx
push dword [edx]
jmp 0x1004e280
add eax, 0xfffff63c
cmp eax, 1
ja 0x1004e3b2
mov edi, dword [ebp - 8]
mov edx, 2
mov ecx, edi
call fcn.10046e70
jmp 0x1004def3
mov eax, dword [ebp - 8]
mov ecx, 0x51d430
cmp dword [ecx], 0
jne 0x1004e3f1
test byte [0x6ac7b0], 2
je 0x1004e3f1
cmp dword [0x59e940], 0
je 0x1004e3e1
mov eax, 0
call dword [0x10121534]
jmp 0x1004def0
mov eax, 1
call dword [0x10121534]
jmp 0x1004def0
test byte [0x6ac7b0], 1
je 0x1004def0
mov edx, 0x519054
cmp eax, 0x3e8
jl 0x1004e4b2
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
add eax, 0x3e8
cmp ecx, eax
jge 0x1004e4af
cmp dword [0x59e940], 1
je 0x1004e4a0
cmp dword [0x10174fec], 0
mov dword [ebp - 0xc], 0
je 0x1004e44d
push 0
push 0
lea edx, [ebp - 0xc]
call fcn.100483c0
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
jmp 0x1004e47f
push edi
mov ecx, 0x59e844
call fcn.10049870
mov edi, dword [ebp - 8]
mov eax, dword [eax]
lea edx, [edi - 0x3e8]
add edx, eax
mov eax, dword [0x1013cad8]
mov eax, dword [eax]
mov ecx, dword [eax]
cmp edx, ecx
jge 0x1004def3
mov eax, dword [eax + 8]
sub ecx, edx
mov ecx, dword [eax + ecx*8 - 8]
test ecx, ecx
je 0x1004def3
lea eax, [ebp - 0x4c]
mov edx, edi
push eax
lea eax, [ebp - 0x58]
push eax
push 1
call fcn.1004cb30
mov byte [ebp - 1], al
jmp 0x1004def3
mov edx, 2
call fcn.10047a90
jmp 0x1004def0
mov eax, dword [ebp - 8]
cmp eax, 0x7d0
jl 0x1004def0
mov eax, dword [edx]
mov edi, dword [ebp - 8]
add eax, 0x7d0
cmp edi, eax
jge 0x1004def3
cmp dword [0x59e940], 1
je 0x1004e54b
cmp dword [0x10174fec], 0
mov dword [ebp - 0xc], 0
je 0x1004e4fb
push 0
push 0
lea edx, [ebp - 0xc]
mov ecx, edi
call fcn.100483c0
mov ecx, dword [ebp - 0xc]
jmp 0x1004e52a
push esi
mov ecx, 0x59e7ec
call fcn.10049870
lea edx, [edi - 0x7d0]
mov eax, dword [eax]
add edx, eax
mov eax, dword [0x1013ca80]
mov eax, dword [eax]
mov ecx, dword [eax]
cmp edx, ecx
jge 0x1004def3
mov eax, dword [eax + 8]
sub ecx, edx
mov ecx, dword [eax + ecx*8 - 8]
test ecx, ecx
je 0x1004def3
lea eax, [ebp - 0x4c]
mov edx, edi
push eax
lea eax, [ebp - 0x58]
push eax
push 0
call fcn.1004cb30
mov byte [ebp - 1], al
jmp 0x1004def3
mov edx, 2
mov ecx, edi
call fcn.10047a90
jmp 0x1004def3