Function at 0x41b1d0
Capabilities:
Check http status code
Encrypt data using speck
Inspect section memory permissions
Parse pe header
Validate payment card number using luhn algorithm

Disassembly:
sub esp, 0x484
push ebx
push ebp
mov ebp, dword [esp + 0x4a0]
push esi
push edi
xor ebx, ebx
lea esi, [esp + 0x2d0]
mov edi, ecx
mov dword [esp + 0x14], ebx
call fcn.00412db0
lea esi, [esp + 0x328]
call fcn.004d5b20
mov eax, dword [0x7283a0]
mov dword [esp + 0xd0], eax
xor eax, eax
nop
mov cl, byte [eax + 0x86bb48]
mov byte [esp + eax + 0x350], cl
inc eax
cmp cl, bl
jne 0x41b210
cmp edi, 5
mov ecx, dword [0x8ccbd4]
mov edx, dword [0x8ccde0]
mov eax, dword [0x8ccde4]
mov dword [esp + 0x158], ecx
mov ecx, dword [0x8ccde8]
mov dword [esp + 0x29c], edx
mov dword [esp + 0x2a0], eax
mov dword [esp + 0x2a4], ecx
jne 0x41b27f
mov eax, dword [0x729424]
mov ecx, dword [0x729428]
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [0x72942c]
mov dword [edx + 4], ecx
mov dword [edx + 8], eax
call fcn.005020f0
add esp, 0xc
mov ecx, dword [0x7283bc]
mov edx, dword [0x728a84]
mov esi, dword [esp + 0x4ac]
mov eax, ecx
mov dword [edx*4 + 0x7288f4], ecx
mov ecx, dword [0x728a84]
or eax, 0x80000027
inc ecx
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], bl
mov dword [0x728a84], ecx
mov dword [0x7283bc], eax
mov dword [0x72eb4c], edi
mov dword [0x72eb48], esi
mov dword [0x72ecbc], ebx
mov dword [0x72ecb8], ebx
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 3
idiv ecx
mov dword [esp + 0xc8], ebx
mov dword [0x72ecc0], ebx
mov dword [0x72ecbc], edx
call fcn.00427ee0
cmp dword [0x72eb4c], 2
jg 0x41b340
mov eax, dword [esp + 0x158]
mov cl, 1
call fcn.0041a1e0
cmp eax, 1
mov dword [esp + 0xc8], eax
jne 0x41b327
push 0x3f266666
push str.skydome_lateday.nif
jmp 0x41b336
cmp eax, 2
jne 0x41b340
push 0x3f266666
push str.skydome_night.nif
mov eax, dword [0x8cbdec]
call fcn.004da420
xor eax, eax
or edx, 0xffffffff
mov ecx, 0x5a
mov edi, 0x72eb50
rep stosd dword es:[edi], eax
mov edi, dword [0x85c158]
mov ecx, dword [0x72eb4c]
mov eax, ebp
add ebp, edi
cmp ecx, 5
mov dword [esp + 0x150], ebx
mov dword [esp + 0x174], ebx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x34], edx
mov byte [esp + 0x7b], bl
mov dword [esp + 0x180], ebx
mov dword [esp + 0xf0], edx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0x130], ebx
mov dword [esp + 0x178], edx
mov dword [esp + 0x170], ebx
mov dword [esp + 0xe4], edx
mov dword [esp + 0x16c], ebx
mov dword [0x725870], edx
mov dword [esp + 0xbc], ebx
mov dword [0x72eb44], eax
mov dword [esp + 0x4a8], ebp
jne 0x41b40a
cmp eax, 2
jne 0x41b40a
cmp esi, edx
je 0x41b40a
movsx eax, word [esi*2 + 0x86ba88]
dec eax
cdq
sub eax, edx
sar eax, 1
cmp eax, ebx
jge 0x41b3f7
xor eax, eax
jmp 0x41b401
cmp eax, 2
jle 0x41b401
mov eax, 2
add ebp, eax
mov dword [esp + 0x4a8], ebp
cmp ebp, ebx
je 0x41b41e
cmp dword [0x8cc92c], ebx
jne 0x41b41e
dec ebp
mov dword [esp + 0x4a8], ebp
mov eax, dword [0x72eb4c]
cmp eax, 3
mov dword [0x72ecc4], ebx
je 0x41b449
cmp eax, 4
je 0x41b449
mov dl, byte [0x86bb21]
neg dl
sbb edx, edx
and edx, 0x130
mov dword [0x72ecc4], edx
lea ecx, [esp + 0x19c]
lea eax, [esp + 0x344]
mov dword [esp + 0x19c], 0
mov dword [esp + 0x1a0], 0x4504d2c9
mov dword [esp + 0x1a4], 0xc4dc853f
call fcn.00428530
mov esi, dword [0x72ed74]
cmp byte [esi + 0xf0], bl
jne 0x41b49b
mov byte [esp + 0x7b], 1
call fcn.004e46f0
mov esi, dword [0x72ed74]
mov dl, 1
mov ecx, esi
call fcn.004e5c70
fld dword [esi + 0x2c]
call fcn.005f275c
mov dword [esp + 0x2b8], eax
call fcn.004e5e50
fstp dword [esp + 0x2a8]
cmp byte [0x8ccc29], bl
je 0x41b4ca
push ebx
jmp 0x41b4cc
push 1
mov ebx, dword [0x72ed74]
call fcn.004e5cc0
mov eax, dword [0x725900]
mov ecx, dword [0x72ed74]
add eax, 0xffffff6a
push eax
call fcn.004e5e80
lea ecx, [esp + 0x2bc]
push ecx
push 4
push str.fWaterTexScale
mov dword [esp + 0x2c8], 0x40200000
call fcn.005bf910
add esp, 0xc
push 0x4a96d0
push 3
push 4
lea edx, [esp + 0x30]
push edx
call fcn.004127b0
push 0x4a96d0
push 2
push 4
lea eax, [esp + 0xb4]
push eax
call fcn.004127b0
push 0x4a96d0
push 3
push 4
lea ecx, [esp + 0x130]
push ecx
call fcn.004127b0
push 0x4a96d0
push 3
xor ebx, ebx
push 4
lea edx, [esp + 0x214]
push edx
mov dword [esp + 0x18c], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0x178], ebx
mov dword [esp + 0xc8], ebx
call fcn.004127b0
push 0x4a96d0
push 3
push 4
lea eax, [esp + 0x88]
push eax
call fcn.004127b0
push 0x4a96d0
push 3
push 4
lea ecx, [esp + 0x94]
push ecx
call fcn.004127b0
push 0x4a96d0
push 0x14
push 4
lea edx, [esp + 0x1b4]
push edx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xd0], ebx
call fcn.004127b0
push 0x4a96d0
push 5
push 4
lea eax, [esp + 0x190]
push eax
mov dword [esp + 0x148], ebx
mov dword [esp + 0xa4], ebx
call fcn.004127b0
mov ecx, dword [0x725900]
mov esi, dword [0x8cbdec]
neg ecx
mov dword [esp + 0xb0], ecx
fild dword [esp + 0xb0]
mov dword [esp + 0xd8], ebx
fstp dword [esp + 0xb0]
mov eax, dword [esp + 0xb0]
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx]
push eax
add esi, 0x14
push ebx
push ebx
call dword [edx + 0x10]
mov ecx, dword [esi]
mov edx, dword [ecx]
push ebx
call dword [edx + 0xc]
mov eax, dword [esp + 0x4bc]
cmp eax, ebx
mov esi, 0x8cccd0
mov dword [esp + 0x110], esi
mov dword [0x7258f8], 0xffffffff
je 0x41b675
mov al, byte [eax + 0x1c]
jmp 0x41b677
xor al, al
mov ecx, dword [0x72eb44]
mov edi, dword [esp + 0x4ac]
push eax
mov eax, dword [esp + 0x4b4]
push eax
mov eax, dword [esp + 0x4bc]
push ecx
lea edx, [esp + 0x14c]
push edx
mov edx, dword [esp + 0x4b4]
mov ecx, edi
call fcn.0041a300
add esp, 0x10
lea ecx, [esp + 0x110]
call fcn.00412ec0
mov eax, dword [esp + 0x140]
add eax, 0xfffffff8
cmp eax, ebx
je 0x41b6d8
cmp eax, 0x8cccc8
je 0x41b6d8
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
push 0xc0
mov dword [esp + 0x144], esi
call fcn.005354b8
add esp, 4
cmp eax, ebx
je 0x41b719
mov ecx, dword [esp + 0x110]
mov edx, dword [0x8ebffc]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
push ebx
push ebx
push ebx
push ecx
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x41b71b
xor esi, esi
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x41b749
test eax, eax
je 0x41b73e
mov ebx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec ebx
mov edx, ebx
test edx, edx
mov dword [eax], ebx
jne 0x41b73e
mov eax, dword [ecx]
push 1
call dword [eax]
test esi, esi
mov dword [esp + 0x28], esi
je 0x41b749
inc dword [esi + 4]
mov edx, dword [0x72eb4c]
mov eax, dword [0x72ecc4]
xor ecx, ecx
mov cl, byte [0x72eb40]
push ecx
push edi
push edx
call fcn.004a6670
add esp, 0xc
lea eax, [esp + 0x124]
push eax
push edi
lea eax, [esp + 0x398]
lea edx, [esp + 0x418]
call fcn.0041a9f0
add esp, 8
push 0
push 0
push 0
push 0
push 1
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push 0x86bb48
push ecx
mov ecx, dword [0x8ebffc]
mov eax, esp
mov dword [eax], ecx
mov eax, ecx
test eax, eax
je 0x41b7b3
inc dword [eax + 4]
call fcn.004afb00
mov esi, eax
mov eax, dword [esp + 0x54]
add esp, 0x30
cmp eax, esi
je 0x41b7eb
test eax, eax
je 0x41b7e0
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41b7e0
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x24], esi
je 0x41b7eb
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41b82a
mov ecx, dword [0x8ec008]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Crewcount_01.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x41b82c
xor esi, esi
mov eax, dword [esp + 0x1a8]
cmp eax, esi
je 0x41b860
test eax, eax
je 0x41b852
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41b852
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x1a8], esi
je 0x41b860
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41b89f
mov ecx, dword [0x8ec008]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Crewcount_02.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x41b8a1
xor esi, esi
mov eax, dword [esp + 0x1ac]
cmp eax, esi
je 0x41b8d5
test eax, eax
je 0x41b8c7
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41b8c7
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x1ac], esi
je 0x41b8d5
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41b914
mov ecx, dword [0x8ec008]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Crewcount_03.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x41b916
xor esi, esi
mov eax, dword [esp + 0x1b0]
cmp eax, esi
je 0x41b94a
test eax, eax
je 0x41b93c
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41b93c
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x1b0], esi
je 0x41b94a
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41b989
mov ecx, dword [0x8ec008]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Crewcount_04.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x41b98b
xor esi, esi
mov eax, dword [esp + 0x1b4]
cmp eax, esi
je 0x41b9bf
test eax, eax
je 0x41b9b1
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41b9b1
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x1b4], esi
je 0x41b9bf
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41b9fe
mov ecx, dword [0x8ec008]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Crewcount_05.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x41ba00
xor esi, esi
mov eax, dword [esp + 0x1b8]
cmp eax, esi
je 0x41ba34
test eax, eax
je 0x41ba26
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41ba26
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x1b8], esi
je 0x41ba34
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41ba73
mov ecx, dword [0x8ec008]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Crewcount_06.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x41ba75
xor esi, esi
mov eax, dword [esp + 0x1bc]
cmp eax, esi
je 0x41baa9
test eax, eax
je 0x41ba9b
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41ba9b
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x1bc], esi
je 0x41baa9
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41bae8
mov ecx, dword [0x8ec008]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Crewcount_07.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x41baea
xor esi, esi
mov eax, dword [esp + 0x1c0]
cmp eax, esi
je 0x41bb1e
test eax, eax
je 0x41bb10
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41bb10
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x1c0], esi
je 0x41bb1e
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41bb5d
mov ecx, dword [0x8ec008]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Crewcount_08.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x41bb5f
xor esi, esi
mov eax, dword [esp + 0x1c4]
cmp eax, esi
je 0x41bb93
test eax, eax
je 0x41bb85
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41bb85
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x1c4], esi
je 0x41bb93
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41bbd2
mov ecx, dword [0x8ec008]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Crewcount_09.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x41bbd4
xor esi, esi
mov eax, dword [esp + 0x1c8]
cmp eax, esi
je 0x41bc08
test eax, eax
je 0x41bbfa
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41bbfa
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x1c8], esi
je 0x41bc08
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41bc47
mov ecx, dword [0x8ec008]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Crewcount_10.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x41bc49
xor esi, esi
mov eax, dword [esp + 0x1cc]
cmp eax, esi
je 0x41bc7d
test eax, eax
je 0x41bc6f
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41bc6f
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x1cc], esi
je 0x41bc7d
inc dword [esi + 4]
mov ecx, dword [esp + 0x1a8]
push 0
call fcn.004bbbd0
mov esi, eax
mov eax, dword [esp + 0x1d0]
cmp eax, esi
je 0x41bcc1
test eax, eax
je 0x41bcb3
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41bcb3
mov eax, dword [ecx]
push 1
call dword [eax]
test esi, esi
mov dword [esp + 0x1d0], esi
je 0x41bcc1
inc dword [esi + 4]
mov ecx, dword [esp + 0x1ac]
push 0
call fcn.004bbbd0
mov esi, eax
mov eax, dword [esp + 0x1d4]
cmp eax, esi
je 0x41bd05
test eax, eax
je 0x41bcf7
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41bcf7
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x1d4], esi
je 0x41bd05
inc dword [esi + 4]
mov ecx, dword [esp + 0x1b0]
push 0
call fcn.004bbbd0
mov esi, eax
mov eax, dword [esp + 0x1d8]
cmp eax, esi
je 0x41bd49
test eax, eax
je 0x41bd3b
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41bd3b
mov eax, dword [ecx]
push 1
call dword [eax]
test esi, esi
mov dword [esp + 0x1d8], esi
je 0x41bd49
inc dword [esi + 4]
mov ecx, dword [esp + 0x1b4]
push 0
call fcn.004bbbd0
mov esi, eax
mov eax, dword [esp + 0x1dc]
cmp eax, esi
je 0x41bd8d
test eax, eax
je 0x41bd7f
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41bd7f
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x1dc], esi
je 0x41bd8d
inc dword [esi + 4]
mov ecx, dword [esp + 0x1b8]
push 0
call fcn.004bbbd0
mov esi, eax
mov eax, dword [esp + 0x1e0]
cmp eax, esi
je 0x41bdd1
test eax, eax
je 0x41bdc3
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41bdc3
mov eax, dword [ecx]
push 1
call dword [eax]
test esi, esi
mov dword [esp + 0x1e0], esi
je 0x41bdd1
inc dword [esi + 4]
mov ecx, dword [esp + 0x1bc]
push 0
call fcn.004bbbd0
mov esi, eax
mov eax, dword [esp + 0x1e4]
cmp eax, esi
je 0x41be15
test eax, eax
je 0x41be07
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41be07
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x1e4], esi
je 0x41be15
inc dword [esi + 4]
mov ecx, dword [esp + 0x1c0]
push 0
call fcn.004bbbd0
mov esi, eax
mov eax, dword [esp + 0x1e8]
cmp eax, esi
je 0x41be59
test eax, eax
je 0x41be4b
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41be4b
mov eax, dword [ecx]
push 1
call dword [eax]
test esi, esi
mov dword [esp + 0x1e8], esi
je 0x41be59
inc dword [esi + 4]
mov ecx, dword [esp + 0x1c4]
push 0
call fcn.004bbbd0
mov esi, eax
mov eax, dword [esp + 0x1ec]
cmp eax, esi
je 0x41be9d
test eax, eax
je 0x41be8f
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41be8f
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x1ec], esi
je 0x41be9d
inc dword [esi + 4]
mov ecx, dword [esp + 0x1c8]
push 0
call fcn.004bbbd0
mov esi, eax
mov eax, dword [esp + 0x1f0]
cmp eax, esi
je 0x41bee1
test eax, eax
je 0x41bed3
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41bed3
mov eax, dword [ecx]
push 1
call dword [eax]
test esi, esi
mov dword [esp + 0x1f0], esi
je 0x41bee1
inc dword [esi + 4]
mov ecx, dword [esp + 0x1cc]
push 0
call fcn.004bbbd0
mov esi, eax
mov eax, dword [esp + 0x1f4]
cmp eax, esi
je 0x41bf25
test eax, eax
je 0x41bf17
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41bf17
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x1f4], esi
je 0x41bf25
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41bf65
mov edx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x3b4]
push ecx
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41bf67
xor eax, eax
test eax, eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0x2c4], eax
je 0x41bf7c
inc dword [eax + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41bfbc
mov edx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x434]
push ecx
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41bfbe
xor eax, eax
test eax, eax
mov dword [esp + 0xec], eax
mov dword [esp + 0x25c], eax
je 0x41bfd3
inc dword [eax + 4]
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x2b4], eax
je 0x41bfed
inc dword [eax + 4]
mov eax, dword [esp + 0x28]
test eax, eax
mov dword [esp + 0x2ac], eax
je 0x41bfff
inc dword [eax + 4]
mov eax, dword [0x72eb4c]
cmp eax, 5
ja case.0x41c00d.3
jmp dword [eax*4 + 0x424c4c]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c141
mov ecx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.cam_deck_01.kfm
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c143
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c141
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.cam_deck_02.kfm
jmp 0x41c0ef
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c141
mov ecx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.cam_deck_03.kfm
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c143
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c141
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.cam_dueling_garden_v2.kfm
mov edx, dword [0x8ebfec]
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c143
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c141
mov ecx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Tavern_camera.kfm
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c143
xor eax, eax
lea edi, [esp + 0x4c]
mov esi, eax
call fcn.004c2eb0
mov eax, dword [0x72eb4c]
test eax, eax
mov dword [0x72ecd4], 0xfa
mov dword [0x72ecc8], 0x55
mov dword [0x72ecd0], 0xfffffffd
mov dword [0x72eb3c], 0
jl 0x41c284
cmp eax, 2
jg 0x41c284
mov ebp, dword [esp + 0xc8]
mov eax, ebp
sub eax, 0
je 0x41c245
dec eax
je 0x41c1fa
dec eax
jne 0x41c28b
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c272
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.fx_drifting_smoke_night.nif
mov edx, dword [0x8ebfec]
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
lea edi, [esp + 0x94]
call fcn.004c2eb0
jmp 0x41c28b
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c272
mov ecx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.fx_drifting_smoke_sunset.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
lea edi, [esp + 0x94]
call fcn.004c2eb0
jmp 0x41c28b
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c272
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.fx_drifting_smoke_noon.nif
jmp 0x41c1d4
xor eax, eax
mov esi, eax
lea edi, [esp + 0x94]
call fcn.004c2eb0
jmp 0x41c28b
mov ebp, dword [esp + 0xc8]
mov eax, dword [0x72eb4c]
cmp eax, 6
ja case.default.0x41c299
jmp dword [eax*4 + 0x424c64]
mov eax, ebp
sub eax, 0
je 0x41c333
dec eax
je 0x41c2f6
dec eax
jne 0x41c36a
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c35d
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Ship_Deck_01n.nif
mov ecx, dword [0x8ebfec]
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c35f
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c35d
mov edx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Ship_Deck_01s.nif
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c35f
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c35d
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Ship_Deck_01.nif
jmp 0x41c2e1
xor eax, eax
lea edi, [esp + 0x18]
mov esi, eax
call fcn.004c2eb0
mov edx, dword [esp + 0x18]
push 1
push edx
call fcn.004bf440
jmp case.default.0x41c299
mov eax, ebp
sub eax, 0
je 0x41c40e
dec eax
je 0x41c3d1
dec eax
jne 0x41c445
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c438
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Ship_Deck_02n.nif
mov ecx, dword [0x8ebfec]
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c43a
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c438
mov edx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Ship_Deck_02s.nif
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c43a
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c438
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Ship_Deck_02.nif
jmp 0x41c3bc
xor eax, eax
lea edi, [esp + 0x18]
mov esi, eax
call fcn.004c2eb0
mov edx, dword [esp + 0x18]
push 1
push edx
mov dword [0x72ecd0], 0xfffffff0
call fcn.004bf440
jmp case.default.0x41c299
mov eax, ebp
sub eax, 0
je 0x41c4f3
dec eax
je 0x41c4b6
dec eax
jne 0x41c52a
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c51d
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Ship_Deck_03.n.nif
mov ecx, dword [0x8ebfec]
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c51f
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c51d
mov edx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Ship_Deck_03s.nif
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c51f
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c51d
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Ship_Deck_03.nif
jmp 0x41c4a1
xor eax, eax
lea edi, [esp + 0x18]
mov esi, eax
call fcn.004c2eb0
mov eax, dword [0x72ecd4]
mov edx, dword [esp + 0x18]
push 1
neg eax
push edx
mov dword [0x72ecd4], eax
mov dword [0x72ecd0], 0xfffffffe
call fcn.004bf440
jmp case.default.0x41c299
mov eax, dword [0x72ed74]
call fcn.004e4740
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c5a6
mov ecx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.dueling_garden_001.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
lea edi, [esp + 0x18]
call fcn.004c2eb0
jmp 0x41c8ca
xor eax, eax
mov esi, eax
lea edi, [esp + 0x18]
call fcn.004c2eb0
jmp 0x41c8ca
mov eax, dword [0x72ed74]
call fcn.004e4740
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c5ff
mov edx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.dueling_garden_002.nif
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c601
xor eax, eax
mov esi, eax
lea edi, [esp + 0x18]
call fcn.004c2eb0
mov dword [0x725900], 0
jmp 0x41c8ca
mov eax, dword [0x72ed74]
call fcn.004e4740
mov eax, dword [0x72eb48]
sub eax, 0
push 0xc0
je 0x41c6db
dec eax
je 0x41c6a3
dec eax
je 0x41c667
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c713
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.tav_d_duel.nif
jmp 0x41c6c6
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c713
mov edx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.tav_f_duel.nif
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c715
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c713
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.tav_e_duel.nif
mov ecx, dword [0x8ebfec]
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c715
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c713
mov edx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.tav_s_duel.nif
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c715
xor eax, eax
lea edi, [esp + 0x18]
mov esi, eax
call fcn.004c2eb0
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c75d
mov ecx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.tavern_railing.kfm
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c75f
xor eax, eax
mov esi, eax
lea edi, [esp + 0x9c]
call fcn.004c2eb0
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c7aa
mov edx, dword [0x8ebffc]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.tavern_window.kfm
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c7ac
xor eax, eax
mov esi, eax
mov edi, 0x8ccdf0
call fcn.004c2eb0
mov eax, dword [esp + 0x4bc]
test eax, eax
je 0x41c7c8
mov eax, dword [eax + 0x18]
jmp 0x41c7ca
xor eax, eax
push eax
mov eax, dword [0x72eb48]
push 2
call fcn.00482960
add esp, 8
mov esi, eax
mov edi, 0x8ccdf4
call fcn.004c2eb0
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c823
mov ecx, dword [0x8ebffc]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.broken_glass_pieces.kfm
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c825
xor eax, eax
mov esi, eax
mov edi, 0x8ccdf8
call fcn.004c2eb0
mov ecx, dword [0x8ec08c]
mov edx, dword [ecx]
push 0x729424
call dword [edx + 0x74]
and dword [0x7283bc], 0xfffffffe
mov dword [0x72ecd4], 0
mov dword [0x72ecd0], 2
mov dword [0x72eb3c], 1
jmp case.default.0x41c299
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41c8a5
mov ecx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.ramparts_01.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
jmp 0x41c8a7
xor eax, eax
mov esi, eax
lea edi, [esp + 0x18]
call fcn.004c2eb0
mov edx, dword [0x725900]
mov ecx, dword [0x72ed74]
add edx, 0xffffff06
push edx
call fcn.004e5e80
mov dword [0x72ecd0], 0xfffffff0
cmp dword [0x72eb4c], 2
mov byte [0x86bb48], 0
jg 0x41c90d
cmp dword [esp + 0x49c], 1
jle 0x41c90d
push str.The_ships_collide_with_a_mighty_crash_
mov esi, 0x8ebf58
call fcn.004f7660
add esp, 4
push str.As_your_crew_rushes_to_attack__the_enemy_captain_approaches_with_his_sword_drawn__n
call fcn.004f7680
add esp, 4
mov eax, dword [0x85c158]
test eax, eax
je 0x41c9d0
push 0
push 0x28
call fcn.00487950
push str.Select_your_weapon..._n_Longsword__Versatile__n_Rapier__Quick_attack__n_Cutlass__Solid_defense__n
mov esi, 0x8ebf58
call fcn.004f7680
mov al, byte [0x86bb48]
add esp, 0xc
test al, al
je 0x41c9da
mov ebx, str.TBB_HigherAlpha.dds
mov eax, 0x8e86f0
call fcn.00412f10
mov ecx, dword [0x85c268]
push 1
mov eax, 0x66666667
imul ecx
push 0
push 0xffffffffffffffff
push 0
sar edx, 1
push 0
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0xffffffffffffffff
or eax, 1
push 0
push str.ChooseWeapon.dds
push eax
mov eax, dword [0x85c26c]
cdq
and edx, 3
add eax, edx
sar eax, 2
push eax
mov dword [0x8ccc44], 0xc47a4000
call fcn.00430160
mov esi, eax
add esp, 0x28
mov ebx, str.TBB.dds
mov eax, 0x8e86f0
call fcn.00412f10
test esi, esi
mov eax, esi
jge 0x41c9bf
xor eax, eax
mov dword [0x72ecb8], eax
jmp 0x41c9da
cmp esi, 2
jle 0x41c9c9
mov eax, 2
mov dword [0x72ecb8], eax
jmp 0x41c9da
mov dword [0x72ecb8], 0
cmp dword [esp + 0x49c], 0xffffffff
je 0x41cc6b
xor eax, eax
mov dword [esp + 0x2d8], eax
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x2dc], eax
mov dword [esp + 0x238], ecx
mov dword [esp + 0x214], edx
mov dword [esp + 0x2e0], eax
mov dword [esp + 0x23c], ecx
mov dword [esp + 0x218], edx
mov dword [esp + 0x2e4], eax
mov dword [esp + 0x240], ecx
mov dword [esp + 0x21c], edx
mov dword [esp + 0x2e8], eax
mov dword [esp + 0x244], ecx
mov dword [esp + 0x220], edx
mov dword [esp + 0x2ec], eax
mov dword [esp + 0x248], ecx
mov dword [esp + 0x224], edx
mov dword [esp + 0x2f0], eax
mov dword [esp + 0x24c], ecx
mov dword [esp + 0x228], edx
mov dword [esp + 0x2f4], eax
mov dword [esp + 0x250], ecx
mov dword [esp + 0x22c], edx
mov dword [esp + 0x2f8], eax
mov eax, dword [esp + 0xd0]
test eax, eax
mov dword [esp + 0x254], ecx
mov dword [esp + 0x230], edx
mov dword [esp + 0x258], ecx
mov dword [esp + 0x234], edx
je 0x41cc6b
lea ecx, [esp + 0x2d8]
push ecx
lea edx, [esp + 0x218]
push edx
mov edx, dword [0x8ec000]
lea eax, [esp + 0x240]
push eax
push 0xffffffffffffffff
push 0
push 0
or ecx, 0xffffffff
call fcn.004814c0
add esp, 0x18
mov esi, eax
lea edi, [esp + 0x7c]
call fcn.004c2eb0
lea ecx, [esp + 0x2e4]
push ecx
lea edx, [esp + 0x224]
push edx
mov edx, dword [0x8ec000]
lea eax, [esp + 0x24c]
push eax
push 0xffffffffffffffff
push 0
push 0
or ecx, 0xffffffff
call fcn.004814c0
add esp, 0x18
mov esi, eax
lea edi, [esp + 0x80]
call fcn.004c2eb0
lea ecx, [esp + 0x2f0]
push ecx
lea edx, [esp + 0x230]
push edx
mov edx, dword [0x8ec000]
lea eax, [esp + 0x258]
push eax
push 0xffffffffffffffff
push 0
push 0
or ecx, 0xffffffff
call fcn.004814c0
add esp, 0x18
mov esi, eax
lea edi, [esp + 0x84]
call fcn.004c2eb0
lea ecx, [esp + 0x2dc]
push ecx
mov ecx, dword [0x72eb48]
lea edx, [esp + 0x21c]
push edx
mov edx, dword [0x8ec000]
lea eax, [esp + 0x244]
push eax
push 0xffffffffffffffff
push 1
push 0
call fcn.004814c0
add esp, 0x18
mov esi, eax
lea edi, [esp + 0x88]
call fcn.004c2eb0
lea ecx, [esp + 0x2e8]
push ecx
mov ecx, dword [0x72eb48]
lea edx, [esp + 0x228]
push edx
mov edx, dword [0x8ec000]
lea eax, [esp + 0x250]
push eax
push 0xffffffffffffffff
push 1
push 0
call fcn.004814c0
add esp, 0x18
mov esi, eax
lea edi, [esp + 0x8c]
call fcn.004c2eb0
lea ecx, [esp + 0x2f4]
push ecx
mov ecx, dword [0x72eb48]
lea edx, [esp + 0x234]
push edx
mov edx, dword [0x8ec000]
lea eax, [esp + 0x25c]
push eax
push 0xffffffffffffffff
push 1
push 0
call fcn.004814c0
add esp, 0x18
mov esi, eax
lea edi, [esp + 0x90]
call fcn.004c2eb0
lea ecx, [esp + 0x2e4]
push ecx
lea edx, [esp + 0x220]
push edx
mov edx, dword [0x8ec000]
lea eax, [esp + 0x248]
push eax
push 0xffffffffffffffff
push 0
push 0
or ecx, 0xffffffff
call fcn.004814c0
add esp, 0x18
mov esi, eax
lea edi, [esp + 0xb8]
call fcn.004c2eb0
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41ccb8
mov ecx, dword [0x8ec008]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.energyBar.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
test eax, eax
je 0x41ccb8
mov ecx, dword [eax + 4]
inc ecx
mov dword [esp + 0xd8], eax
mov dword [eax + 4], ecx
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41cd05
mov edx, dword [0x8ec000]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.fx_sword_hit_thrust.nif
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
test eax, eax
je 0x41cd05
mov ecx, dword [eax + 4]
inc ecx
mov dword [esp + 0xc0], eax
mov dword [eax + 4], ecx
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41cd52
mov ecx, dword [0x8ec000]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.dizzy_fx_only.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
test eax, eax
je 0x41cd52
mov ecx, dword [eax + 4]
inc ecx
mov dword [esp + 0x138], eax
mov dword [eax + 4], ecx
xor edi, edi
mov ebp, 0xbf800000
lea esp, [esp]
mov ecx, dword [0x72eb4c]
lea eax, [edi + ecx*4]
add eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [edx*4 + 0x725908]
xor esi, esi
cmp eax, esi
je 0x41cdf5
push 0xc0
call fcn.005354b8
add esp, 4
cmp eax, esi
je 0x41cdc1
mov edx, dword [0x72eb4c]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
push esi
lea ecx, [edi + edx*4]
add ecx, edx
push esi
lea ecx, [ecx + ecx*2]
mov edx, dword [ecx*4 + 0x725908]
mov ecx, dword [0x8ec000]
push esi
push edx
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
mov ecx, dword [esp + edi*4 + 0x184]
cmp ecx, esi
je 0x41cde9
test ecx, ecx
je 0x41cddb
dec dword [ecx + 4]
jne 0x41cddb
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + edi*4 + 0x184], esi
je 0x41cde9
inc dword [esi + 4]
mov eax, dword [esp + edi*4 + 0x184]
mov dword [eax + 0x2c], ebp
jmp 0x41ce12
mov ecx, dword [esp + edi*4 + 0x184]
cmp ecx, esi
je 0x41ce12
dec dword [ecx + 4]
jne 0x41ce0b
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + edi*4 + 0x184], esi
inc edi
cmp edi, 5
jl 0x41cd60
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41ce5b
mov ecx, dword [0x8ec000]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.duel_props.kfm
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x41ce5d
xor esi, esi
mov eax, dword [esp + 0xa8]
cmp eax, esi
je 0x41ce91
test eax, eax
je 0x41ce83
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41ce83
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0xa8], esi
je 0x41ce91
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41ced0
mov ecx, dword [0x8ec000]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.duel_props.kfm
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x41ced2
xor esi, esi
mov eax, dword [esp + 0xac]
cmp eax, esi
je 0x41cf06
test eax, eax
je 0x41cef8
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41cef8
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0xac], esi
je 0x41cf06
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41cf45
mov ecx, dword [0x8ec000]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.bucket_ground.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x41cf47
xor esi, esi
mov eax, dword [esp + 0x20c]
cmp eax, esi
je 0x41cf7b
test eax, eax
je 0x41cf6d
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41cf6d
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x20c], esi
je 0x41cf7b
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41cfba
mov ecx, dword [0x8ec000]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.gaff_ground.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x41cfbc
xor esi, esi
mov eax, dword [esp + 0x210]
cmp eax, esi
je 0x41cff0
test eax, eax
je 0x41cfe2
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x41cfe2
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x210], esi
je 0x41cff0
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41d03d
mov ecx, dword [0x8ec000]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.fx_explosion_on_deck.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
test eax, eax
je 0x41d03d
mov ecx, dword [eax + 4]
inc ecx
mov dword [esp + 0xb4], eax
mov dword [eax + 4], ecx
mov eax, dword [esp + 0xb4]
call fcn.004bb170
mov eax, dword [0x7258fc]
cmp eax, 0xffffffff
je 0x41d173
mov ecx, 0x8cccd0
dec eax
cmp eax, 6
mov dword [esp + 0x20], ecx
mov dword [esp + 0x40], ecx
ja case.default.0x41d06e
jmp dword [eax*4 + 0x424c80]
mov ebx, str.blackbeard_var.dds
lea eax, [esp + 0x20]
call fcn.00412f10
mov ebx, str.blackbeard_512.dds
jmp 0x41d11e
mov ebx, str.kidd_var.dds
lea eax, [esp + 0x20]
call fcn.00412f10
mov ebx, str.Kidd_512.dds
jmp 0x41d11e
mov ebx, str.bonnet_var.dds
lea eax, [esp + 0x20]
call fcn.00412f10
mov ebx, str.Bonnet_512.dds
jmp 0x41d11e
mov ebx, str.lollonais_var.dds
lea eax, [esp + 0x20]
call fcn.00412f10
mov ebx, str.lolonnais_512.dds
jmp 0x41d11e
mov ebx, str.roberts_var.dds
lea eax, [esp + 0x20]
call fcn.00412f10
mov ebx, str.Roberts.dds
jmp 0x41d11e
mov ebx, str.rackam_var.dds
lea eax, [esp + 0x20]
call fcn.00412f10
mov ebx, str.rackam.dds
jmp 0x41d11e
mov ebx, str.uber_villian_var.dds
lea eax, [esp + 0x20]
call fcn.00412f10
mov ebx, str.uber_villian.dds
jmp 0x41d11e
mov ebx, str.morgan_var.dds
lea eax, [esp + 0x20]
call fcn.00412f10
mov ebx, str.Henry_Morgan512.dds
lea eax, [esp + 0x40]
call fcn.00412f10
mov eax, dword [esp + 0x28]
call fcn.004bb170
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x40]
push edi
push esi
push 0
push eax
call fcn.004bfe30
lea eax, [esi - 8]
add esp, 0x10
test eax, eax
je 0x41d15c
cmp eax, 0x8cccc8
je 0x41d15c
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
lea eax, [edi - 8]
test eax, eax
je 0x41d173
cmp eax, 0x8cccc8
je 0x41d173
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
mov al, byte [0x72eb41]
test al, al
je 0x41d251
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41d1ca
mov edx, dword [0x8ec000]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.fx_blackbeard_fire.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
test eax, eax
je 0x41d1ca
mov ecx, dword [eax + 4]
inc ecx
mov dword [esp + 0xe8], eax
mov dword [eax + 4], ecx
mov edi, dword [esp + 0xe8]
mov ecx, edi
call fcn.004c1010
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41d222
mov ecx, dword [0x8ec000]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.fx_blackbeard_smoke.nif
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
test eax, eax
je 0x41d222
mov ecx, dword [eax + 4]
inc ecx
mov dword [esp + 0xe0], eax
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x28]
push 0xffffffffffffffff
push 0x64
push str.fx_blackbeard_fire
push edx
mov ebx, edi
call fcn.004c1750
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0xe0]
push 0xffffffffffffffff
push 0x64
push str.fx_blackbeard_fire
push eax
call fcn.004c1750
mov esi, dword [esp + 0x28]
call fcn.00419c20
mov esi, dword [esp + 0xac]
call fcn.00419c20
mov esi, dword [esp + 0x12c]
call fcn.00419c20
mov al, byte [0x8ccc29]
test al, al
je 0x41d2e2
xor esi, esi
lea ecx, [ecx]
mov eax, dword [esp + esi*4 + 0x24]
call fcn.004bb170
push eax
call fcn.005035d0
mov eax, dword [esp + esi*4 + 0x28]
add esp, 4
push 3
call fcn.004bb170
push eax
call fcn.005036c0
mov eax, dword [esp + esi*4 + 0x2c]
add esp, 8
call fcn.004bb170
push eax
call fcn.004b0010
mov eax, dword [esp + esi*4 + 0x28]
add esp, 4
push 1
push 0
call fcn.004bb170
mov ecx, eax
call fcn.00535550
mov eax, dword [esp + esi*4 + 0x24]
call fcn.004bb170
mov ecx, eax
call fcn.00535bb0
inc esi
cmp esi, 2
jb 0x41d280
cmp dword [esp + 0x49c], 0xffffffff
je 0x41d549
mov eax, dword [esp + 0xd0]
test eax, eax
je 0x41d549
xor esi, esi
mov eax, dword [esp + esi + 0x7c]
push 1
push str.bolt_on_right_hand
push eax
mov edi, str.crew_cutlass.nif
call fcn.004c13c0
mov eax, dword [esp + esi + 0x88]
push 1
push str.bolt_on_right_hand
push eax
call fcn.004c13c0
mov al, byte [0x8ccc29]
test al, al
je 0x41d3de
mov eax, dword [esp + esi + 0x7c]
call fcn.004bb170
push eax
call fcn.005035d0
mov eax, dword [esp + esi + 0x80]
add esp, 4
push 3
call fcn.004bb170
push eax
call fcn.005036c0
mov eax, dword [esp + esi + 0x84]
add esp, 8
push 1
push 0
call fcn.004bb170
mov ecx, eax
call fcn.00535550
mov eax, dword [esp + esi + 0x7c]
call fcn.004bb170
mov ecx, eax
call fcn.00535bb0
mov eax, dword [esp + esi + 0x88]
call fcn.004bb170
push eax
call fcn.005035d0
mov eax, dword [esp + esi + 0x8c]
add esp, 4
push 3
call fcn.004bb170
push eax
call fcn.005036c0
mov eax, dword [esp + esi + 0x90]
add esp, 8
push 1
push 0
call fcn.004bb170
mov ecx, eax
call fcn.00535550
mov eax, dword [esp + esi + 0x88]
call fcn.004bb170
mov ecx, eax
call fcn.00535bb0
add esi, 4
cmp esi, 0xc
jl 0x41d301
mov ebx, dword [esp + 0xb8]
push 1
push str.bolt_on_right_hand
push ebx
mov edi, str.crew_cutlass.nif
call fcn.004c13c0
xor edi, edi
xor esi, esi
jmp 0x41d410
mov eax, dword [esp + edi + 0x238]
test eax, eax
je 0x41d432
cmp eax, 1
mov ecx, str.crew_2a_var1.dds
je 0x41d42a
mov ecx, str.crew_2a_var2.dds
push ecx
push str.crew_2a.dds
jmp 0x41d45e
mov eax, dword [esp + edi + 0x214]
test eax, eax
je 0x41d449
push str.crew_6a_var1.dds
push str.crew_6a.dds
jmp 0x41d45e
mov eax, dword [esp + edi + 0x2d8]
test eax, eax
je 0x41d475
push str.crew_6b_var1.dds
push str.crew_6b.dds
mov eax, dword [esp + esi + 0x84]
push 0
call fcn.004bb170
push eax
call fcn.004bfe30
add esp, 0x10
mov eax, dword [esp + edi + 0x23c]
test eax, eax
je 0x41d497
cmp eax, 1
mov ecx, str.crew_2a_var1.dds
je 0x41d48f
mov ecx, str.crew_2a_var2.dds
push ecx
push str.crew_2a.dds
jmp 0x41d4c3
mov eax, dword [esp + edi + 0x218]
test eax, eax
je 0x41d4ae
push str.crew_6a_var1.dds
push str.crew_6a.dds
jmp 0x41d4c3
mov eax, dword [esp + edi + 0x2dc]
test eax, eax
je 0x41d4da
push str.crew_6b_var1.dds
push str.crew_6b.dds
mov eax, dword [esp + esi + 0x90]
push 0
call fcn.004bb170
push eax
call fcn.004bfe30
add esp, 0x10
mov eax, dword [esp + edi + 0x240]
test eax, eax
je 0x41d4fc
cmp eax, 1
mov eax, str.crew_2a_var1.dds
je 0x41d4f4
mov eax, str.crew_2a_var2.dds
push eax
push str.crew_2a.dds
jmp 0x41d528
mov eax, dword [esp + edi + 0x21c]
test eax, eax
je 0x41d513
push str.crew_6a_var1.dds
push str.crew_6a.dds
jmp 0x41d528
mov eax, dword [esp + edi + 0x2e0]
test eax, eax
je 0x41d53a
push str.crew_6b_var1.dds
push str.crew_6b.dds
mov eax, ebx
push 0
call fcn.004bb170
push eax
call fcn.004bfe30
add esp, 0x10
add esi, 4
add edi, 0xc
cmp esi, 0xc
jl 0x41d410
cmp dword [0x72eb4c], 5
mov ecx, dword [0x72ecd0]
mov ebp, dword [esp + 0x4b8]
mov dword [0x72eccc], ecx
jne 0x41d59a
test ebp, ebp
jne 0x41d57c
mov eax, dword [0x72eb48]
call fcn.00419cc0
mov ebp, eax
mov dword [esp + 0x4b8], ebp
push 0x63
push ebp
call fcn.004bf440
mov edx, dword [esp + 0x18]
push 6
push edx
mov dword [0x72eccc], 0xfffffffe
call fcn.004bf440
mov eax, 0x8cccd0
mov dword [esp + 0xcc], eax
mov dword [esp + 0xc4], eax
cmp dword [0x72eb48], 3
je 0x41d62d
mov esi, 1
lea edi, [esp + 0x1d0]
mov ebx, 0xa
jmp 0x41d5d0
push esi
push str.Crewcount__02d.dds
lea edx, [esp + 0xd4]
call fcn.004f3ce0
mov eax, dword [0x72eb48]
movsx ecx, byte [eax + str.sefdp]
push esi
push ecx
push str.Crewcount__c__02d.dds
lea edx, [esp + 0xd8]
call fcn.004f3ce0
mov edx, dword [esp + 0xd8]
mov ecx, dword [esp + 0xe0]
mov eax, dword [edi]
add esp, 0x14
push edx
push ecx
push 0
call fcn.004bb170
push eax
call fcn.004bfe30
add esp, 0x10
inc esi
add edi, 4
dec ebx
jne 0x41d5d0
mov esi, 1
lea edi, [esp + 0x1a8]
mov ebx, 0xa
mov edi, edi
push esi
push str.Crewcount__02d.dds
lea edx, [esp + 0xd4]
call fcn.004f3ce0
push esi
push str.Crewcount_p__02d.dds
lea edx, [esp + 0xd4]
call fcn.004f3ce0
mov edx, dword [esp + 0xd4]
mov ecx, dword [esp + 0xdc]
mov eax, dword [edi]
add esp, 0x10
push edx
push ecx
push 0
call fcn.004bb170
push eax
call fcn.004bfe30
add esp, 0x10
inc esi
add edi, 4
dec ebx
jne 0x41d640
mov edx, dword [0x728820]
mov al, byte [0x727d98]
mov byte [edx + 0x728814], al
mov edx, dword [0x728820]
inc edx
test al, al
mov dword [0x728820], edx
je 0x41d6e8
mov ecx, dword [0x8cb7c0]
mov eax, dword [0x8cb7c4]
mov byte [ecx + 0xb4], 0
mov byte [eax + 0xb4], 0
mov edx, dword [0x8ebfe8]
push edx
call fcn.00537020
mov eax, dword [0x8ebfe8]
mov ecx, dword [0x8cb7c4]
push eax
call fcn.00537020
mov eax, dword [esp + 0xb4]
mov byte [0x727d98], 0
mov byte [0x8cbdf4], 1
call fcn.004bb170
mov edi, dword [esp + 0x18]
push edi
call fcn.00427f80
mov ecx, dword [0x72eb4c]
add esp, 4
cmp ecx, 3
jl 0x41d753
cmp ecx, 4
jg 0x41d753
mov eax, dword [0x72eb3c]
shl eax, 4
mov ecx, dword [eax + 0x7257d8]
mov edx, dword [eax + 0x7257d4]
push ecx
mov ecx, dword [eax + 0x7257d0]
push edx
mov edx, dword [eax + 0x7257dc]
push ecx
push edx
mov esi, edi
call fcn.004a7430
mov ecx, dword [0x72eb4c]
add esp, 0x10
xor esi, esi
jmp 0x41d760
mov ebx, dword [esp + esi*4 + 0x184]
test ebx, ebx
je 0x41d7ff
lea eax, [esi + ecx*4]
add eax, ecx
lea eax, [eax + eax*2]
shl eax, 2
mov ecx, dword [eax + 0x725910]
cmp ecx, 0xffffffff
mov eax, dword [eax + 0x72590c]
je 0x41d7be
push ecx
push 0x64
push eax
push edi
call fcn.004c1750
mov al, byte [0x8cc928]
test al, al
je 0x41d7f9
mov ecx, dword [0x72eb4c]
lea eax, [esi + ecx*4]
add eax, ecx
lea eax, [eax + eax*2]
shl eax, 2
mov ecx, dword [eax + 0x725910]
mov edx, dword [eax + 0x72590c]
push ecx
jmp 0x41d7e9
push 0xffffffffffffffff
push 0x64
push eax
push edi
call fcn.004c1750
mov al, byte [0x8cc928]
test al, al
je 0x41d7f9
mov ecx, dword [0x72eb4c]
lea eax, [esi + ecx*4]
add eax, ecx
lea ecx, [eax + eax*2]
mov edx, dword [ecx*4 + 0x72590c]
push 0xffffffffffffffff
mov ebx, dword [esp + esi*4 + 0x188]
push 0x64
push edx
push ebp
call fcn.004c1750
mov ecx, dword [0x72eb4c]
inc esi
cmp esi, 5
jl 0x41d760
test ecx, ecx
je 0x41d850
cmp ecx, 1
je 0x41d850
cmp ecx, 2
je 0x41d850
cmp ecx, 5
jne 0x41d8f0
mov eax, dword [esp + 0x184]
push 0
push eax
push edi
mov ebx, str.fx_lantern
call fcn.004c1970
mov al, byte [0x8cc928]
test al, al
je 0x41d87d
mov ecx, dword [esp + 0x184]
push 0
push ecx
push ebp
call fcn.004c1970
jmp 0x41d87d
mov eax, dword [0x72eb3c]
shl eax, 4
mov edx, dword [eax + 0x7257d8]
mov ecx, dword [eax + 0x7257d4]
push edx
mov edx, dword [eax + 0x7257d0]
mov eax, dword [eax + 0x7257dc]
push ecx
push edx
push eax
push edi
call fcn.004a6f20
add esp, 0x14
cmp dword [0x72eb4c], 5
jne 0x41d8f0
push str.cl_floor01
lea ebx, [esp + 0x200]
mov esi, edi
call fcn.004c16d0
fild dword [0x725900]
mov edx, dword [esp + 0x200]
mov esi, dword [esp + 0x1fc]
fadd dword [esp + 0x204]
xor eax, eax
fstp dword [esp + 0x204]
mov edi, dword [esp + 0x204]
mov ecx, dword [esp + eax*4 + 0x24]
add ecx, 0x78
mov dword [ecx], esi
inc eax
cmp eax, 2
mov dword [ecx + 4], edx
mov dword [ecx + 8], edi
jl 0x41d8c4
mov eax, dword [esp + 0x9c]
call fcn.004bb170
mov esi, dword [esp + 0x18]
mov ebx, eax
call fcn.004bf5b0
mov eax, dword [0x72ecc4]
test eax, eax
jne 0x41d90e
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
xor eax, eax
call fcn.004a6910
add esp, 0xc
call fcn.004a2120
movsx edx, byte [0x86bb20]
mov ecx, dword [0x72ecb8]
mov esi, dword [esp + 0x24]
mov dword [0x8cc920], ecx
mov dword [0x8cc924], edx
call fcn.00419ac0
mov esi, dword [esp + 0xa8]
call fcn.00419ac0
mov esi, dword [esp + 0x124]
call fcn.00419ac0
mov esi, dword [esp + 0x128]
call fcn.00419ac0
mov eax, dword [0x72ecc4]
test eax, eax
je 0x41e523
cmp eax, 0x12c
je 0x41d973
cmp eax, 0x130
jne 0x41e0d0
mov eax, dword [0x72eb4c]
cmp eax, 5
mov dword [esp + 0x20], 0
push 0xc0
jne 0x41d9b3
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41da26
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.intro_cam_tavern.kfm
jmp 0x41da07
cmp eax, 2
jne 0x41d9e4
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41da26
mov edx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.intro_cam_deck03.kfm
push edx
jmp 0x41da0e
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41da26
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.intro_cam.kfm
mov ecx, dword [0x8ebfec]
push ecx
mov esi, eax
xor ebx, ebx
call fcn.004bb100
test eax, eax
je 0x41da26
mov ecx, dword [eax + 4]
inc ecx
mov dword [esp + 0x20], eax
mov dword [eax + 4], ecx
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41da60
mov edx, dword [0x8ebffc]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.rope_swing.kfm
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
jmp 0x41da62
xor eax, eax
test eax, eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0xd4], eax
je 0x41da74
inc dword [eax + 4]
mov eax, dword [esp + 0xc8]
xor ebp, ebp
sub eax, ebp
je 0x41dae2
dec eax
je 0x41dab1
dec eax
jne 0x41db2a
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41db2a
push ebp
push ebp
push ebp
push ebp
push 0xffffffffffffffff
push ebp
push ebp
push ebp
push ebp
push str.ship_intro_n.nif
jmp 0x41db0a
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41db2a
mov edx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.ship_intro_s.nif
push edx
jmp 0x41db11
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41db2a
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.ship_intro.nif
mov ecx, dword [0x8ebfec]
push ecx
mov esi, eax
mov ebx, 1
call fcn.004bb100
test eax, eax
je 0x41db2a
mov ecx, dword [eax + 4]
inc ecx
mov ebp, eax
mov dword [eax + 4], ecx
cmp dword [0x72ecc4], 0x12c
jne 0x41df12
mov eax, dword [esp + 0x24]
call fcn.004bb170
mov edi, dword [esp + 0x18]
mov ebx, eax
call fcn.004bf620
mov eax, dword [esp + 0x24]
call fcn.004bb170
mov ebx, eax
mov esi, ebp
call fcn.004bf5b0
mov esi, dword [esp + 0x6c]
mov eax, esi
call fcn.004bb170
mov ebx, eax
call fcn.004bf620
mov eax, esi
call fcn.004bb170
mov ebx, eax
mov esi, ebp
call fcn.004bf5b0
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
push eax
push 0xf
push 0x12c
mov byte [0x8cbdf4], 1
call fcn.00427de0
mov al, byte [0x86bb21]
add esp, 0x10
test al, al
je 0x41dbc6
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push ecx
push edi
push 0xf0
push 0x12c
call fcn.00427de0
jmp 0x41dbe3
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
push eax
push 0x80
push 0x12c
call fcn.00427de0
mov edi, dword [esp + 0x30]
add esp, 0x10
call fcn.00427db0
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x80]
push edx
push ebp
lea ecx, [esp + 0x30]
mov eax, 1
call fcn.0041a000
add esp, 0xc
push 1
push ebp
call fcn.004bf440
mov eax, dword [esp + 0x4bc]
test eax, eax
je 0x41dc26
mov ebx, dword [esp + 0x14]
jmp 0x41dc41
mov ebx, 1
mov dword [esp + 0x14], ebx
mov dword [esp + 0x118], 0x8cccd0
lea eax, [esp + 0x118]
mov eax, dword [eax]
mov edx, dword [esp + 0x6c]
push eax
mov eax, dword [0x72ecc4]
push eax
lea ecx, [esp + 0x2c]
push ecx
push edx
push ebp
push edi
push 1
push 0x12c
call fcn.00424f10
add esp, 0x20
test bl, 1
mov byte [esp + 0x3f], al
je 0x41dc9c
mov eax, dword [esp + 0x118]
and ebx, 0xfffffffe
add eax, 0xfffffff8
mov dword [esp + 0x14], ebx
je 0x41dc91
cmp eax, 0x8cccc8
je 0x41dc91
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esp + 0x118], 0x8cccd0
mov al, byte [esp + 0x3f]
test al, al
je 0x41de01
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x80]
push ecx
push esi
lea ecx, [esp + 0x30]
mov eax, 1
call fcn.0041a000
add esp, 0xc
push 2
push ebp
call fcn.004bf440
mov eax, dword [esp + 0x4bc]
test eax, eax
je 0x41dce3
jmp 0x41dcfc
or ebx, 2
mov dword [esp + 0x14], ebx
mov dword [esp + 0xf8], 0x8cccd0
lea eax, [esp + 0xf8]
mov eax, dword [eax]
push eax
push 0xffffffffffffffff
lea edx, [esp + 0x2c]
push edx
push 0
push esi
push edi
push 2
push 0x12c
call fcn.00424f10
add esp, 0x20
test bl, 2
mov byte [esp + 0x3f], al
je 0x41dd53
mov eax, dword [esp + 0xf8]
and ebx, 0xfffffffd
add eax, 0xfffffff8
mov dword [esp + 0x14], ebx
je 0x41dd45
cmp eax, 0x8cccc8
je 0x41dd45
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
mov esi, 0x8cccd0
mov dword [esp + 0xf8], esi
jmp 0x41dd58
mov esi, 0x8cccd0
mov al, byte [esp + 0x3f]
test al, al
je 0x41de01
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x80]
push ecx
push ebp
lea ecx, [esp + 0x30]
mov eax, 1
call fcn.0041a000
add esp, 0xc
push 1
push ebp
call fcn.004bf440
mov eax, dword [esp + 0x4bc]
test eax, eax
jne 0x41ddae
or ebx, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0xfc], esi
lea eax, [esp + 0xfc]
mov eax, dword [eax]
push eax
mov eax, dword [esp + 0x70]
push 0xffffffffffffffff
lea edx, [esp + 0x2c]
push edx
push eax
push ebp
push edi
push 4
push 0x12c
call fcn.00424f10
add esp, 0x20
test bl, 4
mov byte [esp + 0x3f], al
je 0x41de01
mov eax, dword [esp + 0xfc]
and ebx, 0xfffffffb
add eax, 0xfffffff8
mov dword [esp + 0x14], ebx
je 0x41ddfa
cmp eax, 0x8cccc8
je 0x41ddfa
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esp + 0xfc], esi
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x80]
push edx
push esi
lea ecx, [esp + 0x30]
mov eax, 1
call fcn.0041a000
add esp, 0xc
push 2
push ebp
call fcn.004bf440
mov eax, dword [esp + 0x24]
call fcn.004bb170
mov ebx, eax
mov edi, ebp
call fcn.004bf620
mov eax, dword [esp + 0x24]
call fcn.004bb170
mov ebx, eax
call fcn.004bf5b0
mov esi, dword [esp + 0x6c]
mov eax, esi
call fcn.004bb170
mov ebx, eax
call fcn.004bf620
mov eax, esi
call fcn.004bb170
mov esi, dword [esp + 0x18]
mov ebx, eax
call fcn.004bf5b0
mov al, byte [esp + 0x3f]
test al, al
je 0x41e073
mov edi, dword [esp + 0x4bc]
test edi, edi
je 0x41de90
mov eax, edi
jmp 0x41dea7
or dword [esp + 0x14], 8
mov dword [esp + 0x104], 0x8cccd0
lea eax, [esp + 0x104]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x2c]
push eax
push 0
push ecx
push esi
push 8
push 0x12c
call fcn.00424f10
mov bl, al
mov al, byte [esp + 0x34]
add esp, 0x20
test al, 8
je 0x41df08
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x104]
and edx, 0xfffffff7
add eax, 0xfffffff8
mov dword [esp + 0x14], edx
je 0x41defd
cmp eax, 0x8cccc8
je 0x41defd
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esp + 0x104], 0x8cccd0
test bl, bl
je 0x41e077
jmp 0x41df1d
mov edi, dword [esp + 0x4bc]
mov esi, dword [esp + 0x20]
mov al, byte [0x86bb21]
test al, al
lea edx, [esp + 0x24]
push edx
push esi
je 0x41dfdd
push 0xf0
push 0x12c
call fcn.00427de0
add esp, 0x10
call fcn.00427db0
test edi, edi
je 0x41df4f
mov eax, edi
jmp 0x41df66
or dword [esp + 0x14], 0x10
mov dword [esp + 0x10c], 0x8cccd0
lea eax, [esp + 0x10c]
mov ecx, dword [0x72ecc4]
cmp ecx, 0x12c
jne 0x41df77
or ecx, 0xffffffff
mov eax, dword [eax]
push eax
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
push eax
push 0
push ecx
push esi
push 0xf0
push 0x12c
call fcn.00424f10
mov al, byte [esp + 0x34]
add esp, 0x20
test al, 0x10
je 0x41e077
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10c]
and edx, 0xffffffef
add eax, 0xfffffff8
mov dword [esp + 0x14], edx
je 0x41dfcd
cmp eax, 0x8cccc8
je 0x41dfcd
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esp + 0x10c], 0x8cccd0
jmp 0x41e077
push 0x80
push 0x12c
call fcn.00427de0
add esp, 0x10
call fcn.00427db0
test edi, edi
je 0x41dffc
mov eax, edi
jmp 0x41e013
or dword [esp + 0x14], 0x20
mov dword [esp + 0x114], 0x8cccd0
lea eax, [esp + 0x114]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x2c]
push eax
push 0
push ecx
push esi
push 0x80
push 0x12c
call fcn.00424f10
mov al, byte [esp + 0x34]
add esp, 0x20
test al, 0x20
je 0x41e077
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x114]
and edx, 0xffffffdf
add eax, 0xfffffff8
mov dword [esp + 0x14], edx
je 0x41e066
cmp eax, 0x8cccc8
je 0x41e066
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esp + 0x114], 0x8cccd0
jmp 0x41e077
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x41e08e
dec dword [ecx + 4]
jne 0x41e08a
mov edx, dword [ecx]
push 1
call dword [edx]
xor edi, edi
jmp 0x41e095
mov edi, dword [esp + 0xd4]
test ebp, ebp
je 0x41e0a7
dec dword [ebp + 4]
jne 0x41e0a7
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax]
test edi, edi
je 0x41e0b8
dec dword [edi + 4]
jne 0x41e0b8
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx]
test esi, esi
je 0x41e0c9
dec dword [esi + 4]
jne 0x41e0c9
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov ebp, dword [esp + 0x4b8]
cmp dword [0x72ecc4], 0x82
jne 0x41e1da
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41e14f
mov ecx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Tavern_camera.kfm
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov esi, eax
test esi, esi
je 0x41e121
inc dword [esi + 4]
lea edx, [esp + 0x24]
push edx
push esi
push 7
push 0x82
call fcn.00427de0
add esp, 0x10
call fcn.00427db0
mov edi, dword [esp + 0x4bc]
test edi, edi
mov ebx, 0x40
je 0x41e153
mov eax, edi
jmp 0x41e169
xor esi, esi
jmp 0x41e121
or dword [esp + 0x14], ebx
mov dword [esp + 0x11c], 0x8cccd0
lea eax, [esp + 0x11c]
mov eax, dword [eax]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [0x72ecc4]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebp
push edx
push esi
push 7
push 0x82
call fcn.00424f10
mov al, byte [esp + 0x34]
add esp, 0x20
test bl, al
je 0x41e1c7
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x11c]
and edx, 0xffffffbf
add eax, 0xfffffff8
mov dword [esp + 0x14], edx
je 0x41e1bc
cmp eax, 0x8cccc8
je 0x41e1bc
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esp + 0x11c], 0x8cccd0
test esi, esi
je 0x41e1e1
dec dword [esi + 4]
jne 0x41e1e1
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x41e1e1
mov edi, dword [esp + 0x4bc]
cmp dword [0x72ecc4], 0x87
jne 0x41e2e4
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41e254
mov ecx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Tavern_camera.kfm
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov esi, eax
test esi, esi
je 0x41e232
inc dword [esi + 4]
lea edx, [esp + 0x24]
push edx
push esi
push 7
push 0x87
call fcn.00427de0
add esp, 0x10
call fcn.00427db0
test edi, edi
je 0x41e258
mov eax, edi
jmp 0x41e272
xor esi, esi
jmp 0x41e232
or dword [esp + 0x14], 0x80
mov dword [esp + 0x134], 0x8cccd0
lea eax, [esp + 0x134]
mov eax, dword [eax]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [0x72ecc4]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebp
push edx
push esi
push 7
push 0x87
call fcn.00424f10
mov al, byte [esp + 0x34]
add esp, 0x20
test al, al
jns 0x41e2d3
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x134]
and edx, 0xffffff7f
add eax, 0xfffffff8
mov dword [esp + 0x14], edx
je 0x41e2c8
cmp eax, 0x8cccc8
je 0x41e2c8
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esp + 0x134], 0x8cccd0
test esi, esi
je 0x41e2e4
dec dword [esi + 4]
jne 0x41e2e4
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
cmp dword [0x72ecc4], 0x259
jne 0x41e523
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41e7e5
mov ecx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.cam_uber_intro.kfm
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov edi, eax
test edi, edi
je 0x41e339
inc dword [edi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41e7ec
mov edx, dword [0x8ebffc]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.locket_uber_intro.kfm
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
test eax, eax
mov dword [esp + 0x98], eax
je 0x41e383
inc dword [eax + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x41e7fc
mov ecx, dword [0x8ebffc]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.locket_thrown.kfm
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov ebp, eax
test ebp, ebp
je 0x41e3c8
inc dword [ebp + 4]
lea edx, [esp + 0x24]
push edx
push edi
push 0x7ff
push 0x259
call fcn.00427de0
add esp, 0x10
call fcn.00427db0
mov eax, dword [esp + 0x4bc]
test eax, eax
mov esi, dword [esp + 0x14]
jne 0x41e40c
or esi, 0x100
mov dword [esp + 0x13c], 0x8cccd0
lea eax, [esp + 0x13c]
mov eax, dword [eax]
mov edx, dword [esp + 0x98]
push eax
mov eax, dword [0x72ecc4]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x2c]
push ecx
push edx
push eax
push edi
push 0x1ff
push 0x259
call fcn.00424f10
add esp, 0x20
test esi, 0x100
mov bl, al
je 0x41e471
mov eax, dword [esp + 0x13c]
and esi, 0xfffffeff
add eax, 0xfffffff8
je 0x41e466
cmp eax, 0x8cccc8
je 0x41e466
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esp + 0x13c], 0x8cccd0
test bl, bl
je 0x41e4ea
mov eax, dword [esp + 0x4bc]
test eax, eax
jne 0x41e498
or esi, 0x200
mov dword [esp + 0xf4], 0x8cccd0
lea eax, [esp + 0xf4]
mov eax, dword [eax]
mov edx, dword [esp + 0x18]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
push ecx
push ebp
push edx
push edi
push 0x600
push 0x259
call fcn.00424f10
add esp, 0x20
test esi, 0x200
je 0x41e4ea
mov eax, dword [esp + 0xf4]
add eax, 0xfffffff8
je 0x41e4df
cmp eax, 0x8cccc8
je 0x41e4df
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esp + 0xf4], 0x8cccd0
test ebp, ebp
je 0x41e4fc
dec dword [ebp + 4]
jne 0x41e4fc
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax]
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x41e512
dec dword [ecx + 4]
jne 0x41e512
mov edx, dword [ecx]
push 1
call dword [edx]
test edi, edi
je 0x41e523
dec dword [edi + 4]
jne 0x41e523
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov eax, dword [0x8ebfd8]
push 0x47629000
push 0x3c23d70a
mov byte [0x8cbdf4], 1
call fcn.00412840
call fcn.004a6e60
mov ecx, 0x64
xor esi, esi
mov dword [0x85c120], ecx
mov dword [0x85c12c], ecx
mov ecx, dword [0x72eb4c]
xor eax, eax
cmp ecx, 2
mov dword [esp + 0x198], esi
mov dword [esp + 0xd4], esi
mov dword [0x85c124], esi
mov dword [0x85c134], esi
mov dword [0x85c128], esi
mov dword [0x85c138], eax
jne 0x41e599
mov eax, dword [0x72ecd4]
neg eax
mov dword [0x85c128], eax
mov dword [0x85c138], eax
mov ecx, dword [0x725900]
push 0x20000000
push esi
push 0xb60b60b
push 0xe0000000
add ecx, 0xa1
push ecx
add eax, 0x100
push 0xffffff00
push eax
call fcn.004ad540
mov eax, dword [0x72eb4c]
add esp, 0x1c
cmp eax, 4
jne 0x41e5f0
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x328]
push edx
call fcn.004bb170
mov ebx, eax
call fcn.00419de0
add esp, 4
xor esi, esi
or eax, 0xffffffff
mov dword [esp + 0x14c], eax
mov dword [esp + 0x148], eax
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x2d8]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.MSVCR71.dll_rand]
mov ebx, esi
and bl, 1
neg bl
sbb ebx, ebx
add ebx, 2
call edi
cdq
mov ecx, 0xf
idiv ecx
inc esi
cmp esi, 4
mov dword [esp + edx*4 + 0x2dc], ebx
jl 0x41e617
mov edx, dword [0x72eb4c]
cmp edx, 3
je 0x41e64f
cmp edx, 4
je 0x41e64f
cmp edx, 5
jne 0x41e65f
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x2d8]
rep stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x26
mov edi, 0x72ecd8
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x4a8]
or eax, 0xffffffff
mov dword [0x72ed44], eax
mov dword [0x72ecf8], eax
mov dword [0x72ed48], eax
mov dword [0x72ecfc], eax
mov dword [0x72ed58], eax
mov dword [0x72ed0c], eax
mov eax, dword [esp + 0x4a0]
mov dword [0x72ed14], eax
mov eax, dword [esp + 0x49c]
mov dword [0x72ed18], eax
mov eax, dword [0x8cc918]
mov dword [0x72ed60], ecx
mov ecx, dword [esp + 0x4a4]
xor ebx, ebx
cmp eax, ebx
mov dword [0x72ed64], ecx
jne 0x41e6d0
mov eax, 0xfffffff
cmp edx, 2
mov dword [0x72ed20], eax
mov dword [0x72ed6c], eax
mov dword [0x72ece4], 0x1e
mov dword [0x72ed30], 0xffffffba
mov dword [0x72ece8], ebx
mov dword [0x72ed34], ebx
je 0x41e704
cmp edx, 5
jne 0x41e725
mov edx, dword [0x72ed1c]
mov ecx, dword [0x72ed68]
mov eax, 0x20
or edx, eax
or ecx, eax
mov dword [0x72ed1c], edx
mov dword [0x72ed68], ecx
mov dl, byte [0x86bb21]
movsx eax, dl
lea ecx, [eax + eax*4 + 0x14]
shl ecx, 1
cmp dl, bl
mov dword [esp + 0x40], ebx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x64], ecx
je 0x41e791
mov ecx, dword [0x725874]
mov ebp, dword [0x72ecf0]
imul ecx, eax
mov esi, dword [0x72ed3c]
sub ebp, eax
sub esi, eax
mov edx, 0x1e
sub edx, ecx
mov eax, 0xffffffba
sub eax, ecx
mov dword [0x72ecf0], ebp
mov dword [0x72ece4], edx
mov dword [0x72ed3c], esi
mov dword [0x72ed30], eax
mov dword [esp + 0x154], ebx
push ebx
call fcn.0042e1a0
add esp, 4
cmp eax, ebx
jne 0x41e798
mov ecx, dword [esp + 0x2d0]
xor ebp, ebp
push ecx
mov dword [0x86e35c], ebx
mov dword [0x86e360], ebx
mov dword [esp + 0x9c], ebp
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [esp + 0xa4], 1
cmp byte [0x8ccc29], bl
mov edi, dword [esp + 0x120]
je 0x41e803
push ebx
jmp 0x41e805
xor edi, edi
jmp 0x41e339
mov dword [esp + 0x98], 0
jmp 0x41e383
xor ebp, ebp
jmp 0x41e3c8
push 1
mov ebx, dword [0x72ed74]
call fcn.004e5cc0
mov ecx, dword [0x72ecc4]
mov eax, dword [0x8ebfd8]
xor ebx, ebx
cmp ecx, ebx
push 0x47629000
sete dl
push 0x3c23d70a
movzx esi, dl
call fcn.00412840
inc edi
cmp edi, 0x46
mov dword [esp + 0x120], edi
jg 0x41e8d5
cmp esi, ebx
je 0x41e8d5
push 0xc0
call fcn.005354b8
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x41e8ad
mov ecx, 0x46
sub ecx, edi
imul ecx, ecx, 0xff
mov eax, 0xea0ea0eb
imul ecx
push ebx
add edx, ecx
mov ecx, dword [0x85c268]
push ebx
sar edx, 6
push ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x85c26c]
push ebx
shl eax, 0x18
or eax, 0x787878
push eax
mov eax, dword [0x8ec008]
push ecx
push edx
push ebx
push ebx
push ebx
push eax
call fcn.004bb100
mov esi, eax
jmp 0x41e8af
xor esi, esi
cmp ebp, esi
je 0x41e8ee
cmp ebp, ebx
je 0x41e8c5
dec dword [ebp + 4]
jne 0x41e8c5
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx]
cmp esi, ebx
mov dword [esp + 0x98], esi
je 0x41e8ee
inc dword [esi + 4]
jmp 0x41e8ee
cmp ebp, ebx
je 0x41e8ee
dec dword [ebp + 4]
jne 0x41e8e7
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax]
mov dword [esp + 0x98], ebx
fld qword [0x8ca4b0]
fmul dword [0x715698]
call fcn.005f275c
mov esi, eax
test byte [0x8ef61c], 1
mov dword [esp + 0x108], esi
jne 0x41e923
or dword [0x8ef61c], 1
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x8ef618], eax
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [0x8ef618]
mov edi, dword [esp + 0x154]
mov dword [esp + 0x298], eax
mov ecx, esi
sub ecx, edi
shl ecx, 1
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 5
jge 0x41e95f
mov eax, 5
jmp 0x41e969
cmp eax, 0x14
jle 0x41e969
mov eax, 0x14
cmp esi, edi
mov dword [esp + 0x74], eax
jne 0x41e977
xor eax, eax
mov dword [esp + 0x74], eax
add eax, eax
mov dword [0x7288ec], eax
mov dword [esp + 0x154], esi
call fcn.004a6cb0
cmp dword [0x72ed14], ebx
jge 0x41e998
mov dword [0x72ed14], ebx
cmp dword [0x72ed60], ebx
jge 0x41e9a6
mov dword [0x72ed60], ebx
mov ecx, dword [0x85c268]
mov bl, byte [esp + 0x40]
mov esi, dword [esp + 0x30]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, 0x20
test bl, 0xf
mov dword [esp + 0x54], ecx
jne 0x41ea02
test esi, esi
jle 0x41e9dd
mov ecx, 1
jmp 0x41e9e5
xor ecx, ecx
test esi, esi
setge cl
dec ecx
mov eax, 0x66666667
imul esi
sar edx, 3
mov eax, edx
shr eax, 0x1f
lea eax, [edx + eax + 1]
cdq
xor eax, edx
sub eax, edx
imul eax, ecx
sub esi, eax
test bl, 1
je 0x41ea28
mov edx, dword [esp + 0x20]
mov eax, esi
sub eax, edx
test eax, eax
jle 0x41ea1a
mov eax, 1
jmp 0x41ea24
xor ecx, ecx
test eax, eax
setge cl
dec ecx
mov eax, ecx
add dword [esp + 0x20], eax
mov eax, dword [0x85c158]
neg eax
sbb eax, eax
and eax, 0xffffffce
cmp esi, eax
mov ecx, esi
mov dword [esp + 0x58], ecx
jge 0x41ea44
mov ecx, eax
mov dword [esp + 0x58], ecx
cmp ecx, 0x32
jle 0x41ea51
mov dword [esp + 0x58], 0x32
mov ecx, dword [0x85c26c]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x30], edx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
lea edi, [edx + eax + 0x44]
mov eax, edi
cdq
sub eax, edx
mov ebx, eax
mov eax, ecx
cdq
sub eax, edx
lea ecx, [esp + 0x48]
push ecx
mov esi, eax
xor eax, eax
lea edx, [esp + 0x64]
push edx
push eax
push eax
sar ebx, 1
sar esi, 1
push eax
sub esi, ebx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x74], eax
call fcn.004ceb00
mov ebp, dword [esp + 0x68]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x74]
add esp, 0x14
push 0x100
push 0xffffffffffffffff
push 0xc
push edi
add ebp, 0xfffffff7
push ebp
push esi
push ecx
push edx
push 0
push 0
push eax
call fcn.004af500
mov eax, dword [0x85c26c]
cdq
add esp, 0x2c
sub eax, edx
lea ecx, [esp + 0x48]
push ecx
mov esi, eax
xor eax, eax
lea edx, [esp + 0x64]
push edx
push eax
push eax
sar esi, 1
push eax
sub esi, ebx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x74], eax
call fcn.004ceb00
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x34]
mov ecx, 0x32
sub ecx, eax
imul ecx, edi
mov eax, 0x51eb851f
imul ecx
add esp, 0x14
sar edx, 5
push 0x100
mov eax, edx
push 0xffc00000
shr eax, 0x1f
push 0xc
add eax, edx
push eax
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x60]
push ebp
push esi
push ecx
push edx
push 0
push 0
push eax
call fcn.004af500
mov eax, dword [0x85c26c]
mov edi, dword [esp + 0x80]
mov esi, dword [esp + 0x104]
add esp, 0x2c
push 0x3e8
cdq
push 0xf5
sub eax, edx
push edi
sar eax, 1
push eax
call fcn.004128a0
push str.Advantage
mov esi, 0x8ebf58
mov dword [0x85c11c], 0x4b
call fcn.004f7660
mov eax, dword [0x85c26c]
mov esi, dword [esp + 0x24]
add esp, 4
cdq
sub eax, edx
mov edx, dword [0x85c11c]
xor ecx, ecx
sar eax, 1
cmp esi, 0x32
setg cl
push 0
push 0xffffffffffffffff
push 4
add edi, 0xffffffe0
dec ecx
and ecx, 0x3fffff
add ecx, 0xffc00000
push ecx
push edx
push edi
push eax
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov ecx, dword [0x72ed18]
add esp, 0x20
cmp ecx, 0xffffffff
je 0x41ee8f
cmp ecx, 0xa
jge 0x41ebef
test byte [esp + 0x40], 8
je 0x41ed37
xor edi, edi
lea eax, [ecx + 1]
cdq
sub eax, edx
sar eax, 1
test eax, eax
jge 0x41ec01
xor eax, eax
jmp 0x41ec0b
cmp eax, 0xa
jle 0x41ec0b
mov eax, 0xa
cmp edi, eax
jge 0x41ec53
mov eax, edi
cdq
mov ecx, 0xa
idiv ecx
push 0x4b
mov ecx, eax
mov eax, dword [0x85c26c]
imul ecx, ecx, 0x2c
mov esi, edx
mov edx, dword [0x85c268]
mov esi, dword [esp + esi*4 + 0x1ac]
add edx, 0xffffffe0
push edx
cdq
sub eax, edx
sar eax, 1
lea eax, [ecx + eax + 0x98]
push eax
call fcn.00412900
mov ecx, dword [0x72ed18]
inc edi
jmp 0x41ebf1
push ecx
push str._NUM
mov esi, 0x8ebf58
mov dword [0x85c11c], 0x96
call fcn.004f7660
mov ecx, dword [0x85c26c]
mov ebx, dword [esp + 0x5c]
add ecx, ecx
mov eax, 0x55555556
imul ecx
push 0
push 0xffffffffffffffff
mov ecx, edx
push 4
shr ecx, 0x1f
lea eax, [edx + ecx + 0x2c]
mov edx, dword [0x85c11c]
push 0xffffffffffffffff
push edx
lea ecx, [ebx + 6]
push ecx
push eax
push 0x86bb48
xor eax, eax
call fcn.004b0b40
push str.Pirates
call fcn.004f7660
mov eax, dword [0x85c158]
add esp, 0x2c
test eax, eax
je 0x41ecef
mov eax, dword [0x72ecb8]
sub eax, 0
je 0x41ecdd
dec eax
je 0x41ecd6
dec eax
jne 0x41ecef
push str.__Cutlass_
jmp 0x41ece2
push str.__Rapier_
jmp 0x41ece2
push str.__Longsword_
mov esi, 0x8ebf58
call fcn.004f7680
add esp, 4
mov ecx, dword [0x85c26c]
add ecx, ecx
mov eax, 0x55555556
imul ecx
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
mov eax, edx
shr eax, 0x1f
push 0x4b
lea ecx, [ebx + 0x22]
lea edx, [edx + eax + 0x2c]
push ecx
push edx
push 0x86bb48
xor eax, eax
mov dword [0x85c11c], 0x4b
call fcn.004b0b40
mov ecx, dword [0x72ed18]
add esp, 0x20
jmp 0x41ed3b
mov ebx, dword [esp + 0x54]
mov esi, dword [0x72ed64]
cmp esi, 0xa
jge 0x41ed51
test byte [esp + 0x40], 8
je 0x41f07d
xor edi, edi
lea eax, [esi + 1]
cdq
sub eax, edx
sar eax, 1
cmp eax, 1
jge 0x41ed67
mov eax, 1
jmp 0x41ed71
cmp eax, 0xa
jle 0x41ed71
mov eax, 0xa
cmp edi, eax
jge 0x41edb9
mov eax, edi
cdq
mov ecx, 0xa
idiv ecx
push 0x4b
mov ecx, eax
mov eax, dword [0x85c26c]
imul ecx, ecx, 0x2c
mov esi, edx
mov edx, dword [0x85c268]
mov esi, dword [esp + esi*4 + 0x1d4]
add edx, 0xffffffe0
push edx
cdq
sub eax, edx
sar eax, 1
sub eax, ecx
sub eax, 0x9c
push eax
call fcn.00412900
mov esi, dword [0x72ed64]
inc edi
jmp 0x41ed53
push esi
push str._NUM
mov esi, 0x8ebf58
mov dword [0x85c11c], 0x96
call fcn.004f7660
mov ecx, dword [0x85c26c]
mov eax, 0x55555556
imul ecx
mov ecx, dword [0x85c11c]
push 0
push 0xffffffffffffffff
push 4
mov eax, edx
shr eax, 0x1f
push 0xffffffffffffffff
lea eax, [edx + eax - 0x30]
push ecx
lea edx, [ebx + 6]
push edx
push eax
push 0x86bb48
xor eax, eax
call fcn.004b0b40
add esp, 0x28
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x350]
mov byte [eax + 0x86bb48], cl
inc eax
test cl, cl
jne 0x41ee10
mov eax, dword [0x85c158]
test eax, eax
je 0x41ee5b
mov eax, dword [0x72ecbc]
sub eax, 0
je 0x41ee49
dec eax
je 0x41ee42
dec eax
jne 0x41ee5b
push str.__Cutlass_
jmp 0x41ee4e
push str.__Rapier_
jmp 0x41ee4e
push str.__Longsword_
mov esi, 0x8ebf58
call fcn.004f7680
add esp, 4
mov ecx, dword [0x85c26c]
mov eax, 0x55555556
imul ecx
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
mov eax, edx
shr eax, 0x1f
push 0x4b
add ebx, 0x22
lea eax, [edx + eax - 0x30]
push ebx
mov dword [0x85c11c], 0x4b
push eax
jmp 0x41f068
mov eax, dword [0x85c26c]
cdq
sub eax, edx
mov edi, eax
lea ecx, [esp + 0x350]
sar edi, 1
push ecx
xor eax, eax
mov dword [0x85c11c], 0x64
sub edi, ebx
call fcn.004af3f0
add esp, 4
call fcn.005f275c
mov esi, eax
cdq
sub eax, edx
sar eax, 1
mov ecx, edi
sub ecx, eax
mov eax, dword [0x85c26c]
cdq
sub eax, edx
sar eax, 1
lea edx, [ecx + esi]
lea ebp, [eax - 8]
cmp edx, ebp
jle 0x41eee4
sub eax, esi
add eax, 8
mov ecx, eax
mov eax, dword [0x85c11c]
mov ebp, dword [esp + 0x54]
push 0
push 0xffffffffffffffff
push 1
push 0xffc00000
push eax
add ebp, 0xc
push ebp
push ecx
lea ecx, [esp + 0x36c]
push ecx
xor eax, eax
call fcn.004b0b40
mov eax, dword [0x72ecbc]
add esp, 0x20
sub eax, 0
mov byte [0x86bb48], 0
je 0x41ef35
dec eax
je 0x41ef2e
dec eax
jne 0x41ef47
push str.__Cutlass_
jmp 0x41ef3a
push str.__Rapier_
jmp 0x41ef3a
push str.__Longsword_
mov esi, 0x8ebf58
call fcn.004f7660
add esp, 4
mov eax, dword [0x85c158]
test eax, eax
mov dword [0x85c11c], 0x4b
je 0x41ef7f
mov edx, dword [esp + 0x54]
push 0
push 0xffffffffffffffff
push 4
push 0xffc00000
push 0x4b
add edx, 0x22
push edx
push edi
push 0x86bb48
xor eax, eax
call fcn.004b0b40
add esp, 0x20
mov ecx, dword [0x728638]
mov edx, dword [0x72863c]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x728640]
mov dword [eax + 4], edx
push 0x6fd6bc
mov esi, 0x8ebf58
mov dword [eax + 8], ecx
call fcn.004f7660
mov eax, dword [0x85c26c]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
push 0x86bb48
xor eax, eax
add edi, ebx
call fcn.004af3f0
add esp, 0x14
call fcn.005f275c
cdq
sub eax, edx
sar eax, 1
mov ecx, edi
sub ecx, eax
mov eax, dword [0x85c26c]
cdq
sub eax, edx
sar eax, 1
add eax, 8
cmp ecx, eax
jge 0x41efeb
mov ecx, eax
mov edx, dword [0x85c11c]
push 0
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push edx
push ebp
push ecx
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov eax, dword [0x72ecb8]
add esp, 0x20
sub eax, 0
mov byte [0x86bb48], 0
je 0x41f030
dec eax
je 0x41f029
dec eax
jne 0x41f042
push str.__Cutlass_
jmp 0x41f035
push str.__Rapier_
jmp 0x41f035
push str.__Longsword_
mov esi, 0x8ebf58
call fcn.004f7660
add esp, 4
mov eax, dword [0x85c158]
test eax, eax
mov dword [0x85c11c], 0x4b
je 0x41f077
mov eax, dword [esp + 0x54]
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0x4b
add eax, 0x22
push eax
push edi
xor eax, eax
push 0x86bb48
call fcn.004b0b40
add esp, 0x20
mov ecx, dword [0x72ed18]
test byte [0x85c164], 4
jne 0x41f235
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x144]
add edx, 0xffffff9c
cmp eax, edx
jge 0x41f235
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x41f235
cmp ecx, 0xffffffff
je 0x41f235
mov ebp, dword [esp + 0x64]
mov edx, dword [0x85c158]
mov edi, dword [sym.imp.MSVCR71.dll_rand]
mov eax, 0xa
sub eax, edx
lea esi, [ebp + 0x64]
imul esi, eax
imul esi, ecx
test esi, esi
jle 0x41f0e8
call edi
cdq
idiv esi
mov ecx, dword [0x72ed18]
mov ebx, edx
jmp 0x41f0ea
xor ebx, ebx
mov esi, 0xb4
sub esi, ebp
imul esi, dword [0x72ed64]
imul esi, dword [esp + 0x4a8]
test esi, esi
jle 0x41f111
call edi
mov ecx, dword [0x72ed18]
cdq
idiv esi
jmp 0x41f113
xor edx, edx
cmp ebx, edx
jle 0x41f1a3
mov edx, dword [0x72ed64]
lea ecx, [ecx + edx*2]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
lea esi, [edx + eax + 2]
test esi, esi
jle 0x41f144
call edi
cdq
idiv esi
jmp 0x41f146
xor edx, edx
mov eax, dword [0x72ed64]
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
cmp eax, 1
mov dword [0x72ed64], eax
jge 0x41f166
mov dword [0x72ed64], 1
push 0xffffffffffffffff
push 0xbf800000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x7a
push 0x8c9380
call fcn.00488920
mov edx, dword [esp + 0x74]
mov ecx, dword [0x72ed18]
add esp, 0x1c
add edx, 0xa
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x144], edx
jmp 0x41f239
mov eax, dword [0x72ed64]
lea esi, [eax + ecx*2]
mov eax, 0x88888889
imul esi
add edx, esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
lea esi, [edx + eax + 2]
test esi, esi
jle 0x41f1d1
call edi
mov ecx, dword [0x72ed18]
cdq
idiv esi
jmp 0x41f1d3
xor edx, edx
or eax, 0xffffffff
sub eax, edx
add ecx, eax
cmp ecx, 1
mov dword [0x72ed18], ecx
jge 0x41f1ef
mov dword [0x72ed18], 1
push 0xffffffffffffffff
push 0xbf800000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x7b
push 0x8c937c
call fcn.00488920
mov ecx, dword [0x85c158]
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x5c]
add esp, 0x1c
neg ecx
sbb ecx, ecx
and ecx, 0xa
sub eax, ecx
mov ecx, dword [0x72ed18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x144], edx
jmp 0x41f239
mov ebp, dword [esp + 0x64]
xor edi, edi
cmp ecx, edi
je 0x41f243
cmp ebp, edi
jg 0x41f24b
mov dword [esp + 0x44], 0xffffffff
mov esi, dword [0x72ed64]
cmp esi, edi
je 0x41f25a
cmp ebp, 0x50
jl 0x41f262
mov dword [esp + 0x44], 1
lea edx, [ebp + ebp*4]
mov eax, 0x66666667
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
jns 0x41f27d
xor eax, eax
jmp 0x41f287
cmp eax, 4
jle 0x41f287
mov eax, 4
cmp ecx, 1
mov dword [0x72ed70], eax
jne 0x41f297
mov dword [0x72ed70], edi
cmp esi, 1
jne 0x41f2a6
mov dword [0x72ed70], 4
cmp dword [0x72eb4c], 2
mov dword [esp + 0x6c], edi
jg 0x41f2cb
mov ecx, dword [esp + 0x40]
imul ecx, ecx, 0x12f684b
mov eax, 0x38e38e3
call fcn.004dcac0
mov dword [esp + 0x6c], eax
mov dword [esp + 0x14], edi
nop
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + esi*4 + 0x24]
mov ebp, esi
imul ebp, ebp, 0x4c
mov eax, dword [ebp + 0x72ecdc]
xor edi, edi
call fcn.004bc830
mov dword [ebp + 0x72ed00], eax
test byte [0x85c164], 0x20
je 0x41f4e2
mov eax, dword [ebp + 0x72ecdc]
cmp eax, 0x3e8
jge 0x41f4e2
imul eax, eax, 0x21
add eax, 0x724aa8
mov edx, 0x86bb48
jmp 0x41f320
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x41f320
mov edi, 0x86bb48
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41f330
mov ecx, dword [ebp + 0x72ecdc]
mov ax, word [0x6fde48]
mov ebx, dword [sym.imp.MSVCR71.dll__itoa]
push 0xa
push 0x72eb30
push ecx
mov word [edi], ax
call ebx
add esp, 0xc
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41f360
or edi, 0xffffffff
test esi, esi
mov dword [esp + 0x38], edi
je 0x41f9a9
mov al, byte [0x8cc91c]
test al, al
jne 0x41f9a9
mov ecx, dword [esp + 0x4a8]
test ecx, ecx
jne 0x41f515
mov ecx, 1
mov dword [esp + 0x4a8], ecx
mov eax, dword [ebp + 0x72ed08]
test eax, eax
jne 0x41f8c1
mov eax, 0xe
cdq
idiv ecx
mov ebx, dword [sym.imp.MSVCR71.dll_rand]
mov esi, eax
test esi, esi
jle 0x41f559
mov eax, dword [ebp + 0x72ecd8]
test eax, eax
jne 0x41f90f
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx*4 + 0x8ccba8]
mov esi, str.Duel
mov dword [0x8ca4dc], eax
call fcn.0042e410
test ebx, ebx
jne 0x41fa9c
cmp eax, 0x200
mov ecx, dword [0x86e35c]
jl 0x41fa26
cmp eax, 0x208
jg 0x41fa26
lea edx, [eax - 0x200]
cmp edx, 5
ja 0x41fa26
test cl, 4
je 0x41fa35
mov eax, 0x127
jmp 0x41fbfd
cmp eax, 0x2c8
jl 0x41fa9c
cmp eax, 0x124
jg 0x41fbf4
je 0x41fbe4
cmp eax, 0x10c
jg 0x41fb8f
call fcn.00419a60
test al, al
je 0x41fc64
cmp eax, 0x128
jg 0x41fc4a
je 0x41fc3a
sub eax, 0x2d2
je 0x41fc5d