Function at 0x1004ced0
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x1013cba8]
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
cmp esi, dword [eax]
jne 0x1004e11e
mov al, byte [edi + 0x23]
and al, 0xf
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
cmp al, 1
jne 0x1004cf9f
mov ecx, dword [edi + 0x64]
cmp ecx, 0xffffffff
je 0x1004cf9f
mov eax, ecx
and eax, 0xff000000
cmp eax, 0x1000000
jne 0x1004cf9f
lea edx, [ebp - 0x10]
call fcn.1003be50
cmp eax, 0xffffffff
je 0x1004cf9f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
and eax, 0x20
je 0x1004cf9f
call dword [0x10121524]
cmp dword [0x59e814], 0
jle 0x1004e11e
mov edx, 0x32
mov ecx, 0x59e814
call fcn.1003d290
cmp eax, 0xffffffff
je 0x1004e11e
mov ecx, dword [0x59e818]
add eax, eax
mov eax, dword [ecx + eax*8 + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call dword [0x1012171c]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
test byte [edi + 0x23], 0xf
jne 0x1004d003
mov ecx, dword [edi + 0x64]
mov eax, ecx
shr eax, 0x18
test al, al
jne 0x1004d003
lea edx, [ebp - 0x10]
call fcn.1003be50
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x20], 1
jne 0x1004d003
cmp dword [edi + 0x18], 0
jne 0x1004d003
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
call dword [0x10120ea0]
test eax, eax
je 0x1004d003
movzx esi, word [eax + 8]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call dword [0x10120e98]
cmp esi, 1
ja 0x1004e11e
mov esi, dword [ebp - 0x1c]
cmp dword [0x51d430], 0
jne 0x1004d1be
mov ecx, edi
call fcn.1006cdd0
test al, al
jne 0x1004d1be
mov edi, dword [edi + 0x78]
cmp edi, 0xffffffff
je 0x1004d1bb
lea edx, [ebp - 0x10]
mov ecx, edi
call fcn.1006e780
cmp eax, 0xffffffff
je 0x1004d047
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x38], esi
mov dword [eax + 0x3c], 0
cmp dword [0x51c714], 0
mov byte [ebp - 1], 0
je 0x1004d19f
lea edx, [ebp - 0x10]
mov ecx, edi
call fcn.1006e780
cmp eax, 0xffffffff
je 0x1004d19f
mov esi, dword [ebp - 0x10]
mov dword [esi + 0x44], 0
mov dword [esi + 0x28], 0
test byte [esi + 0x10], 1
jne 0x1004d0c2
mov eax, dword [esi + 0x14]
and eax, 0xffffff
lea ecx, [eax + eax*4]
mov eax, dword [0x51c7c8]
lea eax, [eax + ecx*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call dword [0x101214a4]
mov dword [esi + 0x18], eax
test eax, eax
jne 0x1004d0ba
push str._nError:_exec_script_proc:_script_load_failed_
call fcn.10016d20
add esp, 4
jmp 0x1004d19f
or dword [esi + 0x10], 1
mov byte [ebp - 1], 1
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1004d19f
mov ecx, 0x124
test word [eax + 0x80], cx
jne 0x1004d19f
mov eax, dword [esi + 0x64]
test eax, eax
jle 0x1004d0f8
push 0x28
push eax
mov edx, esi
mov ecx, 4
call fcn.100cd960
mov cl, byte [ebp - 1]
mov dword [ebp - 0x20], eax
test cl, cl
jne 0x1004d114
test eax, eax
jne 0x1004d114
mov eax, dword [esi + 0x58]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x1004d19f
cmp eax, 0xffffffff
je 0x1004d19f
cmp dword [esi + 0x3c], 0
jne 0x1004d129
mov eax, dword [esi + 0x34]
mov dword [esi + 0x3c], eax
or dword [esi + 0x10], 4
test cl, cl
je 0x1004d175
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
call dword [0x10121218]
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x1004d157
mov eax, dword [esi + 0x58]
mov ecx, 1
test eax, eax
cmove eax, ecx
mov dword [ebp - 0x20], eax
mov dword [esi + 0x2c], 0
mov eax, dword [ebp - 0x34]
call dword [0x10121224]
mov edx, 0xffffffff
mov eax, dword [ebp - 0x34]
call dword [0x10121570]
mov dword [esi + 0x2c], 4
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
call dword [0x101216d0]
mov edx, esi
mov ecx, 4
push 0x29
push 0
call fcn.100cd960
mov dword [esi + 0x38], 0
lea edx, [ebp - 0x10]
mov ecx, edi
call fcn.1006e780
cmp eax, 0xffffffff
je 0x1004d1bb
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x44], 0
jne 0x1004e11e
mov edi, dword [ebp - 0x18]
or eax, 0xffffffff
mov dword [ebp - 0x34], 0
push 0x1d3
mov edx, eax
lea ecx, [ebp - 0x34]
call fcn.10017620
cmp eax, 0xffffffff
je 0x1004e11e
call dword [0x10121540]
cmp eax, 0xffffffff
je 0x1004e11e
mov eax, dword [0x1013ca80]
lea ecx, [edi + 0x2c]
mov dword [eax], ecx
mov dword [0x59e81c], edi
mov dword [0x59e7ec], 0
mov eax, dword [0x1013ca84]
mov dword [eax], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call dword [0x101214f4]
xor esi, esi
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x10], esi
cmp dword [0x51d430], esi
jne 0x1004d250
mov ecx, edi
call fcn.1006cdd0
test al, al
je 0x1004d442
mov eax, dword [ebp - 0x18]
call dword [0x1012153c]
mov esi, eax
mov dword [ebp - 0x50], esi
test esi, esi
je 0x1004d2f6
mov ecx, 9
call fcn.100cb440
test al, al
je 0x1004d2eb
mov ecx, dword [0x10182300]
mov dword [ecx + 0x88], 5
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], 1
mov dword [ecx + 0x10], 0x473b2e
mov dword [ecx + 0x14], 0
call fcn.100cb2c0
mov ecx, dword [0x10182300]
test ecx, ecx
je 0x1004d2eb
mov eax, dword [ecx + 0x84]
test eax, eax
jle 0x1004d2bf
dec eax
mov dword [ecx + 0x84], eax
mov eax, dword [0x1013d39c]
sub eax, 1
mov dword [0x1013d39c], eax
jns 0x1004d2da
mov dword [0x10182300], 0
jmp 0x1004d2eb
imul eax, eax, 0x9c
add eax, dword [0x101552d4]
mov dword [0x10182300], eax
push 1
mov edx, esi
mov ecx, edi
call fcn.1001e460
mov eax, dword [ebp - 0x18]
call dword [0x10121538]
mov esi, eax
mov dword [ebp - 0x54], esi
test esi, esi
je 0x1004d39c
mov ecx, 9
call fcn.100cb440
test al, al
je 0x1004d391
mov ecx, dword [0x10182300]
mov dword [ecx + 0x88], 5
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], 1
mov dword [ecx + 0x10], 0x473b2e
mov dword [ecx + 0x14], 0
call fcn.100cb2c0
mov ecx, dword [0x10182300]
test ecx, ecx
je 0x1004d391
mov eax, dword [ecx + 0x84]
test eax, eax
jle 0x1004d365
dec eax
mov dword [ecx + 0x84], eax
mov eax, dword [0x1013d39c]
sub eax, 1
mov dword [0x1013d39c], eax
jns 0x1004d380
mov dword [0x10182300], 0
jmp 0x1004d391
imul eax, eax, 0x9c
add eax, dword [0x101552d4]
mov dword [0x10182300], eax
push 1
mov edx, esi
mov ecx, edi
call fcn.1001e460
mov eax, dword [ebp - 0x18]
call dword [0x10121528]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x1004d442
mov ecx, 9
call fcn.100cb440
test al, al
je 0x1004d437
mov ecx, dword [0x10182300]
mov dword [ecx + 0x88], 5
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], 1
mov dword [ecx + 0x10], 0x473b2e
mov dword [ecx + 0x14], 0
call fcn.100cb2c0
mov ecx, dword [0x10182300]
test ecx, ecx
je 0x1004d437
mov eax, dword [ecx + 0x84]
test eax, eax
jle 0x1004d40b
dec eax
mov dword [ecx + 0x84], eax
mov eax, dword [0x1013d39c]
sub eax, 1
mov dword [0x1013d39c], eax
jns 0x1004d426
mov dword [0x10182300], 0
jmp 0x1004d437
imul eax, eax, 0x9c
add eax, dword [0x101552d4]
mov dword [0x10182300], eax
push 1
mov edx, esi
mov ecx, edi
call fcn.1001e460
push dword [ebp - 0x34]
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
push edi
push esi
call fcn.10046550
mov eax, dword [0x101558f4]
mov ecx, 6
cmp eax, 2
jl 0x1004d498
test eax, eax
je 0x1004d498
cmp dword [0x1013cf04], 0x2bc
jl 0x1004d498
mov edx, ecx
mov ecx, str.LOOT2.FRM
call fcn.10016470
mov dword [0x10174fe4], eax
test eax, eax
jne 0x1004d498
push str.LOOT2.FRM
push str._nError:_Graphic_file__s_of_the_expanded_inventory_was_not_found.
call fcn.10016d20
add esp, 8
mov ecx, 2
call fcn.100458e0
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x48], eax
cmp dword [0x51d430], eax
jne 0x1004d63f
mov al, byte [edi + 0x23]
and al, 0xf
cmp al, 1
jne 0x1004d63f
test byte [edi + 0x44], 0x81
je 0x1004d63f
mov edx, dword [edi + 0x28]
lea eax, [ebp - 0x3c]
mov ecx, dword [edi + 4]
push eax
push 1
call fcn.100175a0
mov edx, dword [ebp - 0x3c]
mov esi, eax
xor ecx, ecx
mov dword [ebp - 0x20], esi
test esi, esi
jle 0x1004d51a
mov edi, eax
mov esi, dword [edx + ecx*4]
test byte [esi + 0x44], 0x81
jne 0x1004d50c
mov eax, dword [edx + edi*4 - 4]
dec edi
mov dword [edx + ecx*4], eax
dec ecx
mov eax, dword [ebp - 0x3c]
mov dword [eax + edi*4], esi
mov edx, dword [ebp - 0x3c]
inc ecx
cmp ecx, edi
jl 0x1004d4f1
mov dword [ebp - 0x20], edi
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
cmp esi, 1
jne 0x1004d530
mov ecx, edx
call fcn.10017590
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x1004d63f
jle 0x1004d63f
movaps xmm0, xmmword [0x10132a60]
lea eax, [ebp - 0x80]
push eax
push ecx
mov ecx, 0x600007a
movaps xmmword [ebp - 0x80], xmm0
call fcn.10017c70
mov esi, eax
test esi, esi
je 0x1004d5b2
lea eax, [ebp - 0x7c]
push eax
push ecx
mov ecx, 0x600007b
call fcn.10017c70
test eax, eax
je 0x1004d5b2
mov edx, dword [0x10174fec]
mov ecx, dword [0x1013cbc4]
push 0
push 0
push eax
mov ecx, dword [ecx]
lea edx, [edx + 0x1b4]
push esi
push 0xffffffffffffffff
push 0x149
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x14
push 0xa2
call fcn.10016da0
cmp eax, 0xffffffff
je 0x1004d5b2
push 0x451978
mov edx, 0x451970
mov ecx, eax
call fcn.10017a30
lea eax, [ebp - 0x78]
push eax
push ecx
mov ecx, 0x600007c
call fcn.10017c70
mov esi, eax
test esi, esi
je 0x1004d623
lea eax, [ebp - 0x74]
push eax
push ecx
mov ecx, 0x600007d
call fcn.10017c70
test eax, eax
je 0x1004d623
mov edx, dword [0x10174fec]
mov ecx, dword [0x1013cbc4]
push 0
push 0
push eax
mov ecx, dword [ecx]
lea edx, [edx + 0x1c8]
push esi
push 0xffffffffffffffff
push 0x151
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x14
push 0xa2
call fcn.10016da0
cmp eax, 0xffffffff
je 0x1004d623
push 0x451978
mov edx, 0x451970
mov ecx, eax
call fcn.10017a30
mov esi, dword [ebp - 0x20]
xor eax, eax
test esi, esi
jle 0x1004d63f
mov ecx, dword [ebp - 0x3c]
nop
cmp dword [ecx + eax*4], edi
je 0x1004d63c
inc eax
cmp eax, esi
jl 0x1004d630
jmp 0x1004d63f
mov dword [ebp - 0x48], eax
mov eax, dword [0x1013ca84]
mov byte [ebp - 1], 0
mov dword [ebp - 0x4c], 0xa
mov dword [ebp - 0x58], 0
mov ecx, dword [eax]
test ecx, ecx
js 0x1004d661
cmp ecx, 0xa
jl 0x1004d662
int3
mov eax, dword [0x1013ca80]
or edx, 0xffffffff
mov ecx, dword [ecx*4 + 0x59e7ec]
push 2
push dword [eax]
call fcn.10046bc0
mov eax, dword [0x1013cca8]
mov esi, dword [eax]
test esi, esi
js 0x1004d68a
cmp esi, 0xa
jl 0x1004d68b
int3
mov eax, dword [0x1013cbc4]
mov esi, dword [esi*4 + 0x59e844]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
call dword [0x10120fb4]
cmp dword [0x10174fec], 0
mov ecx, dword [eax + 0x2c]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0x44], 0
je 0x1004d6ce
mov eax, dword [0x10174fe4]
mov eax, dword [eax + 0x3e]
mov edi, dword [eax + 0xc]
jmp 0x1004d6e2
lea eax, [ebp - 0x44]
push eax
push ecx
mov ecx, 0x6000072
call fcn.10017c70
mov edx, dword [ebp - 8]
mov edi, eax
test edi, edi
je 0x1004d724
mov eax, dword [ebp - 0x38]
imul ecx, edx, 0x25
push edx
add ecx, 0xb0
add eax, ecx
push eax
mov eax, dword [0x10174fe8]
push edx
add eax, 0x40
push 0x120
push eax
lea eax, [ecx + edi]
push eax
call fcn.1003eee0
mov eax, dword [ebp - 0x44]
add esp, 0x18
test eax, eax
je 0x1004d724
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
call dword [0x10120e98]
mov eax, dword [0x5190e4]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
je 0x1004d749
test esi, esi
jg 0x1004d740
mov eax, dword [ebp - 0x24]
call dword [0x101210f8]
jmp 0x1004d749
mov eax, dword [ebp - 0x24]
call dword [0x101210f0]
mov eax, dword [0x5190e8]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
je 0x1004d7a4
cmp dword [0x10174ff0], 0
mov edi, dword [0x519054]
mov ecx, dword [0x1013cad8]
jne 0x1004d778
cmp dword [0x10174fec], 0
jne 0x1004d778
xor eax, eax
jmp 0x1004d784
mov eax, dword [ecx]
mov eax, dword [eax]
sub eax, 0xc
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ecx]
add eax, edi
mov ecx, dword [ecx]
sub ecx, esi
cmp ecx, eax
jg 0x1004d79b
mov eax, dword [ebp - 0x24]
call dword [0x101210f8]
jmp 0x1004d7a4
mov eax, dword [ebp - 0x24]
call dword [0x101210f0]
or edx, 0xffffffff
cmp dword [0x10174ff0], 0
mov dword [ebp - 0xc], edx
jne 0x1004d7bc
cmp dword [0x10174fec], 0
je 0x1004d7ea
mov eax, dword [0x1013cad8]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
test cl, 1
lea ecx, [eax + 1]
cmove ecx, eax
mov eax, 6
cmp ecx, 6
mov edx, ecx
cmovg edx, eax
sub ecx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [0x1013cad8]
not esi
mov eax, dword [0x519054]
xor edi, edi
mov dword [ebp - 0x24], eax
mov eax, dword [ecx]
add esi, dword [eax]
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], eax
jle 0x1004d8b7
nop
test esi, esi
js 0x1004d8b7
cmp edi, edx
jne 0x1004d824
xor eax, eax
sub esi, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x38]
add eax, 0x29
imul eax, dword [ebp - 8]
add ecx, 0xb4
add eax, ecx
mov ecx, dword [0x1013cad8]
mov dword [ebp - 0x14], eax
cmp edi, edx
jl 0x1004d84c
add eax, dword [0x10174fe8]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx]
mov eax, dword [eax + 8]
mov ecx, dword [eax + esi*8]
lea eax, [eax + esi*8]
mov dword [ebp - 0x2c], eax
test ecx, ecx
je 0x1004d871
mov ecx, dword [ecx + 0x64]
lea edx, [ebp - 0x5c]
call fcn.1003be50
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax + 0x7c]
jmp 0x1004d874
or ecx, 0xffffffff
push dword [ebp - 8]
mov edx, dword [ebp - 0x14]
push 0x28
push 0x38
call fcn.10017830
mov ecx, dword [ebp - 0x2c]
xor eax, eax
cmp edi, 0xffffffff
sete al
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
push eax
push dword [ebp - 8]
push dword [ebp - 0x14]
call fcn.10044a10
mov eax, dword [ebp - 0x28]
inc edi
add eax, 0x30
dec esi
mov dword [ebp - 0x28], eax
cmp edi, dword [ebp - 0x24]
jge 0x1004d8b7
mov edx, dword [ebp - 0xc]
jmp 0x1004d810
mov eax, dword [0x1013cbc4]
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x1004d901
test eax, eax
js 0x1004d8cc
cmp eax, 0x32
jl 0x1004d8cd
int3
mov eax, dword [eax*4 + 0x6add90]
cmp eax, 0xffffffff
je 0x1004d901
test eax, eax
js 0x1004d8e2
cmp eax, 0x32
jl 0x1004d8e3
int3
mov ecx, dword [eax*4 + 0x6ade58]
test ecx, ecx
je 0x1004d901
cmp dword [0x51e3e0], 0
je 0x1004d901
push 0
lea edx, [ecx + 8]
call fcn.100416b0
mov ecx, dword [ebp - 0x18]
mov edx, 2
mov ecx, dword [ecx + 0x20]
call fcn.100445c0
mov ecx, dword [0x1013cbc4]
mov ecx, dword [ecx]
call fcn.10075450
mov eax, dword [0x10176038]
mov ecx, eax
or eax, 0x10000
xor ecx, eax
mov dword [0x10176038], eax
je 0x1004d93a
xor ecx, ecx
call fcn.100b64a0
mov eax, 0
call dword [0x10121534]
nop word [eax + eax]
mov eax, dword [0x1013cc2c]
cmp dword [eax], 0
jne 0x1004df12
call fcn.1003b980
mov dword [ebp - 8], eax
cmp eax, 0x11
je 0x1004d977
cmp eax, 0x18
je 0x1004d977
cmp eax, 0x144
jne 0x1004d97d
call dword [0x1012100c]
mov eax, dword [0x1013cc2c]
cmp dword [eax], 0
jne 0x1004df12
cmp byte [0x1013ca24], 0
mov eax, dword [0x1013cca8]
mov edi, dword [eax]
mov eax, dword [0x1013ca84]
mov dword [ebp - 0x38], edi
mov esi, dword [eax]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], esi
je 0x1004da1d
cmp eax, 0x148
je 0x1004d9b9
cmp eax, 0x150
jne 0x1004da22
mov ecx, dword [0x10174fe8]
mov eax, dword [0x1013cbc4]
lea edi, [ecx + 0x122]
mov eax, dword [eax]
lea esi, [ecx + edi]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
call dword [0x10120fb4]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 8]
lea eax, [edx + 0x145]
add edx, 0x25
push eax
lea eax, [ecx + 0x50]
add ecx, edi
add eax, esi
push eax
call fcn.100174b0
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x38]
test eax, eax
je 0x1004da1a
xor eax, eax
cmp dword [ebp - 8], 0x148
setne al
lea eax, [eax*4 + 0x18d]
mov dword [ebp - 8], eax
jmp 0x1004da1d
mov eax, dword [ebp - 8]
cmp eax, 0x150
jg 0x1004e22b
cmp eax, 0x150
je 0x1004e1e0
cmp eax, 0x148
jg 0x1004e1d0
je 0x1004e194
cmp eax, 0x41
je 0x1004da52
cmp eax, 0x61
jne 0x1004e3c5
mov eax, 0x51d430
cmp dword [eax], 0
jne 0x1004df00
mov eax, dword [ebp - 0x1c]
cmp byte [eax + 0x67], 1
je 0x1004da75
mov dword [ebp - 0x14], 0
jmp 0x1004dbec
mov ecx, eax
call fcn.10088080
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1004da94
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
mov ecx, dword [ecx + 0x64]
call fcn.1003be50
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0x14], eax
cmp dword [ecx + 0x64], 0x1000000
jne 0x1004db61
mov eax, dword [0x1013cd38]
cmp ecx, dword [eax]
jne 0x1004db61
xor edx, edx
mov dword [ebp - 0x28], edx
cmp dword [0x10176d18], edx
je 0x1004daec
mov eax, dword [0x66be40]
cmp eax, 0xffffffff
je 0x1004dad8
mov edx, dword [eax*4 + 0x10176350]
mov dword [ebp - 0x28], edx
mov eax, dword [0x66be44]
cmp eax, 0xffffffff
je 0x1004daec
add edx, dword [eax*4 + 0x10176350]
mov dword [ebp - 0x28], edx
mov ecx, 2
call fcn.10024bd0
test eax, eax
je 0x1004db5b
cmp byte [0x10174fad], 0
je 0x1004db16
mov ecx, dword [0x1013cd38]
xor edx, edx
mov ecx, dword [ecx]
call fcn.100247b0
mov ecx, eax
jmp 0x1004db4c
mov eax, dword [0x1013cd38]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp byte [eax + 0x67], 1
jne 0x1004db4a
mov ecx, eax
call fcn.10088080
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1004db45
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0xc]
mov ecx, dword [ecx + 0x64]
call fcn.1003be50
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x24]
jmp 0x1004db4c
xor ecx, ecx
mov edx, dword [ebp - 0x28]
mov eax, ecx
neg eax
shl eax, 2
sub eax, ecx
lea edx, [edx + eax*2]
add dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x1c]
xor eax, eax
cmp byte [ecx + 0x67], 1
jne 0x1004db8c
call fcn.10088080
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x1004db86
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
mov ecx, dword [ecx + 0x64]
call fcn.1003be50
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xe0]
add eax, dword [ebp - 0x14]
cmp dword [0x1013d3d0], 0xc
mov dword [ebp - 0x14], eax
jne 0x1004dbda
mov eax, dword [ebp - 0x1c]
call dword [0x10121538]
test eax, eax
je 0x1004dbb9
mov eax, dword [eax + 0x64]
cmp eax, dword [0x1013d3cc]
jne 0x1004dbb9
mov eax, dword [ebp - 0x14]
inc eax
jmp 0x1004dbda
mov eax, dword [ebp - 0x1c]
call dword [0x1012153c]
test eax, eax
je 0x1004dbd7
mov eax, dword [eax + 0x64]
cmp eax, dword [0x1013d3cc]
mov eax, dword [ebp - 0x14]
jne 0x1004dbda
inc eax
jmp 0x1004dbda
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov edx, eax
push 0xc
call fcn.100c65f0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov ecx, eax
call fcn.1001e200
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub dword [ebp - 0x14], eax
call fcn.100b3e20
test al, al
je 0x1004e129
mov ecx, dword [ebp - 0x18]
call fcn.1001e200
cmp eax, dword [ebp - 0x14]
jg 0x1004e129
mov edx, dword [ebp - 0x18]
cmp byte [edx + 0x67], 1
jne 0x1004dc4b
mov eax, dword [edx + 0x44]
shr eax, 7
not al
test al, 1
je 0x1004dc4b
mov eax, dword [ebp - 0x18]
call dword [0x10121538]
test eax, eax
je 0x1004dc4b
mov ecx, dword [ebp - 0x18]
mov edx, eax
push 0x2000000
call fcn.1004ca40
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
call fcn.1001df40
test esi, esi
js 0x1004dc5f
cmp esi, 0xa
jl 0x1004dc60
int3
mov eax, dword [0x1013ca80]
mov ecx, dword [esi*4 + 0x59e7ec]
push 2
push dword [eax]
or eax, 0xffffffff
mov edx, eax
call fcn.10046bc0
test edi, edi
js 0x1004dc83
cmp edi, 0xa
jl 0x1004dc84
int3
mov eax, dword [0x1013cbc4]
mov esi, dword [edi*4 + 0x59e844]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
call dword [0x10120fb4]
cmp dword [0x10174fec], 0
mov ecx, dword [eax + 0x2c]
mov edi, dword [eax + 0x18]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x30], 0
je 0x1004dcc7
mov eax, dword [0x10174fe4]
mov eax, dword [eax + 0x3e]
mov edx, dword [eax + 0xc]
jmp 0x1004dcd8
lea eax, [ebp - 0x30]
push eax
push ecx
mov ecx, 0x6000072
call fcn.10017c70
mov edx, eax
test edx, edx
je 0x1004dd1a
mov eax, dword [ebp - 0x38]
imul ecx, edi, 0x25
push edi
add ecx, 0xb0
add eax, ecx
push eax
mov eax, dword [0x10174fe8]
push edi
add eax, 0x40
push 0x120
push eax
lea eax, [ecx + edx]
push eax
call fcn.1003eee0
mov eax, dword [ebp - 0x30]
add esp, 0x18
test eax, eax
je 0x1004dd1a
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
call dword [0x10120e98]
mov eax, 0x5190e4
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x1004dd41
test esi, esi
jg 0x1004dd38
mov eax, dword [ebp - 0xc]
call dword [0x101210f8]
jmp 0x1004dd41
mov eax, dword [ebp - 0xc]
call dword [0x101210f0]
mov eax, 0x5190e8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x1004dd9f
cmp dword [0x10174ff0], 0
mov eax, 0x519054
mov ecx, dword [0x1013cad8]
mov edi, dword [eax]
jne 0x1004dd73
cmp dword [0x10174fec], 0
jne 0x1004dd73
xor eax, eax
jmp 0x1004dd7f
mov eax, dword [ecx]
mov eax, dword [eax]
sub eax, 0xc
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ecx]
add eax, edi
mov ecx, dword [ecx]
sub ecx, esi
cmp ecx, eax
jg 0x1004dd96
mov eax, dword [ebp - 0xc]
call dword [0x101210f8]
jmp 0x1004dd9f
mov eax, dword [ebp - 0xc]
call dword [0x101210f0]
mov edx, dword [0x1013cad8]
or edi, 0xffffffff
cmp dword [0x10174ff0], 0
mov dword [ebp - 0x44], edi
jne 0x1004ddbd
cmp dword [0x10174fec], 0
je 0x1004dde9
mov eax, dword [edx]
mov eax, dword [eax]
mov ecx, eax
test ecx, ecx
jns 0x1004ddca
add ecx, 1
sar ecx, 1
test al, 1
lea eax, [ecx + 1]
cmove eax, ecx
mov ecx, 6
cmp eax, 6
mov edi, eax
cmovg edi, ecx
sub eax, edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x5c], eax
mov eax, 0x519054
not esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [edx]
add esi, dword [eax]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0xc], eax
jle 0x1004deb6
nop dword [eax]
test esi, esi
js 0x1004deb6
cmp ecx, edi
jne 0x1004de24
xor eax, eax
sub esi, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
mov edi, dword [ebp - 0x38]
add eax, 0x29
imul eax, dword [ebp - 0x28]
add edi, 0xb4
add edi, eax
cmp ecx, dword [ebp - 0x44]
jl 0x1004de41
add edi, dword [0x10174fe8]
mov eax, dword [edx]
mov eax, dword [eax + 8]
mov ecx, dword [eax + esi*8]
lea eax, [eax + esi*8]
mov dword [ebp - 0x2c], eax
test ecx, ecx
je 0x1004de66
mov ecx, dword [ecx + 0x64]
lea edx, [ebp - 0x40]
call fcn.1003be50
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x7c]
jmp 0x1004de69
or ecx, 0xffffffff
push dword [ebp - 0x28]
mov edx, edi
push 0x28
push 0x38
call fcn.10017830
mov ecx, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x14], 0xffffffff
sete al
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
push eax
push dword [ebp - 0x28]
push edi
call fcn.10044a10
mov ecx, dword [ebp - 0x14]
dec esi
mov eax, dword [ebp - 0x24]
inc ecx
add eax, 0x30
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], eax
cmp ecx, dword [ebp - 0xc]
jge 0x1004deb6
mov edx, dword [0x1013cad8]
mov edi, dword [ebp - 0x44]
jmp 0x1004de10
mov eax, dword [0x1013cbc4]
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x1004df00
test eax, eax
js 0x1004decb
cmp eax, 0x32
jl 0x1004decc
int3
mov eax, dword [eax*4 + 0x6add90]
cmp eax, 0xffffffff
je 0x1004df00
test eax, eax
js 0x1004dee1
cmp eax, 0x32
jl 0x1004dee2
int3
mov ecx, dword [eax*4 + 0x6ade58]
test ecx, ecx
je 0x1004df00
cmp dword [0x51e3e0], 0
je 0x1004df00
push 0
lea edx, [ecx + 8]
call fcn.100416b0
mov edi, dword [ebp - 8]
cmp edi, 0x1b
je 0x1004df12
cmp byte [ebp - 1], 0
je 0x1004d950
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x1004df39
mov ecx, dword [ebp - 0x3c]
call fcn.10017590
xor esi, esi
mov eax, dword [ebp + esi*4 - 0x80]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
call dword [0x10120e98]
inc esi
cmp esi, 4
jb 0x1004df23
cmp dword [0x51d430], 0
mov esi, dword [ebp - 0x18]
jne 0x1004df50
mov ecx, esi
call fcn.1006cdd0
test al, al
je 0x1004dfa5
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x1004df6d
or dword [eax + 0x24], 0x1000000
mov edx, eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
mov ecx, esi
call fcn.1001dcf0
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x1004df8a
or dword [eax + 0x24], 0x2000000
mov edx, eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
mov ecx, esi
call fcn.1001dcf0
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x1004dfa5
or dword [edx + 0x24], 0x4000000
mov ecx, esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
call fcn.1001dcf0
mov edi, dword [ebp - 0x34]
mov edx, esi
mov ecx, edi
call fcn.1001df40
mov dword [ebp - 0x40], edi
mov edx, 0
mov eax, dword [ebp - 0x40]
call dword [0x101213d0]
cmp dword [0x51d430], 0
je 0x1004e08b
cmp byte [ebp - 1], 0
jne 0x1004e08b
mov edi, dword [ebp - 0x58]
test edi, edi
jle 0x1004e08b
mov ecx, esi
call fcn.1006ce10
test al, al
jne 0x1004e08b
mov ecx, dword [ebp - 0x1c]
mov edx, 0xa
call fcn.10023f50
mov esi, 0x12c
sub esi, eax
cmp esi, edi
push esi
push str._nStealing_max_experience:__d
cmovl edi, esi
call fcn.10016d20
add esp, 8
mov edx, 1
mov ecx, edi
call fcn.10022590
lea edx, [ebp - 0x70]
mov dword [ebp - 0x70], 0x1d
mov ecx, 0x59e814
call fcn.1003d330
cmp eax, 1
jne 0x1004e06f
mov eax, dword [0x1013cfd0]
cmp eax, 0xffffffff
cmove eax, edi
push eax
push dword [ebp - 0x64]
lea eax, [ebp - 0x148]
push eax
call fcn.1000d880
lea eax, [ebp - 0x148]
add esp, 0xc
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
call dword [0x1012171c]
mov eax, dword [0x1013cfd0]
mov edx, 0xffffffff
cmp byte [0x10175301], 0
mov esi, dword [ebp - 0x18]
cmovne eax, edx
mov dword [0x1013cfd0], eax
mov eax, dword [ebp - 0x60]
call dword [0x101216cc]
mov ecx, dword [0x10176038]
mov eax, ecx
and ecx, 0xbffeffff
mov dword [0x10176038], ecx
xor ecx, eax
je 0x1004e0b3
xor ecx, ecx
call fcn.100b64a0
call fcn.100464f0
call fcn.100455a0
cmp dword [0x51d430], 0
je 0x1004e100
cmp byte [ebp - 1], 0
je 0x1004e100
mov eax, dword [0x1013cc14]
cmp dword [eax], 0
jbe 0x1004e100
mov esi, dword [esi + 0x78]
cmp esi, 0xffffffff
je 0x1004e100
mov edx, dword [ebp - 0x1c]
mov ecx, esi
push 0
call fcn.1006ed20
mov edx, 4
mov ecx, esi
call fcn.1006ed80
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.1006e780
mov dword [0x10174fa8], 0
mov dword [0x10174fa4], 0
mov dword [0x10174fa0], 0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp dword [0x59e814], 0
mov dword [ebp - 0x70], 0x1f
jle 0x1004df00
mov edx, 0x1f
mov ecx, 0x59e814
call fcn.1003d290
mov edx, eax
cmp edx, 0xffffffff
je 0x1004df00
shl edx, 4
add edx, dword [0x59e818]
push 0
mov eax, dword [edx + 8]
mov ecx, dword [edx + 4]
mov dword [ebp - 0x68], eax
movzx eax, byte [0x6ab718]
push eax
push 0
push eax
push 0x75
mov dword [ebp - 0x6c], ecx
mov ecx, dword [edx + 0xc]
xor edx, edx
push 0xa9
push 0
mov dword [ebp - 0x64], ecx
call fcn.100171f0
jmp 0x1004df00
test edi, edi
js 0x1004e19d
cmp edi, 0xa
jl 0x1004e19e
int3
mov ecx, dword [edi*4 + 0x59e844]
test ecx, ecx
jle 0x1004df08
test edi, edi
js 0x1004e1b6
cmp edi, 0xa
jl 0x1004e1b7
int3
dec ecx
or eax, 0xffffffff
mov dword [edi*4 + 0x59e844], ecx
push 2
mov edx, eax
call fcn.10046600
jmp 0x1004df08
cmp eax, 0x149
je 0x1004e2af
jmp 0x1004e3c5
test edi, edi
js 0x1004e1e9
cmp edi, 0xa
jl 0x1004e1ea
int3
call fcn.100456d0
add eax, dword [edi*4 + 0x59e844]
mov ecx, 0x519054
add eax, dword [ecx]
mov ecx, dword [0x1013cad8]
mov ecx, dword [ecx]
cmp eax, dword [ecx]
jge 0x1004df08
test edi, edi
js 0x1004e216
cmp edi, 0xa
jl 0x1004e217
int3
mov ecx, dword [edi*4 + 0x59e844]
inc ecx
test edi, edi
js 0x1004e228
cmp edi, 0xa
jl 0x1004e1b8
int3
cmp eax, 0x191
jg 0x1004e3a4
je 0x1004e34b
sub eax, 0x151
je 0x1004e2ac
sub eax, 0x3c
jne 0x1004e3c2
test esi, esi
js 0x1004e255
cmp esi, 0xa
jl 0x1004e256
int3
cmp dword [esi*4 + 0x59e7ec], 0
jle 0x1004df08
test esi, esi
js 0x1004e26d
cmp esi, 0xa
jl 0x1004e26e
int3
mov ecx, dword [esi*4 + 0x59e7ec]
dec ecx
test esi, esi
js 0x1004e27f
cmp esi, 0xa
jl 0x1004e280
int3
mov eax, dword [0x1013ca80]
push 2
mov dword [esi*4 + 0x59e7ec], ecx
push dword [eax]
or eax, 0xffffffff
mov edx, eax
call fcn.10046bc0
mov ecx, dword [0x1013cbc4]
mov ecx, dword [ecx]
call fcn.10016cd0
jmp 0x1004df08
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x1004df00
cmp eax, 0x149
jne 0x1004e2cf
mov eax, dword [ebp - 0x48]
lea edx, [ecx - 1]
add eax, 0xffffffff
cmovns edx, eax
jmp 0x1004e2da
mov edx, dword [ebp - 0x48]
xor eax, eax
inc edx
cmp edx, ecx
cmovge edx, eax
mov eax, dword [ebp - 0x3c]
push 2
mov dword [ebp - 0x48], edx
mov esi, dword [eax + edx*4]
mov eax, dword [0x1013ca80]
mov dword [ebp - 0x18], esi
lea ecx, [esi + 0x2c]
mov dword [eax], ecx
mov eax, 0x59e81c
push ecx
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [0x1013ca84]
mov dword [eax], 0
mov eax, 0x59e7ec
mov dword [eax], 0
or eax, 0xffffffff
mov edx, eax
call fcn.10046bc0
test edi, edi
js 0x1004e325
cmp edi, 0xa
jl 0x1004e326
int3
mov ecx, dword [edi*4 + 0x59e844]
or eax, 0xffffffff
push 2
mov edx, eax
call fcn.10046600
mov ecx, dword [esi + 0x20]
mov edx, 2
call fcn.100445c0
jmp 0x1004df00
test esi, esi
js 0x1004e354
cmp esi, 0xa
jl 0x1004e355
int3
call fcn.10045700
mov edx, dword [0x1013ca80]
mov ecx, 0x519054
add eax, dword [ecx]
mov ecx, dword [edx]
add eax, dword [esi*4 + 0x59e7ec]
cmp eax, dword [ecx]
jge 0x1004df08
test esi, esi
js 0x1004e381
cmp esi, 0xa
jl 0x1004e382
int3
mov ecx, dword [esi*4 + 0x59e7ec]
inc ecx
test esi, esi
js 0x1004e393
cmp esi, 0xa
jl 0x1004e394
int3
push 2
mov dword [esi*4 + 0x59e7ec], ecx
push dword [edx]
jmp 0x1004e290
add eax, 0xfffff63c
cmp eax, 1
ja 0x1004e3c2
mov edi, dword [ebp - 8]
mov edx, 2
mov ecx, edi
call fcn.10046e80
jmp 0x1004df03
mov eax, dword [ebp - 8]
mov ecx, 0x51d430
cmp dword [ecx], 0
jne 0x1004e401
test byte [0x6ac7b0], 2
je 0x1004e401
cmp dword [0x59e940], 0
je 0x1004e3f1
mov eax, 0
call dword [0x10121534]
jmp 0x1004df00
mov eax, 1
call dword [0x10121534]
jmp 0x1004df00
test byte [0x6ac7b0], 1
je 0x1004df00
mov edx, 0x519054
cmp eax, 0x3e8
jl 0x1004e4c2
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
add eax, 0x3e8
cmp ecx, eax
jge 0x1004e4bf
cmp dword [0x59e940], 1
je 0x1004e4b0
cmp dword [0x10174fec], 0
mov dword [ebp - 0xc], 0
je 0x1004e45d
push 0
push 0
lea edx, [ebp - 0xc]
call fcn.100483d0
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
jmp 0x1004e48f
push edi
mov ecx, 0x59e844
call fcn.10049880
mov edi, dword [ebp - 8]
mov eax, dword [eax]
lea edx, [edi - 0x3e8]
add edx, eax
mov eax, dword [0x1013cad8]
mov eax, dword [eax]
mov ecx, dword [eax]
cmp edx, ecx
jge 0x1004df03
mov eax, dword [eax + 8]
sub ecx, edx
mov ecx, dword [eax + ecx*8 - 8]
test ecx, ecx
je 0x1004df03
lea eax, [ebp - 0x4c]
mov edx, edi
push eax
lea eax, [ebp - 0x58]
push eax
push 1
call fcn.1004cb40
mov byte [ebp - 1], al
jmp 0x1004df03
mov edx, 2
call fcn.10047aa0
jmp 0x1004df00
mov eax, dword [ebp - 8]
cmp eax, 0x7d0
jl 0x1004df00
mov eax, dword [edx]
mov edi, dword [ebp - 8]
add eax, 0x7d0
cmp edi, eax
jge 0x1004df03
cmp dword [0x59e940], 1
je 0x1004e55b
cmp dword [0x10174fec], 0
mov dword [ebp - 0xc], 0
je 0x1004e50b
push 0
push 0
lea edx, [ebp - 0xc]
mov ecx, edi
call fcn.100483d0
mov ecx, dword [ebp - 0xc]
jmp 0x1004e53a
push esi
mov ecx, 0x59e7ec
call fcn.10049880
lea edx, [edi - 0x7d0]
mov eax, dword [eax]
add edx, eax
mov eax, dword [0x1013ca80]
mov eax, dword [eax]
mov ecx, dword [eax]
cmp edx, ecx
jge 0x1004df03
mov eax, dword [eax + 8]
sub ecx, edx
mov ecx, dword [eax + ecx*8 - 8]
test ecx, ecx
je 0x1004df03
lea eax, [ebp - 0x4c]
mov edx, edi
push eax
lea eax, [ebp - 0x58]
push eax
push 0
call fcn.1004cb40
mov byte [ebp - 1], al
jmp 0x1004df03
mov edx, 2
mov ecx, edi
call fcn.10047aa0
jmp 0x1004df03