Function at 0x4461f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x6e52ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [0x825749]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x10], esi
test al, 1
mov dword [esp + 0xc], ebx
jne 0x447d41
mov cl, al
mov al, byte [esp + 0xa]
or cl, 1
push edi
mov byte [0x825749], cl
push ebx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c], al
call fcn.00407e50
mov edi, str.air_elemental_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.air_elemental_dwelling
lea ecx, [esp + 0x20]
call fcn.00415530
lea ecx, [esp + 0x18]
mov dword [esp + 0x40], 1
push ecx
mov ecx, 0x825de0
call fcn.0040ca10
lea edx, [esp + 0xe]
lea eax, [esp + 0xf]
push edx
push eax
mov ecx, 0x825df4
mov byte [esp + 0x48], 2
mov dword [0x825df0], ebx
call fcn.0044d290
lea ecx, [esp + 0x18]
mov dword [0x825e04], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
mov cl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
call fcn.00407e50
mov edi, str.angel_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.angel_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea edx, [esp + 0x28]
mov ecx, 0x825e08
push edx
mov dword [esp + 0x44], 3
call fcn.0040ca10
lea eax, [esp + 0xf]
lea ecx, [esp + 0xe]
push eax
push ecx
mov ecx, 0x825e1c
mov byte [esp + 0x48], 4
mov dword [0x825e18], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x825e2c], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov dl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], dl
call fcn.00407e50
mov edi, str.ballista_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.ballista_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea eax, [esp + 0x28]
mov ecx, 0x825e30
push eax
mov dword [esp + 0x44], 5
call fcn.0040ca10
lea ecx, [esp + 0xf]
lea edx, [esp + 0xe]
push ecx
push edx
mov ecx, 0x825e44
mov byte [esp + 0x48], 6
mov dword [0x825e40], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x825e54], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov al, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], al
call fcn.00407e50
mov edi, str.bandit_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.bandit_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 7
push ecx
mov ecx, 0x825e58
call fcn.0040ca10
lea edx, [esp + 0xf]
lea eax, [esp + 0xe]
push edx
push eax
mov ecx, 0x825e6c
mov byte [esp + 0x48], 8
mov dword [0x825e68], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x825e7c], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
mov cl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
call fcn.00407e50
mov edi, str.behemoth_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.behemoth_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
mov dword [esp + 0x40], 9
lea edx, [esp + 0x28]
push edx
mov ecx, 0x825e80
call fcn.0040ca10
lea eax, [esp + 0xf]
lea ecx, [esp + 0xe]
push eax
push ecx
mov ecx, 0x825e94
mov byte [esp + 0x48], 0xa
mov dword [0x825e90], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x825ea4], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov dl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], dl
call fcn.00407e50
mov edi, str.beholder_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.beholder_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea eax, [esp + 0x28]
mov ecx, 0x825ea8
push eax
mov dword [esp + 0x44], 0xb
call fcn.0040ca10
lea ecx, [esp + 0xf]
lea edx, [esp + 0xe]
push ecx
push edx
mov ecx, 0x825ebc
mov byte [esp + 0x48], 0xc
mov dword [0x825eb8], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x825ecc], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov al, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], al
call fcn.00407e50
mov edi, str.black_dragon_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.black_dragon_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0xd
push ecx
mov ecx, 0x825ed0
call fcn.0040ca10
lea edx, [esp + 0xf]
lea eax, [esp + 0xe]
push edx
mov byte [esp + 0x44], 0xe
mov dword [0x825ee0], ebx
push eax
mov ecx, 0x825ee4
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x825ef4], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
mov cl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
call fcn.00407e50
mov edi, str.bone_dragon_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.bone_dragon_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea edx, [esp + 0x28]
mov ecx, 0x825ef8
push edx
mov dword [esp + 0x44], 0xf
call fcn.0040ca10
lea eax, [esp + 0xf]
lea ecx, [esp + 0xe]
push eax
push ecx
mov ecx, 0x825f0c
mov byte [esp + 0x48], 0x10
mov dword [0x825f08], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x825f1c], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov dl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], dl
call fcn.00407e50
mov edi, str.centaur_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.centaur_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea eax, [esp + 0x28]
mov ecx, 0x825f20
push eax
mov dword [esp + 0x44], 0x11
call fcn.0040ca10
lea ecx, [esp + 0xf]
lea edx, [esp + 0xe]
push ecx
push edx
mov ecx, 0x825f34
mov byte [esp + 0x48], 0x12
mov dword [0x825f30], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x825f44], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov al, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], al
call fcn.00407e50
mov edi, str.cerberus_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.cerberus_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x13
push ecx
mov ecx, 0x825f48
call fcn.0040ca10
lea edx, [esp + 0xf]
lea eax, [esp + 0xe]
push edx
push eax
mov ecx, 0x825f5c
mov byte [esp + 0x48], 0x14
mov dword [0x825f58], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x825f6c], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
mov cl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
call fcn.00407e50
mov edi, str.champion_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.champion_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea edx, [esp + 0x28]
mov ecx, 0x825f70
push edx
mov dword [esp + 0x44], 0x15
call fcn.0040ca10
lea eax, [esp + 0xf]
lea ecx, [esp + 0xe]
push eax
push ecx
mov ecx, 0x825f84
mov byte [esp + 0x48], 0x16
mov dword [0x825f80], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x825f94], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov dl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], dl
call fcn.00407e50
mov edi, str.crossbowman_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.crossbowman_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea eax, [esp + 0x28]
mov ecx, 0x825f98
push eax
mov dword [esp + 0x44], 0x17
call fcn.0040ca10
lea ecx, [esp + 0xf]
lea edx, [esp + 0xe]
push ecx
push edx
mov ecx, 0x825fac
mov byte [esp + 0x48], 0x18
mov dword [0x825fa8], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x825fbc], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov al, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], al
call fcn.00407e50
mov edi, str.crusader_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.crusader_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x19
push ecx
mov ecx, 0x825fc0
call fcn.0040ca10
lea edx, [esp + 0xf]
lea eax, [esp + 0xe]
push edx
push eax
mov ecx, 0x825fd4
mov byte [esp + 0x48], 0x1a
mov dword [0x825fd0], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x825fe4], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
mov cl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
call fcn.00407e50
mov edi, str.cyclops_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.cyclops_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea edx, [esp + 0x28]
mov ecx, 0x825fe8
push edx
mov dword [esp + 0x44], 0x1b
call fcn.0040ca10
lea eax, [esp + 0xf]
mov byte [esp + 0x40], 0x1c
mov dword [0x825ff8], ebx
push eax
lea ecx, [esp + 0x12]
push ecx
mov ecx, 0x825ffc
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x82600c], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov dl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], dl
call fcn.00407e50
mov edi, str.venom_spawn_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.venom_spawn_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea eax, [esp + 0x28]
mov ecx, 0x826010
push eax
mov dword [esp + 0x44], 0x1d
call fcn.0040ca10
lea ecx, [esp + 0xf]
lea edx, [esp + 0xe]
push ecx
push edx
mov ecx, 0x826024
mov byte [esp + 0x48], 0x1e
mov dword [0x826020], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x826034], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov al, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], al
call fcn.00407e50
mov edi, str.devil_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.devil_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x1f
push ecx
mov ecx, 0x826038
call fcn.0040ca10
lea edx, [esp + 0xf]
lea eax, [esp + 0xe]
push edx
push eax
mov ecx, 0x82604c
mov byte [esp + 0x48], 0x20
mov dword [0x826048], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x82605c], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
mov cl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
call fcn.00407e50
mov edi, str.dragon_golem_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.dragon_golem_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea edx, [esp + 0x28]
mov ecx, 0x826060
push edx
mov dword [esp + 0x44], 0x21
call fcn.0040ca10
lea eax, [esp + 0xf]
lea ecx, [esp + 0xe]
push eax
push ecx
mov ecx, 0x826074
mov byte [esp + 0x48], 0x22
mov dword [0x826070], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x826084], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov dl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], dl
call fcn.00407e50
mov edi, str.dwarf_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.dwarf_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea eax, [esp + 0x28]
mov ecx, 0x826088
push eax
mov dword [esp + 0x44], 0x23
call fcn.0040ca10
lea ecx, [esp + 0xf]
lea edx, [esp + 0xe]
push ecx
push edx
mov ecx, 0x82609c
mov byte [esp + 0x48], 0x24
mov dword [0x826098], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x8260ac], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov al, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], al
call fcn.00407e50
mov edi, str.earth_elemental_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.earth_elemental_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x25
push ecx
mov ecx, 0x8260b0
call fcn.0040ca10
lea edx, [esp + 0xf]
lea eax, [esp + 0xe]
push edx
push eax
mov ecx, 0x8260c4
mov byte [esp + 0x48], 0x26
mov dword [0x8260c0], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x8260d4], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
mov cl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
call fcn.00407e50
mov edi, str.efreet_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.efreet_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea edx, [esp + 0x28]
mov ecx, 0x8260d8
push edx
mov dword [esp + 0x44], 0x27
call fcn.0040ca10
lea eax, [esp + 0xf]
lea ecx, [esp + 0xe]
push eax
push ecx
mov ecx, 0x8260ec
mov byte [esp + 0x48], 0x28
mov dword [0x8260e8], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x8260fc], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov dl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], dl
call fcn.00407e50
mov edi, str.elf_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.elf_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea eax, [esp + 0x28]
mov ecx, 0x826100
push eax
mov dword [esp + 0x44], 0x29
call fcn.0040ca10
mov byte [esp + 0x40], 0x2a
mov dword [0x826110], ebx
lea ecx, [esp + 0xf]
lea edx, [esp + 0xe]
push ecx
push edx
mov ecx, 0x826114
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x826124], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov al, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], al
call fcn.00407e50
mov edi, str.faerie_dragon_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.faerie_dragon_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x2b
push ecx
mov ecx, 0x826128
call fcn.0040ca10
lea edx, [esp + 0xf]
lea eax, [esp + 0xe]
push edx
push eax
mov ecx, 0x82613c
mov byte [esp + 0x48], 0x2c
mov dword [0x826138], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x82614c], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
mov cl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
call fcn.00407e50
mov edi, str.fire_elemental_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.fire_elemental_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea edx, [esp + 0x28]
mov ecx, 0x826150
push edx
mov dword [esp + 0x44], 0x2d
call fcn.0040ca10
lea eax, [esp + 0xf]
lea ecx, [esp + 0xe]
push eax
push ecx
mov ecx, 0x826164
mov byte [esp + 0x48], 0x2e
mov dword [0x826160], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x826174], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
mov dl, byte [esp + 0xf]
push ebx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2c], dl
call fcn.00407e50
mov edi, str.gargoyle_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.gargoyle_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea eax, [esp + 0x28]
mov ecx, 0x826178
push eax
mov dword [esp + 0x44], 0x2f
call fcn.0040ca10
lea ecx, [esp + 0xf]
lea edx, [esp + 0xe]
push ecx
push edx
mov ecx, 0x82618c
mov byte [esp + 0x48], 0x30
mov dword [0x826188], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x82619c], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov al, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], al
call fcn.00407e50
mov edi, str.genie_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.genie_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x31
push ecx
mov ecx, 0x8261a0
call fcn.0040ca10
lea edx, [esp + 0xf]
lea eax, [esp + 0xe]
push edx
push eax
mov ecx, 0x8261b4
mov byte [esp + 0x48], 0x32
mov dword [0x8261b0], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x8261c4], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
mov cl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
call fcn.00407e50
mov edi, str.ghost_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.ghost_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea edx, [esp + 0x28]
mov ecx, 0x8261c8
push edx
mov dword [esp + 0x44], 0x33
call fcn.0040ca10
lea eax, [esp + 0xf]
lea ecx, [esp + 0xe]
push eax
push ecx
mov ecx, 0x8261dc
mov byte [esp + 0x48], 0x34
mov dword [0x8261d8], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x8261ec], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov dl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], dl
call fcn.00407e50
mov edi, str.berserker_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.berserker_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea eax, [esp + 0x28]
mov ecx, 0x8261f0
push eax
mov dword [esp + 0x44], 0x35
call fcn.0040ca10
lea ecx, [esp + 0xf]
lea edx, [esp + 0xe]
push ecx
push edx
mov ecx, 0x826204
mov byte [esp + 0x48], 0x36
mov dword [0x826200], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x826214], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov al, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], al
call fcn.00407e50
mov edi, str.gold_golem_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.gold_golem_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x37
push ecx
mov ecx, 0x826218
call fcn.0040ca10
mov byte [esp + 0x40], 0x38
lea edx, [esp + 0xf]
lea eax, [esp + 0xe]
push edx
push eax
mov ecx, 0x82622c
mov dword [0x826228], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x82623c], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
mov cl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
call fcn.00407e50
mov edi, str.griffin_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.griffin_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea edx, [esp + 0x28]
mov ecx, 0x826240
push edx
mov dword [esp + 0x44], 0x39
call fcn.0040ca10
lea eax, [esp + 0xf]
lea ecx, [esp + 0xe]
push eax
push ecx
mov ecx, 0x826254
mov byte [esp + 0x48], 0x3a
mov dword [0x826250], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x826264], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov dl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], dl
call fcn.00407e50
mov edi, str.halfling_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.halfling_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea eax, [esp + 0x28]
mov ecx, 0x826268
push eax
mov dword [esp + 0x44], 0x3b
call fcn.0040ca10
lea ecx, [esp + 0xf]
lea edx, [esp + 0xe]
push ecx
push edx
mov ecx, 0x82627c
mov byte [esp + 0x48], 0x3c
mov dword [0x826278], ebx
call fcn.0044d290
mov dword [0x82628c], ebx
mov byte [esp + 0x40], bl
push 1
lea ecx, [esp + 0x2c]
call fcn.00407e50
lea ecx, [esp + 0x28]
mov al, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], al
call fcn.00407e50
mov edi, str.harpy_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.harpy_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x3d
push ecx
mov ecx, 0x826290
call fcn.0040ca10
lea edx, [esp + 0xf]
lea eax, [esp + 0xe]
push edx
push eax
mov ecx, 0x8262a4
mov byte [esp + 0x48], 0x3e
mov dword [0x8262a0], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x8262b4], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
mov cl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
call fcn.00407e50
mov edi, str.hydra_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.hydra_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea edx, [esp + 0x28]
mov ecx, 0x8262b8
push edx
mov dword [esp + 0x44], 0x3f
call fcn.0040ca10
lea eax, [esp + 0xf]
lea ecx, [esp + 0xe]
push eax
push ecx
mov ecx, 0x8262cc
mov byte [esp + 0x48], 0x40
mov dword [0x8262c8], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x8262dc], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov dl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], dl
call fcn.00407e50
mov edi, str.ice_demon_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.ice_demon_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea eax, [esp + 0x28]
mov ecx, 0x8262e0
push eax
mov dword [esp + 0x44], 0x41
call fcn.0040ca10
lea ecx, [esp + 0xf]
lea edx, [esp + 0xe]
push ecx
push edx
mov ecx, 0x8262f4
mov byte [esp + 0x48], 0x42
mov dword [0x8262f0], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x826304], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov al, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], al
call fcn.00407e50
mov edi, str.imp_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.imp_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x43
push ecx
mov ecx, 0x826308
call fcn.0040ca10
lea edx, [esp + 0xf]
lea eax, [esp + 0xe]
push edx
push eax
mov ecx, 0x82631c
mov byte [esp + 0x48], 0x44
mov dword [0x826318], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x82632c], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
mov cl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
call fcn.00407e50
mov edi, str.leprechaun_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.leprechaun_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea edx, [esp + 0x28]
mov ecx, 0x826330
push edx
mov dword [esp + 0x44], 0x45
call fcn.0040ca10
lea eax, [esp + 0xf]
lea ecx, [esp + 0xe]
push eax
push ecx
mov ecx, 0x826344
mov byte [esp + 0x48], 0x46
mov dword [0x826340], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x826354], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov dl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], dl
call fcn.00407e50
mov edi, str.mage_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.mage_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea eax, [esp + 0x28]
mov ecx, 0x826358
push eax
mov dword [esp + 0x44], 0x47
call fcn.0040ca10
lea ecx, [esp + 0xf]
lea edx, [esp + 0xe]
push ecx
push edx
mov ecx, 0x82636c
mov byte [esp + 0x48], 0x48
mov dword [0x826368], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x82637c], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov al, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], al
call fcn.00407e50
mov edi, str.mantis_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.mantis_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x49
push ecx
mov ecx, 0x826380
call fcn.0040ca10
lea edx, [esp + 0xf]
lea eax, [esp + 0xe]
push edx
push eax
mov ecx, 0x826394
mov byte [esp + 0x48], 0x4a
mov dword [0x826390], ebx
call fcn.0044d290
mov dword [0x8263a4], ebx
mov byte [esp + 0x40], bl
push 1
lea ecx, [esp + 0x2c]
call fcn.00407e50
mov cl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
call fcn.00407e50
mov edi, str.medusa_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.medusa_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea edx, [esp + 0x28]
mov ecx, 0x8263a8
push edx
mov dword [esp + 0x44], 0x4b
call fcn.0040ca10
lea eax, [esp + 0xf]
lea ecx, [esp + 0xe]
push eax
push ecx
mov ecx, 0x8263bc
mov byte [esp + 0x48], 0x4c
mov dword [0x8263b8], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x8263cc], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov dl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], dl
call fcn.00407e50
mov edi, str.mermaid_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.mermaid_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea eax, [esp + 0x28]
mov ecx, 0x8263d0
push eax
mov dword [esp + 0x44], 0x4d
call fcn.0040ca10
lea ecx, [esp + 0xf]
lea edx, [esp + 0xe]
push ecx
push edx
mov ecx, 0x8263e4
mov byte [esp + 0x48], 0x4e
mov dword [0x8263e0], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x8263f4], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
lea ecx, [esp + 0x28]
mov al, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], al
call fcn.00407e50
or ecx, 0xffffffff
mov edi, str.minotaur_dwelling
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.minotaur_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x4f
push ecx
mov ecx, 0x8263f8
call fcn.0040ca10
lea edx, [esp + 0xf]
lea eax, [esp + 0xe]
push edx
push eax
mov ecx, 0x82640c
mov byte [esp + 0x48], 0x50
mov dword [0x826408], ebx
call fcn.0044d290
lea ecx, [esp + 0x28]
mov dword [0x82641c], ebx
push 1
mov byte [esp + 0x44], bl
call fcn.00407e50
mov cl, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
call fcn.00407e50
mov edi, str.monk_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.monk_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea edx, [esp + 0x28]
mov ecx, 0x826420
push edx
mov dword [esp + 0x44], 0x51
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea ecx, [esp + 0x28]
mov al, byte [esp + 0xf]
push ebx
mov byte [esp + 0x2c], al
call fcn.00407e50
mov edi, str.mummy_dwelling
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.mummy_dwelling
lea ecx, [esp + 0x30]
call fcn.00415530
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x52
push ecx
mov ecx, 0x826448
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea edx, [esp + 0xf]
lea ecx, [esp + 0x28]
push edx
push str.naga_dwelling
call fcn.0044d1d0
lea eax, [esp + 0x28]
mov ecx, 0x826470
push eax
mov dword [esp + 0x44], 0x53
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea ecx, [esp + 0xf]
push ecx
push str.nightmare_dwelling
lea ecx, [esp + 0x30]
call fcn.0044d1d0
lea edx, [esp + 0x28]
mov ecx, 0x826498
push edx
mov dword [esp + 0x44], 0x54
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea eax, [esp + 0xf]
lea ecx, [esp + 0x28]
push eax
push str.nomad_dwelling
call fcn.0044d1d0
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x55
push ecx
mov ecx, 0x8264c0
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea edx, [esp + 0xf]
lea ecx, [esp + 0x28]
push edx
push str.ogre_mage_dwelling
call fcn.0044d1d0
lea eax, [esp + 0x28]
mov ecx, 0x8264e8
push eax
mov dword [esp + 0x44], 0x56
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea ecx, [esp + 0xf]
push ecx
push str.orc_dwelling
lea ecx, [esp + 0x30]
call fcn.0044d1d0
lea edx, [esp + 0x28]
mov ecx, 0x826510
push edx
mov dword [esp + 0x44], 0x57
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea eax, [esp + 0xf]
lea ecx, [esp + 0x28]
push eax
push str.peasant_dwelling
call fcn.0044d1d0
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x58
push ecx
mov ecx, 0x826538
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea edx, [esp + 0xf]
lea ecx, [esp + 0x28]
push edx
push str.phoenix_dwelling
call fcn.0044d1d0
lea eax, [esp + 0x28]
mov ecx, 0x826560
push eax
mov dword [esp + 0x44], 0x59
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea ecx, [esp + 0xf]
push ecx
push str.pikeman_dwelling
lea ecx, [esp + 0x30]
call fcn.0044d1d0
lea edx, [esp + 0x28]
mov ecx, 0x826588
push edx
mov dword [esp + 0x44], 0x5a
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea eax, [esp + 0xf]
lea ecx, [esp + 0x28]
push eax
push str.pirate_dwelling
call fcn.0044d1d0
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x5b
push ecx
mov ecx, 0x8265b0
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea edx, [esp + 0xf]
lea ecx, [esp + 0x28]
push edx
push str.saytr_dwelling
call fcn.0044d1d0
lea eax, [esp + 0x28]
mov ecx, 0x8265d8
push eax
mov dword [esp + 0x44], 0x5c
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea ecx, [esp + 0xf]
push ecx
push str.sea_monster_dwelling
lea ecx, [esp + 0x30]
call fcn.0044d1d0
lea edx, [esp + 0x28]
mov ecx, 0x826600
push edx
mov dword [esp + 0x44], 0x5d
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea eax, [esp + 0xf]
push eax
push str.skeleton_dwelling
lea ecx, [esp + 0x30]
call fcn.0044d1d0
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x5e
push ecx
mov ecx, 0x826628
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea edx, [esp + 0xf]
lea ecx, [esp + 0x28]
push edx
push str.squire_dwelling
call fcn.0044d1d0
lea eax, [esp + 0x28]
mov ecx, 0x826650
push eax
mov dword [esp + 0x44], 0x5f
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea ecx, [esp + 0xf]
push ecx
push str.sprite_dwelling
lea ecx, [esp + 0x30]
call fcn.0044d1d0
lea edx, [esp + 0x28]
mov ecx, 0x826678
push edx
mov dword [esp + 0x44], 0x60
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea eax, [esp + 0xf]
lea ecx, [esp + 0x28]
push eax
push str.thunderbird_dwelling
call fcn.0044d1d0
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x61
push ecx
mov ecx, 0x8266a0
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea edx, [esp + 0xf]
lea ecx, [esp + 0x28]
push edx
push str.titan_dwelling
call fcn.0044d1d0
lea eax, [esp + 0x28]
mov ecx, 0x8266c8
push eax
mov dword [esp + 0x44], 0x62
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea ecx, [esp + 0xf]
push ecx
push str.troglodyte_dwelling
lea ecx, [esp + 0x30]
call fcn.0044d1d0
mov dword [esp + 0x40], 0x63
lea edx, [esp + 0x28]
mov ecx, 0x8266f0
push edx
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea eax, [esp + 0xf]
lea ecx, [esp + 0x28]
push eax
push str.troll_dwelling
call fcn.0044d1d0
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x64
push ecx
mov ecx, 0x826718
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea edx, [esp + 0xf]
lea ecx, [esp + 0x28]
push edx
push str.unicorn_dwelling
call fcn.0044d1d0
lea eax, [esp + 0x28]
mov ecx, 0x826740
push eax
mov dword [esp + 0x44], 0x65
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea ecx, [esp + 0xf]
push ecx
push str.vampire_dwelling
lea ecx, [esp + 0x30]
call fcn.0044d1d0
lea edx, [esp + 0x28]
mov ecx, 0x826768
push edx
mov dword [esp + 0x44], 0x66
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea eax, [esp + 0xf]
lea ecx, [esp + 0x28]
push eax
push str.water_elemental_dwelling
call fcn.0044d1d0
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x67
push ecx
mov ecx, 0x826790
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea edx, [esp + 0xf]
lea ecx, [esp + 0x28]
push edx
push str.white_tiger_dwelling
call fcn.0044d1d0
lea eax, [esp + 0x28]
mov ecx, 0x8267b8
push eax
mov dword [esp + 0x44], 0x68
call fcn.0043e450
mov byte [esp + 0x40], bl
push 1
lea ecx, [esp + 0x2c]
call fcn.00407e50
lea ecx, [esp + 0xf]
push ecx
push str.wolf_dwelling
lea ecx, [esp + 0x30]
call fcn.0044d1d0
lea edx, [esp + 0x28]
mov ecx, 0x8267e0
push edx
mov dword [esp + 0x44], 0x69
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea eax, [esp + 0xf]
lea ecx, [esp + 0x28]
push eax
push str.zombie_dwelling
call fcn.0044d1d0
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x6a
push ecx
mov ecx, 0x826808
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea edx, [esp + 0xf]
lea ecx, [esp + 0x28]
push edx
push str.waspwort_dwelling
call fcn.0044d1d0
lea eax, [esp + 0x28]
mov ecx, 0x826830
push eax
mov dword [esp + 0x44], 0x6b
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea ecx, [esp + 0xf]
push ecx
push str.goblin_knight_dwelling
lea ecx, [esp + 0x30]
call fcn.0044d1d0
lea edx, [esp + 0x28]
mov ecx, 0x826858
push edx
mov dword [esp + 0x44], 0x6c
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea eax, [esp + 0xf]
lea ecx, [esp + 0x28]
push eax
push str.evil_sorceress_dwelling
call fcn.0044d1d0
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x6d
push ecx
mov ecx, 0x826880
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea edx, [esp + 0xf]
lea ecx, [esp + 0x28]
push edx
push str.gargantuan_dwelling
call fcn.0044d1d0
lea eax, [esp + 0x28]
mov ecx, 0x8268a8
push eax
mov dword [esp + 0x44], 0x6e
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea ecx, [esp + 0xf]
push ecx
push str.dark_champion_dwelling
lea ecx, [esp + 0x30]
call fcn.0044d1d0
lea edx, [esp + 0x28]
mov ecx, 0x8268d0
push edx
mov dword [esp + 0x44], 0x6f
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea eax, [esp + 0xf]
lea ecx, [esp + 0x28]
push eax
push str.catapult_dwelling
call fcn.0044d1d0
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0x70
push ecx
mov ecx, 0x8268f8
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea edx, [esp + 0xf]
lea ecx, [esp + 0x28]
push edx
push str.frenzied_gnasher_dwelling
call fcn.0044d1d0
lea eax, [esp + 0x28]
mov ecx, 0x826920
push eax
mov dword [esp + 0x44], 0x71
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
lea ecx, [esp + 0xf]
push ecx
push str.mega_dragon_dwelling
lea ecx, [esp + 0x30]
call fcn.0044d1d0
lea edx, [esp + 0x28]
mov ecx, 0x826948
push edx
mov dword [esp + 0x44], 0x72
call fcn.0043e450
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
push 1
call fcn.00407e50
push 0x447da0
call fcn.006601e7
add esp, 4
pop edi
lea eax, [esp + 0xb]
lea ecx, [esp + 0x24]
push eax
push str.creature_dwelling
call fcn.0044d1d0
push 0x825de0
lea ecx, [esp + 0x28]
push 0x4a
push ecx
push 0x15
mov ecx, esi
mov dword [esp + 0x4c], 0x73
call fcn.0044c620
mov dword [esp + 0xc], 1
push 1
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], bl
call fcn.00407e50
mov eax, esi
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret