Function at 0x408870
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xbc
mov ecx, dword [0x444ce8]
push ebx
push ebp
push esi
push edi
mov di, word [ecx + 0x4d0c]
cmp di, 0xffff
mov dword [esp + 0x48], edi
je 0x40af03
and edi, 0xffff
cmp word [ecx + 0x5be8], 2
mov esi, edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], esi
jne 0x4088b6
xor esi, esi
mov dword [esp + 0x20], esi
mov ebp, dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 0x10], 0
lea ebx, [esi + esi*4]
shl ebx, 4
sub ebx, esi
shl ebx, 3
cmp word [ebx + ecx + 0x4d16], 0xffff
jne 0x408955
cmp word [ecx + 0x4d0a], 0
je 0x409305
cmp word [ebx + ecx + 0x4d64], 3
jne 0x409305
mov eax, dword [0x448944]
push eax
call fcn.00435460
mov ecx, dword [0x477904]
add esp, 4
push 0xffffff
push ecx
call ebp
mov edx, dword [esp + 0x10]
mov eax, dword [0x444cec]
shl edx, 4
add edx, eax
mov edi, 0x43f670
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x477904]
not ecx
dec ecx
push ecx
mov ecx, dword [edx + 4]
mov edx, dword [edx]
push 0x43f670
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov ecx, dword [0x444ce8]
jmp 0x409301
mov ecx, dword [0x448944]
push ecx
call fcn.00435460
mov edx, dword [0x477904]
add esp, 4
push 0xffffff
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [0x444ce8]
mov esi, dword [esp + 0x10]
or ecx, 0xffffffff
mov edx, dword [0x444cec]
lea edi, [ebx + eax + 0x4efc]
xor eax, eax
shl esi, 4
repne scasb al, byte es:[edi]
mov eax, dword [esi + edx + 8]
mov ebp, dword [esi + edx]
not ecx
dec ecx
push 0
shl ecx, 3
sub eax, ecx
mov ecx, dword [0x477904]
sub eax, ebp
push ecx
cdq
sub eax, edx
mov ebp, eax
sar ebp, 1
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [0x444ce8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + edx + 0x4efc]
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, dword [0x444cec]
not ecx
dec ecx
push ecx
mov ecx, dword [esi + eax + 4]
push edx
mov edx, dword [esi + eax]
inc ecx
push ecx
mov ecx, dword [0x477904]
lea eax, [edx + ebp + 1]
push eax
push ecx
call dword [sym.imp.GDI32.dll_TextOutA]
mov edx, dword [0x477904]
push 0xffffff
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [0x444ce8]
or ecx, 0xffffffff
lea edx, [ebx + eax + 0x4efc]
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, dword [0x444cec]
not ecx
dec ecx
push ecx
mov ecx, dword [esi + eax + 4]
push edx
mov edx, dword [esi + eax]
mov eax, dword [0x477904]
add edx, ebp
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov edx, dword [0x444ce8]
mov ecx, dword [ebx + edx + 0x4d44]
mov eax, dword [ebx + edx + 0x4d48]
mov edi, ecx
or edi, eax
jne 0x408a61
xor eax, eax
jmp 0x408afd
test eax, eax
ja 0x408ae2
jb 0x408a6f
cmp ecx, 0x2710
jae 0x408a79
mov eax, 1
jmp 0x408afd
test eax, eax
ja 0x408ae2
jb 0x408a87
cmp ecx, 0x186a0
jae 0x408a8e
mov eax, 2
jmp 0x408afd
test eax, eax
ja 0x408ae2
jb 0x408a9c
cmp ecx, 0xf4240
jae 0x408aa3
mov eax, 3
jmp 0x408afd
test eax, eax
ja 0x408ae2
jb 0x408ab1
cmp ecx, 0x989680
jae 0x408ab8
mov eax, 4
jmp 0x408afd
test eax, eax
ja 0x408ae2
jb 0x408ac6
cmp ecx, 0x5f5e100
jae 0x408acd
mov eax, 5
jmp 0x408afd
test eax, eax
ja 0x408ae2
jb 0x408adb
cmp ecx, 0x3b9aca00
jae 0x408ae2
mov eax, 6
jmp 0x408afd
cmp eax, 2
ja 0x408af8
jb 0x408af1
cmp ecx, 0x540be400
jae 0x408af8
mov eax, 7
jmp 0x408afd
mov eax, 8
xor ecx, ecx
mov word [ebx + edx + 0x4f46], ax
mov dword [esp + 0x18], ecx
mov edx, dword [0x444ce8]
lea eax, [ebx + edx]
mov al, byte [eax + ecx + 0x4f40]
cmp al, 0xff
je 0x408b73
mov ecx, dword [esp + 0x18]
and eax, 0xff
add eax, 0x7a
mov edi, eax
mov eax, dword [esp + 0x10]
push edi
lea edx, [ecx + eax*2]
mov ecx, dword [0x444cec]
add eax, edx
shl eax, 4
add eax, ecx
mov ecx, 0x44a660
mov ebp, dword [eax + 0x64c]
mov eax, dword [eax + 0x648]
push ebp
push eax
mov dword [esp + 0x20], eax
call fcn.00432600
mov edx, dword [esp + 0x14]
push edi
push ebp
push edx
mov ecx, 0x44a660
call fcn.00432650
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 3
mov dword [esp + 0x18], ecx
jl 0x408b0b
mov eax, dword [0x448944]
push eax
call fcn.00435460
mov eax, dword [0x444ce8]
mov ecx, dword [ebx + eax + 0x4d48]
mov edx, dword [ebx + eax + 0x4d44]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
call fcn.0042c470
lea ecx, [esp + 0x38]
lea edx, [esp + 0x5c]
push ecx
push 0x43f570
push edx
call fcn.00436e62
mov eax, dword [esp + 0x2c]
lea edi, [esp + 0x68]
or ecx, 0xffffffff
add esp, 0x1c
lea edx, [eax + 6]
xor eax, eax
shl edx, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], edx
push 0
lea ecx, [ecx + ecx*2]
shl ecx, 1
mov edi, ecx
mov ecx, dword [0x444cec]
mov eax, dword [esi + ecx + 0x68]
mov ebp, dword [edx + ecx]
sub eax, ebp
sub eax, edi
cdq
sub eax, edx
mov edx, dword [0x477904]
mov ebp, eax
push edx
sar ebp, 1
call dword [sym.imp.GDI32.dll_SetTextColor]
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x4c]
push ecx
push eax
mov eax, dword [0x444cec]
mov ecx, dword [esi + eax + 0x64]
mov eax, dword [edx + eax]
mov edx, dword [0x477904]
inc ecx
push ecx
lea ecx, [eax + ebp + 1]
push ecx
push edx
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [0x477904]
push 0xffffff
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x444cec]
not ecx
mov edx, dword [esi + eax + 0x64]
dec ecx
push ecx
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [ecx + eax]
mov eax, dword [0x477904]
add edx, ebp
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov ecx, dword [0x4456f4]
push ecx
call fcn.00435460
mov eax, dword [0x444cec]
add esp, 4
mov edi, dword [esi + eax + 0xc4]
mov ecx, dword [esi + eax + 0xcc]
mov edx, dword [esi + eax + 0xc8]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x10]
add edi, 0xc
shl edi, 4
mov ebp, dword [edi + eax]
mov dword [0x477884], ecx
mov ecx, dword [esp + 0x10]
mov dword [0x4778a4], ebp
mov ebp, dword [esp + 0x14]
mov dword [0x4778a8], edx
test ecx, ecx
mov dword [0x47789c], ebp
jne 0x408f37
mov edx, dword [0x444cd4]
cmp dword [edx + 0xa4c], 1
jne 0x408d84
mov ebx, dword [eax + 0x7b4]
mov ebp, dword [eax + 0x7b0]
push 0x3e
push ebx
push ebp
mov ecx, 0x44af60
call fcn.00432600
push 0x3e
push ebx
push ebp
mov ecx, 0x44af60
call fcn.00432650
mov eax, dword [0x444cd4]
mov edx, dword [eax + 0xa54]
mov eax, dword [0x444cec]
cmp edx, 1
jb 0x408d84
mov ecx, dword [eax + 0x7b0]
mov ebx, dword [eax + 0x7bc]
mov ebp, dword [eax + 0x7b4]
mov dword [0x4778a4], ecx
lea edx, [edx + ecx + 6]
mov dword [0x47789c], ebp
mov dword [0x4778a8], edx
mov dword [0x477884], ebx
mov ecx, dword [eax + 0x7b4]
mov edx, dword [eax + 0x7b0]
push 0x3f
push ecx
push edx
mov ecx, 0x44af60
call fcn.00433f90
mov eax, dword [0x444cec]
mov ecx, dword [0x444ce8]
add ecx, 0x4ce8
mov edx, dword [ecx + 4]
test edx, edx
ja 0x408da3
cmp dword [ecx], 0x186a0
jb 0x4091f3
mov edx, dword [eax + 0xc4]
mov eax, dword [eax + 0xc0]
add edx, 0x7e
push 0x32
add eax, 2
push edx
push eax
mov ecx, 0x44af60
call fcn.00432650
mov ecx, dword [0x444ce8]
mov eax, dword [0x444cd4]
mov edx, dword [ecx + 0x7a92]
mov ecx, dword [eax + edx*4 + 0x914]
test ecx, ecx
je 0x4091ee
mov eax, 0xcccccccd
mul ecx
mov ebx, edx
shr ebx, 3
test ebx, ebx
jle 0x408e48
xor ebp, ebp
mov dword [esp + 0x18], ebx
mov eax, dword [0x444cec]
cmp ebp, 0x34
push 0x3d
mov ecx, dword [eax + 0xc4]
jg 0x408e1e
mov edx, dword [eax + 0xc0]
add ecx, 0x80
push ecx
lea eax, [edx + ebp + 5]
jmp 0x408e2f
mov edx, dword [eax + 0xc0]
add ecx, 0x90
push ecx
lea eax, [edx + ebp - 0x3c]
push eax
mov ecx, 0x44af60
call fcn.00432650
mov eax, dword [esp + 0x18]
add ebp, 0xd
dec eax
mov dword [esp + 0x18], eax
jne 0x408df9
mov ecx, dword [0x444ce8]
mov eax, dword [0x444cd4]
mov edx, dword [ecx + 0x7a92]
mov ecx, 0xa
mov eax, dword [eax + edx*4 + 0x914]
xor edx, edx
div ecx
test edx, edx
je 0x408ecb
cmp ebx, 5
jge 0x408e9a
mov eax, dword [0x444cec]
add edx, 0x33
push edx
lea ecx, [ebx + ebx*2]
mov edx, dword [eax + 0xc4]
mov eax, dword [eax + 0xc0]
add edx, 0x80
push edx
lea edx, [ebx + ecx*4]
lea ecx, [eax + edx + 5]
jmp 0x408ec0
mov eax, dword [0x444cec]
add edx, 0x33
push edx
lea ecx, [ebx + ebx*2]
mov edx, dword [eax + 0xc4]
mov eax, dword [eax + 0xc0]
add edx, 0x90
push edx
lea edx, [ebx + ecx*4]
lea ecx, [eax + edx - 0x3c]
push ecx
mov ecx, 0x44af60
call fcn.00432650
mov edx, dword [0x444ce8]
mov ecx, dword [0x444cd4]
mov eax, dword [edx + 0x7a92]
cmp dword [ecx + eax*4 + 0x914], 0x64
jb 0x4091ee
push 0
push 2
push 0x12c
call fcn.0042c150
mov ebx, eax
mov eax, dword [0x444cec]
add esp, 0xc
add ebx, 0x30
mov ebp, dword [eax + 0xc4]
mov eax, dword [eax + 0xc0]
sub ebp, 4
add eax, 8
push ebx
push ebp
push eax
mov ecx, 0x44af60
mov dword [esp + 0x20], eax
call fcn.00432600
mov edx, dword [esp + 0x14]
push 6
push ebx
push ebp
push edx
jmp 0x4091e4
mov ecx, dword [0x444cd4]
cmp dword [ecx + 0xa4c], 1
jne 0x408ffb
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + eax + 0x7b4]
push 0x3e
mov dword [esp + 0x18], ecx
lea ebp, [edx + 0x7b]
push ecx
shl ebp, 4
mov ecx, 0x44af60
mov eax, dword [eax + ebp]
push eax
mov dword [esp + 0x24], eax
call fcn.00432600
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 0x3e
push eax
push ecx
mov ecx, 0x44af60
call fcn.00432650
mov edx, dword [0x444ce8]
mov eax, dword [0x444cec]
mov edx, dword [ebx + edx + 0x4f84]
cmp edx, 1
jb 0x408ffb
mov ecx, dword [esi + eax + 0x7bc]
push 0x3f
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + ebp]
lea edx, [edx + ecx + 6]
mov dword [esp + 0x18], edx
mov edx, dword [esi + eax + 0x7b4]
mov dword [0x4778a4], ecx
mov ecx, dword [esp + 0x18]
mov dword [0x47789c], edx
mov edx, dword [esp + 0x1c]
mov dword [0x4778a8], ecx
mov dword [0x477884], edx
mov ecx, dword [esi + eax + 0x7b4]
mov edx, dword [eax + ebp]
push ecx
push edx
mov ecx, 0x44af60
call fcn.00433f90
mov eax, dword [0x444cec]
mov ecx, dword [0x444ce8]
add ecx, 0x4ce8
mov edx, dword [ecx + 4]
test edx, edx
ja 0x40901a
cmp dword [ecx], 0x186a0
jb 0x4091f3
mov edx, dword [esi + eax + 0xc4]
mov eax, dword [edi + eax]
add edx, 0x7e
push 0x32
push edx
push eax
mov ecx, 0x44af60
call fcn.00432650
mov ecx, dword [0x444ce8]
mov ecx, dword [ebx + ecx + 0x4f7c]
test ecx, ecx
je 0x4091ee
mov eax, 0xcccccccd
mul ecx
mov ebp, edx
shr ebp, 3
test ebp, ebp
jle 0x4090cc
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x18]
push 0x3d
cmp eax, 0x34
mov eax, dword [0x444cec]
jg 0x409092
mov edx, dword [esi + eax + 0xc4]
mov eax, dword [edi + eax]
mov ecx, dword [esp + 0x1c]
add edx, 0x80
push edx
lea edx, [eax + ecx + 3]
push edx
jmp 0x4090ac
mov ecx, dword [esi + eax + 0xc4]
mov edx, dword [edi + eax]
mov eax, dword [esp + 0x1c]
add ecx, 0x90
push ecx
lea ecx, [edx + eax - 0x3e]
push ecx
mov ecx, 0x44af60
call fcn.00432650
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add ecx, 0xd
dec eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
jne 0x409066
mov edx, dword [0x444ce8]
mov ecx, 0xa
mov eax, dword [ebx + edx + 0x4f7c]
xor edx, edx
div ecx
test edx, edx
je 0x409144
cmp ebp, 5
jge 0x409113
mov eax, dword [0x444cec]
add edx, 0x33
push edx
lea ecx, [ebp + ebp*2]
mov edx, dword [esi + eax + 0xc4]
mov eax, dword [edi + eax]
add edx, 0x80
push edx
lea edx, [ebp + ecx*4]
lea ecx, [eax + edx + 3]
jmp 0x409139
mov eax, dword [0x444cec]
add edx, 0x33
push edx
lea ecx, [ebp + ebp*2]
mov edx, dword [esi + eax + 0xc4]
mov eax, dword [edi + eax]
add edx, 0x90
push edx
lea edx, [ebp + ecx*4]
lea ecx, [eax + edx - 0x3e]
push ecx
mov ecx, 0x44af60
call fcn.00432650
mov edx, dword [0x444ce8]
cmp dword [ebx + edx + 0x4f7c], 0x64
jb 0x4091ee
mov eax, dword [esp + 0x10]
push 0
cmp eax, 2
push 2
push 0x12c
jg 0x4091a8
call fcn.0042c150
mov ebx, eax
mov eax, dword [0x444cec]
add esp, 0xc
add ebx, 0x30
mov ebp, dword [esi + eax + 0xc4]
mov eax, dword [edi + eax]
sub ebp, 4
sub eax, 6
push ebx
push ebp
push eax
mov ecx, 0x44af60
mov dword [esp + 0x20], eax
call fcn.00432600
mov eax, dword [esp + 0x14]
push 6
push ebx
push ebp
push eax
jmp 0x4091e4
call fcn.0042c150
mov ebx, eax
mov eax, dword [0x444cec]
add esp, 0xc
add ebx, 0x30
mov ebp, dword [esi + eax + 0xc4]
mov eax, dword [edi + eax]
sub ebp, 4
add eax, 8
push ebx
push ebp
push eax
mov ecx, 0x44af60
mov dword [esp + 0x20], eax
call fcn.00432600
mov ecx, dword [esp + 0x14]
push 6
push ebx
push ebp
push ecx
mov ecx, 0x44af60
call fcn.00433860
mov eax, dword [0x444cec]
mov ecx, dword [0x444d00]
cmp dword [ecx], 2
jne 0x409207
cmp dword [ecx + 0x142], 2
jb 0x409256
mov ecx, dword [0x444ce8]
xor edx, edx
mov dx, word [ecx + 0x4d0e]
mov ecx, dword [esp + 0x20]
cmp ecx, edx
jne 0x40924c
mov ecx, dword [esp + 0x10]
push 0x2c
mov ebx, dword [eax + ecx*8 + 0x124]
mov ebp, dword [eax + ecx*8 + 0x120]
push ebx
push ebp
mov ecx, 0x44a550
call fcn.00432600
push 0x2c
push ebx
push ebp
mov ecx, 0x44a550
call fcn.00432650
call fcn.0040afb0
mov eax, dword [0x444cec]
add edi, eax
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov edi, dword [edi + 0xc]
push edi
push edx
push ecx
push eax
mov ecx, 0x44a800
call fcn.0042d3e0
mov eax, dword [0x444cec]
mov edx, dword [esi + eax + 0xc]
mov ecx, dword [esi + eax + 8]
push edx
mov edx, dword [esi + eax + 4]
mov eax, dword [esi + eax]
push ecx
push edx
push eax
mov ecx, 0x44a800
call fcn.0042d3e0
mov eax, dword [0x444cec]
mov edx, dword [esi + eax + 0x68]
mov ecx, dword [esi + eax + 0x6c]
add edx, 0x66
push ecx
mov ecx, dword [esi + eax + 0x64]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, 0x44a800
mov eax, dword [edx + eax]
push eax
call fcn.0042d3e0
mov eax, dword [0x444cec]
mov ecx, dword [esi + eax + 0x52c]
mov edx, dword [esi + eax + 0x528]
push ecx
mov ecx, dword [esi + eax + 0x4c4]
push edx
mov edx, dword [esp + 0x18]
add edx, 0x4c
push ecx
shl edx, 4
mov ecx, 0x44a800
mov eax, dword [edx + eax]
push eax
call fcn.0042d3e0
mov ecx, dword [0x444ce8]
mov esi, dword [esp + 0x20]
mov ebp, dword [sym.imp.GDI32.dll_SetTextColor]
mov edi, dword [esp + 0x24]
lea eax, [esi + 1]
mov esi, 5
cdq
idiv esi
mov ebx, dword [esp + 0x10]
inc ebx
cmp ebx, 5
mov dword [esp + 0x10], ebx
mov esi, edx
mov dword [esp + 0x20], esi
jl 0x4088c4
cmp word [ecx + 0x4cf0], 1
jne 0x40af03
mov ecx, dword [0x477904]
push 0xffffff
push ecx
call ebp
mov edx, dword [0x4456f4]
push edx
call fcn.00435460
mov ebx, dword [0x444ce8]
lea esi, [edi + edi*4]
shl esi, 4
sub esi, edi
add esp, 4
shl esi, 3
mov dword [esp + 0x10], esi
mov edi, 0x1e
mov ax, word [esi + ebx + 0x4d64]
cmp ax, 1
jne 0x409b07
mov eax, dword [0x477904]
push 0xffffff
push eax
call ebp
mov eax, dword [0x444ce8]
mov ecx, dword [eax + 0x4d06]
mov edx, dword [eax + 0x4d02]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.0042c470
mov ecx, dword [0x448944]
push ecx
call fcn.00435460
mov ecx, dword [0x444ce8]
xor eax, eax
mov dword [0x444ce4], 0
push 0x444d0c
mov ax, word [ecx + 0x4d0c]
push 0x444ce4
push 0x444d04
lea edx, [eax + eax*4]
shl edx, 4
sub edx, eax
lea eax, [ecx + edx*8 + 0x4f24]
push eax
call fcn.00418b40
mov edx, dword [0x444ce4]
add esp, 0x20
test edx, edx
jle 0x4096ea
mov eax, dword [0x444ce8]
xor ecx, ecx
mov cx, word [eax + 0x4d0c]
lea ebx, [ecx + ecx*4]
shl ebx, 4
sub ebx, ecx
cmp word [eax + ebx*8 + 0x4f22], 4
jne 0x4096ea
mov ecx, dword [eax + 0x4ca2]
test ecx, ecx
je 0x40943e
cmp dword [eax + 0x4cd2], edi
jl 0x4096ea
mov ecx, dword [eax + 0x4ca6]
test ecx, ecx
je 0x409454
cmp dword [eax + 0x4cd6], edi
jl 0x4096ea
mov ecx, dword [eax + 0x4caa]
test ecx, ecx
je 0x40946a
cmp dword [eax + 0x4cda], edi
jl 0x4096ea
mov ecx, dword [eax + 0x4cae]
test ecx, ecx
je 0x409480
cmp dword [eax + 0x4cde], edi
jl 0x4096ea
cmp edx, 4
jne 0x4094f2
mov eax, dword [0x444d0c]
lea ecx, [eax + eax*2]
lea edx, [eax + ecx*4]
mov cl, byte [0x444d07]
and ecx, 0xf
lea eax, [edx*2 + 0x4400bc]
push eax
mov al, byte [0x444d06]
and eax, 0xf
lea edx, [ecx*4 + str.A23456789JQK]
push edx
mov dl, byte [0x444d05]
lea ecx, [eax*4 + str.A23456789JQK]
and edx, 0xf
push ecx
mov cl, byte [0x444d04]
and ecx, 0xf
lea eax, [edx*4 + str.A23456789JQK]
push eax
lea eax, [esp + 0x5c]
lea edx, [ecx*4 + str.A23456789JQK]
push edx
push str.__s__s__s__s___s
push eax
call fcn.00436e62
add esp, 0x1c
jmp 0x4095cf
cmp edx, 3
jne 0x409550
mov eax, dword [0x444d0c]
lea ecx, [eax + eax*2]
lea edx, [eax + ecx*4]
mov cl, byte [0x444d06]
and ecx, 0xf
lea eax, [edx*2 + 0x4400bc]
lea edx, [ecx*4 + str.A23456789JQK]
push eax
mov al, byte [0x444d05]
push edx
mov dl, byte [0x444d04]
and eax, 0xf
and edx, 0xf
lea ecx, [eax*4 + str.A23456789JQK]
lea eax, [edx*4 + str.A23456789JQK]
push ecx
push eax
lea ecx, [esp + 0x5c]
push str.__s__s__s___s
push ecx
call fcn.00436e62
add esp, 0x18
jmp 0x4095cf
mov eax, dword [0x444d0c]
cmp edx, 2
jne 0x40959e
lea edx, [eax + eax*2]
lea eax, [eax + edx*4]
mov dl, byte [0x444d05]
and edx, 0xf
lea ecx, [eax*2 + 0x4400bc]
push ecx
mov cl, byte [0x444d04]
and ecx, 0xf
lea eax, [edx*4 + str.A23456789JQK]
push eax
lea eax, [esp + 0x54]
lea edx, [ecx*4 + str.A23456789JQK]
push edx
push str.__s__s___s
push eax
call fcn.00436e62
add esp, 0x14
jmp 0x4095cf
lea ecx, [eax + eax*2]
lea edx, [eax + ecx*4]
mov cl, byte [0x444d04]
and ecx, 0xf
lea eax, [edx*2 + 0x4400bc]
lea edx, [ecx*4 + str.A23456789JQK]
push eax
push edx
lea eax, [esp + 0x54]
push str.__s___s
push eax
call fcn.00436e62
add esp, 0x10
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [0x444ce8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, dword [ebx + 8]
imul ecx, dword [0x4778cc]
mov edx, dword [ebx]
mov edi, dword [ebx + 0xc]
mov ebx, dword [ebx + 4]
mov eax, ebp
sub eax, ecx
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x14]
sub eax, edx
cdq
add edi, 3
sub ebx, 4
push edi
sub eax, edx
push ebp
push ebx
mov esi, eax
push ecx
mov ecx, dword [0x477894]
sar esi, 1
call fcn.0042d3e0
mov edx, dword [esp + 0x14]
push 0
push edi
push ebp
push ebx
push edx
call fcn.00434ab0
mov eax, dword [0x477904]
add esp, 0x14
push 0
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x444ce8]
not ecx
mov edx, dword [eax + 4]
mov eax, dword [eax]
dec ecx
inc edx
push ecx
lea ecx, [esp + 0x50]
push ecx
push edx
mov edx, dword [0x477904]
lea ecx, [esi + eax + 1]
push ecx
push edx
call dword [sym.imp.GDI32.dll_TextOutA]
cmp dword [0x444d0c], 3
jl 0x409687
mov eax, dword [0x477904]
push 0xa240ff
push eax
jmp 0x409693
mov ecx, dword [0x477904]
push 0xffffff
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4c]
repne scasb al, byte es:[edi]
mov eax, dword [0x444ce8]
not ecx
dec ecx
push ecx
mov ecx, dword [eax + 4]
push edx
mov edx, dword [0x477904]
push ecx
mov ecx, dword [eax]
add esi, ecx
push esi
push edx
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [0x444ce8]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
push ecx
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax]
push ecx
push edx
mov ecx, 0x44a800
call fcn.0042d3e0
mov esi, dword [esp + 0x10]
mov eax, dword [0x4456f4]
push eax
call fcn.00435460
mov ebx, dword [0x444ce8]
xor edi, edi
add esp, 4
cmp word [esi + ebx + 0x4f22], di
jbe 0x409979
mov eax, dword [esp + 0x10]
xor esi, esi
mov dword [esp + 0x1c], 0x4690
add eax, ebx
mov al, byte [eax + edi + 0x4f24]
cmp al, 0xff
je 0x409954
mov ecx, dword [esp + 0x1c]
cmp word [ecx + ebx], 0
je 0x409787
mov edx, dword [ebx + 0x5c46]
push edx
push eax
call fcn.004249c0
mov ebp, eax
mov eax, dword [0x444cec]
add esp, 8
mov ecx, 0x4465f0
mov ebx, dword [esi + eax + 0x154]
mov eax, dword [esi + eax + 0x150]
sub ebx, 0xa
push ebp
push ebx
push eax
mov dword [esp + 0x20], eax
call fcn.00432600
mov eax, dword [esp + 0x14]
push ebp
push ebx
push eax
mov ecx, 0x4465f0
call fcn.00432650
jmp 0x40994e
mov ecx, dword [ebx + 0x5c46]
push ecx
push eax
call fcn.004249c0
mov ebx, eax
mov eax, dword [0x444cec]
add esp, 8
mov ecx, 0x4465f0
mov ebp, dword [esi + eax + 0x154]
mov eax, dword [esi + eax + 0x150]
push ebx
push ebp
push eax
mov dword [esp + 0x20], eax
call fcn.00432600
mov edx, dword [esp + 0x14]
push ebx
push ebp
push edx
mov ecx, 0x4465f0
call fcn.00432650
mov ebx, dword [0x444ce8]
mov eax, dword [ebx + edi*4 + 0x4ca2]
test eax, eax
je 0x409954
mov ecx, dword [ebx + edi*4 + 0x4cb2]
test ecx, ecx
je 0x40987d
mov eax, dword [0x44cef4]
mov ecx, dword [ebx + edi*4 + 0x4cc2]
cmp eax, ecx
jge 0x409806
xor eax, eax
jmp 0x409812
sub eax, ecx
cmp eax, 0x3c
jl 0x409812
mov eax, 0x3c
mov dword [ebx + edi*4 + 0x4cd2], eax
mov eax, dword [0x444ce8]
mov ecx, dword [eax + 0x5c46]
push ecx
push 0xff
call fcn.004249c0
mov edx, dword [0x444ce8]
mov ebp, eax
mov eax, dword [0x444cec]
add esp, 8
mov ecx, dword [edx + edi*4 + 0x4cd2]
mov ebx, dword [esi + eax + 0x154]
mov eax, dword [esi + eax + 0x150]
add ebx, ecx
push ebp
push ebx
push eax
mov ecx, 0x4465f0
mov dword [esp + 0x20], eax
call fcn.00432600
mov eax, dword [esp + 0x14]
push ebp
push ebx
push eax
mov ecx, 0x4465f0
call fcn.00432650
jmp 0x40994e
cmp eax, 1
jne 0x4098de
mov ecx, dword [ebx + 0x5c46]
push ecx
push 0xff
call fcn.004249c0
mov edx, dword [0x444ce8]
mov ebp, eax
mov eax, dword [0x444cec]
add esp, 8
mov ecx, dword [edx + edi*4 + 0x4cd2]
mov ebx, dword [esi + eax + 0x154]
mov eax, dword [esi + eax + 0x150]
add ebx, ecx
push ebp
push ebx
push eax
mov ecx, 0x4465f0
mov dword [esp + 0x20], eax
call fcn.00432600
mov eax, dword [esp + 0x14]
push ebp
push ebx
push eax
mov ecx, 0x4465f0
call fcn.00432650
jmp 0x40994e
cmp dword [ebx + edi*4 + 0x4cd2], 0x1e
jg 0x409954
mov ecx, dword [ebx + 0x5c46]
push ecx
push 0xff
call fcn.004249c0
mov edx, dword [0x444ce8]
mov ebp, eax
mov eax, dword [0x444cec]
add esp, 8
mov ecx, dword [edx + edi*4 + 0x4cd2]
mov ebx, dword [esi + eax + 0x154]
mov eax, dword [esi + eax + 0x150]
add ebx, ecx
push ebp
push ebx
push eax
mov ecx, 0x4465f0
mov dword [esp + 0x20], eax
call fcn.00432600
mov eax, dword [esp + 0x14]
push ebp
push ebx
push eax
mov ecx, 0x4465f0
call fcn.00432650
mov eax, dword [0x444ce8]
inc dword [eax + edi*4 + 0x4cd2]
mov ebx, dword [0x444ce8]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
add eax, 2
inc edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
add esi, 0x10
mov cx, word [eax + ebx + 0x4f22]
cmp edi, ecx
jl 0x40971c
cmp dword [ebx + 0x5c2a], 1
jne 0x409a33
mov edx, dword [0x444d10]
cmp dword [edx], 2
jne 0x409a33
mov edx, dword [esp + 0x10]
xor ecx, ecx
xor eax, eax
mov cx, word [edx + ebx + 0x4f22]
test ecx, ecx
jle 0x409a33
lea edx, [edx + ebx + 0x4f24]
cmp byte [edx + eax], 0xff
je 0x4099bf
inc eax
cmp eax, ecx
jl 0x4099b4
cmp eax, 4
jne 0x409a33
xor ebp, ebp
mov esi, 0x22
mov dword [esp + 0x1c], 0x4690
mov eax, dword [esp + 0x1c]
cmp word [eax + ebx], 0
mov eax, dword [0x444cec]
mov edi, dword [eax + ebp + 0x15c]
je 0x4099ef
sub edi, 0x22
jmp 0x4099f2
sub edi, 0x18
mov ebx, dword [eax + ebp + 0x150]
push esi
add ebx, 3
push edi
push ebx
mov ecx, 0x44a660
call fcn.00432600
push esi
push edi
push ebx
mov ecx, 0x44a660
call fcn.00432650
mov edi, dword [esp + 0x1c]
mov ebx, dword [0x444ce8]
add edi, 2
inc esi
add ebp, 0x10
mov dword [esp + 0x1c], edi
lea ecx, [esi - 0x22]
cmp ecx, 4
jl 0x4099d3
cmp word [ebx + 0x468e], 3
jne 0x409e6e
mov edx, dword [esp + 0x10]
xor ecx, ecx
xor eax, eax
mov cx, word [edx + ebx + 0x4f22]
test ecx, ecx
jle 0x409e6e
lea edx, [edx + ebx + 0x4f24]
cmp byte [edx + eax], 0xff
je 0x409a6b
inc eax
cmp eax, ecx
jl 0x409a60
cmp eax, 4
jne 0x409e6e
xor ebp, ebp
xor eax, eax
mov ecx, 0x4690
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ecx
mov edx, dword [eax + ebx + 0x4ca2]
test edx, edx
je 0x409ae1
cmp dword [eax + ebx + 0x4cd2], 0x18
jg 0x409ae1
mov eax, dword [0x444cec]
cmp word [ecx + ebx], 0
mov esi, dword [eax + ebp + 0x15c]
je 0x409ab2
sub esi, 0x22
jmp 0x409ab5
sub esi, 0x18
mov edi, dword [eax + ebp + 0x150]
push 0x27
add edi, 3
push esi
push edi
mov ecx, 0x44a660
call fcn.00432600
push 0x27
push esi
push edi
mov ecx, 0x44a660
call fcn.00432650
mov ebx, dword [0x444ce8]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
add ecx, 2
add eax, 4
add ebp, 0x10
cmp ecx, 0x4698
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
jl 0x409a85
jmp 0x409e6e
cmp ax, 2
jne 0x409e6e
mov edx, dword [esp + 0x10]
xor esi, esi
mov dword [esp + 0x18], esi
cmp word [edx + ebx + 0x4f22], si
jbe 0x409c09
mov eax, dword [0x447d28]
mov ecx, 0x4465f0
lea edi, [eax + 0x34]
mov eax, dword [0x444cec]
push edi
mov ebx, dword [esi + eax + 0x154]
mov ebp, dword [esi + eax + 0x150]
push ebx
push ebp
call fcn.00432600
push edi
push ebx
push ebp
mov ecx, 0x4465f0
call fcn.00432650
mov ecx, dword [0x444d00]
cmp dword [ecx], 1
jne 0x409be1
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
cmp edx, eax
jne 0x409be1
mov eax, 1
cmp word [ecx + 0xa9e], ax
jne 0x409be1
cmp word [ecx + 0xaa0], ax
jne 0x409be1
mov eax, dword [0x444ce8]
mov edx, dword [esp + 0x10]
add edx, eax
mov ecx, dword [eax + 0x5c46]
mov eax, dword [esp + 0x18]
push ecx
mov cl, byte [edx + eax + 0x4f24]
push ecx
call fcn.004249c0
mov edi, eax
mov eax, dword [0x444cec]
add esp, 8
mov ecx, 0x4465f0
mov ebx, dword [esi + eax + 0x154]
mov ebp, dword [esi + eax + 0x150]
push edi
push ebx
push ebp
call fcn.00432600
push edi
push ebx
push ebp
mov ecx, 0x4465f0
call fcn.00432650
mov ebx, dword [0x444ce8]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
xor edx, edx
mov dx, word [ecx + ebx + 0x4f22]
inc eax
add esi, 0x10
cmp eax, edx
mov dword [esp + 0x18], eax
jl 0x409b29
cmp dword [ebx + 0x5c2e], 1
jne 0x409e6e
mov eax, dword [0x444d00]
cmp dword [eax], 1
jne 0x409c32
mov dx, word [esp + 0x48]
cmp word [eax + 0x11c], dx
je 0x409e6e
mov eax, dword [0x444cec]
push 0x1e
mov ecx, 0x44a550
mov esi, dword [eax + 0x154]
mov edi, dword [eax + 0x150]
push esi
push edi
call fcn.00432600
push 0x1e
push esi
push edi
mov ecx, 0x44a550
call fcn.004328f0
mov eax, dword [0x444cec]
push 0x27
mov ecx, 0x44a550
mov esi, dword [eax + 0x154]
mov edi, dword [eax + 0x150]
add esi, 0x38
add edi, 0x46
push esi
push edi
call fcn.00432600
push 0x27
push esi
push edi
mov ecx, 0x44a550
call fcn.004328f0
mov eax, dword [0x444cec]
push 0x27
mov ecx, 0x44a550
mov esi, dword [eax + 0x154]
mov edi, dword [eax + 0x150]
add esi, 0x38
add edi, 0x46
push esi
push edi
call fcn.00432600
push 0x27
push esi
push edi
mov ecx, 0x44a550
call fcn.004328f0
mov eax, dword [0x448944]
push eax
call fcn.00435460
mov ecx, dword [0x444ce8]
mov ebp, dword [esp + 0x14]
xor eax, eax
add esp, 4
lea edi, [ecx + ebp + 0x4efc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, dword [sym.imp.GDI32.dll_SetTextColor]
shl ecx, 3
mov edx, ecx
mov ecx, dword [0x444cec]
push 0
mov eax, dword [ecx + 8]
sub eax, edx
mov edx, dword [ecx]
sub eax, edx
cdq
sub eax, edx
mov esi, eax
mov eax, dword [0x477904]
push eax
sar esi, 1
call ebx
mov ecx, dword [0x444ce8]
xor eax, eax
lea edx, [ecx + ebp + 0x4efc]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov eax, dword [0x444cec]
mov ebp, dword [sym.imp.GDI32.dll_TextOutA]
mov edx, dword [eax + 4]
mov eax, dword [eax]
inc edx
push edx
mov edx, dword [0x477904]
lea ecx, [eax + esi + 1]
push ecx
push edx
call ebp
mov eax, dword [0x477904]
push 0xffffff
push eax
call ebx
mov ecx, dword [0x444ce8]
mov edx, dword [esp + 0x10]
xor eax, eax
lea edx, [edx + ecx + 0x4efc]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, dword [0x444cec]
not ecx
dec ecx
push ecx
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax]
mov eax, dword [0x477904]
add edx, esi
push ecx
push edx
push eax
call ebp
mov eax, dword [0x444cd4]
mov ecx, dword [eax + 0x7a8]
mov edx, dword [eax + 0x7a4]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.0042c470
lea ecx, [esp + 0x34]
lea edx, [esp + 0x58]
push ecx
push 0x43f570
push edx
call fcn.00436e62
lea edi, [esp + 0x64]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0
lea eax, [ecx + ecx*2]
mov ecx, dword [0x444cec]
shl eax, 1
mov edi, dword [ecx + 0x60]
mov edx, eax
mov eax, dword [ecx + 0x68]
sub eax, edi
sub eax, edx
cdq
sub eax, edx
mov esi, eax
mov eax, dword [0x477904]
push eax
sar esi, 1
call ebx
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x50]
push ecx
mov eax, dword [0x444cec]
mov edx, dword [eax + 0x64]
mov eax, dword [eax + 0x60]
inc edx
push edx
mov edx, dword [0x477904]
lea ecx, [eax + esi + 1]
push ecx
push edx
call ebp
mov eax, dword [0x477904]
push 0xffffff
push eax
call ebx
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x444cec]
not ecx
mov edx, dword [eax + 0x64]
mov eax, dword [eax + 0x60]
dec ecx
add eax, esi
push ecx
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [0x477904]
push edx
push eax
push ecx
call ebp
mov ebx, dword [0x444ce8]
mov edx, dword [esp + 0x10]
cmp word [edx + ebx + 0x4d64], 0
je 0x409ecc
mov eax, dword [0x444cd4]
add eax, 0x7a4
mov ecx, dword [eax]
mov edx, dword [eax + 4]
or ecx, edx
jne 0x409ecc
mov eax, dword [0x444cec]
push 0x1f
mov ecx, 0x44a660
mov esi, dword [eax + 0xc4]
mov edi, dword [eax + 0xc0]
add esi, 0x24
add edi, 0xc8
push esi
push edi
call fcn.00432600
push 0x1f
push esi
push edi
mov ecx, 0x44a660
call fcn.00432650
mov ebx, dword [0x444ce8]
mov edx, dword [0x444d00]
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, 1
mov eax, dword [edx]
cmp eax, ecx
jne 0x40a099
mov dx, word [edx + 0x11c]
cmp dx, word [esp + 0x48]
jne 0x409fb1
mov eax, dword [ebx + 0x5c3a]
test eax, eax
jne 0x409f17
mov dword [ebx + 0x5c3a], ecx
call esi
mov ecx, dword [0x444ce8]
mov dword [ecx + 0x5c3e], eax
call esi
mov eax, dword [0x444cec]
push 0x71
mov ecx, 0x44a660
mov esi, dword [eax + 0x154]
mov edi, dword [eax + 0x150]
add esi, 0x4f
push esi
push edi
call fcn.00432600
push 0x71
push esi
push edi
mov ecx, 0x44a660
call fcn.004328f0
mov eax, dword [0x444cec]
push 0x71
mov ecx, 0x44a660
mov esi, dword [eax + 0x154]
mov edi, dword [eax + 0x150]
add esi, 0x4f
push esi
push edi
call fcn.00432600
push 0x71
push esi
push edi
mov ecx, 0x44a660
call fcn.004328f0
mov eax, dword [0x444cec]
push 0x70
mov ecx, 0x44a660
mov esi, dword [eax + 0x154]
mov edi, dword [eax + 0x150]
add esi, 0x4f
push esi
push edi
call fcn.00432600
push 5
push 0x70
push esi
push edi
mov ecx, 0x44a660
call fcn.00433860
mov ebx, dword [0x444ce8]
mov edi, dword [esp + 0x20]
mov dword [esp + 0x1c], 0
mov ebp, 0x150
lea esi, [edi + edi*4]
shl esi, 4
sub esi, edi
shl esi, 3
mov ax, word [esi + ebx + 0x4d16]
cmp ax, word [esp + 0x48]
je 0x40a883
cmp ax, 0xffff
je 0x40a883
mov ax, word [esi + ebx + 0x4d64]
cmp ax, 1
jne 0x40a344
mov eax, dword [ebx + 0x5c32]
xor edi, edi
cmp eax, edi
je 0x40a186
cmp word [esi + ebx + 0x4f22], di
jbe 0x40a6e6
mov dword [esp + 0x10], ebp
mov edx, dword [ebx + 0x5c46]
lea eax, [esi + ebx]
push edx
mov cl, byte [eax + edi + 0x4f24]
push ecx
call fcn.004249c0
mov edx, dword [esp + 0x18]
mov ebx, eax
mov eax, dword [0x444cec]
add esp, 8
mov ecx, dword [edx + eax + 4]
mov eax, dword [edx + eax]
push ebx
mov dword [esp + 0x18], ecx
push ecx
push eax
mov ecx, 0x4465f0
mov dword [esp + 0x24], eax
call fcn.00432600
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push ebx
push edx
push eax
mov ecx, 0x4465f0
call fcn.00432650
mov ecx, dword [esp + 0x10]
mov ebx, dword [0x444ce8]
add ecx, 0x10
inc edi
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov cx, word [esi + ebx + 0x4f22]
cmp edi, ecx
jl 0x40a01e
jmp 0x40a6e6
cmp eax, 2
jne 0x409fb1
cmp dword [edx + 0x142], 2
jne 0x409fb1
mov edi, dword [esp + 0x20]
lea edx, [edi + edi*4]
shl edx, 4
sub edx, edi
cmp word [ebx + edx*8 + 0x4d6c], cx
jne 0x409fb5
mov eax, dword [ebx + 0x5c3a]
test eax, eax
jne 0x40a0e7
mov dword [ebx + 0x5c3a], ecx
call esi
mov ecx, dword [0x444ce8]
mov dword [ecx + 0x5c3e], eax
call esi
mov eax, dword [0x444cec]
push 0x71
mov ecx, 0x44a660
mov esi, dword [eax + 0x154]
mov ebx, dword [eax + 0x150]
add esi, 0x4f
push esi
push ebx
call fcn.00432600
push 0x71
push esi
push ebx
mov ecx, 0x44a660
call fcn.004328f0
mov eax, dword [0x444cec]
push 0x71
mov ecx, 0x44a660
mov esi, dword [eax + 0x154]
mov ebx, dword [eax + 0x150]
add esi, 0x4f
push esi
push ebx
call fcn.00432600
push 0x71
push esi
push ebx
mov ecx, 0x44a660
call fcn.004328f0
mov eax, dword [0x444cec]
push 0x70
mov ecx, 0x44a660
mov esi, dword [eax + 0x154]
mov ebx, dword [eax + 0x150]
add esi, 0x4f
push esi
push ebx
call fcn.00432600
push 5
push 0x70
push esi
push ebx
mov ecx, 0x44a660
call fcn.00433860
mov ebx, dword [0x444ce8]
jmp 0x409fb5
mov edx, dword [0x444d00]
cmp dword [edx], 2
jne 0x40a2b7
cmp word [esi + ebx + 0x4d68], 0xff00
jne 0x40a232
cmp word [esi + ebx + 0x4f22], di
jbe 0x40a6e6
mov dword [esp + 0x10], ebp
mov eax, dword [ebx + 0x5c46]
lea ecx, [esi + ebx]
push eax
mov dl, byte [ecx + edi + 0x4f24]
push edx
call fcn.004249c0
mov edx, dword [esp + 0x18]
mov ebx, eax
mov eax, dword [0x444cec]
add esp, 8
mov ecx, dword [edx + eax + 4]
mov eax, dword [edx + eax]
push ebx
mov dword [esp + 0x18], ecx
push ecx
push eax
mov ecx, 0x4465f0
mov dword [esp + 0x24], eax
call fcn.00432600
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ebx
push eax
push ecx
mov ecx, 0x4465f0
call fcn.00432650
mov ebx, dword [0x444ce8]
mov ecx, dword [esp + 0x10]
xor edx, edx
inc edi
mov dx, word [esi + ebx + 0x4f22]
add ecx, 0x10
cmp edi, edx
mov dword [esp + 0x10], ecx
jl 0x40a1b7
jmp 0x40a6e6
cmp word [esi + ebx + 0x4f22], di
mov dword [esp + 0x18], edi
jbe 0x40a6e6
mov edi, ebp
mov eax, dword [ebx + 0x5c46]
push eax
push 0xff
call fcn.004249c0
mov ebx, eax
mov eax, dword [0x444cec]
add esp, 8
mov ecx, dword [edi + eax + 4]
mov eax, dword [edi + eax]
push ebx
mov dword [esp + 0x18], ecx
push ecx
push eax
mov ecx, 0x4465f0
mov dword [esp + 0x1c], eax
call fcn.00432600
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ebx
push ecx
push edx
mov ecx, 0x4465f0
call fcn.00432650
mov ebx, dword [0x444ce8]
mov eax, dword [esp + 0x18]
xor ecx, ecx
inc eax
mov cx, word [esi + ebx + 0x4f22]
add edi, 0x10
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x40a246
jmp 0x40a6e6
cmp word [esi + ebx + 0x4f22], di
jbe 0x40a6e6
mov dword [esp + 0x10], ebp
mov edx, dword [ebx + 0x5c46]
lea eax, [esi + ebx]
push edx
mov cl, byte [eax + edi + 0x4f24]
push ecx
call fcn.004249c0
mov edx, dword [esp + 0x18]
mov ebx, eax
mov eax, dword [0x444cec]
add esp, 8
mov ecx, dword [edx + eax + 4]
mov eax, dword [edx + eax]
push ebx
mov dword [esp + 0x18], ecx
push ecx
push eax
mov ecx, 0x4465f0
mov dword [esp + 0x24], eax
call fcn.00432600
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push ebx
push edx
push eax
mov ecx, 0x4465f0
call fcn.00432650
mov ecx, dword [esp + 0x10]
mov ebx, dword [0x444ce8]
add ecx, 0x10
inc edi
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov cx, word [esi + ebx + 0x4f22]
cmp edi, ecx
jl 0x40a2c9
jmp 0x40a6e6
cmp ax, 2
jne 0x40a6e6
cmp word [esi + ebx + 0x4f22], 0
mov dword [esp + 0x18], 0
jbe 0x40a457
mov edi, ebp
mov edx, dword [0x447d28]
mov eax, dword [0x444cec]
mov ecx, dword [edi + eax + 4]
mov eax, dword [edi + eax]
lea ebx, [edx + 0x34]
mov dword [esp + 0x14], ecx
push ebx
push ecx
push eax
mov ecx, 0x4465f0
mov dword [esp + 0x1c], eax
call fcn.00432600
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ebx
push eax
push ecx
mov ecx, 0x4465f0
call fcn.00432650
mov ecx, dword [0x444d00]
mov eax, 1
cmp dword [ecx], eax
jne 0x40a433
mov ebx, dword [esp + 0x20]
xor edx, edx
mov dx, word [ecx + 0x11c]
cmp edx, ebx
jne 0x40a433
cmp word [ecx + 0xa9e], ax
jne 0x40a433
cmp word [ecx + 0xaa0], ax
jne 0x40a433
mov eax, dword [0x444ce8]
mov ecx, dword [eax + 0x5c46]
lea edx, [esi + eax]
mov eax, dword [esp + 0x18]
push ecx
mov cl, byte [edx + eax + 0x4f24]
push ecx
call fcn.004249c0
mov ebx, eax
mov eax, dword [0x444cec]
add esp, 8
mov ecx, dword [edi + eax + 4]
mov eax, dword [edi + eax]
push ebx
mov dword [esp + 0x18], ecx
push ecx
push eax
mov ecx, 0x4465f0
mov dword [esp + 0x1c], eax
call fcn.00432600
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push ebx
push edx
push eax
mov ecx, 0x4465f0
call fcn.00432650
mov ebx, dword [0x444ce8]
mov eax, dword [esp + 0x18]
xor ecx, ecx
inc eax
mov cx, word [esi + ebx + 0x4f22]
add edi, 0x10
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x40a367
cmp dword [ebx + 0x5c2e], 1
jne 0x40a6e6
mov eax, dword [0x444d00]
cmp dword [eax], 1
jne 0x40a483
xor edx, edx
mov dx, word [eax + 0x11c]
mov eax, dword [esp + 0x20]
cmp edx, eax
je 0x40a6e6
mov eax, dword [0x444cec]
push 0x1e
mov ecx, 0x44a550
cmp ebp, 0x230
mov edi, dword [eax + ebp + 4]
mov ebx, dword [eax + ebp]
push edi
push ebx
call fcn.00432600
push 0x1e
push edi
push ebx
mov ecx, 0x44a550
call fcn.004328f0
mov eax, dword [0x444cec]
push 0x27
mov ecx, 0x44a550
mov edi, dword [eax + ebp + 4]
mov ebx, dword [eax + ebp]
add edi, 0x38
add ebx, 0x46
push edi
push ebx
call fcn.00432600
push 0x27
push edi
push ebx
mov ecx, 0x44a550
call fcn.004328f0
mov eax, dword [0x444cec]
push 0x27
mov ecx, 0x44a550
mov edi, dword [eax + ebp + 4]
mov ebx, dword [eax + ebp]
add edi, 0x38
add ebx, 0x46
push edi
push ebx
call fcn.00432600
push 0x27
push edi
push ebx
mov ecx, 0x44a550
call fcn.004328f0
mov eax, dword [0x448944]
push eax
call fcn.00435460
mov ecx, dword [0x444ce8]
xor eax, eax
add esp, 4
mov edx, dword [0x444cec]
lea edi, [esi + ecx + 0x4efc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ebx, dword [esp + 0x1c]
push 0
not ecx
mov eax, dword [ebx + edx + 8]
dec ecx
shl ecx, 3
sub eax, ecx
mov ecx, dword [ebx + edx]
sub eax, ecx
cdq
sub eax, edx
mov edx, dword [0x477904]
sar eax, 1
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [0x444ce8]
or ecx, 0xffffffff
lea edx, [esi + eax + 0x4efc]
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, dword [0x444cec]
not ecx
dec ecx
push ecx
push edx
mov ecx, dword [ebx + eax + 4]
mov edx, dword [ebx + eax]
mov eax, dword [esp + 0x18]
inc ecx
push ecx
lea ecx, [edx + eax + 1]
mov edx, dword [0x477904]
push ecx
push edx
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [0x477904]
push 0xffffff
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [0x444ce8]
xor eax, eax
lea edx, [esi + ecx + 0x4efc]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, dword [0x444cec]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [ebx + eax + 4]
mov eax, dword [ebx + eax]
push edx
add eax, ecx
mov ecx, dword [0x477904]
push eax
push ecx
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [0x444ce8]
lea ecx, [esp + 0x28]
mov edx, dword [esi + eax + 0x4d48]
mov eax, dword [esi + eax + 0x4d44]
push edx
push eax
push ecx
call fcn.0042c470
lea edx, [esp + 0x34]
lea eax, [esp + 0x58]
push edx
push 0x43f570
push eax
call fcn.00436e62
lea edi, [esp + 0x64]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0
lea ecx, [ecx + ecx*2]
shl ecx, 1
mov edx, ecx
mov ecx, dword [0x444cec]
mov eax, dword [ebx + ecx + 0x68]
mov edi, dword [ebx + ecx + 0x60]
sub eax, edi
sub eax, edx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [0x477904]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x444cec]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x50]
push ecx
mov edx, dword [ebx + eax + 0x64]
mov eax, dword [ebx + eax + 0x60]
mov ecx, dword [esp + 0x18]
inc edx
push edx
lea edx, [eax + ecx + 1]
mov eax, dword [0x477904]
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov ecx, dword [0x477904]
push 0xffffff
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4c]
repne scasb al, byte es:[edi]
mov eax, dword [0x444cec]
not ecx
dec ecx
push ecx
mov ecx, dword [ebx + eax + 0x64]
push edx
mov edx, dword [ebx + eax + 0x60]
mov ebx, dword [esp + 0x18]
mov eax, dword [0x477904]
add edx, ebx
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov ebx, dword [0x444ce8]
cmp word [esi + ebx + 0x4d64], 0
je 0x40a75f
mov ecx, dword [esi + ebx + 0x4d44]
mov eax, dword [esi + ebx + 0x4d48]
or ecx, eax
jne 0x40a75f
mov eax, dword [0x444cec]
mov ecx, dword [esp + 0x1c]
cmp ebp, 0x230
mov edi, dword [ecx + eax + 0xc4]
jg 0x40a72d
mov ebx, dword [ecx + eax + 0xc0]
add edi, 0x2a
add ebx, 0xc8
jmp 0x40a73d
mov ebx, dword [ecx + eax + 0xc0]
add edi, 0x2a
sub ebx, 0xfa
push 0x1f
push edi
push ebx
mov ecx, 0x44a660
call fcn.00432600
push 0x1f
push edi
push ebx
mov ecx, 0x44a660
call fcn.00432650
mov ebx, dword [0x444ce8]
mov ecx, dword [0x444d00]
mov eax, dword [ecx]
cmp eax, 1
jne 0x40a7a9
mov eax, dword [esp + 0x20]
xor edx, edx
mov dx, word [ecx + 0x11c]
cmp edx, eax
jne 0x40a883
mov eax, dword [ebx + 0x5c3a]
test eax, eax
jne 0x40a7f4
mov dword [ebx + 0x5c3a], 1
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [0x444ce8]
mov dword [ecx + 0x5c3e], eax
jmp 0x40a7f4
cmp eax, 2
jne 0x40a883
cmp dword [ecx + 0x142], 2
jne 0x40a883
cmp word [esi + ebx + 0x4d6c], 1
jne 0x40a883
mov eax, dword [ebx + 0x5c3a]
test eax, eax
jne 0x40a7f4
mov dword [ebx + 0x5c3a], 1
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [0x444ce8]
mov dword [edx + 0x5c3e], eax
call dword [sym.imp.WINMM.dll_timeGetTime]
mov eax, dword [0x444cec]
push 0x71
mov ecx, 0x44a660
mov esi, dword [eax + ebp + 4]
mov edi, dword [eax + ebp]
add esi, 0x4f
push esi
push edi
call fcn.00432600
push 0x71
push esi
push edi
mov ecx, 0x44a660
call fcn.004328f0
mov eax, dword [0x444cec]
push 0x71
mov ecx, 0x44a660
mov esi, dword [eax + ebp + 4]
mov edi, dword [eax + ebp]
add esi, 0x4f
push esi
push edi
call fcn.00432600
push 0x71
push esi
push edi
mov ecx, 0x44a660
call fcn.004328f0
mov eax, dword [0x444cec]
push 0x70
mov ecx, 0x44a660
mov esi, dword [eax + ebp + 4]
mov edi, dword [eax + ebp]
add esi, 0x4f
push esi
push edi
call fcn.00432600
push 6
push 0x70
push esi
push edi
mov ecx, 0x44a660
call fcn.00433860
mov ebx, dword [0x444ce8]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
add edx, 0x10
add ebp, 0x70
inc eax
mov dword [esp + 0x1c], edx
cdq
mov ecx, 5
idiv ecx
cmp ebp, 0x380
mov edi, edx
mov dword [esp + 0x20], edi
jl 0x409fc2
mov edx, dword [esp + 0x24]
cmp word [ebx + 0x5be8], 2
mov dword [esp + 0x20], edx
jne 0x40a8c8
xor edx, edx
mov dword [esp + 0x20], edx
xor ebp, ebp
lea esi, [edx + edx*4]
shl esi, 4
sub esi, edx
shl esi, 3
mov dword [esp + 0x14], esi
cmp word [esi + ebx + 0x4d16], 0xffff
jne 0x40a8f4
cmp word [esi + ebx + 0x4d64], 3
jne case.default.0x40ae86
mov edx, dword [0x444d00]
cmp dword [edx], 0
jne 0x40a958
cmp word [esi + ebx + 0x4d64], 2
jne 0x40a958
cmp word [esi + ebx + 0x4d68], 0xff00
je 0x40a958
mov edi, 0x43f630
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xffffff
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x477904]
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ebx, dword [0x444ce8]
mov esi, dword [esp + 0x14]
cmp word [esi + ebx + 0x4d68], 0xffff
je case.default.0x40ae86
mov edx, dword [0x477904]
push 0xf0f0f0
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ebx, dword [0x444ce8]
xor eax, eax
mov ax, word [esi + ebx + 0x4d68]
cmp eax, 0xff00
jg 0x40ae7c
je 0x40ac18
cmp eax, 7
ja case.default.0x40ae86
jmp dword [eax*4 + 0x40af10]
cmp word [esi + ebx + 0x4d6a], 1
lea edx, [esp + 0x4c]
jne 0x40a9e1
mov edi, 0x43f628
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp case.default.0x40ae86
mov edi, 0x43f620
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp case.default.0x40ae86
mov ecx, dword [esi + ebx + 0x4f16]
mov edx, dword [esi + ebx + 0x4f12]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.0042c470
lea ecx, [esp + 0x34]
lea edx, [esp + 0x58]
push ecx
push 0x43f5a0
push edx
call fcn.00436e62
add esp, 0x18
jmp 0x40aedd
mov eax, dword [esi + ebx + 0x4f1e]
mov ecx, dword [esi + ebx + 0x4f1a]
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.0042c470
lea eax, [esp + 0x34]
push eax
push 0x43f598
jmp 0x40ab80
mov edx, dword [esi + ebx + 0x4f16]
mov eax, dword [esi + ebx + 0x4f12]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.0042c470
lea edx, [esp + 0x34]
lea eax, [esp + 0x58]
push edx
push 0x43f614
push eax
call fcn.00436e62
mov eax, dword [0x444ce8]
mov ecx, dword [esi + eax + 0x4f1e]
mov edx, dword [esi + eax + 0x4f1a]
push ecx
lea eax, [esp + 0x44]
push edx
push eax
call fcn.0042c470
lea ecx, [esp + 0x4c]
lea edx, [esp + 0x70]
push ecx
push 0x43f570
push edx
call fcn.00436e62
add esp, 0x30
jmp 0x40aedd
mov eax, dword [esi + ebx + 0x4f12]
mov ecx, dword [esi + ebx + 0x4f16]
mov edx, eax
or edx, ecx
jne 0x40ab92
mov eax, dword [esi + ebx + 0x4f1e]
mov ecx, dword [esi + ebx + 0x4f1a]
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.0042c470
lea eax, [esp + 0x34]
push eax
push 0x43f60c
jmp 0x40ab80
mov eax, dword [esi + ebx + 0x4f12]
mov ecx, dword [esi + ebx + 0x4f16]
mov edx, eax
or edx, ecx
jne 0x40ab92
mov eax, dword [esi + ebx + 0x4f1e]
mov ecx, dword [esi + ebx + 0x4f1a]
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.0042c470
lea eax, [esp + 0x34]
push eax
push 0x43f600
jmp 0x40ab80
mov eax, dword [esi + ebx + 0x4f12]
mov ecx, dword [esi + ebx + 0x4f16]
mov edx, eax
or edx, ecx
jne 0x40ab92
mov eax, dword [esi + ebx + 0x4f1e]
mov ecx, dword [esi + ebx + 0x4f1a]
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.0042c470
lea eax, [esp + 0x34]
push eax
push 0x43f5f4
lea ecx, [esp + 0x60]
push ecx
call fcn.00436e62
add esp, 0x18
jmp 0x40aedd
push ecx
lea edx, [esp + 0x2c]
push eax
push edx
call fcn.0042c470
lea eax, [esp + 0x34]
lea ecx, [esp + 0x58]
push eax
push 0x43f614
push ecx
call fcn.00436e62
mov eax, dword [0x444ce8]
lea ecx, [esp + 0x40]
mov edx, dword [esi + eax + 0x4f1e]
mov eax, dword [esi + eax + 0x4f1a]
push edx
push eax
push ecx
call fcn.0042c470
lea edx, [esp + 0x4c]
lea eax, [esp + 0x70]
push edx
push 0x43f570
push eax
call fcn.00436e62
add esp, 0x30
jmp 0x40aedd
mov edi, 0x43f630
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp case.default.0x40ae86
mov ecx, dword [0x448068]
push ecx
call fcn.00435460
mov edx, dword [0x444d00]
add esp, 4
mov eax, dword [edx + 0x142]
cmp eax, 2
mov eax, dword [0x444cec]
mov edi, dword [eax + ebp + 0x15c]
jne 0x40ad70
mov ebx, dword [eax + ebp + 0x150]
sub edi, 0x1e
push 0x72
push edi
push ebx
mov ecx, 0x44a660
call fcn.00432600
push 0x72
push edi
push ebx
mov ecx, 0x44a660
call fcn.004328f0
mov eax, dword [0x444cec]
push 0x72
mov ecx, 0x44a660
mov edi, dword [eax + ebp + 0x15c]
mov ebx, dword [eax + ebp + 0x150]
sub edi, 0x1e
push edi
push ebx
call fcn.00432600
push 0x72
push edi
push ebx
mov ecx, 0x44a660
call fcn.004328f0
mov eax, dword [0x477904]
push 0
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [0x444ce8]
xor eax, eax
mov ebx, dword [sym.imp.GDI32.dll_TextOutA]
lea edx, [esi + ecx + 0x4dee]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, dword [0x444cec]
not ecx
dec ecx
push ecx
mov ecx, dword [0x477904]
push edx
mov edx, dword [eax + ebp + 0x15c]
mov eax, dword [eax + ebp + 0x150]
sub edx, 0x15
add eax, 0x1f
push edx
push eax
push ecx
call ebx
mov edx, dword [0x444ce8]
push 0xffff
cmp word [esi + edx + 0x4d6c], 0
je 0x40ad11
mov eax, dword [0x477904]
push eax
jmp 0x40ad18
mov ecx, dword [0x477904]
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [0x444ce8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esi + edx + 0x4dee]
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, dword [0x444cec]
not ecx
dec ecx
push ecx
mov ecx, dword [eax + ebp + 0x15c]
push edx
mov edx, dword [eax + ebp + 0x150]
mov eax, dword [0x477904]
sub ecx, 0x16
add edx, 0x1e
push ecx
push edx
push eax
call ebx
mov ecx, dword [0x4456f4]
push ecx
call fcn.00435460
add esp, 4
jmp 0x40aedd
mov ebx, dword [eax + ebp + 0x150]
sub edi, 0x1e
push 0x72
push edi
push ebx
mov ecx, 0x44a660
call fcn.00432600
push 0x72
push edi
push ebx
mov ecx, 0x44a660
call fcn.004328f0
mov eax, dword [0x444cec]
push 0x72
mov ecx, 0x44a660
mov edi, dword [eax + ebp + 0x15c]
mov ebx, dword [eax + ebp + 0x150]
sub edi, 0x1e
push edi
push ebx
call fcn.00432600
push 0x72
push edi
push ebx
mov ecx, 0x44a660
call fcn.004328f0
mov ecx, dword [0x477904]
mov ebx, dword [sym.imp.GDI32.dll_SetTextColor]
push 0
push ecx
call ebx
mov edx, dword [0x444ce8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esi + edx + 0x4d6e]
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, dword [0x444cec]
not ecx
dec ecx
push ecx
mov ecx, dword [eax + ebp + 0x15c]
push edx
mov edx, dword [eax + ebp + 0x150]
mov eax, dword [0x477904]
sub ecx, 0x15
add edx, 0x1f
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov ecx, dword [0x477904]
push 0xffff
push ecx
call ebx
mov edx, dword [0x444ce8]
or ecx, 0xffffffff
xor eax, eax
lea esi, [esi + edx + 0x4d6e]
mov edi, esi
repne scasb al, byte es:[edi]
mov eax, dword [0x444cec]
not ecx
mov edx, dword [eax + ebp + 0x150]
dec ecx
push ecx
mov ecx, dword [eax + ebp + 0x15c]
mov eax, dword [0x477904]
sub ecx, 0x16
push esi
add edx, 0x1e
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov ecx, dword [0x4456f4]
push ecx
call fcn.00435460
add esp, 4
jmp 0x40aedd
add eax, 0xffff00ff
cmp eax, 6
ja case.default.0x40ae86
jmp dword [eax*4 + 0x40af30]
push 0x43f5e4
jmp 0x40aed0
lea eax, [esp + 0x4c]
push 0x43f5d0
push eax
jmp 0x40aed5
lea ecx, [esp + 0x4c]
push str.1_Cut
push ecx
jmp 0x40aed5
push str.2_Cut
jmp 0x40aed0
lea eax, [esp + 0x4c]
push str.3_Cut
push eax
jmp 0x40aed5
lea ecx, [esp + 0x4c]
push str.4_Cut
push ecx
jmp 0x40aed5
push str.Pass
lea edx, [esp + 0x50]
push edx
call fcn.00436e62
add esp, 8
mov ebx, dword [0x444ce8]
mov eax, dword [esp + 0x20]
add ebp, 0x70
inc eax
mov ecx, 5
cdq
idiv ecx
cmp ebp, 0x230
mov dword [esp + 0x20], edx
jl 0x40a8ca
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xbc
ret