Function at 0x4ce370
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff14
push esi
xor ecx, ecx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cf014
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00484c2c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x4ce3d9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov edx, dword [ebp - 8]
mov si, 0xfff6
call fcn.00403b30
call fcn.00406bb0
mov edx, dword [ebp - 4]
sub eax, dword [edx + 4]
cmp eax, 0x3e8
jbe 0x4ce40a
call fcn.00406bb0
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
inc dword [eax + 8]
mov eax, dword [0x52b860]
cmp dword [eax], 0
je 0x4cefe9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov edx, dword [0x52b734]
cmp eax, dword [edx]
jne 0x4cefe9
mov eax, dword [0x52b84c]
cmp byte [eax + 0xaf], 1
jne 0x4ce64d
mov eax, dword [0x52b734]
mov eax, dword [eax]
mov eax, dword [eax + 0x62588]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4ce64d
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], 0
mov eax, dword [0x52b734]
mov eax, dword [eax]
mov eax, dword [eax + 0x62588]
mov edx, dword [ebp - 0x14]
call fcn.00418734
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0x2c], 0
jne 0x4ce641
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0xe], 0x32
je 0x4ce641
mov eax, dword [0x52b860]
mov eax, dword [eax]
mov eax, dword [eax + 0x11c]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0x11c]
cdq
xor eax, edx
sub eax, edx
cmp eax, 9
jge 0x4ce641
mov eax, dword [0x52ba54]
mov eax, dword [eax]
mov eax, dword [eax + 0x33c]
mov edx, 0x103
call fcn.0048af20
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0x1e], 0
jbe 0x4ce4f2
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xb8]
sub eax, 0x25
mov dword [ebp - 0x18], eax
jmp 0x4ce501
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xb8]
sub eax, 0xa
mov dword [ebp - 0x18], eax
mov eax, dword [0x52bae4]
cmp byte [eax], 0
je 0x4ce54f
mov eax, dword [0x52baf4]
cmp byte [eax], 0
je 0x4ce533
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0xb4], 0x220
jle 0x4ce54f
cmp dword [ebp - 0x18], 0x100
jl 0x4ce64d
jmp 0x4ce54f
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0xb4], 0x2a0
jle 0x4ce54f
cmp dword [ebp - 0x18], 0x80
jl 0x4ce64d
cmp dword [ebp - 0x34], 0
je 0x4ce595
lea edx, [ebp - 0xcc]
mov eax, dword [ebp - 0x34]
call fcn.00484cb8
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [ebp - 0x34]
push eax
push 1
mov eax, dword [ebp - 0x34]
call fcn.00484f18
sar eax, 1
jns 0x4ce57f
adc eax, 0
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0xb4]
sub edx, eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.004846b0
mov eax, dword [0x52ba54]
mov eax, dword [eax]
mov eax, dword [eax + 0x33c]
mov edx, 0x104
call fcn.0048af20
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4ce641
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0x34]
call fcn.00484cb8
mov eax, dword [ebp - 0x28]
cmp word [eax + 0x66], 0
jbe 0x4ce612
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x58]
mov dword [ebp - 0xd0], eax
fild dword [ebp - 0xd0]
mov eax, dword [ebp - 0x28]
movzx eax, word [eax + 0x66]
mov dword [ebp - 0xd4], eax
fild dword [ebp - 0xd4]
fdivp st(1)
mov eax, dword [ebp - 0x28]
movzx eax, word [eax + 0x62]
mov dword [ebp - 0xd8], eax
fild dword [ebp - 0xd8]
fmulp st(1)
call fcn.00402bf8
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x34]
push eax
push 1
mov eax, dword [ebp - 0x34]
call fcn.00484f18
sar eax, 1
jns 0x4ce62b
adc eax, 0
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0xb4]
sub edx, eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.004846b0
inc dword [ebp - 0x14]
dec dword [ebp - 0x44]
jne 0x4ce468
push 1
mov eax, dword [ebp - 8]
call fcn.00484c80
call fcn.00423148
push eax
call fcn.00406ee0
mov eax, dword [0x52b84c]
cmp byte [eax + 0xbe], 1
jne 0x4ce7ae
mov eax, dword [0x52b734]
mov eax, dword [eax]
mov eax, dword [eax + 0x62588]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4ce8a4
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [0x52b734]
mov eax, dword [eax]
mov eax, dword [eax + 0x62588]
mov edx, dword [ebp - 0x14]
call fcn.00418734
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4ce79d
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0x85], 0
je 0x4ce79d
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0x2c], 0
jne 0x4ce79d
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0xb4], 0
je 0x4ce79d
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0xb8], 0
je 0x4ce79d
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x3c]
call fcn.0040471c
mov eax, dword [0x52b84c]
cmp byte [eax + 0xc0], 1
jne 0x4ce723
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x3c], eax
jmp 0x4ce72c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x3c], eax
push ebp
mov eax, dword [ebp - 0x3c]
push eax
push 0
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0xb8]
add ecx, 0x1e
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0xb4]
mov eax, dword [ebp - 8]
call fcn.004ce280
pop ecx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x40]
call fcn.0040471c
push ebp
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x48]
push eax
push 0
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0xb8]
add ecx, 0x1e
mov eax, dword [ebp - 0x24]
shl eax, 2
lea eax, [eax + eax*2]
add ecx, eax
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0xb4]
mov eax, dword [ebp - 8]
call fcn.004ce280
pop ecx
inc dword [ebp - 0x14]
dec dword [ebp - 0x44]
jne 0x4ce698
jmp 0x4ce8a4
mov eax, dword [0x52b92c]
cmp dword [eax], 0
je 0x4ce8a4
mov edx, dword [0x52b92c]
mov edx, dword [edx]
mov eax, dword [0x52b734]
mov eax, dword [eax]
call fcn.004c6834
test al, al
je 0x4ce8a4
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
mov edx, dword [0x52b92c]
mov edx, dword [edx]
mov edx, dword [edx + 0x3c]
call fcn.0040471c
mov eax, dword [0x52b84c]
cmp byte [eax + 0xc0], 1
jne 0x4ce80d
mov eax, dword [0x52b92c]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x3c], eax
jmp 0x4ce81a
mov eax, dword [0x52b92c]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x3c], eax
push ebp
mov eax, dword [ebp - 0x3c]
push eax
push 0
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [0x52b92c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xb8]
add ecx, 0x1e
mov eax, dword [0x52b92c]
mov eax, dword [eax]
mov edx, dword [eax + 0xb4]
mov eax, dword [ebp - 8]
call fcn.004ce280
pop ecx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
mov edx, dword [0x52b92c]
mov edx, dword [edx]
mov edx, dword [edx + 0x40]
call fcn.0040471c
push ebp
mov eax, dword [0x52b92c]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
push eax
push 0
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [0x52b92c]
mov eax, dword [eax]
mov ecx, dword [eax + 0xb8]
add ecx, 0x1e
mov eax, dword [ebp - 0x24]
shl eax, 2
lea eax, [eax + eax*2]
add ecx, eax
mov eax, dword [0x52b92c]
mov eax, dword [eax]
mov edx, dword [eax + 0xb4]
mov eax, dword [ebp - 8]
call fcn.004ce280
pop ecx
mov eax, dword [0x52b8cc]
cmp byte [eax], 0
je 0x4ce95d
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
mov edx, dword [0x52b860]
mov edx, dword [edx]
mov edx, dword [edx + 0x3c]
call fcn.0040471c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x3c], eax
push ebp
mov eax, dword [ebp - 0x3c]
push eax
push 0
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [0x52b860]
mov eax, dword [eax]
mov ecx, dword [eax + 0xb8]
add ecx, 0x1e
mov eax, dword [0x52b860]
mov eax, dword [eax]
mov edx, dword [eax + 0xb4]
mov eax, dword [ebp - 8]
call fcn.004ce280
pop ecx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
mov edx, dword [0x52b860]
mov edx, dword [edx]
mov edx, dword [edx + 0x40]
call fcn.0040471c
push ebp
mov eax, dword [0x52b860]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
push eax
push 0
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [0x52b860]
mov eax, dword [eax]
mov ecx, dword [eax + 0xb8]
add ecx, 0x1e
mov eax, dword [ebp - 0x24]
shl eax, 2
lea eax, [eax + eax*2]
add ecx, eax
mov eax, dword [0x52b860]
mov eax, dword [eax]
mov edx, dword [eax + 0xb4]
mov eax, dword [ebp - 8]
call fcn.004ce280
pop ecx
mov eax, dword [0x52b734]
mov eax, dword [eax]
mov eax, dword [eax + 0x62588]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4ced9b
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], 0
mov eax, dword [0x52b734]
mov eax, dword [eax]
mov eax, dword [eax + 0x62588]
mov edx, dword [ebp - 0x14]
call fcn.00418734
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0x1e], 0
jbe 0x4ce9ab
mov dword [ebp - 0x18], 0xffffffe8
jmp 0x4ce9b0
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
cmp word [eax + 0x62], 0
jbe 0x4ceb92
mov eax, dword [0x52b860]
mov eax, dword [eax]
mov eax, dword [eax + 0x11c]
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0x11c]
cdq
xor eax, edx
sub eax, edx
cmp eax, 9
jge 0x4ceb92
mov eax, dword [0x52b84c]
cmp byte [eax + 0xaf], 1
jne 0x4ceb92
mov eax, dword [0x52b84c]
cmp byte [eax + 0xb0], 1
jne 0x4ceb92
push 1
mov eax, dword [ebp - 8]
call fcn.00484c80
call fcn.00423148
push eax
call fcn.00406ee0
mov eax, dword [0x52b84c]
cmp byte [eax + 0xb7], 1
jne 0x4cea88
mov eax, dword [0x52b860]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x28]
je 0x4cea88
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0xe], 0
jne 0x4cea88
lea edx, [ebp - 0xdc]
mov eax, dword [ebp - 0x28]
movzx eax, word [eax + 0x62]
call fcn.00408d74
push dword [ebp - 0xdc]
push 0x4cf028
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x28]
movzx eax, word [eax + 0x66]
call fcn.00408d74
push dword [ebp - 0xe0]
mov eax, dword [ebp - 0x28]
push dword [eax + 0x44]
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00404a04
jmp 0x4ceaca
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 0x28]
movzx eax, word [eax + 0x62]
call fcn.00408d74
push dword [ebp - 0xe4]
push 0x4cf028
lea edx, [ebp - 0xe8]
mov eax, dword [ebp - 0x28]
movzx eax, word [eax + 0x66]
call fcn.00408d74
push dword [ebp - 0xe8]
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00404a04
mov eax, dword [0x52bae4]
cmp byte [eax], 0
je 0x4ceb32
mov eax, dword [0x52baf4]
cmp byte [eax], 0
je 0x4ceb09
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0xb4], 0x220
jle 0x4ceb32
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xb8]
sub eax, 0x19
add eax, dword [ebp - 0x18]
cmp eax, 0x100
jl 0x4ced9b
jmp 0x4ceb32
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0xb4], 0x2a0
jle 0x4ceb32
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xb8]
sub eax, 0x19
add eax, dword [ebp - 0x18]
cmp eax, 0x80
jl 0x4ced9b
mov eax, dword [ebp - 8]
call fcn.00484c80
mov eax, dword [eax + 0xc]
mov edx, dword [0x52b84c]
mov edx, dword [edx + 0xf68]
call fcn.0042217c
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 8]
call fcn.00484c80
mov edx, dword [ebp - 0x2c]
call fcn.00422fa8
sar eax, 1
jns 0x4ceb69
adc eax, 0
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0xb4]
sub edx, eax
push edx
mov eax, dword [ebp - 8]
call fcn.00484c80
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 0xb8]
sub ecx, 0x19
add ecx, dword [ebp - 0x18]
pop edx
call fcn.00422ed8
mov eax, dword [ebp - 8]
call fcn.00484c80
mov eax, dword [eax + 0xc]
mov edx, 0xffffff
call fcn.0042217c
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x88], 0
je 0x4ced8f
call fcn.00406bb0
mov edx, dword [ebp - 0x28]
sub eax, dword [edx + 0xb0]
cmp eax, 0xfa0
jae 0x4ced82
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xbc]
dec eax
test eax, eax
jl 0x4ced8f
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0xc], 0
mov eax, dword [0x52bae4]
cmp byte [eax], 0
je 0x4cecb1
mov eax, dword [0x52baf4]
cmp byte [eax], 0
je 0x4cec5e
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + eax*4 + 0x9c]
sar eax, 1
jns 0x4cec19
adc eax, 0
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0xb4]
sub edx, eax
cmp edx, 0x220
jle 0x4cecb1
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xbc]
shl eax, 4
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0xb8]
sub edx, eax
imul eax, dword [ebp - 0xc], 0xe
add edx, eax
add edx, dword [ebp - 0x18]
cmp edx, 0x100
jl 0x4ced8f
jmp 0x4cecb1
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + eax*4 + 0x9c]
sar eax, 1
jns 0x4cec72
adc eax, 0
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0xb4]
sub edx, eax
cmp edx, 0x2a0
jle 0x4cecb1
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xbc]
shl eax, 4
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0xb8]
sub edx, eax
imul eax, dword [ebp - 0xc], 0xe
add edx, eax
add edx, dword [ebp - 0x18]
cmp edx, 0x80
jl 0x4ced8f
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0x2c], 0
je 0x4ced18
push 0x808080
push 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + eax*4 + 0x88]
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xbc]
shl eax, 4
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 0xb8]
sub ecx, eax
imul eax, dword [ebp - 0xc], 0xe
add ecx, eax
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + eax*4 + 0x9c]
sar eax, 1
jns 0x4ced03
adc eax, 0
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0xb4]
sub edx, eax
mov eax, dword [ebp - 8]
call fcn.0050bd74
jmp 0x4ced74
push 0xffffff
push 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + eax*4 + 0x88]
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xbc]
shl eax, 4
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 0xb8]
sub ecx, eax
imul eax, dword [ebp - 0xc], 0xe
add ecx, eax
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + eax*4 + 0x9c]
sar eax, 1
jns 0x4ced61
adc eax, 0
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0xb4]
sub edx, eax
mov eax, dword [ebp - 8]
call fcn.0050bd74
inc dword [ebp - 0xc]
dec dword [ebp - 0x48]
jne 0x4cebed
jmp 0x4ced8f
mov eax, dword [ebp - 0x28]
add eax, 0x88
call fcn.00404684
inc dword [ebp - 0x14]
dec dword [ebp - 0x44]
jne 0x4ce981
mov eax, dword [0x52b84c]
cmp byte [eax + 0x9f4], 1
jne 0x4cef37
mov eax, dword [0x52bd98]
mov eax, dword [eax]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4cef37
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xc], 0
mov eax, dword [0x52bd98]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
call fcn.00418734
mov dword [ebp - 0x38], eax
mov eax, dword [0x52b84c]
cmp byte [eax + 0x9f2], 1
jne 0x4cee49
mov eax, dword [0x52ba34]
mov eax, dword [eax]
call fcn.00405890
test eax, eax
jl 0x4cee49
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], 0
imul eax, dword [ebp - 0x10], 0x37
mov edx, dword [0x52ba34]
mov edx, dword [edx]
lea eax, [edx + eax]
mov edx, dword [ebp - 0x38]
add edx, 0xc
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403108
jne 0x4cee41
imul eax, dword [ebp - 0x10], 0x37
mov edx, dword [0x52ba34]
mov edx, dword [edx]
cmp byte [edx + eax + 0x33], 0
jne 0x4cee41
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x4cee49
inc dword [ebp - 0x10]
dec dword [ebp - 0x48]
jne 0x4cee06
mov eax, dword [0x52b84c]
mov eax, dword [eax + 0xf54]
mov dword [ebp - 0x40], eax
mov eax, dword [0x52b84c]
cmp byte [eax + 0x9f6], 1
jne 0x4ceed2
cmp dword [ebp - 0x38], 0
je 0x4ceed2
mov eax, dword [0x52ba34]
mov eax, dword [eax]
call fcn.00405890
test eax, eax
jl 0x4ceed2
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], 0
imul eax, dword [ebp - 0x10], 0x37
mov edx, dword [0x52ba34]
mov edx, dword [edx]
lea eax, [edx + eax]
mov edx, dword [ebp - 0x38]
add edx, 0xc
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00403108
jne 0x4ceeca
imul eax, dword [ebp - 0x10], 0x37
mov edx, dword [0x52ba34]
mov edx, dword [edx]
cmp byte [edx + eax + 0x34], 0
je 0x4ceeca
mov eax, dword [0x52b84c]
mov eax, dword [eax + 0xf50]
mov dword [ebp - 0x40], eax
jmp 0x4ceed2
inc dword [ebp - 0x10]
dec dword [ebp - 0x48]
jne 0x4cee86
cmp dword [ebp - 0x38], 0
je 0x4cef2b
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax + 2]
mov eax, dword [ebp - 0x38]
movzx edx, word [eax]
mov eax, dword [0x52b734]
mov eax, dword [eax]
call fcn.004c5db8
mov eax, dword [ebp - 0x40]
push eax
push 0
lea eax, [ebp - 0xec]
mov edx, dword [ebp - 0x38]
add edx, 0xc
call fcn.004048e8
mov eax, dword [ebp - 0xec]
push eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0xa
mov edx, dword [ebp - 0x1c]
sub edx, 0x14
mov eax, dword [ebp - 8]
call fcn.0050bd74
inc dword [ebp - 0xc]
dec dword [ebp - 0x44]
jne 0x4cedcb
mov eax, dword [0x52bbe4]
test byte [eax], 4
je 0x4cef59
push 0xffffff
push 0
push 0x4cf034
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0050bd74
mov eax, dword [ebp - 8]
call fcn.00484c80
call fcn.00483cec
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov eax, 1
shr eax, cl
mov edx, dword [0x52bbe4]
and eax, dword [edx]
je 0x4cefe0
mov edx, dword [ebp - 0xc]
add edx, 0x96
mov eax, dword [0x52ba54]
mov eax, dword [eax]
mov eax, dword [eax + 0x33c]
call fcn.0048af20
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4cefe0
mov eax, dword [ebp - 0x34]
call fcn.00484f18
add dword [ebp - 0x14], eax
lea edx, [ebp - 0xcc]
mov eax, dword [ebp - 0x34]
call fcn.00484cb8
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [ebp - 0x34]
push eax
push 1
mov edx, 0x320
sub edx, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.004846b0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x10
jne 0x4cef70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf01b
lea eax, [ebp - 0xec]
mov edx, 5
call fcn.004046a8
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004046a8
ret