Function at 0x4c7760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xaa
push 0
push 0
dec ecx
jne 0x4c7769
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x90]
lea edi, [ebp - 0x418]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3c], ecx
mov edi, edx
mov dword [ebp - 0x38], eax
xor eax, eax
push ebp
push 0x4ceb06
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xd4], 0xffffffff
mov eax, dword [ebp + 0x68]
mov eax, dword [eax]
sub dword [ebp - 0x40c], eax
push edi
lea esi, [ebp - 0x418]
lea edi, [ebp - 0x448]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebp + 0x44]
cmp dword [eax], 0
jl 0x4c7811
mov eax, dword [ebp + 0x8c]
mov eax, dword [eax]
add dword [ebp - 0x418], eax
mov eax, dword [ebp + 0x8c]
mov eax, dword [eax + 4]
add dword [ebp - 0x414], eax
mov eax, dword [ebp + 0x8c]
mov eax, dword [eax + 8]
sub dword [ebp - 0x410], eax
mov eax, dword [ebp + 0x8c]
mov eax, dword [eax + 0xc]
sub dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x44]
mov eax, dword [eax]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00405ec8
lea eax, [ebp - 0x30]
xor edx, edx
call fcn.00405f1c
xor eax, eax
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xcd], 0
mov eax, dword [ebp + 0x18]
movzx eax, byte [eax]
mov byte [ebp - 0xcf], al
mov eax, dword [ebp + 0x18]
mov byte [eax], 0
mov eax, dword [ebp + 0x7c]
xor edx, edx
mov dword [eax], edx
xor eax, eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x45c]
xor ecx, ecx
mov edx, 0x14
call fcn.0040368c
mov dword [ebp - 0x45c], 0x14
mov dword [ebp - 0x70], 0xffffffff
mov byte [ebp - 0x41], 0
mov byte [ebp - 0x42], 0
mov byte [ebp - 0xa9], 1
mov byte [ebp - 0xaa], 1
mov eax, dword [ebp + 0x20]
mov byte [eax], 0
mov eax, dword [ebp + 0x1c]
mov byte [eax], 0
mov eax, dword [ebp + 0x94]
add eax, 0xffffffd8
xor edx, edx
call fcn.00405f1c
mov eax, dword [ebp + 0x4c]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 0xb8], 0
movzx eax, byte [ebp + 0x80]
mov byte [ebp - 0xb9], al
mov eax, dword [ebp + 0x2c]
mov byte [eax], 0
mov eax, dword [ebp + 0x2c]
cmp byte [eax], 0
jne 0x4c78e8
mov eax, dword [ebp + 0x5c]
mov eax, dword [eax]
sub eax, 2
jae 0x4c78e8
mov byte [ebp - 0xb8], 1
mov byte [ebp + 0x80], 0
push edi
lea esi, [ebp - 0x418]
lea edi, [ebp - 0x428]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00405f1c
lea eax, [ebp - 0x18]
xor edx, edx
call fcn.00405f1c
lea eax, [ebp - 0x1c]
xor edx, edx
call fcn.00405f1c
mov eax, dword [ebp + 0x78]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp + 0x74]
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x78]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
cmp byte [ebp + 0x84], 0
jne 0x4c7957
mov eax, dword [ebp + 0x10]
add dword [ebp - 0x428], eax
mov eax, dword [ebp + 0x94]
cmp byte [eax - 0x29], 0
je 0x4c7a0b
cmp byte [ebp + 0x84], 0
jne 0x4c7a0b
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
call fcn.0043917c
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439694
cmp al, 1
jne 0x4c79a0
mov dword [ebp - 0xd8], 0x1fffffff
jmp 0x4c79b1
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439534
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0xd8]
call fcn.00439184
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp + 0x78]
mov eax, dword [eax]
add eax, dword [ebp - 0x414]
push eax
mov eax, dword [ebp + 0x94]
mov edx, dword [eax + 0x8c]
mov edx, dword [edx]
mov ecx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x38]
call fcn.00439acc
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0xc0]
call fcn.00439184
mov byte [ebp - 0xb7], 1
mov eax, dword [ebp + 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp + 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0xc4], eax
jmp 0x4ce97a
mov eax, dword [ebp + 0x94]
movzx eax, byte [eax + 0xc]
mov byte [ebp - 0xba], al
mov eax, dword [ebp + 0x4c]
inc dword [eax]
mov eax, dword [ebp - 0x38]
call fcn.004c7650
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x38]
call fcn.004c767c
mov dword [ebp - 0x4c], eax
mov edx, dword [edi]
mov eax, 0x4ceb24
call fcn.0040698c
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jle 0x4c7aca
mov ecx, dword [ebp - 0x78]
inc ecx
mov edx, dword [edi]
mov eax, 0x4ceb24
call fcn.0040a94c
mov esi, eax
mov ecx, dword [ebp - 0x78]
inc ecx
mov edx, dword [edi]
mov eax, 0x4ceb34
call fcn.0040a94c
mov ebx, eax
test ebx, ebx
jle 0x4c7aa8
cmp esi, ebx
jg 0x4c7aca
test esi, esi
jne 0x4c7ab0
test ebx, ebx
jg 0x4c7aca
cmp esi, ebx
jge 0x4c7abb
test esi, esi
jle 0x4c7abb
mov dword [ebp - 0x78], esi
test ebx, ebx
jne 0x4c7ac4
xor eax, eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jg 0x4c7a7c
cmp dword [ebp - 0x78], 0
jle 0x4c7ae6
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x78]
dec ecx
mov eax, dword [edi]
mov edx, 1
call fcn.00406674
jmp 0x4c7af0
lea eax, [ebp - 0x10]
mov edx, dword [edi]
call fcn.00405f1c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
je 0x4c7b22
mov eax, dword [ebp - 0xdc]
sub eax, 0xa
cmp word [eax], 2
je 0x4c7b22
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x10]
call fcn.0040563c
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
je 0x4c7b48
mov eax, dword [ebp - 0xe0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jle 0x4c7d37
push 2
lea eax, [ebp - 0x10]
push eax
mov eax, 0x4ceb44
mov dword [ebp - 0x468], eax
mov eax, 0x4ceb24
mov dword [ebp - 0x464], eax
mov eax, 0x4ceb34
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x468]
push eax
mov eax, 0x4ceb54
mov dword [ebp - 0x474], eax
mov eax, 0x4ceb70
mov dword [ebp - 0x470], eax
mov eax, 0x4ceb88
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x474]
mov edx, 2
pop ecx
call fcn.004c73a8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
je 0x4c7bf3
mov eax, dword [ebp - 0xe4]
sub eax, 0xa
cmp word [eax], 2
je 0x4c7bf3
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x10]
call fcn.0040563c
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
je 0x4c7c19
mov eax, dword [ebp - 0xe8]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0xd4], 0
jl 0x4c7c5c
cmp dword [ebp - 0x98], 0
jle 0x4c7c5c
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xd4]
jne 0x4c7c5c
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x24]
cmp byte [eax], 0
je 0x4c7ca4
cmp dword [ebp - 0xa8], 0
jne 0x4c7ca4
mov eax, dword [ebp + 0x58]
cmp dword [eax], 0
jle 0x4c7ca4
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x30]
call fcn.00425364
mov edx, dword [ebp + 0x58]
cmp eax, dword [edx]
jl 0x4c7ca4
mov edx, dword [ebp + 0x58]
mov edx, dword [edx]
dec edx
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x30]
call fcn.004d24cc
mov dword [ebp - 0xa8], eax
cmp byte [ebp + 0x84], 0
jne 0x4c7ce2
push edi
lea esi, [ebp - 0x428]
lea edi, [ebp - 0x438]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
cmp byte [ebp - 0xb7], 0
jne 0x4c7d1d
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x430], eax
jmp 0x4c7d1d
push edi
lea esi, [ebp - 0x418]
lea edi, [ebp - 0x438]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
cmp byte [ebp - 0xb7], 0
jne 0x4c7d1d
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
add eax, dword [ebp - 0x418]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x430], eax
add dword [ebp - 0x434], 0x2710
mov eax, dword [ebp - 0x434]
add eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x42c], eax
cmp byte [ebp + 0x88], 0
jne 0x4c7d5e
cmp dword [ebp - 0xd4], 0
jl 0x4c7d56
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xd4]
jle 0x4c7d5e
mov eax, dword [ebp + 0x5c]
cmp dword [eax], 1
jne 0x4c7d75
cmp dword [ebp - 0x98], 0
jle 0x4c7d75
xor eax, eax
mov dword [ebp - 0x7c], eax
mov byte [ebp - 0x41], 0
jmp 0x4c7f13
mov eax, dword [ebp + 0x48]
cmp dword [eax], 0
jl 0x4c7dc2
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp + 0x48]
mov edx, dword [edx]
inc edx
cmp eax, edx
jl 0x4c7dc2
xor eax, eax
mov dword [ebp - 0x7c], eax
cmp byte [ebp + 0x88], 0
jne 0x4c7db4
cmp dword [ebp - 0x98], 0
jle 0x4c7db4
mov eax, dword [ebp + 0x5c]
cmp dword [eax], 0
je 0x4c7db4
cmp byte [ebp - 0xb9], 0
jne 0x4c7db8
xor eax, eax
jmp 0x4c7dba
mov al, 1
mov byte [ebp - 0x41], al
jmp 0x4c7f13
cmp byte [ebp + 0x80], 0
je 0x4c7f0e
mov eax, dword [ebp + 0x5c]
cmp dword [eax], 0
setne al
or al, byte [ebp + 0x84]
je 0x4c7f0e
cmp dword [ebp - 0x98], 0
jle 0x4c7e71
xor eax, eax
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [ebp + 0x94]
movzx eax, byte [eax + 0x50]
and al, byte [ebp + 0x80]
and eax, 0x7f
mov eax, dword [eax*4 + 0x5427ec]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx - 0x34]
and edx, 0xffffffdf
and edx, 0xffff7fff
or edx, 0x10
or eax, edx
push eax
lea eax, [ebp - 0x438]
push eax
mov eax, dword [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00405f54
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.user32.dll_DrawTextExW
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jne 0x4c7e96
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x7c], eax
jmp 0x4c7e96
xor eax, eax
mov dword [ebp - 0x7c], eax
cmp byte [ebp - 0xb7], 0
je 0x4c7e96
mov eax, dword [ebp + 0x78]
xor edx, edx
mov dword [eax], edx
cmp byte [ebp + 0x88], 0
jne 0x4c7e96
mov eax, dword [ebp + 0x74]
xor edx, edx
mov dword [eax], edx
cmp dword [ebp - 0x98], 0
jle 0x4c7eaa
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x98]
jl 0x4c7eae
xor eax, eax
jmp 0x4c7eb0
mov al, 1
mov byte [ebp - 0x41], al
cmp byte [ebp - 0x41], 0
je 0x4c7f13
mov eax, dword [ebp + 0x2c]
cmp byte [eax], 0
je 0x4c7f13
mov eax, dword [ebp + 0x5c]
cmp dword [eax], 1
jne 0x4c7f13
cmp byte [ebp + 0x80], 0
je 0x4c7f13
cmp byte [ebp - 0xcd], 0
jne 0x4c7f13
mov eax, dword [ebp + 0x4c]
cmp dword [eax], 1
jle 0x4c7f13
mov byte [ebp - 0xa9], 1
mov eax, dword [ebp + 0x4c]
dec dword [eax]
mov eax, dword [ebp + 0x6c]
mov edx, dword [ebp - 0xc8]
mov dword [eax], edx
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0xcc]
mov dword [eax + 0x18], edx
jmp 0x4ce99a
xor eax, eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x78], 0
jle 0x4c7f3d
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x78]
jg 0x4c7f27
cmp dword [ebp - 0x7c], 0
jne 0x4c7f3d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x78]
dec ecx
mov eax, dword [edi]
mov edx, 1
call fcn.00406674
jmp 0x4c7f62
cmp dword [ebp - 0x7c], 0
jle 0x4c7f58
lea eax, [ebp - 0x10]
push eax
mov eax, dword [edi]
mov ecx, dword [ebp - 0x7c]
mov edx, 1
call fcn.00406674
jmp 0x4c7f62
lea eax, [ebp - 0x10]
mov edx, dword [edi]
call fcn.00405f1c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
je 0x4c7f94
mov eax, dword [ebp - 0xec]
sub eax, 0xa
cmp word [eax], 2
je 0x4c7f94
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x10]
call fcn.0040563c
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
je 0x4c7fba
mov eax, dword [ebp - 0xf0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jle 0x4c802f
push 2
lea eax, [ebp - 0x10]
push eax
mov eax, 0x4ceb44
mov dword [ebp - 0x468], eax
mov eax, 0x4ceb24
mov dword [ebp - 0x464], eax
mov eax, 0x4ceb34
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x468]
push eax
mov eax, 0x4ceb54
mov dword [ebp - 0x474], eax
mov eax, 0x4ceb70
mov dword [ebp - 0x470], eax
mov eax, 0x4ceb88
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x474]
mov edx, 2
pop ecx
call fcn.004c73a8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
je 0x4c8061
mov eax, dword [ebp - 0xf4]
sub eax, 0xa
cmp word [eax], 2
je 0x4c8061
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x10]
call fcn.0040563c
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
je 0x4c8087
mov eax, dword [ebp - 0xf8]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jne 0x4c80a1
mov eax, dword [ebp + 0x4c]
dec dword [eax]
mov eax, dword [ebp - 0x10]
mov edx, 0x4ceba0
call fcn.0040666c
jne 0x4c80db
lea eax, [ebp - 0x10]
xor edx, edx
call fcn.00405f1c
mov eax, edi
mov ecx, 1
mov edx, 1
call fcn.00406744
xor eax, eax
mov dword [ebp - 0x9c], eax
xor eax, eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jle 0x4c81e5
mov eax, dword [ebp + 0x48]
cmp dword [eax], 0
jl 0x4c81e5
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp + 0x48]
mov edx, dword [edx]
inc edx
cmp eax, edx
jl 0x4c81e5
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp + 0x48]
mov edx, dword [edx]
inc edx
cmp eax, edx
je 0x4c812b
mov eax, dword [ebp + 0x5c]
cmp dword [eax], 0
je 0x4c812b
cmp byte [ebp - 0xb9], 0
jne 0x4c81b4
cmp dword [ebp - 0xa8], 0
je 0x4c8140
mov eax, dword [ebp - 0xa8]
cmp byte [eax + 0x3c], 0
jne 0x4c81b4
mov eax, edi
mov ecx, dword [ebp - 0x98]
mov edx, 1
call fcn.00406744
lea eax, [ebp - 0x14]
mov edx, 0x4ceba0
call fcn.004062dc
xor eax, eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0xa8], 0
je 0x4c817a
mov eax, dword [ebp - 0xa8]
mov byte [eax + 0x3d], 1
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp + 0x48]
mov edx, dword [edx]
inc edx
cmp eax, edx
je 0x4c81b4
movzx eax, byte [ebp - 0xb9]
xor al, 1
and al, byte [ebp - 0xcd]
je 0x4c81b4
cmp dword [ebp - 0xd4], 0
jl 0x4c81b4
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xd4]
jle 0x4c81b4
mov byte [ebp - 0x41], 1
cmp byte [ebp - 0x41], 0
je 0x4c81e5
mov byte [ebp - 0xa9], 1
mov eax, dword [ebp + 0x4c]
dec dword [eax]
mov eax, dword [ebp + 0x6c]
mov edx, dword [ebp - 0xc8]
mov dword [eax], edx
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0xcc]
mov dword [eax + 0x18], edx
jmp 0x4ce99a
cmp dword [ebp - 0x98], 0
jle 0x4c9a8e
mov byte [ebp - 0xb7], 0
mov eax, dword [ebp + 0x94]
cmp byte [eax - 0x35], 0
je 0x4c821f
mov eax, dword [ebp + 0x68]
mov eax, dword [eax]
mov edx, dword [ebp - 0x50]
shr edx, 2
cmp eax, edx
jge 0x4c821f
mov eax, dword [ebp - 0x50]
shr eax, 2
mov edx, dword [ebp + 0x68]
mov dword [edx], eax
mov eax, dword [ebp + 0x94]
cmp byte [eax - 0x36], 0
je 0x4c8245
mov eax, dword [ebp + 0x64]
mov eax, dword [eax]
mov edx, dword [ebp - 0x50]
shr edx, 2
cmp eax, edx
jge 0x4c8245
mov eax, dword [ebp - 0x50]
shr eax, 2
mov edx, dword [ebp + 0x64]
mov dword [edx], eax
mov eax, dword [ebp + 0x78]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp + 0x78]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x50]
jge 0x4c8262
mov eax, dword [ebp + 0x78]
mov edx, dword [ebp - 0x50]
mov dword [eax], edx
mov eax, dword [ebp + 0x74]
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x74]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4c]
jge 0x4c827f
mov eax, dword [ebp + 0x74]
mov edx, dword [ebp - 0x4c]
mov dword [eax], edx
mov eax, dword [ebp + 0x24]
cmp byte [eax], 0
je 0x4c82a2
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x3c]
mov edx, dword [edx]
call fcn.00405f1c
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x10]
call fcn.004062dc
mov eax, dword [ebp - 0x3c]
lea eax, [ebp - 4]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx + 0x34]
mov edx, dword [edx]
call fcn.00405f1c
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 0x10]
call fcn.004062dc
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x34]
lea eax, [ebp - 8]
xor edx, edx
call fcn.00405f1c
mov eax, dword [ebp + 0x94]
cmp byte [eax - 0x37], 0
je 0x4c82f7
mov eax, edi
mov ecx, dword [ebp - 0x98]
mov edx, 1
call fcn.00406744
mov byte [ebp - 0xa9], 1
mov eax, dword [ebp + 0x94]
cmp byte [eax - 0x37], 0
jne 0x4c9a8e
cmp byte [ebp + 0x84], 0
jne 0x4c8af4
mov eax, dword [ebp + 0x94]
cmp byte [eax - 0x36], 0
je 0x4c8332
mov eax, dword [ebp + 0x64]
mov eax, dword [eax]
sub dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x94]
cmp byte [eax - 0x35], 0
je 0x4c8349
mov eax, dword [ebp + 0x68]
mov eax, dword [eax]
add dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x60]
mov eax, dword [eax]
sub dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x74]
mov edx, dword [ebp - 0x41c]
sub edx, dword [eax]
add edx, dword [ebp - 0x4c]
mov dword [ebp - 0x41c], edx
mov eax, dword [ebp + 0x94]
push edi
lea edi, [eax - 0x10]
lea esi, [ebp - 0x428]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
push edi
lea esi, [ebp - 0x428]
lea edi, [ebp - 0x438]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0xb6], 1
mov byte [ebp - 0xb5], 0
push 0
mov eax, dword [ebp + 0x94]
movzx eax, byte [eax + 0x50]
and al, byte [ebp + 0x80]
and eax, 0x7f
mov eax, dword [eax*4 + 0x5427ec]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx - 0x34]
and edx, 0xffffffdf
and edx, 0xfffffff7
and edx, 0xfffffdff
and edx, 0xffff7fff
or edx, 0x10
or eax, edx
or eax, 0x400
push eax
mov eax, dword [ebp + 0x94]
add eax, 0xfffffff0
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00405f54
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.user32.dll_DrawTextExW
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 4]
mov edx, dword [ebp + 0x94]
sub eax, dword [edx - 0xc]
cmp eax, dword [ebp - 0x50]
jg 0x4c8459
mov byte [ebp - 0xb6], 0
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 8]
cmp eax, dword [ebp - 0x420]
jg 0x4c8448
mov byte [ebp - 0xba], 0
jmp 0x4c8459
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x38], 1
mov byte [ebp - 0xb5], 1
mov eax, dword [ebp + 0x94]
push edi
lea edi, [eax - 0x10]
lea esi, [ebp - 0x428]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00405f1c
push 0
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x34]
or eax, 0x400
push eax
lea eax, [ebp - 0x428]
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00405f54
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.user32.dll_DrawTextExW
cmp byte [ebp - 0xb6], 0
je 0x4c84e0
cmp byte [ebp + 0x80], 0
jne 0x4c84e0
mov eax, dword [ebp - 0x420]
cmp eax, dword [ebp - 0x430]
jle 0x4c84e0
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x38], 1
mov byte [ebp - 0xb5], 1
mov eax, dword [ebp - 0x420]
sub eax, dword [ebp - 0x428]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x428]
cmp eax, dword [ebp - 0x410]
jge 0x4c897f
mov eax, dword [ebp + 0x94]
cmp byte [eax - 0x39], 0
je 0x4c864e
mov eax, dword [ebp + 0x94]
mov ecx, dword [eax + 0x70]
mov eax, dword [ebp + 0x94]
mov edx, dword [eax + 0x70]
mov eax, dword [ebp + 0x94]
add eax, 0xfffffff0
call fcn.00408afc
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp + 0x94]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438a10
cmp byte [ebp - 0xba], 0
jne 0x4c8575
mov eax, dword [ebp + 0x94]
cmp byte [eax + 0xc], 0
sete al
and al, byte [ebp - 0xb5]
je 0x4c85dc
cmp dword [ebp - 0xd4], 0
jl 0x4c85dc
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xd4]
dec edx
cmp eax, edx
jg 0x4c85dc
push 0
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x34]
and eax, 0xfffffdff
and eax, 0xfffffeff
movzx edx, byte [ebp - 0xba]
or eax, dword [edx*4 + 0x5427f4]
push eax
mov eax, dword [ebp + 0x94]
add eax, 0xfffffff0
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405f54
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.user32.dll_DrawTextExW
jmp 0x4c8628
push 0
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x34]
and eax, 0xfffffdff
movzx edx, byte [ebp - 0xba]
or eax, dword [edx*4 + 0x5427f4]
or eax, 0x100
push eax
mov eax, dword [ebp + 0x94]
add eax, 0xfffffff0
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405f54
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.user32.dll_DrawTextExW
mov eax, dword [ebp + 0x94]
push edi
lea edi, [eax - 0x10]
lea esi, [ebp - 0x438]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x88]
call fcn.00438a10
cmp dword [ebp - 0xd4], 0
jl 0x4c8931
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xd4]
dec edx
cmp eax, edx
jg 0x4c8931
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x10]
mov edx, dword [ebp + 0x94]
cmp eax, dword [edx - 8]
jle 0x4c8695
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x10]
mov edx, dword [ebp + 0x94]
mov dword [edx - 8], eax
cmp byte [ebp - 0xba], 0
jne 0x4c8784
push 0
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x34]
and eax, 0xfffffdff
movzx edx, byte [ebp - 0xba]
or eax, dword [edx*4 + 0x5427f4]
movzx edx, byte [ebp - 0xb5]
xor dl, 1
and edx, 0x7f
or eax, dword [edx*4 + 0x5427e4]
push eax
mov eax, dword [ebp + 0x94]
add eax, 0xfffffff0
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405f54
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.user32.dll_DrawTextExW
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 8]
mov edx, dword [ebp + 0x94]
sub eax, dword [edx - 0x10]
cmp eax, dword [ebp - 0xa0]
jge 0x4c8721
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x38], 1
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 8]
mov edx, dword [ebp + 0x94]
sub eax, dword [edx - 0x10]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0xfc]
jge 0x4c8755
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x100], eax
jmp 0x4c8761
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x428]
add eax, dword [ebp - 0xa0]
mov dword [ebp - 0x420], eax
jmp 0x4c89ac
lea eax, [ebp - 0xc]
mov edx, 0x4cebb0
call fcn.004062dc
mov eax, dword [ebp - 0xc]
call fcn.00405f54
mov dword [ebp - 0x40], eax
push 0
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x34]
and eax, 0xfffffdff
and eax, 0xfffffeff
or eax, 0x10000
movzx edx, byte [ebp - 0xba]
or eax, dword [edx*4 + 0x5427f4]
push eax
mov eax, dword [ebp + 0x94]
add eax, 0xfffffff0
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.user32.dll_DrawTextExW
mov eax, dword [ebp - 0x10]
call fcn.00405f54
mov edx, dword [ebp - 0x40]
call fcn.0040e004
test eax, eax
je 0x4c89ac
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x38], 1
mov byte [ebp - 0xb5], 1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x40]
call fcn.00406074
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x4c884e
mov eax, dword [ebp - 0x104]
sub eax, 0xa
cmp word [eax], 2
je 0x4c884e
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.0040563c
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x4c8874
mov eax, dword [ebp - 0x108]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 8]
mov edx, dword [ebp + 0x94]
sub eax, dword [edx - 0x10]
mov dword [ebp - 0xa0], eax
push 0
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x34]
or eax, 0x400
push eax
mov eax, dword [ebp + 0x94]
add eax, 0xfffffff0
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405f54
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.user32.dll_DrawTextExW
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 8]
mov edx, dword [ebp + 0x94]
sub eax, dword [edx - 0x10]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x10c]
jge 0x4c8905
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x110], eax
jmp 0x4c8911
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x428]
add eax, dword [ebp - 0xa0]
mov dword [ebp - 0x420], eax
jmp 0x4c89ac
push 0
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x34]
and eax, 0xfffffdff
movzx edx, byte [ebp - 0xba]
or eax, dword [edx*4 + 0x5427f4]
or eax, 0x100
push eax
mov eax, dword [ebp + 0x94]
add eax, 0xfffffff0
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405f54
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.user32.dll_DrawTextExW
jmp 0x4c89ac
cmp dword [ebp - 0xd4], 0
jl 0x4c89ac
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xd4]
dec edx
cmp eax, edx
jg 0x4c89ac
xor eax, eax
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x7c]
mov edx, dword [ebp - 0xa0]
add dword [eax], edx
mov eax, dword [ebp + 0x24]
cmp byte [eax], 0
je 0x4c89f5
mov eax, dword [ebp + 0x94]
cmp dword [eax + 0x78], 0
jl 0x4c89f5
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x78]
mov edx, dword [ebp + 0x58]
mov edx, dword [edx]
dec edx
cmp eax, edx
jne 0x4c89f5
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx - 0x40]
call fcn.00405ec8
mov eax, dword [ebp + 0x94]
cmp byte [eax - 0x41], 0
je 0x4c8a93
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
mov edx, 0xff
call fcn.00439184
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
mov edx, 1
call fcn.004392c4
mov eax, dword [ebp - 0x428]
sar eax, 1
jns 0x4c8a32
adc eax, 0
mov ebx, eax
add ebx, ebx
mov eax, ebx
and eax, 0x80000003
jns 0x4c8a44
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x4c8a4f
mov esi, 2
jmp 0x4c8a51
xor esi, esi
mov ecx, dword [ebp - 0x40c]
add ecx, esi
dec ecx
mov edx, ebx
mov eax, dword [ebp - 0x38]
call fcn.00439a64
jmp 0x4c8a8b
cmp esi, 2
jne 0x4c8a6f
xor esi, esi
jmp 0x4c8a74
mov esi, 2
mov ecx, dword [ebp - 0x40c]
add ecx, esi
dec ecx
lea edx, [ebx + 2]
mov eax, dword [ebp - 0x38]
call fcn.00439a04
add ebx, 2
cmp ebx, dword [ebp - 0x420]
jl 0x4c8a66
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x34]
and eax, 0x20000
cmp eax, 0x20000
je 0x4c8ac2
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x420], eax
jmp 0x4c8ad7
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x420]
add eax, dword [ebp - 0x428]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x424], eax
jmp 0x4c98be
cmp byte [ebp + 0x88], 0
jne 0x4c8b9c
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x14]
cmp byte [eax], 0
jne 0x4c8b1b
mov eax, dword [ebp + 0x48]
cmp dword [eax], 0
jl 0x4c8b9c
mov eax, dword [ebp + 0x48]
cmp dword [eax], 0
jle 0x4c8b9c
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp + 0x48]
cmp eax, dword [edx]
jne 0x4c8b9c
cmp dword [ebp - 0xa8], 0
je 0x4c8b62
mov eax, dword [ebp - 0xa8]
cmp byte [eax + 0x3c], 0
je 0x4c8b62
mov eax, dword [ebp + 0x4c]
cmp dword [eax], 1
jle 0x4c8b62
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
dec eax
mov edx, dword [ebp + 0x48]
mov dword [edx], eax
mov eax, dword [ebp + 0x18]
mov byte [eax], 1
jmp 0x4ceab0
lea eax, [ebp - 8]
mov edx, 0x4cebd0
call fcn.00405f1c
cmp byte [ebp - 0xba], 1
je 0x4c8b8a
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004062dc
add dword [ebp - 0x9c], 3
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x14]
movzx eax, byte [eax]
mov byte [ebp - 0xcd], al
push edi
lea esi, [ebp - 0x418]
lea edi, [ebp - 0x428]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebp - 0x428]
cmp eax, dword [ebp - 0x420]
jle 0x4c8bc8
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x420], eax
push 0
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x34]
or eax, 0x400
push eax
lea eax, [ebp - 0x428]
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00405f54
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.user32.dll_DrawTextExW
xor eax, eax
mov dword [ebp - 0x48], eax
cmp byte [ebp + 0x88], 0
je 0x4c8cc8
cmp dword [ebp - 0x10], 0
je 0x4c8cc8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x4c8c4c
mov eax, dword [ebp - 0x114]
sub eax, 0xa
cmp word [eax], 2
je 0x4c8c4c
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x10]
call fcn.0040563c
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x4c8c7e
mov eax, dword [ebp - 0x118]
sub eax, 0xa
cmp word [eax], 2
je 0x4c8c7e
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x10]
call fcn.0040563c
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x4c8ca4
mov eax, dword [ebp - 0x11c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x114]
mov edx, dword [ebp - 0x11c]
cmp word [eax + edx*2 - 2], 0x20
jne 0x4c8cc8
mov edx, 0x4ceb44
mov eax, dword [ebp - 0x38]
call fcn.00439cbc
mov dword [ebp - 0x48], eax
cmp byte [ebp + 0x88], 0
je 0x4c8edc
mov eax, dword [ebp - 0x420]
sub eax, dword [ebp - 0x428]
sub eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x430]
sub edx, dword [ebp - 0x438]
cmp eax, edx
jle 0x4c8edc
cmp byte [ebp - 0xba], 0
jne 0x4c8d2a
mov eax, dword [ebp - 0x430]
sub eax, dword [ebp - 0x438]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x428]
add eax, dword [ebp - 0xa0]
mov dword [ebp - 0x420], eax
jmp 0x4c8edc
lea eax, [ebp - 0xc]
mov ecx, 0x4cebb0
mov edx, dword [ebp - 0x10]
call fcn.0040639c
mov eax, dword [ebp - 0xc]
call fcn.00405f54
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x94]
push edi
lea edi, [eax - 0x10]
lea esi, [ebp - 0x438]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
push 0
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x34]
and eax, 0xfffffdff
and eax, 0xfffffeff
or eax, 0x10000
movzx edx, byte [ebp - 0xba]
or eax, dword [edx*4 + 0x5427f4]
push eax
mov eax, dword [ebp + 0x94]
add eax, 0xfffffff0
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.user32.dll_DrawTextExW
mov eax, dword [ebp - 0x10]
call fcn.00405f54
mov edx, dword [ebp - 0x40]
call fcn.0040e004
test eax, eax
je 0x4c8edc
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x40]
call fcn.00406074
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 8]
mov edx, dword [ebp + 0x94]
sub eax, dword [edx - 0x10]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x4c8e21
mov eax, dword [ebp - 0x120]
sub eax, 0xa
cmp word [eax], 2
je 0x4c8e21
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.0040563c
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x4c8e47
mov eax, dword [ebp - 0x124]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x124], eax
push 0
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x34]
or eax, 0x400
push eax
mov eax, dword [ebp + 0x94]
add eax, 0xfffffff0
push eax
mov eax, dword [ebp - 0x124]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405f54
push eax
mov eax, dword [ebp - 0x128]
push eax
call sub.user32.dll_DrawTextExW
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 8]
mov edx, dword [ebp + 0x94]
sub eax, dword [edx - 0x10]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x12c]
jge 0x4c8eb2
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x130], eax
jmp 0x4c8ebe
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x428]
add eax, dword [ebp - 0xa0]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x34]
cmp eax, dword [ebp - 0x424]
jl 0x4c8f71
mov eax, dword [ebp + 0x34]
cmp eax, dword [ebp - 0x41c]
jge 0x4c8f71
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
cmp eax, dword [ebp + 0x38]
jge 0x4c8f71
mov eax, dword [ebp + 0x94]
add eax, 0xffffffe4
push eax
push 0
mov eax, dword [ebp + 0x94]
add eax, 0xffffffec
push eax
mov eax, dword [ebp + 0x7c]
mov edx, dword [ebp + 0x38]
sub edx, dword [eax]
push edx
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00405f54
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_GetTextExtentExPointW
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x14]
cmp eax, dword [ebp - 0x98]
jne 0x4c8f5f
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x98]
add dword [eax - 0x48], edx
jmp 0x4c8f71
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x14]
mov edx, dword [ebp + 0x94]
add dword [edx - 0x48], eax
mov eax, dword [ebp - 0x420]
sub eax, dword [ebp - 0x428]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jge 0x4c8f94
xor eax, eax
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x7c]
mov edx, dword [ebp - 0xa0]
add dword [eax], edx
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x34]
and eax, 0x20000
cmp eax, 0x20000
jne 0x4c8fc8
mov eax, dword [ebp - 0x410]
sub eax, dword [ebp + 0x38]
sub eax, dword [ebp - 0x428]
mov dword [ebp - 0x5c], eax
jmp 0x4c8fd4
mov eax, dword [ebp + 0x38]
sub eax, dword [ebp - 0x428]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x24]
movzx eax, byte [eax]
and al, byte [ebp + 0x88]
je 0x4c916f
mov eax, dword [ebp + 0x74]
mov edx, dword [ebp - 0x41c]
sub edx, dword [eax]
add edx, dword [ebp - 0x4c]
mov dword [ebp - 0x41c], edx
mov eax, dword [ebp - 0x41c]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
add eax, dword [ebp - 0x418]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
sub eax, dword [ebp - 0xa0]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
mov edx, dword [ebp + 0x30]
cmp eax, dword [edx + 8]
jne 0x4c9052
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp - 0x428]
mov dword [eax], edx
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp - 0x420]
mov dword [eax + 8], edx
jmp 0x4c9084
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x428]
jle 0x4c906a
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp - 0x428]
mov dword [eax], edx
mov eax, dword [ebp + 0x30]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 0x420]
jge 0x4c9084
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp - 0x420]
mov dword [eax + 8], edx
mov eax, dword [ebp + 0x30]
mov eax, dword [eax + 4]
mov edx, dword [ebp + 0x30]
cmp eax, dword [edx + 0xc]
jne 0x4c90ac
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp - 0x424]
mov dword [eax + 4], edx
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp - 0x41c]
mov dword [eax + 0xc], edx
jmp 0x4c90e0
mov eax, dword [ebp + 0x30]
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 0x424]
jle 0x4c90c6
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp - 0x424]
mov dword [eax + 4], edx
mov eax, dword [ebp + 0x30]
mov eax, dword [eax + 0xc]
cmp eax, dword [ebp - 0x41c]
jge 0x4c90e0
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp - 0x41c]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 0x38]
cmp eax, dword [ebp - 0x428]
jl 0x4c9146
mov eax, dword [ebp + 0x38]
cmp eax, dword [ebp - 0x420]
jg 0x4c9146
mov eax, dword [ebp + 0x34]
cmp eax, dword [ebp - 0x424]
jl 0x4c9146
mov eax, dword [ebp + 0x34]
cmp eax, dword [ebp - 0x41c]
jge 0x4c9146
mov eax, dword [ebp + 0x20]
mov byte [eax], 1
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx - 0x40]
call fcn.00405ec8
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx - 0x28]
call fcn.00405ec8
mov eax, dword [ebp + 0x28]
mov byte [eax], 1
mov eax, dword [ebp + 0x28]
cmp byte [eax], 0
je 0x4c916f
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx + 0x1c]
push edi
mov esi, eax
mov edi, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebp + 0x58]
mov eax, dword [eax]
dec eax
mov edx, dword [ebp + 0x54]
mov dword [edx], eax
cmp byte [ebp + 0x88], 0
jne 0x4c91ba
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
add eax, dword [ebp - 0x418]
add eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x410]
jle 0x4c91ba
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xd4]
je 0x4c91ba
cmp dword [ebp - 8], 0
je 0x4c91b6
cmp dword [ebp - 0xa8], 0
je 0x4c91ba
mov eax, dword [ebp - 0xa8]
cmp byte [eax + 0x3c], 0
je 0x4c91ba
xor eax, eax
jmp 0x4c91bc
mov al, 1
mov byte [ebp - 0xa9], al
movzx eax, byte [ebp - 0xa9]
mov byte [ebp - 0xaa], al
mov eax, dword [ebp + 0x24]
cmp byte [eax], 0
je 0x4c9272
cmp byte [ebp - 0xa9], 0
je 0x4c9216
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
add eax, dword [ebp - 0x418]
add eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x410]
jg 0x4c9200
cmp dword [ebp - 8], 0
je 0x4c9272
cmp byte [ebp - 0xcd], 0
jne 0x4c9216
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xd4]
jge 0x4c9272
cmp dword [ebp - 0xa8], 0
je 0x4c9272
mov eax, dword [ebp - 0xa8]
mov byte [eax + 0x3d], 1
cmp byte [ebp + 0x80], 0
je 0x4c9241
cmp byte [ebp - 0x41], 0
jne 0x4c9272
cmp dword [ebp - 0xd4], 0
jl 0x4c9272
mov eax, dword [ebp - 0xa8]
cmp byte [eax + 0x3c], 0
je 0x4c9272
mov eax, dword [ebp - 0x440]
sub eax, dword [ebp - 0x448]
cmp eax, dword [ebp - 0xa0]
jl 0x4c926b
mov eax, dword [ebp - 0xa8]
mov byte [eax + 0x3d], 0
mov byte [ebp - 0xa9], 1
movzx eax, byte [ebp - 0xa9]
xor al, 1
and al, byte [ebp + 0x80]
je 0x4c92a0
cmp dword [ebp - 0xd4], 0
jl 0x4c92a0
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xd4]
jg 0x4c92a0
mov byte [ebp - 0xa9], 1
cmp byte [ebp - 0xcd], 0
je 0x4c92be
cmp byte [ebp - 0xa9], 0
jne 0x4c92be
mov eax, dword [ebp + 0x4c]
cmp dword [eax], 1
jg 0x4c93b0
cmp byte [ebp - 0xcf], 0
jne 0x4c92fe
cmp byte [ebp - 0xcd], 0
jne 0x4c92fe
cmp byte [ebp - 0xa9], 0
jne 0x4c92fe
cmp byte [ebp + 0x80], 0
jne 0x4c92fe
cmp byte [ebp - 0xb8], 0
jne 0x4c92fe
cmp byte [ebp - 0x41], 0
jne 0x4c92fe
cmp byte [ebp - 0xba], 0
jne 0x4c93b0
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp + 0x44]
cmp eax, dword [edx]
jge 0x4c9358
cmp byte [ebp - 0xcf], 0
jne 0x4c9358
cmp byte [ebp - 0xcd], 0
jne 0x4c9328
mov eax, dword [ebp + 0x48]
mov eax, dword [eax]
mov edx, dword [ebp + 0x4c]
cmp eax, dword [edx]
jne 0x4c9358
cmp byte [ebp - 0xa9], 0
je 0x4c9358
cmp dword [ebp - 8], 0
je 0x4c9358
cmp byte [ebp + 0x80], 0
jne 0x4c9358
cmp byte [ebp - 0xb8], 0
jne 0x4c9358
cmp byte [ebp - 0x41], 0
jne 0x4c9358
cmp byte [ebp - 0xba], 0
jne 0x4c93b0
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xd4]
dec edx
cmp eax, edx
sete al
and al, byte [ebp + 0x80]
je 0x4c9525
cmp byte [ebp - 0x41], 0
jne 0x4c9525
cmp byte [ebp - 0xba], 0
je 0x4c9525
cmp byte [ebp - 0xa9], 0
je 0x4c9525
cmp byte [ebp - 0xaa], 0
jne 0x4c9525
cmp dword [ebp - 8], 0
jne 0x4c9525
lea eax, [ebp - 0x478]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00406674
lea eax, [ebp - 0x478]
mov edx, 0x4cebd0
call fcn.004062dc
mov edx, dword [ebp - 0x478]
mov eax, dword [ebp - 0x38]
call fcn.00439cbc
mov ebx, eax
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
sub eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0x418]
add eax, dword [ebp + 0x10]
add ebx, eax
cmp ebx, dword [ebp - 0x410]
jle 0x4c951c
cmp byte [ebp - 0xb9], 0
je 0x4c941c
mov eax, dword [ebp + 0x4c]
cmp dword [eax], 0
jg 0x4c9420
xor eax, eax
jmp 0x4c9422
mov al, 1
mov byte [ebp - 0x41], al
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x38], 1
cmp byte [ebp - 0xcd], 0
je 0x4c945e
mov eax, dword [ebp + 0x48]
cmp dword [eax], 1
jle 0x4c945e
mov eax, dword [ebp + 0x4c]
cmp dword [eax], 0
jle 0x4c945e
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
dec eax
mov edx, dword [ebp + 0x48]
mov dword [edx], eax
mov eax, dword [ebp + 0x18]
mov byte [eax], 1
jmp 0x4ceab0
mov eax, dword [ebp + 0x4c]
cmp dword [eax], 1
jle 0x4c949b
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x14]
cmp byte [eax], 0
je 0x4c949b
cmp byte [ebp - 0xcd], 0
jne 0x4c949b
mov eax, dword [ebp + 0x48]
cmp dword [eax], 1
jle 0x4c949b
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
dec eax
mov edx, dword [ebp + 0x48]
mov dword [edx], eax
mov eax, dword [ebp + 0x18]
mov byte [eax], 1
jmp 0x4ceab0
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x14]
cmp byte [eax], 0
jne 0x4c94f1
cmp byte [ebp - 0xcf], 0
jne 0x4c94f1
mov eax, dword [ebp + 0x5c]
cmp dword [eax], 0
je 0x4c94d3
cmp byte [ebp + 0x80], 0
je 0x4c94d3
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xd4]
dec edx
cmp eax, edx
jne 0x4c94f1
mov eax, dword [ebp + 0x4c]
cmp dword [eax], 1
jle 0x4c94f1
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
dec eax
mov edx, dword [ebp + 0x48]
mov dword [edx], eax
mov eax, dword [ebp + 0x18]
mov byte [eax], 1
jmp 0x4ceab0
cmp byte [ebp - 0xcf], 0
jne 0x4c953a
mov eax, dword [ebp + 0x5c]
cmp dword [eax], 0
je 0x4c950b
cmp byte [ebp + 0x80], 0
jne 0x4c953a
mov eax, dword [ebp + 0x4c]
cmp dword [eax], 1
jne 0x4c953a
mov byte [ebp - 0xa9], 1
jmp 0x4c953a
mov byte [ebp - 0xa9], 1
jmp 0x4c953a
movzx eax, byte [ebp + 0x80]
xor al, 1
or al, byte [ebp - 0xa9]
mov byte [ebp - 0xa9], al
cmp byte [ebp - 0xa9], 0
jne 0x4c973d
cmp byte [ebp + 0x80], 0
je 0x4c973d
push 0
mov eax, dword [ebp + 0x94]
movzx eax, byte [eax + 0x50]
and al, byte [ebp + 0x80]
and eax, 0x7f
mov eax, dword [eax*4 + 0x5427ec]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx - 0x34]
and edx, 0xfffffdff
and edx, 0xffffffdf
and edx, 0xffff7fff
or edx, 0x10
or eax, edx
or eax, 0x400
push eax
lea eax, [ebp - 0x438]
push eax
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00405f54
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.user32.dll_DrawTextExW
mov eax, dword [ebp - 0x42c]
sub eax, dword [ebp - 0x434]
cmp eax, dword [ebp - 0x50]
setle byte [ebp - 0xa9]
cmp byte [ebp - 0xa9], 0
je 0x4c9607
mov eax, dword [ebp - 0x410]
cmp eax, dword [ebp - 0x438]
jle 0x4c95f3
mov eax, dword [ebp - 0x410]
cmp eax, dword [ebp - 0x430]
jge 0x4c95ff
mov eax, dword [ebp + 0x4c]
cmp dword [eax], 1
je 0x4c95ff
xor eax, eax
jmp 0x4c9601
mov al, 1
mov byte [ebp - 0xa9], al
cmp byte [ebp - 0xa9], 0
jne 0x4c97b0
cmp byte [ebp - 0xba], 0
je 0x4c97b0
mov eax, dword [ebp - 0x414]
add eax, dword [ebp - 0xb0]
mov edx, dword [ebp + 0x6c]
add eax, dword [edx]
mov edx, dword [ebp + 0x70]
add eax, dword [edx]
add eax, dword [ebp - 0x50]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx + 0x8c]
cmp eax, dword [edx + 0xc]
jle 0x4c97b0
lea eax, [ebp - 0x47c]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00406674
lea eax, [ebp - 0x47c]
mov edx, 0x4cebd0
call fcn.004062dc
mov edx, dword [ebp - 0x47c]
mov eax, dword [ebp - 0x38]
call fcn.00439cbc
mov edx, dword [ebp + 0x7c]
mov edx, dword [edx]
sub edx, dword [ebp - 0xa0]
add edx, dword [ebp - 0x418]
add edx, dword [ebp + 0x10]
add eax, edx
cmp eax, dword [ebp - 0x410]
jle 0x4c96c1
cmp dword [ebp - 0xa8], 0
je 0x4c97b0
mov eax, dword [ebp - 0xa8]
cmp byte [eax + 0x3c], 0
je 0x4c97b0
mov byte [ebp - 0xa9], 1
cmp byte [ebp - 0x41], 0
jne 0x4c97b0
cmp byte [ebp - 0xaa], 0
jne 0x4c97b0
cmp dword [ebp - 0xa8], 0
je 0x4c97b0
cmp dword [ebp - 0xd4], 0
jge 0x4c97b0
mov eax, dword [ebp - 0xa8]
cmp byte [eax + 0x3c], 0
je 0x4c97b0
mov eax, dword [ebp - 0xa8]
mov byte [eax + 0x3d], 0
mov eax, dword [ebp + 0x8c]
mov edx, dword [ebp - 0xa0]
add dword [eax + 8], edx
mov eax, dword [ebp + 0x44]
cmp dword [eax], 0
jge 0x4ceab0
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp + 0x44]
mov dword [edx], eax
jmp 0x4ceab0
cmp byte [ebp + 0x88], 0
jne 0x4c97b0
cmp byte [ebp + 0x80], 0
je 0x4c9755
cmp byte [ebp - 0x41], 0
jne 0x4c97b0
cmp byte [ebp - 0xaa], 0
jne 0x4c97b0
cmp dword [ebp - 0xa8], 0
je 0x4c97b0
cmp dword [ebp - 0xd4], 0
jge 0x4c97b0
mov eax, dword [ebp - 0xa8]
cmp byte [eax + 0x3c], 0
je 0x4c97b0
mov eax, dword [ebp - 0xa8]
mov byte [eax + 0x3d], 0
mov eax, dword [ebp + 0x8c]
mov edx, dword [ebp - 0xa0]
add dword [eax + 8], edx
mov eax, dword [ebp + 0x44]
cmp dword [eax], 0
jge 0x4ceab0
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp + 0x44]
mov dword [edx], eax
jmp 0x4ceab0
movzx eax, byte [ebp - 0xa9]
and al, byte [ebp + 0x80]
je 0x4c984d
cmp byte [ebp - 0x41], 0
jne 0x4c984d
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
add eax, dword [ebp - 0x418]
add eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x410]
jl 0x4c984d
mov eax, dword [edi]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x4c9812
mov eax, dword [ebp - 0x134]
sub eax, 0xa
cmp word [eax], 2
je 0x4c9812
mov edx, dword [edi]
mov eax, edi
call fcn.0040563c
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
je 0x4c9838
mov eax, dword [ebp - 0x138]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x138]
setl byte [ebp - 0x139]
jmp 0x4c9854
mov byte [ebp - 0x139], 0
cmp byte [ebp - 0x139], 0
je 0x4c9873
mov eax, dword [edi]
mov edx, dword [ebp - 0x98]
cmp word [eax + edx*2], 0x3c
sete byte [ebp - 0x13a]
jmp 0x4c987a
mov byte [ebp - 0x13a], 0
cmp byte [ebp - 0x13a], 0
jne 0x4c98b1
cmp byte [ebp + 0x80], 0
je 0x4c98b1
cmp byte [ebp - 0x41], 0
jne 0x4c98ac
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
add eax, dword [ebp - 0x418]
add eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x410]
jge 0x4c98ac
xor eax, eax
jmp 0x4c98ae
mov al, 1
mov byte [ebp - 0x41], al
movzx eax, byte [ebp - 0xa9]
mov byte [ebp - 0xa9], al
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x10]
call fcn.004062dc
cmp byte [ebp + 0x80], 0
je 0x4c994f
cmp byte [ebp - 0x41], 0
jne 0x4c98e1
cmp byte [ebp + 0x84], 0
jne 0x4c994f
mov eax, dword [ebp + 0x5c]
cmp dword [eax], 0
jl 0x4c994f
mov byte [ebp - 0xce], 0
mov eax, dword [ebp + 0x5c]
cmp dword [eax], 0
je 0x4c9918
mov eax, dword [ebp + 0x5c]
cmp dword [eax], 1
jne 0x4c9918
mov eax, dword [ebp + 0x2c]
cmp byte [eax], 0
je 0x4c9918
cmp byte [ebp - 0xa9], 0
jne 0x4c9918
mov byte [ebp - 0xce], 1
mov eax, dword [ebp + 0x5c]
dec dword [eax]
mov eax, dword [ebp + 0x2c]
mov byte [eax], 0
mov eax, dword [ebp + 0x5c]
cmp dword [eax], 0
jg 0x4c997d
cmp byte [ebp - 0xce], 0
jne 0x4c997d
mov byte [ebp - 0x41], 0
mov byte [ebp - 0xa9], 1
mov byte [ebp + 0x80], 0
mov byte [ebp - 0xb8], 1
jmp 0x4c997d
cmp byte [ebp - 0xb8], 0
je 0x4c997d
mov eax, dword [ebp + 0x4c]
cmp dword [eax], 1
jle 0x4c9965
mov eax, dword [ebp + 0x4c]
dec dword [eax]
mov byte [ebp - 0xb8], 0
mov byte [ebp - 0x41], 0
movzx eax, byte [ebp - 0xb9]
mov byte [ebp + 0x80], al
cmp byte [ebp - 0xa9], 0
jne 0x4c9999
cmp byte [ebp + 0x80], 0
jne 0x4c9a13
cmp byte [ebp - 0x41], 0
jne 0x4c9a13
lea eax, [ebp - 0x480]
push eax
mov eax, dword [edi]
mov ecx, dword [ebp - 0x98]
mov edx, 1
call fcn.00406674
mov edx, dword [ebp - 0x480]
lea eax, [ebp - 0x14]
call fcn.004062dc
cmp byte [ebp - 0xba], 1
je 0x4c99d4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004062dc
mov eax, edi
mov ecx, dword [ebp - 0x98]
mov edx, 1
call fcn.00406744
cmp byte [ebp - 0x41], 0
je 0x4c99f7
mov eax, dword [ebp + 0x70]
mov edx, dword [ebp - 0xc4]
mov dword [eax], edx
mov eax, dword [ebp + 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xcc], eax
jmp 0x4c9a8e
mov eax, dword [ebp + 0x4c]
dec dword [eax]
cmp dword [ebp - 0xa8], 0
je 0x4c9a2b
mov eax, dword [ebp - 0xa8]
mov byte [eax + 0x3d], 0
mov byte [ebp - 0x41], 1
mov eax, dword [ebp + 0x7c]
mov edx, dword [ebp - 0xa0]
sub dword [eax], edx
mov eax, dword [ebp + 0x78]
mov edx, dword [ebp - 0xb0]
mov dword [eax], edx
mov eax, dword [ebp + 0x74]
mov edx, dword [ebp - 0xb4]
mov dword [eax], edx
mov eax, dword [ebp + 0x24]
cmp byte [eax], 0
je 0x4c9a63
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x34]
call fcn.00405ec8
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 4]
call fcn.00405ec8
mov eax, dword [ebp + 0x6c]
mov edx, dword [ebp - 0xc8]
mov dword [eax], edx
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0xcc]
mov dword [eax + 0x18], edx
mov edx, dword [edi]
mov eax, 0x4ceb24
call fcn.0040698c
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jne 0x4c9b0a
mov eax, dword [edi]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x4c9ad2
mov eax, dword [ebp - 0x140]
sub eax, 0xa
cmp word [eax], 2
je 0x4c9ad2
mov edx, dword [edi]
mov eax, edi
call fcn.0040563c
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
je 0x4c9af8
mov eax, dword [ebp - 0x144]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jg 0x4c9b0a
mov eax, edi
xor edx, edx
call fcn.00405ec8
cmp byte [ebp - 0x41], 0
jne 0x4ce97a
cmp dword [ebp - 0x78], 1
jne 0x4ce97a
mov eax, dword [edi]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
je 0x4c9b4d
mov eax, dword [ebp - 0x148]
sub eax, 0xa
cmp word [eax], 2
je 0x4c9b4d
mov edx, dword [edi]
mov eax, edi
call fcn.0040563c
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
je 0x4c9b73
mov eax, dword [ebp - 0x14c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jle 0x4ce97a
mov eax, dword [edi]
cmp word [eax + 2], 0x2f
jne 0x4c9bee
mov eax, dword [edi]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
je 0x4c9bb8
mov eax, dword [ebp - 0x150]
sub eax, 0xa
cmp word [eax], 2
je 0x4c9bb8
mov edx, dword [edi]
mov eax, edi
call fcn.0040563c
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
je 0x4c9bde
mov eax, dword [ebp - 0x154]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
setg byte [ebp - 0x155]
jmp 0x4c9bf5
mov byte [ebp - 0x155], 0
cmp byte [ebp - 0x155], 0
je 0x4ca3ac
mov eax, dword [edi]
movzx eax, word [eax + 4]
mov word [ebp - 0x158], ax
movzx eax, word [ebp - 0x158]
mov word [ebp - 0x15a], ax
movzx eax, word [ebp - 0x158]
add eax, 0xffffff9f
sub ax, 0x1a
jae 0x4c9c3f
movzx eax, word [ebp - 0x158]
and ax, 0xffdf
mov word [ebp - 0x15a], ax
movzx eax, word [ebp - 0x15a]
add eax, 0xffffffbf
cmp eax, 0x19
ja case.0x4ca3fc.67
jmp dword [eax*4 + 0x4c9c59]
mov eax, dword [ebp + 0x24]
cmp byte [eax], 0
je case.0x4ca3fc.67
cmp byte [ebp + 0x84], 0
jne 0x4c9d2f
mov eax, dword [ebp + 0x94]
cmp dword [eax - 0x4c], 0x1fffffff
jne 0x4c9cf4
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp 0x4c9d2f
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x4c]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x1fffffff
jne 0x4c9d1e
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp 0x4c9d2f
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x160]
call fcn.0043953c
mov eax, dword [ebp - 0x3c]
xor edx, edx
call fcn.00405ec8
mov eax, dword [ebp + 0x94]
cmp byte [eax + 0x58], 0
jne 0x4c9d64
mov eax, dword [ebp + 0x94]
cmp dword [eax + 0x74], 0
jl 0x4c9d81
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x74]
mov edx, dword [ebp + 0x58]
mov edx, dword [edx]
dec edx
cmp eax, edx
jne 0x4c9d81
cmp byte [ebp + 0x84], 0
jne 0x4c9d81
mov eax, dword [ebp + 0x94]
mov edx, dword [eax - 0x50]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438a10
cmp byte [ebp + 0x84], 0
jne 0x4c9dad
mov eax, dword [ebp + 0x94]
cmp byte [eax + 0x60], 0
jne 0x4c9dad
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x54]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438a10
cmp byte [ebp + 0x88], 0
je 0x4c9e60
mov eax, dword [ebp + 0x28]
cmp byte [eax], 0
je 0x4c9e3b
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x40c]
mov dword [eax - 0x58], edx
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
add eax, dword [ebp - 0x418]
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x5c], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x60]
cmp eax, dword [ebp - 0x414]
je 0x4c9e14
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x418]
mov dword [eax - 0x64], edx
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x414]
mov dword [eax - 0x60], edx
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx + 0x1c]
push edi
mov esi, eax
mov edi, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebp + 0x58]
mov eax, dword [eax]
dec eax
mov edx, dword [ebp + 0x54]
mov dword [edx], eax
mov eax, dword [ebp + 0x28]
mov byte [eax], 0
push 0
lea eax, [ebp - 0x490]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00408a00
mov eax, dword [ebp + 0x30]
push edi
lea esi, [ebp - 0x490]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebp + 0x58]
cmp dword [eax], 0
jle 0x4c9ebf
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x30]
call fcn.00425364
mov edx, dword [ebp + 0x58]
cmp eax, dword [edx]
jl 0x4c9ebf
mov edx, dword [ebp + 0x58]
mov edx, dword [edx]
dec edx
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x30]
call fcn.004d24cc
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xa8]
cmp dword [eax + 0x30], 0
jne 0x4c9ebf
movzx eax, byte [ebp - 0xb9]
mov byte [ebp + 0x80], al
mov eax, dword [ebp + 0x94]
cmp dword [eax + 0x78], 0
jl 0x4c9f37
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x78]
mov edx, dword [ebp + 0x58]
mov edx, dword [edx]
dec edx
cmp eax, edx
jne 0x4c9f37
cmp byte [ebp + 0x84], 0
jne 0x4c9f37
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x428]
mov dword [eax - 0x6c], edx
mov eax, dword [ebp + 0x60]
mov edx, dword [ebp - 0x41c]
sub edx, dword [eax]
mov eax, dword [ebp + 0x94]
mov dword [eax - 0x68], edx
mov eax, dword [ebp - 0x38]
call fcn.004c7650
mov edx, dword [ebp + 0x94]
mov edx, dword [edx - 0x68]
sub edx, eax
mov eax, dword [ebp + 0x94]
mov dword [eax - 0x70], edx
mov eax, dword [ebp + 0x94]
lea edx, [eax - 0x74]
mov eax, dword [ebp - 0x38]
call fcn.00439944
mov eax, dword [ebp + 0x94]
mov edx, dword [eax - 0x78]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp + 0x5c]
mov dword [eax], 0xffffffff
mov eax, dword [ebp + 0x24]
mov byte [eax], 0
cmp byte [ebp - 0xb8], 0
je case.0x4ca3fc.67
mov byte [ebp - 0xb8], 0
mov byte [ebp - 0x41], 0
movzx eax, byte [ebp - 0xb9]
mov byte [ebp + 0x80], al
jmp case.0x4ca3fc.67
cmp byte [ebp + 0x84], 0
jne case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x41], 0
jmp case.0x4ca3fc.67
mov eax, dword [edi]
cmp word [eax + 6], 0x3e
je 0x4c9fcd
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x54]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438a10
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dc0
movzx edx, byte [0x4cebd8]
not edx
and dl, al
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dcc
jmp case.0x4ca3fc.67
mov eax, dword [edi]
movzx eax, word [eax + 6]
mov word [ebp - 0x162], ax
movzx eax, word [ebp - 0x162]
mov word [ebp - 0x164], ax
movzx eax, word [ebp - 0x162]
add eax, 0xffffff9f
sub ax, 0x1a
jae 0x4ca030
movzx eax, word [ebp - 0x162]
and ax, 0xffdf
mov word [ebp - 0x164], ax
movzx eax, word [ebp - 0x164]
mov word [ebp - 0xa2], ax
cmp word [ebp - 0xa2], 0x54
jne 0x4ca06e
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dc0
movzx edx, byte [0x4cebdc]
not edx
and dl, al
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dcc
jmp case.0x4ca3fc.67
cmp word [ebp - 0xa2], 0x55
jne 0x4ca091
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x36], 0
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x35], 0
jmp case.0x4ca3fc.67
cmp word [ebp - 0xa2], 0x50
jne 0x4ca0e8
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x7c]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x1fffffff
jne 0x4ca0c5
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp 0x4ca0d6
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x168]
call fcn.0043953c
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp case.0x4ca3fc.67
cmp word [ebp - 0xa2], 0x48
jne 0x4ca101
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x39], 0
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dc0
movzx edx, byte [0x4cebdc]
not edx
and dl, al
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dcc
jmp case.0x4ca3fc.67
lea edx, [ebp - 0x494]
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x54]
call fcn.00438cd4
mov edx, dword [ebp - 0x494]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438d28
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x54]
call fcn.00438c94
mov edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438c9c
cmp byte [ebp + 0x84], 0
jne case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
cmp byte [eax + 0x60], 0
jne case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x54]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438a10
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x7c]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x1fffffff
jne 0x4ca1c8
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x16c]
call fcn.0043953c
jmp case.0x4ca3fc.67
cmp byte [ebp + 0x84], 0
jne case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
mov edx, dword [eax - 0x80]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438a10
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x84]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0x1fffffff
jne 0x4ca22f
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x170]
call fcn.0043953c
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dc0
movzx edx, byte [0x4cebe0]
not edx
and dl, al
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dcc
jmp case.0x4ca3fc.67
mov byte [ebp - 0x41], 1
jmp case.0x4ca3fc.67
mov eax, dword [edi]
cmp word [eax + 6], 0x3e
je 0x4ca29c
mov eax, dword [ebp + 0x50]
cmp dword [eax], 0
jle 0x4ca29c
mov eax, dword [ebp + 0x50]
dec dword [eax]
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x85], 0
jmp case.0x4ca3fc.67
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
jmp case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
movzx eax, byte [eax - 0x86]
mov edx, dword [ebp + 0x40]
mov byte [edx], al
mov byte [ebp - 0x41], 1
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x29], 0
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x34]
mov edx, 0x4cebf0
call fcn.004062dc
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x34]
cmp byte [ebp + 0x84], 0
jne case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
cmp byte [eax + 0x60], 0
jne case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x8c]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x1fffffff
jne 0x4ca331
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x174]
call fcn.0043953c
jmp case.0x4ca3fc.67
mov eax, dword [edi]
cmp word [eax + 6], 0x3e
je 0x4ca362
mov eax, dword [ebp + 0x50]
cmp dword [eax], 0
jle 0x4ca362
mov eax, dword [ebp + 0x50]
dec dword [eax]
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dc0
movzx edx, byte [0x4cebf8]
not edx
and dl, al
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dcc
jmp case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
push eax
mov eax, dword [ebp - 0x38]
call fcn.004c7734
pop ecx
jmp case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x37], 0
jmp case.0x4ca3fc.67
mov eax, dword [edi]
movzx eax, word [eax + 2]
mov word [ebp - 0x176], ax
movzx eax, word [ebp - 0x176]
mov word [ebp - 0x178], ax
movzx eax, word [ebp - 0x176]
add eax, 0xffffff9f
sub ax, 0x1a
jae 0x4ca3e9
movzx eax, word [ebp - 0x176]
and ax, 0xffdf
mov word [ebp - 0x178], ax
movzx eax, word [ebp - 0x178]
add eax, 0xffffffbf
cmp eax, 0x19
ja case.0x4ca3fc.67
jmp dword [eax*4 + 0x4ca403]
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x78]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0x94]
cmp dword [eax + 0x78], 0
jl 0x4ca4c2
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x78]
mov edx, dword [ebp + 0x58]
cmp eax, dword [edx]
jne 0x4ca4c2
cmp byte [ebp + 0x84], 0
jne 0x4ca4c2
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x428]
mov dword [eax - 0x74], edx
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x424]
mov dword [eax - 0x70], edx
cmp byte [ebp + 0x84], 0
jne 0x4ca506
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439694
cmp al, 1
jne 0x4ca4e6
mov dword [ebp - 0x17c], 0x1fffffff
jmp 0x4ca4f7
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439534
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x17c]
mov dword [eax - 0x4c], edx
mov eax, dword [ebp + 0x94]
cmp byte [eax + 0x58], 0
jne 0x4ca536
mov eax, dword [ebp + 0x94]
cmp dword [eax + 0x74], 0
jl 0x4ca5cb
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x74]
mov edx, dword [ebp + 0x58]
cmp eax, dword [edx]
jne 0x4ca5cb
cmp byte [ebp + 0x84], 0
jne 0x4ca5cb
mov eax, dword [ebp + 0x94]
cmp dword [eax + 0x44], 0x1fffffff
je 0x4ca596
cmp byte [ebp + 0x84], 0
jne 0x4ca596
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x44]
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0x1fffffff
jne 0x4ca585
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp 0x4ca596
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x180]
call fcn.0043953c
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x50], eax
mov eax, dword [ebp + 0x94]
cmp dword [eax + 0x40], 0x1fffffff
je 0x4ca5cb
mov eax, dword [ebp + 0x94]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438a10
mov eax, dword [ebp - 0x3c]
xor edx, edx
call fcn.00405ec8
mov eax, dword [ebp + 0x2c]
mov byte [eax], 1
mov edx, dword [edi]
mov eax, 0x4ceb34
call fcn.0040698c
inc eax
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x5c]
mov dword [eax], 0xffffffff
xor eax, eax
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp + 0x58]
cmp dword [eax], 0
jl 0x4ca800
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x30]
call fcn.00425364
mov edx, dword [ebp + 0x58]
cmp eax, dword [edx]
jle 0x4ca800
mov edx, dword [ebp + 0x58]
mov edx, dword [edx]
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x30]
call fcn.004d24cc
mov dword [ebp - 0xa8], eax
cmp byte [ebp + 0x84], 0
je 0x4ca719
cmp byte [ebp + 0x88], 0
jne 0x4ca75a
mov eax, dword [ebp - 0xa8]
mov byte [eax + 0x3d], 0
mov edx, dword [edi]
mov ecx, dword [ebp - 0x70]
mov eax, 0x4cec08
call fcn.0040a94c
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x4ca6d5
mov eax, dword [edi]
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0
je 0x4ca6a5
mov eax, dword [ebp - 0x184]
sub eax, 0xa
cmp word [eax], 2
je 0x4ca6a5
mov edx, dword [edi]
mov eax, edi
call fcn.0040563c
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
je 0x4ca6cb
mov eax, dword [ebp - 0x188]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0xa8]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp - 0x70]
mov eax, dword [edi]
mov edx, dword [ebp - 0x70]
call fcn.00406674
lea edx, [ebp - 0x498]
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + 0x40]
call fcn.004c74ec
mov edx, dword [ebp - 0x498]
mov eax, dword [ebp - 0xa8]
add eax, 0x40
call fcn.00405ec8
jmp 0x4ca75a
mov eax, dword [ebp - 0xa8]
cmp dword [eax + 0x20], 0x1fffffff
je 0x4ca75a
mov eax, dword [ebp - 0xa8]
cmp dword [eax + 0x20], 0x1fffffff
jne 0x4ca746
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp 0x4ca75a
mov eax, dword [ebp - 0xa8]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.0043953c
mov eax, dword [ebp - 0xa8]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp byte [ebp + 0x84], 0
jne 0x4ca7a7
mov eax, dword [ebp + 0x94]
cmp byte [eax + 0x58], 0
jne 0x4ca793
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x74]
mov edx, dword [ebp + 0x58]
cmp eax, dword [edx]
jne 0x4ca7a7
mov eax, dword [ebp - 0xa8]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp + 0x5c]
mov dword [edx], eax
mov eax, dword [ebp - 0xa8]
cmp dword [eax + 0x38], 0xffffd8f1
je 0x4ca7f1
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 0x70]
mov dword [edx], eax
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 0x6c]
mov dword [edx], eax
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0xc4], eax
jmp 0x4ca800
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x70]
sub ecx, 2
mov eax, dword [edi]
mov edx, 3
call fcn.00406674
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x24]
call fcn.0040c170
mov edx, dword [ebp - 0x20]
mov eax, 0x4cec20
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jle 0x4ca8e3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
je 0x4ca879
mov eax, dword [ebp - 0x190]
sub eax, 0xa
cmp word [eax], 2
je 0x4ca879
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
je 0x4ca89f
mov eax, dword [ebp - 0x194]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x194], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 7
mov ecx, dword [ebp - 0x194]
mov eax, dword [ebp - 0x20]
call fcn.00406674
lea edx, [ebp - 0x49c]
mov eax, dword [ebp - 0x28]
call fcn.004c7100
mov edx, dword [ebp - 0x49c]
lea eax, [ebp - 0x28]
call fcn.00405f1c
or edx, 0xffffffff
mov eax, dword [ebp - 0x28]
call fcn.0040d0e4
mov edx, dword [ebp + 0x5c]
mov dword [edx], eax
mov edx, dword [ebp - 0x20]
mov eax, 0x4cec3c
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jle 0x4ca9b1
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x24]
call fcn.00405f1c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x4ca946
mov eax, dword [ebp - 0x19c]
sub eax, 0xa
cmp word [eax], 2
je 0x4ca946
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
je 0x4ca96c
mov eax, dword [ebp - 0x1a0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1a0], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 4
mov ecx, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x20]
call fcn.00406674
lea edx, [ebp - 0x4a0]
mov eax, dword [ebp - 0x28]
call fcn.004c7100
mov edx, dword [ebp - 0x4a0]
lea eax, [ebp - 0x28]
call fcn.00405f1c
mov eax, dword [ebp + 0x94]
add eax, 0xffffffc0
mov edx, dword [ebp - 0x28]
call fcn.00405f1c
mov edx, dword [ebp - 0x20]
mov eax, 0x4cec54
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
jle 0x4caa81
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x24]
call fcn.00405f1c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
je 0x4caa14
mov eax, dword [ebp - 0x1a8]
sub eax, 0xa
cmp word [eax], 2
je 0x4caa14
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
je 0x4caa3a
mov eax, dword [ebp - 0x1ac]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1ac], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 5
mov ecx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x20]
call fcn.00406674
lea edx, [ebp - 0x4a4]
mov eax, dword [ebp - 0x28]
call fcn.004c7100
mov edx, dword [ebp - 0x4a4]
lea eax, [ebp - 0x28]
call fcn.00405f1c
mov eax, dword [ebp + 0x94]
add eax, 0xffffffd8
mov edx, dword [ebp - 0x28]
call fcn.00405f1c
jmp 0x4caa91
mov eax, dword [ebp + 0x94]
add eax, 0xffffffd8
xor edx, edx
call fcn.00405f1c
mov eax, dword [ebp + 0x24]
mov byte [eax], 1
cmp dword [ebp - 0xa8], 0
je 0x4caac3
mov eax, dword [ebp - 0xa8]
cmp byte [eax + 0x3c], 0
je 0x4caac3
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + 0x30]
sub eax, 2
jb 0x4caac3
mov eax, dword [ebp + 0x5c]
mov dword [eax], 1
mov eax, dword [ebp + 0x5c]
mov eax, dword [eax]
sub eax, 1
jb 0x4caad1
je 0x4caada
jmp 0x4caaf0
mov byte [ebp + 0x80], 0
jmp 0x4caaf0
mov eax, dword [ebp + 0x4c]
cmp dword [eax], 0
jne 0x4caaf0
mov byte [ebp + 0x80], 0
mov byte [ebp - 0xb8], 1
cmp byte [ebp + 0x88], 0
je 0x4cab4a
mov eax, dword [ebp - 0x414]
push eax
lea eax, [ebp - 0x490]
push eax
mov ecx, dword [ebp + 0x7c]
mov ecx, dword [ecx]
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x414]
call fcn.00408a00
mov eax, dword [ebp + 0x30]
push edi
lea esi, [ebp - 0x490]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x64], eax
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x414]
mov dword [eax - 0x60], edx
mov eax, dword [ebp + 0x58]
inc dword [eax]
jmp case.0x4ca3fc.67
mov eax, dword [edi]
movzx eax, word [eax + 4]
mov word [ebp - 0x1ae], ax
movzx eax, word [ebp - 0x1ae]
mov word [ebp - 0x1b0], ax
movzx eax, word [ebp - 0x1ae]
add eax, 0xffffff9f
sub ax, 0x1a
jae 0x4cab91
movzx eax, word [ebp - 0x1ae]
and ax, 0xffdf
mov word [ebp - 0x1b0], ax
movzx eax, word [ebp - 0x1b0]
mov word [ebp - 0xa2], ax
movzx eax, word [ebp - 0xa2]
sub ax, 0x3e
je 0x4cabcb
sub ax, 0xe
je 0x4cad9f
sub ax, 3
je 0x4cadcb
sub ax, 3
je 0x4cabee
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dc0
mov edx, eax
or dl, byte [0x4cebd8]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dcc
jmp case.0x4ca3fc.67
mov byte [ebp - 0x41], 1
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x34]
mov edx, 0x4cebf0
call fcn.004062dc
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x34]
mov eax, dword [edi]
mov dword [ebp - 0x1b4], eax
mov edx, dword [ebp - 0x1b4]
mov eax, 0x4ceb34
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jle 0x4cad27
lea eax, [ebp - 0x4a8]
push eax
mov ecx, dword [ebp - 0x78]
sub ecx, 4
mov eax, dword [edi]
mov edx, 4
call fcn.00406674
mov eax, dword [ebp - 0x4a8]
lea edx, [ebp - 0x20]
call fcn.0040c170
mov edx, dword [ebp - 0x20]
mov eax, 0x4cec6c
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
jle 0x4cad27
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
je 0x4cacbe
mov eax, dword [ebp - 0x1c0]
sub eax, 0xa
cmp word [eax], 2
je 0x4cacbe
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
je 0x4cace4
mov eax, dword [ebp - 0x1c4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c4], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 9
mov ecx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x20]
call fcn.00406674
lea edx, [ebp - 0x4ac]
mov eax, dword [ebp - 0x28]
call fcn.004c7100
mov edx, dword [ebp - 0x4ac]
lea eax, [ebp - 0x28]
call fcn.00405f1c
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.0040d0e4
mov edx, dword [ebp + 0x70]
mov dword [edx], eax
cmp dword [ebp - 0x9c], 0
sete al
and al, byte [ebp - 0xb7]
je case.0x4ca3fc.67
mov eax, dword [ebp + 0x78]
mov edx, dword [ebp - 0x50]
mov dword [eax], edx
mov eax, dword [ebp + 0x74]
mov edx, dword [ebp - 0x4c]
mov dword [eax], edx
mov eax, dword [ebp + 0x4c]
inc dword [eax]
cmp byte [ebp + 0x84], 0
je case.0x4ca3fc.67
cmp byte [ebp + 0x88], 0
jne case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x14]
cmp byte [eax], 0
je case.0x4ca3fc.67
mov eax, dword [ebp + 0x48]
cmp dword [eax], 0
jle case.0x4ca3fc.67
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp + 0x48]
cmp eax, dword [edx]
je 0x4c8b62
jmp case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
cmp byte [eax + 0x5c], 0
jne case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
mov edx, dword [eax - 0x90]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438a10
jmp case.0x4ca3fc.67
lea eax, [ebp - 0x4b0]
push eax
mov edx, dword [edi]
mov eax, 0x4ceb34
call fcn.0040698c
mov ecx, eax
mov eax, dword [edi]
mov edx, 1
call fcn.00406674
mov edx, dword [ebp - 0x4b0]
lea eax, [ebp - 0x14]
call fcn.004062dc
cmp byte [ebp + 0x84], 0
jne case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
cmp byte [eax + 0x60], 0
jne case.0x4ca3fc.67
lea eax, [ebp - 0x4b4]
push eax
mov edx, dword [edi]
mov eax, 0x4ceb34
call fcn.0040698c
mov ecx, eax
dec ecx
mov eax, dword [edi]
mov edx, 6
call fcn.00406674
mov eax, dword [ebp - 0x4b4]
lea edx, [ebp - 0x20]
call fcn.0040c170
mov edx, dword [ebp - 0x20]
mov eax, 0x4cec8c
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jle 0x4cb289
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
je 0x4cae9f
mov eax, dword [ebp - 0x1cc]
sub eax, 0xa
cmp word [eax], 2
je 0x4cae9f
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
je 0x4caec5
mov eax, dword [ebp - 0x1d0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1d0], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 0xa
mov ecx, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x20]
call fcn.00406674
lea edx, [ebp - 0x4b8]
mov eax, dword [ebp - 0x28]
call fcn.004c7100
mov edx, dword [ebp - 0x4b8]
lea eax, [ebp - 0x28]
call fcn.00405f1c
lea edx, [ebp - 0x4bc]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x4bc]
mov eax, 0x4cecb0
call fcn.0040698c
test eax, eax
jle 0x4caf2d
lea eax, [ebp - 0x28]
mov ecx, 4
mov edx, 1
call fcn.00406744
lea edx, [ebp - 0x4c0]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x4c0]
mov eax, 0x4cecc8
call fcn.0040698c
test eax, eax
jle 0x4cb027
lea eax, [ebp - 0x28]
mov ecx, 5
mov edx, 1
call fcn.00406744
mov eax, dword [ebp - 0x28]
push eax
push 0
movzx eax, byte [ebp + 0x84]
xor al, 1
push eax
mov eax, dword [ebp + 0x94]
movzx eax, byte [eax + 0x64]
push eax
mov eax, dword [ebp + 0x94]
push dword [eax + 0x4c]
push dword [eax + 0x48]
lea eax, [ebp - 0x4c8]
push eax
mov ecx, dword [ebp - 0x424]
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x38]
call fcn.004c69f0
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x4c8]
mov dword [eax - 0x98], edx
mov edx, dword [ebp - 0x4c4]
mov dword [eax - 0x94], edx
push 0x60
push 0x58
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_GetDeviceCaps
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x98]
push eax
call sub.kernel32.dll_MulDiv
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x98], eax
push 0x60
push 0x5a
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_GetDeviceCaps
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x94]
push eax
call sub.kernel32.dll_MulDiv
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x94], eax
lea edx, [ebp - 0x4cc]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x4cc]
mov eax, 0x4cece0
call fcn.0040698c
test eax, eax
jle 0x4cb121
lea eax, [ebp - 0x28]
mov ecx, 5
mov edx, 1
call fcn.00406744
mov eax, dword [ebp - 0x28]
push eax
push 1
movzx eax, byte [ebp + 0x84]
xor al, 1
push eax
mov eax, dword [ebp + 0x94]
movzx eax, byte [eax + 0x64]
push eax
mov eax, dword [ebp + 0x94]
push dword [eax + 0x4c]
push dword [eax + 0x48]
lea eax, [ebp - 0x4c8]
push eax
mov ecx, dword [ebp - 0x424]
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x38]
call fcn.004c69f0
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x4c8]
mov dword [eax - 0x98], edx
mov edx, dword [ebp - 0x4c4]
mov dword [eax - 0x94], edx
push 0x60
push 0x58
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_GetDeviceCaps
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x98]
push eax
call sub.kernel32.dll_MulDiv
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x98], eax
push 0x60
push 0x5a
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_GetDeviceCaps
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x94]
push eax
call sub.kernel32.dll_MulDiv
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x94], eax
xor eax, eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x4cb289
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x20]
test al, al
jne 0x4cb289
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x30]
test eax, eax
jle 0x4cb289
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x24]
test eax, eax
jle 0x4cb289
xor eax, eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_CreateRectRgn
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x9c], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x9c]
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_SelectClipRgn
jmp 0x4cb240
xor eax, eax
mov dword [ebp - 0x60], eax
jmp 0x4cb213
mov eax, dword [ebp - 0x80]
push eax
mov eax, dword [ebp + 0x94]
mov ecx, dword [eax + 0x8c]
mov ecx, dword [ecx + 4]
add ecx, dword [ebp - 0x64]
mov eax, dword [ebp + 0x94]
mov edx, dword [eax + 0x8c]
mov edx, dword [edx]
add edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x38]
call fcn.00439898
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x30]
add dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx + 0x8c]
sub eax, dword [edx]
cmp eax, dword [ebp - 0x60]
jg 0x4cb1d9
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x24]
add dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx + 0x8c]
sub eax, dword [edx + 4]
cmp eax, dword [ebp - 0x64]
jg 0x4cb1d2
push 0
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_SelectClipRgn
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x9c]
push eax
call sub.gdi32.dll_DeleteObject
mov edx, dword [ebp - 0x20]
mov eax, 0x4cecf8
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jle 0x4cb74a
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0
je 0x4cb2e1
mov eax, dword [ebp - 0x1d8]
sub eax, 0xa
cmp word [eax], 2
je 0x4cb2e1
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
je 0x4cb307
mov eax, dword [ebp - 0x1dc]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1dc], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 0xa
mov ecx, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
je 0x4cb351
mov eax, dword [ebp - 0x1e0]
sub eax, 0xa
cmp word [eax], 2
je 0x4cb351
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
call fcn.0040563c
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0
je 0x4cb377
mov eax, dword [ebp - 0x1e4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1e4], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov edx, eax
inc edx
mov ecx, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x28]
call fcn.00406674
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x28]
call fcn.00406674
lea edx, [ebp - 0x4d0]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x4d0]
mov eax, 0x4cecb0
call fcn.0040698c
test eax, eax
jle 0x4cb3ee
lea eax, [ebp - 0x28]
mov ecx, 4
mov edx, 1
call fcn.00406744
lea edx, [ebp - 0x4d4]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x4d4]
mov eax, 0x4cecc8
call fcn.0040698c
test eax, eax
jle 0x4cb4e8
lea eax, [ebp - 0x28]
mov ecx, 5
mov edx, 1
call fcn.00406744
mov eax, dword [ebp - 0x28]
push eax
push 0
movzx eax, byte [ebp + 0x84]
xor al, 1
push eax
mov eax, dword [ebp + 0x94]
movzx eax, byte [eax + 0x64]
push eax
mov eax, dword [ebp + 0x94]
push dword [eax + 0x4c]
push dword [eax + 0x48]
lea eax, [ebp - 0x4c8]
push eax
mov ecx, dword [ebp - 0x424]
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x38]
call fcn.004c69f0
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x4c8]
mov dword [eax - 0x98], edx
mov edx, dword [ebp - 0x4c4]
mov dword [eax - 0x94], edx
push 0x60
push 0x58
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_GetDeviceCaps
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x98]
push eax
call sub.kernel32.dll_MulDiv
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x98], eax
push 0x60
push 0x5a
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_GetDeviceCaps
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x94]
push eax
call sub.kernel32.dll_MulDiv
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x94], eax
lea edx, [ebp - 0x4d8]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x4d8]
mov eax, 0x4cece0
call fcn.0040698c
test eax, eax
jle 0x4cb5e2
lea eax, [ebp - 0x28]
mov ecx, 5
mov edx, 1
call fcn.00406744
mov eax, dword [ebp - 0x28]
push eax
push 1
movzx eax, byte [ebp + 0x84]
xor al, 1
push eax
mov eax, dword [ebp + 0x94]
movzx eax, byte [eax + 0x64]
push eax
mov eax, dword [ebp + 0x94]
push dword [eax + 0x4c]
push dword [eax + 0x48]
lea eax, [ebp - 0x4c8]
push eax
mov ecx, dword [ebp - 0x424]
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x38]
call fcn.004c69f0
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x4c8]
mov dword [eax - 0x98], edx
mov edx, dword [ebp - 0x4c4]
mov dword [eax - 0x94], edx
push 0x60
push 0x58
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_GetDeviceCaps
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x98]
push eax
call sub.kernel32.dll_MulDiv
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x98], eax
push 0x60
push 0x5a
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_GetDeviceCaps
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x94]
push eax
call sub.kernel32.dll_MulDiv
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x94], eax
xor eax, eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x4cb74a
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x20]
test al, al
jne 0x4cb74a
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x30]
test eax, eax
jle 0x4cb74a
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x24]
test eax, eax
jle 0x4cb74a
xor eax, eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_CreateRectRgn
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x9c], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x9c]
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_SelectClipRgn
jmp 0x4cb701
xor eax, eax
mov dword [ebp - 0x60], eax
jmp 0x4cb6d4
mov eax, dword [ebp - 0x80]
push eax
mov eax, dword [ebp + 0x94]
mov ecx, dword [eax + 0x8c]
mov ecx, dword [ecx + 4]
add ecx, dword [ebp - 0x64]
mov eax, dword [ebp + 0x94]
mov edx, dword [eax + 0x8c]
mov edx, dword [edx]
add edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x38]
call fcn.00439898
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x30]
add dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx + 0x8c]
sub eax, dword [edx]
cmp eax, dword [ebp - 0x60]
jg 0x4cb69a
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x24]
add dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx + 0x8c]
sub eax, dword [edx + 4]
cmp eax, dword [ebp - 0x64]
jg 0x4cb693
push 0
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_SelectClipRgn
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x9c]
push eax
call sub.gdi32.dll_DeleteObject
mov edx, dword [ebp - 0x20]
mov eax, 0x4ced28
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
jle 0x4cba87
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0
je 0x4cb7a2
mov eax, dword [ebp - 0x1ec]
sub eax, 0xa
cmp word [eax], 2
je 0x4cb7a2
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
je 0x4cb7c8
mov eax, dword [ebp - 0x1f0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1f0], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 0xa
mov ecx, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0
je 0x4cb812
mov eax, dword [ebp - 0x1f4]
sub eax, 0xa
cmp word [eax], 2
je 0x4cb812
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
call fcn.0040563c
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
je 0x4cb838
mov eax, dword [ebp - 0x1f8]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1f8], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov edx, eax
inc edx
mov ecx, dword [ebp - 0x1f8]
mov eax, dword [ebp - 0x28]
call fcn.00406674
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x28]
call fcn.00406674
lea edx, [ebp - 0x4dc]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x4dc]
mov eax, 0x4cecb0
call fcn.0040698c
test eax, eax
jle 0x4cb8af
lea eax, [ebp - 0x28]
mov ecx, 4
mov edx, 1
call fcn.00406744
lea edx, [ebp - 0x4e0]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x4e0]
mov eax, 0x4cecc8
call fcn.0040698c
test eax, eax
jle 0x4cb8e3
lea eax, [ebp - 0x28]
mov ecx, 5
mov edx, 1
call fcn.00406744
lea edx, [ebp - 0x4e4]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x4e4]
mov eax, 0x4cece0
call fcn.0040698c
test eax, eax
jle 0x4cb917
lea eax, [ebp - 0x28]
mov ecx, 5
mov edx, 1
call fcn.00406744
xor eax, eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x4cba87
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x20]
test al, al
jne 0x4cba87
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x30]
test eax, eax
jle 0x4cba87
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x24]
test eax, eax
jle 0x4cba87
xor eax, eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_CreateRectRgn
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x9c], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x9c]
push eax
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_SelectClipRgn
jmp 0x4cba3e
xor eax, eax
mov dword [ebp - 0x60], eax
jmp 0x4cba11
mov eax, dword [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x30]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx + 0x8c]
mov edx, dword [edx + 8]
sub edx, eax
mov eax, dword [ebp + 0x94]
mov ecx, dword [eax + 0x8c]
mov ecx, dword [ecx + 4]
add ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x38]
call fcn.00439898
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x30]
add dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx + 0x8c]
sub eax, dword [edx]
cmp eax, dword [ebp - 0x60]
jg 0x4cb9cf
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
call dword [edx + 0x24]
add dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx + 0x8c]
sub eax, dword [edx + 4]
cmp eax, dword [ebp - 0x64]
jg 0x4cb9c8
push 0
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_SelectClipRgn
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x9c]
push eax
call sub.gdi32.dll_DeleteObject
mov edx, dword [ebp - 0x20]
mov eax, 0x4ced4c
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jle case.0x4ca3fc.67
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0
je 0x4cbadf
mov eax, dword [ebp - 0x200]
sub eax, 0xa
cmp word [eax], 2
je 0x4cbadf
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
je 0x4cbb05
mov eax, dword [ebp - 0x204]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x204], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 7
mov ecx, dword [ebp - 0x204]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov edx, 0x1fffffff
mov eax, dword [ebp - 0x28]
call fcn.004c7274
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x20]
mov eax, 0x4ced68
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jle 0x4cbdb3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x4cbb88
mov eax, dword [ebp - 0x20c]
sub eax, 0xa
cmp word [eax], 2
je 0x4cbb88
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x4cbbae
mov eax, dword [ebp - 0x210]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 9
mov ecx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov edx, 0x1fffffff
mov eax, dword [ebp - 0x28]
call fcn.004c7274
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x28]
mov edx, 0x4ced88
call fcn.00405f1c
mov edx, dword [ebp - 0x20]
mov eax, 0x4ced98
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jle 0x4cbd17
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x4cbc3e
mov eax, dword [ebp - 0x218]
sub eax, 0xa
cmp word [eax], 2
je 0x4cbc3e
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x4cbc64
mov eax, dword [ebp - 0x21c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 3
mov ecx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x4cbcae
mov eax, dword [ebp - 0x220]
sub eax, 0xa
cmp word [eax], 2
je 0x4cbcae
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
call fcn.0040563c
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x4cbcd4
mov eax, dword [ebp - 0x224]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov edx, eax
inc edx
mov ecx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x28]
call fcn.00406674
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x28]
call fcn.00406674
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x88]
call fcn.00439184
push 0x1fffffff
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 0xc]
push eax
lea eax, [ebp - 0x490]
push eax
mov eax, dword [ebp + 0x94]
mov ecx, dword [eax + 0x8c]
mov ecx, dword [ecx + 8]
mov eax, dword [ebp + 0x94]
mov edx, dword [eax + 0x8c]
mov edx, dword [edx + 4]
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax]
call fcn.00408a00
lea eax, [ebp - 0x490]
push eax
mov eax, dword [ebp - 0x28]
mov edx, 0x4ced88
call fcn.0040666c
sete al
push eax
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x38]
call fcn.004c6c24
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439694
cmp al, 1
jne 0x4cbdce
mov dword [ebp - 0x228], 0x1fffffff
jmp 0x4cbddf
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439534
mov dword [ebp - 0x228], eax
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x228]
mov dword [eax - 0x7c], edx
cmp dword [ebp - 0x88], 0x1fffffff
jne 0x4cbe09
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp 0x4cbe1a
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x88]
call fcn.0043953c
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
call fcn.0043917c
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x88]
call fcn.00439184
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp + 0x94]
mov ecx, dword [eax + 0x8c]
mov ecx, dword [ecx + 4]
mov eax, dword [ebp + 0x94]
mov edx, dword [eax + 0x8c]
mov edx, dword [edx]
sub edx, 2
mov eax, dword [ebp - 0x38]
call fcn.00439acc
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0xc0]
call fcn.00439184
jmp case.0x4ca3fc.67
cmp byte [ebp + 0x84], 0
jne case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x41], 1
jmp case.0x4ca3fc.67
mov eax, dword [edi]
movzx eax, word [eax + 4]
mov word [ebp - 0x22a], ax
movzx eax, word [ebp - 0x22a]
mov word [ebp - 0x22c], ax
movzx eax, word [ebp - 0x22a]
add eax, 0xffffff9f
sub ax, 0x1a
jae 0x4cbef3
movzx eax, word [ebp - 0x22a]
and ax, 0xffdf
mov word [ebp - 0x22c], ax
movzx eax, word [ebp - 0x22c]
sub ax, 0x49
je 0x4cc06f
sub ax, 9
jne case.0x4ca3fc.67
mov byte [ebp - 0x41], 1
cmp byte [ebp + 0x84], 0
jne case.0x4ca3fc.67
lea eax, [ebp - 0x20]
push eax
mov edx, dword [edi]
mov eax, 0x4ceb34
call fcn.0040698c
mov ecx, eax
dec ecx
mov eax, dword [edi]
mov edx, 4
call fcn.00406674
xor eax, eax
mov dword [ebp - 0x88], eax
lea edx, [ebp - 0x4e8]
mov eax, dword [ebp - 0x20]
call fcn.0040c170
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x230], eax
mov edx, dword [ebp - 0x230]
mov eax, 0x4cedac
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jle 0x4cc00d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x4cbfbb
mov eax, dword [ebp - 0x238]
sub eax, 0xa
cmp word [eax], 2
je 0x4cbfbb
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x4cbfe1
mov eax, dword [ebp - 0x23c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 5
mov ecx, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x28]
call fcn.004c7274
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
call fcn.0043917c
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x88]
call fcn.00439184
mov ecx, dword [ebp - 0x41c]
inc ecx
mov edx, dword [ebp - 0x418]
mov eax, dword [ebp - 0x38]
call fcn.00439a64
mov ecx, dword [ebp - 0x41c]
inc ecx
mov edx, dword [ebp - 0x410]
mov eax, dword [ebp - 0x38]
call fcn.00439a04
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0xc0]
call fcn.00439184
jmp case.0x4ca3fc.67
cmp byte [ebp + 0x84], 0
jne case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x80], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439694
cmp al, 1
jne 0x4cc0a9
mov dword [ebp - 0x240], 0x1fffffff
jmp 0x4cc0ba
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439534
mov dword [ebp - 0x240], eax
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x240]
mov dword [eax - 0x84], edx
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov edx, 0xff00000d
call fcn.0043953c
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov edx, 0xff00000e
call fcn.00438a10
jmp case.0x4ca3fc.67
mov eax, dword [edi]
movzx eax, word [eax + 4]
mov word [ebp - 0x242], ax
movzx eax, word [ebp - 0x242]
mov word [ebp - 0x244], ax
movzx eax, word [ebp - 0x242]
add eax, 0xffffff9f
sub ax, 0x1a
jae 0x4cc12e
movzx eax, word [ebp - 0x242]
and ax, 0xffdf
mov word [ebp - 0x244], ax
movzx eax, word [ebp - 0x244]
mov word [ebp - 0xa2], ax
cmp word [ebp - 0xa2], 0x3e
jne 0x4cc169
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dc0
mov edx, eax
or dl, byte [0x4cebe0]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dcc
jmp case.0x4ca3fc.67
cmp word [ebp - 0xa2], 0x4e
jne 0x4cc2f7
lea eax, [ebp - 0x20]
push eax
mov edx, dword [edi]
mov eax, 0x4ceb34
call fcn.0040698c
mov ecx, eax
dec ecx
mov eax, dword [edi]
mov edx, 3
call fcn.00406674
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
je 0x4cc1c8
mov eax, dword [ebp - 0x248]
sub eax, 0xa
cmp word [eax], 2
je 0x4cc1c8
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
je 0x4cc1ee
mov eax, dword [ebp - 0x24c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x20]
mov eax, 0x4cedc4
call fcn.004c6e84
mov edx, eax
add edx, 2
mov ecx, dword [ebp - 0x24c]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
je 0x4cc244
mov eax, dword [ebp - 0x250]
sub eax, 0xa
cmp word [eax], 2
je 0x4cc244
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
call fcn.0040563c
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
je 0x4cc26a
mov eax, dword [ebp - 0x254]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov edx, eax
inc edx
mov ecx, dword [ebp - 0x254]
mov eax, dword [ebp - 0x28]
call fcn.00406674
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x28]
call fcn.00406674
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 0x28]
call fcn.00403728
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x5c], 0
jne case.0x4ca3fc.67
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x58]
jge case.0x4ca3fc.67
mov eax, dword [ebp + 0x7c]
mov edx, dword [ebp - 0x58]
mov dword [eax], edx
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax]
add eax, dword [ebp - 0x58]
mov dword [ebp - 0x428], eax
jmp case.0x4ca3fc.67
cmp word [ebp - 0xa2], 0x4d
jne case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
inc dword [eax - 0xa0]
lea eax, [ebp - 0x20]
push eax
mov edx, dword [edi]
mov eax, 0x4ceb34
call fcn.0040698c
mov ecx, eax
dec ecx
mov eax, dword [edi]
mov edx, 3
call fcn.00406674
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
je 0x4cc362
mov eax, dword [ebp - 0x258]
sub eax, 0xa
cmp word [eax], 2
je 0x4cc362
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
je 0x4cc388
mov eax, dword [ebp - 0x25c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x4ec]
mov eax, dword [ebp - 0x20]
call fcn.0040c170
mov edx, dword [ebp - 0x4ec]
mov eax, 0x4cedd4
call fcn.0040698c
mov edx, eax
add edx, 4
mov ecx, dword [ebp - 0x25c]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
je 0x4cc3ef
mov eax, dword [ebp - 0x260]
sub eax, 0xa
cmp word [eax], 2
je 0x4cc3ef
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
call fcn.0040563c
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
je 0x4cc415
mov eax, dword [ebp - 0x264]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov edx, eax
inc edx
mov ecx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x28]
call fcn.00406674
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x28]
call fcn.00406674
lea edx, [ebp - 0x4f0]
mov eax, dword [ebp - 0x20]
call fcn.0040c170
mov edx, dword [ebp - 0x4f0]
lea eax, [ebp - 0x20]
call fcn.00405f1c
mov edx, dword [ebp - 0x20]
mov eax, 0x4cede8
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jle 0x4cc5c3
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0xa4]
mov edx, dword [ebp + 0x94]
cmp eax, dword [edx - 0xa0]
jne 0x4cc5c3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
je 0x4cc4ea
mov eax, dword [ebp - 0x26c]
sub eax, 0xa
cmp word [eax], 2
je 0x4cc4ea
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
je 0x4cc510
mov eax, dword [ebp - 0x270]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [ebp - 0x78]
add edx, 4
mov ecx, dword [ebp - 0x270]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0
je 0x4cc55a
mov eax, dword [ebp - 0x274]
sub eax, 0xa
cmp word [eax], 2
je 0x4cc55a
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
call fcn.0040563c
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
je 0x4cc580
mov eax, dword [ebp - 0x278]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [ebp - 0x2c]
mov eax, 0x4ced18
call fcn.0040698c
mov edx, eax
inc edx
mov ecx, dword [ebp - 0x278]
mov eax, dword [ebp - 0x2c]
call fcn.00406674
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [ebp - 0x2c]
mov eax, 0x4ced18
call fcn.0040698c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x2c]
call fcn.00406674
xor eax, eax
mov dword [ebp - 0x90], eax
xor eax, eax
mov dword [ebp - 0x94], eax
mov edx, dword [ebp - 0x20]
mov eax, 0x4cedfc
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
jle 0x4cc696
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
je 0x4cc62b
mov eax, dword [ebp - 0x280]
sub eax, 0xa
cmp word [eax], 2
je 0x4cc62b
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0
je 0x4cc651
mov eax, dword [ebp - 0x284]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x284], eax
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [ebp - 0x78]
add edx, 6
mov ecx, dword [ebp - 0x284]
mov eax, dword [ebp - 0x20]
call fcn.00406674
lea edx, [ebp - 0x4f4]
mov eax, dword [ebp - 0x2c]
call fcn.004c7100
mov edx, dword [ebp - 0x4f4]
lea eax, [ebp - 0x2c]
call fcn.00405f1c
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 0x2c]
call fcn.00403728
mov dword [ebp - 0x90], eax
mov edx, dword [ebp - 0x20]
mov eax, 0x4cee14
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0
jle 0x4cc759
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x4cc6ee
mov eax, dword [ebp - 0x28c]
sub eax, 0xa
cmp word [eax], 2
je 0x4cc6ee
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0
je 0x4cc714
mov eax, dword [ebp - 0x290]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x290], eax
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [ebp - 0x78]
add edx, 7
mov ecx, dword [ebp - 0x290]
mov eax, dword [ebp - 0x20]
call fcn.00406674
lea edx, [ebp - 0x4f8]
mov eax, dword [ebp - 0x2c]
call fcn.004c7100
mov edx, dword [ebp - 0x4f8]
lea eax, [ebp - 0x2c]
call fcn.00405f1c
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 0x2c]
call fcn.00403728
mov dword [ebp - 0x94], eax
mov eax, dword [ebp + 0x94]
xor edx, edx
mov dword [eax - 0x98], edx
mov eax, dword [ebp + 0x94]
xor edx, edx
mov dword [eax - 0x94], edx
lea edx, [ebp - 0x4fc]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x4fc]
mov eax, 0x4cecb0
call fcn.0040698c
test eax, eax
jle 0x4cc7a9
lea eax, [ebp - 0x28]
mov ecx, 4
mov edx, 1
call fcn.00406744
lea edx, [ebp - 0x500]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x500]
mov eax, 0x4cecc8
call fcn.0040698c
test eax, eax
jle 0x4cc8a3
lea eax, [ebp - 0x28]
mov ecx, 5
mov edx, 1
call fcn.00406744
mov eax, dword [ebp - 0x28]
push eax
push 0
movzx eax, byte [ebp + 0x84]
xor al, 1
push eax
mov eax, dword [ebp + 0x94]
movzx eax, byte [eax + 0x64]
push eax
mov eax, dword [ebp + 0x94]
push dword [eax + 0x4c]
push dword [eax + 0x48]
lea eax, [ebp - 0x4c8]
push eax
mov ecx, dword [ebp - 0x424]
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x38]
call fcn.004c69f0
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x4c8]
mov dword [eax - 0x98], edx
mov edx, dword [ebp - 0x4c4]
mov dword [eax - 0x94], edx
push 0x60
push 0x58
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_GetDeviceCaps
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x98]
push eax
call sub.kernel32.dll_MulDiv
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x98], eax
push 0x60
push 0x5a
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_GetDeviceCaps
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x94]
push eax
call sub.kernel32.dll_MulDiv
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x94], eax
lea edx, [ebp - 0x504]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x504]
mov eax, 0x4cece0
call fcn.0040698c
test eax, eax
jle 0x4cc99d
lea eax, [ebp - 0x28]
mov ecx, 5
mov edx, 1
call fcn.00406744
mov eax, dword [ebp - 0x28]
push eax
push 1
movzx eax, byte [ebp + 0x84]
xor al, 1
push eax
mov eax, dword [ebp + 0x94]
movzx eax, byte [eax + 0x64]
push eax
mov eax, dword [ebp + 0x94]
push dword [eax + 0x4c]
push dword [eax + 0x48]
lea eax, [ebp - 0x4c8]
push eax
mov ecx, dword [ebp - 0x424]
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x38]
call fcn.004c69f0
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x4c8]
mov dword [eax - 0x98], edx
mov edx, dword [ebp - 0x4c4]
mov dword [eax - 0x94], edx
push 0x60
push 0x58
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_GetDeviceCaps
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x98]
push eax
call sub.kernel32.dll_MulDiv
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x98], eax
push 0x60
push 0x5a
mov eax, dword [ebp - 0x38]
call fcn.00439e88
push eax
call sub.gdi32.dll_GetDeviceCaps
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x94]
push eax
call sub.kernel32.dll_MulDiv
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x94], eax
mov eax, dword [ebp + 0x38]
sub eax, dword [ebp - 0x418]
mov edx, dword [ebp + 0x7c]
cmp eax, dword [edx]
jle 0x4cca55
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
mov edx, dword [ebp + 0x94]
add eax, dword [edx - 0x98]
mov edx, dword [ebp + 0x38]
sub edx, dword [ebp - 0x418]
cmp eax, edx
jle 0x4cca55
mov eax, dword [ebp + 0x34]
cmp eax, dword [ebp - 0x424]
jl 0x4cca55
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x94]
add eax, dword [ebp - 0x424]
cmp eax, dword [ebp + 0x34]
jle 0x4cca55
mov eax, dword [ebp + 0x24]
cmp byte [eax], 0
je 0x4cca55
mov eax, dword [ebp + 0x1c]
mov byte [eax], 1
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx - 0x40]
call fcn.00405ec8
mov eax, dword [ebp + 0x94]
cmp dword [eax - 0x28], 0
je 0x4cca3d
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp + 0x94]
mov edx, dword [edx - 0x28]
call fcn.00405ec8
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0xa0]
mov edx, dword [ebp + 0x94]
mov dword [edx - 0xa4], eax
mov eax, dword [ebp + 0x94]
cmp byte [eax + 0x64], 0
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
mov edx, dword [ebp + 0x94]
add eax, dword [edx - 0x98]
mov edx, dword [ebp - 0x410]
sub edx, dword [ebp - 0x418]
cmp eax, edx
jle 0x4ccaa0
mov eax, dword [ebp - 0x410]
sub eax, dword [ebp - 0x418]
mov edx, dword [ebp + 0x94]
cmp eax, dword [edx - 0x98]
jle 0x4ccaa0
mov byte [ebp - 0x42], 1
jmp 0x4ccae7
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x98]
mov edx, dword [ebp + 0x7c]
add dword [edx], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x98]
add dword [ebp - 0x428], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x94]
mov edx, dword [ebp + 0x78]
cmp eax, dword [edx]
jle 0x4ccae7
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x94]
mov edx, dword [ebp + 0x78]
mov dword [edx], eax
mov edx, dword [ebp - 0x20]
mov eax, 0x4cee30
call fcn.0040698c
test eax, eax
jle 0x4ccb46
mov edx, dword [ebp - 0x20]
mov eax, 0x4cee48
call fcn.0040698c
test eax, eax
jle 0x4ccb1f
mov eax, dword [ebp - 0x38]
call fcn.004c7650
mov edx, dword [ebp + 0x78]
mov edx, dword [edx]
sub edx, eax
mov eax, dword [ebp + 0x60]
mov dword [eax], edx
jmp 0x4ccb46
mov edx, dword [ebp - 0x20]
mov eax, 0x4cee60
call fcn.0040698c
test eax, eax
jle 0x4ccb46
mov eax, dword [ebp - 0x38]
call fcn.004c7650
mov edx, dword [ebp + 0x78]
mov edx, dword [edx]
sub edx, eax
shr edx, 1
mov eax, dword [ebp + 0x60]
mov dword [eax], edx
mov edx, dword [ebp - 0x20]
mov eax, 0x4cee7c
call fcn.0040698c
test eax, eax
jle case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
call fcn.004c7650
mov edx, dword [ebp + 0x78]
mov dword [edx], eax
mov eax, dword [ebp + 0x60]
xor edx, edx
mov dword [eax], edx
jmp case.0x4ca3fc.67
mov eax, dword [edi]
movzx eax, word [eax + 4]
mov word [ebp - 0x292], ax
movzx eax, word [ebp - 0x292]
mov word [ebp - 0x294], ax
movzx eax, word [ebp - 0x292]
add eax, 0xffffff9f
sub ax, 0x1a
jae 0x4ccbb1
movzx eax, word [ebp - 0x292]
and ax, 0xffdf
mov word [ebp - 0x294], ax
movzx eax, word [ebp - 0x294]
sub ax, 0x49
jne 0x4ccce0
mov eax, dword [edi]
mov dword [ebp - 0x298], eax
mov edx, dword [ebp - 0x298]
mov eax, 0x4ceb34
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
jle case.0x4ca3fc.67
lea eax, [ebp - 0x508]
push eax
mov ecx, dword [ebp - 0x78]
sub ecx, 2
mov eax, dword [edi]
mov edx, 2
call fcn.00406674
mov eax, dword [ebp - 0x508]
lea edx, [ebp - 0x20]
call fcn.0040c170
mov edx, dword [ebp - 0x20]
mov eax, 0x4cec6c
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
jle case.0x4ca3fc.67
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
je 0x4ccc72
mov eax, dword [ebp - 0x2a4]
sub eax, 0xa
cmp word [eax], 2
je 0x4ccc72
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0
je 0x4ccc98
mov eax, dword [ebp - 0x2a8]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x2a8], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 9
mov ecx, dword [ebp - 0x2a8]
mov eax, dword [ebp - 0x20]
call fcn.00406674
lea edx, [ebp - 0x50c]
mov eax, dword [ebp - 0x28]
call fcn.004c7100
mov edx, dword [ebp - 0x50c]
lea eax, [ebp - 0x28]
call fcn.00405f1c
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.0040d0e4
mov edx, dword [ebp + 0x6c]
mov dword [edx], eax
jmp case.0x4ca3fc.67
mov dword [ebp - 0x88], 0x1fffffff
mov eax, dword [ebp + 0x94]
add eax, 0xffffff58
xor edx, edx
call fcn.00405f1c
mov eax, dword [edi]
mov dword [ebp - 0x2ac], eax
mov edx, dword [ebp - 0x2ac]
mov eax, 0x4ceb34
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0
jle 0x4ccf40
lea eax, [ebp - 0x510]
push eax
mov ecx, dword [ebp - 0x78]
dec ecx
mov eax, dword [edi]
mov edx, 3
call fcn.00406674
mov eax, dword [ebp - 0x510]
lea edx, [ebp - 0x20]
call fcn.0040c170
mov edx, dword [ebp - 0x20]
mov eax, 0x4cee94
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jle 0x4cce96
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
je 0x4ccdaa
mov eax, dword [ebp - 0x2b8]
sub eax, 0xa
cmp word [eax], 2
je 0x4ccdaa
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
je 0x4ccdd0
mov eax, dword [ebp - 0x2bc]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x2bc], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 4
mov ecx, dword [ebp - 0x2bc]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0
je 0x4cce1a
mov eax, dword [ebp - 0x2c0]
sub eax, 0xa
cmp word [eax], 2
je 0x4cce1a
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
call fcn.0040563c
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0
je 0x4cce40
mov eax, dword [ebp - 0x2c4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov edx, eax
inc edx
mov ecx, dword [ebp - 0x2c4]
mov eax, dword [ebp - 0x28]
call fcn.00406674
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x28]
call fcn.00406674
mov eax, dword [ebp + 0x94]
add eax, 0xffffff58
mov edx, dword [ebp - 0x28]
call fcn.00405f1c
mov edx, dword [ebp - 0x20]
mov eax, 0x4cedac
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0
jle 0x4ccf40
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0
je 0x4cceee
mov eax, dword [ebp - 0x2cc]
sub eax, 0xa
cmp word [eax], 2
je 0x4cceee
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0
je 0x4ccf14
mov eax, dword [ebp - 0x2d0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x2d0], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 5
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x28]
call fcn.004c7274
mov dword [ebp - 0x88], eax
mov eax, dword [ebp + 0x50]
mov eax, dword [eax]
add eax, eax
add eax, eax
lea eax, [eax + eax*2]
mov edx, dword [ebp + 0x7c]
add dword [edx], eax
cmp byte [ebp - 0x43], 0
je 0x4ccf5d
mov byte [ebp - 0x42], 1
jmp 0x4ccf61
mov byte [ebp - 0x43], 1
mov eax, dword [ebp + 0x50]
mov eax, dword [eax]
dec eax
add eax, eax
add eax, eax
lea eax, [eax + eax*2]
add dword [ebp - 0x428], eax
cmp byte [ebp + 0x84], 0
jne 0x4cd42f
mov eax, dword [ebp + 0x94]
cmp byte [eax - 0x37], 0
jne 0x4cd42f
mov eax, dword [ebp + 0x94]
cmp dword [eax - 0xa8], 0
jne 0x4cd1ba
cmp dword [ebp - 0x88], 0x1fffffff
je 0x4ccfd6
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp + 0x94]
mov dword [edx - 0xac], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x88]
call fcn.00438a10
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438cd4
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov edx, 0x4ceeac
call fcn.00438d28
mov eax, dword [ebp + 0x94]
cmp byte [eax - 0x85], 0
jne 0x4cd081
mov eax, dword [ebp + 0x50]
test byte [eax], 1
je 0x4cd046
mov eax, dword [ebp - 0x38]
call fcn.00439e88
mov dword [ebp - 0x2d4], eax
push 0
lea eax, [ebp - 0x428]
push eax
push 1
mov eax, 0x4ceec8
call fcn.00405f54
push eax
mov eax, dword [ebp - 0x2d4]
push eax
call sub.user32.dll_DrawTextW
mov dword [ebp - 0x2d8], eax
jmp 0x4cd180
mov eax, dword [ebp - 0x38]
call fcn.00439e88
mov dword [ebp - 0x2dc], eax
push 0
lea eax, [ebp - 0x428]
push eax
push 1
mov eax, 0x4ceed8
call fcn.00405f54
push eax
mov eax, dword [ebp - 0x2dc]
push eax
call sub.user32.dll_DrawTextW
mov dword [ebp - 0x2e0], eax
jmp 0x4cd180
lea edx, [ebp - 0x514]
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0xb0]
call fcn.0040ce4c
mov edx, dword [ebp - 0x514]
mov eax, dword [ebp + 0x94]
add eax, 0xffffffe0
mov ecx, 0x4ceee8
call fcn.0040639c
mov eax, dword [ebp + 0x94]
inc dword [eax - 0xb0]
mov eax, dword [ebp - 0x38]
call fcn.00439e88
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x20]
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0
je 0x4cd10f
mov eax, dword [ebp - 0x2e4]
sub eax, 0xa
cmp word [eax], 2
je 0x4cd10f
mov eax, dword [ebp + 0x94]
mov edx, dword [eax - 0x20]
mov eax, dword [ebp + 0x94]
add eax, 0xffffffe0
call fcn.0040563c
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0
je 0x4cd135
mov eax, dword [ebp - 0x2e8]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x2e8], eax
push 0
lea eax, [ebp - 0x428]
push eax
mov eax, dword [ebp - 0x2e8]
push eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x20]
call fcn.00405f54
push eax
mov eax, dword [ebp - 0x2ec]
push eax
call sub.user32.dll_DrawTextW
mov eax, dword [ebp + 0x94]
mov edx, dword [eax - 0x20]
mov eax, dword [ebp - 0x38]
call fcn.00439cbc
add eax, dword [ebp - 0x428]
sub eax, 0xc
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x28]
call fcn.00438d28
cmp dword [ebp - 0x88], 0x1fffffff
je 0x4cd42f
mov eax, dword [ebp + 0x94]
mov edx, dword [eax - 0xac]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438a10
jmp 0x4cd42f
mov eax, dword [ebp + 0x94]
mov dword [eax - 0xb4], 0x1fffffff
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0xa8]
mov edx, 0x4ceefc
call fcn.0040666c
jne 0x4cd2f6
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439694
cmp al, 1
jne 0x4cd201
mov dword [ebp - 0x2f0], 0x1fffffff
jmp 0x4cd212
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439534
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x2f0]
mov dword [eax - 0xb4], edx
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x88]
call fcn.00439184
cmp dword [ebp - 0x88], 0x1fffffff
jne 0x4cd250
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp 0x4cd261
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x88]
call fcn.0043953c
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
xor edx, edx
call fcn.0043969c
mov eax, dword [ebp - 0x428]
add eax, 8
push eax
mov eax, dword [ebp - 0x424]
add eax, 0xa
push eax
mov ecx, dword [ebp - 0x424]
add ecx, 2
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x38]
call fcn.00439acc
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0xb4]
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0x1fffffff
jne 0x4cd2c6
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp 0x4cd2d7
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x2f4]
call fcn.0043953c
mov eax, dword [ebp + 0x94]
cmp dword [eax - 0xb4], 0x1fffffff
jne 0x4cd2f6
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0xa8]
mov edx, 0x4cef18
call fcn.0040666c
jne 0x4cd422
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439694
cmp al, 1
jne 0x4cd32d
mov dword [ebp - 0x2f8], 0x1fffffff
jmp 0x4cd33e
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439534
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x2f8]
mov dword [eax - 0xb4], edx
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x88]
call fcn.00439184
cmp dword [ebp - 0x88], 0x1fffffff
jne 0x4cd37c
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp 0x4cd38d
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x88]
call fcn.0043953c
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
xor edx, edx
call fcn.0043969c
mov eax, dword [ebp - 0x428]
add eax, 8
push eax
mov eax, dword [ebp - 0x424]
add eax, 0xa
push eax
mov ecx, dword [ebp - 0x424]
add ecx, 2
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x38]
call fcn.00439978
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0xb4]
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0x1fffffff
jne 0x4cd3f2
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp 0x4cd403
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x2fc]
call fcn.0043953c
mov eax, dword [ebp + 0x94]
cmp dword [eax - 0xb4], 0x1fffffff
jne 0x4cd422
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
add dword [ebp - 0x428], 0xc
jmp case.0x4ca3fc.67
mov eax, dword [edi]
cmp word [eax + 4], 0x3e
je 0x4cd467
mov eax, dword [ebp + 0x50]
inc dword [eax]
mov eax, dword [ebp + 0x7c]
cmp dword [eax], 0
jle 0x4cd455
mov byte [ebp - 0x41], 1
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x85], 0
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dc0
mov edx, eax
or dl, byte [0x4cebf8]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dcc
jmp case.0x4ca3fc.67
mov eax, dword [edi]
movzx eax, word [eax + 4]
mov word [ebp - 0x2fe], ax
movzx eax, word [ebp - 0x2fe]
mov word [ebp - 0x300], ax
movzx eax, word [ebp - 0x2fe]
add eax, 0xffffff9f
sub ax, 0x1a
jae 0x4cd4c7
movzx eax, word [ebp - 0x2fe]
and ax, 0xffdf
mov word [ebp - 0x300], ax
movzx eax, word [ebp - 0x300]
mov word [ebp - 0xa2], ax
cmp word [ebp - 0xa2], 0x4c
jne 0x4cd50d
mov eax, dword [ebp + 0x50]
inc dword [eax]
mov eax, dword [ebp + 0x7c]
cmp dword [eax], 0
jle 0x4cd4f0
mov byte [ebp - 0x41], 1
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x85], 1
mov eax, dword [ebp + 0x94]
mov dword [eax - 0xb0], 1
cmp word [ebp - 0xa2], 0x46
jne case.0x4ca3fc.67
lea eax, [ebp - 0x20]
push eax
mov edx, dword [edi]
mov eax, 0x4ceb34
call fcn.0040698c
mov ecx, eax
dec ecx
mov eax, dword [edi]
mov edx, 3
call fcn.00406674
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0
je 0x4cd56c
mov eax, dword [ebp - 0x304]
sub eax, 0xa
cmp word [eax], 2
je 0x4cd56c
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
je 0x4cd592
mov eax, dword [ebp - 0x308]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x308], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x20]
mov eax, 0x4cedc4
call fcn.004c6e84
mov edx, eax
add edx, 2
mov ecx, dword [ebp - 0x308]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
je 0x4cd5e8
mov eax, dword [ebp - 0x30c]
sub eax, 0xa
cmp word [eax], 2
je 0x4cd5e8
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
call fcn.0040563c
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0
je 0x4cd60e
mov eax, dword [ebp - 0x310]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x310], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov edx, eax
inc edx
mov ecx, dword [ebp - 0x310]
mov eax, dword [ebp - 0x28]
call fcn.00406674
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x28]
call fcn.00406674
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 0x28]
call fcn.00403728
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
add eax, dword [edx]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, dword [ebp + 0x7c]
mov dword [edx], eax
jmp case.0x4ca3fc.67
mov eax, dword [edi]
mov dword [ebp - 0x314], eax
mov edx, dword [ebp - 0x314]
mov eax, 0x4ceb34
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0
jle case.0x4ca3fc.67
lea eax, [ebp - 0x518]
push eax
mov ecx, dword [ebp - 0x78]
dec ecx
mov eax, dword [edi]
mov edx, 3
call fcn.00406674
mov eax, dword [ebp - 0x518]
lea edx, [ebp - 0x20]
call fcn.0040c170
mov edx, dword [ebp - 0x20]
mov eax, 0x4cee30
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
jle 0x4cd7da
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0
je 0x4cd737
mov eax, dword [ebp - 0x320]
sub eax, 0xa
cmp word [eax], 2
je 0x4cd737
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
je 0x4cd75d
mov eax, dword [ebp - 0x324]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 5
mov ecx, dword [ebp - 0x324]
mov eax, dword [ebp - 0x20]
call fcn.00406674
lea edx, [ebp - 0x51c]
mov eax, dword [ebp - 0x28]
call fcn.004c7100
mov edx, dword [ebp - 0x51c]
lea eax, [ebp - 0x28]
call fcn.00405f1c
mov edx, dword [ebp - 0x28]
mov eax, 0x4cef34
call fcn.0040698c
test eax, eax
jle 0x4cd7aa
mov eax, dword [ebp + 0x40]
mov byte [eax], 1
jmp 0x4cd7da
mov edx, dword [ebp - 0x28]
mov eax, 0x4cef4c
call fcn.0040698c
test eax, eax
jle 0x4cd7c3
mov eax, dword [ebp + 0x40]
mov byte [eax], 0
jmp 0x4cd7da
mov edx, dword [ebp - 0x28]
mov eax, 0x4cef64
call fcn.0040698c
test eax, eax
jle 0x4cd7da
mov eax, dword [ebp + 0x40]
mov byte [eax], 2
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x34]
cmp dword [eax], 0
je 0x4cd80a
mov byte [ebp - 0x41], 1
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x34]
mov edx, 0x4cebf0
call fcn.004062dc
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x34]
jmp 0x4cd81c
mov eax, dword [ebp + 0x40]
movzx eax, byte [eax]
mov edx, dword [ebp + 0x94]
mov byte [edx - 0xb5], al
mov edx, dword [ebp - 0x20]
mov eax, 0x4cef80
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jle 0x4cd95a
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
je 0x4cd874
mov eax, dword [ebp - 0x32c]
sub eax, 0xa
cmp word [eax], 2
je 0x4cd874
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0
je 0x4cd89a
mov eax, dword [ebp - 0x330]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x330], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 6
mov ecx, dword [ebp - 0x330]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0
je 0x4cd8e4
mov eax, dword [ebp - 0x334]
sub eax, 0xa
cmp word [eax], 2
je 0x4cd8e4
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
call fcn.0040563c
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0
je 0x4cd90a
mov eax, dword [ebp - 0x338]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x338], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov edx, eax
inc edx
mov ecx, dword [ebp - 0x338]
mov eax, dword [ebp - 0x28]
call fcn.00406674
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x28]
call fcn.00406674
mov eax, dword [ebp - 0x28]
call fcn.004c6ed8
mov edx, dword [ebp + 0x3c]
mov dword [edx], eax
mov edx, dword [ebp - 0x20]
mov eax, 0x4ced4c
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
jle case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
cmp byte [eax + 0x60], 0
jne case.0x4ca3fc.67
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0
je 0x4cd9c2
mov eax, dword [ebp - 0x340]
sub eax, 0xa
cmp word [eax], 2
je 0x4cd9c2
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0
je 0x4cd9e8
mov eax, dword [ebp - 0x344]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 7
mov ecx, dword [ebp - 0x344]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov edx, 0x1fffffff
mov eax, dword [ebp - 0x28]
call fcn.004c7274
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x20]
mov eax, 0x4ced68
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0
jle 0x4cda49
mov eax, dword [ebp + 0x94]
movzx eax, byte [eax + 0x60]
xor al, 1
mov byte [ebp - 0x349], al
jmp 0x4cda50
mov byte [ebp - 0x349], 0
cmp byte [ebp - 0x349], 0
je 0x4cdb75
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0
je 0x4cda8f
mov eax, dword [ebp - 0x350]
sub eax, 0xa
cmp word [eax], 2
je 0x4cda8f
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0
je 0x4cdab5
mov eax, dword [ebp - 0x354]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x354], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 9
mov ecx, dword [ebp - 0x354]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov edx, 0x1fffffff
mov eax, dword [ebp - 0x28]
call fcn.004c7274
mov dword [ebp - 0x8c], eax
cmp byte [ebp + 0x84], 0
jne case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x29], 1
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x88]
call fcn.00439184
push 0x1fffffff
mov eax, dword [ebp - 0x40c]
add eax, 2
push eax
lea eax, [ebp - 0x490]
push eax
mov eax, dword [ebp + 0x94]
mov ecx, dword [eax + 0x8c]
mov ecx, dword [ecx + 8]
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x414]
call fcn.00408a00
lea eax, [ebp - 0x490]
push eax
push 1
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x38]
call fcn.004c6c24
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp case.0x4ca3fc.67
cmp byte [ebp + 0x84], 0
jne case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x29], 1
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439694
cmp al, 1
jne 0x4cdba7
mov dword [ebp - 0x358], 0x1fffffff
jmp 0x4cdbb8
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439534
mov dword [ebp - 0x358], eax
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x358]
mov dword [eax - 0x8c], edx
cmp dword [ebp - 0x88], 0x1fffffff
jne 0x4cdbe5
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp 0x4cdbf6
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x88]
call fcn.0043953c
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
call fcn.0043917c
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x88]
call fcn.00439184
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x8c]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp - 0x40c]
push eax
mov eax, dword [ebp + 0x94]
mov edx, dword [eax + 0x8c]
mov edx, dword [edx]
mov ecx, dword [ebp - 0x414]
mov eax, dword [ebp - 0x38]
call fcn.00439acc
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0xc0]
call fcn.00439184
jmp case.0x4ca3fc.67
mov eax, dword [edi]
mov dword [ebp - 0x35c], eax
mov edx, dword [ebp - 0x35c]
mov eax, 0x4ceb34
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0
jle case.0x4ca3fc.67
cmp byte [ebp + 0x84], 0
jne 0x4cdcd6
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439694
cmp al, 1
jne 0x4cdcb6
mov dword [ebp - 0x364], 0x1fffffff
jmp 0x4cdcc7
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439534
mov dword [ebp - 0x364], eax
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x364]
mov dword [eax - 0x7c], edx
lea eax, [ebp - 0x520]
push eax
mov ecx, dword [ebp - 0x78]
sub ecx, 6
mov eax, dword [edi]
mov edx, 6
call fcn.00406674
mov eax, dword [ebp - 0x520]
lea edx, [ebp - 0x20]
call fcn.0040c170
mov edx, dword [ebp - 0x20]
mov eax, 0x4cef9c
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0
jle 0x4cddbd
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0
je 0x4cdd55
mov eax, dword [ebp - 0x36c]
sub eax, 0xa
cmp word [eax], 2
je 0x4cdd55
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0
je 0x4cdd7b
mov eax, dword [ebp - 0x370]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 4
mov ecx, dword [ebp - 0x370]
mov eax, dword [ebp - 0x20]
call fcn.00406674
lea edx, [ebp - 0x524]
mov eax, dword [ebp - 0x28]
call fcn.004c7100
mov edx, dword [ebp - 0x524]
lea eax, [ebp - 0x28]
call fcn.00405f1c
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x28]
call fcn.00438d28
mov edx, dword [ebp - 0x20]
mov eax, 0x4cefb4
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0
jle 0x4cdea5
mov eax, dword [ebp + 0x94]
cmp byte [eax + 0x60], 0
jne 0x4cdea5
cmp byte [ebp + 0x84], 0
jne 0x4cdea5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0
je 0x4cde32
mov eax, dword [ebp - 0x378]
sub eax, 0xa
cmp word [eax], 2
je 0x4cde32
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x4cde58
mov eax, dword [ebp - 0x37c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x37c], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 6
mov ecx, dword [ebp - 0x37c]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x54]
call fcn.00438a10
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 0x28]
call fcn.004c7274
mov edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438a10
mov edx, dword [ebp - 0x20]
mov eax, 0x4ced4c
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0
jle 0x4cded8
movzx eax, byte [ebp + 0x84]
xor al, 1
mov byte [ebp - 0x381], al
jmp 0x4cdedf
mov byte [ebp - 0x381], 0
cmp byte [ebp - 0x381], 0
je 0x4cdfe5
mov eax, dword [ebp + 0x94]
cmp byte [eax + 0x60], 0
jne 0x4cdfe5
cmp byte [ebp + 0x84], 0
jne 0x4cdfe5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0
je 0x4cdf3b
mov eax, dword [ebp - 0x388]
sub eax, 0xa
cmp word [eax], 2
je 0x4cdf3b
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0
je 0x4cdf61
mov eax, dword [ebp - 0x38c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x38c], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 7
mov ecx, dword [ebp - 0x38c]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439694
cmp al, 1
jne 0x4cdf94
mov dword [ebp - 0x390], 0x1fffffff
jmp 0x4cdfa5
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439534
mov dword [ebp - 0x390], eax
mov edx, dword [ebp - 0x390]
mov eax, dword [ebp - 0x28]
call fcn.004c7274
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0x1fffffff
jne 0x4cdfd4
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp 0x4cdfe5
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x394]
call fcn.0043953c
mov edx, dword [ebp - 0x20]
mov eax, 0x4cefd0
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0
jle 0x4ce23b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0
je 0x4ce03d
mov eax, dword [ebp - 0x39c]
sub eax, 0xa
cmp word [eax], 2
je 0x4ce03d
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0
je 0x4ce063
mov eax, dword [ebp - 0x3a0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x3a0], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 5
mov ecx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x4ce0ad
mov eax, dword [ebp - 0x3a4]
sub eax, 0xa
cmp word [eax], 2
je 0x4ce0ad
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
call fcn.0040563c
mov dword [ebp - 0x3a4], eax
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0
je 0x4ce0d3
mov eax, dword [ebp - 0x3a8]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x3a8], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4cefe8
call fcn.0040698c
mov edx, eax
inc edx
mov ecx, dword [ebp - 0x3a8]
mov eax, dword [ebp - 0x28]
call fcn.00406674
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 0
je 0x4ce127
mov eax, dword [ebp - 0x3ac]
sub eax, 0xa
cmp word [eax], 2
je 0x4ce127
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
call fcn.0040563c
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0
je 0x4ce14d
mov eax, dword [ebp - 0x3b0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x3b0], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov edx, eax
inc edx
mov ecx, dword [ebp - 0x3b0]
mov eax, dword [ebp - 0x28]
call fcn.00406674
lea edx, [ebp - 0x528]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x528]
mov eax, 0x4ceff8
call fcn.0040698c
test eax, eax
jle case.0x4ca3fc.67
lea eax, [ebp - 0x28]
mov ecx, 0xa
mov edx, 1
call fcn.00406744
lea edx, [ebp - 0x52c]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x52c]
mov eax, 0x4cf01c
call fcn.0040698c
test eax, eax
jle case.0x4ca3fc.67
lea eax, [ebp - 0x534]
push eax
lea edx, [ebp - 0x538]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x538]
mov eax, 0x4cf01c
call fcn.0040698c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x28]
call fcn.00406674
mov eax, dword [ebp - 0x534]
lea edx, [ebp - 0x530]
call fcn.0040c724
mov edx, dword [ebp - 0x530]
lea eax, [ebp - 0x28]
call fcn.00405f1c
mov eax, dword [ebp - 0x28]
call fcn.004c6ed8
mov edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438da0
jmp case.0x4ca3fc.67
mov edx, dword [ebp - 0x20]
mov eax, 0x4cf030
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0
jle case.0x4ca3fc.67
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0
je 0x4ce293
mov eax, dword [ebp - 0x3b8]
sub eax, 0xa
cmp word [eax], 2
je 0x4ce293
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 0
je 0x4ce2b9
mov eax, dword [ebp - 0x3bc]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x3bc], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 4
mov ecx, dword [ebp - 0x3bc]
mov eax, dword [ebp - 0x20]
call fcn.00406674
lea edx, [ebp - 0x53c]
mov eax, dword [ebp - 0x28]
call fcn.004c7100
mov edx, dword [ebp - 0x53c]
lea eax, [ebp - 0x28]
call fcn.00405f1c
mov eax, dword [ebp - 0x28]
call fcn.004c6ed8
cmp eax, 5
ja case.0x4ce2fe.0
jmp dword [eax*4 + 0x4ce305]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov edx, 8
call fcn.00438da0
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov edx, 0xa
call fcn.00438da0
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov edx, 0xc
call fcn.00438da0
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov edx, 0xe
call fcn.00438da0
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov edx, 0x10
call fcn.00438da0
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x28]
call fcn.004c6ed8
mov edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438da0
jmp case.0x4ca3fc.67
mov eax, dword [edi]
movzx eax, word [eax + 4]
mov word [ebp - 0x3be], ax
movzx eax, word [ebp - 0x3be]
mov word [ebp - 0x3c0], ax
movzx eax, word [ebp - 0x3be]
add eax, 0xffffff9f
sub ax, 0x1a
jae 0x4ce3dd
movzx eax, word [ebp - 0x3be]
and ax, 0xffdf
mov word [ebp - 0x3c0], ax
movzx eax, word [ebp - 0x3c0]
mov word [ebp - 0xa2], ax
cmp word [ebp - 0xa2], 0x3e
jne 0x4ce418
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dc0
mov edx, eax
or dl, byte [0x4cebdc]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dcc
jmp case.0x4ca3fc.67
cmp word [ebp - 0xa2], 0x54
jne 0x4ce445
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dc0
mov edx, eax
or dl, byte [0x4cebdc]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
call fcn.00438dcc
jmp case.0x4ca3fc.67
cmp word [ebp - 0xa2], 0x48
jne 0x4ce45e
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x39], 1
jmp case.0x4ca3fc.67
cmp word [ebp - 0xa2], 0x50
jne 0x4ce72a
mov eax, dword [edi]
mov dword [ebp - 0x3c4], eax
mov edx, dword [ebp - 0x3c4]
mov eax, 0x4ceb34
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0
jle case.0x4ca3fc.67
lea eax, [ebp - 0x540]
push eax
mov ecx, dword [ebp - 0x78]
sub ecx, 6
mov eax, dword [edi]
mov edx, 6
call fcn.00406674
mov eax, dword [ebp - 0x540]
lea edx, [ebp - 0x20]
call fcn.0040c170
mov edx, dword [ebp - 0x20]
mov eax, 0x4cefd0
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0
jle case.0x4ca3fc.67
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0
je 0x4ce51c
mov eax, dword [ebp - 0x3d0]
sub eax, 0xa
cmp word [eax], 2
je 0x4ce51c
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0
je 0x4ce542
mov eax, dword [ebp - 0x3d4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x3d4], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x78]
add edx, 5
mov ecx, dword [ebp - 0x3d4]
mov eax, dword [ebp - 0x20]
call fcn.00406674
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0
je 0x4ce58c
mov eax, dword [ebp - 0x3d8]
sub eax, 0xa
cmp word [eax], 2
je 0x4ce58c
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
call fcn.0040563c
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 0
je 0x4ce5b2
mov eax, dword [ebp - 0x3dc]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x3dc], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4cefe8
call fcn.0040698c
mov edx, eax
inc edx
mov ecx, dword [ebp - 0x3dc]
mov eax, dword [ebp - 0x28]
call fcn.00406674
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0
je 0x4ce606
mov eax, dword [ebp - 0x3e0]
sub eax, 0xa
cmp word [eax], 2
je 0x4ce606
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
call fcn.0040563c
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0
je 0x4ce62c
mov eax, dword [ebp - 0x3e4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x3e4], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x28]
mov eax, 0x4ced18
call fcn.0040698c
mov edx, eax
inc edx
mov ecx, dword [ebp - 0x3e4]
mov eax, dword [ebp - 0x28]
call fcn.00406674
lea edx, [ebp - 0x544]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x544]
mov eax, 0x4cf048
call fcn.0040698c
test eax, eax
jle case.0x4ca3fc.67
lea eax, [ebp - 0x28]
mov ecx, 0x11
mov edx, 1
call fcn.00406744
lea edx, [ebp - 0x548]
mov eax, dword [ebp - 0x28]
call fcn.0040c170
mov edx, dword [ebp - 0x548]
mov eax, 0x4cf078
call fcn.0040698c
dec eax
jne case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439694
cmp al, 1
jne 0x4ce6c6
mov dword [ebp - 0x3e8], 0x1fffffff
jmp 0x4ce6d7
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
call fcn.00439534
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x3e8]
mov dword [eax - 0x7c], edx
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.004c6dcc
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0x1fffffff
jne 0x4ce714
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dl, 1
call fcn.0043969c
jmp case.0x4ca3fc.67
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x3ec]
call fcn.0043953c
jmp case.0x4ca3fc.67
mov edx, dword [edi]
mov eax, 0x4cf088
call fcn.004c6e84
dec eax
jne 0x4ce748
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x35], 1
jmp case.0x4ca3fc.67
mov edx, dword [edi]
mov eax, 0x4cf0a0
call fcn.004c6e84
dec eax
jne case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x36], 1
jmp case.0x4ca3fc.67
lea eax, [ebp - 0x20]
push eax
mov edx, dword [edi]
mov eax, 0x4ceb34
call fcn.0040698c
mov ecx, eax
dec ecx
mov eax, dword [edi]
mov edx, 3
call fcn.00406674
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0
je 0x4ce7bb
mov eax, dword [ebp - 0x3f0]
sub eax, 0xa
cmp word [eax], 2
je 0x4ce7bb
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
call fcn.0040563c
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0
je 0x4ce7e1
mov eax, dword [ebp - 0x3f4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x3f4], eax
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x20]
mov eax, 0x4cf0b8
call fcn.004c6e84
mov edx, eax
add edx, 2
mov ecx, dword [ebp - 0x3f4]
mov eax, dword [ebp - 0x20]
call fcn.00406674
lea edx, [ebp - 0x54c]
mov eax, dword [ebp - 0x28]
call fcn.004c7100
mov edx, dword [ebp - 0x54c]
lea eax, [ebp - 0x28]
call fcn.00405f1c
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 0x28]
call fcn.00403728
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x94]
push eax
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x38]
call fcn.004c76dc
pop ecx
jmp case.0x4ca3fc.67
mov eax, dword [ebp + 0x94]
mov byte [eax - 0x37], 1
cmp dword [ebp - 0x10], 0
je 0x4ce869
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00405f1c
lea eax, [ebp - 0x1c]
xor edx, edx
call fcn.00405f1c
mov eax, dword [edi]
mov dword [ebp - 0x3f8], eax
mov edx, dword [ebp - 0x3f8]
mov eax, 0x4ceb34
call fcn.0040698c
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0
jle 0x4ce8a4
movzx eax, byte [ebp - 0x42]
xor al, 1
mov byte [ebp - 0x3fd], al
jmp 0x4ce8ab
mov byte [ebp - 0x3fd], 0
cmp byte [ebp - 0x3fd], 0
je 0x4ce90d
lea eax, [ebp - 0x550]
push eax
mov eax, dword [edi]
mov ecx, dword [ebp - 0x78]
mov edx, 1
call fcn.00406674
mov edx, dword [ebp - 0x550]
lea eax, [ebp - 0x1c]
call fcn.004062dc
lea eax, [ebp - 0x554]
push eax
mov eax, dword [edi]
mov ecx, dword [ebp - 0x78]
mov edx, 1
call fcn.00406674
mov edx, dword [ebp - 0x554]
lea eax, [ebp - 0x14]
call fcn.004062dc
mov eax, edi
mov ecx, dword [ebp - 0x78]
mov edx, 1
call fcn.00406744
jmp 0x4ce97a
cmp byte [ebp - 0x42], 0
jne 0x4ce97a
mov eax, dword [edi]
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0
je 0x4ce942
mov eax, dword [ebp - 0x404]
sub eax, 0xa
cmp word [eax], 2
je 0x4ce942
mov edx, dword [edi]
mov eax, edi
call fcn.0040563c
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
je 0x4ce968
mov eax, dword [ebp - 0x408]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x408], eax
mov eax, edi
mov ecx, dword [ebp - 0x408]
mov edx, 1
call fcn.00406744
mov eax, edi
call fcn.0040564c
call fcn.00406238
test eax, eax
jle 0x4ce99a
cmp byte [ebp - 0x41], 0
jne 0x4ce99a
cmp byte [ebp - 0x42], 0
je 0x4c7a3c
mov eax, dword [ebp + 0x48]
cmp dword [eax], 0xfffffffe
jne 0x4ce9bf
mov eax, dword [ebp + 0x4c]
cmp dword [eax], 0
jle 0x4ce9bf
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov edx, dword [ebp + 0x48]
mov dword [edx], eax
mov eax, dword [ebp + 0x18]
mov byte [eax], 1
jmp 0x4ceab0
mov eax, dword [ebp + 0x6c]
mov edx, dword [ebp - 0xc8]
mov dword [eax], edx
movzx eax, byte [ebp - 0xa9]
xor al, 1
and al, byte [ebp - 0x41]
je 0x4cea0d
cmp byte [ebp + 0x80], 0
je 0x4cea0d
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0xb0]
jle 0x4ce9f7
mov eax, dword [ebp + 0x78]
mov edx, dword [ebp - 0xb0]
mov dword [eax], edx
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0xb4]
jle 0x4cea0d
mov eax, dword [ebp + 0x74]
mov edx, dword [ebp - 0xb4]
mov dword [eax], edx
mov eax, dword [ebp + 0x7c]
mov edx, dword [ebp - 0x54]
sub dword [eax], edx
mov eax, dword [ebp + 0x7c]
cmp dword [eax], 0
jge 0x4cea24
mov eax, dword [ebp + 0x7c]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0x94]
cmp dword [eax + 0x78], 0
jl 0x4ceaa5
mov eax, dword [ebp + 0x94]
mov eax, dword [eax + 0x78]
mov edx, dword [ebp + 0x58]
mov edx, dword [edx]
dec edx
cmp eax, edx
jne 0x4ceaa5
mov eax, dword [ebp + 0x24]
cmp byte [eax], 0
je 0x4ceaa5
cmp byte [ebp + 0x84], 0
jne 0x4ceaa5
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x428]
mov dword [eax - 0x6c], edx
mov eax, dword [ebp + 0x94]
mov edx, dword [ebp - 0x41c]
mov dword [eax - 0x68], edx
mov eax, dword [ebp + 0x94]
lea edx, [eax - 0x74]
mov eax, dword [ebp - 0x38]
call fcn.00439944
mov eax, dword [ebp - 0x418]
inc eax
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x74], eax
mov eax, dword [ebp + 0x94]
mov eax, dword [eax - 0x68]
mov edx, dword [ebp + 0x94]
mov dword [edx - 0x70], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
call fcn.00405ec8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ceb0d
lea eax, [ebp - 0x554]
mov edx, 0x23
call fcn.00405ec0
lea eax, [ebp - 0x4c0]
mov edx, 0xb
call fcn.00405ec0
lea eax, [ebp - 0x494]
call fcn.00405eb8
lea eax, [ebp - 0x480]
mov edx, 3
call fcn.00405ec0
lea eax, [ebp - 0x34]
mov edx, 0xd
call fcn.00405ec0
ret