Function at 0x4dd4a0
Capabilities:
Check os version

Disassembly:
mov dword [esp + 0xec], 0xffffffff
jmp 0x4dec80
push 0xffffffffffffffff
push 0x83bf3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd4
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0x3f800000
mov dword [esp + 0x34], 0
mov dword [esp + 0x20], 0x3f800000
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x14], 0xbf800000
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0xd8], 0xbdcccccd
mov dword [esp + 0xdc], 0xbf800000
mov dword [esp + 0xe0], 0
mov dword [esp + 0xb4], 0xbdcccccd
mov dword [esp + 0xb8], 0x3f800000
mov dword [esp + 0xbc], 0
mov dword [esp + 0xcc], 0x3dcccccd
mov dword [esp + 0xd0], 0xbf800000
mov dword [esp + 0xd4], 0
mov dword [esp + 0xc0], 0x3dcccccd
mov dword [esp + 0xc4], 0x3f800000
mov dword [esp + 0xc8], 0
mov dword [esp + 0x40], ebx
mov eax, dword [esp + 0xf4]
cmp eax, 0x65
mov ecx, dword [0xbd00f8]
movsx edx, byte [ecx + eax]
mov dword [esp + 0xac], edx
mov dword [esp + 0xec], ebx
fild dword [esp + 0xac]
fadd dword [esp + 0xf8]
fstp dword [esp + 0x10]
ja case.0x4dd5d4.21
movzx eax, byte [eax + 0x4ded2c]
jmp dword [eax*4 + 0x4deca0]
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov ebp, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esp + 0x48]
push esi
mov dword [ecx + 4], eax
push 0x19
mov dword [ecx + 8], edx
push ebx
lea ecx, [esp + 0x70]
call fcn.004efe50
mov eax, dword [esp + 0xfc]
lea ecx, [esp + 0x38]
push ecx
mov edi, 0x151b
mov ecx, 0xb62cb0
mov dword [esp + 0x58], eax
mov word [esp + 0x92], di
call fcn.004efb10
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov edx, esp
push esi
push 0x1a
jmp 0x4de90e
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x48]
push esi
mov dword [eax + 4], edx
push 0xe
mov dword [eax + 8], ecx
push ebx
lea ecx, [esp + 0x70]
call fcn.004efe50
mov edx, dword [esp + 0xfc]
lea eax, [esp + 0x38]
mov edi, 0x151b
push eax
mov ecx, 0xb62cb0
mov dword [esp + 0x58], edx
mov word [esp + 0x92], di
call fcn.004efb10
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov ecx, esp
push esi
push 0xf
push ebx
jmp 0x4dd928
push 1
push 0x3c
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x48]
push esi
mov dword [edx + 4], ecx
push 6
push 1
lea ecx, [esp + 0x70]
mov dword [edx + 8], eax
call fcn.004efe50
mov ecx, dword [esp + 0xfc]
lea edx, [esp + 0x38]
mov dword [esp + 0x54], ecx
mov edi, 0x151b
push edx
mov ecx, 0xb62cb0
mov word [esp + 0x92], di
call fcn.004efb10
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x54]
push esi
mov dword [eax + 4], edx
push 7
mov dword [eax + 8], ecx
push 1
lea ecx, [esp + 0x70]
call fcn.004efe50
mov edx, dword [esp + 0xfc]
lea eax, [esp + 0x38]
push eax
mov ecx, 0xb62cb0
mov dword [esp + 0x58], edx
mov word [esp + 0x92], di
call fcn.004efb10
jmp case.0x4dd5d4.21
push 1
push 0x3c
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov ebp, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esp + 0x48]
push esi
mov dword [ecx + 4], eax
push ebx
mov dword [ecx + 8], edx
push 1
lea ecx, [esp + 0x70]
call fcn.004efe50
mov eax, dword [esp + 0xfc]
lea ecx, [esp + 0x38]
push ecx
mov edi, 0x151b
mov ecx, 0xb62cb0
mov dword [esp + 0x58], eax
mov word [esp + 0x92], di
call fcn.004efb10
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov edx, esp
push esi
push 1
push 1
jmp 0x4de90f
push 1
push 0x3c
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x48]
push esi
mov dword [eax + 4], edx
push 4
mov dword [eax + 8], ecx
push 1
lea ecx, [esp + 0x70]
call fcn.004efe50
mov edx, dword [esp + 0xfc]
lea eax, [esp + 0x38]
mov edi, 0x111b
push eax
mov ecx, 0xb62cb0
mov dword [esp + 0x58], edx
mov word [esp + 0x92], di
call fcn.004efb10
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov ecx, esp
push esi
push 5
push 1
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
mov dword [ecx], edx
mov edx, dword [esp + 0x60]
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
lea ecx, [esp + 0x70]
call fcn.004efe50
mov eax, dword [esp + 0xfc]
lea ecx, [esp + 0x38]
push ecx
mov ecx, 0xb62cb0
mov dword [esp + 0x58], eax
mov word [esp + 0x92], di
call fcn.004efb10
jmp case.0x4dd5d4.21
push 1
push 0x3c
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push edx
mov edx, dword [esp + 0x50]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x60]
push esi
mov dword [eax + 4], edx
push 8
mov dword [eax + 8], ecx
push 1
lea ecx, [esp + 0x70]
call fcn.004efe50
mov edx, dword [esp + 0xfc]
lea eax, [esp + 0x38]
push eax
mov ecx, 0xb62cb0
mov dword [esp + 0x58], edx
mov word [esp + 0x92], 0x11b
call fcn.004efb10
jmp case.0x4dd5d4.21
push 1
push 0x3c
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov ebp, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esp + 0x48]
push esi
mov dword [ecx + 4], eax
push 2
mov dword [ecx + 8], edx
push 1
lea ecx, [esp + 0x70]
call fcn.004efe50
mov eax, dword [esp + 0xfc]
lea ecx, [esp + 0x38]
push ecx
mov edi, 0x151b
mov ecx, 0xb62cb0
mov dword [esp + 0x58], eax
mov word [esp + 0x92], di
call fcn.004efb10
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov edx, esp
push esi
push 3
push 1
jmp 0x4de90f
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov ecx, dword [esi + 0x84]
mov eax, dword [0xb7cb4c]
add ecx, 5
cmp eax, ecx
jb case.0x4dd5d4.21
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov edx, esp
mov dword [esi + 0x84], eax
mov eax, dword [esp + 0x40]
mov dword [edx], eax
mov eax, dword [esp + 0x48]
push esi
mov dword [edx + 4], ecx
push 0x1b
push ebx
lea ecx, [esp + 0x70]
mov dword [edx + 8], eax
call fcn.004efe50
mov ecx, dword [esp + 0xfc]
lea edx, [esp + 0x38]
mov dword [esp + 0x54], ecx
mov edi, 0x111b
push edx
mov ecx, 0xb62cb0
mov word [esp + 0x92], di
call fcn.004efb10
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov eax, esp
push esi
push 0x1c
jmp 0x4de833
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov ecx, dword [esi + 0x84]
mov eax, dword [0xb7cb4c]
add ecx, 5
cmp eax, ecx
jb case.0x4dd5d4.21
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov edx, esp
mov dword [esi + 0x84], eax
mov eax, dword [esp + 0x40]
mov dword [edx], eax
mov eax, dword [esp + 0x48]
push esi
mov dword [edx + 4], ecx
push 0x10
push ebx
lea ecx, [esp + 0x70]
mov dword [edx + 8], eax
call fcn.004efe50
mov ecx, dword [esp + 0xfc]
lea edx, [esp + 0x38]
mov dword [esp + 0x54], ecx
mov edi, 0x111b
push edx
mov ecx, 0xb62cb0
mov word [esp + 0x92], di
call fcn.004efb10
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov eax, esp
push esi
push 0x11
jmp 0x4de833
push 5
push 0x8f
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
push 0x3f000000
call fcn.004d9c80
add esp, 4
test al, al
je 0x4ddc39
mov dword [esp + 0xb0], 0x3f983809
mov dword [esp + 0xac], 0x3f800000
jmp 0x4ddc4f
mov dword [esp + 0xb0], 0x3f800000
mov dword [esp + 0xac], 0x3f983809
mov ecx, dword [esp + 0xb0]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
push 0
push 0x3f800000
push ecx
mov ecx, dword [esp + 0x30]
push 0x3f800000
push edi
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x48]
push esi
mov dword [edx + 4], ecx
push 0x1c
push 5
lea ecx, [esp + 0x70]
mov dword [edx + 8], eax
call fcn.004efe50
lea ecx, [esp + 0x38]
push ecx
mov ebp, 0x110f
mov ebx, 0x10
mov ecx, 0xb62cb0
mov word [esp + 0x92], bp
mov dword [esp + 0x48], ebx
call fcn.004efb10
mov edx, dword [esp + 0xac]
mov ecx, dword [esp + 0x20]
push 0
push 0
push 0
push 0
push 0x3f800000
push edx
mov edx, dword [esp + 0x3c]
push 0x3f800000
push edi
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x54]
push esi
mov dword [eax + 4], edx
push 0x1c
mov dword [eax + 8], ecx
push 5
lea ecx, [esp + 0x70]
call fcn.004efe50
lea edx, [esp + 0x38]
push edx
mov ecx, 0xb62cb0
mov word [esp + 0x92], bp
mov dword [esp + 0x48], ebx
call fcn.004efb10
mov eax, dword [0xb7cb84]
mov dword [esi + 0x90], eax
jmp case.0x4dd5d4.21
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov ecx, dword [esi + 0x84]
mov eax, dword [0xb7cb4c]
add ecx, 5
cmp eax, ecx
jb case.0x4dd5d4.21
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f574bc7
push 0x3f800000
push ebp
sub esp, 0xc
mov edx, esp
mov dword [esi + 0x84], eax
mov eax, dword [esp + 0x40]
mov dword [edx], eax
mov eax, dword [esp + 0x48]
push esi
mov dword [edx + 4], ecx
push 0x1b
push ebx
lea ecx, [esp + 0x70]
mov dword [edx + 8], eax
call fcn.004efe50
lea ecx, [esp + 0x38]
push ecx
mov edi, 0x111b
mov ecx, 0xb62cb0
mov word [esp + 0x92], di
call fcn.004efb10
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f574bc7
push 0x3f800000
push ebp
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x54]
push esi
mov dword [edx + 4], ecx
push 0x1c
push ebx
lea ecx, [esp + 0x70]
mov dword [edx + 8], eax
call fcn.004efe50
lea ecx, [esp + 0x38]
push ecx
mov ecx, 0xb62cb0
mov word [esp + 0x92], di
call fcn.004efb10
jmp case.0x4dd5d4.21
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push edx
mov edx, dword [esp + 0x50]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x60]
push esi
mov dword [eax + 4], edx
push 9
mov dword [eax + 8], ecx
push ebx
lea ecx, [esp + 0x70]
call fcn.004efe50
lea edx, [esp + 0x38]
push edx
mov ecx, 0xb62cb0
mov word [esp + 0x92], 0x11b
mov dword [esp + 0x5c], 0x3d70d845
call fcn.004efb10
jmp case.0x4dd5d4.21
xor eax, eax
mov ax, word [esi + 0x82]
push 0x2a
mov ecx, 0xb5f8b8
push eax
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov ecx, dword [esi + 0x8c]
mov eax, dword [0xb7cb4c]
add ecx, 5
cmp eax, ecx
jb case.0x4dd5d4.21
cmp word [esi + 0x80], 0xa
jle 0x4ddeff
push 0x2a
mov ecx, 0xb62cb0
call fcn.004ef520
test ax, ax
jne case.0x4dd5d4.21
inc word [esi + 0x82]
cmp word [esi + 0x82], 0x1f
jle 0x4ddeee
mov word [esi + 0x82], 0x1c
xor edx, edx
mov dx, word [esi + 0x82]
push 0x2a
push edx
jmp 0x4de135
mov edx, dword [esp + 0xd8]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
mov dword [esi + 0x8c], eax
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0xfc]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esp + 0x10c]
push esi
mov dword [ecx + 4], eax
push 2
push ebx
mov dword [ecx + 8], edx
call fcn.004d9c10
add esp, 8
push eax
push 0x2a
lea ecx, [esp + 0x70]
call fcn.004efe50
lea eax, [esp + 0x38]
mov dword [esp + 0x44], 0x1b
push eax
jmp 0x4de1b0
xor ecx, ecx
mov cx, word [esi + 0x82]
push 0x2a
push ecx
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov edx, dword [esi + 0x8c]
mov eax, dword [0xb7cb4c]
add edx, 5
cmp eax, edx
jb case.0x4dd5d4.21
cmp word [esi + 0x80], 0xa
jg 0x4de0fa
mov ecx, dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ecx
mov ecx, dword [esp + 0xd8]
sub esp, 0xc
mov dword [esi + 0x8c], eax
mov eax, dword [esp + 0xe0]
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0xe8]
push esi
mov dword [edx + 4], ecx
push 2
push ebx
mov dword [edx + 8], eax
call fcn.004d9c10
add esp, 8
push eax
push 0x2a
lea ecx, [esp + 0x70]
call fcn.004efe50
mov dword [esp + 0x44], 0x1c
jmp 0x4de1ab
xor edx, edx
mov dx, word [esi + 0x82]
push 0x2a
mov ecx, 0xb5f8b8
push edx
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov ecx, dword [esi + 0x8c]
mov eax, dword [0xb7cb4c]
add ecx, 5
cmp eax, ecx
jb case.0x4dd5d4.21
cmp word [esi + 0x80], 0xa
jg 0x4ddebf
mov edx, dword [esp + 0xcc]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
mov dword [esi + 0x8c], eax
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0xf0]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esp + 0x100]
push esi
mov dword [ecx + 4], eax
push 2
push ebx
mov dword [ecx + 8], edx
call fcn.004d9c10
add esp, 8
push eax
push 0x2a
lea ecx, [esp + 0x70]
call fcn.004efe50
lea eax, [esp + 0x38]
mov dword [esp + 0x44], 0x1d
push eax
jmp 0x4de1b0
xor ecx, ecx
mov cx, word [esi + 0x82]
push 0x2a
push ecx
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov edx, dword [esi + 0x8c]
mov eax, dword [0xb7cb4c]
add edx, 5
cmp eax, edx
jb case.0x4dd5d4.21
cmp word [esi + 0x80], 0xa
jle 0x4de14b
mov ecx, 0xb62cb0
push 0x2a
call fcn.004ef520
test ax, ax
jne case.0x4dd5d4.21
inc word [esi + 0x82]
cmp word [esi + 0x82], 0x1f
jle 0x4de129
mov word [esi + 0x82], 0x1c
xor eax, eax
mov ax, word [esi + 0x82]
push 0x2a
push eax
mov ecx, 0xb5f8b8
call fcn.004d88a0
mov word [esi + 0x80], bx
jmp case.0x4dd5d4.21
mov ecx, dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ecx
mov ecx, dword [esp + 0xe4]
sub esp, 0xc
mov dword [esi + 0x8c], eax
mov eax, dword [esp + 0xec]
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0xf4]
push esi
mov dword [edx + 4], ecx
push 2
push ebx
mov dword [edx + 8], eax
call fcn.004d9c10
add esp, 8
push eax
push 0x2a
lea ecx, [esp + 0x70]
call fcn.004efe50
mov dword [esp + 0x44], 0x1e
lea ecx, [esp + 0x38]
push ecx
mov ecx, 0xb62cb0
mov dword [esp + 0x5c], 0x3d000000
mov word [esp + 0x92], 7
call fcn.004efb10
inc word [esi + 0x80]
jmp case.0x4dd5d4.21
mov al, byte [esi + 0x7c]
test al, al
jne case.0x4dd5d4.21
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push edx
mov edx, dword [esp + 0x50]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x60]
push esi
mov dword [eax + 4], edx
push 8
mov dword [eax + 8], ecx
push ebx
lea ecx, [esp + 0x70]
call fcn.004efe50
mov edx, dword [esp + 0xfc]
lea eax, [esp + 0x38]
push eax
mov ecx, 0xb62cb0
mov dword [esp + 0x58], edx
mov word [esp + 0x92], 0x11f
call fcn.004efb10
cmp eax, ebx
setne cl
mov dword [esi + 0x98], eax
mov byte [esi + 0x7c], cl
jmp case.0x4dd5d4.21
push esi
mov ebx, 0x21
push ebx
mov ecx, 0xb62cb0
call fcn.004ef570
test ax, ax
jne 0x4de370
push 0
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 0
push 0
push 0
push 0
push 0x3f800000
push 0x3f800000
push 0x3f800000
push edi
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x48]
push esi
mov dword [edx + 4], ecx
push 4
push 0
lea ecx, [esp + 0x70]
mov dword [edx + 8], eax
call fcn.004efe50
mov ecx, dword [esp + 0xfc]
lea edx, [esp + 0x38]
mov dword [esp + 0x54], ecx
mov ebp, 0x110f
push edx
mov ecx, 0xb62cb0
mov word [esp + 0x92], bp
mov dword [esp + 0x48], ebx
call fcn.004efb10
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push 0x3f800000
push 0x3f800000
push 0x3f800000
push edi
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x54]
push esi
mov dword [eax + 4], edx
push 5
mov dword [eax + 8], ecx
push 0
lea ecx, [esp + 0x70]
call fcn.004efe50
mov edx, dword [esp + 0xfc]
lea eax, [esp + 0x38]
push eax
mov ecx, 0xb62cb0
mov dword [esp + 0x58], edx
mov word [esp + 0x92], bp
mov dword [esp + 0x48], ebx
call fcn.004efb10
mov ecx, dword [0xb7cb84]
mov dword [esi + 0x94], ecx
jmp case.0x4dd5d4.21
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov al, byte [0xb7cb49]
test al, al
jne 0x4de414
mov al, byte [0xb7cb48]
test al, al
jne 0x4de414
cmp word [esi + 0x124], bx
jne case.0x4dd5d4.21
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x28a
push 0xc8
push esi
push 1
push 2
lea edi, [esi + 0x9c]
push ebx
mov ecx, edi
call fcn.004f28a0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push 0x14b
push 0x3f800000
push 0x3f800000
push 0x3f800000
push edx
mov edx, dword [esp + 0x44]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x54]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov ecx, edi
call fcn.004f2cb0
jmp case.0x4dd5d4.21
cmp word [esi + 0x1cc], bx
jne case.0x4dd5d4.21
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x28a
push 0xc8
push esi
push 1
push 2
lea edi, [esi + 0x144]
push ebx
mov ecx, edi
call fcn.004f28a0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push 0x15b
push 0x3f800000
push 0x3f800000
push 0x3f800000
push edx
mov edx, dword [esp + 0x44]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x54]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov ecx, edi
call fcn.004f2cb0
jmp case.0x4dd5d4.21
mov al, byte [0xb7cb49]
test al, al
jne case.0x4dd5d4.36
mov al, byte [0xb7cb48]
test al, al
jne case.0x4dd5d4.36
cmp word [esi + 0x124], bx
je case.0x4dd5d4.21
lea ecx, [esi + 0x9c]
call fcn.004f2960
jmp case.0x4dd5d4.21
cmp word [esi + 0x1cc], bx
je case.0x4dd5d4.21
lea ecx, [esi + 0x144]
call fcn.004f2960
jmp case.0x4dd5d4.21
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push edx
mov edx, dword [esp + 0x50]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x60]
push esi
mov dword [eax + 4], edx
push 0x17
mov dword [eax + 8], ecx
push ebx
lea ecx, [esp + 0x70]
call fcn.004efe50
lea edx, [esp + 0x38]
push edx
mov ecx, 0xb62cb0
mov word [esp + 0x92], 0x11b
call fcn.004efb10
jmp case.0x4dd5d4.21
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f641206
push 0x3f800000
push eax
mov eax, dword [esp + 0x50]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esp + 0x60]
push esi
mov dword [ecx + 4], eax
push 0x17
mov dword [ecx + 8], edx
push ebx
lea ecx, [esp + 0x70]
call fcn.004efe50
lea eax, [esp + 0x38]
push eax
mov ecx, 0xb62cb0
mov word [esp + 0x92], 0x11b
call fcn.004efb10
jmp case.0x4dd5d4.21
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ecx
mov ecx, dword [esp + 0x50]
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x60]
push esi
mov dword [edx + 4], ecx
push 0xa
push ebx
lea ecx, [esp + 0x70]
mov dword [edx + 8], eax
call fcn.004efe50
mov ecx, dword [esp + 0xfc]
lea edx, [esp + 0x38]
mov dword [esp + 0x54], ecx
push edx
mov ecx, 0xb62cb0
mov word [esp + 0x92], 3
call fcn.004efb10
jmp case.0x4dd5d4.21
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push eax
mov eax, dword [esp + 0x50]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esp + 0x60]
push esi
mov dword [ecx + 4], eax
push 0xb
mov dword [ecx + 8], edx
push ebx
lea ecx, [esp + 0x70]
call fcn.004efe50
mov eax, dword [esp + 0xfc]
lea ecx, [esp + 0x38]
push ecx
mov ecx, 0xb62cb0
mov dword [esp + 0x58], eax
mov word [esp + 0x92], 3
call fcn.004efb10
jmp case.0x4dd5d4.21
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov edx, dword [esi + 0x88]
mov eax, dword [0xb7cb4c]
add edx, 5
cmp eax, edx
jb case.0x4dd5d4.21
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov dword [esi + 0x88], eax
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x48]
push esi
mov dword [eax + 4], edx
push 0x12
mov dword [eax + 8], ecx
push ebx
lea ecx, [esp + 0x70]
call fcn.004efe50
mov edx, dword [esp + 0xfc]
lea eax, [esp + 0x38]
mov edi, 0x151b
push eax
mov ecx, 0xb62cb0
mov dword [esp + 0x58], edx
mov word [esp + 0x92], di
call fcn.004efb10
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esp + 0x54]
push esi
mov dword [ecx + 4], eax
push 0x13
mov dword [ecx + 8], edx
push ebx
lea ecx, [esp + 0x70]
call fcn.004efe50
mov eax, dword [esp + 0xfc]
lea ecx, [esp + 0x38]
push ecx
mov ecx, 0xb62cb0
mov dword [esp + 0x58], eax
mov word [esp + 0x92], di
call fcn.004efb10
jmp case.0x4dd5d4.21
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x48]
push esi
mov dword [edx + 4], ecx
push 6
push ebx
lea ecx, [esp + 0x70]
mov dword [edx + 8], eax
call fcn.004efe50
mov ecx, dword [esp + 0xfc]
lea edx, [esp + 0x38]
mov dword [esp + 0x54], ecx
mov edi, 0x151b
push edx
mov ecx, 0xb62cb0
mov word [esp + 0x92], di
call fcn.004efb10
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov eax, esp
push esi
push 7
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [eax], ecx
mov ecx, dword [esp + 0x5c]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
push ebx
lea ecx, [esp + 0x70]
call fcn.004efe50
mov edx, dword [esp + 0xfc]
lea eax, [esp + 0x38]
push eax
mov ecx, 0xb62cb0
mov dword [esp + 0x58], edx
mov word [esp + 0x92], di
call fcn.004efb10
jmp case.0x4dd5d4.21
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
mov ebp, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esp + 0x48]
push esi
mov dword [ecx + 4], eax
push 0xc
mov dword [ecx + 8], edx
push ebx
lea ecx, [esp + 0x70]
call fcn.004efe50
mov eax, dword [esp + 0xfc]
lea ecx, [esp + 0x38]
push ecx
mov edi, 0x151b
mov ecx, 0xb62cb0
mov dword [esp + 0x58], eax
mov word [esp + 0x92], di
call fcn.004efb10
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov edx, esp
push esi
push 0xd
push ebx
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov dword [edx], eax
mov eax, dword [esp + 0x60]
mov dword [edx + 4], ecx
lea ecx, [esp + 0x70]
mov dword [edx + 8], eax
call fcn.004efe50
mov ecx, dword [esp + 0xfc]
lea edx, [esp + 0x38]
mov dword [esp + 0x54], ecx
push edx
mov ecx, 0xb62cb0
mov word [esp + 0x92], di
call fcn.004efb10
jmp case.0x4dd5d4.21
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
push esi
push 0x65
mov ecx, 0xb62cb0
call fcn.004ef570
test ax, ax
jne case.0x4dd5d4.21
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push eax
mov eax, dword [esp + 0x50]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esp + 0x60]
push esi
mov dword [ecx + 4], eax
push 0xd
mov dword [ecx + 8], edx
push ebx
lea ecx, [esp + 0x70]
call fcn.004efe50
mov eax, dword [esp + 0xfc]
lea ecx, [esp + 0x38]
push ecx
mov ecx, 0xb62cb0
mov dword [esp + 0x58], eax
mov word [esp + 0x92], 0x101
mov dword [esp + 0x48], 0x65
call fcn.004efb10
jmp case.0x4dd5d4.21
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
push esi
push 0x2f
mov ecx, 0xb62cb0
call fcn.004ef570
test ax, ax
jne case.0x4dd5d4.21
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push edx
mov edx, dword [esp + 0x50]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x60]
push esi
mov dword [eax + 4], edx
push 3
mov dword [eax + 8], ecx
push ebx
lea ecx, [esp + 0x70]
call fcn.004efe50
mov edx, dword [esp + 0xfc]
lea eax, [esp + 0x38]
push eax
mov ecx, 0xb62cb0
mov dword [esp + 0x58], edx
mov word [esp + 0x92], 0x103
mov dword [esp + 0x48], 0x2f
call fcn.004efb10
jmp case.0x4dd5d4.21
push esi
push 0x2f
jmp 0x4dec67
push ebx
push 0x3b
mov ecx, 0xb5f8b8
call fcn.004d88c0
test al, al
je case.0x4dd5d4.21
push esi
push 0x31
mov ecx, 0xb62cb0
call fcn.004ef570
test ax, ax
jne case.0x4dd5d4.21
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ecx
mov ecx, dword [esp + 0x50]
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x60]
push esi
mov dword [edx + 4], ecx
push 0x18
push ebx
lea ecx, [esp + 0x70]
mov dword [edx + 8], eax
call fcn.004efe50
mov ecx, dword [esp + 0xfc]
lea edx, [esp + 0x38]
mov dword [esp + 0x54], ecx
push edx
mov ecx, 0xb62cb0
mov word [esp + 0x92], 0x103
mov dword [esp + 0x48], 0x31
call fcn.004efb10
jmp case.0x4dd5d4.21
movsx ax, byte [esi + 0x7d]
push 2
mov ecx, 0xb5f8b8
shl eax, 1
push eax
push 0x52
call fcn.004d8ef0
test al, al
je case.0x4dd5d4.21
movsx cx, byte [esi + 0x7d]
push 5
lea edx, [ecx + ecx + 1]
push edx
push 0x52
mov ecx, 0xb5f8b8
call fcn.004d8ef0
test al, al
je case.0x4dd5d4.21
push esi
mov ebx, 0x32
push ebx
mov ecx, 0xb62cb0
call fcn.004ef570
test ax, ax
jne case.0x4dd5d4.21
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
push 0
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x48]
mov dword [eax + 4], edx
movsx dx, byte [esi + 0x7d]
push esi
mov dword [eax + 8], ecx
lea ecx, [esp + 0x68]
shl edx, 1
push edx
push 2
call fcn.004efe50
mov eax, dword [esp + 0xfc]
lea ecx, [esp + 0x38]
push ecx
mov edi, 0x111b
mov ecx, 0xb62cb0
mov dword [esp + 0x58], eax
mov word [esp + 0x92], di
mov dword [esp + 0x48], ebx
call fcn.004efb10
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push 0x3f800000
push 0x3f800000
push 0x3f800000
push ebp
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x54]
mov dword [edx + 4], ecx
movsx cx, byte [esi + 0x7d]
mov dword [edx + 8], eax
push esi
lea edx, [ecx + ecx + 1]
push edx
push 5
lea ecx, [esp + 0x70]
call fcn.004efe50
mov eax, dword [esp + 0xfc]
lea ecx, [esp + 0x38]
push ecx
mov ecx, 0xb62cb0
mov dword [esp + 0x58], eax
mov word [esp + 0x92], di
mov dword [esp + 0x48], ebx
call fcn.004efb10
jmp case.0x4dd5d4.21
push esi
push 0x32
mov ecx, 0xb62cb0
call fcn.004efb90
lea ecx, [esp + 0x38]
nop
nop
nop
nop
nop
nop
jmp 0x406a86
call fcn.004ef660
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xe0
ret 0xc