Function at 0x467ef0
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
push ebx
push ebp
push esi
mov esi, dword [esp + 0x78]
mov ebp, esi
imul ebp, ebp, 0x45c
movsx ecx, word [ebp + 0x81635a]
push edi
xor edi, edi
cmp ecx, edi
mov dword [esp + 0x24], ecx
jle 0x467f31
mov eax, ecx
imul eax, eax, 0x45c
mov edx, dword [eax + 0x816350]
test dh, 3
je 0x467f2f
xor ecx, ecx
mov dword [esp + 0x24], ecx
jmp 0x467f62
cmp ecx, edi
je 0x467f62
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
imul eax, eax, 0x45c
cmp word [eax + 0x8162f8], 0xffff
jne 0x467f62
cmp word [ebp + 0x8162fa], 6
mov word [ebp + 0x81635a], di
jne 0x467f62
mov word [ebp + 0x8162fa], di
mov ebx, dword [0x85c164]
test bh, 4
je 0x467f76
cmp esi, 8
jl 0x4680fb
cmp esi, edi
jne 0x4682f7
test bl, bl
mov dword [0x8bb97c], edi
jns 0x468103
call fcn.0045d210
cmp dword [0x86bab0], 0xa
jge 0x467fa4
push 1
call fcn.0045ca10
add esp, 4
mov al, byte [0x85c164]
test al, al
jns 0x46811d
mov ecx, dword [0x85c7b0]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [0x8bb6b4], ecx
mov ecx, dword [0x85c7d0]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [0x8bb6b0], eax
test byte [0x85c164], 4
jne 0x4680fb
mov eax, 0x51eb851f
imul dword [0x727684]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
xor esi, esi
test eax, eax
jle 0x4680a9
mov ebp, dword [0x85c150]
push 0xffffffffffffffff
push 0
inc ebp
push 0xffffffffffffffff
mov dword [0x85c150], ebp
call fcn.00413710
add esp, 0xc
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
call fcn.00413710
add esp, 0xc
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
call fcn.00413710
add esp, 0xc
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
call fcn.00413710
mov eax, dword [0x85c150]
cdq
mov ecx, 0x258
idiv ecx
add esp, 0xc
test edx, edx
jne 0x46808f
call fcn.00460030
mov eax, 0x51eb851f
imul dword [0x727684]
sar edx, 5
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
cmp esi, eax
jl 0x468034
mov eax, dword [0x85c150]
cdq
mov ecx, 0x1770
idiv ecx
mov eax, 0x51eb851f
mov ecx, edx
imul dword [0x727684]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jge 0x4680fb
mov eax, dword [0x85c164]
test ah, 4
jne 0x4680f6
push 0xbf800000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x39
or esi, 0xffffffff
xor eax, eax
or ecx, 0xffffffff
call fcn.00488840
add esp, 0x10
call fcn.004603e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
test bl, 4
jne 0x468297
mov eax, dword [0x8bb8c4]
cmp eax, edi
je 0x468123
dec eax
mov dword [0x8bb8c4], eax
jmp 0x468123
mov ebx, dword [0x85c164]
test bl, 4
jne 0x468297
movsx esi, word [0x81631c]
push str.Sail
push 0x186
call fcn.0042d4d0
add esp, 8
fadd st(0), st(0)
call fcn.005f275c
cmp dword [0x85c15c], edi
mov word [0x81631c], ax
je 0x468233
xor eax, eax
mov dword [esp + 0x44], 0x34
mov dword [esp + 0x48], 0xff
mov ecx, 0xb
lea edi, [esp + 0x4c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x44]
push ecx
push eax
call dword [sym.imp.WINMM.dll_joyGetPosEx]
mov ecx, dword [esp + 0x58]
cmp ecx, 0x6000
jae 0x46819f
or ax, 0xffff
mov word [0x81631c], ax
jmp 0x4681a5
mov ax, word [0x81631c]
cmp ecx, 0x3000
jae 0x4681b7
mov ax, 0xfffe
mov word [0x81631c], ax
cmp ecx, 0xa000
jbe 0x4681c9
mov ax, 1
mov word [0x81631c], ax
cmp ecx, 0xd000
jbe 0x4681db
mov ax, 2
mov word [0x81631c], ax
mov ecx, dword [esp + 0x4c]
cmp ecx, 0x6000
jae 0x4681f1
or ax, 0xffff
mov word [0x81631c], ax
cmp ecx, 0x3000
jae 0x468203
mov ax, 0xfffe
mov word [0x81631c], ax
cmp ecx, 0xa000
jbe 0x468215
mov ax, 1
mov word [0x81631c], ax
cmp ecx, 0xd000
jbe 0x468233
mov ax, 2
mov word [0x81631c], ax
mov dword [0x81633c], 0
jmp 0x468283
test ax, ax
je 0x468244
mov dword [0x81633c], 0
jmp 0x468283
mov ecx, dword [0x81633c]
test ecx, ecx
je 0x468283
sub ecx, dword [0x81630c]
mov eax, 0x90000003
imul ecx
add edx, ecx
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0xfffffffe
jge 0x468273
mov eax, 0xfffffffe
jmp 0x46827d
cmp eax, 2
jle 0x46827d
mov eax, 2
mov word [0x81631c], ax
movsx ecx, ax
mov eax, esi
call fcn.004a36f0
mov ebx, dword [0x85c164]
mov esi, dword [esp + 0x7c]
mov ecx, dword [0x816304]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x10624dd3
imul ecx
mov ecx, dword [0x816308]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [0x8bb6b4], eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [0x8bb6b0], ecx
jmp 0x468577
cmp ecx, edi
jle 0x4683b0
mov edi, dword [esp + 0x24]
imul edi, edi, 0x45c
mov ebx, dword [edi + 0x81630c]
mov eax, 0x51615
mov ecx, ebx
call fcn.004dcac0
mov edx, dword [ebp + 0x816304]
mov esi, dword [edi + 0x816304]
sub esi, edx
sub esi, eax
lea ecx, [ebx + 0x40000000]
mov eax, 0x51615
call fcn.004dcac0
mov edi, dword [edi + 0x816308]
sub edi, dword [ebp + 0x816308]
sub edi, eax
mov eax, 0x10624dd3
imul edi
sar edx, 6
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ebx
call fcn.004dcb20
test esi, esi
mov dword [ebp + 0x81630c], eax
mov dword [ebp + 0x81633c], eax
jge 0x468384
neg esi
test edi, edi
jge 0x46838a
neg edi
cmp esi, edi
lea eax, [edi + esi*2]
jg 0x468394
lea eax, [esi + edi*2]
cdq
sub eax, edx
sar eax, 1
shl eax, 1
cdq
idiv dword [0x727678]
mov ebx, dword [0x85c164]
mov esi, dword [esp + 0x7c]
mov dword [esp + 0x2c], eax
cmp esi, 8
jl 0x4683c5
test dword [ebp + 0x816350], 0x400000
je 0x468537
mov eax, dword [esp + 0x7c]
add eax, 0xfffffffe
jns 0x4683d2
xor eax, eax
jmp 0x4683dc
cmp eax, 0x63
jle 0x4683dc
mov eax, 0x63
mov ecx, dword [ebp + 0x816350]
and ecx, 0x400000
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], ecx
jne 0x468402
imul eax, eax, 0x45c
cmp word [eax + 0x81631a], 0x64
jl 0x46840a
mov dword [esp + 0x24], 0
mov eax, dword [esp + 0x24]
mov edx, dword [ebp + 0x816308]
imul eax, eax, 0x45c
mov ebx, dword [eax + 0x816308]
mov edi, dword [eax + 0x816304]
mov eax, dword [0x8bb6b0]
mov esi, dword [ebp + 0x816304]
sub ebx, edx
mov edx, dword [0x8bb6b4]
imul edx, edx, 0x125
movsx eax, byte [edx + eax + 0x72ed80]
sub edi, esi
cmp eax, 1
jge 0x468455
mov eax, 1
jmp 0x46845f
cmp eax, 4
jle 0x46845f
mov eax, 4
imul eax, eax, 0xf4240
mov ecx, eax
mov eax, 0x66666667
imul ecx
mov ecx, dword [esp + 0x7c]
sar edx, 2
mov esi, edx
and cl, 1
shr esi, 0x1f
add esi, edx
mov edx, dword [0x81630c]
neg cl
mov eax, esi
sbb ecx, ecx
and ecx, 0x80000000
add ecx, 0xc0000000
add ecx, edx
mov dword [esp + 0x34], ecx
call fcn.004dcac0
mov ecx, dword [esp + 0x34]
sub edi, eax
add ecx, 0x40000000
mov eax, esi
call fcn.004dcac0
sub ebx, eax
mov eax, 0x10624dd3
imul ebx
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x10624dd3
imul edi
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, esi
call fcn.004dcb20
test edi, edi
mov dword [ebp + 0x81633c], eax
jge 0x4684ec
neg edi
test ebx, ebx
jge 0x4684f2
neg ebx
cmp edi, ebx
lea eax, [ebx + edi*2]
jg 0x4684fc
lea eax, [edi + ebx*2]
cdq
sub eax, edx
sar eax, 1
cdq
idiv dword [0x727678]
mov ecx, eax
mov eax, dword [esp + 0x30]
test eax, eax
je 0x468514
add ecx, ecx
cmp dword [esp + 0x7c], 2
mov ebx, dword [0x85c164]
jle 0x46852a
lea eax, [ecx + ecx]
mov dword [esp + 0x2c], eax
jmp 0x468537
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebp + 0x81633c]
sub ecx, dword [ebp + 0x81630c]
mov eax, 0x90000003
imul ecx
add edx, ecx
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0xfffffffe
jge 0x468562
mov eax, 0xfffffffe
jmp 0x46856c
cmp eax, 2
jle 0x46856c
mov eax, 2
mov esi, dword [esp + 0x7c]
mov word [ebp + 0x81631c], ax
mov ecx, dword [ebp + 0x816304]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x10624dd3
imul ecx
mov ecx, dword [ebp + 0x816308]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x34], eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
test esi, esi
mov esi, dword [0x8bb8c0]
mov dword [esp + 0x30], eax
mov edi, 0xc8
jne 0x4686b3
test bh, 4
jne 0x4686b8
mov eax, dword [0x727604]
test ebx, 0x10000000
mov ecx, 0
setne cl
cdq
inc ecx
idiv ecx
add eax, 0x32
cmp eax, edi
jge 0x46860d
mov eax, edi
jmp 0x468619
cmp eax, 0x257
jle 0x468619
mov eax, 0x257
test ebx, 0x8080
mov ecx, eax
je 0x46862e
mov ecx, 0x64
mov dword [0x727684], ecx
test bl, 0x40
jne 0x46863c
mov eax, dword [0x8bb8c4]
test eax, eax
je 0x46864a
cmp dword [0x727684], edi
jle 0x46864a
mov dword [0x727684], edi
test bh, bh
jns 0x468659
mov ecx, 0x32
mov dword [0x727684], ecx
cmp esi, 0x21
mov eax, esi
jge 0x468667
mov eax, 0x21
jmp 0x468671
cmp esi, 0x64
jle 0x468671
mov eax, 0x64
imul eax, ecx
mov ecx, eax
mov eax, 0x3e0f83e1
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, dword [0x727684]
test eax, eax
jle 0x468698
mov ecx, 1
jmp 0x4686a0
xor ecx, ecx
test eax, eax
setge cl
dec ecx
cdq
and edx, 0xf
add eax, edx
sar eax, 4
add eax, ecx
add dword [0x727684], eax
jmp 0x4686c6
test bh, 4
je 0x4686c6
mov eax, dword [ebp + 0x816350]
test ah, ah
js 0x4680fb
mov eax, dword [esp + 0x7c]
xor edi, edi
test eax, eax
jne 0x46877a
mov edx, dword [0x727684]
push edx
push str._NUM
mov esi, 0x8ebf58
call fcn.004f7660
add esp, 8
mov eax, 0x816754
mov cx, word [eax - 0x45c]
cmp cx, 0xffff
je 0x468711
movsx ecx, cx
imul ecx, ecx, 0x44
mov ecx, dword [ecx + 0x725b0c]
cmp ecx, edi
jle 0x468711
mov edi, ecx
mov cx, word [eax]
cmp cx, 0xffff
je 0x46872c
movsx edx, cx
imul edx, edx, 0x44
mov ecx, dword [edx + 0x725b0c]
cmp ecx, edi
jle 0x46872c
mov edi, ecx
mov cx, word [eax + 0x45c]
cmp cx, 0xffff
je 0x46874b
movsx ecx, cx
imul ecx, ecx, 0x44
mov ecx, dword [ecx + 0x725b0c]
cmp ecx, edi
jle 0x46874b
mov edi, ecx
mov cx, word [eax + 0x8b8]
cmp cx, 0xffff
je 0x46876a
movsx edx, cx
imul edx, edx, 0x44
mov ecx, dword [edx + 0x725b0c]
cmp ecx, edi
jle 0x46876a
mov edi, ecx
add eax, 0x1170
cmp eax, 0x818a34
jl 0x4686f2
movsx ecx, word [ebp + 0x81631c]
imul ecx, ecx, 0x38e38e3
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x51eb851f
imul ecx
mov eax, dword [esp + 0x7c]
mov ecx, dword [0x727600]
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
cmp eax, 8
mov dword [esp + 0x28], ebx
jge 0x4687c4
mov ecx, dword [0x7273bc]
mov edi, dword [0x8162f8]
jl 0x4687d5
mov ax, word [ebp + 0x8162f8]
jmp 0x4687d7
mov eax, edi
movsx eax, ax
push eax
mov eax, dword [ebp + 0x81630c]
call fcn.004773b0
mov esi, eax
mov eax, dword [esp + 0x80]
add esp, 4
cmp eax, 8
jge 0x4688c2
mov ecx, dword [0x86bb34]
and cl, 0x20
neg cl
mov edx, 0x32
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 3
imul ecx, eax
sub edx, ecx
lea esi, [esi + edx*4]
cmp esi, 0x190
jge 0x468857
mov eax, dword [0x8cc92c]
xor ecx, ecx
cmp eax, 2
mov eax, dword [0x85c158]
sete cl
cdq
inc ecx
idiv ecx
mov ecx, 0x190
sub ecx, esi
mov edx, eax
mov eax, 4
sub eax, edx
imul eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
add esi, eax
mov edx, dword [ebp + 0x816308]
mov eax, dword [ebp + 0x816304]
push 0
push edx
push eax
call fcn.0045f9d0
add esp, 0xc
test esi, esi
mov ecx, eax
jl 0x4688cf
movsx eax, di
imul ecx, esi
cdq
mov edi, 9
idiv edi
mov eax, 0x2aaaaaab
imul edx, edx, 0x44
mov edi, dword [edx + 0x725b0c]
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, 0xe
imul ecx, edi
sub edx, edi
imul edx, esi
add ecx, edx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
jmp 0x4688cf
cmp esi, 0xc8
jge 0x4688cf
mov esi, 0xc8
mov ecx, dword [ebp + 0x816350]
test ch, 1
je 0x4688e7
cmp esi, 0xc8
jge 0x4688e7
mov esi, 0xc8
test byte [ebp + 0x816324], 2
je 0x4688fd
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
add esi, eax
mov eax, dword [esp + 0x7c]
test eax, eax
mov edi, dword [sym.imp.MSVCR71.dll_rand]
jne 0x468917
mov dword [0x8ca218], 0
jmp 0x468929
cmp eax, 8
jl 0x468aa5
test cl, 8
je 0x468aa5
mov ecx, dword [ebp + 0x816308]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [0x8bb8e4]
sub ecx, edx
mov edx, dword [ebp + 0x816304]
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [0x8bb8f0]
sub eax, edx
jns 0x46896a
neg eax
test ecx, ecx
jge 0x468970
neg ecx
cmp eax, ecx
jle 0x468979
lea eax, [ecx + eax*2]
jmp 0x46897c
lea eax, [eax + ecx*2]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
shl ecx, 2
mov eax, 0x55555556
imul ecx
mov eax, dword [0x727678]
imul eax, eax, 0xbb8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cdq
sub eax, edx
mov edx, dword [esp + 0x7c]
sar eax, 1
test edx, edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
je 0x468a02
mov edx, dword [0x727678]
imul edx, edx, 0x7d0
mov eax, 0x55555556
imul edx
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jge 0x468aa5
cmp word [ebp + 0x816318], 0x32
jge 0x468aa5
call edi
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x468aa5
inc word [ebp + 0x816318]
jmp 0x468aa5
cmp ecx, eax
mov dword [0x8ca210], ecx
jge 0x468a7e
mov eax, dword [0x727678]
movsx edx, byte [0x86bb26]
imul eax, eax, 0x7d0
lea ebx, [edx + edx + 3]
cdq
idiv ebx
add esi, 0x190
mov dword [0x8ca218], 2
cmp ecx, eax
jge 0x468aa1
test dword [0x85c164], 0x484
mov dword [0x8ca218], 3
jne 0x468aa1
call edi
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x468a5d
dec eax
or eax, 0xfffffff8
inc eax
mov ebx, dword [esp + 0x28]
imul eax, eax, 0x45c
lea eax, [eax + 0x816318]
xor ecx, ecx
mov cx, word [eax]
cmp cx, 0x46
jge 0x468aa5
inc ecx
mov word [eax], cx
jmp 0x468aa5
fild dword [esp + 0x20]
fild dword [esp + 0x1c]
fmul dword [0x715948]
fcompp
fnstsw ax
test ah, 0x41
jne 0x468aa5
mov dword [0x8ca218], 1
jmp 0x468aa5
mov ebx, dword [esp + 0x28]
movsx eax, word [ebp + 0x8162f8]
imul eax, eax, 0x44
mov ecx, dword [eax + 0x725b0c]
cmp ecx, 1
jge 0x468ac1
mov ecx, 1
jmp 0x468acb
cmp ecx, 6
jle 0x468acb
mov ecx, 6
mov edi, dword [ebp + 0x816310]
lea eax, [edi + 0xc8]
cdq
idiv ecx
mov ecx, eax
imul ecx, ebx
test edi, edi
jge 0x468b11
cmp word [ebp + 0x81631c], 0
jne 0x468b11
mov ecx, dword [0x727600]
sub ecx, dword [ebp + 0x81630c]
xor edx, edx
test ecx, ecx
setle dl
dec edx
and edx, 0xfe38e390
add edx, 0xe38e38
mov ecx, edx
jmp 0x468b4f
mov eax, dword [ebp + 0x816350]
test ah, 1
je 0x468b24
add ecx, ecx
mov dword [ebp + 0x816314], ecx
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x468b4f
cmp eax, 8
jge 0x468b4f
mov edx, dword [ebp + 0x81630c]
mov eax, dword [ebp + 0x81633c]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
add ecx, ecx
cmp eax, 0x20000000
jle 0x468b4f
add ecx, ecx
mov eax, dword [0x8bb8c0]
cmp eax, 0x21
mov dword [esp + 0x28], eax
jge 0x468b67
mov dword [esp + 0x28], 0x21
jmp 0x468b74
cmp eax, 0x64
jle 0x468b74
mov dword [esp + 0x28], 0x64
mov edi, dword [ebp + 0x816314]
mov bx, word [ebp + 0x81631c]
sub ecx, edi
mov eax, 0x51eb851f
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
neg bx
cdq
sbb ebx, ebx
and ebx, 0xc
add ebx, 4
idiv ebx
imul eax, dword [esp + 0x28]
add edi, eax
test byte [0x85c164], 4
mov dword [ebp + 0x816314], edi
jne 0x468c45
mov eax, dword [esp + 0x7c]
mov ecx, dword [0x727684]
neg eax
sbb eax, eax
and eax, 0x12c
add eax, 0xc8
test ecx, ecx
jge 0x468bda
xor ecx, ecx
cmp ecx, eax
jle 0x468be0
mov ecx, eax
mov eax, dword [0x8bb8c0]
cmp eax, 0x21
jge 0x468bf1
mov eax, 0x21
jmp 0x468bfb
cmp eax, 0x64
jle 0x468bfb
mov eax, 0x64
imul eax, ecx
mov ecx, eax
mov eax, 0x3e0f83e1
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x55555556
imul edi
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x88888889
imul ecx
mov eax, dword [ebp + 0x81630c]
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ebx, ecx
add eax, ebx
mov dword [ebp + 0x81630c], eax
test esi, esi
mov ebx, dword [esp + 0x2c]
jle 0x468c63
cmp dword [esp + 0x7c], 8
jl 0x468c6f
cmp esi, 0x12c
jge 0x468c6f
mov esi, 0x12c
jmp 0x468c6f
cmp word [ebp + 0x81631c], 0
jne 0x468c6f
add esi, esi
mov eax, edi
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
imul ecx, esi
neg ecx
shl ecx, 1
mov eax, 0x90000017
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp + 0x81630c]
add esi, eax
mov eax, dword [0x727600]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x2aaaaaaa
jle 0x468ce6
movsx eax, word [ebp + 0x816322]
cmp eax, 2
jge 0x468ccd
mov eax, 2
lea ecx, [eax + 2]
imul ecx, esi
mov eax, 0x2aaaaaab
imul ecx
jmp 0x468cfd
cmp eax, 4
jle 0x468cd7
mov eax, 4
lea ecx, [eax + 2]
imul ecx, esi
mov eax, 0x2aaaaaab
imul ecx
jmp 0x468cfd
movsx ecx, word [ebp + 0x816322]
add ecx, 6
imul ecx, esi
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, dword [esp + 0x7c]
mov edi, edx
shr edi, 0x1f
xor esi, esi
add edi, edx
cmp eax, esi
jne 0x468da8
test byte [0x86baac], 1
jne 0x468d2f
mov eax, 0x55555555
imul edi
sub edx, edi
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add edi, ecx
mov eax, dword [0x85c164]
test ah, 0x40
mov cl, byte [0x8bb8c8]
jne 0x468d44
test cl, 1
je 0x468d51
cmp edi, esi
jle 0x468d51
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov edi, eax
test cl, 2
je 0x468d63
cmp edi, esi
jle 0x468d63
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, dword [0x72760c]
cmp eax, 0x78
jge 0x468d77
cmp edi, esi
jle 0x468d77
add edi, 0xc8
test byte [0x85c154], 7
jne 0x468d86
mov dword [0x8bb8c8], esi
cmp eax, 0x64
jge 0x468f04
cmp dword [0x816310], esi
jge 0x468f04
xor edi, edi
mov dword [0x816310], esi
jmp 0x468f04
cmp eax, 8
jl 0x468df2
test dword [ebp + 0x816350], 0x400000
jne 0x468df2
mov eax, dword [esp + 0x24]
cmp eax, esi
jle 0x468f04
imul eax, eax, 0x45c
mov ecx, dword [eax + 0x816310]
imul ecx, ebx
mov eax, 0xc953a8bb
imul ecx
add edx, ecx
sar edx, 0x12
mov edi, edx
shr edi, 0x1f
add edi, edx
mov dword [ebp + 0x816310], edi
jmp 0x468f04
mov ecx, dword [ebp + 0x816350]
mov eax, 0x10624dd3
imul ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
or ecx, 1
mov dword [ebp + 0x816350], ecx
mov esi, ecx
mov ecx, eax
imul ecx, dword [0x816310]
mov eax, 0xc4ce07b1
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jle 0x468e36
mov edi, eax
test esi, 0x400000
je 0x468e4b
mov dword [ebp + 0x816310], eax
mov edi, eax
jmp 0x468f04
cmp ebx, 0xc3500
jle 0x468e5a
or dword [0x8bb8c8], 1
cmp ebx, 0xf4240
jle 0x468f04
or dword [0x8bb8c8], 2
push str.Wait_for_me_
mov esi, 0x8ebf58
call fcn.004f7660
mov edx, dword [0x85c164]
mov ecx, dword [0x8bb8d8]
and dl, 0x40
add esp, 4
neg dl
push 0
push 0xc
push 0x1f4
push ecx
sbb edx, edx
and edx, 0xffffffec
add edx, 0xffffffba
mov dword [esp + 0x3c], edx
fild dword [esp + 0x3c]
fmul qword [0x715680]
call fcn.005f275c
mov ecx, dword [ebp + 0x816308]
push eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
lea ecx, [edx + eax - 0x1f4]
push 0
push 0x1f4
push ecx
mov ecx, dword [ebp + 0x816304]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
mov eax, 0xff000000
mov ecx, 0x86bb48
call fcn.004af0b0
add esp, 0x24
mov ebx, dword [ebp + 0x816310]
test ebx, ebx
jle 0x468f42
test edi, edi
jle 0x468f42
mov eax, dword [0x85c158]
mov ecx, 0xa
sub ecx, eax
movsx eax, word [ebp + 0x81631a]
imul ecx, ecx, 0x1e
cdq
sub eax, edx
movsx edx, word [ebp + 0x816318]
sar eax, 1
neg eax
sub eax, edx
add eax, ecx
imul eax, edi
cdq
idiv ecx
mov edi, eax
cmp word [ebp + 0x81631a], 0x64
jl 0x468f4e
xor edi, edi
mov eax, dword [0x85c164]
and eax, 4
mov dword [esp + 0x2c], eax
jne 0x468fb1
sub edi, ebx
test edi, edi
jle 0x468f69
mov esi, 1
jmp 0x468f73
xor eax, eax
test edi, edi
setge al
dec eax
mov esi, eax
mov ecx, dword [esp + 0x7c]
xor eax, eax
test ecx, ecx
movsx ecx, word [ebp + 0x8162f8]
setne al
imul ecx, ecx, 0x44
inc eax
imul eax, edi
cdq
idiv dword [ecx + 0x725b0c]
mov ecx, eax
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ebx
add eax, esi
mov dword [ebp + 0x816310], eax
mov eax, dword [esp + 0x2c]
test dword [0x85c164], 0x480
mov edi, dword [esp + 0x7c]
je 0x468fca
cmp edi, 8
jl 0x4680fb
xor esi, esi
cmp eax, esi
jne 0x4680fb
mov cx, word [ebp + 0x816354]
cmp cx, si
jne 0x469401
mov edi, dword [ebp + 0x816310]
mov ebx, dword [ebp + 0x81630c]
mov eax, edi
mov ecx, ebx
call fcn.004dcac0
imul eax, dword [0x727684]
imul eax, dword [0x727678]
lea eax, [eax + eax*4]
cdq
and edx, 3
add eax, edx
mov ecx, eax
sar ecx, 2
mov eax, 0x88888889
imul ecx
mov eax, dword [ebp + 0x816304]
add edx, ecx
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, eax
lea ecx, [ebx + 0x40000000]
mov eax, edi
call fcn.004dcac0
imul eax, dword [0x727684]
imul eax, dword [0x727678]
lea eax, [eax + eax*4]
cdq
and edx, 3
add eax, edx
mov ecx, eax
sar ecx, 2
mov eax, 0x88888889
imul ecx
mov eax, dword [esp + 0x7c]
add edx, ecx
mov ecx, dword [ebp + 0x816308]
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
add ebx, ecx
test eax, eax
jne 0x469118
mov eax, 0x10624dd3
imul ebx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, dword [0x72ed78]
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov dword [esp + 0x2c], ecx
mov eax, edx
shr eax, 0x1f
fild dword [esp + 0x2c]
add eax, edx
mov dword [esp + 0x28], eax
push 1
fstp dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
fild dword [esp + 0x2c]
push ecx
mov al, 1
fstp dword [esp + 0x30]
mov edx, dword [esp + 0x30]
push edx
call fcn.004e8db0
call fcn.005f275c
test eax, eax
jne 0x4691d1
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x30]
push 0x727618
push eax
mov eax, dword [0x72ed78]
push ecx
call fcn.004e9000
test al, al
jne 0x4691d1
mov eax, dword [0x8bb8c4]
test eax, eax
jne 0x469118
cmp dword [0x72760c], 0x32
jl 0x4691de
mov edi, dword [esp + 0x7c]
mov dword [ebp + 0x816304], esi
mov dword [ebp + 0x816308], ebx
test edi, edi
je 0x46800c
mov eax, dword [esp + 0x7c]
push eax
call fcn.00467390
add esp, 4
cmp word [ebp + 0x8162f8], 0xffff
je 0x4680fb
mov ecx, dword [ebp + 0x816304]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov esi, edx
mov edi, dword [ebp + 0x816308]
shr esi, 0x1f
add esi, edx
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x38], eax
mov eax, 0x10624dd3
imul edi
sar edx, 6
mov ebx, dword [0x816308]
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x10624dd3
imul esi
mov esi, dword [0x816304]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x3c], eax
mov eax, edi
mov edx, ecx
sub eax, ebx
sub edx, esi
jns 0x4691bb
neg edx
test eax, eax
jge 0x4691c1
neg eax
cmp edx, eax
jle 0x46978b
lea eax, [eax + edx*2]
jmp 0x46978e
mov eax, dword [0x8bb8c4]
test eax, eax
jne 0x46800c
mov ecx, dword [0x816308]
mov eax, 0x10624dd3
imul ecx
mov ecx, dword [0x816304]
sar edx, 6
mov eax, edx
mov edi, 0x80000000
push edi
shr eax, 0x1f
push 0x7d0
add eax, edx
push 0xffffffffffffffff
push eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
call fcn.0045fca0
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4693df
call fcn.004757b0
test al, al
je 0x469389
push str.Do_you_wish_to_form_a_landing_party_and_go_ashore__n_No__sail_away._n_Yes__well_anchor_here._n
mov esi, 0x8ebf58
call fcn.004f7660
add esp, 4
push 0
push 0x2c
call fcn.00487950
mov eax, dword [0x85c268]
push 0
push 0
cdq
push 0xffffffffffffffff
push 0
push 0
and edx, 7
add eax, edx
push 0xffffffffffffffff
sar eax, 3
inc eax
push 0
push str.snap
push eax
mov eax, dword [0x85c26c]
cdq
and edx, 3
add eax, edx
sar eax, 2
push eax
call fcn.00430160
add esp, 0x30
cmp eax, 1
jne 0x4692f0
cmp dword [0x86bab0], 0xa
jge 0x469370
push str.You_must_have_at_least_10_crew_members_to_form_a_landing_party._n
call fcn.004f7660
add esp, 4
push 0
push 0x2c
call fcn.00487950
mov eax, dword [0x85c268]
push 0
push 0
cdq
push 0xffffffffffffffff
push 0
push 0
and edx, 7
add eax, edx
push 0xffffffffffffffff
sar eax, 3
inc eax
push 0
push str.snap
push eax
mov eax, dword [0x85c26c]
cdq
and edx, 3
add eax, edx
sar eax, 2
push eax
call fcn.00430160
add esp, 0x30
mov ecx, 2
mov eax, 0x81630c
mov edx, 0x400000
nop
lea esi, [ecx - 2]
cmp esi, 8
jl 0x46930d
test dword [eax + 0x44], edx
je 0x46930f
add dword [eax], edi
lea esi, [ecx - 1]
cmp esi, 8
jl 0x46931f
test dword [eax + 0x4a0], edx
je 0x469325
add dword [eax + 0x45c], edi
cmp ecx, 8
jl 0x469332
test dword [eax + 0x8fc], edx
je 0x469338
add dword [eax + 0x8b8], edi
lea esi, [ecx + 1]
cmp esi, 8
jl 0x469348
test dword [eax + 0xd58], edx
je 0x46934e
add dword [eax + 0xd14], edi
add ecx, 4
lea esi, [ecx - 2]
add eax, 0x1170
cmp esi, 0x100
jl 0x469300
mov dword [0x8bb8c4], 0x28
jmp 0x46800c
push 1
call fcn.0045c1d0
add esp, 4
mov dword [0x816314], 0
jmp 0x46800c
mov eax, str.Sail
mov ecx, 0x125
call fcn.0042d430
test al, al
jne 0x46800c
mov eax, str.Sail
mov ecx, 0x128
call fcn.0042d430
test al, al
jne 0x46800c
mov edx, dword [0x816304]
mov eax, dword [0x81630c]
and dl, 0x32
neg dl
sbb edx, edx
and edx, 0xfffffffe
inc edx
imul edx, edx, 0x16c16c0
add eax, edx
mov dword [0x81630c], eax
jmp 0x46800c
push eax
mov dword [0x8bb8c4], 0x14
call fcn.00466e60
add esp, 4
mov dword [0x8bb8c4], 0x50
jmp 0x46800c
mov eax, 0x51eb851f
imul dword [0x727684]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [ebp + 0x816350]
mov edx, eax
and edx, 8
mov word [ebp + 0x816354], cx
je 0x46943c
cmp cx, 0x12c
jle 0x46943c
mov word [ebp + 0x816354], 0x12c
cmp edx, esi
je 0x469462
mov cx, word [ebp + 0x8162fe]
cmp cx, si
jle 0x469462
movsx ecx, cx
shl ecx, 5
cmp dword [ecx + 0x85c984], 0x2a
jne 0x469462
mov word [ebp + 0x816354], si
cmp word [ebp + 0x816354], si
jg 0x46975f
test ah, 2
mov word [ebp + 0x816354], si
je 0x46975f
test ah, 0x40
je 0x46952d
xor ecx, ecx
mov eax, edi
call fcn.00405e20
cmp eax, 0x10
jge 0x469510
mov eax, dword [0x85c164]
test ah, 4
jne 0x469510
or esi, 0xffffffff
jmp 0x4694b0
push 0xc0008000
push 0x270f
call dword [sym.imp.MSVCR71.dll_rand]
mov ecx, eax
and ecx, 0x80000003
jns 0x4694cf
dec ecx
or ecx, 0xfffffffc
inc ecx
mov eax, dword [0x8bb6b0]
mov edx, 1
shl edx, cl
mov ecx, dword [0x8bb6b4]
or edx, 1
push edx
push eax
push ecx
call fcn.0045fc10
add esp, 0x14
cmp ax, si
mov word [ebp + 0x816338], ax
je 0x4694b0
and dword [ebp + 0x816350], 0xfffffc7f
mov word [ebp + 0x81634c], 0
jmp 0x469530
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 0x2ee
idiv ecx
add word [ebp + 0x816354], dx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
or esi, 0xffffffff
mov eax, dword [ebp + 0x816350]
test ah, 0x10
je 0x469561
mov dx, word [0x724a08]
cmp dx, si
mov word [ebp + 0x816338], dx
jne 0x469561
push 1
push edi
call fcn.00414c00
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
test ah, 0x20
je 0x4695f8
xor edi, edi
lea esp, [esp]
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 0x2c
idiv ecx
mov esi, edx
mov eax, esi
shl eax, 5
mov cl, byte [eax + 0x862b74]
test cl, cl
je 0x469598
inc edi
cmp edi, 0x3e8
jl 0x469570
mov ebx, dword [eax + 0x862b70]
test bl, 2
je 0x469570
movsx ecx, word [ebp + 0x816336]
mov eax, esi
call fcn.00405d50
cmp eax, 0x9a
jg 0x469570
test ebx, 0xc0000000
jne 0x469570
movsx edx, word [ebp + 0x816338]
cmp esi, edx
je 0x469570
mov eax, dword [ebp + 0x816350]
mov edi, dword [esp + 0x7c]
and eax, 0xfffffc7f
or eax, 0x20000
mov word [ebp + 0x816338], si
mov dword [ebp + 0x816350], eax
mov word [ebp + 0x81634c], 0
or esi, 0xffffffff
mov ax, word [ebp + 0x816336]
cmp word [ebp + 0x816338], ax
je 0x46969d
mov cx, word [ebp + 0x81635a]
test cx, cx
jle 0x46963b
movsx edx, cx
imul edx, edx, 0x45c
test dword [edx + 0x816350], 0x200
je 0x46963b
mov word [ebp + 0x816354], 0x64
jmp 0x46975f
mov ebx, dword [ebp + 0x816350]
mov edx, dword [0x85c150]
movsx eax, ax
imul eax, eax, 0x94
movsx eax, word [eax + 0x85dff6]
shl eax, 0x1d
and ebx, 0xfffffcff
test cx, cx
mov dword [ebp + 0x816350], ebx
mov dword [ebp + 0x816340], edx
mov dword [ebp + 0x81633c], eax
mov dword [ebp + 0x81630c], eax
jge 0x469692
movsx ecx, cx
imul ecx, ecx, 0x45c
mov eax, 0x816354
sub eax, ecx
mov word [eax], 0xa
mov dword [ebp + 0x816340], edx
jmp 0x46975f
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 0x1f4
idiv ecx
mov eax, dword [ebp + 0x816350]
add edx, 0xc8
test ah, 0x10
mov word [ebp + 0x816354], dx
je 0x46975f
mov ecx, 1
mov eax, 0x818630
cmp word [eax - 0x58], si
je 0x4696e9
mov edx, dword [eax]
and edx, 0x1200
cmp edx, 0x1000
jne 0x4696e9
xor ecx, ecx
cmp word [eax + 0x404], si
je 0x469708
mov edx, dword [eax + 0x45c]
and edx, 0x1200
cmp edx, 0x1000
jne 0x469708
xor ecx, ecx
cmp word [eax + 0x860], si
je 0x469727
mov edx, dword [eax + 0x8b8]
and edx, 0x1200
cmp edx, 0x1000
jne 0x469727
xor ecx, ecx
cmp word [eax + 0xcbc], si
je 0x469746
mov edx, dword [eax + 0xd14]
and edx, 0x1200
cmp edx, 0x1000
jne 0x469746
xor ecx, ecx
add eax, 0x1170
cmp eax, 0x85bf50
jl 0x4696d1
test ecx, ecx
je 0x46975f
call fcn.004157c0
cmp word [ebp + 0x816354], 0
je 0x469128
test byte [ebp + 0x816350], 0x20
jne 0x469128
push edi
call fcn.00467390
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
lea eax, [edx + eax*2]
cdq
sub eax, edx
mov edx, eax
sar edx, 1
shl edx, 1
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov ebx, dword [0x727678]
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x66666667
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cdq
idiv ebx
mov si, word [ebp + 0x816358]
test si, si
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], eax
je 0x469821
movsx edx, si
imul edx, edx, 0x45c
mov eax, edi
sub eax, dword [edx + 0x816308]
sub ecx, dword [edx + 0x816304]
call fcn.00412810
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cdq
idiv ebx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x816350]
xor ebx, ebx
test al, 0x20
je 0x469aff
cmp word [ebp + 0x816356], bx
jg 0x469aff
cmp si, bx
je 0x469aff
mov edi, 0x64
cmp word [ebp + 0x81631a], di
jge 0x469aff
cmp dword [esp + 0x2c], 0x80
jge 0x469aff
cmp si, 0xffff
je 0x469949
movsx ecx, si
imul ecx, ecx, 0x45c
cmp word [ecx + 0x8162f8], 0xffff
je 0x469ae1
cmp word [ecx + 0x81631a], di
jge 0x469ae1
cmp si, 0xffff
je 0x469949
test al, 8
je 0x469949
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 0x1e
idiv ecx
test edx, edx
jne 0x469949
cmp word [ebp + 0x816320], bx
je 0x469949
movsx ecx, word [ebp + 0x816358]
imul ecx, ecx, 0x45c
mov edx, dword [ecx + 0x816308]
mov ecx, dword [ecx + 0x816304]
mov eax, 0x10624dd3
imul edx
sar edx, 6
push 1
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
mov ecx, dword [ebp + 0x816308]
mov eax, 0x10624dd3
imul ecx
mov ecx, dword [ebp + 0x816304]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
xor ecx, ecx
call fcn.0045abf0
add esp, 0x20
movsx edx, word [ebp + 0x8162f8]
movsx ecx, word [ebp + 0x816322]
imul edx, edx, 0x44
mov eax, dword [edx + 0x725b18]
add eax, edi
cdq
lea edi, [ecx + 1]
idiv edi
dec word [ebp + 0x816356]
mov si, word [ebp + 0x816356]
movsx edx, si
neg eax
cmp edx, eax
jge 0x469aff
cmp word [ebp + 0x816358], 0xffff
mov ax, word [ebp + 0x816320]
mov word [ebp + 0x816356], ax
je 0x469aff
movsx edi, word [ebp + 0x816358]
movsx eax, ax
imul edi, edi, 0x45c
imul eax, ecx
cdq
sub eax, edx
mov esi, eax
sar esi, 1
lea edi, [edi + 0x81631a]
call fcn.00412950
add word [edi], ax
movsx eax, word [ebp + 0x816322]
movsx ecx, word [ebp + 0x816320]
movsx edi, word [ebp + 0x816358]
imul eax, ecx
imul edi, edi, 0x45c
cdq
sub eax, edx
mov esi, eax
sar esi, 1
lea edi, [edi + 0x816318]
call fcn.00412950
add word [edi], ax
movsx edx, word [ebp + 0x816358]
imul edx, edx, 0x45c
mov eax, 0x96
mov word [ebp + 0x816354], ax
mov word [edx + 0x816354], ax
movsx eax, word [ebp + 0x816358]
imul eax, eax, 0x45c
mov ecx, dword [eax + 0x816350]
test ch, 0x60
je 0x469a45
cmp word [eax + 0x81631a], 0x64
jl 0x469a45
mov word [eax + 0x81631a], 0x5a
movsx eax, word [ebp + 0x816358]
imul eax, eax, 0x45c
mov edx, dword [eax + 0x816350]
test dh, 0x40
mov ecx, 0x4b
jne 0x469a6b
cmp word [eax + 0x81631a], cx
jg 0x469a78
cmp word [eax + 0x816318], cx
jle 0x469aff
mov word [eax + 0x81631a], 0x64
movsx eax, word [ebp + 0x816358]
imul eax, eax, 0x45c
mov ecx, dword [eax + 0x816350]
lea eax, [eax + 0x816350]
and ecx, 0xffffff9f
mov dword [eax], ecx
movsx eax, word [ebp + 0x816358]
imul eax, eax, 0x45c
mov word [eax + 0x816358], bx
movsx ecx, word [ebp + 0x816358]
imul ecx, ecx, 0x45c
mov word [ecx + 0x816356], bx
movsx edx, word [ebp + 0x816358]
imul edx, edx, 0x45c
mov word [edx + 0x816354], bx
mov eax, dword [ebp + 0x816350]
and eax, 0xffffff9f
mov dword [ebp + 0x816350], eax
mov word [ebp + 0x816358], bx
mov word [ebp + 0x816356], bx
mov word [ebp + 0x816354], bx
mov eax, dword [ebp + 0x816350]
test al, 0x20
je 0x469b4d
cmp word [ebp + 0x816354], bx
jne 0x469b4d
cmp word [ebp + 0x816358], bx
je 0x469b2f
cmp word [ebp + 0x81631a], 0x64
jge 0x469b2f
cmp dword [esp + 0x2c], 0x80
jl 0x469b4d
and eax, 0xffffff9f
mov dword [ebp + 0x816350], eax
mov word [ebp + 0x816358], bx
mov word [ebp + 0x816356], bx
mov word [ebp + 0x816354], bx
cmp word [ebp + 0x816356], bx
jle 0x469b9f
mov edi, dword [sym.imp.MSVCR71.dll_rand]
lea esp, [esp]
movsx esi, word [ebp + 0x816356]
test esi, esi
jle 0x469b74
call edi
cdq
idiv esi
mov esi, edx
jmp 0x469b76
xor esi, esi
mov cx, word [ebp + 0x816356]
movsx edx, cx
mov eax, 0x55555556
imul edx
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jg 0x469b9f
dec ecx
test cx, cx
mov word [ebp + 0x816356], cx
jg 0x469b60
mov ebx, dword [esp + 0x7c]
cmp ebx, 8
jl 0x46afdb
mov edx, dword [esp + 0x28]
cmp edx, 0x1f4
jle 0x469bbf
and dword [ebp + 0x816350], 0xfffffffb
cmp edx, dword [0x8bb984]
jge 0x469bde
mov eax, ebx
call fcn.00467d10
test al, al
je 0x469bde
mov dword [0x8bb988], ebx
mov dword [0x8bb984], edx
mov ecx, dword [0x816308]
mov edi, dword [ebp + 0x816304]
mov edx, dword [0x816304]
or eax, 0xffffffff
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x816308]
mov dword [esp + 0x14], eax
sub eax, ecx
mov ecx, edi
mov esi, 0xfffffff
sub ecx, edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], edi
call fcn.00412810
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
mov ecx, dword [ebp + 0x816350]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
test ecx, 0x1400000
jne 0x469c71
cmp eax, 0x14d
jge 0x469c71
mov edx, dword [0x8bb8c4]
test edx, edx
jg 0x469c71
cmp dword [0x72760c], 0xc8
jle 0x469c71
or ecx, 0x1000000
mov dword [0x8cc9cc], 1
mov dword [ebp + 0x816350], ecx
cmp eax, 0x7d0
jle 0x469c82
and dword [ebp + 0x816350], 0xfeffffff
mov dword [esp + 0x10], esi
mov si, word [ebp + 0x81634c]
test si, si
je 0x469d56
mov ecx, dword [0x85c154]
add ecx, ebx
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x469cab
dec ecx
or ecx, 0xfffffff8
inc ecx
je 0x469d56
movsx edx, word [ebp + 0x81634a]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], edx
imul edx, edx, 0x45c
mov ecx, dword [edx + 0x816308]
mov ebx, dword [edx + 0x816304]
sub eax, ecx
mov ecx, edi
sub ecx, ebx
call fcn.00412810
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ebx, edx
movsx ecx, si
shr ebx, 0x1f
add ebx, edx
mov dword [esp + 0x2c], ecx
shl ecx, 5
mov esi, dword [ecx + 0x862b6c]
mov eax, 0x10624dd3
imul esi, esi, 0x3e8
imul dword [esp + 0x14]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
mov esi, dword [ecx + 0x862b68]
mov dword [esp + 0x28], eax
imul esi, esi, 0x3e8
mov eax, 0x10624dd3
imul edi
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ecx, esi
mov esi, dword [esp + 0x28]
mov eax, esi
mov dword [esp + 0x10], ebx
call fcn.00412810
mov dword [esp + 0x18], eax
jmp 0x46a266
mov ebx, dword [0x85c164]
mov ecx, dword [ebp + 0x816350]
shr ebx, 7
shr ecx, 3
and ecx, 1
and ebx, 8
cmp ebx, 0x100
mov dword [0x8bb6ac], ecx
jge 0x469e0e
mov esi, ebx
imul esi, esi, 0x45c
add esi, 0x81631a
jmp 0x469d96
mov ecx, dword [0x8bb6ac]
cmp word [esi - 0x22], 0xffff
je 0x469dff
cmp ebx, dword [esp + 0x7c]
je 0x469dff
cmp word [esi], 0x64
jge 0x469dff
mov eax, dword [esi + 0x36]
test eax, 0x100200
jne 0x469dff
mov edx, dword [0x85c150]
sub edx, dword [esi + 0x26]
cmp edx, 0x32
jl 0x469dff
test al, 8
je 0x469dcc
inc ecx
mov dword [0x8bb6ac], ecx
cmp esi, 0x81631a
je 0x469ddc
cmp esi, 0x8185fa
jl 0x469dff
mov ecx, dword [esi - 0x12]
mov eax, dword [esp + 0x14]
mov edx, dword [esi - 0x16]
sub eax, ecx
mov ecx, edi
sub ecx, edx
call fcn.00412810
cmp eax, dword [esp + 0x10]
jge 0x469dff
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], ebx
add esi, 0x45c
inc ebx
cmp esi, 0x85bf1a
jl 0x469d90
cmp word [ebp + 0x8162fa], 0
jne 0x469e7b
cmp word [ebp + 0x8162fe], 0
jg 0x469e7b
test byte [ebp + 0x816350], 8
jne 0x469e7b
cmp dword [esp + 0x10], 0x7a120
jge 0x469e7b
mov ecx, dword [esp + 0x28]
imul ecx, ecx, 0x45c
cmp word [ecx + 0x8162fa], 6
je 0x469e7b
mov ax, word [ebp + 0x816338]
cmp ax, word [ecx + 0x816338]
je 0x46b41e
mov edx, dword [ecx + 0x81630c]
mov eax, dword [ebp + 0x81630c]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xaaaaaaa
jl 0x46b41e
mov ax, word [ebp + 0x816300]
test ax, ax
jle 0x469f3d
movsx ecx, ax
mov ebx, ecx
imul ebx, ebx, 0x45c
cmp word [ebx + 0x8162f8], 0xffff
jne 0x469eae
mov word [ebp + 0x816300], 0
jmp 0x469f3d
mov eax, dword [ebp + 0x816350]
and eax, 0xffffff7f
mov dword [ebp + 0x816350], eax
mov esi, dword [ebx + 0x816308]
mov edi, dword [ebx + 0x816304]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x20]
sub eax, esi
sub ecx, edi
call fcn.00412810
cmp eax, 0x4c4b40
mov dword [esp + 0x10], eax
jge 0x469f39
test byte [esp + 0x1c], 0x20
jne 0x469f39
mov ebx, dword [ebx + 0x81630c]
mov eax, dword [esp + 0x10]
lea ecx, [ebx + 0x40000000]
call fcn.004dcac0
sub esi, dword [esp + 0x14]
add eax, esi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov ecx, ebx
call fcn.004dcac0
mov edx, dword [esp + 0x20]
mov ecx, eax
mov eax, dword [esp + 0x1c]
sub edi, edx
add ecx, edi
call fcn.004dcb20
mov dword [ebp + 0x81633c], eax
mov edi, dword [esp + 0x20]
mov eax, dword [ebp + 0x816350]
test ah, 0x40
je 0x469fa3
test al, 8
je 0x469fa3
mov eax, 0x19
cmp word [ebp + 0x81631a], ax
jge 0x469fa3
cmp word [ebp + 0x816318], ax
jge 0x469fa3
movsx edx, word [ebp + 0x816330]
imul edx, edx, 0x1c
test byte [edx + 0x863ffc], 1
je 0x469fa3
mov eax, dword [0x85c164]
test ah, 4
jne 0x469fa3
mov edx, dword [0x816304]
mov eax, dword [esp + 0x14]
mov ebx, dword [0x816308]
mov ecx, edi
sub eax, ebx
sub ecx, edx
xor esi, esi
call fcn.00412810
mov dword [esp + 0x10], eax
jmp 0x469fa7
mov esi, dword [esp + 0x28]
mov eax, 0x10624dd3
imul dword [esp + 0x10]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x1c], esi
mov word [ebp + 0x81634a], si
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], 2
mov ecx, 0x862b6c
test dword [ecx + 4], 0xc0000000
jne 0x46a04c
mov eax, 0x10624dd3
imul dword [esp + 0x14]
sar edx, 6
mov ebx, dword [ecx - 4]
mov eax, edx
imul ebx, ebx, 0x3e8
shr eax, 0x1f
add eax, edx
mov edx, dword [ecx]
imul edx, edx, 0x3e8
mov esi, eax
sub esi, edx
mov eax, 0x10624dd3
imul edi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
jns 0x46a01e
neg eax
test esi, esi
jge 0x46a024
neg esi
cmp eax, esi
jle 0x46a02d
lea eax, [esi + eax*2]
jmp 0x46a030
lea eax, [eax + esi*2]
cdq
sub eax, edx
mov edx, dword [esp + 0x18]
sar eax, 1
cmp eax, edx
jge 0x46a04c
mov edx, dword [esp + 0x28]
add edx, 0xfffffffe
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], edx
test dword [ecx + 0x24], 0xc0000000
jne 0x46a0c1
mov ebx, dword [ecx + 0x20]
mov eax, 0x10624dd3
imul ebx, ebx, 0x3e8
imul dword [esp + 0x14]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x10624dd3
imul edi
sub esi, ebx
mov ebx, dword [ecx + 0x1c]
imul ebx, ebx, 0x3e8
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
jns 0x46a095
neg eax
test esi, esi
jge 0x46a09b
neg esi
cmp eax, esi
jle 0x46a0a4
lea eax, [esi + eax*2]
jmp 0x46a0a7
lea eax, [eax + esi*2]
cdq
sub eax, edx
mov edx, dword [esp + 0x18]
sar eax, 1
cmp eax, edx
jge 0x46a0c1
mov edx, dword [esp + 0x28]
dec edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], edx
test dword [ecx + 0x44], 0xc0000000
jne 0x46a135
mov ebx, dword [ecx + 0x40]
mov eax, 0x10624dd3
imul ebx, ebx, 0x3e8
imul dword [esp + 0x14]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x10624dd3
imul edi
sub esi, ebx
mov ebx, dword [ecx + 0x3c]
imul ebx, ebx, 0x3e8
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
jns 0x46a10a
neg eax
test esi, esi
jge 0x46a110
neg esi
cmp eax, esi
jle 0x46a119
lea eax, [esi + eax*2]
jmp 0x46a11c
lea eax, [eax + esi*2]
cdq
sub eax, edx
mov edx, dword [esp + 0x18]
sar eax, 1
cmp eax, edx
jge 0x46a135
mov edx, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], edx
test dword [ecx + 0x64], 0xc0000000
jne 0x46a1aa
mov ebx, dword [ecx + 0x60]
mov eax, 0x10624dd3
imul ebx, ebx, 0x3e8
imul dword [esp + 0x14]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x10624dd3
imul edi
sub esi, ebx
mov ebx, dword [ecx + 0x5c]
imul ebx, ebx, 0x3e8
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebx
jns 0x46a17e
neg eax
test esi, esi
jge 0x46a184
neg esi
cmp eax, esi
jle 0x46a18d
lea eax, [esi + eax*2]
jmp 0x46a190
lea eax, [eax + esi*2]
cdq
sub eax, edx
mov edx, dword [esp + 0x18]
sar eax, 1
cmp eax, edx
jge 0x46a1aa
mov edx, dword [esp + 0x28]
inc edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x28]
add eax, 4
mov dword [esp + 0x28], eax
add eax, 0xfffffffe
add ecx, 0x80
cmp eax, 0x2c
jl 0x469fd6
mov ax, word [ebp + 0x816338]
cmp ax, 0x2c
jle 0x46a253
movsx ebx, ax
mov ecx, ebx
shl ecx, 5
mov eax, dword [ecx + 0x862b6c]
imul eax, eax, 0x3e8
mov dword [esp + 0x28], eax
mov eax, 0x10624dd3
imul dword [esp + 0x14]
mov ecx, dword [ecx + 0x862b68]
sar edx, 6
imul ecx, ecx, 0x3e8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, dword [esp + 0x28]
sub esi, eax
mov eax, 0x10624dd3
imul edi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
jns 0x46a22e
neg eax
test esi, esi
jge 0x46a234
neg esi
cmp eax, esi
jle 0x46a23d
lea eax, [esi + eax*2]
jmp 0x46a240
lea eax, [eax + esi*2]
mov ecx, dword [esp + 0x18]
cdq
sub eax, edx
sar eax, 1
cmp eax, ecx
jge 0x46a253
mov dword [esp + 0x18], eax
jmp 0x46a257
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x2c], ebx
mov word [ebp + 0x81634c], bx
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
imul eax, eax, 0x125
cmp byte [eax + ecx + 0x72ed80], 1
jle 0x46a3a6
cmp ebx, 0x7d0
jge 0x46a3a6
mov eax, dword [ebp + 0x816350]
test al, 8
je 0x46a3a6
test ah, 0x41
jne 0x46a3a6
cmp word [ebp + 0x8162fa], 1
je 0x46a3a6
cmp word [ebp + 0x816300], 0
jg 0x46a3a6
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
imul esi, esi, 0x45c
mov ecx, dword [esi + 0x816304]
mov eax, dword [esi + 0x816308]
mov edx, dword [esp + 0x20]
sub eax, edi
mov edi, dword [ebp + 0x81630c]
mov dword [esp + 0x3c], ecx
sub ecx, edx
mov dword [esp + 0x40], eax
call fcn.004dcb20
sub eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x15555555
jge 0x46a3a6
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x46a31e
cmp word [0x86bad0], 1
je 0x46a31e
xor eax, eax
jmp 0x46a323
mov eax, 2
mov edx, dword [esi + 0x816310]
mov ecx, dword [esi + 0x81630c]
imul eax, edx
imul eax, eax, 0x3e8
mov dword [esp + 0x38], edx
mov dword [esp + 0x28], ecx
call fcn.004dcac0
mov ecx, dword [esp + 0x3c]
mov esi, eax
mov eax, dword [esp + 0x1c]
add esi, ecx
test eax, eax
jne 0x46a363
cmp word [0x86bad0], 1
je 0x46a363
xor eax, eax
jmp 0x46a368
mov eax, 2
imul eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x28]
imul eax, eax, 0x3e8
add ecx, 0x40000000
call fcn.004dcac0
add eax, dword [esp + 0x40]
mov ecx, esi
sub ecx, dword [esp + 0x20]
call fcn.004dcb20
sub eax, edi
call fcn.00412f70
imul eax, eax, 0x15555555
sub edi, eax
mov dword [ebp + 0x81633c], edi
mov edi, dword [esp + 0x18]
cmp ebx, edi
jge 0x46a690
mov ebx, dword [ebp + 0x816350]
test bl, bl
js 0x46a690
mov eax, dword [esp + 0x1c]
test eax, eax
jg 0x46a3e8
test bh, 0x40
je 0x46a690
movsx edx, word [ebp + 0x816330]
imul edx, edx, 0x1c
test byte [edx + 0x863ffc], 1
je 0x46a690
mov eax, 0x32
cmp word [ebp + 0x81631a], ax
jge 0x46a5de
cmp word [ebp + 0x816318], ax
jge 0x46a5de
mov edi, dword [esp + 0x1c]
imul edi, edi, 0x45c
mov ax, word [edi + 0x8162fc]
cmp ax, 4
je 0x46a5de
movsx ecx, word [ebp + 0x8162fc]
movsx edx, ax
lea eax, [edx + ecx*8]
cmp dword [eax*4 + 0x85c168], 1
jne 0x46a45c
mov ax, word [ebp + 0x8162fa]
cmp ax, 2
jne 0x46a456
mov cx, word [ebp + 0x816320]
cmp cx, word [edi + 0x816320]
jge 0x46a46d
cmp ax, 3
je 0x46a46d
movsx edx, word [ebp + 0x816300]
cmp edx, dword [esp + 0x1c]
jne 0x46a5de
mov eax, dword [esp + 0x10]
cmp eax, 0xbb8
jge 0x46a5de
lea eax, [eax + eax*2]
cdq
and edx, 3
add eax, edx
mov esi, eax
mov eax, dword [edi + 0x81630c]
sar esi, 2
imul esi, esi, 0x3e8
lea ecx, [eax + 0x40000000]
mov eax, esi
call fcn.004dcac0
mov edx, dword [esp + 0x14]
mov ecx, dword [edi + 0x816308]
sub ecx, edx
add eax, ecx
mov ecx, dword [edi + 0x81630c]
mov dword [esp + 0x40], eax
mov eax, esi
call fcn.004dcac0
mov edx, dword [edi + 0x816304]
mov esi, dword [esp + 0x20]
mov ecx, eax
mov eax, dword [esp + 0x40]
sub edx, esi
add ecx, edx
call fcn.004dcb20
mov ecx, dword [0x727678]
imul ecx, ecx, 0x3e8
mov dword [ebp + 0x81633c], eax
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [esp + 0x10]
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jge 0x46a5be
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x46a5de
mov ecx, ebx
and ecx, 0x4020
cmp ecx, 0x4000
jne 0x46a549
movsx eax, word [ebp + 0x816330]
movsx edx, word [edi + 0x816328]
imul eax, eax, 0x1c
mov ecx, dword [eax + 0x863ff8]
inc word [eax + 0x86400a]
add ecx, edx
mov dword [eax + 0x863ff8], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [edi + 0x816308]
sub eax, ecx
mov ecx, dword [edi + 0x816304]
sub ecx, esi
call fcn.004dcb20
mov dx, word [esp + 0x1c]
add eax, 0x40000000
mov dword [ebp + 0x81633c], eax
mov ecx, 0x96
mov word [ebp + 0x816354], cx
mov word [ebp + 0x816358], dx
or ebx, 0x60
mov dword [ebp + 0x816350], ebx
mov word [edi + 0x816354], cx
mov ecx, dword [edi + 0x816350]
and ecx, 0xffbfffff
mov dword [edi + 0x81633c], eax
mov ax, word [esp + 0x7c]
or ecx, 0x20
mov word [edi + 0x816358], ax
mov dword [edi + 0x816350], ecx
jmp 0x46a5de
and ebx, 0xffffff9f
xor eax, eax
mov dword [ebp + 0x816350], ebx
mov word [ebp + 0x816358], ax
mov word [ebp + 0x816356], ax
mov word [ebp + 0x816354], ax
mov eax, dword [0x727678]
mov ecx, dword [esp + 0x10]
imul eax, eax, 0x960
cmp ecx, eax
jge 0x46a8c9
cmp word [ebp + 0x8162fe], 0
jg 0x46a8c9
mov ax, word [ebp + 0x8162fa]
test ax, ax
je 0x46a624
cmp ax, 4
je 0x46a624
mov eax, dword [ebp + 0x816350]
test ah, 0x40
je 0x46a8c9
mov edx, dword [esp + 0x1c]
movsx eax, word [ebp + 0x8162fc]
imul edx, edx, 0x45c
movsx ecx, word [edx + 0x8162fc]
lea eax, [ecx + eax*8]
cmp dword [eax*4 + 0x85c168], 1
jne 0x46a8c9
mov ax, word [edx + 0x8162fa]
cmp ax, 2
je 0x46a664
cmp ax, 3
jne 0x46a8c9
mov edi, dword [edx + 0x816308]
mov esi, dword [edx + 0x816304]
mov eax, dword [ebp + 0x816308]
mov ecx, dword [ebp + 0x816304]
sub eax, edi
sub ecx, esi
call fcn.004dcb20
mov dword [ebp + 0x81633c], eax
jmp 0x46a8c9
mov si, word [ebp + 0x8162fa]
cmp si, 2
jne 0x46a6d6
cmp edi, 0xbb8
jl 0x46a6bc
mov eax, 0x32
cmp word [ebp + 0x81631a], ax
jge 0x46a6bc
cmp word [ebp + 0x816318], ax
jle 0x46a6d6
or dword [ebp + 0x816350], 0x80
mov eax, dword [esp + 0x7c]
call fcn.0045b530
mov word [ebp + 0x816336], ax
cmp si, 3
jne 0x46a8c9
cmp edi, 0x7d0
jge 0x46a8c9
mov edi, dword [esp + 0x2c]
movsx ecx, word [ebp + 0x8162fc]
shl edi, 5
movsx edx, byte [edi + 0x862b74]
lea eax, [edx + ecx*8]
cmp dword [eax*4 + 0x85c168], 1
jne 0x46a8c9
cmp word [ebp + 0x81631a], 0x32
jge 0x46a8c9
cmp word [ebp + 0x816318], 0x32
jge 0x46a8c9
mov eax, dword [ebp + 0x816350]
test al, al
mov dword [esp + 0x1c], eax
js 0x46a8c9
mov cx, word [ebp + 0x816354]
test cx, cx
jne 0x46a7ff
mov ebx, dword [edi + 0x862b6c]
mov ecx, dword [edi + 0x862b68]
imul ebx, ebx, 0x3e8
mov eax, 0x10624dd3
imul ecx, ecx, 0x3e8
imul dword [esp + 0x14]
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x10624dd3
imul dword [esp + 0x20]
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
mov dword [esp + 0x40], ecx
mov eax, ebx
sub eax, esi
sub ecx, edi
call fcn.004dcb20
add eax, 0x40000000
mov dword [ebp + 0x81633c], eax
mov eax, dword [esp + 0x1c]
or eax, 0x60
test al, 8
mov word [ebp + 0x816354], 0x1f4
mov dword [ebp + 0x816350], eax
mov word [ebp + 0x816358], 0xffff
je 0x46a8c9
cmp word [ebp + 0x816320], 0
je 0x46a8c9
mov ecx, dword [esp + 0x40]
push 1
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push ebx
push ecx
push esi
push edi
mov ecx, 0xa
call fcn.0045abf0
add esp, 0x20
jmp 0x46a8c9
cmp cx, 1
jne 0x46a8c9
and eax, 0xffffff9f
mov dword [ebp + 0x816350], eax
mov eax, dword [esp + 0x7c]
call fcn.0045b6a0
mov ecx, dword [edi + 0x862b7c]
mov eax, 0x66666667
imul ecx
mov esi, dword [esp + 0x2c]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [edi + 0x862b7c], ecx
mov cl, byte [edi + 0x862b76]
movsx eax, cl
cdq
and edx, 3
add eax, edx
sar eax, 2
sub cl, al
mov byte [edi + 0x862b76], cl
mov ecx, esi
imul ecx, ecx, 0x94
add word [ecx + 0x85df7e], 0x32
lea eax, [ecx + 0x85df7e]
mov ax, word [ebp + 0x8162fe]
xor ebx, ebx
cmp ax, bx
mov word [ebp + 0x816358], bx
mov word [ebp + 0x816356], bx
mov word [ebp + 0x816354], bx
jle 0x46a89f
movsx edx, ax
push 1
push edx
call fcn.0044d240
add esp, 8
cmp dword [edi + 0x862b80], 7
jne 0x46a8c9
movsx ecx, word [ebp + 0x8162fc]
mov al, byte [ebp + 0x8162fc]
push 0
push esi
push ecx
push 0x15
mov byte [edi + 0x862b74], al
call fcn.0043a8d0
add esp, 0x10
mov ax, word [ebp + 0x8162fa]
cmp ax, 2
je 0x46a8dc
cmp ax, 3
jne 0x46a90d
mov eax, 0x32
cmp word [ebp + 0x81631a], ax
jge 0x46a8f3
cmp word [ebp + 0x816318], ax
jl 0x46a90d
or dword [ebp + 0x816350], 0x80
mov eax, dword [esp + 0x7c]
call fcn.0045b530
mov word [ebp + 0x816336], ax
cmp word [ebp + 0x8162fc], 4
jne 0x46a951
mov eax, dword [ebp + 0x816350]
test ah, 4
je 0x46a951
cmp word [ebp + 0x81631a], 0
jne 0x46a936
cmp word [ebp + 0x816318], 0
je 0x46a951
or eax, 0x80
mov dword [ebp + 0x816350], eax
mov eax, dword [esp + 0x7c]
call fcn.0045b530
mov word [ebp + 0x816336], ax
mov ecx, dword [ebp + 0x816304]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x10624dd3
imul ecx
mov ecx, dword [ebp + 0x816308]
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x10624dd3
imul ecx
mov ebx, dword [ebp + 0x816350]
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
test ebx, 0x400000
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], ebx
je 0x46aa64
movsx eax, word [ebp + 0x816338]
shl eax, 5
mov ecx, dword [eax + 0x862b6c]
mov eax, dword [eax + 0x862b68]
sub ecx, edi
sub eax, esi
jns 0x46a9dd
neg eax
test ecx, ecx
jge 0x46a9e3
neg ecx
cmp eax, ecx
jle 0x46a9ec
lea eax, [ecx + eax*2]
jmp 0x46a9ef
lea eax, [eax + ecx*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, 6
jle 0x46aa58
movsx ebx, word [ebp + 0x816338]
movsx ecx, word [ebp + 0x816336]
mov eax, ebx
call fcn.00405d50
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x40], eax
mov eax, ebx
call fcn.00405d90
mov edx, dword [ebp + 0x816340]
mov ecx, dword [0x85c150]
mov ebx, eax
sub ecx, edx
mov eax, 0x10624dd3
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add ebx, edx
lea ecx, [eax + ebx - 4]
mov eax, dword [esp + 0x40]
cmp eax, ecx
jl 0x46aa54
mov eax, dword [0x85c164]
test ah, 4
je 0x46aa64
mov ebx, dword [esp + 0x1c]
and ebx, 0xffbfffff
mov dword [ebp + 0x816350], ebx
test esi, esi
jl 0x46b5ab
test edi, edi
jl 0x46b5ab
cmp esi, 0x1ce
jge 0x46b5ab
cmp edi, 0x125
jge 0x46b5ab
cmp esi, dword [esp + 0x34]
jne 0x46aaa8
cmp edi, dword [esp + 0x30]
jne 0x46aaa8
test dword [ebp + 0x816350], 0x110
je 0x46afdb
mov eax, dword [esp + 0x24]
test eax, eax
jg 0x46afdb
test dword [ebp + 0x816350], 0x400020
jne 0x46afdb
cmp word [ebp + 0x8162fa], 3
jne 0x46aafc
movsx edx, word [ebp + 0x816338]
movsx ecx, word [ebp + 0x8162fc]
shl edx, 5
movsx eax, byte [edx + 0x862b74]
lea edx, [eax + ecx*8]
cmp dword [edx*4 + 0x85c168], 1
je 0x46aafc
mov eax, dword [esp + 0x7c]
call fcn.0045b6a0
mov esi, dword [ebp + 0x816350]
xor eax, eax
mov ax, word [ebp + 0x816338]
movsx edx, ax
mov dword [esp + 0x1c], esi
shr esi, 8
not esi
mov dword [esp + 0x3c], eax
mov eax, edx
imul eax, eax, 0x94
mov dword [esp + 0x38], eax
movsx eax, word [eax + 0x85dff6]
shl eax, 2
mov edi, dword [eax + 0x7272f0]
and esi, 1
imul edi, esi
mov ecx, edx
shl ecx, 5
add edi, dword [ecx + 0x862b68]
mov ebx, dword [eax + 0x727350]
mov eax, dword [ecx + 0x862b6c]
imul ebx, esi
add ebx, eax
mov al, byte [esp + 0x1c]
test al, al
mov dword [esp + 0x18], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x14], edx
jns 0x46abe4
movsx ecx, word [ebp + 0x816336]
mov eax, ecx
imul eax, eax, 0x94
movsx eax, word [eax + 0x85dff6]
shl eax, 2
mov edi, dword [eax + 0x7272f0]
imul edi, esi
mov dword [esp + 0x40], ecx
shl ecx, 5
mov ebx, dword [ecx + 0x862b68]
mov edx, dword [ecx + 0x862b6c]
mov ecx, dword [esp + 0x30]
add edi, ebx
mov ebx, dword [eax + 0x727350]
imul ebx, esi
add ebx, edx
mov edx, dword [esp + 0x34]
mov eax, ebx
sub eax, ecx
mov ecx, edi
sub ecx, edx
call fcn.00412810
cmp eax, 3
jle 0x46abd8
mov eax, dword [esp + 0x1c]
and eax, 0xfffffeff
mov dword [ebp + 0x816350], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x2c]
xor eax, eax
mov ax, word [ebp + 0x8162fa]
cmp ax, 3
mov dword [esp + 0x10], eax
jne 0x46ac02
movsx edx, word [ebp + 0x816336]
mov dword [esp + 0x14], edx
cmp ax, 2
jne 0x46ad78
mov eax, 0x32
cmp word [ebp + 0x81631a], ax
jge 0x46ad78
cmp word [ebp + 0x816318], ax
jge 0x46ad78
mov al, byte [ebp + 0x816350]
test al, al
js 0x46ad78
mov eax, 0x818630
mov dword [esp + 0x34], 0xfffffff
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x1c], 8
mov dword [esp + 0x24], eax
lea ebx, [ebx]
cmp word [eax - 0x58], 0xffff
je 0x46acba
test dword [eax], 0x100200
jne 0x46acba
movsx edx, word [eax - 0x54]
movsx ecx, word [ebp + 0x8162fc]
lea ecx, [edx + ecx*8]
cmp dword [ecx*4 + 0x85c168], 1
jne 0x46acba
mov edx, dword [esp + 0x24]
mov ecx, dword [edx - 0x48]
mov eax, dword [ebp + 0x816308]
sub eax, ecx
mov ecx, dword [ebp + 0x816304]
sub ecx, dword [edx - 0x4c]
call fcn.00412810
cmp eax, dword [esp + 0x34]
jge 0x46acb6
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
add eax, 0x45c
inc ecx
cmp eax, 0x85bf50
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], eax
jl 0x46ac60
mov ecx, dword [esp + 0x30]
cmp ecx, 0xffffffff
je 0x46ad6b
imul ecx, ecx, 0x45c
mov edx, dword [ecx + 0x816304]
mov eax, 0x10624dd3
imul edx
mov ecx, dword [ecx + 0x816308]
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x10624dd3
imul ecx
mov eax, dword [esp + 0x20]
sar edx, 6
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
cmp edi, eax
jne 0x46ad66
cmp ebx, dword [esp + 0x28]
jne 0x46ad66
mov eax, dword [esp + 0x7c]
call fcn.0045b530
mov word [ebp + 0x816336], ax
movsx eax, ax
shl eax, 5
mov edi, dword [eax + 0x862b68]
mov ebx, dword [eax + 0x862b6c]
or esi, 0xffffffff
jmp 0x46ad74
mov word [ebp + 0x8162f8], 0xffff
mov ecx, dword [esp + 0x2c]
mov ax, word [ebp + 0x816300]
test ax, ax
jle 0x46ae20
cmp word [ebp + 0x81631a], 0x32
jge 0x46ae20
movsx ebx, ax
imul ebx, ebx, 0x45c
mov edx, dword [ebx + 0x816304]
mov ecx, dword [ebx + 0x81630c]
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov ebx, dword [ebx + 0x816308]
mov eax, edx
shr eax, 0x1f
lea edx, [edx + eax + 0x1f4]
mov eax, 0x10624dd3
imul edx
sar ecx, 0x1c
sar edx, 6
inc ecx
mov edi, edx
sar ecx, 1
and ecx, 7
shl ecx, 2
shr edi, 0x1f
add edi, edx
add edi, dword [ecx + 0x7272f0]
mov eax, 0x10624dd3
imul ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
lea edx, [edx + eax + 0x1f4]
mov eax, 0x10624dd3
imul edx
mov eax, dword [ecx + 0x727350]
mov ecx, dword [esp + 0x2c]
sar edx, 6
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
add ebx, eax
or esi, 0xffffffff
cmp word [esp + 0x10], 1
jne 0x46b02a
movsx esi, word [ebp + 0x816336]
mov ecx, dword [esp + 0x7c]
mov edi, dword [0x8bb6b4]
mov ebx, dword [0x8bb6b0]
mov eax, esi
call fcn.00405d90
mov dword [esp + 0x40], eax
mov eax, esi
call fcn.0045e610
mov ecx, dword [esp + 0x40]
cmp ecx, eax
jg 0x46ae8b
mov eax, dword [0x85c164]
test ah, 4
jne 0x46ae8b
movsx ecx, word [ebp + 0x8162fc]
movsx edx, word [ecx*2 + 0x86ba78]
movsx ecx, word [0x81631a]
mov eax, 0xa
sub eax, edx
lea eax, [eax + eax*4]
cmp ecx, eax
jle 0x46ae9d
mov word [ebp + 0x8162fa], 3
mov eax, dword [esp + 0x7c]
call fcn.0045b6a0
mov cx, word [ebp + 0x8162fa]
test cx, cx
mov eax, dword [ebp + 0x81630c]
je 0x46aeb9
cmp cx, 4
jne 0x46af6f
cmp word [ebp + 0x81635a], 0
jl 0x46af6f
mov ecx, dword [ebp + 0x816350]
test cl, 8
je 0x46af6f
test ch, 0x10
jne 0x46af6f
cmp word [ebp + 0x8162fe], 0
jne 0x46af6f
movsx edx, word [ebp + 0x8162fc]
movsx ecx, word [edx*2 + 0x86ba78]
movsx edx, word [ebp + 0x8162f8]
imul edx, edx, 0x44
mov edx, dword [edx + 0x725b08]
neg edx
cmp ecx, edx
jg 0x46af6f
cmp word [ebp + 0x816322], 2
jg 0x46af6f
mov edx, dword [0x816308]
mov ecx, dword [0x816304]
mov eax, dword [ebp + 0x816308]
mov esi, dword [ebp + 0x816304]
sub eax, edx
sub esi, ecx
call fcn.004dca00
mov edx, dword [esp + 0x20]
mov ecx, dword [eax*4 + 0x7272f0]
mov esi, dword [esp + 0x28]
lea ecx, [edx + ecx*2]
mov edx, dword [eax*4 + 0x727350]
lea edx, [esi + edx*2]
mov esi, ecx
imul esi, esi, 0x125
cmp byte [esi + edx + 0x7b30a0], 3
jg 0x46af6f
mov edi, ecx
mov ebx, edx
mov ecx, dword [ebp + 0x816350]
test ch, 1
je 0x46b441
mov edx, dword [ebp + 0x816308]
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
test cl, cl
mov edx, dword [ebp + 0x816304]
jns 0x46b435
movsx ecx, word [ebp + 0x816336]
shl ecx, 4
mov esi, dword [ecx + 0x85d174]
mov ecx, dword [ecx + 0x85d170]
sub esi, eax
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, esi
call fcn.004dcb20
mov dword [ebp + 0x81633c], eax
xor eax, eax
mov ax, word [ebp + 0x81631a]
cmp ax, 0x64
jl 0x4680fb
add eax, 0xa
cmp ax, 0x3e8
mov word [ebp + 0x81631a], ax
jl 0x4680fb
mov eax, dword [esp + 0x7c]
cmp eax, 8
jge 0x46b6d0
mov ebx, eax
call fcn.00467d50
push 1
xor eax, eax
call fcn.0045bb50
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
mov eax, dword [esp + 0x20]
sub eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 1
jg 0x46b04a
mov eax, dword [esp + 0x28]
sub eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 1
jle 0x46b059
mov eax, dword [ebp + 0x816350]
test ah, 1
je 0x46ae9d
cmp word [esp + 0x10], 3
jne 0x46b137
mov al, byte [ebp + 0x816350]
test al, al
js 0x46b137
cmp word [esp + 0x3c], 0x2c
jle 0x46b137
movsx edx, byte [ecx + 0x862b74]
movsx eax, word [ebp + 0x8162fc]
lea ecx, [edx + eax*8]
cmp dword [ecx*4 + 0x85c168], 1
jne 0x46ae94
mov edx, dword [esp + 0x38]
cmp word [edx + 0x85df78], 5
jge 0x46ae94
mov cl, byte [ebp + 0x8162fc]
mov edx, dword [esp + 0x2c]
mov byte [edx + 0x862b74], cl
mov ecx, dword [esp + 0x18]
push 0
push ecx
push eax
push 0x15
call fcn.0043a8d0
mov al, byte [ebp + 0x816350]
add esp, 0x10
test al, 8
je 0x46b101
mov eax, dword [0x85c164]
test ah, 4
jne 0x46b101
push 0xbf800000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x56
or esi, 0xffffffff
xor eax, eax
or ecx, 0xffffffff
call fcn.00488840
add esp, 0x10
movsx eax, word [ebp + 0x816338]
mov edx, eax
shl edx, 5
lea ecx, [edx + 0x862b70]
mov edx, dword [ecx]
and edx, 0xfff7ffff
or edx, 0x20000
imul eax, eax, 0x94
mov dword [ecx], edx
mov word [eax + 0x85df78], 0
jmp 0x46ae94
mov eax, dword [ebp + 0x816350]
test ah, 1
mov dword [esp + 0x1c], eax
jne 0x46b183
cmp esi, 0xffffffff
je 0x46ae9d
mov ecx, dword [0x85c150]
mov edx, dword [esp + 0x18]
or eax, 0x100
test al, 8
mov dword [ebp + 0x816350], eax
mov dword [edx*4 + 0x85bef8], ecx
je 0x46ae9d
and eax, 0xff7fffff
mov dword [ebp + 0x816350], eax
jmp 0x46ae9d
cmp word [ebp + 0x8162f8], 0
jne 0x46b236
mov esi, dword [ecx + 0x862b7c]
mov eax, 0xc8
sub eax, esi
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x7c]
sar eax, 3
imul edx, edx, 0x45c
add eax, esi
mov dword [ecx + 0x862b7c], eax
mov eax, dword [esp + 0x18]
movsx ecx, word [edx + 0x81632a]
imul eax, eax, 0x94
mov esi, dword [eax + 0x85df9c]
add eax, 4
add edx, 2
add esi, ecx
movsx ecx, word [edx + 0x81632a]
mov dword [eax + 0x85df98], esi
mov esi, dword [eax + 0x85df9c]
add esi, ecx
movsx ecx, word [edx + 0x81632c]
mov dword [eax + 0x85df9c], esi
mov esi, dword [eax + 0x85dfa0]
add esi, ecx
movsx ecx, word [edx + 0x81632e]
movsx edx, word [edx + 0x816330]
mov dword [eax + 0x85dfa0], esi
mov esi, dword [eax + 0x85dfa4]
add esi, ecx
mov ecx, dword [eax + 0x85dfa8]
add ecx, edx
mov dword [eax + 0x85dfa4], esi
mov dword [eax + 0x85dfa8], ecx
mov eax, dword [esp + 0x1c]
test ah, 4
je 0x46b36e
mov eax, dword [esp + 0x1c]
or eax, 0x200
mov dword [ebp + 0x816350], eax
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 0x3e8
idiv ecx
mov eax, dword [ebp + 0x816350]
add edx, 0x1f4
test al, al
mov word [ebp + 0x816354], dx
jns 0x46b27c
mov cx, word [ebp + 0x816336]
jmp 0x46b283
mov cx, word [ebp + 0x816338]
mov word [ebp + 0x816338], cx
mov word [ebp + 0x816336], cx
movsx ecx, cx
imul ecx, ecx, 0x94
movsx ecx, word [ecx + 0x85dff6]
xor ecx, 4
shl ecx, 0x1d
and eax, 0xffffff7f
mov dword [ebp + 0x81630c], ecx
xor ecx, ecx
test ah, 0x20
mov dword [ebp + 0x816350], eax
mov word [ebp + 0x816318], cx
mov word [ebp + 0x81631a], cx
je 0x46b2da
add edx, 0x1770
mov word [ebp + 0x816354], dx
test ah, 0x40
je 0x46b2e8
add word [ebp + 0x816354], 0xbb8
test ah, 0x10
je 0x46ae9d
movsx eax, word [ebp + 0x81632c]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
call fcn.00412950
sub word [ebp + 0x81632c], ax
movsx eax, word [ebp + 0x81632e]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
call fcn.00412950
movsx edx, word [ebp + 0x816338]
sub word [ebp + 0x81632e], ax
shl edx, 5
mov eax, dword [edx + 0x862b7c]
lea esi, [eax + eax*4]
call fcn.00412950
add word [ebp + 0x816328], ax
mov eax, dword [ebp + 0x816350]
test eax, 0x20000
je 0x46ae9d
add word [ebp + 0x816354], 0x3e8
and eax, 0xfffdffff
mov dword [ebp + 0x816350], eax
jmp 0x46ae9d
mov ax, word [ebp + 0x816348]
cmp ax, 0x64
jge 0x46b41e
test ax, ax
jne 0x46ae9d
mov ecx, dword [ebp + 0x816308]
mov esi, dword [esp + 0x14]
mov eax, 0x10624dd3
imul ecx
mov ecx, dword [ebp + 0x816304]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
shl esi, 4
sub eax, dword [esi + 0x85d174]
mov dword [esp + 0x40], eax
mov eax, 0x10624dd3
imul ecx
mov eax, dword [esp + 0x40]
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ecx, dword [esi + 0x85d170]
call fcn.00412810
cmp eax, 0x5dc
jge 0x46ae9d
mov ecx, dword [0x8bb8c0]
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
jns 0x46b408
xor eax, eax
mov word [ebp + 0x816348], ax
jmp 0x46ae9d
cmp eax, 0x64
jle 0x46b412
mov eax, 0x64
mov word [ebp + 0x816348], ax
jmp 0x46ae9d
mov ecx, dword [esp + 0x7c]
push 1
push ecx
call fcn.00414c00
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
movsx ecx, word [ebp + 0x816338]
jmp 0x46afaa
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x7c]
push ecx
push esi
push ebx
push edi
push edx
call fcn.00475020
add esp, 0x14
cmp eax, 2
mov dword [ebp + 0x81633c], eax
jne 0x46b46b
mov dword [ebp + 0x81633c], eax
cmp dword [ebp + 0x81633c], 0xffffffff
jne 0x46b4b3
mov eax, dword [ebp + 0x816350]
test ah, 4
je 0x46b594
imul edi, edi, 0xf4240
imul ebx, ebx, 0xf4240
mov dword [ebp + 0x816304], edi
mov dword [ebp + 0x816308], ebx
call dword [sym.imp.MSVCR71.dll_rand]
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x46b4ad
dec eax
or eax, 0xfffffff8
inc eax
mov dword [ebp + 0x81633c], eax
mov ecx, dword [ebp + 0x81633c]
mov edx, dword [esp + 0x28]
shl ecx, 2
mov edi, dword [ecx + 0x727350]
add edi, edx
mov edx, dword [ebp + 0x816308]
imul edi, edi, 0x3e8
mov ecx, dword [ecx + 0x7272f0]
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp + 0x816304]
sub edi, eax
mov eax, 0x10624dd3
imul edx
add ecx, esi
imul ecx, ecx, 0x3e8
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add edi, 0x1f4
add ecx, 0x1f4
mov eax, edi
call fcn.004dcb20
mov ecx, dword [ebp + 0x816350]
test ch, 1
mov dword [ebp + 0x81633c], eax
lea esi, [eax - 0x40000000]
jne 0x46b560
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x20000000
jge 0x46b560
xor edx, edx
test esi, esi
setle dl
dec edx
and edx, 0x40000000
add edx, 0x20000000
mov dword [ebp + 0x81633c], edx
test cl, 8
jne 0x46b571
mov eax, dword [ebp + 0x81633c]
mov dword [ebp + 0x81630c], eax
test cl, 0x10
je 0x46afdb
mov edx, dword [ebp + 0x81633c]
and ecx, 0xffffffef
mov dword [ebp + 0x81630c], edx
mov dword [ebp + 0x816350], ecx
jmp 0x46afdb
mov eax, dword [esp + 0x7c]
push 1
push eax
call fcn.00414c00
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
mov eax, dword [ebp + 0x816350]
test ah, 0x40
je 0x46b6b9
mov edi, dword [sym.imp.MSVCR71.dll_rand]
call edi
cdq
mov ecx, 0x2c
idiv ecx
mov ecx, dword [0x816308]
mov eax, 0x10624dd3
push 0xc0008000
push 0x270f
push 0xffffffffffffffff
mov esi, edx
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x10624dd3
imul ecx
mov ecx, dword [0x816304]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
call fcn.0045fc10
add esp, 0x14
cmp eax, esi
jne 0x46b5c0
mov eax, esi
imul esi, esi, 0x94
movsx esi, word [esi + 0x85dff6]
shl eax, 5
mov edi, dword [eax + 0x862b68]
mov ebx, dword [eax + 0x862b6c]
imul edi, edi, 0xf4240
imul ebx, ebx, 0xf4240
shl esi, 0x1d
mov eax, 0x51615
mov ecx, esi
mov dword [ebp + 0x816304], edi
mov dword [ebp + 0x816308], ebx
mov dword [ebp + 0x81633c], esi
mov dword [ebp + 0x81630c], esi
mov dword [ebp + 0x816310], 0x12c
call fcn.004dcac0
add eax, edi
mov dword [ebp + 0x816304], eax
lea ecx, [esi + 0x40000000]
mov eax, 0x51615
call fcn.004dcac0
add eax, ebx
mov dword [ebp + 0x816308], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
mov edx, dword [esp + 0x7c]
push 2
push edx
call fcn.00414c00
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
push 2
push eax
call fcn.00414c00
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret