Function at 0x4954ca
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x4d1eab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
mov dword [0x5246f8], esi
push fcn.00435d40
push fcn.0046dbf0
push 7
push 0x10
xor ebx, ebx
push esi
mov dword [esp + 0x38], ebx
call fcn.004bf7a6
lea edi, [esi + 0x70]
mov byte [esp + 0x24], 1
mov eax, edi
mov ecx, 0x39
mov byte [eax], 0
mov dword [eax + 4], ebx
add eax, 8
dec ecx
jne 0x495501
mov ebx, esi
mov ebp, 7
push 0x39
mov ecx, ebx
call fcn.00495370
add ebx, 0x10
dec ebp
jne 0x495514
mov byte [esp + 0x10], 0
mov ecx, dword [esp + 0x10]
mov eax, str.HELM
mov dword [edi + 4], eax
mov byte [esp + 0x10], 1
mov edx, dword [esp + 0x10]
mov eax, str.SHIRT
mov dword [esi + 0x7c], eax
mov byte [esp + 0x10], 2
mov eax, str.TUNIC
mov dword [esi + 0x84], eax
mov eax, str.ARMOUR
mov dword [esi + 0x8c], eax
mov eax, str.GLOVE
mov dword [esi + 0x94], eax
mov dword [edi], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 3
mov dword [esi + 0x78], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 4
mov eax, str.BOOTS
mov dword [esi + 0x9c], eax
mov dword [esi + 0x80], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 5
mov eax, str.ONEHANDED_SWORD
mov dword [esi + 0xa4], eax
mov dword [esi + 0x88], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 6
mov eax, str.ONEHANDED_BLUNT
mov dword [esi + 0xac], eax
mov dword [esi + 0x90], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 7
mov eax, str.ONEHANDED_AXE
mov dword [esi + 0xb4], eax
mov dword [esi + 0x98], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 8
mov eax, str.TWOHANDED_BLUNT
mov dword [esi + 0xbc], eax
mov dword [esi + 0xa0], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 9
mov dword [esi + 0xa8], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0xa
mov eax, str.TWOHANDED_AXE
mov dword [esi + 0xc4], eax
mov dword [esi + 0xb0], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 0xb
mov eax, str.TWOHANDED_SWORD
mov dword [esi + 0xcc], eax
mov dword [esi + 0xb8], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0xc
mov eax, 0x4f5c58
mov dword [esi + 0xd4], eax
mov dword [esi + 0xc0], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 0xd
mov eax, str.CROSSBOW
mov dword [esi + 0xc8], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0xdc], eax
mov byte [esp + 0x10], 0xe
mov eax, str.STAFF
mov dword [esi + 0xd0], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 0xf
mov dword [esi + 0xd8], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0xe4], eax
mov eax, str.DAGGER
mov dword [esi + 0xe0], ecx
mov dword [esi + 0xe8], edx
mov dword [esi + 0xec], eax
mov byte [esp + 0x10], 0x10
mov ecx, dword [esp + 0x10]
mov eax, str.SHIELD
mov dword [esi + 0xf4], eax
mov byte [esp + 0x10], 0x11
mov edx, dword [esp + 0x10]
mov eax, str.CLOAK
mov dword [esi + 0xfc], eax
mov byte [esp + 0x10], 0x12
mov eax, str.RING
mov dword [esi + 0x104], eax
mov eax, str.NECKLACE
mov dword [esi + 0x10c], eax
mov eax, str.POTION
mov dword [esi + 0x114], eax
mov dword [esi + 0xf0], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x13
mov eax, str.POISON
mov dword [esi + 0x11c], eax
mov dword [esi + 0xf8], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x14
mov eax, str.TRAP
mov dword [esi + 0x124], eax
mov dword [esi + 0x100], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x15
mov dword [esi + 0x108], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x16
mov eax, str.SKILLBOOK
mov dword [esi + 0x12c], eax
mov dword [esi + 0x110], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x17
mov eax, 0x4f5bf0
mov dword [esi + 0x134], eax
mov dword [esi + 0x118], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x18
mov eax, str.RUNE
mov dword [esi + 0x13c], eax
mov dword [esi + 0x120], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x19
mov eax, 0x4f5be4
mov dword [esi + 0x144], eax
mov dword [esi + 0x128], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x1a
mov eax, str.AMMO
mov dword [esi + 0x14c], eax
mov dword [esi + 0x130], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x1b
mov dword [esi + 0x138], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x1c
mov eax, 0x4f5bd8
mov dword [esi + 0x154], eax
mov dword [esi + 0x140], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x1d
mov eax, str.HEAD
mov dword [esi + 0x15c], eax
mov dword [esi + 0x148], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x1e
mov eax, str.BODY
mov dword [esi + 0x150], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x164], eax
mov byte [esp + 0x10], 0x1f
mov eax, str.PROTECT_A
mov dword [esi + 0x158], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x16c], eax
mov dword [esi + 0x160], ecx
mov dword [esi + 0x168], edx
mov byte [esp + 0x10], 0x20
mov eax, str.PELVIS
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x174], eax
mov byte [esp + 0x10], 0x21
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x22
mov eax, str.COM_BLUNT
mov dword [esi + 0x17c], eax
mov eax, str.COM_SWORD
mov dword [esi + 0x184], eax
mov dword [esi + 0x170], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x23
mov dword [esi + 0x178], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x24
mov eax, str.OPP_HAMMER
mov dword [esi + 0x18c], eax
mov dword [esi + 0x180], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x25
mov eax, str.OPP_AXE
mov dword [esi + 0x194], eax
mov dword [esi + 0x188], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x26
mov eax, str.OPP_SLUSHER
mov dword [esi + 0x19c], eax
mov dword [esi + 0x190], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x27
mov dword [esi + 0x198], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x28
mov eax, str.OPP_TALON
mov dword [esi + 0x1a4], eax
mov eax, str.OPP_SYTHE
mov dword [esi + 0x1ac], eax
mov dword [esi + 0x1a0], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x29
mov dword [esi + 0x1a8], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x2a
mov eax, str.SKILL_A_GUARD
mov dword [esi + 0x1b4], eax
mov dword [esi + 0x1b0], ecx
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x2b
mov eax, str.SKILL_A_ATTACK
mov dword [esi + 0x1bc], eax
mov dword [esi + 0x1b8], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x2c
mov eax, str.SKILL_A_GUN
mov dword [esi + 0x1c4], eax
mov dword [esi + 0x1c0], ecx
mov ecx, dword [esp + 0x10]
mov eax, str.SKILL_A_KNIFE
mov dword [esi + 0x1cc], eax
mov eax, str.ACCESSORY
mov dword [esi + 0x1d0], ecx
mov dword [esi + 0x1c8], edx
mov dword [esi + 0x1d4], eax
mov ecx, 0x2d
mov byte [esp + 0x10], cl
mov edx, dword [esp + 0x10]
mov eax, str.ARROW
mov ebx, 0x2e
mov byte [esp + 0x10], bl
mov dword [esi + 0x1d8], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x1dc], eax
mov eax, str.BOLT
mov byte [esp + 0x10], 0x2f
mov dword [esi + 0x1e0], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x1e4], eax
mov eax, str.PORTAL
mov dword [esi + 0x1e8], edx
mov dword [esi + 0x1ec], eax
mov byte [esp + 0x10], 0x30
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x31
mov eax, str.EVENT_DROP
mov dword [esi + 0x1f4], eax
mov dword [esi + 0x1f0], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x32
mov eax, str.EVENT_LOTTERY
mov dword [esi + 0x1fc], eax
mov dword [esi + 0x1f8], edx
mov edx, dword [esp + 0x10]
mov eax, str.EXPBOOK
mov dword [esi + 0x204], eax
mov byte [esp + 0x10], 0x33
mov dword [esi + 0x200], edx
mov edx, dword [esp + 0x10]
mov eax, str.CASHBOOK
mov dword [esi + 0x20c], eax
mov byte [esp + 0x10], 0x34
mov dword [esi + 0x208], edx
mov edx, dword [esp + 0x10]
mov eax, str.FIRE_CRACKER
mov dword [esi + 0x214], eax
mov byte [esp + 0x10], 0x35
mov eax, str.CAMP_KIT
mov dword [esi + 0x21c], eax
mov dword [esi + 0x210], edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x10], 0x36
mov eax, str.SHORT_RANGE_ARMS_KIT
mov dword [esi + 0x224], eax
mov dword [esi + 0x218], edx
mov edx, dword [esp + 0x10]
mov eax, str.LONG_RANGE_ARMS_KIT
mov byte [esp + 0x10], 0x37
mov dword [esi + 0x22c], eax
mov dword [esi + 0x220], edx
mov edx, dword [esp + 0x10]
mov eax, str.AIRSHIP_KIT
lea ebp, [esi + 4]
mov byte [esp + 0x10], 0x38
mov dword [esi + 0x234], eax
mov eax, dword [ebp]
test eax, eax
mov dword [esi + 0x228], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x230], edx
mov dword [esp + 0x10], ecx
jne 0x495afa
xor edx, edx
jmp 0x495b02
mov edx, dword [esi + 8]
sub edx, eax
sar edx, 2
test eax, eax
je 0x495b33
mov ecx, dword [esi + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x495b33
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x495b45
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], ebx
jne 0x495b54
xor ecx, ecx
jmp 0x495b5c
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x495b8d
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x495b8d
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x495b9f
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0
jne 0x495bb2
xor ecx, ecx
jmp 0x495bba
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x495beb
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x495beb
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x495bfd
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 1
jne 0x495c10
xor ecx, ecx
jmp 0x495c18
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x495c49
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x495c49
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x495c5b
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 2
jne 0x495c6e
xor ecx, ecx
jmp 0x495c76
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x495ca7
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x495ca7
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x495cb9
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 3
jne 0x495ccc
xor ecx, ecx
jmp 0x495cd4
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x495d05
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x495d05
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x495d17
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0x10
jne 0x495d2a
xor ecx, ecx
jmp 0x495d32
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x495d63
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x495d63
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x495d75
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0x11
jne 0x495d88
xor ecx, ecx
jmp 0x495d90
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x495dc1
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x495dc1
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x495dd3
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 4
jne 0x495de6
xor ecx, ecx
jmp 0x495dee
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x495e1f
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x495e1f
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x495e31
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 5
jne 0x495e44
xor ecx, ecx
jmp 0x495e4c
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x495e7d
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x495e7d
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x495e8f
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 6
jne 0x495ea2
xor ecx, ecx
jmp 0x495eaa
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x495edb
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x495edb
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x495eed
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 7
jne 0x495f00
xor ecx, ecx
jmp 0x495f08
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x495f39
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x495f39
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x495f4b
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 8
jne 0x495f5e
xor ecx, ecx
jmp 0x495f66
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x495f97
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x495f97
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x495fa9
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0xf
jne 0x495fbc
xor ecx, ecx
jmp 0x495fc4
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x495ff5
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x495ff5
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x496007
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0xe
jne 0x49601a
xor ecx, ecx
jmp 0x496022
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x496053
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x496053
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x496065
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 9
jne 0x496078
xor ecx, ecx
jmp 0x496080
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x4960b1
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x4960b1
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x4960c3
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0xa
jne 0x4960d6
xor ecx, ecx
jmp 0x4960de
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x49610f
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x49610f
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x496121
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0xb
jne 0x496134
xor ecx, ecx
jmp 0x49613c
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x49616d
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x49616d
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x49617f
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0xc
jne 0x496192
xor ecx, ecx
jmp 0x49619a
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x4961cb
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x4961cb
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x4961dd
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0xd
jne 0x4961f0
xor ecx, ecx
jmp 0x4961f8
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x496229
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x496229
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x49623b
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0x12
jne 0x49624e
xor ecx, ecx
jmp 0x496256
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x496287
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x496287
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x496299
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0x13
jne 0x4962ac
xor ecx, ecx
jmp 0x4962b4
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x4962e5
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x4962e5
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x4962f7
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0x1d
jne 0x49630a
xor ecx, ecx
jmp 0x496312
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x496343
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x496343
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x496355
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0x1e
jne 0x496368
xor ecx, ecx
jmp 0x496370
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x4963a1
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x4963a1
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x4963b3
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0x20
jne 0x4963c6
xor ecx, ecx
jmp 0x4963ce
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x4963ff
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x4963ff
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x496411
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0x1f
jne 0x496424
xor ecx, ecx
jmp 0x49642c
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x49645d
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x49645d
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x49646f
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0x21
jne 0x496482
xor ecx, ecx
jmp 0x49648a
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x4964bb
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x4964bb
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x4964cd
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
mov edx, dword [ebp]
test edx, edx
mov dword [esp + 0x10], 0x22
jne 0x4964e0
xor ecx, ecx
jmp 0x4964e8
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x496519
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x496519
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 8]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
call fcn.00498580
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x49652b
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 1
push eax
mov ecx, esi
call fcn.00495060
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x14], 0x23
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
mov dword [esp + 0x14], 0x24
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, esi
mov dword [esp + 0x14], 0x25
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x14], 0x26
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ebx, 0x27
mov ecx, esi
mov dword [esp + 0x14], ebx
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, esi
mov dword [esp + 0x14], 0x28
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x14], 0x29
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
mov dword [esp + 0x14], 0x2a
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, esi
mov dword [esp + 0x14], 0x2b
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x14], 0x2c
call fcn.00495440
lea ecx, [esp + 0x10]
lea edi, [esi + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0x14
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 0x15
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x14], 0x16
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0x17
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 0x1b
call fcn.00495440
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x2f
push eax
mov ecx, edi
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0x31
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 0x32
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x14], 0x33
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0x34
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 0x35
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x14], 0x36
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0x37
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 0x38
call fcn.00495440
lea eax, [esp + 0x10]
lea edi, [esi + 0x20]
push eax
mov ecx, edi
mov dword [esp + 0x14], 6
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 7
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 8
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x14], 0xf
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0xe
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 9
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x14], 0xa
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0xb
mov ecx, edi
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 0xc
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x14], 0xd
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0x21
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 0x22
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x14], 0x23
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0x24
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 0x25
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x14], 0x26
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], ebx
call fcn.00495440
lea edx, [esp + 0x10]
lea edi, [esi + 0x30]
push edx
mov ecx, edi
mov dword [esp + 0x14], 0
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x14], 1
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 2
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 3
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x14], 0x10
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0x11
call fcn.00495440
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 4
push edx
mov ecx, edi
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x14], 5
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ebx, 0x1d
mov ecx, edi
mov dword [esp + 0x14], ebx
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 0x1e
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x14], 0x20
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0x1f
call fcn.00495440
lea edx, [esp + 0x10]
lea edi, [esi + 0x40]
push edx
mov ecx, edi
mov dword [esp + 0x14], 0x28
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x14], 0x29
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0x2a
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 0x2b
call fcn.00495440
lea eax, [esp + 0x10]
lea edi, [esi + 0x50]
push eax
mov ecx, edi
mov dword [esp + 0x14], 0xe
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 9
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 0xa
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x14], 0xb
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0xc
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 0xd
call fcn.00495440
mov dword [esp + 0x10], 0
lea edi, [esi + 0x60]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0x12
call fcn.00495440
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x14], 0x13
call fcn.00495440
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x14], ebx
call fcn.00495440
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0x2c
call fcn.00495440
mov edi, 7
lea esp, [esp]
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
mov edx, eax
sub edx, ecx
sar edx, 2
push edx
push eax
push ecx
call fcn.004952a0
add esp, 0xc
add ebp, 0x10
dec edi
jne 0x496a90
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret