Function at 0x4c2e30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b476e
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x5f8800]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xcc], esi
push 0x78
lea eax, [ebp - 0x88]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movzx eax, word [esi + 0x1412c4]
add esp, 0xc
movzx ecx, word [esi + 0x1412c6]
movzx edi, word [esi + 0x1412c2]
mov dword [ebp - 0xc8], ecx
push 0
push 0
movsx ecx, ax
push 2
push ecx
mov dword [ebp - 0xbc], eax
movsx eax, di
push eax
mov dword [ebp - 0xd4], ecx
mov ecx, esi
push 0x3d
mov dword [ebp - 0xe8], edi
mov dword [ebp - 0xd0], eax
call fcn.0043d1d0
mov ecx, dword [ebp - 0xd0]
push 0
push 0
push 0x12
push dword [ebp - 0xd4]
push ecx
push 0x46
mov ecx, esi
call fcn.0043d1d0
movsx eax, word [esi + 0x1413cc]
cmp eax, 0xb
ja case.default.0x4bd28e
jmp dword [eax*4 + 0x4c0848]
cmp byte [esi + 0x18958e], 0
jne 0x4bd431
mov eax, dword [ebp - 0xd0]
movsx ecx, word [ebp + 8]
mov dword [ebp - 0xcc], ecx
lea edx, [eax + 0x1e]
mov dword [ebp - 0xc0], edx
cmp ecx, edx
jle 0x4bd392
add eax, 0xd2
mov dword [ebp - 0xf0], eax
cmp ecx, eax
jge 0x4bd392
mov eax, dword [ebp - 0xd4]
movsx ecx, word [ebp + 0xc]
mov dword [ebp - 0xd8], ecx
lea edx, [eax + 0x32]
mov dword [ebp - 0xe8], edx
cmp ecx, edx
jle 0x4bd392
add eax, 0x41
cmp ecx, eax
jge 0x4bd392
push str.DRAW_DIALOGBOX_CITYHALL_MENU1
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
mov eax, dword [ebp - 0xc8]
mov ecx, 0x5fd3c4
push 0
cwde
add eax, dword [ebp - 0xd0]
push 0xff
push 0xff
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0xa0]
push 0xff
push eax
mov dword [ebp - 4], 0
call fcn.00411e80
mov ecx, eax
call fcn.00494bc0
push eax
push dword [ebp - 0xe8]
mov ecx, esi
push dword [ebp - 0xe0]
push dword [ebp - 0xd0]
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0xcc]
jmp 0x4bd4de
push str.DRAW_DIALOGBOX_CITYHALL_MENU1
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 1
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4bd3c2
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
mov edx, dword [ebp - 0xd0]
push 0
push 0x32
push 0
push 4
push eax
mov eax, dword [ebp - 0xd4]
movsx ecx, cx
add eax, 0x32
add ecx, edx
push eax
push ecx
mov dword [ebp - 0xe0], ecx
mov ecx, esi
push edx
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
mov eax, dword [ebp - 0xd0]
movzx edx, word [ebp + 0xc]
movsx edx, dx
mov dword [ebp - 0xd8], edx
lea ecx, [eax + 0xd2]
mov dword [ebp - 0xf0], ecx
mov ecx, dword [ebp - 0xcc]
jmp 0x4bd4de
push str.DRAW_DIALOGBOX_CITYHALL_MENU1
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 2
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4bd461
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
mov edx, dword [ebp - 0xd0]
push 0
push 0x41
push 0x41
push 0x41
push eax
mov eax, dword [ebp - 0xd4]
movsx ecx, cx
add eax, 0x32
add ecx, edx
push eax
push ecx
mov dword [ebp - 0xe0], ecx
mov ecx, esi
push edx
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
mov eax, dword [ebp - 0xd0]
mov edi, dword [ebp - 0xe8]
lea edx, [eax + 0xd2]
lea ecx, [eax + 0x1e]
mov dword [ebp - 0xf0], edx
movzx edx, word [ebp + 0xc]
mov dword [ebp - 0xc0], ecx
movsx ecx, word [ebp + 8]
movsx edx, dx
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0xd8], edx
cmp byte [esi + 0x189666], 0
jne 0x4bd5cb
cmp dword [esi + 0x18c024], 0
jne 0x4bd5cb
cmp byte [esi + 0x18958e], 0
je 0x4bd5cb
cmp byte [esi + 0x18958c], 0
jne 0x4bd51b
cmp dword [esi + 0x18bffc], 0x64
jg 0x4bd5cb
lea edx, [eax + 0x1e]
cmp ecx, edx
jle 0x4bd592
add eax, 0xd2
cmp ecx, eax
jge 0x4bd592
mov eax, dword [ebp - 0xd4]
movsx ecx, word [ebp + 0xc]
lea edx, [eax + 0x50]
mov dword [ebp - 0xe8], edx
cmp ecx, edx
jle 0x4bd592
add eax, 0x5f
cmp ecx, eax
jge 0x4bd592
push str.DRAW_DIALOGBOX_CITYHALL_MENU56
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
push 0
push 0xff
push 0xff
push 0xff
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 3
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
mov ecx, eax
call fcn.00494bc0
push eax
push dword [ebp - 0xe8]
jmp 0x4bd60e
push str.DRAW_DIALOGBOX_CITYHALL_MENU56
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
push 0
push 0x32
push 0
push 4
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 4
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
mov ecx, eax
call fcn.00494bc0
jmp 0x4bd603
push str.DRAW_DIALOGBOX_CITYHALL_MENU56
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 5
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4bd5fb
mov eax, dword [eax]
push 0
push 0x41
push 0x41
push 0x41
push eax
mov eax, dword [ebp - 0xd4]
add eax, 0x50
push eax
push dword [ebp - 0xe0]
mov ecx, esi
push dword [ebp - 0xd0]
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
cmp dword [esi + 0x18c028], 0
jle 0x4bd6f9
mov ecx, dword [ebp - 0xcc]
cmp ecx, dword [ebp - 0xc0]
jle 0x4bd6bf
cmp ecx, dword [ebp - 0xf0]
jge 0x4bd6bf
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd8]
lea edx, [eax + 0x6e]
mov dword [ebp - 0xc0], edx
cmp ecx, edx
jle 0x4bd6bf
add eax, 0x7d
cmp ecx, eax
jge 0x4bd6bf
push str.DRAW_DIALOGBOX_CITYHALL_MENU4
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
push 0
push 0xff
push 0xff
push 0xff
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 6
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
mov ecx, eax
call fcn.00494bc0
push eax
push dword [ebp - 0xc0]
jmp 0x4bd73c
push str.DRAW_DIALOGBOX_CITYHALL_MENU4
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 7
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4bd6ef
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
jmp 0x4bd731
push str.DRAW_DIALOGBOX_CITYHALL_MENU4
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 8
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4bd729
mov eax, dword [eax]
push 0
push 0x41
push 0x41
push 0x41
push eax
mov eax, dword [ebp - 0xd4]
add eax, 0x6e
push eax
push dword [ebp - 0xe0]
mov ecx, esi
push dword [ebp - 0xd0]
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
cmp byte [esi + 0x18958e], 0
je 0x4bd88a
cmp dword [esi + 0x18c024], 0
jne 0x4bd88a
movsx ecx, word [ebp + 8]
movsx eax, di
add eax, 0x1e
cmp ecx, eax
jle 0x4bd829
movsx eax, di
add eax, 0xd2
cmp ecx, eax
jge 0x4bd829
mov ecx, dword [ebp - 0xbc]
movsx eax, cx
movsx ecx, word [ebp + 0xc]
lea edx, [eax + 0x8c]
mov dword [ebp - 0xc0], edx
cmp ecx, edx
jle 0x4bd829
add eax, 0x9b
cmp ecx, eax
jge 0x4bd829
push str.DRAW_DIALOGBOX_CITYHALL_MENU78
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
push 0
push 0xff
movsx eax, di
add eax, ecx
mov dword [ebp - 4], 9
push 0xff
mov dword [ebp - 0xe0], eax
mov ecx, 0x5fd3c4
push 0xff
lea eax, [ebp - 0xa0]
push eax
call fcn.00411e80
mov ecx, eax
call fcn.00494bc0
push eax
push dword [ebp - 0xc0]
push dword [ebp - 0xe0]
jmp 0x4bd8e5
push str.DRAW_DIALOGBOX_CITYHALL_MENU78
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
push 0
push 0x32
movsx eax, di
add eax, ecx
mov dword [ebp - 4], 0xa
push 0
mov dword [ebp - 0xe0], eax
mov ecx, 0x5fd3c4
push 4
lea eax, [ebp - 0xa0]
push eax
call fcn.00411e80
mov ecx, eax
call fcn.00494bc0
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x8c
push eax
push dword [ebp - 0xe0]
jmp 0x4bd8e5
push str.DRAW_DIALOGBOX_CITYHALL_MENU78
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0xb
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4bd8ba
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
push 0
push 0x41
push 0x41
push 0x41
push eax
mov eax, dword [ebp - 0xbc]
movsx edx, cx
movsx ecx, di
add ecx, edx
cwde
add eax, 0x8c
mov dword [ebp - 0xe0], ecx
push eax
push ecx
movsx eax, di
mov ecx, esi
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
cmp byte [esi + 0x189666], 0
je 0x4bda10
cmp byte [esi + 0x18958e], 0
je 0x4bda10
movsx ecx, word [ebp + 8]
movsx eax, di
add eax, 0x1e
cmp ecx, eax
jle 0x4bd9b9
movsx eax, di
add eax, 0xd2
cmp ecx, eax
jge 0x4bd9b9
mov eax, dword [ebp - 0xbc]
movsx ecx, word [ebp + 0xc]
cwde
lea edx, [eax + 0xaa]
mov dword [ebp - 0xc0], edx
cmp ecx, edx
jle 0x4bd9b9
add eax, 0xb9
cmp ecx, eax
jge 0x4bd9b9
push str.DRAW_DIALOGBOX_CITYHALL_MENU14
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
push 0
push 0xff
push 0xff
push 0xff
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0xc
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
mov ecx, eax
call fcn.00494bc0
push eax
mov eax, dword [ebp - 0xc8]
push dword [ebp - 0xc0]
movsx ecx, ax
movsx eax, di
add ecx, eax
push ecx
jmp 0x4bda5c
push str.DRAW_DIALOGBOX_CITYHALL_MENU14
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0xd
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4bd9e9
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0xaa
push eax
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
movsx eax, di
add ecx, eax
push ecx
jmp 0x4bda5c
push str.DRAW_DIALOGBOX_CITYHALL_MENU14
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0xe
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4bda40
mov eax, dword [eax]
push 0
push 0x41
push 0x41
push 0x41
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0xaa
push eax
push dword [ebp - 0xe0]
movsx eax, di
mov ecx, esi
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
cmp byte [esi + 0x189666], 0
jne 0x4bdbb6
cmp byte [esi + 0x18958e], 0
je 0x4bdbb6
movsx ecx, word [ebp + 8]
movsx eax, di
add eax, 0x1e
mov dword [ebp - 0xd8], ecx
cmp ecx, eax
jle 0x4bdb7c
movsx eax, di
add eax, 0xd2
cmp ecx, eax
jge 0x4bdb7c
mov eax, dword [ebp - 0xbc]
movsx ecx, word [ebp + 0xc]
cwde
mov dword [ebp - 0xf0], ecx
lea edx, [eax + 0xc8]
mov dword [ebp - 0xc0], edx
cmp ecx, edx
jle 0x4bdb7c
add eax, 0xd7
cmp ecx, eax
jge 0x4bdb7c
push str.DRAW_DIALOGBOX_CITYHALL_MENU88
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
push 0
push 0xff
movsx eax, di
add eax, ecx
mov dword [ebp - 4], 0xf
push 0xff
mov dword [ebp - 0xcc], eax
mov ecx, 0x5fd3c4
push 0xff
lea eax, [ebp - 0xa0]
push eax
call fcn.00411e80
mov ecx, eax
call fcn.00494bc0
push eax
push dword [ebp - 0xc0]
movsx eax, di
mov ecx, esi
push dword [ebp - 0xcc]
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
mov ecx, dword [ebp - 0xd8]
mov edx, dword [ebp - 0xf0]
jmp 0x4bdc36
push str.DRAW_DIALOGBOX_CITYHALL_MENU88
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x10
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4bdbac
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
jmp 0x4bdbee
push str.DRAW_DIALOGBOX_CITYHALL_MENU88
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x11
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4bdbe6
mov eax, dword [eax]
push 0
push 0x41
push 0x41
push 0x41
mov ecx, dword [ebp - 0xc8]
push eax
mov eax, dword [ebp - 0xbc]
cwde
movsx edx, cx
add eax, 0xc8
push eax
movsx ecx, di
add ecx, edx
movsx eax, di
push ecx
mov dword [ebp - 0xcc], ecx
mov ecx, esi
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
movsx edx, word [ebp + 0xc]
movsx ecx, word [ebp + 8]
movsx eax, di
add eax, 0x1e
cmp ecx, eax
jle 0x4bdcc8
movsx eax, di
add eax, 0xd2
cmp ecx, eax
jge 0x4bdcc8
mov eax, dword [ebp - 0xbc]
cwde
lea ecx, [eax + 0xe6]
mov dword [ebp - 0xc0], ecx
cmp edx, ecx
jle 0x4bdcc8
add eax, 0xf5
cmp edx, eax
jge 0x4bdcc8
push str.DRAW_DIALOGBOX_CITYHALL_MENU95
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
push 0
push 0xff
push 0xff
push 0xff
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x12
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
mov ecx, eax
call fcn.00494bc0
push eax
mov eax, dword [ebp - 0xc8]
push dword [ebp - 0xc0]
movsx ecx, ax
movsx eax, di
add ecx, eax
push ecx
jmp 0x4bdd20
push str.DRAW_DIALOGBOX_CITYHALL_MENU95
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x13
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bdd04
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0xe6
push eax
push dword [ebp - 0xcc]
movsx eax, di
mov ecx, esi
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU17
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x14
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bdd79
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x113
push eax
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
movsx eax, di
add ecx, eax
push ecx
movsx eax, di
mov ecx, esi
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
call fcn.00411640
jmp case.default.0x4bd28e
push str.DRAW_DIALOGBOX_CITYHALL_MENU18
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x15
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov edx, dword [eax]
add edx, 0x20
cmp dword [edx + 0x14], 0xf
jbe 0x4bddf5
mov edx, dword [edx]
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xd0]
push 0
push 0x19
cwde
add eax, ecx
push 0x19
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xd4]
push 0x37
push edx
add eax, 0x50
push eax
push dword [ebp - 0xcc]
push ecx
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU19
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x16
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bde79
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xd4]
mov ecx, esi
add eax, 0x5f
push eax
push dword [ebp - 0xcc]
push dword [ebp - 0xd0]
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU20
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x17
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bdeed
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0x6e
push eax
push dword [ebp - 0xcc]
movsx eax, di
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU21
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x18
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bdf60
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0x7d
push eax
push dword [ebp - 0xcc]
movsx eax, di
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU22
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x19
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bdfd3
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x8c
push eax
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU23
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4be051
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x9b
push eax
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU24
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x1b
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4be0cf
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0xaa
push eax
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU25
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4be14d
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0xc8
push eax
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU26
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x1d
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4be1cb
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0xd7
push eax
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU27
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4be249
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0xe6
push eax
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
movsx ecx, word [ebp + 8]
movsx edx, di
add edx, 0x1e
mov dword [ebp - 0xcc], edx
cmp ecx, edx
jl 0x4be2ea
movsx eax, di
add eax, 0x68
cmp ecx, eax
jg 0x4be2ea
mov ecx, dword [ebp - 0xbc]
mov ax, word [ebp + 0xc]
movsx edx, cx
add edx, 0x124
cwde
mov dword [ebp - 0xe0], edx
cmp eax, edx
jl 0x4be2e4
mov edi, dword [ebp - 0xe8]
movsx eax, cx
movsx ecx, word [ebp + 0xc]
add eax, 0x138
cmp ecx, eax
jg 0x4be2e4
mov eax, 0x13
jmp 0x4be30a
mov edx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xcc], edx
movsx edx, ax
mov eax, 0x12
add edx, 0x124
mov dword [ebp - 0xe0], edx
push 0
push 0
push eax
push edx
push dword [ebp - 0xcc]
mov ecx, esi
push 0x47
call fcn.0043d1d0
movsx edx, word [ebp + 8]
movsx ecx, di
add ecx, 0x9a
mov dword [ebp - 0xc0], ecx
cmp edx, ecx
mov ecx, dword [ebp - 0xe0]
jl 0x4be365
movsx eax, di
add eax, 0xe4
cmp edx, eax
jg 0x4be365
movsx edx, word [ebp + 0xc]
cmp edx, ecx
jl 0x4be365
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x138
cmp edx, eax
mov edx, 3
jle 0x4be36a
mov edx, 2
mov eax, dword [ebp - 0xc0]
push 0
push 0
push edx
push ecx
push eax
jmp 0x4c0803
push str.DRAW_DIALOGBOX_CITYHALL_MENU28
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x1f
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4be3b8
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xd4]
add eax, 0x8c
mov ecx, dword [ebp - 0xd0]
push eax
mov eax, dword [ebp - 0xc8]
cwde
add eax, ecx
push eax
push ecx
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
call fcn.00411640
jmp case.default.0x4bd28e
push str.DRAW_DIALOGBOX_CITYHALL_MENU29
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x20
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4be431
mov eax, dword [eax]
mov edi, dword [ebp - 0xd0]
mov ecx, esi
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xd4]
add eax, 0x8c
push eax
mov eax, dword [ebp - 0xc8]
cwde
add eax, edi
push eax
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
movsx ecx, word [ebp + 8]
lea edx, [edi + 0x9a]
cmp ecx, edx
jl 0x4be4bd
lea eax, [edi + 0xe4]
cmp ecx, eax
jg 0x4be4bd
mov ecx, dword [ebp - 0xd4]
movsx edi, word [ebp + 0xc]
add ecx, 0x124
cmp edi, ecx
jle 0x4be4bd
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x138
cmp edi, eax
jge 0x4be4bd
push 0
push 0
mov eax, 1
push eax
push ecx
push edx
jmp 0x4c0803
mov eax, dword [ebp - 0xbc]
movsx ecx, ax
add ecx, 0x124
xor eax, eax
push eax
push eax
push eax
push ecx
push edx
jmp 0x4c0803
push str.DRAW_DIALOGBOX_CITYHALL_MENU30
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x21
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov edx, dword [eax]
add edx, 0x20
cmp dword [edx + 0x14], 0xf
jbe 0x4be514
mov edx, dword [edx]
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xd0]
push 0
push 0x19
cwde
add eax, ecx
push 0x19
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd4]
push 0x37
push edx
add eax, 0x50
push eax
push dword [ebp - 0xd8]
push ecx
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU31
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x22
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4be598
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xd4]
mov ecx, esi
add eax, 0x64
push eax
push dword [ebp - 0xd8]
push dword [ebp - 0xd0]
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU32
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x23
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4be60c
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0x73
push eax
push dword [ebp - 0xd8]
movsx eax, di
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
movsx edx, word [ebp + 8]
movsx ecx, di
add ecx, 0x9a
mov dword [ebp - 0xd8], ecx
cmp edx, ecx
jl 0x4be6a6
movsx eax, di
add eax, 0xe4
cmp edx, eax
jg 0x4be6a6
mov ecx, dword [ebp - 0xbc]
movsx edi, word [ebp + 0xc]
movsx edx, cx
add edx, 0x124
cmp edi, edx
jle 0x4be6a0
movsx eax, cx
mov ecx, dword [ebp - 0xd8]
add eax, 0x138
cmp edi, eax
jge 0x4be6a6
push 0
push 0
mov eax, 1
push eax
push edx
push ecx
jmp 0x4c0803
mov ecx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xbc]
movsx edx, ax
add edx, 0x124
xor eax, eax
push eax
push eax
push eax
push edx
push ecx
jmp 0x4c0803
push str.DRAW_DIALOGBOX_CITYHALL_MENU33
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x24
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov edx, dword [eax]
add edx, 0x20
cmp dword [edx + 0x14], 0xf
jbe 0x4be6fd
mov edx, dword [edx]
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xd0]
push 0
push 0x19
cwde
add eax, ecx
push 0x19
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd4]
push 0x37
push edx
add eax, 0x7d
push eax
push dword [ebp - 0xd8]
push ecx
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU34
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x25
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4be781
mov eax, dword [eax]
push dword [esi + 0x18c028]
push eax
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.00411640
push 0
push 0x19
push 0x19
push 0x37
lea eax, [ebp - 0x88]
mov ecx, esi
push eax
mov eax, dword [ebp - 0xd4]
add eax, 0x8c
push eax
push dword [ebp - 0xd8]
push dword [ebp - 0xd0]
call fcn.0045d060
push str.DRAW_DIALOGBOX_CITYHALL_MENU35
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x26
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4be814
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0x9b
push eax
push dword [ebp - 0xd8]
movsx eax, di
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
movsx ecx, word [ebp + 8]
movsx edx, di
add edx, 0x1e
mov dword [ebp - 0xcc], edx
cmp ecx, edx
jl 0x4be8ac
movsx eax, di
add eax, 0x68
cmp ecx, eax
jg 0x4be8ac
mov ecx, dword [ebp - 0xbc]
mov ax, word [ebp + 0xc]
movsx edx, cx
add edx, 0x124
cwde
mov dword [ebp - 0xe0], edx
cmp eax, edx
jl 0x4be8a6
mov edi, dword [ebp - 0xe8]
movsx eax, cx
movsx ecx, word [ebp + 0xc]
add eax, 0x138
cmp ecx, eax
jg 0x4be8a6
mov eax, 0x13
jmp 0x4be8cc
mov edx, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xcc], edx
movsx edx, ax
mov eax, 0x12
add edx, 0x124
mov dword [ebp - 0xe0], edx
push 0
push 0
push eax
push edx
push dword [ebp - 0xcc]
mov ecx, esi
push 0x47
call fcn.0043d1d0
movsx edx, word [ebp + 8]
movsx ecx, di
add ecx, 0x9a
mov dword [ebp - 0xc0], ecx
cmp edx, ecx
mov ecx, dword [ebp - 0xe0]
jl 0x4be365
movsx eax, di
add eax, 0xe4
cmp edx, eax
jg 0x4be365
movsx edx, word [ebp + 0xc]
cmp edx, ecx
jl 0x4be365
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x138
cmp edx, eax
jg 0x4be365
mov eax, dword [ebp - 0xc0]
mov edx, 3
push 0
push 0
push edx
push ecx
push eax
jmp 0x4c0803
cmp byte [esi + 0x18958c], 0
lea ecx, [ebp - 0xa0]
je 0x4be96b
push str.DRAW_DIALOGBOX_CITYHALL_MENU57
call fcn.0040f9f0
mov dword [ebp - 4], 0x27
jmp 0x4be97c
push str.DRAW_DIALOGBOX_CITYHALL_MENU58
call fcn.0040f9f0
mov dword [ebp - 4], 0x28
lea eax, [ebp - 0xa0]
mov ecx, 0x5fd3c4
push eax
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4be995
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
mov edx, dword [ebp - 0xd0]
push 0
push 0x19
push 0xc8
push 0xc8
push eax
mov eax, dword [ebp - 0xd4]
movsx ecx, cx
add eax, 0x35
add ecx, edx
push eax
push ecx
mov dword [ebp - 0xd8], ecx
mov ecx, esi
push edx
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU59
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x29
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bea1c
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0x4e
push eax
push dword [ebp - 0xd8]
movsx eax, di
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU60
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bea8f
mov eax, dword [eax]
push 0
push 0x2d82dc
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0x6c
push eax
movsx eax, di
add eax, 0x23
push eax
call fcn.0045d450
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU61
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x2b
push eax
lea eax, [ebp - 0xf4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4beafe
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0x7d
push eax
push dword [ebp - 0xd8]
movsx eax, di
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU62
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x2c
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4beb71
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x8c
movsx ecx, cx
push eax
movsx eax, di
add eax, ecx
mov ecx, esi
push eax
movsx eax, di
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU63
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x2d
push eax
lea eax, [ebp - 0xdc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bebef
mov eax, dword [eax]
mov edx, dword [ebp - 0xc8]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x9b
movsx ecx, dx
push eax
movsx eax, di
add eax, ecx
mov ecx, esi
push eax
movsx eax, di
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU64
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x2e
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bec6d
mov eax, dword [eax]
push 0
push 0x2d82dc
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0xb1
push eax
movsx eax, di
add eax, 0x23
push eax
call fcn.0045d450
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU65
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x2f
push eax
lea eax, [ebp - 0xdc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4becde
mov eax, dword [eax]
mov edx, dword [ebp - 0xc8]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0xc2
movsx ecx, dx
push eax
movsx eax, di
add eax, ecx
mov ecx, esi
push eax
movsx eax, di
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU66
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x30
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bed5c
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0xd1
push eax
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU67
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x31
push eax
lea eax, [ebp - 0xdc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bedda
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0xe0
push eax
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU68
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x32
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bee58
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0xfc
push eax
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
movsx ecx, word [ebp + 8]
movsx eax, di
add eax, 0x1e
mov dword [ebp - 0xd8], eax
cmp ecx, eax
jl 0x4bef0a
movsx eax, di
add eax, 0x68
cmp ecx, eax
jg 0x4bef0a
mov ecx, dword [ebp - 0xbc]
mov ax, word [ebp + 0xc]
movsx edx, cx
add edx, 0x124
cwde
mov dword [ebp - 0xcc], edx
mov dword [ebp - 0xc0], eax
cmp eax, edx
jl 0x4bef0a
movsx eax, cx
add eax, 0x138
cmp dword [ebp - 0xc0], eax
jg 0x4bef0a
push 0
push 0
push 0x13
push edx
push dword [ebp - 0xd8]
mov ecx, esi
push 0x47
call fcn.0043d1d0
mov edx, dword [ebp - 0xc0]
jmp 0x4bef36
mov eax, dword [ebp - 0xbc]
mov ecx, esi
push 0
push 0
cwde
push 0x12
add eax, 0x124
push eax
push dword [ebp - 0xd8]
mov dword [ebp - 0xcc], eax
push 0x47
call fcn.0043d1d0
movsx edx, word [ebp + 0xc]
movsx ecx, di
add ecx, 0x9a
mov dword [ebp - 0xd8], ecx
movsx ecx, word [ebp + 8]
cmp ecx, dword [ebp - 0xd8]
jl 0x4bef89
movsx eax, di
add eax, 0xe4
cmp ecx, eax
mov ecx, dword [ebp - 0xcc]
jg 0x4bef8f
cmp edx, ecx
jl 0x4bef8f
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x138
cmp edx, eax
jg 0x4bef8f
push 0
push 0
push 3
push ecx
push dword [ebp - 0xd8]
jmp 0x4c0803
mov ecx, dword [ebp - 0xcc]
push 0
push 0
push 2
push ecx
push dword [ebp - 0xd8]
jmp 0x4c0803
mov eax, dword [esi + 4]
lea ecx, [ebp - 0xa0]
test eax, eax
jle 0x4bf222
push str.DRAW_DIALOGBOX_CITYHALL_MENU87
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x33
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4befdc
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
mov edx, dword [ebp - 0xd0]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xd4]
movsx ecx, cx
add eax, 0x32
add ecx, edx
push eax
push ecx
mov dword [ebp - 0xc0], ecx
mov ecx, esi
push edx
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU72_1
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x34
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4bf051
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0x12c
push eax
movsx eax, di
add eax, 0x15
push eax
call fcn.0045d320
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
cmp dword [esi + 4], 0
mov dword [ebp - 0xd8], 0
jle case.default.0x4bd28e
movsx eax, di
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xbc]
movsx edi, ax
lea eax, [esi + 0x1497ac]
add edi, 0x82
mov dword [ebp - 0xcc], eax
nop
push 0x78
lea eax, [ebp - 0x88]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebp - 0xcc]
add eax, 0xffffffec
push eax
call fcn.005666c0
add esp, 0x14
mov dword [ebp - 0x90], 0
xorps xmm0, xmm0
mov dword [ebp - 0x8c], 0
lea ecx, [ebp - 0xa0]
movups xmmword [ebp - 0xa0], xmm0
push 0x1e
push str.DRAW_DIALOGBOX_CITYHALL_MENU77
call fcn.0040b5c0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x35
push eax
lea eax, [ebp - 0xec]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bf145
mov eax, dword [eax]
mov ecx, dword [ebp - 0xcc]
push dword [ecx]
lea ecx, [ebp - 0x88]
push ecx
push eax
lea eax, [esi + 0x18d57f]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x8c]
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4bf1a6
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4bf19c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c0829
push ecx
push edx
call fcn.005aa4e8
add esp, 8
mov ecx, dword [ebp - 0xf0]
movsx edx, word [ebp + 8]
lea eax, [ecx + 0x1e]
cmp edx, eax
jl 0x4bf1d9
lea eax, [ecx + 0xe4]
cmp edx, eax
jg 0x4bf1d9
movsx edx, word [ebp + 0xc]
cmp edx, edi
jl 0x4bf1d9
lea eax, [edi + 0xe]
cmp edx, eax
jg 0x4bf1d9
push 0
push 0xff
jmp 0x4bf1dd
push 0
push 0
push 0xff
push 0xff
lea eax, [esi + 0x18d57f]
push eax
push edi
push dword [ebp - 0xc0]
push ecx
mov ecx, esi
call fcn.0045d060
mov eax, dword [ebp - 0xd8]
add edi, 0xf
add dword [ebp - 0xcc], 0x1c
inc eax
mov dword [ebp - 0xd8], eax
cmp eax, dword [esi + 4]
jl 0x4bf0c0
jmp case.default.0x4bd28e
cmp eax, 0xffffffff
jne 0x4bf354
push str.DRAW_DIALOGBOX_CITYHALL_MENU73
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x36
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4bf255
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
mov edx, dword [ebp - 0xd0]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xd4]
movsx ecx, cx
add eax, 0x7d
add ecx, edx
push eax
push ecx
mov dword [ebp - 0xc0], ecx
mov ecx, esi
push edx
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU74
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x37
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4bf2ca
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0x96
push eax
push dword [ebp - 0xc0]
movsx eax, di
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU75
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x38
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4bf333
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0xaf
push eax
push dword [ebp - 0xc0]
jmp 0x4bdd9e
push str.DRAW_DIALOGBOX_CITYHALL_MENU76
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x39
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4bf37e
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xd4]
add eax, 0xaf
jmp 0x4be3cc
lea eax, [esi + 0x18558c]
mov dword [ebp - 0xe0], 0
mov edi, 0x32
mov esi, eax
nop
mov eax, dword [esi]
test eax, eax
je 0x4bf3ef
mov ecx, str.TownChangeContract
add eax, 4
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4bf3e0
test dl, dl
je 0x4bf3dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4bf3e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4bf3c0
xor eax, eax
jmp 0x4bf3e5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4bf3ef
inc dword [ebp - 0xe0]
add esi, 4
sub edi, 1
jne 0x4bf3b0
xorps xmm0, xmm0
mov dword [ebp - 0x90], edi
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], edi
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CITYHALL_MENU88]
mov edx, eax
mov dword [ebp - 0x90], 0x1e
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0734]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d073c]
mov dword [edx + 0x18], ecx
mov ax, word [0x5d0740]
mov word [edx + 0x1c], ax
mov byte [edx + 0x1e], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x3a
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov esi, dword [ebp - 0xcc]
mov edi, dword [ebp - 0xe8]
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bf499
mov eax, dword [eax]
push 0
push 0xc8
push 0xc8
push 0xdc
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0x2d
push eax
movsx eax, di
add eax, 0xf0
push eax
movsx eax, di
add eax, 0x19
push eax
call fcn.0045d060
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4bf50e
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4bf504
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c0829
push ecx
push edx
call fcn.005aa4e8
add esp, 8
push 0x1e
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push str.DRAW_DIALOGBOX_CITYHALL_MENU88
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x8c], 0
movups xmmword [ebp - 0xa0], xmm0
call fcn.0040b5c0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x3b
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bf56a
mov eax, dword [eax]
push 0
push 0xc8
push 0xc8
push 0xdc
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0x2d
push eax
movsx eax, di
add eax, 0xf1
push eax
movsx eax, di
add eax, 0x1a
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CITYHALL_MENU89]
mov edx, eax
mov dword [ebp - 0x90], 0x1e
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0b74]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d0b7c]
mov dword [edx + 0x18], ecx
mov ax, word [0x5d0b80]
mov word [edx + 0x1c], ax
mov byte [edx + 0x1e], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x3c
push eax
lea eax, [ebp - 0xdc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bf64e
mov eax, dword [eax]
push dword [ebp - 0xe0]
push eax
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.00411640
cmp dword [ebp - 0xe0], 0
lea ecx, [ebp - 0xa0]
jle 0x4bfa05
cmp dword [esi + 0x18c030], 0xffffffff
jne 0x4bf92c
push 0x1e
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push str.DRAW_DIALOGBOX_CITYHALL_MENU90
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.0040b5c0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x3d
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bf6ed
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x7d
push eax
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push 0x1e
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push str.DRAW_DIALOGBOX_CITYHALL_MENU91
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x8c], 0
movups xmmword [ebp - 0xa0], xmm0
call fcn.0040b5c0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0xdc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bf789
mov eax, dword [eax]
push 0
push 0x191937
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0xaa
push eax
movsx eax, di
add eax, 0x19
push eax
call fcn.0045d450
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
mov eax, dword [ebp - 0xbc]
push 0
mov ecx, dword [esi + 0x14add4]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [esi + 0x189300]
cwde
add eax, 0x104
push 0xb2
push eax
movsx eax, di
add eax, 0x23
push eax
call fcn.0057e2f0
push 0
push 0xff00
lea eax, [ebp - 0x88]
mov ecx, esi
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0xfa
push eax
movsx eax, di
add eax, 0x32
push eax
call fcn.0045d450
movsx ecx, word [ebp + 8]
movsx eax, di
add eax, 0x1e
mov dword [ebp - 0xd8], eax
cmp ecx, eax
jl 0x4bf88f
movsx eax, di
add eax, 0x68
cmp ecx, eax
jg 0x4bf88f
mov ecx, dword [ebp - 0xbc]
mov ax, word [ebp + 0xc]
movsx edx, cx
add edx, 0x124
cwde
mov dword [ebp - 0xe8], edx
mov dword [ebp - 0xc0], eax
cmp eax, edx
jl 0x4bf88f
movsx eax, cx
add eax, 0x138
cmp dword [ebp - 0xc0], eax
jg 0x4bf88f
push 0
push 0
push 0x13
push edx
push dword [ebp - 0xd8]
mov ecx, esi
push 0x47
call fcn.0043d1d0
mov edx, dword [ebp - 0xc0]
jmp 0x4bf8bb
mov eax, dword [ebp - 0xbc]
mov ecx, esi
push 0
push 0
cwde
push 0x12
add eax, 0x124
push eax
push dword [ebp - 0xd8]
mov dword [ebp - 0xe8], eax
push 0x47
call fcn.0043d1d0
movsx edx, word [ebp + 0xc]
movsx eax, word [ebp + 8]
mov esi, dword [ebp - 0xcc]
movsx ecx, di
add ecx, 0x9a
mov dword [ebp - 0xc0], ecx
cmp eax, ecx
jl 0x4bf914
movsx ecx, word [ebp + 8]
movsx eax, di
add eax, 0xe4
cmp ecx, eax
mov ecx, dword [ebp - 0xe8]
jg 0x4bf91a
cmp edx, ecx
jl 0x4bf91a
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x138
cmp edx, eax
jg 0x4bf91a
push 0
push 0
push 3
push ecx
push dword [ebp - 0xc0]
jmp 0x4c0803
mov ecx, dword [ebp - 0xe8]
push 0
push 0
push 2
push ecx
push dword [ebp - 0xc0]
jmp 0x4c0803
push str.DRAW_DIALOGBOX_CITYHALL_MENU94
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x3f
push eax
lea eax, [ebp - 0xdc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov edx, dword [eax]
add edx, 0x20
cmp dword [edx + 0x14], 0xf
jbe 0x4bf962
mov edx, dword [edx]
mov eax, dword [ebp - 0xc8]
push 0
movsx ecx, ax
push 0x19
push 0x19
movsx eax, di
add ecx, eax
mov eax, dword [ebp - 0xbc]
push 0x37
cwde
push edx
add eax, 0x7d
mov dword [ebp - 0xc0], ecx
push eax
push ecx
movsx eax, di
mov ecx, esi
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU93
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x40
push eax
lea eax, [ebp - 0xf4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bf9e4
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x8c
push eax
push dword [ebp - 0xc0]
jmp 0x4bfb19
push 0x1e
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push str.DRAW_DIALOGBOX_CITYHALL_MENU92
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.0040b5c0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x41
push eax
lea eax, [ebp - 0xdc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov edx, dword [eax]
add edx, 0x20
cmp dword [edx + 0x14], 0xf
jbe 0x4bfa5b
mov edx, dword [edx]
mov eax, dword [ebp - 0xc8]
push 0
movsx ecx, ax
push 0x19
push 0x19
movsx eax, di
add ecx, eax
mov eax, dword [ebp - 0xbc]
push 0x37
cwde
push edx
add eax, 0x7d
mov dword [ebp - 0xc0], ecx
push eax
push ecx
movsx eax, di
mov ecx, esi
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push 0x1e
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push str.DRAW_DIALOGBOX_CITYHALL_MENU93
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x8c], 0
movups xmmword [ebp - 0xa0], xmm0
call fcn.0040b5c0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x42
push eax
lea eax, [ebp - 0xf4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bfafd
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x8c
push eax
push dword [ebp - 0xc0]
movsx eax, di
mov ecx, esi
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
mov eax, dword [ebp - 0xbc]
push 0
mov ecx, dword [esi + 0x14add4]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [esi + 0x189300]
cwde
add eax, 0x104
push 0xb2
push eax
movsx eax, di
add eax, 0x23
push eax
call fcn.0057e2f0
mov ecx, dword [ebp - 0xbc]
lea edx, [ebp - 0x88]
movsx ecx, cx
movsx eax, di
add ecx, 0xfa
add eax, 0x32
cmp dword [ebp - 0xe0], 0
push 0
jle 0x4bfb9b
push 0xff00
jmp 0x4bfba0
push 0xff
push edx
push ecx
push eax
mov ecx, esi
call fcn.0045d450
movsx ecx, word [ebp + 8]
movsx edx, di
add edx, 0x9a
cmp ecx, edx
jl 0x4bfc02
movsx eax, di
add eax, 0xe4
cmp ecx, eax
jg 0x4bfc02
mov ecx, dword [ebp - 0xbc]
mov ax, word [ebp + 0xc]
movsx edi, cx
add edi, 0x124
cwde
cmp eax, edi
jle 0x4bfc02
mov esi, dword [ebp - 0xcc]
movsx eax, cx
movsx ecx, word [ebp + 0xc]
add eax, 0x138
cmp ecx, eax
jge 0x4bfc02
push 0
push 0
push 1
push edi
push edx
jmp 0x4c0803
mov eax, dword [ebp - 0xbc]
push 0
push 0
cwde
push 0
add eax, 0x124
push eax
push edx
jmp 0x4c0803
lea eax, [esi + 0x18558c]
mov dword [ebp - 0xe0], 0
mov edi, 0x32
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x4bfc6f
mov ecx, str.NameChangeContract
add eax, 4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4bfc60
test dl, dl
je 0x4bfc5c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4bfc60
add eax, 2
add ecx, 2
test dl, dl
jne 0x4bfc40
xor eax, eax
jmp 0x4bfc65
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4bfc6f
inc dword [ebp - 0xe0]
add esi, 4
sub edi, 1
jne 0x4bfc32
xorps xmm0, xmm0
mov dword [ebp - 0x90], edi
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], edi
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CITYHALL_MENU95]
mov edx, eax
mov dword [ebp - 0x90], 0x1e
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0754]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d075c]
mov dword [edx + 0x18], ecx
mov ax, word [0x5d0760]
mov word [edx + 0x1c], ax
mov byte [edx + 0x1e], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x43
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov esi, dword [ebp - 0xcc]
mov edi, dword [ebp - 0xe8]
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bfd19
mov eax, dword [eax]
push 0
push 0xc8
push 0xc8
push 0xdc
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0x2d
push eax
movsx eax, di
add eax, 0xf0
push eax
movsx eax, di
add eax, 0x19
push eax
call fcn.0045d060
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4bfd8e
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4bfd84
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c082e
push ecx
push edx
call fcn.005aa4e8
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CITYHALL_MENU95]
mov edx, eax
mov dword [ebp - 0x90], 0x1e
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0754]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d075c]
mov dword [edx + 0x18], ecx
mov ax, word [0x5d0760]
mov word [edx + 0x1c], ax
mov byte [edx + 0x1e], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x44
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bfe2c
mov eax, dword [eax]
push 0
push 0xc8
push 0xc8
push 0xdc
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0x2d
push eax
movsx eax, di
add eax, 0xf1
push eax
movsx eax, di
add eax, 0x1a
push eax
call fcn.0045d060
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4bfea1
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4bfe97
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c0833
push ecx
push edx
call fcn.005aa4e8
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CITYHALL_MENU96]
mov edx, eax
mov dword [ebp - 0x90], 0x1e
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0c34]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d0c3c]
mov dword [edx + 0x18], ecx
mov ax, word [0x5d0c40]
mov word [edx + 0x1c], ax
mov byte [edx + 0x1e], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x45
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4bff3f
mov eax, dword [eax]
push dword [ebp - 0xe0]
push eax
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x8c]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4bff97
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4bff8d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c0838
push ecx
push edx
call fcn.005aa4e8
add esp, 8
cmp dword [ebp - 0xe0], 0
movzx eax, word [esi + 0x1413cc]
jle 0x4c0512
cmp ax, 0xb
jne 0x4bfffb
mov ecx, esi
call fcn.00447e40
lea eax, [esi + 0x18bfc4]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov ecx, esi
mov word [eax + 8], 0
push 0
push eax
mov byte [eax + 0xa], 0
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x8c
push 0xb
push eax
movsx eax, di
add eax, 0x3c
push eax
call fcn.00462cb0
mov eax, 9
mov word [esi + 0x1413cc], ax
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CITYHALL_MENU97]
mov edx, eax
mov dword [ebp - 0x90], 0x1e
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0c54]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d0c5c]
mov dword [edx + 0x18], ecx
mov ax, word [0x5d0c60]
mov word [edx + 0x1c], ax
mov byte [edx + 0x1e], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x46
push eax
lea eax, [ebp - 0xdc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov edx, dword [eax]
add edx, 0x20
cmp dword [edx + 0x14], 0xf
jbe 0x4c0099
mov edx, dword [edx]
mov eax, dword [ebp - 0xc8]
push 0
movsx ecx, ax
push 0x19
push 0x19
movsx eax, di
add ecx, eax
mov eax, dword [ebp - 0xbc]
push 0x37
cwde
push edx
add eax, 0x55
mov dword [ebp - 0xc0], ecx
push eax
push ecx
movsx eax, di
mov ecx, esi
push eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CITYHALL_MENU101]
mov edx, eax
mov dword [ebp - 0x90], 0x1f
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0c74]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d0c7c]
mov dword [edx + 0x18], ecx
mov ax, word [0x5d0c80]
mov word [edx + 0x1c], ax
mov al, byte [0x5d0c82]
mov byte [edx + 0x1e], al
mov byte [edx + 0x1f], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x47
push eax
lea eax, [ebp - 0xf4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c0185
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0x7d
push eax
push dword [ebp - 0xc0]
movsx eax, di
push eax
call fcn.0045d060
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4c01eb
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c01e1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c083d
push ecx
push edx
call fcn.005aa4e8
add esp, 8
mov eax, dword [ebp - 0xbc]
cwde
push 0
push 0x192319
push str.____________________
lea ecx, [eax + 0x8c]
movsx eax, di
add eax, 0x3c
mov dword [ebp - 0xc0], ecx
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0xd8], eax
call fcn.0045d450
cmp byte [esi + 0x189668], 0
je 0x4c023e
mov ecx, esi
call fcn.004973c0
cmp eax, 0xd
jne 0x4c023e
cmp word [esi + 0x1413cc], 0xa
jne 0x4c025f
push 0
push 0xffffff
lea eax, [esi + 0x18bfc4]
mov ecx, esi
push eax
push dword [ebp - 0xc0]
push dword [ebp - 0xd8]
call fcn.0045d450
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CITYHALL_MENU98]
mov edx, eax
mov dword [ebp - 0x90], 0x1e
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0cac]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d0cb4]
mov dword [edx + 0x18], ecx
mov ax, word [0x5d0cb8]
mov word [edx + 0x1c], ax
mov byte [edx + 0x1e], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x48
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c02fd
mov eax, dword [eax]
push 0
push 0x191937
push eax
mov eax, dword [ebp - 0xbc]
mov ecx, esi
cwde
add eax, 0xaa
push eax
movsx eax, di
add eax, 0x19
push eax
call fcn.0045d450
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
mov eax, dword [ebp - 0xbc]
push 0
mov ecx, dword [esi + 0x14add4]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [esi + 0x189300]
cwde
add eax, 0x104
push 0xb3
push eax
movsx eax, di
add eax, 0x23
push eax
call fcn.0057e2f0
push 0
push 0xff00
lea eax, [ebp - 0x88]
mov ecx, esi
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0xfa
push eax
movsx eax, di
add eax, 0x32
push eax
call fcn.0045d450
movsx ecx, word [ebp + 8]
movsx eax, di
add eax, 0x1e
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xd8], eax
cmp ecx, eax
jl 0x4c047d
movsx eax, di
add eax, 0x68
cmp ecx, eax
jg 0x4c047d
mov ecx, dword [ebp - 0xbc]
movsx edx, word [ebp + 0xc]
movsx eax, cx
add eax, 0x124
mov dword [ebp - 0xc0], eax
cmp edx, eax
jl 0x4c047d
movsx eax, cx
add eax, 0x138
cmp edx, eax
jg 0x4c047d
lea ecx, [esi + 0x18bfc4]
mov edx, ecx
lea eax, [edx + 1]
mov dword [ebp - 0xe8], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x4c0400
sub edx, dword [ebp - 0xe8]
je 0x4c046f
lea eax, [esi + 0x18d77a]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4c0435
test dl, dl
je 0x4c0431
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4c0435
add ecx, 2
add eax, 2
test dl, dl
jne 0x4c0415
xor eax, eax
jmp 0x4c043a
sbb eax, eax
or eax, 1
test eax, eax
je 0x4c0462
push 0
push 0
push 0x13
push dword [ebp - 0xc0]
mov ecx, esi
push dword [ebp - 0xd8]
push 0x47
call fcn.0043d1d0
movzx eax, word [ebp + 8]
movsx ecx, ax
jmp 0x4c04a5
movzx eax, word [ebp + 8]
movsx ecx, ax
mov dword [ebp - 0xf0], ecx
push 0
push 0
push 0x12
push dword [ebp - 0xc0]
jmp 0x4c0490
mov eax, dword [ebp - 0xbc]
push 0
push 0
cwde
push 0x12
add eax, 0x124
push eax
push dword [ebp - 0xd8]
mov ecx, esi
push 0x47
call fcn.0043d1d0
mov ecx, dword [ebp - 0xf0]
movsx edx, di
add edx, 0x9a
cmp ecx, edx
jl 0x4c04f9
movsx eax, di
add eax, 0xe4
cmp ecx, eax
jg 0x4c04f9
mov ecx, dword [ebp - 0xbc]
mov ax, word [ebp + 0xc]
movsx edi, cx
add edi, 0x124
cwde
cmp eax, edi
jl 0x4c04f9
mov esi, dword [ebp - 0xcc]
movsx eax, cx
movsx ecx, word [ebp + 0xc]
add eax, 0x138
cmp ecx, eax
jg 0x4c04f9
push 0
push 0
push 3
push edi
push edx
jmp 0x4c0803
mov eax, dword [ebp - 0xbc]
push 0
push 0
cwde
push 2
add eax, 0x124
push eax
push edx
jmp 0x4c0803
cmp ax, 0xb
je 0x4c0546
mov ecx, esi
call fcn.00447e40
xorps xmm0, xmm0
mov eax, 0xb
movq qword [esi + 0x18bfc4], xmm0
mov word [esi + 0x18bfcc], 0
mov byte [esi + 0x18bfce], 0
mov word [esi + 0x1413cc], ax
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CITYHALL_MENU99]
mov edx, eax
mov dword [ebp - 0x90], 0x1e
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0ccc]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d0cd4]
mov dword [edx + 0x18], ecx
mov ax, word [0x5d0cd8]
mov word [edx + 0x1c], ax
mov byte [edx + 0x1e], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x49
push eax
lea eax, [ebp - 0xc4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c05e4
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x7d
push eax
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4c0653
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c0649
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c0842
push ecx
push edx
call fcn.005aa4e8
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0xa8], 0
push 0x20
movups xmmword [ebp - 0xb8], xmm0
mov dword [ebp - 0xa4], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CITYHALL_MENU100]
mov edx, eax
mov dword [ebp - 0xa8], 0x1f
mov dword [ebp - 0xb8], edx
add esp, 4
mov dword [ebp - 0xa4], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0cec]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d0cf4]
mov dword [edx + 0x18], ecx
mov ax, word [0x5d0cf8]
mov word [edx + 0x1c], ax
mov al, byte [0x5d0cfa]
mov byte [edx + 0x1e], al
mov byte [edx + 0x1f], 0
lea eax, [ebp - 0xb8]
mov dword [ebp - 4], 0x4a
push eax
lea eax, [ebp - 0xe4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c06f9
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0x8c
push eax
mov eax, dword [ebp - 0xc8]
movsx ecx, ax
movsx eax, di
add ecx, eax
movsx eax, di
push ecx
push eax
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
mov eax, dword [ebp - 0xbc]
push 0
mov ecx, dword [esi + 0x14add4]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [esi + 0x189300]
cwde
add eax, 0x104
push 0xb3
push eax
movsx eax, di
add eax, 0x23
push eax
call fcn.0057e2f0
push 0
push 0xff
lea eax, [ebp - 0x88]
mov ecx, esi
push eax
mov eax, dword [ebp - 0xbc]
cwde
add eax, 0xfa
push eax
movsx eax, di
add eax, 0x32
push eax
call fcn.0045d450
movsx ecx, word [ebp + 8]
movsx eax, di
add eax, 0x9a
mov dword [ebp - 0xc0], eax
cmp ecx, eax
jl 0x4c07ea
movsx eax, di
add eax, 0xe4
cmp ecx, eax
jg 0x4c07ea
mov ecx, dword [ebp - 0xbc]
movsx edi, word [ebp + 0xc]
movsx edx, cx
add edx, 0x124
cmp edi, edx
jle 0x4c07ea
movsx eax, cx
add eax, 0x138
cmp edi, eax
jge 0x4c07ea
push 0
push 0
push 1
push edx
jmp 0x4c07fd
mov eax, dword [ebp - 0xbc]
push 0
push 0
cwde
push 0
add eax, 0x124
push eax
push dword [ebp - 0xc0]
push 0x47
mov ecx, esi
call fcn.0043d1d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005aa550
mov esp, ebp
pop ebp
ret 0x10
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
nop
xchg ebp, eax
ror byte [ebx], cl
mov ecx, 0x7c004bdd
jecxz 4982942
add ch, dh
jecxz 0x4c08a2
add al, bl
in al, 0x4b
add cl, al
out 0x4b, al
add byte [ecx - 0x17], cl
dec ebx
add byte [ecx - 0x68ffb411], ah
dec ebx
add byte [ebx], bl
cld
dec ebx
add byte [ebx], bl
cld
dec ebx
add byte [ebx], bl
cld
dec ebx
add ah, cl
int3
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xd0], esi
movzx eax, word [esi + 0x1440a8]
movzx ecx, word [esi + 0x1440a6]
movzx edx, word [esi + 0x1440aa]
push 0
push 0
push 2
cwde
movsx edi, cx
mov ecx, esi
push eax
push edi
push 0x3d
mov dword [ebp - 0xc4], edx
mov dword [ebp - 0xc0], eax
call fcn.0043d1d0
push 0
push 0
push 0x18
push dword [ebp - 0xc0]
mov ecx, esi
push edi
push 0x46
call fcn.0043d1d0
movsx eax, word [esi + 0x1441b0]
cmp eax, 4
ja case.default.0x4c0911
jmp dword [eax*4 + 0x4c2e1c]
mov ecx, str.NONE
lea eax, [esi + 0x18d86f]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4c0943
test dl, dl
je 0x4c093f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4c0943
add eax, 2
add ecx, 2
test dl, dl
jne 0x4c0923
xor eax, eax
jmp 0x4c0948
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4c0afa
push 0x1c
xorps xmm0, xmm0
mov dword [ebp - 0x90], eax
push str.DRAW_DIALOGBOX_CMDHALL_MENU1
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x8c], eax
movups xmmword [ebp - 0xa0], xmm0
call fcn.0040b5c0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov ecx, dword [eax]
add ecx, 0x20
cmp dword [ecx + 0x14], 0xf
jbe 0x4c09a4
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc0]
push 0
push 0x41
push 0x41
push 0x41
push ecx
movsx edx, dx
add eax, 0x46
add edx, edi
mov ecx, esi
push eax
push edx
push edi
mov dword [ebp - 0xd4], edx
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push 0x1c
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push str.DRAW_DIALOGBOX_CMDHALL_MENU2
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x8c], 0
movups xmmword [ebp - 0xa0], xmm0
call fcn.0040b5c0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c0a3f
mov eax, dword [eax]
push 0
push 0x41
push 0x41
push 0x41
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0x60
push eax
push dword [ebp - 0xd4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push 0x1c
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push str.DRAW_DIALOGBOX_CMDHALL_MENU3
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x8c], 0
movups xmmword [ebp - 0xa0], xmm0
call fcn.0040b5c0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c0ace
mov eax, dword [eax]
push 0
push 0x41
push 0x41
push 0x41
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0x7a
push eax
push dword [ebp - 0xd4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
jmp 0x4c2dd7
movsx eax, word [ebp + 8]
lea ecx, [edi + 0x23]
mov dword [ebp - 0xe0], ecx
cmp eax, ecx
jle 0x4c0bdc
lea ecx, [edi + 0xdc]
mov dword [ebp - 0xd4], ecx
cmp eax, ecx
jge 0x4c0bdc
mov eax, dword [ebp - 0xc0]
movsx ecx, word [ebp + 0xc]
mov dword [ebp - 0xd8], ecx
lea edx, [eax + 0x46]
mov dword [ebp - 0xd0], edx
cmp ecx, edx
jle 0x4c0bdc
add eax, 0x5f
cmp ecx, eax
jge 0x4c0bdc
push str.DRAW_DIALOGBOX_CMDHALL_MENU1
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 3
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
mov edx, eax
cmp dword [edx + 0x14], 0xf
jbe 0x4c0b81
mov edx, dword [edx]
mov eax, dword [ebp - 0xc4]
mov ecx, esi
push 0
push 0xff
push 0xff
push 0xff
push edx
push dword [ebp - 0xd0]
movsx eax, ax
add eax, edi
push eax
push edi
mov dword [ebp - 0xc4], eax
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xd8]
mov dword [ebp - 0xd0], eax
jmp 0x4c0cae
push str.DRAW_DIALOGBOX_CMDHALL_MENU1
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov edx, dword [eax]
add edx, 0x20
cmp dword [edx + 0x14], 0xf
jbe 0x4c0c18
mov edx, dword [edx]
mov eax, dword [ebp - 0xc4]
push 0
push 0x32
cwde
push 0
push 4
push edx
lea ecx, [eax + edi]
mov eax, dword [ebp - 0xc0]
add eax, 0x46
mov dword [ebp - 0xc4], ecx
push eax
push ecx
push edi
mov ecx, esi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
movsx ecx, word [ebp + 0xc]
lea edx, [edi + 0xdc]
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xd4], edx
mov dword [ebp - 0xc8], edx
movsx edx, word [ebp + 8]
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xd0], eax
cmp edx, dword [ebp - 0xe0]
jle 0x4c0d36
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xd4], eax
cmp edx, eax
jge 0x4c0d36
mov eax, dword [ebp - 0xc0]
lea edx, [eax + 0x60]
mov dword [ebp - 0xc8], edx
cmp ecx, edx
jle 0x4c0d36
add eax, 0x79
cmp ecx, eax
jge 0x4c0d36
push str.DRAW_DIALOGBOX_CMDHALL_MENU2
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 5
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c0cf8
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
push dword [ebp - 0xc8]
mov ecx, esi
push dword [ebp - 0xd0]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
movsx eax, word [ebp + 8]
jmp 0x4c0db4
push str.DRAW_DIALOGBOX_CMDHALL_MENU2
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 6
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c0d72
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0x60
push eax
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
movsx eax, word [ebp + 8]
lea ecx, [edi + 0x23]
cmp eax, ecx
jle 0x4c0e4f
cmp eax, dword [ebp - 0xd4]
jge 0x4c0e4f
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xd8]
lea edx, [eax + 0x7a]
mov dword [ebp - 0xc8], edx
cmp ecx, edx
jle 0x4c0e4f
add eax, 0x93
cmp ecx, eax
jge 0x4c0e4f
push str.DRAW_DIALOGBOX_CMDHALL_MENU3
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 7
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c0e12
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
push dword [ebp - 0xc8]
mov ecx, esi
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
jmp 0x4c0ed9
push str.DRAW_DIALOGBOX_CMDHALL_MENU3
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 8
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c0e8b
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0x7a
push eax
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
movsx eax, word [ebp + 8]
lea ecx, [edi + 0x23]
cmp eax, ecx
jle 0x4c0f5f
cmp eax, dword [ebp - 0xd4]
jge 0x4c0f5f
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xd8]
lea edx, [eax + 0x94]
mov dword [ebp - 0xc8], edx
cmp ecx, edx
jle 0x4c0f5f
add eax, 0xad
cmp ecx, eax
jge 0x4c0f5f
push str.DRAW_DIALOGBOX_CMDHALL_MENU18
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 9
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c0f2e
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
push dword [ebp - 0xc8]
mov ecx, esi
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
jmp 0x4c2dd7
push str.DRAW_DIALOGBOX_CMDHALL_MENU18
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0xa
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c0f9b
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0x94
push eax
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
jmp 0x4c2dd7
mov eax, dword [esi + 4]
lea ecx, [ebp - 0xa0]
test eax, eax
jle 0x4c1226
push str.DRAW_DIALOGBOX_CITYHALL_MENU72_1
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0xb
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c1010
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0xc8
push eax
lea eax, [edi + 0x15]
push eax
call fcn.0045d320
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
cmp dword [esi + 4], 0
mov dword [ebp - 0xd0], 0
jle case.default.0x4c0911
mov eax, dword [ebp - 0xc0]
add eax, 0x86
mov dword [ebp - 0xd8], eax
lea eax, [esi + 0x1497ac]
mov dword [ebp - 0xd4], eax
push 0x78
lea eax, [ebp - 0x88]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebp - 0xd4]
add eax, 0xffffffec
push eax
call fcn.005666c0
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CITYHALL_MENU77]
mov edx, eax
mov dword [ebp - 0x90], 0x1e
mov dword [ebp - 0xa0], edx
add esp, 0x18
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0354]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d035c]
mov dword [edx + 0x18], ecx
mov ax, word [0x5d0360]
mov word [edx + 0x1c], ax
mov byte [edx + 0x1e], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0xc
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c1137
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd4]
push dword [ecx]
lea ecx, [ebp - 0x88]
push ecx
push eax
lea eax, [esi + 0x18d57f]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x8c]
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4c1198
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c118e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c2df9
push ecx
push edx
call fcn.005aa4e8
add esp, 8
movsx ecx, word [ebp + 8]
lea eax, [edi + 0x1e]
cmp ecx, eax
jl 0x4c11c9
lea eax, [edi + 0xe4]
cmp ecx, eax
mov ecx, dword [ebp - 0xd8]
jg 0x4c11cf
movsx edx, word [ebp + 0xc]
lea eax, [ecx - 0xe]
cmp edx, eax
jl 0x4c11cf
cmp edx, ecx
jg 0x4c11cf
mov eax, 0xff
jmp 0x4c11d1
mov ecx, dword [ebp - 0xd8]
xor eax, eax
push 0
push eax
push 0xff
push 0xff
lea eax, [esi + 0x18d57f]
mov edx, esi
push eax
lea eax, [ecx - 4]
mov ecx, edx
push eax
mov eax, dword [ebp - 0xc4]
cwde
add eax, edi
push eax
push edi
call fcn.0045d060
mov ecx, dword [ebp - 0xd0]
add dword [ebp - 0xd4], 0x1c
inc ecx
add dword [ebp - 0xd8], 0xf
mov dword [ebp - 0xd0], ecx
cmp ecx, dword [esi + 4]
jl 0x4c1073
jmp case.default.0x4c0911
cmp eax, 0xffffffff
jne 0x4c135b
push str.DRAW_DIALOGBOX_CITYHALL_MENU73
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0xd
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c1259
mov eax, dword [eax]
mov edx, dword [ebp - 0xc4]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xc0]
movsx ecx, dx
add eax, 0x7d
add ecx, edi
push eax
push ecx
mov dword [ebp - 0xd0], ecx
mov ecx, esi
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU74
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0xe
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c12c8
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0x96
push eax
push dword [ebp - 0xd0]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CITYHALL_MENU75
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0xf
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c132d
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0xaf
push eax
push dword [ebp - 0xd0]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
jmp 0x4c2dd7
push str.DRAW_DIALOGBOX_CITYHALL_MENU76
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x10
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c1385
mov eax, dword [eax]
push 0
push 0x19
push 0x19
push 0x37
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0xaf
push eax
mov eax, dword [ebp - 0xc4]
cwde
add eax, edi
push eax
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
jmp 0x4c2dd7
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CMDHALL_MENU11]
mov edx, eax
mov dword [ebp - 0x90], 0x1d
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d03f4]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d03fc]
mov dword [edx + 0x18], ecx
mov al, byte [0x5d0400]
mov byte [edx + 0x1c], al
mov byte [edx + 0x1d], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x11
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov edx, dword [eax]
add edx, 0x20
cmp dword [edx + 0x14], 0xf
jbe 0x4c1453
mov edx, dword [edx]
mov eax, dword [ebp - 0xc4]
push 0
push 0xff
cwde
push 0xff
push 0xff
push edx
lea ecx, [eax + edi]
mov eax, dword [ebp - 0xc0]
add eax, 0x2d
mov dword [ebp - 0xc4], ecx
push eax
push ecx
push edi
mov ecx, esi
call fcn.0045d060
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4c14c9
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c14bf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c2df9
push ecx
push edx
call fcn.005aa4e8
add esp, 8
cmp dword [esi + 0x18c0b4], 0x7d0
jl 0x4c1604
movsx eax, word [ebp + 8]
lea ecx, [edi + 0x1e]
mov dword [ebp - 0xd0], ecx
cmp eax, ecx
jl 0x4c1593
lea ecx, [edi + 0xe4]
cmp eax, ecx
jg 0x4c1593
mov eax, dword [ebp - 0xc0]
movsx ecx, word [ebp + 0xc]
mov dword [ebp - 0xd8], ecx
lea edx, [eax + 0x46]
mov dword [ebp - 0xc8], edx
cmp ecx, edx
jl 0x4c1593
add eax, 0x55
cmp ecx, eax
jg 0x4c1593
push str.DRAW_DIALOGBOX_CMDHALL_MENU4
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x12
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c1550
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
push dword [ebp - 0xc8]
mov ecx, esi
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
mov ecx, dword [ebp - 0xd8]
jmp 0x4c1686
push str.DRAW_DIALOGBOX_CMDHALL_MENU4
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x13
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c15cf
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0x46
push eax
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
jmp 0x4c167c
push str.DRAW_DIALOGBOX_CMDHALL_MENU4
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x14
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c1640
mov eax, dword [eax]
push 0
push 0x41
push 0x41
push 0x41
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0x46
push eax
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
lea eax, [edi + 0x1e]
mov dword [ebp - 0xd0], eax
movsx ecx, word [ebp + 0xc]
mov dword [ebp - 0xd8], ecx
cmp dword [esi + 0x18c0b4], 0xbb8
lea edx, [edi + 0xe4]
movsx eax, word [ebp + 8]
jl 0x4c1759
cmp eax, dword [ebp - 0xd0]
jl 0x4c1713
cmp eax, edx
jg 0x4c1713
mov eax, dword [ebp - 0xc0]
lea edx, [eax + 0x5f]
mov dword [ebp - 0xc8], edx
cmp ecx, edx
jl 0x4c1713
add eax, 0x6e
cmp ecx, eax
jg 0x4c1713
push str.DRAW_DIALOGBOX_CMDHALL_MENU5
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x15
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c16f6
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
push dword [ebp - 0xc8]
jmp 0x4c17a8
push str.DRAW_DIALOGBOX_CMDHALL_MENU5
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x16
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c174f
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
jmp 0x4c179d
push str.DRAW_DIALOGBOX_CMDHALL_MENU5
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x17
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c1795
mov eax, dword [eax]
push 0
push 0x41
push 0x41
push 0x41
push eax
mov eax, dword [ebp - 0xc0]
add eax, 0x5f
push eax
push dword [ebp - 0xc4]
mov ecx, esi
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
cmp dword [esi + 0x18c0b4], 0x5dc
jl 0x4c18a2
movsx eax, word [ebp + 8]
lea ecx, [edi + 0x1e]
cmp eax, ecx
jl 0x4c185c
lea ecx, [edi + 0xe4]
cmp eax, ecx
jg 0x4c185c
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xd8]
lea edx, [eax + 0x78]
mov dword [ebp - 0xc8], edx
cmp ecx, edx
jl 0x4c185c
add eax, 0x87
cmp ecx, eax
jg 0x4c185c
push str.DRAW_DIALOGBOX_CMDHALL_MENU6
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x18
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c183f
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
push dword [ebp - 0xc8]
jmp 0x4c18f1
push str.DRAW_DIALOGBOX_CMDHALL_MENU6
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x19
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c1898
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
jmp 0x4c18e6
push str.DRAW_DIALOGBOX_CMDHALL_MENU6
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c18de
mov eax, dword [eax]
push 0
push 0x41
push 0x41
push 0x41
push eax
mov eax, dword [ebp - 0xc0]
add eax, 0x78
push eax
push dword [ebp - 0xc4]
mov ecx, esi
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
cmp dword [esi + 0x18c0b4], 0xbb8
jl 0x4c19ee
movsx eax, word [ebp + 8]
lea ecx, [edi + 0x1e]
cmp eax, ecx
jl 0x4c19a8
lea ecx, [edi + 0xe4]
cmp eax, ecx
jg 0x4c19a8
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xd8]
lea edx, [eax + 0x91]
mov dword [ebp - 0xc8], edx
cmp ecx, edx
jl 0x4c19a8
add eax, 0xa0
cmp ecx, eax
jg 0x4c19a8
push str.DRAW_DIALOGBOX_CMDHALL_MENU7
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x1b
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c198b
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
push dword [ebp - 0xc8]
jmp 0x4c1a3f
push str.DRAW_DIALOGBOX_CMDHALL_MENU7
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c19e4
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
jmp 0x4c1a32
push str.DRAW_DIALOGBOX_CMDHALL_MENU7
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x1d
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c1a2a
mov eax, dword [eax]
push 0
push 0x41
push 0x41
push 0x41
push eax
mov eax, dword [ebp - 0xc0]
add eax, 0x91
push eax
push dword [ebp - 0xc4]
mov ecx, esi
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
cmp dword [esi + 0x18c0b4], 0xfa0
jl 0x4c1b3c
movsx eax, word [ebp + 8]
lea ecx, [edi + 0x1e]
cmp eax, ecx
jl 0x4c1af6
lea ecx, [edi + 0xe4]
cmp eax, ecx
jg 0x4c1af6
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xd8]
lea edx, [eax + 0xaa]
mov dword [ebp - 0xc8], edx
cmp ecx, edx
jl 0x4c1af6
add eax, 0xb9
cmp ecx, eax
jg 0x4c1af6
push str.DRAW_DIALOGBOX_CMDHALL_MENU8
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x1e
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c1ad9
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
push dword [ebp - 0xc8]
jmp 0x4c1b8d
push str.DRAW_DIALOGBOX_CMDHALL_MENU8
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x1f
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c1b32
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
jmp 0x4c1b80
push str.DRAW_DIALOGBOX_CMDHALL_MENU8
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x20
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c1b78
mov eax, dword [eax]
push 0
push 0x41
push 0x41
push 0x41
push eax
mov eax, dword [ebp - 0xc0]
add eax, 0xaa
push eax
push dword [ebp - 0xc4]
mov ecx, esi
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
cmp dword [esi + 0x18c0b4], 0xbb8
jl 0x4c1c8a
movsx eax, word [ebp + 8]
lea ecx, [edi + 0x1e]
cmp eax, ecx
jl 0x4c1c44
lea ecx, [edi + 0xe4]
cmp eax, ecx
jg 0x4c1c44
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xd8]
lea edx, [eax + 0xc3]
mov dword [ebp - 0xc8], edx
cmp ecx, edx
jl 0x4c1c44
add eax, 0xd2
cmp ecx, eax
jg 0x4c1c44
push str.DRAW_DIALOGBOX_CMDHALL_MENU9
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x21
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c1c27
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
push dword [ebp - 0xc8]
jmp 0x4c1cdb
push str.DRAW_DIALOGBOX_CMDHALL_MENU9
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x22
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c1c80
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
jmp 0x4c1cce
push str.DRAW_DIALOGBOX_CMDHALL_MENU9
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x23
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c1cc6
mov eax, dword [eax]
push 0
push 0x41
push 0x41
push 0x41
push eax
mov eax, dword [ebp - 0xc0]
add eax, 0xc3
push eax
push dword [ebp - 0xc4]
mov ecx, esi
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CMDHALL_MENU15]
mov edx, eax
mov dword [ebp - 0x90], 0x1d
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d04d4]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d04dc]
mov dword [edx + 0x18], ecx
mov al, byte [0x5d04e0]
mov byte [edx + 0x1c], al
mov byte [edx + 0x1d], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x24
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c1d97
mov eax, dword [eax]
push dword [esi + 0x18c0b4]
lea ecx, [esi + 0x18d57f]
push eax
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x8c]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4c1def
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c1de5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c2dfe
push ecx
push edx
call fcn.005aa4e8
add esp, 8
push 0
push 0x32
push 0
push 4
lea eax, [esi + 0x18d57f]
mov ecx, esi
push eax
mov eax, dword [ebp - 0xc0]
add eax, 0xdc
push eax
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CMDHALL_MENU14]
mov edx, eax
mov dword [ebp - 0x90], 0x1d
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d04f4]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d04fc]
mov dword [edx + 0x18], ecx
mov al, byte [0x5d0500]
mov byte [edx + 0x1c], al
mov byte [edx + 0x1d], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x25
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c1eb4
mov eax, dword [eax]
push dword [esi + 0x18c0b4]
push eax
lea eax, [esi + 0x18d57f]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.00411640
push 0
push 0x32
push 0
push 4
lea eax, [esi + 0x18d57f]
mov ecx, esi
push eax
mov eax, dword [ebp - 0xc0]
add eax, 0xfa
push eax
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CMDHALL_MENU12]
mov edx, eax
mov dword [ebp - 0x90], 0x1d
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0514]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d051c]
mov dword [edx + 0x18], ecx
mov al, byte [0x5d0520]
mov byte [edx + 0x1c], al
mov byte [edx + 0x1d], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x26
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c1fa2
mov eax, dword [eax]
push dword [esi + 0x18c0b4]
push eax
lea eax, [esi + 0x18d57f]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.00411640
push 0
push 0x32
push 0
push 4
lea eax, [esi + 0x18d57f]
mov ecx, esi
push eax
mov eax, dword [ebp - 0xc0]
add eax, 0x118
push eax
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CMDHALL_MENU13]
mov edx, eax
mov dword [ebp - 0x90], 0x1d
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0534]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d053c]
mov dword [edx + 0x18], ecx
mov al, byte [0x5d0540]
mov byte [edx + 0x1c], al
mov byte [edx + 0x1d], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x27
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c2090
mov eax, dword [eax]
push dword [esi + 0x18c0b4]
push eax
lea eax, [esi + 0x18d57f]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x8c]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4c20e8
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c20de
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c2e03
push ecx
push edx
call fcn.005aa4e8
add esp, 8
push 0
push 0x32
push 0
push 4
lea eax, [esi + 0x18d57f]
mov ecx, esi
push eax
mov eax, dword [ebp - 0xc0]
add eax, 0x12c
push eax
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
jmp case.default.0x4c0911
movsx ecx, word [ebp + 8]
lea eax, [edi + 0x1e]
cmp ecx, eax
jl 0x4c2292
lea eax, [edi + 0xe4]
cmp ecx, eax
jg 0x4c2292
mov ecx, dword [ebp - 0xc0]
movsx edx, word [ebp + 0xc]
lea eax, [ecx + 0x87]
cmp edx, eax
jl 0x4c2292
lea eax, [ecx + 0x95]
cmp edx, eax
jg 0x4c2292
push str.DRAW_DIALOGBOX_CMDHALL_MENU16
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x28
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c2189
mov eax, dword [eax]
mov edx, dword [ebp - 0xc4]
push 0
push 0x32
push 0
push 4
push eax
mov eax, dword [ebp - 0xc0]
movsx ecx, dx
add eax, 0x5a
add ecx, edi
push eax
push ecx
mov dword [ebp - 0xd0], ecx
mov ecx, esi
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CMDHALL_MENU17
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x29
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c21f8
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0x6e
push eax
push dword [ebp - 0xd0]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_CMDHALL_MENU10
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x2a
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c225b
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0x82
push eax
push dword [ebp - 0xd0]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
jmp 0x4c2dd7
push 0x1d
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push str.DRAW_DIALOGBOX_CMDHALL_MENU16
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x8c], 0
movups xmmword [ebp - 0xa0], xmm0
call fcn.0040b5c0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x2b
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov ecx, dword [eax]
add ecx, 0x20
cmp dword [ecx + 0x14], 0xf
jbe 0x4c22ee
mov ecx, dword [ecx]
mov eax, dword [ebp - 0xc4]
push 0
push 0x32
cwde
push 0
push 4
push ecx
lea edx, [eax + edi]
mov ecx, esi
mov eax, dword [ebp - 0xc0]
add eax, 0x5a
mov dword [ebp - 0xd0], edx
push eax
push edx
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push 0x1d
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push str.DRAW_DIALOGBOX_CMDHALL_MENU17
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x8c], 0
movups xmmword [ebp - 0xa0], xmm0
call fcn.0040b5c0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x2c
push eax
lea eax, [ebp - 0xe4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c2388
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0x6e
push eax
push dword [ebp - 0xd0]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CMDHALL_MENU10]
mov edx, eax
mov dword [ebp - 0x90], 0x1d
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0594]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d059c]
mov dword [edx + 0x18], ecx
mov al, byte [0x5d05a0]
mov byte [edx + 0x1c], al
mov byte [edx + 0x1d], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x2d
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c2457
mov eax, dword [eax]
push 0
push 0
push 0xff
push 0xff
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0x82
push eax
push dword [ebp - 0xd0]
push edi
call fcn.0045d060
mov ecx, dword [ebp - 0x8c]
cmp ecx, 0xf
jbe case.default.0x4c0911
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c24b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c2e08
push ecx
push edx
call fcn.005aa4e8
add esp, 8
jmp case.default.0x4c0911
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CMDHALL_MENU19]
mov edx, eax
mov dword [ebp - 0x90], 0x1d
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d05b4]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d05bc]
mov dword [edx + 0x18], ecx
mov al, byte [0x5d05c0]
mov byte [edx + 0x1c], al
mov byte [edx + 0x1d], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x2e
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov edx, dword [eax]
add edx, 0x20
cmp dword [edx + 0x14], 0xf
jbe 0x4c255f
mov edx, dword [edx]
mov eax, dword [ebp - 0xc4]
push 0
push 0x32
cwde
push 0
push 4
push edx
lea ecx, [eax + edi]
mov eax, dword [ebp - 0xc0]
add eax, 0x5a
mov dword [ebp - 0xc4], ecx
push eax
push ecx
push edi
mov ecx, esi
call fcn.0045d060
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4c25cc
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c25c2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c2e0d
push ecx
push edx
call fcn.005aa4e8
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CMDHALL_MENU20]
mov edx, eax
mov dword [ebp - 0x90], 0x1d
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d05d4]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d05dc]
mov dword [edx + 0x18], ecx
mov al, byte [0x5d05e0]
mov byte [edx + 0x1c], al
mov byte [edx + 0x1d], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x2f
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c2668
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0x6e
push eax
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0
push 0x20
movups xmmword [ebp - 0xa4], xmm0
mov dword [ebp - 0x90], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_ITEMUPGRADE11]
mov dword [ebp - 0xa4], eax
add esp, 4
mov dword [ebp - 0x94], 0x1c
mov dword [ebp - 0x90], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d05f4]
movq qword [eax + 0x10], xmm0
mov ecx, dword [0x5d05fc]
mov dword [eax + 0x18], ecx
mov byte [eax + 0x1c], 0
lea eax, [ebp - 0xa4]
mov dword [ebp - 4], 0x30
push eax
lea eax, [ebp - 0xe4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov ecx, dword [eax]
add ecx, 0x20
cmp dword [ecx + 0x14], 0xf
jbe 0x4c272d
mov ecx, dword [ecx]
mov eax, dword [ebp - 0xd0]
add esi, 0x18d57f
push dword [eax + 0x18c0d0]
push ecx
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4]
call fcn.00411640
mov eax, dword [ebp - 0xc0]
push 0
push 0
push 0
push 0
push esi
mov esi, dword [ebp - 0xd0]
add eax, 0x8c
push eax
push dword [ebp - 0xc4]
mov ecx, esi
push edi
call fcn.0045d060
movsx eax, word [ebp + 8]
lea ecx, [edi + 0x1e]
mov dword [ebp - 0xc8], ecx
cmp eax, ecx
jl 0x4c284f
lea ecx, [edi + 0xe4]
mov dword [ebp - 0xd4], ecx
cmp eax, ecx
jg 0x4c284f
mov ecx, dword [ebp - 0xc0]
movsx edx, word [ebp + 0xc]
mov dword [ebp - 0xd8], edx
lea eax, [ecx + 0xb9]
cmp edx, eax
jl 0x4c284f
lea eax, [ecx + 0xc7]
cmp edx, eax
jg 0x4c284f
push str.DRAW_DIALOGBOX_CMDHALL_MENU24
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x31
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c2806
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0xb4
push eax
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
mov ecx, dword [ebp - 0xd8]
jmp 0x4c2991
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CMDHALL_MENU24]
mov edx, eax
mov dword [ebp - 0x90], 0x1d
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0614]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d061c]
mov dword [edx + 0x18], ecx
mov al, byte [0x5d0620]
mov byte [edx + 0x1c], al
mov byte [edx + 0x1d], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x32
push eax
lea eax, [ebp - 0xe4]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c28eb
mov eax, dword [eax]
push 0
push 0
push 0xff
push 0xff
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0xb4
push eax
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4c2955
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c294b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c2e12
push ecx
push edx
call fcn.005aa4e8
add esp, 8
movsx ecx, word [ebp + 0xc]
lea eax, [edi + 0xe4]
mov dword [ebp - 0xd4], eax
mov edx, eax
movsx eax, word [ebp + 8]
mov dword [ebp - 0xd8], ecx
cmp eax, dword [ebp - 0xc8]
jl 0x4c2a21
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xd4], edx
cmp eax, edx
jg 0x4c2a21
mov eax, dword [ebp - 0xc0]
lea edx, [eax + 0xd2]
mov dword [ebp - 0xc8], edx
cmp ecx, edx
jl 0x4c2a21
add eax, 0xe1
cmp ecx, eax
jg 0x4c2a21
push str.DRAW_DIALOGBOX_CMDHALL_MENU21
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x33
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c29e0
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
push dword [ebp - 0xc8]
mov ecx, esi
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
movsx eax, word [ebp + 8]
jmp 0x4c2b07
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CMDHALL_MENU21]
mov edx, eax
mov dword [ebp - 0x90], 0x1d
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0634]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d063c]
mov dword [edx + 0x18], ecx
mov al, byte [0x5d0640]
mov byte [edx + 0x1c], al
mov byte [edx + 0x1d], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x34
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c2abd
mov eax, dword [eax]
push 0
push 0
push 0xff
push 0xff
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0xd2
push eax
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
movsx eax, word [ebp + 8]
lea ecx, [edi + 0x1e]
cmp eax, ecx
jl 0x4c2ba5
cmp eax, dword [ebp - 0xd4]
jg 0x4c2ba5
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xd8]
lea edx, [eax + 0xeb]
mov dword [ebp - 0xc8], edx
cmp ecx, edx
jl 0x4c2ba5
add eax, 0xfa
cmp ecx, eax
jg 0x4c2ba5
push str.DRAW_DIALOGBOX_CMDHALL_MENU22
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x35
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c2b68
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
push dword [ebp - 0xc8]
mov ecx, esi
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
jmp 0x4c2cc6
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x20
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_CMDHALL_MENU22]
mov edx, eax
mov dword [ebp - 0x90], 0x1d
mov dword [ebp - 0xa0], edx
add esp, 4
mov dword [ebp - 0x8c], 0x1f
movups xmmword [edx], xmm0
movq xmm0, qword [0x5d0654]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x5d065c]
mov dword [edx + 0x18], ecx
mov al, byte [0x5d0660]
mov byte [edx + 0x1c], al
mov byte [edx + 0x1d], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x36
push eax
lea eax, [ebp - 0xcc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c2c41
mov eax, dword [eax]
push 0
push 0
push 0xff
push 0xff
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0xeb
push eax
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4c2cab
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c2ca1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c2e17
push ecx
push edx
call fcn.005aa4e8
add esp, 8
movsx eax, word [ebp + 8]
lea ecx, [edi + 0x1e]
cmp eax, ecx
jl 0x4c2d4c
cmp eax, dword [ebp - 0xd4]
jg 0x4c2d4c
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xd8]
lea edx, [eax + 0x104]
mov dword [ebp - 0xc8], edx
cmp ecx, edx
jl 0x4c2d4c
add eax, 0x113
cmp ecx, eax
jg 0x4c2d4c
push str.DRAW_DIALOGBOX_CMDHALL_MENU23
lea ecx, [ebp - 0xa0]
call fcn.0040f9f0
lea eax, [ebp - 0xa0]
mov dword [ebp - 4], 0x37
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c2d1b
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
push dword [ebp - 0xc8]
mov ecx, esi
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xa0]
jmp 0x4c2dd7
push 0x1d
xorps xmm0, xmm0
mov dword [ebp - 0xac], 0
push str.DRAW_DIALOGBOX_CMDHALL_MENU23
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0xa8], 0
movups xmmword [ebp - 0xbc], xmm0
call fcn.0040b5c0
lea eax, [ebp - 0xbc]
mov dword [ebp - 4], 0x38
push eax
lea eax, [ebp - 0xdc]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c2da8
mov eax, dword [eax]
push 0
push 0
push 0xff
push 0xff
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, esi
add eax, 0x104
push eax
push dword [ebp - 0xc4]
push edi
call fcn.0045d060
lea ecx, [ebp - 0xbc]
call fcn.00411640
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005aa550
mov esp, ebp
pop ebp
ret 8
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
sbb byte [ecx], cl
dec esp
add cl, cl
cmovl eax, dword [eax]
mov bh, 0x13
dec esp
add byte [esi], dl
and dword [eax + eax - 0x3d], ecx
and al, 0x4c
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b4bf5
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x5f8800]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
movzx eax, word [edi + 0x1432be]
mov esi, dword [edi + 0x1892f0]
mov dword [ebp - 0x60], eax
movzx eax, word [edi + 0x1432c0]
mov dword [ebp - 0x6c], eax
movzx eax, word [edi + 0x1432c2]
mov dword [ebp - 0x58], eax
mov eax, esi
sub eax, dword [edi + 0x18932c]
mov dword [ebp - 0x54], esi
cmp eax, 0x2710
jbe 0x4c2eb2
push 3
push str.middleland
call fcn.00481e90
push 1
push str.middleland
mov ecx, edi
call fcn.00481e90
mov dword [edi + 0x18932c], esi
mov eax, dword [ebp - 0x6c]
movsx ecx, ax
mov eax, dword [ebp - 0x60]
movsx esi, ax
movzx eax, byte [edi + 0x189654]
push eax
push 0
push 0
lea eax, [ecx - 0xc]
mov dword [ebp - 0x48], ecx
push eax
lea eax, [esi - 1]
mov dword [ebp - 0x50], esi
push eax
push 0x48
mov ecx, edi
call fcn.0043d1d0
movzx eax, byte [edi + 0x189654]
mov ecx, edi
push eax
push 0
push 0xf
push dword [ebp - 0x48]
push esi
push 0x46
call fcn.0043d1d0
movsx eax, word [edi + 0x1433c8]
cmp eax, 4
ja case.default.0x4c2f0a
jmp dword [eax*4 + 0x4c5600]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_COMMANDER1]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x19
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d49a4]
movq qword [eax + 0x10], xmm0
mov cl, byte [0x5d49ac]
mov byte [eax + 0x18], cl
mov byte [eax + 0x19], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x68]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c2f8b
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [ebp - 0x48]
mov ecx, edi
add eax, 0x23
push eax
mov eax, dword [ebp - 0x58]
cwde
add eax, esi
push eax
push esi
call fcn.0045d060
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4c2fe5
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c2fdb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c55df
push ecx
push edx
call fcn.005aa4e8
add esp, 8
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x14]
mov dword [ebp - 0x60], eax
cmp ecx, eax
jl 0x4c30e8
lea eax, [esi + 0x42]
mov esi, dword [ebp + 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
jg 0x4c30ee
lea ecx, [eax + 0x154]
mov dword [ebp - 0x5c], ecx
cmp esi, ecx
jl 0x4c30ee
lea edx, [eax + 0x188]
mov dword [ebp - 0x58], edx
cmp esi, edx
jg 0x4c30ee
cmp byte [edi + 0x13b65a], 0
jne 0x4c3064
push str.DRAW_DIALOGBOX_COMMANDER50
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 1
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c305c
mov eax, dword [eax]
push 0
push 0
push 0
jmp 0x4c30bc
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x11
push ecx
push dword [ebp - 0x60]
mov ecx, dword [edi + 0x14aa2c]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER2
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 2
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c30b0
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x23]
mov ecx, edi
push eax
mov eax, dword [ebp + 8]
add eax, 0x14
push eax
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
mov edx, dword [ebp - 0x58]
jmp 0x4c3124
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x48]
push 0
mov ecx, dword [edi + 0x14aa2c]
add eax, 0x154
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
push 3
push eax
push dword [ebp - 0x60]
call fcn.0057e2f0
mov edx, dword [ebp - 0x48]
add edx, 0x188
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x50]
lea ecx, [eax + 0x46]
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 0x60]
jl 0x4c31d8
add eax, 0x74
cmp ecx, eax
mov eax, dword [ebp - 0x5c]
jg 0x4c31db
cmp esi, eax
jl 0x4c31db
cmp esi, edx
jg 0x4c31db
push 0
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0xf
push eax
push dword [ebp - 0x60]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER3
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 3
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c31a3
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x23]
mov ecx, edi
push eax
mov eax, dword [ebp + 8]
add eax, 0x14
push eax
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
jmp 0x4c31fd
mov eax, dword [ebp - 0x5c]
push 0
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 1
push eax
push dword [ebp - 0x60]
call fcn.0057e2f0
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp + 8]
lea edx, [eax + 0x78]
cmp ecx, edx
jl 0x4c32e9
add eax, 0xa6
cmp ecx, eax
mov eax, dword [ebp - 0x5c]
jg 0x4c32ec
cmp esi, eax
jl 0x4c32ec
cmp esi, dword [ebp - 0x58]
jg 0x4c32ec
cmp byte [edi + 0x13b658], 0
jne 0x4c326a
push str.DRAW_DIALOGBOX_COMMANDER52
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 4
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c3262
mov eax, dword [eax]
push 0
push 0
push 0
jmp 0x4c32c0
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x10
push eax
push edx
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER4
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 5
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c32b4
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x23]
mov ecx, edi
push eax
mov eax, dword [ebp + 8]
add eax, 0x14
push eax
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
jmp 0x4c330c
mov eax, dword [ebp - 0x5c]
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 2
push eax
push edx
call fcn.0057e2f0
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp + 8]
lea edx, [eax + 0xaa]
cmp ecx, edx
jl 0x4c33fb
add eax, 0xd8
cmp ecx, eax
mov eax, dword [ebp - 0x5c]
jg 0x4c33fe
cmp esi, eax
jl 0x4c33fe
cmp esi, dword [ebp - 0x58]
jg 0x4c33fe
cmp byte [edi + 0x13b659], 0
jne 0x4c337c
push str.DRAW_DIALOGBOX_COMMANDER51
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 6
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c3374
mov eax, dword [eax]
push 0
push 0
push 0
jmp 0x4c33d2
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x18
push eax
push edx
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER5
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 7
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c33c6
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x23]
mov ecx, edi
push eax
mov eax, dword [ebp + 8]
add eax, 0x14
push eax
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
jmp 0x4c341e
mov eax, dword [ebp - 0x5c]
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x1e
push eax
push edx
call fcn.0057e2f0
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp + 8]
lea edx, [eax + 0xf4]
cmp ecx, edx
jl 0x4c34d2
add eax, 0x122
cmp ecx, eax
mov eax, dword [ebp - 0x5c]
jg 0x4c34d5
cmp esi, eax
jl 0x4c34d5
cmp esi, dword [ebp - 0x58]
jg 0x4c34d5
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x12
push eax
push edx
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER6
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 8
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c349d
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x23]
mov ecx, edi
push eax
mov eax, dword [ebp + 8]
add eax, 0x14
push eax
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
jmp 0x4c34f5
mov eax, dword [ebp - 0x5c]
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 4
push eax
push edx
call fcn.0057e2f0
movzx eax, byte [edi + 0x189654]
mov ecx, edi
mov esi, dword [ebp - 0x50]
push eax
push 0
push 0x15
push dword [ebp - 0x48]
push esi
push 0x48
call fcn.0043d1d0
jmp case.default.0x4c2f0a
mov eax, dword [ebp - 0x48]
lea ecx, [esi + 0xc2]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
add eax, 0x154
mov dword [ebp - 0x6c], ecx
push 0x14
push eax
push ecx
mov ecx, dword [edi + 0x14aa2c]
mov dword [ebp - 0x60], eax
call fcn.0057e2f0
push 0
mov ecx, dword [edi + 0x14aa2c]
lea eax, [esi + 0xf4]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
push 4
push dword [ebp - 0x60]
push eax
call fcn.0057e2f0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_COMMANDER7]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x19
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d4aa0]
movq qword [eax + 0x10], xmm0
mov cl, byte [0x5d4aa8]
mov byte [eax + 0x18], cl
mov byte [eax + 0x19], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 9
push eax
lea eax, [ebp - 0x68]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c35ef
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [ebp - 0x48]
mov ecx, edi
add eax, 0x23
push eax
mov eax, dword [ebp - 0x58]
cwde
add eax, esi
push eax
push esi
call fcn.0045d060
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4c3649
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c363f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c55e4
push ecx
push edx
call fcn.005aa4e8
add esp, 8
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xc2]
mov edx, dword [ebp - 0x48]
cmp ecx, eax
jl 0x4c36af
lea eax, [esi + 0xf0]
mov esi, dword [ebp + 0xc]
cmp ecx, eax
jg 0x4c36b2
cmp esi, dword [ebp - 0x60]
jl 0x4c36b2
lea eax, [edx + 0x188]
cmp esi, eax
jg 0x4c36b2
push 0
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x13
push dword [ebp - 0x60]
push dword [ebp - 0x6c]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER8
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
mov dword [ebp - 4], 0xa
jmp 0x4c3719
mov esi, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x5c]
jl 0x4c3762
mov eax, dword [ebp - 0x50]
add eax, 0x122
cmp ecx, eax
jg 0x4c3762
lea ecx, [edx + 0x154]
cmp esi, ecx
jl 0x4c3762
lea eax, [edx + 0x188]
cmp esi, eax
jg 0x4c3762
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x12
push ecx
push dword [ebp - 0x5c]
mov ecx, dword [edi + 0x14aa2c]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER9
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
mov dword [ebp - 4], 0xb
lea eax, [ebp - 0x2c]
mov ecx, 0x5fd3c4
push eax
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c372f
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x23]
mov ecx, edi
push eax
mov eax, dword [ebp + 8]
add eax, 0x14
push eax
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
movzx eax, byte [edi + 0x189654]
mov ecx, edi
push eax
push 0
push 0x15
push dword [ebp - 0x48]
push dword [ebp - 0x50]
push 0x48
call fcn.0043d1d0
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp + 8]
lea eax, [ecx + 0xf]
cmp edx, eax
jl 0x4c5082
lea eax, [ecx + 0x127]
cmp edx, eax
jg 0x4c5082
mov ecx, dword [ebp - 0x48]
lea eax, [ecx + 0x3c]
cmp esi, eax
jl 0x4c37c1
lea eax, [ecx + 0x139]
cmp esi, eax
jg 0x4c37c1
push 1
push 0
push 0x2a
push esi
push edx
push 0x48
mov ecx, edi
call fcn.0043d1d0
mov esi, dword [ebp - 0x50]
jmp case.default.0x4c2f0a
mov eax, dword [ebp - 0x48]
lea ecx, [esi + 0x46]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
add eax, 0x154
mov dword [ebp - 0x6c], ecx
push 1
push eax
push ecx
mov ecx, dword [edi + 0x14aa2c]
mov dword [ebp - 0x5c], eax
call fcn.0057e2f0
push 0
mov ecx, dword [edi + 0x14aa2c]
lea eax, [esi + 0xc2]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
mov dword [ebp - 0x60], eax
push 0x14
push dword [ebp - 0x5c]
push eax
call fcn.0057e2f0
push 0
mov ecx, dword [edi + 0x14aa2c]
lea eax, [esi + 0xf4]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
mov dword [ebp - 0x64], eax
push 4
push dword [ebp - 0x5c]
push eax
call fcn.0057e2f0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_COMMANDER10]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x1a
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d4af4]
movq qword [eax + 0x10], xmm0
mov cx, word [0x5d4afc]
mov word [eax + 0x18], cx
mov byte [eax + 0x1a], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x74]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c38cc
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [ebp - 0x48]
mov ecx, edi
add eax, 0x23
push eax
mov eax, dword [ebp - 0x58]
cwde
add eax, esi
push eax
push esi
call fcn.0045d060
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4c3926
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c391c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c55e9
push ecx
push edx
call fcn.005aa4e8
add esp, 8
mov edx, dword [ebp + 8]
lea eax, [esi + 0x46]
cmp edx, eax
jl 0x4c3988
lea eax, [esi + 0x74]
mov esi, dword [ebp + 0xc]
cmp edx, eax
jg 0x4c398b
mov ecx, dword [ebp - 0x5c]
cmp esi, ecx
jl 0x4c398b
mov eax, dword [ebp - 0x48]
add eax, 0x188
cmp esi, eax
jg 0x4c398b
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0xf
push ecx
push dword [ebp - 0x6c]
mov ecx, dword [edi + 0x14aa2c]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER11
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
mov dword [ebp - 4], 0xd
jmp 0x4c3a55
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x60]
jl 0x4c39e8
lea eax, [ecx + 0xf0]
cmp edx, eax
jg 0x4c39e8
cmp esi, dword [ebp - 0x5c]
jl 0x4c39e8
mov eax, dword [ebp - 0x48]
add eax, 0x188
cmp esi, eax
jg 0x4c39e8
push 0
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x13
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER12
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
mov dword [ebp - 4], 0xe
jmp 0x4c3a55
lea eax, [ecx + 0xf4]
cmp edx, eax
jl 0x4c34f5
lea eax, [ecx + 0x122]
cmp edx, eax
jg 0x4c34f5
mov ecx, dword [ebp - 0x5c]
cmp esi, ecx
jl 0x4c34f5
mov eax, dword [ebp - 0x48]
add eax, 0x188
cmp esi, eax
jg 0x4c34f5
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x12
push ecx
push dword [ebp - 0x64]
mov ecx, dword [edi + 0x14aa2c]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER13
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
mov dword [ebp - 4], 0xf
lea eax, [ebp - 0x2c]
mov ecx, 0x5fd3c4
push eax
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c3a6b
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x23]
mov ecx, edi
push eax
mov eax, dword [ebp + 8]
add eax, 0x14
push eax
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
jmp 0x4c34f5
cmp byte [edi + 0x18958e], 1
jne 0x4c3baa
mov al, byte [edi + 0x18958d]
cmp al, 1
jne 0x4c3afe
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x50]
add esi, 0xdc
mov ecx, dword [edi + 0x14aa2c]
add eax, 0x14
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 6
push esi
push eax
call fcn.0057e2f0
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 5
jmp 0x4c3b48
test al, al
jne 0x4c3baa
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x50]
add esi, 0xdc
mov ecx, dword [edi + 0x14aa2c]
add eax, 0x14
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 9
push esi
push eax
call fcn.0057e2f0
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 8
mov eax, dword [ebp - 0x50]
mov ecx, dword [edi + 0x14aa2c]
add eax, 0x46
push esi
push eax
call fcn.0057e2f0
mov eax, dword [ebp - 0x50]
mov ecx, dword [edi + 0x14aa2c]
add eax, 0x78
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 7
push esi
push eax
call fcn.0057e2f0
push 0
push 0
mov ecx, dword [edi + 0x14aa2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x23
push esi
mov esi, dword [ebp - 0x50]
lea eax, [esi + 0xaa]
push eax
call fcn.0057e2f0
mov eax, dword [ebp - 0x48]
lea ecx, [esi + 0xc2]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
add eax, 0x142
mov dword [ebp - 0x60], ecx
push 0x14
push eax
push ecx
mov ecx, dword [edi + 0x14aa2c]
mov dword [ebp - 0x5c], eax
call fcn.0057e2f0
push 0
mov ecx, dword [edi + 0x14aa2c]
lea eax, [esi + 0xf4]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
mov dword [ebp - 0x6c], eax
push 4
push dword [ebp - 0x5c]
push eax
call fcn.0057e2f0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_COMMANDER14]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x1a
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d4b64]
movq qword [eax + 0x10], xmm0
mov cx, word [0x5d4b6c]
mov word [eax + 0x18], cx
mov byte [eax + 0x1a], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x74]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c3c85
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [ebp - 0x48]
mov ecx, edi
add eax, 0x23
push eax
mov eax, dword [ebp - 0x58]
cwde
add eax, esi
push eax
push esi
call fcn.0045d060
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4c3cdf
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c3cd5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c55ee
push ecx
push edx
call fcn.005aa4e8
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_COMMANDER15]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x1a
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d4b80]
movq qword [eax + 0x10], xmm0
mov cx, word [0x5d4b88]
mov word [eax + 0x18], cx
mov byte [eax + 0x1a], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x74]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c3d5b
mov eax, dword [eax]
push dword [edi + 0x18c0b4]
lea ecx, [edi + 0x18d57f]
push eax
push str._s__d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x18]
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4c3db2
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c3da8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c55f3
push ecx
push edx
call fcn.005aa4e8
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [edi + 0x18d57f]
push eax
mov eax, dword [ebp - 0x48]
lea ecx, [esi + 0x143]
add eax, 0xbe
push eax
push ecx
push esi
mov ecx, edi
call fcn.0045d060
cmp byte [edi + 0x18958e], 1
jne 0x4c499e
mov al, byte [edi + 0x18958d]
cmp al, 1
jne 0x4c43a5
mov edx, dword [ebp + 8]
lea eax, [esi + 0x14]
mov dword [ebp - 0x64], eax
cmp edx, eax
jl 0x4c3f0a
lea eax, [esi + 0x42]
mov esi, dword [ebp + 0xc]
cmp edx, eax
jg 0x4c3f0d
mov eax, dword [ebp - 0x48]
lea ecx, [eax + 0xdc]
cmp esi, ecx
jl 0x4c3f0d
add eax, 0x10e
cmp esi, eax
jg 0x4c3f0d
cmp dword [edi + 0x18c0b4], 0xbb8
jl 0x4c3e60
mov eax, dword [ebp - 0x64]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0xb
push ecx
mov ecx, dword [edi + 0x14aa2c]
push eax
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER16
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x12
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
mov ecx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x4c3e8c
mov ecx, dword [ecx]
mov edx, dword [ebp + 8]
lea eax, [esi + 0x23]
push 0
push 0xff
push 0xff
push 0xff
push ecx
add edx, 0x14
mov ecx, edi
push eax
push edx
mov dword [ebp - 0x64], edx
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_COMMANDER17
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x13
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c3eec
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x32]
push eax
push dword [ebp - 0x64]
jmp 0x4c4985
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x50]
lea eax, [ecx + 0x46]
mov dword [ebp - 0x58], eax
cmp edx, eax
jl 0x4c4027
lea eax, [ecx + 0x73]
cmp edx, eax
jg 0x4c4027
mov eax, dword [ebp - 0x48]
lea ecx, [eax + 0xdc]
mov dword [ebp - 0x64], ecx
cmp esi, ecx
mov ecx, dword [ebp - 0x50]
jl 0x4c4027
add eax, 0x10e
cmp esi, eax
jg 0x4c4027
cmp dword [edi + 0x18c0b4], 0x7d0
jl 0x4c3f7d
push 0
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0xa
push dword [ebp - 0x64]
push dword [ebp - 0x58]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER18
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x14
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
mov ecx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x4c3fa9
mov ecx, dword [ecx]
mov edx, dword [ebp + 8]
lea eax, [esi + 0x23]
push 0
push 0xff
push 0xff
push 0xff
push ecx
add edx, 0x14
mov ecx, edi
push eax
push edx
mov dword [ebp - 0x64], edx
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_COMMANDER19
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x15
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c4009
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x32]
push eax
push dword [ebp - 0x64]
jmp 0x4c4985
lea eax, [ecx + 0x78]
mov dword [ebp - 0x58], eax
cmp edx, eax
jl 0x4c4141
lea eax, [ecx + 0xa5]
cmp edx, eax
jg 0x4c4141
mov eax, dword [ebp - 0x48]
lea ecx, [eax + 0xdc]
mov dword [ebp - 0x64], ecx
cmp esi, ecx
mov ecx, dword [ebp - 0x50]
jl 0x4c4141
add eax, 0x10e
cmp esi, eax
jg 0x4c4141
cmp dword [edi + 0x18c0b4], 0x3e8
jl 0x4c4097
push 0
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0xc
push dword [ebp - 0x64]
push dword [ebp - 0x58]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER20
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x16
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
mov ecx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x4c40c3
mov ecx, dword [ecx]
mov edx, dword [ebp + 8]
lea eax, [esi + 0x23]
push 0
push 0xff
push 0xff
push 0xff
push ecx
add edx, 0x14
mov ecx, edi
push eax
push edx
mov dword [ebp - 0x64], edx
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_COMMANDER21
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x17
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c4123
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x32]
push eax
push dword [ebp - 0x64]
jmp 0x4c4985
lea eax, [ecx + 0xaa]
mov dword [ebp - 0x58], eax
cmp edx, eax
jl 0x4c425e
lea eax, [ecx + 0xd7]
cmp edx, eax
jg 0x4c425e
mov eax, dword [ebp - 0x48]
lea ecx, [eax + 0xdc]
mov dword [ebp - 0x64], ecx
cmp esi, ecx
mov ecx, dword [ebp - 0x50]
jl 0x4c425e
add eax, 0x10e
cmp esi, eax
jg 0x4c425e
cmp dword [edi + 0x18c0b4], 0x1388
jl 0x4c41b4
push 0
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x1d
push dword [ebp - 0x64]
push dword [ebp - 0x58]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER22
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x18
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
mov ecx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x4c41e0
mov ecx, dword [ecx]
mov edx, dword [ebp + 8]
lea eax, [esi + 0x23]
push 0
push 0xff
push 0xff
push 0xff
push ecx
add edx, 0x14
mov ecx, edi
push eax
push edx
mov dword [ebp - 0x64], edx
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_COMMANDER23
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x19
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c4240
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x32]
push eax
push dword [ebp - 0x64]
jmp 0x4c4985
lea eax, [ecx + 0x14]
cmp edx, eax
jl 0x4c42d1
lea eax, [ecx + 0x17c]
cmp edx, eax
jg 0x4c42d1
mov eax, dword [ebp - 0x48]
add eax, 0x8c
cmp esi, eax
jle 0x4c42a0
mov eax, dword [ebp - 0x48]
add eax, 0xa0
cmp esi, eax
jge 0x4c42a0
push str.DRAW_DIALOGBOX_COMMANDER24
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
mov dword [ebp - 4], 0x1a
jmp 0x4c4952
mov eax, dword [ebp - 0x48]
add eax, 0xa0
cmp esi, eax
jle 0x4c42d1
mov eax, dword [ebp - 0x48]
add eax, 0xaf
cmp esi, eax
jge 0x4c42d1
push str.DRAW_DIALOGBOX_COMMANDER25
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
mov dword [ebp - 4], 0x1b
jmp 0x4c4952
lea eax, [ecx + 0xc2]
cmp edx, eax
jl 0x4c4333
lea eax, [ecx + 0xf0]
cmp edx, eax
jg 0x4c4333
cmp esi, dword [ebp - 0x5c]
jl 0x4c4333
mov eax, dword [ebp - 0x48]
add eax, 0x176
cmp esi, eax
jg 0x4c4333
push 0
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x13
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER26
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
mov dword [ebp - 4], 0x1c
jmp 0x4c4952
lea eax, [ecx + 0xf4]
cmp edx, eax
jl 0x4c499b
lea eax, [ecx + 0x122]
cmp edx, eax
jg 0x4c499b
mov ecx, dword [ebp - 0x5c]
cmp esi, ecx
jl 0x4c499b
mov eax, dword [ebp - 0x48]
add eax, 0x176
cmp esi, eax
jg 0x4c499b
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x12
push ecx
push dword [ebp - 0x6c]
mov ecx, dword [edi + 0x14aa2c]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER27
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
mov dword [ebp - 4], 0x1d
jmp 0x4c4952
test al, al
jne 0x4c499e
mov edx, dword [ebp + 8]
lea eax, [esi + 0x14]
mov dword [ebp - 0x64], eax
cmp edx, eax
jl 0x4c44c3
lea eax, [esi + 0x42]
mov esi, dword [ebp + 0xc]
cmp edx, eax
jg 0x4c44c6
mov eax, dword [ebp - 0x48]
lea ecx, [eax + 0xdc]
cmp esi, ecx
jl 0x4c44c6
add eax, 0x10e
cmp esi, eax
jg 0x4c44c6
cmp dword [edi + 0x18c0b4], 0xbb8
jl 0x4c4419
mov eax, dword [ebp - 0x64]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0xe
push ecx
mov ecx, dword [edi + 0x14aa2c]
push eax
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER28
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x1e
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
mov ecx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x4c4445
mov ecx, dword [ecx]
mov edx, dword [ebp + 8]
lea eax, [esi + 0x23]
push 0
push 0xff
push 0xff
push 0xff
push ecx
add edx, 0x14
mov ecx, edi
push eax
push edx
mov dword [ebp - 0x64], edx
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_COMMANDER29
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x1f
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c44a5
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x32]
push eax
push dword [ebp - 0x64]
jmp 0x4c4985
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x50]
lea eax, [ecx + 0x46]
mov dword [ebp - 0x58], eax
cmp edx, eax
jl 0x4c45e0
lea eax, [ecx + 0x73]
cmp edx, eax
jg 0x4c45e0
mov eax, dword [ebp - 0x48]
lea ecx, [eax + 0xdc]
mov dword [ebp - 0x64], ecx
cmp esi, ecx
mov ecx, dword [ebp - 0x50]
jl 0x4c45e0
add eax, 0x10e
cmp esi, eax
jg 0x4c45e0
cmp dword [edi + 0x18c0b4], 0x7d0
jl 0x4c4536
push 0
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0xd
push dword [ebp - 0x64]
push dword [ebp - 0x58]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER30
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x20
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
mov ecx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x4c4562
mov ecx, dword [ecx]
mov edx, dword [ebp + 8]
lea eax, [esi + 0x23]
push 0
push 0xff
push 0xff
push 0xff
push ecx
add edx, 0x14
mov ecx, edi
push eax
push edx
mov dword [ebp - 0x64], edx
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_COMMANDER31
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x21
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c45c2
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x32]
push eax
push dword [ebp - 0x64]
jmp 0x4c4985
lea eax, [ecx + 0x78]
mov dword [ebp - 0x58], eax
cmp edx, eax
jl 0x4c46fa
lea eax, [ecx + 0xa5]
cmp edx, eax
jg 0x4c46fa
mov eax, dword [ebp - 0x48]
lea ecx, [eax + 0xdc]
mov dword [ebp - 0x64], ecx
cmp esi, ecx
mov ecx, dword [ebp - 0x50]
jl 0x4c46fa
add eax, 0x10e
cmp esi, eax
jg 0x4c46fa
cmp dword [edi + 0x18c0b4], 0x3e8
jl 0x4c4650
push 0
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0xc
push dword [ebp - 0x64]
push dword [ebp - 0x58]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER32
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x22
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
mov ecx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x4c467c
mov ecx, dword [ecx]
mov edx, dword [ebp + 8]
lea eax, [esi + 0x23]
push 0
push 0xff
push 0xff
push 0xff
push ecx
add edx, 0x14
mov ecx, edi
push eax
push edx
mov dword [ebp - 0x64], edx
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_COMMANDER33
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x23
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c46dc
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x32]
push eax
push dword [ebp - 0x64]
jmp 0x4c4985
lea eax, [ecx + 0xaa]
mov dword [ebp - 0x58], eax
cmp edx, eax
jl 0x4c4817
lea eax, [ecx + 0xd7]
cmp edx, eax
jg 0x4c4817
mov eax, dword [ebp - 0x48]
lea ecx, [eax + 0xdc]
mov dword [ebp - 0x64], ecx
cmp esi, ecx
mov ecx, dword [ebp - 0x50]
jl 0x4c4817
add eax, 0x10e
cmp esi, eax
jg 0x4c4817
cmp dword [edi + 0x18c0b4], 0x1388
jl 0x4c476d
push 0
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x1d
push dword [ebp - 0x64]
push dword [ebp - 0x58]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER34
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x24
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
mov ecx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x4c4799
mov ecx, dword [ecx]
mov edx, dword [ebp + 8]
lea eax, [esi + 0x23]
push 0
push 0xff
push 0xff
push 0xff
push ecx
add edx, 0x14
mov ecx, edi
push eax
push edx
mov dword [ebp - 0x64], edx
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_COMMANDER35
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x25
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c47f9
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x32]
push eax
push dword [ebp - 0x64]
jmp 0x4c4985
lea eax, [ecx + 0x14]
cmp edx, eax
jl 0x4c488a
lea eax, [ecx + 0x17c]
cmp edx, eax
jg 0x4c488a
mov eax, dword [ebp - 0x48]
add eax, 0x8c
cmp esi, eax
jle 0x4c4859
mov eax, dword [ebp - 0x48]
add eax, 0xa0
cmp esi, eax
jge 0x4c4859
push str.DRAW_DIALOGBOX_COMMANDER36
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
mov dword [ebp - 4], 0x26
jmp 0x4c4952
mov eax, dword [ebp - 0x48]
add eax, 0xa0
cmp esi, eax
jle 0x4c488a
mov eax, dword [ebp - 0x48]
add eax, 0xaf
cmp esi, eax
jge 0x4c488a
push str.DRAW_DIALOGBOX_COMMANDER37
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
mov dword [ebp - 4], 0x27
jmp 0x4c4952
lea eax, [ecx + 0xc2]
cmp edx, eax
jl 0x4c48e9
lea eax, [ecx + 0xf0]
cmp edx, eax
jg 0x4c48e9
cmp esi, dword [ebp - 0x5c]
jl 0x4c48e9
mov eax, dword [ebp - 0x48]
add eax, 0x176
cmp esi, eax
jg 0x4c48e9
push 0
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x13
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER38
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
mov dword [ebp - 4], 0x28
jmp 0x4c4952
lea eax, [ecx + 0xf4]
cmp edx, eax
jl 0x4c499b
lea eax, [ecx + 0x122]
cmp edx, eax
jg 0x4c499b
mov ecx, dword [ebp - 0x5c]
cmp esi, ecx
jl 0x4c499b
mov eax, dword [ebp - 0x48]
add eax, 0x176
cmp esi, eax
jg 0x4c499b
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x12
push ecx
push dword [ebp - 0x6c]
mov ecx, dword [edi + 0x14aa2c]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER39
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
mov dword [ebp - 4], 0x29
lea eax, [ebp - 0x2c]
mov ecx, 0x5fd3c4
push eax
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c4968
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x23]
push eax
mov eax, dword [ebp + 8]
add eax, 0x14
push eax
mov ecx, edi
call fcn.0045d320
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
mov esi, dword [ebp - 0x50]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_COMMANDER40]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x1a
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d4e44]
movq qword [eax + 0x10], xmm0
mov cx, word [0x5d4e4c]
mov word [eax + 0x18], cx
mov byte [eax + 0x1a], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0x74]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c4a1a
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [ebp - 0x48]
mov ecx, edi
add eax, 0x50
push eax
lea eax, [esi + 0x143]
push eax
push esi
call fcn.0045d060
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_COMMANDER41]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x1a
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d4e60]
movq qword [eax + 0x10], xmm0
mov cx, word [0x5d4e68]
mov word [eax + 0x18], cx
mov byte [eax + 0x1a], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x2b
push eax
lea eax, [ebp - 0x74]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c4ac4
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [ebp - 0x48]
mov ecx, edi
add eax, 0x5f
push eax
lea eax, [esi + 0x143]
push eax
push esi
call fcn.0045d060
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_COMMANDER42]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x1a
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d4e7c]
movq qword [eax + 0x10], xmm0
mov cx, word [0x5d4e84]
mov word [eax + 0x18], cx
mov byte [eax + 0x1a], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x2c
push eax
lea eax, [ebp - 0x68]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c4b6e
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [ebp - 0x48]
mov ecx, edi
add eax, 0x6e
push eax
lea eax, [esi + 0x143]
push eax
push esi
call fcn.0045d060
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x4c4bc8
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c4bbe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c55f8
push ecx
push edx
call fcn.005aa4e8
add esp, 8
mov eax, dword [edi + 0x143268]
sub eax, 0
je 0x4c4ca2
sub eax, 1
jne case.default.0x4c2f0a
push str.DRAW_DIALOGBOX_COMMANDER43
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x2f
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c4c0a
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
push eax
mov eax, dword [ebp - 0x48]
mov ecx, edi
add eax, 0x8c
push eax
lea eax, [esi + 0x143]
push eax
push esi
call fcn.0045d060
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push str.DRAW_DIALOGBOX_COMMANDER44
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x30
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c4c64
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
mov eax, dword [ebp - 0x48]
mov ecx, edi
add eax, 0xa0
push eax
lea eax, [esi + 0x143]
push eax
push esi
call fcn.0045d060
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
jmp case.default.0x4c2f0a
push str.DRAW_DIALOGBOX_COMMANDER43
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x2d
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c4ccc
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
mov eax, dword [ebp - 0x48]
mov ecx, edi
add eax, 0x8c
push eax
lea eax, [esi + 0x143]
push eax
push esi
call fcn.0045d060
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_COMMANDER44]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x1a
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d4eb4]
movq qword [eax + 0x10], xmm0
mov cx, word [0x5d4ebc]
mov word [eax + 0x18], cx
mov byte [eax + 0x1a], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x2e
push eax
lea eax, [ebp - 0x74]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c4d81
mov eax, dword [eax]
push 0
push 0x32
push 0
push 4
push eax
mov eax, dword [ebp - 0x48]
mov ecx, edi
add eax, 0xa0
push eax
lea eax, [esi + 0x143]
push eax
push esi
call fcn.0045d060
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
jmp case.default.0x4c2f0a
mov eax, dword [ebp - 0x48]
lea ecx, [esi + 0xc2]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
add eax, 0x154
mov dword [ebp - 0x64], ecx
push 0x14
push eax
push ecx
mov ecx, dword [edi + 0x14aa2c]
mov dword [ebp - 0x60], eax
call fcn.0057e2f0
push 0
mov ecx, dword [edi + 0x14aa2c]
lea eax, [esi + 0xf4]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
mov dword [ebp - 0x6c], eax
push 4
push dword [ebp - 0x60]
push eax
call fcn.0057e2f0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0x20
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
call fcn.005aa520
movups xmm0, xmmword [str.DRAW_DIALOGBOX_COMMANDER47]
mov dword [ebp - 0x2c], eax
add esp, 4
mov dword [ebp - 0x1c], 0x1a
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x5d4ed0]
movq qword [eax + 0x10], xmm0
mov cx, word [0x5d4ed8]
mov word [eax + 0x18], cx
mov byte [eax + 0x1a], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x31
push eax
lea eax, [ebp - 0x74]
mov ecx, 0x5fd3c4
push eax
call fcn.0040e380
mov eax, dword [eax]
add eax, 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x4c4e91
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [ebp - 0x48]
mov ecx, edi
add eax, 0x23
push eax
mov eax, dword [ebp - 0x58]
cwde
add eax, esi
push eax
push esi
call fcn.0045d060
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xc2]
mov edx, dword [ebp - 0x48]
cmp ecx, eax
jl 0x4c4f71
lea eax, [esi + 0xf0]
mov esi, dword [ebp + 0xc]
cmp ecx, eax
jg 0x4c4f74
cmp esi, dword [ebp - 0x60]
jl 0x4c4f74
lea eax, [edx + 0x188]
cmp esi, eax
jg 0x4c4f74
push 0
mov ecx, dword [edi + 0x14aa2c]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x13
push dword [ebp - 0x60]
push dword [ebp - 0x64]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER48
lea ecx, [ebp - 0x2c]
call fcn.0040f9f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0x32
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c4f45
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x23]
mov ecx, edi
push eax
mov eax, dword [ebp + 8]
add eax, 0x14
push eax
call fcn.0045d320
lea ecx, [ebp - 0x2c]
jmp 0x4c5018
mov esi, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x6c]
jl 0x4c5024
mov eax, dword [ebp - 0x50]
add eax, 0x122
cmp ecx, eax
jg 0x4c5024
lea ecx, [edx + 0x154]
cmp esi, ecx
jl 0x4c5024
lea eax, [edx + 0x188]
cmp esi, eax
jg 0x4c5024
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push dword [ebp - 0x54]
push 0x12
push ecx
push dword [ebp - 0x6c]
mov ecx, dword [edi + 0x14aa2c]
call fcn.0057e2f0
push str.DRAW_DIALOGBOX_COMMANDER49
lea ecx, [ebp - 0x44]
call fcn.0040f9f0
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 0x33
push eax
mov ecx, 0x5fd3c4
call fcn.00411e80
cmp dword [eax + 0x14], 0xf
jbe 0x4c4ff1
mov eax, dword [eax]
push 0
push 0xff
push 0xff
push 0xff
push eax
lea eax, [esi + 0x23]
mov ecx, edi
push eax
mov eax, dword [ebp + 8]
add eax, 0x14
push eax
call fcn.0045d320
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xffffffff
call fcn.00411640
push 0
push 0
push 0x15
push dword [ebp - 0x48]
mov ecx, edi
push dword [ebp - 0x50]
push 0x48
call fcn.0043d1d0
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp + 8]
lea eax, [ecx + 0xf]
cmp edx, eax
jl 0x4c5082
lea eax, [ecx + 0x127]
cmp edx, eax
jg 0x4c5082
mov ecx, dword [ebp - 0x48]
lea eax, [ecx + 0x3c]
cmp esi, eax
jl 0x4c37c1
lea eax, [ecx + 0x139]
cmp esi, eax
jg 0x4c37c1
push 1
push 0
push 0x29
push esi
push edx
push 0x48
mov ecx, edi
call fcn.0043d1d0
mov esi, dword [ebp - 0x50]
jmp case.default.0x4c2f0a
mov esi, ecx
movsx eax, word [edi + 0x1433c8]
movsd xmm2, qword [0x5cd5a0]
cmp eax, 4
ja case.0x4c509c.3
jmp dword [eax*4 + 0x4c5614]
lea edx, [edi + 0x18dacf]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], str.aresden
mov eax, edx
nop dword [eax]
mov esi, dword [ebp - 0x58]
mov cl, byte [eax]
mov byte [ebp - 0x49], cl
cmp cl, byte [esi]
mov esi, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x48]
jne 0x4c5103
cmp byte [ebp - 0x49], 0
je 0x4c50ff
mov cl, byte [eax + 1]
mov byte [ebp - 0x49], cl
mov ecx, dword [ebp - 0x58]
mov dl, byte [ebp - 0x49]
cmp dl, byte [ecx + 1]
lea edx, [edi + 0x18dacf]
mov ecx, dword [ebp - 0x48]
jne 0x4c5103
add dword [ebp - 0x58], 2
add eax, 2
cmp byte [ebp - 0x49], 0
jne 0x4c50c0
xor eax, eax
jmp 0x4c5108
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4c5118
mov dword [ebp - 0x5c], 0xfa
jmp 0x4c51cb
mov dword [ebp - 0x58], str.elvine
mov eax, edx
mov esi, dword [ebp - 0x58]
mov cl, byte [eax]
mov byte [ebp - 0x49], cl
cmp cl, byte [esi]
mov esi, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x48]
jne 0x4c5164
cmp byte [ebp - 0x49], 0
je 0x4c5160
mov cl, byte [eax + 1]
mov byte [ebp - 0x49], cl
mov ecx, dword [ebp - 0x58]
mov dl, byte [ebp - 0x49]
cmp dl, byte [ecx + 1]
lea edx, [edi + 0x18dacf]
mov ecx, dword [ebp - 0x48]
jne 0x4c5164
add dword [ebp - 0x58], 2
add eax, 2
cmp byte [ebp - 0x49], 0
jne 0x4c5121
xor eax, eax
jmp 0x4c5169
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4c5176
mov dword [ebp - 0x5c], 0xfa
jmp 0x4c51cb
mov eax, str.middleland
nop dword [eax + eax]
mov cl, byte [edx]
cmp cl, byte [eax]
mov byte [ebp - 0x49], cl
mov ecx, dword [ebp - 0x48]
jne 0x4c51b0
cmp byte [ebp - 0x49], 0
je 0x4c51ac
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
mov byte [ebp - 0x49], cl
mov ecx, dword [ebp - 0x48]
jne 0x4c51b0
add edx, 2
add eax, 2
cmp byte [ebp - 0x49], 0
jne 0x4c5180
xor eax, eax
jmp 0x4c51b5
sbb eax, eax
or eax, 1
test eax, eax
jne case.0x4c509c.3
mov dword [ebp - 0x5c], 0x118
mov dword [ebp - 0x60], 0x20c
lea edx, [edi + 0x147f5c]
mov dword [ebp - 0x6c], 0x12c
mov dword [ebp - 0x50], edx
nop dword [eax + eax]
mov al, byte [edx + 4]
mov byte [ebp - 0x49], al
test al, al
je case.0x4c524f.40
mov eax, dword [ebp - 0x5c]
movzx eax, ax
movd xmm2, eax
mov eax, dword [ebp - 0x60]
movzx eax, ax
cvtdq2pd xmm2, xmm2
movd xmm1, eax
movsx eax, word [edx]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm2
divsd xmm0, xmm1
cvttsd2si eax, xmm0
mov dword [ebp - 0x54], eax
movsx eax, word [edx + 2]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm2
divsd xmm0, xmm1
cvttsd2si eax, xmm0
mov dword [ebp - 0x58], eax
movsx eax, byte [ebp - 0x49]
add eax, 0xffffffdc
cmp eax, 6
ja case.0x4c524f.40
jmp dword [eax*4 + 0x4c5628]
mov al, byte [edx + 5]
mov edx, esi
mov byte [ebp - 0x49], al
cmp al, 1
je 0x4c526e
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x54], eax
xor eax, eax
cmp byte [ebp - 0x49], 1
push 1
sete al
push 0
lea eax, [eax*2 + 0x25]
push eax
mov eax, dword [ebp - 0x58]
add eax, 0x3c
add eax, ecx
push eax
mov eax, dword [ebp - 0x54]
add eax, 0xf
add eax, edx
jmp 0x4c52c4
xor eax, eax
cmp byte [edx + 5], 1
push 1
sete al
push 0
lea eax, [eax*2 + 0x24]
push eax
jmp 0x4c52b3
push 0
push 0
push 0x28
mov eax, dword [ebp - 0x58]
add eax, 0x3c
add eax, ecx
push eax
mov eax, dword [ebp - 0x54]
add eax, 0xf
add eax, esi
push eax
push 0x48
mov ecx, edi
call fcn.0043d1d0
mov edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x48]
add edx, 6
sub dword [ebp - 0x6c], 1
mov dword [ebp - 0x50], edx
jne 0x4c51e0
mov ecx, dword [edi + 0x18c0c8]
cmp ecx, 0xffffffff
je 0x4c5355
mov eax, dword [ebp - 0x5c]
movzx eax, ax
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mov edx, dword [ebp - 0x48]
add edx, 0x3c
push 1
push 0
push 0x2a
movd xmm2, eax
mov eax, dword [ebp - 0x60]
movzx eax, ax
cvtdq2pd xmm2, xmm2
movd xmm1, eax
mulsd xmm0, xmm2
cvtdq2pd xmm1, xmm1
divsd xmm0, xmm1
cvttsd2si ecx, xmm0
movd xmm0, dword [edi + 0x18c0cc]
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm2
divsd xmm0, xmm1
cvttsd2si eax, xmm0
add eax, edx
push eax
lea eax, [ecx + 0xf]
mov ecx, edi
add eax, esi
push eax
push 0x48
call fcn.0043d1d0
cmp word [edi + 0x1433c8], 2
je 0x4c53d0
mov edx, dword [edi + 0x18c0bc]
cmp edx, 0xffffffff
je 0x4c53d0
mov eax, dword [ebp - 0x5c]
movd xmm0, dword [edi + 0x18c0c0]
movzx eax, ax
cvtdq2pd xmm0, xmm0
mov ecx, dword [ebp - 0x48]
push 1
add ecx, 0x3c
push 0
push 0x29
movd xmm2, eax
mov eax, dword [ebp - 0x60]
movzx eax, ax
cvtdq2pd xmm2, xmm2
movd xmm1, eax
mulsd xmm0, xmm2
cvtdq2pd xmm1, xmm1
divsd xmm0, xmm1
cvttsd2si eax, xmm0
movd xmm0, edx
cvtdq2pd xmm0, xmm0
add eax, ecx
mov ecx, edi
push eax
mulsd xmm0, xmm2
divsd xmm0, xmm1
cvttsd2si eax, xmm0
add eax, 0xf
add eax, esi
push eax
push 0x48
call fcn.0043d1d0
mov ecx, str.middleland
lea eax, [edi + 0x18d8a5]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4c5400
test dl, dl
je 0x4c53fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4c5400
add eax, 2
add ecx, 2
test dl, dl
jne 0x4c53e0
xor eax, eax
jmp 0x4c5405
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4c54a8
mov eax, dword [ebp - 0x5c]
mov ecx, dword [edi + 0x1842ec]
movzx eax, ax
movd xmm2, eax
movsx eax, word [edi + 0x18c130]
cvtdq2pd xmm2, xmm2
movd xmm1, eax
movsx eax, word [ecx + 0x670a3c]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsx eax, word [ecx + 0x670a3e]
mulsd xmm1, xmm2
divsd xmm1, xmm0
movsd xmm0, qword [0x5cd5a0]
cvttsd2si edx, xmm1
movd xmm1, eax
cvtdq2pd xmm1, xmm1
ucomisd xmm1, xmm0
lahf
test ah, 0x44
jp 0x4c546f
movaps xmm1, xmm0
movsx eax, word [edi + 0x18c132]
mov ecx, dword [ebp - 0x48]
push 0
push 0
movd xmm0, eax
add ecx, 0x3c
cvtdq2pd xmm0, xmm0
push 0x2b
mulsd xmm0, xmm2
divsd xmm0, xmm1
cvttsd2si eax, xmm0
add eax, ecx
mov ecx, edi
push eax
lea eax, [edx + 0xf]
add eax, esi
push eax
push 0x48
call fcn.0043d1d0
movsd xmm2, qword [0x5cd5a0]
movsx eax, word [edi + 0x1433c8]
sub eax, 0
je 0x4c54ca
sub eax, 1
je 0x4c54ca
sub eax, 3
jne 0x4c55c2
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xf]
cmp ecx, eax
jl 0x4c55c2
lea eax, [esi + 0x127]
cmp ecx, eax
jg 0x4c55c2
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp + 0xc]
add eax, 0x3c
cmp edx, eax
jl 0x4c55c2
mov eax, dword [ebp - 0x48]
add eax, 0x139
cmp edx, eax
jg 0x4c55c2
mov eax, ecx
sub eax, esi
lea esi, [edi + 0x18d57f]
sub eax, 0xf
movd xmm0, eax
mov eax, edx
cvtdq2pd xmm0, xmm0
sub eax, dword [ebp - 0x48]
mov edx, 0x1e
sub eax, 0x3c
mulsd xmm0, xmm2
divsd xmm0, qword [0x5cd598]
cvttsd2si ecx, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
cmp ecx, edx
cmovl ecx, edx
mulsd xmm0, xmm2
divsd xmm0, qword [0x5cd598]
cvttsd2si eax, xmm0
cmp eax, edx
cmovl eax, edx
mov edx, 0x20c
cmp ecx, edx
cmova ecx, edx
cmp eax, edx
cmova eax, edx
push eax
push ecx
push str._d__d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
movzx eax, word [edi + 0x18c598]
add esp, 0x10
shl ax, 2
mov ecx, edi
movzx eax, ax
push 2
push 0
push eax
movzx eax, word [edi + 0x18c39a]
shl ax, 2
movzx eax, ax
push eax
movzx eax, word [edi + 0x18c19c]
shl ax, 2
movzx eax, ax
push eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff6
push esi
push eax
mov eax, dword [ebp + 8]
add eax, 0xa
push eax
call fcn.0045d920
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005aa550
mov esp, ebp
pop ebp
ret 8
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
call fcn.005ac169
nop dword [eax]
adc dword [edi], ebp
dec esp
add byte [esi], dl
xor eax, 0x37c9004c
dec esp
add byte [ebx - 0x49ffb3c6], ah
dec ebp
dec esp
add byte [ebx - 0x5cffb3b0], ah
push eax
dec esp
add byte [ebx - 0x4fffb3b0], ah
push esp
dec esp
add byte [ebx - 0x69ffb3b0], ah
push edx
dec esp
add byte [esi + 0x56004c52], dl
push edx
dec esp
add byte [esi - 0x2effb3ae], dl
push edx
dec esp
add cl, dl
push edx
dec esp
add byte [ebp - 0x33ffb3ae], ch
int3