Function at 0x436b90
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
mov eax, dword [esp + 0x74]
push ebx
push ebp
push esi
shl eax, 4
push edi
mov byte [esp + 0x17], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x48], eax
nop
mov eax, dword [esp + 0x84]
test eax, eax
jne 0x436c02
mov eax, dword [0x8cc974]
test eax, eax
jle 0x436c02
mov eax, dword [esp + 0x2c]
imul eax, eax, 0x14c
cmp word [eax + 0x8709ec], 0x64
jge 0x436c02
mov ecx, dword [0x86e580]
mov edx, dword [0x86e57c]
mov dword [eax + 0x870a1c], ecx
mov ecx, dword [eax + 0x870a08]
and ecx, 0xfffffeff
mov dword [eax + 0x870a20], edx
mov dword [eax + 0x870a08], ecx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x48]
lea ebp, [eax + ecx]
mov dword [esp + 0x54], ebp
imul ebp, ebp, 0x14c
mov ecx, dword [ebp + 0x870a08]
and ecx, 0xfffff7ff
cmp word [ebp + 0x8709e8], 0xffff
mov dword [ebp + 0x870a08], ecx
mov edx, ecx
je 0x438d2e
cmp word [ebp + 0x8709ea], 0
je 0x438d2e
mov ax, word [ebp + 0x8709ec]
cmp ax, 0x64
jge 0x436c59
mov byte [esp + 0x17], 1
xor edi, edi
cmp ax, 0x64
mov dword [esp + 0x34], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x40], edi
jl 0x436d9f
mov ecx, dword [esp + 0x84]
cmp ecx, edi
jne 0x436cff
mov esi, dword [esp + 0x2c]
mov ebx, dword [0x86e5dc]
mov eax, esi
imul eax, eax, 0x14c
mov ecx, dword [eax + 0x870a5c]
add ebx, 0xfffffc18
cmp ecx, ebx
jle 0x436d9f
add ecx, 0xfffffc18
mov dword [eax + 0x870a1c], ecx
mov ecx, esi
mov esi, dword [eax + 0x870a8c]
and cl, 1
neg cl
sbb ecx, ecx
and ecx, 0x14c
add ecx, 0xffffff5a
add ecx, esi
mov dword [eax + 0x870a20], ecx
cmp dword [0x86e584], edi
je 0x436d9f
test dl, 4
jne 0x436cf3
and edx, 0xfffffffd
mov dword [eax + 0x870a08], edx
and dword [eax + 0x870a08], 0xfffffffb
jmp 0x436d9f
mov esi, dword [0x86e5dc]
mov eax, dword [ebp + 0x870a5c]
add esi, 0x4268
cmp eax, esi
jge 0x436d9f
neg ecx
sbb ecx, ecx
and ecx, 0x7d0
add ecx, 0xfffffc18
add ecx, eax
mov eax, dword [esp + 0x2c]
and al, 1
neg al
mov dword [ebp + 0x870a1c], ecx
mov ecx, dword [ebp + 0x870a8c]
sbb eax, eax
and eax, 0x14c
add eax, 0xffffff5a
add eax, ecx
mov dword [ebp + 0x870a20], eax
cmp dword [0x86e584], edi
je 0x436d70
test dl, 4
jne 0x436d69
and edx, 0xfffffffd
mov dword [ebp + 0x870a08], edx
and dword [ebp + 0x870a08], 0xfffffffb
mov edi, dword [sym.imp.MSVCR71.dll_rand]
lea esi, [ebp + 0x870a2c]
mov ebx, 0xc
cmp dword [esi], 0
jne 0x436d97
call edi
cdq
mov ecx, 0xa
idiv ecx
neg edx
sbb edx, edx
inc edx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x436d81
xor edi, edi
mov esi, dword [0x8cc974]
cmp esi, edi
je 0x436dc2
jle 0x436db2
mov eax, 1
jmp 0x436dba
xor eax, eax
cmp esi, edi
setge al
dec eax
add esi, eax
mov dword [0x8cc974], esi
cmp dword [esp + 0x84], edi
jne 0x436e4a
mov ecx, dword [esp + 0x2c]
imul ecx, ecx, 0x14c
cmp word [ecx + 0x8709ec], 0x64
jge 0x436e4a
movsx eax, word [ecx + 0x8709fa]
movsx edx, word [ecx + 0x8709f8]
sub eax, 9
sub edx, 0xd
jns 0x436df7
neg edx
cmp eax, edi
jge 0x436dfd
neg eax
cmp edx, eax
jle 0x436e06
lea eax, [eax + edx*2]
jmp 0x436e09
lea eax, [edx + eax*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, 1
jge 0x436e4a
mov eax, dword [ecx + 0x870a08]
mov edx, dword [ecx + 0x870a5c]
inc esi
or eax, 0x106
mov dword [ecx + 0x870a08], eax
mov eax, dword [ecx + 0x870a8c]
mov dword [0x8cc974], esi
mov byte [0x8cc981], 1
mov dword [ecx + 0x870a24], edx
mov dword [ecx + 0x870a28], eax
test byte [ebp + 0x870a08], 0x30
jne 0x436e61
cmp dword [0x86e584], edi
je 0x438174
xor edi, edi
mov eax, dword [esp + 0x84]
imul eax, eax, 0x14c0
mov esi, 0x871f4c
mov word [ebp + 0x8709f4], 0x7fff
mov word [ebp + 0x8709f2], 0xffff
mov dword [esp + 0x30], edi
mov dword [esp + 0x3c], 0x871f1c
mov dword [esp + 0x60], eax
sub esi, eax
jmp 0x436ea0
cmp word [esi - 0xa4], 0xffff
je 0x4370ab
cmp word [esi - 0x96], 0
je 0x4370ab
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x84]
mov eax, dword [ebp + 0x870a5c]
mov ebx, dword [esi]
mov edi, dword [esi - 0x30]
push ecx
push edx
mov edx, dword [ebp + 0x870a8c]
push eax
mov eax, ebx
mov ecx, edi
call fcn.004319c0
add esp, 0xc
test eax, eax
jne 0x436ef4
test byte [esi - 0x84], 0x10
je 0x436f6a
mov eax, dword [esp + 0x84]
test eax, eax
jne 0x436f3b
mov ecx, dword [esp + 0x3c]
test byte [ecx - 0x54], 2
jne 0x436f3b
mov al, byte [0x8c9190]
test al, al
jne 0x436f3b
mov byte [0x8c9190], 1
call fcn.004a9310
mov eax, dword [0x8cc960]
test eax, eax
je 0x436f3b
mov eax, dword [esp + 0x3c]
mov edx, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [0x85c128], edx
mov dword [0x85c124], eax
mov ecx, dword [esp + 0x30]
mov ebx, dword [esi - 0x84]
mov eax, dword [esp + 0x34]
mov edi, dword [esi - 0x30]
mov edx, 1
or ebx, 6
shl edx, cl
mov dword [esi - 0x84], ebx
mov ebx, dword [esi]
mov dword [esi - 0x68], edi
or eax, edx
mov dword [esp + 0x34], eax
mov dword [esi - 0x64], ebx
cmp word [esi - 0xa0], 0x64
jge 0x4370ab
mov edx, dword [esi - 0x84]
test dl, 2
je 0x437045
movsx eax, word [ebp + 0x8709e8]
imul eax, eax, 7
mov cl, byte [eax + 0x72741c]
test cl, cl
mov dword [esp + 0x24], eax
je 0x436fbb
mov ecx, dword [esp + 0x30]
mov eax, 1
shl eax, cl
mov ecx, dword [esp + 0x34]
test ecx, eax
jne 0x436fbb
test dh, 1
je 0x437045
mov ecx, dword [ebp + 0x870a8c]
mov eax, dword [ebp + 0x870a5c]
sub ebx, ecx
sub edi, eax
jns 0x436fcf
neg edi
test ebx, ebx
jge 0x436fd5
neg ebx
cmp edi, ebx
lea eax, [ebx + edi*2]
jg 0x436fdf
lea eax, [edi + ebx*2]
cdq
sub eax, edx
mov edi, eax
mov eax, dword [esi - 0x84]
sar edi, 1
test ah, 1
je 0x436ffa
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov edi, eax
mov edx, dword [esp + 0x24]
cmp byte [edx + 0x727419], 5
jl 0x437025
mov ecx, dword [esi - 0x64]
mov eax, dword [esi - 0x68]
call fcn.00431910
cmp eax, 1
jne 0x437025
cmp edi, 0x3e8
jle 0x437025
add edi, 0xbb8
movsx eax, word [ebp + 0x8709f4]
cmp edi, eax
jge 0x4370ab
mov cx, word [esp + 0x30]
mov word [ebp + 0x8709f2], cx
mov word [ebp + 0x8709f4], di
jmp 0x4370ab
mov ecx, dword [esi - 0x68]
test ecx, ecx
je 0x4370ab
mov eax, dword [esi - 0x64]
mov edi, dword [ebp + 0x870a8c]
mov edx, dword [ebp + 0x870a5c]
sub eax, edi
sub ecx, edx
jns 0x437063
neg ecx
test eax, eax
jge 0x437069
neg eax
cmp ecx, eax
jle 0x437072
lea eax, [eax + ecx*2]
jmp 0x437075
lea eax, [ecx + eax*2]
cdq
sub eax, edx
movsx edx, word [ebp + 0x8709f4]
sar eax, 1
add eax, 0x7d0
cmp eax, edx
jge 0x43709d
mov cx, word [esp + 0x30]
mov word [ebp + 0x8709f2], cx
mov word [ebp + 0x8709f4], ax
cmp eax, 0xbb8
jge 0x4370ab
mov dword [esi - 0x68], 0
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x30]
add eax, 0x14c
inc ebx
add esi, 0x14c
cmp eax, 0x8733dc
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], eax
jl 0x436ea0
mov esi, dword [esp + 0x60]
mov edi, 0xffffff
xor ebx, ebx
lea esi, [esi + 0x8709f6]
cmp word [esi - 0xe], 0xffff
je 0x437137
cmp word [esi], 0
je 0x437137
cmp word [esi - 0xa], 0x64
jge 0x437137
cmp ebx, dword [esp + 0x2c]
je 0x437137
mov ecx, dword [ebp + 0x870a8c]
mov eax, dword [esi + 0x96]
mov edx, dword [ebp + 0x870a5c]
sub eax, ecx
mov ecx, dword [esi + 0x66]
sub ecx, edx
jns 0x43711a
neg ecx
test eax, eax
jge 0x437120
neg eax
cmp ecx, eax
jle 0x437129
lea eax, [eax + ecx*2]
jmp 0x43712c
lea eax, [ecx + eax*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, edi
jge 0x437137
mov edi, eax
inc ebx
add esi, 0x14c
cmp ebx, 0x10
jl 0x4370e3
mov eax, dword [esp + 0x84]
test eax, eax
jne 0x437176
mov eax, dword [esp + 0x2c]
imul eax, eax, 0x14c
test byte [eax + 0x870a08], 0x10
je 0x437176
mov edx, dword [0x86e588]
mov cx, word [edx*4 + 0x86e590]
mov word [eax + 0x8709f2], cx
movsx ebx, word [ebp + 0x8709f2]
cmp ebx, 0xffffffff
mov dword [esp + 0x30], ebx
je 0x4371e3
mov esi, dword [esp + 0x48]
mov edx, dword [ebp + 0x870a8c]
mov ecx, dword [ebp + 0x870a5c]
mov eax, ebx
sub eax, esi
imul eax, eax, 0x14c
mov esi, dword [eax + 0x871f4c]
mov edi, dword [eax + 0x871f1c]
sub esi, edx
sub edi, ecx
mov eax, esi
mov ecx, edi
call fcn.004dcb20
test edi, edi
mov dword [esp + 0x44], eax
jge 0x4371c3
neg edi
test esi, esi
jge 0x4371c9
neg esi
cmp edi, esi
lea eax, [esi + edi*2]
jg 0x4371d3
lea eax, [edi + esi*2]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x50], eax
mov word [ebp + 0x8709f4], ax
test byte [ebp + 0x870a08], 0x40
je 0x4372a4
movsx eax, word [ebp + 0x870a00]
mov edx, dword [esp + 0x84]
mov edi, 1
sub edi, edx
movsx edx, word [ebp + 0x8709fa]
shl eax, 2
mov ecx, dword [eax + 0x727350]
mov esi, dword [eax + 0x7272f0]
add edx, ecx
movsx ecx, word [ebp + 0x8709f8]
push edx
add ecx, esi
push ecx
call fcn.00431db0
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
mov dword [esp + 0x30], ebx
je 0x4372a4
mov esi, dword [esp + 0x48]
mov edi, dword [ebp + 0x870a5c]
mov ecx, ebx
sub ecx, esi
mov esi, dword [ebp + 0x870a8c]
imul ecx, ecx, 0x14c
mov eax, dword [ecx + 0x871f4c]
mov edx, dword [ecx + 0x871f1c]
sub eax, esi
sub edx, edi
jns 0x437269
neg edx
test eax, eax
jge 0x43726f
neg eax
cmp edx, eax
jle 0x437278
lea eax, [eax + edx*2]
jmp 0x43727b
lea eax, [edx + eax*2]
cdq
sub eax, edx
sar eax, 1
mov word [ebp + 0x8709f4], ax
mov dword [esp + 0x50], eax
mov eax, dword [ecx + 0x871f4c]
mov ecx, dword [ecx + 0x871f1c]
sub eax, esi
sub ecx, edi
call fcn.004dcb20
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4372e6
cmp ebx, 0xffffffff
jne 0x4372ef
test byte [ebp + 0x870a08], 0x30
je 0x438174
mov dx, word [ebp + 0x870a04]
mov word [ebp + 0x870a02], 0xff9d
mov word [ebp + 0x870a06], dx
mov word [ebp + 0x870a04], 0
jmp 0x438174
cmp ebx, 0xffffffff
je 0x438174
test byte [ebp + 0x870a08], 0x30
je 0x438174
movsx esi, word [ebp + 0x8709e8]
movsx edi, word [ebp + 0x8709f4]
imul esi, esi, 7
movsx ebx, byte [esi + 0x72741c]
mov eax, ebx
imul eax, eax, 0x3e8
add eax, 0x29a
cmp edi, eax
mov dword [0x8cc964], 1
mov dword [esp + 0x38], 0
jg 0x4373f9
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov edx, 1
shl edx, cl
test eax, edx
je 0x4373f9
mov ecx, dword [esp + 0x44]
mov edx, dword [ebp + 0x870abc]
mov eax, ecx
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x15555555
mov dword [esp + 0x4c], 1
jle 0x43737a
mov dword [ebp + 0x870abc], ecx
test byte [ebp + 0x870a08], 0x10
je 0x437393
sar ecx, 0x1c
inc ecx
sar ecx, 1
and ecx, 7
mov word [ebp + 0x870a00], cx
mov ecx, edi
cmp ecx, 0x3e8
jge 0x4373a4
mov ecx, 0x3e8
jmp 0x4373b1
cmp ecx, 0x270f
jle 0x4373b1
mov ecx, 0x270f
mov eax, ebx
imul eax, eax, 0x7d0
cdq
idiv ecx
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x30]
movsx esi, byte [esi + 0x72741b]
sub ebx, edx
imul ebx, ebx, 0x14c
mov ecx, dword [ebx + 0x871f4c]
imul esi, eax
mov eax, dword [ebx + 0x871f1c]
mov dword [esp + 0x38], esi
call fcn.00431910
cmp eax, 1
je 0x437465
lea ecx, [esi + esi]
mov dword [esp + 0x38], ecx
jmp 0x437465
mov eax, dword [esp + 0x84]
test eax, eax
jne 0x43743f
mov edx, dword [esp + 0x2c]
imul edx, edx, 0x14c
test byte [edx + 0x870a08], 0x10
je 0x43743f
push 0xbf800000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xab
or esi, 0xffffffff
xor eax, eax
or ecx, 0xffffffff
call fcn.00488840
add esp, 0x10
mov dword [0x8cc968], 0
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x48]
mov edx, dword [ebp + 0x870a08]
sub ebx, ecx
imul ebx, ebx, 0x14c
and edx, 0xffffffef
mov dword [ebp + 0x870a08], edx
and dword [ebx + 0x871ec8], 0xfffffff7
mov di, word [ebp + 0x8709f4]
cmp di, 0x3e8
jge 0x43757b
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x4374bb
mov eax, dword [ebp + 0x870a1c]
test eax, eax
jne 0x4374e7
mov eax, dword [esp + 0x84]
test eax, eax
jne 0x4374e7
mov eax, dword [esp + 0x2c]
imul eax, eax, 0x14c
movsx ecx, word [eax + 0x8709e8]
imul ecx, ecx, 7
mov dl, byte [ecx + 0x72741c]
test dl, dl
je 0x4374e7
test byte [eax + 0x870a08], 8
jne 0x4374e7
mov eax, dword [ebp + 0x870a1c]
test eax, eax
jne 0x4374e7
mov ecx, dword [esp + 0x44]
mov edx, dword [ebp + 0x870abc]
mov eax, ecx
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x15555555
jle 0x4374eb
mov dword [ebp + 0x870abc], ecx
jmp 0x4374eb
mov ecx, dword [esp + 0x44]
test byte [ebp + 0x870a08], 0x20
je 0x43757b
mov edx, dword [ebp + 0x870abc]
mov eax, 1
mov dword [esp + 0x40], eax
mov dword [esp + 0x4c], eax
mov eax, ecx
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x15555555
jle 0x437521
mov dword [ebp + 0x870abc], ecx
mov ax, word [ebp + 0x8709e8]
movsx edx, ax
imul edx, edx, 7
movsx esi, byte [edx + 0x727419]
shl esi, 2
cmp di, 0x14d
mov dword [esp + 0x38], esi
jge 0x43754d
mov dword [ebp + 0x870a1c], 0
cmp ax, 3
jne 0x43757b
mov ecx, dword [ebp + 0x870a8c]
mov eax, dword [ebp + 0x870a5c]
call fcn.00431910
cmp eax, 1
jne 0x43757b
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x38], eax
test byte [ebp + 0x870a08], 0x10
je 0x437799
movsx ecx, word [ebp + 0x8709e8]
movsx edx, word [ebp + 0x870a06]
imul ecx, ecx, 7
test edx, edx
movsx esi, byte [ecx + 0x727418]
lea eax, [esi - 1]
jge 0x4375a9
xor edx, edx
cmp edx, eax
jle 0x4375af
mov edx, eax
movsx eax, byte [ecx + 0x72741c]
movsx ecx, byte [ecx + 0x72741b]
mov dword [esp + 0x60], ecx
add edx, esi
lea ecx, [eax + 2]
imul eax, eax, 0x7d0
fild dword [esp + 0x60]
fmul dword [0x715840]
mov dword [esp + 0x60], edx
imul ecx, ecx, 0x7d0
fimul dword [esp + 0x60]
movsx edx, word [ebp + 0x8709ec]
mov dword [esp + 0x60], edx
movsx edx, di
fild dword [esp + 0x60]
sub ecx, edx
fsubr dword [0x71583c]
mov dword [esp + 0x60], ecx
add eax, 0x1f4
fmulp st(1)
fmul dword [0x715838]
fild dword [esp + 0x60]
mov dword [esp + 0x60], eax
fidiv dword [esp + 0x60]
fmulp st(1)
call fcn.005f275c
cmp eax, 3
mov dword [esp + 0x1c], eax
jge 0x437635
mov dword [esp + 0x1c], 3
jmp 0x437642
cmp eax, 0x3c
jle 0x437642
mov dword [esp + 0x1c], 0x3c
mov edx, dword [ebx + 0x871ed8]
lea eax, [esp + 0x28]
push eax
mov eax, dword [ebx + 0x871f4c]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [ebx + 0x871f1c]
push edx
push eax
push ecx
call fcn.004aec50
movsx edx, word [ebx + 0x871eb8]
add esp, 0x14
and edx, 0x8000000f
jns 0x43767d
dec edx
or edx, 0xfffffff0
inc edx
movsx eax, word [ebx + 0x871eba]
shl edx, 4
and eax, 0x8000000f
jns 0x437693
dec eax
or eax, 0xfffffff0
inc eax
cmp byte [edx + eax + 0x873978], 1
mov edi, dword [esp + 0x28]
jne 0x437706
mov eax, dword [esp + 0x1c]
cdq
sub eax, edx
sar eax, 1
push str.Cover:__2
mov esi, 0x8ebf58
mov dword [esp + 0x20], eax
call fcn.004f7660
mov ecx, dword [0x85c164]
mov eax, dword [esp + 0x1c]
add esp, 4
and cl, 0x40
neg cl
push 0
push 0xffffffffffffffff
push 4
push 0xffff4040
mov edx, edi
push 0x4b
sbb ecx, ecx
and ecx, 0xffffffec
add ecx, 0x3c
sub edx, ecx
add edx, 0x10
push edx
push eax
push 0x86bb48
xor eax, eax
mov dword [0x85c11c], 0x4b
call fcn.004b0b40
add esp, 0x20
test byte [ebx + 0x871ec8], 8
je 0x437764
mov ecx, dword [esp + 0x1c]
push ecx
push str.Damage:_NUM_
mov esi, 0x8ebf58
call fcn.004f7660
mov edx, dword [0x85c164]
mov eax, dword [esp + 0x20]
and dl, 0x40
neg dl
push 0
push 0xffffffffffffffff
push 4
push 0xffff4040
push 0x4b
mov dword [0x85c11c], 0x4b
sbb edx, edx
and edx, 0xffffffec
add edx, 0x3c
sub edi, edx
push edi
push eax
push 0x86bb48
xor eax, eax
call fcn.004b0b40
add esp, 0x28
mov edx, dword [ebx + 0x871f1c]
mov ecx, dword [ebp + 0x870a5c]
mov edi, dword [ebx + 0x871f4c]
lea eax, [ecx + edx - 0x3e8]
cdq
sub eax, edx
sar eax, 1
mov dword [0x85c128], eax
mov eax, dword [ebp + 0x870a8c]
add eax, edi
cdq
sub eax, edx
sar eax, 1
mov dword [0x85c124], eax
test byte [ebp + 0x870a08], 0x40
je 0x437d9e
movsx eax, word [ebp + 0x8709e8]
imul eax, eax, 7
movsx ecx, byte [eax + 0x727419]
mov dword [esp + 0x1c], ecx
mov cx, word [ebx + 0x871ea8]
movsx edx, cx
imul edx, edx, 7
cmp cx, 3
movsx eax, byte [edx + 0x727419]
mov dword [esp + 0x20], eax
jne 0x4377e2
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x20], eax
movsx ecx, word [ebx + 0x871eac]
movsx eax, word [ebp + 0x8709ec]
mov edx, dword [ebp + 0x870a14]
mov edi, dword [0x72ed78]
sub eax, ecx
mov ecx, dword [ebx + 0x871ed4]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x24], edx
mov edx, dword [ebx + 0x871ed0]
fild dword [esp + 0x60]
push 0
sub esp, 8
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x870a10]
fstp dword [esp + 4]
mov dword [esp + 0x40], edx
mov dword [esp + 0x70], eax
mov al, 1
fild dword [esp + 0x40]
mov esi, edi
fstp dword [esp]
call fcn.004e8db0
call fcn.005f275c
fild dword [esp + 0x24]
push 0
sub esp, 8
fstp dword [esp + 4]
mov dword [esp + 0x6c], eax
fild dword [esp + 0x70]
mov al, 1
fstp dword [esp]
call fcn.004e8db0
call fcn.005f275c
sub eax, dword [esp + 0x60]
mov edx, dword [ebx + 0x871ed8]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x28]
push eax
mov eax, dword [ebx + 0x871f4c]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [ebx + 0x871f1c]
push edx
push eax
push ecx
call fcn.004aec50
mov eax, dword [ebp + 0x870a8c]
mov edx, dword [ebx + 0x871f4c]
add esp, 0x14
cmp edx, eax
mov eax, dword [esp + 0x18]
jge 0x4378ba
mov dword [esp + 0x24], 0x43a8a0
sub eax, 0xa
jmp 0x4378c5
mov dword [esp + 0x24], 0x4127e0
add eax, 0xa
mov edi, dword [esp + 0x28]
mov dword [esp + 0x18], eax
movsx eax, word [ebp + 0x8709e8]
push eax
push str._LAND_PARTY
mov esi, 0x8ebf58
sub edi, 0x8c
call fcn.004f7660
mov edx, dword [esp + 0x20]
push 0
push 0xffffffffffffffff
lea ecx, [edi - 0x10]
push ecx
push edx
push 0x86bb48
mov dword [0x85c11c], 0x4b
call dword [esp + 0x40]
mov eax, dword [esp + 0x38]
add esp, 0x1c
push eax
push str.Attack:_NUM
call fcn.004f7660
mov ecx, dword [esp + 0x20]
push 0
push 0xffffffffffffffff
push edi
push ecx
push 0x86bb48
call dword [esp + 0x40]
xor eax, eax
mov ax, word [ebp + 0x870a00]
xor edx, edx
mov dx, word [ebx + 0x871ec0]
add edi, 0x14
add esp, 0x1c
mov dword [esp + 0x28], edi
xor eax, 0xfffffffc
sub eax, edx
and eax, 7
cmp eax, 4
jl 0x43795b
add eax, 0xfffffff8
cdq
xor eax, edx
sub eax, edx
cmp eax, 1
jle 0x43799f
push str.Flank_Attack__x2
mov esi, 0x8ebf58
call fcn.004f7660
mov eax, dword [esp + 0x1c]
add esp, 4
push 0
push 0xffffffffffffffff
push edi
push eax
push 0x86bb48
call dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
add esp, 0x14
add edi, 0x14
lea edx, [ecx + ecx]
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x3c], 0xffffffe7
jg 0x437a03
mov eax, 0xae147ae1
imul dword [esp + 0x3c]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push str.Morale__NUM
mov esi, 0x8ebf58
call fcn.004f7660
mov ecx, dword [esp + 0x20]
push 0
push 0xffffffffffffffff
push edi
push ecx
push 0x86bb48
call dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
mov eax, 0x99999999
imul dword [esp + 0x58]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edi, 0x14
add eax, edx
add esp, 0x1c
add ecx, eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x34], 0x64
jle 0x437a5f
mov eax, 0x51eb851f
imul dword [esp + 0x34]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push str.Height__NUM
mov esi, 0x8ebf58
mov dword [esp + 0x6c], eax
call fcn.004f7660
mov ecx, dword [esp + 0x20]
push 0
push 0xffffffffffffffff
push edi
push ecx
push 0x86bb48
call dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x80]
add edi, 0x14
add esp, 0x1c
add eax, edx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], eax
cmp word [ebp + 0x8709e8], 3
jne 0x437ae3
movsx eax, word [ebx + 0x871eb8]
and eax, 0x8000000f
jns 0x437a7c
dec eax
or eax, 0xfffffff0
inc eax
movsx ecx, word [ebx + 0x871eba]
shl eax, 4
and ecx, 0x8000000f
jns 0x437a93
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp byte [eax + ecx + 0x873978], 1
jne 0x437ae3
push str.Forest:__3
mov esi, 0x8ebf58
call fcn.004f7660
mov edx, dword [esp + 0x1c]
add esp, 4
push 0
push 0xffff4040
push edi
push edx
push 0x86bb48
call dword [esp + 0x38]
mov eax, 0x55555556
imul dword [esp + 0x30]
mov eax, edx
add edi, 0x14
shr eax, 0x1f
add esp, 0x14
add eax, edx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x871ed8]
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [ebx + 0x871f4c]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [ebx + 0x871f1c]
push eax
push ecx
push edx
call fcn.004aec50
mov eax, dword [ebx + 0x871f4c]
mov ecx, dword [ebp + 0x870a8c]
add esp, 0x14
cmp eax, ecx
mov eax, dword [esp + 0x18]
jge 0x437b2b
mov dword [esp + 0x24], 0x4127e0
add eax, 0xa
jmp 0x437b36
mov dword [esp + 0x24], 0x43a8a0
sub eax, 0xa
movsx ecx, word [ebx + 0x871ea8]
mov edi, dword [esp + 0x28]
push ecx
push str._LAND_PARTY
mov esi, 0x8ebf58
mov dword [esp + 0x20], eax
sub edi, 0x8c
call fcn.004f7660
mov eax, dword [esp + 0x20]
push 0
push 0xffffffffffffffff
lea edx, [edi - 0x10]
push edx
push eax
push 0x86bb48
mov dword [0x85c11c], 0x4b
call dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
add esp, 0x1c
push ecx
push str.Defend:_NUM
call fcn.004f7660
mov edx, dword [esp + 0x20]
push 0
push 0xffffffffffffffff
push edi
push edx
push 0x86bb48
call dword [esp + 0x40]
mov eax, dword [ebx + 0x871ec8]
add edi, 0x14
add esp, 0x1c
test ah, 2
mov dword [esp + 0x28], edi
je 0x437bea
push str.Ambush__x2
call fcn.004f7660
mov eax, dword [esp + 0x1c]
add esp, 4
push 0
push 0xffffffffffffffff
push edi
push eax
push 0x86bb48
call dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
add esp, 0x14
add edi, 0x14
lea edx, [ecx + ecx]
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], edx
cmp dword [esp + 0x3c], 0x19
jl 0x437c4e
mov eax, 0x51eb851f
imul dword [esp + 0x3c]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push str.Morale__NUM
mov esi, 0x8ebf58
call fcn.004f7660
mov ecx, dword [esp + 0x20]
push 0
push 0xffffffffffffffff
push edi
push ecx
push 0x86bb48
call dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov eax, 0x66666667
imul dword [esp + 0x58]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edi, 0x14
add eax, edx
add esp, 0x1c
add ecx, eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x34], 0xffffff9c
jge 0x437cb2
mov eax, 0xae147ae1
imul dword [esp + 0x34]
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
push str.Height__NUM
mov esi, 0x8ebf58
call fcn.004f7660
mov edx, dword [esp + 0x20]
push 0
push 0xffffffffffffffff
push edi
push edx
push 0x86bb48
call dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov eax, 0xae147ae1
imul dword [esp + 0x50]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edi, 0x14
add eax, edx
add esp, 0x1c
add ecx, eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], ecx
cmp word [ebx + 0x871ea8], 3
jne 0x437d30
movsx ecx, word [ebx + 0x871eb8]
and ecx, 0x8000000f
jns 0x437cd0
dec ecx
or ecx, 0xfffffff0
inc ecx
movsx edx, word [ebx + 0x871eba]
shl ecx, 4
and edx, 0x8000000f
jns 0x437ce7
dec edx
or edx, 0xfffffff0
inc edx
cmp byte [ecx + edx + 0x873978], 1
jne 0x437d30
push str.Forest:__3
mov esi, 0x8ebf58
call fcn.004f7660
mov eax, dword [esp + 0x1c]
add esp, 4
push 0
push 0xffff4040
push edi
push eax
push 0x86bb48
call dword [esp + 0x38]
mov eax, dword [esp + 0x34]
cdq
add edi, 0x14
sub eax, edx
add esp, 0x14
sar eax, 1
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], eax
mov eax, dword [0x8cc968]
test eax, eax
mov ecx, dword [ebx + 0x871f1c]
mov edx, dword [ebx + 0x871f4c]
mov dword [0x85c128], ecx
mov dword [0x85c124], edx
jne 0x437d9e
test byte [0x8ef61c], 1
jne 0x437d6c
or dword [0x8ef61c], 1
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x8ef618], eax
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [esp + 0x20]
mov ecx, eax
mov eax, dword [esp + 0x1c]
sub eax, edx
cdq
mov esi, eax
xor esi, edx
sub esi, edx
mov eax, 0x7530
add esi, 3
cdq
idiv esi
sub eax, dword [0x8ef618]
add ecx, eax
mov dword [0x8cc968], ecx
mov eax, dword [ebp + 0x870a18]
mov edi, dword [ebx + 0x871ed8]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x50]
sub eax, edi
imul eax, ecx
shl eax, 2
lea esi, [edx + 0x1f4]
cdq
idiv esi
add ecx, eax
mov dword [esp + 0x38], ecx
jns 0x437dd3
mov dword [esp + 0x38], 0
mov cx, word [ebp + 0x8709ec]
cmp cx, 0x64
jl 0x437e28
mov eax, dword [esp + 0x84]
mov edx, dword [esp + 0x2c]
mov edi, dword [ebp + 0x870a5c]
neg eax
sbb eax, eax
and eax, 0x7d0
add eax, 0xfffffc18
and dl, 1
add eax, edi
neg dl
mov dword [ebp + 0x870a1c], eax
mov eax, dword [ebp + 0x870a8c]
sbb edx, edx
and edx, 0x1f4
add edx, 0xffffff06
add edx, eax
mov dword [ebp + 0x870a20], edx
mov eax, dword [ebp + 0x870a08]
test al, 0x50
je 0x437f6a
test ah, 4
jne 0x437f6a
mov edi, dword [esp + 0x1c]
mov word [ebp + 0x8709ee], cx
mov ax, word [ebx + 0x871eac]
mov word [ebx + 0x871eae], ax
mov edx, dword [ebp + 0x870a08]
mov eax, 6
or edx, eax
mov dword [ebp + 0x870a08], edx
or dword [ebx + 0x871ec8], eax
test byte [ebp + 0x870a08], 0x10
je 0x437e9d
mov eax, edi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
test esi, esi
jle 0x437e92
call dword [sym.imp.MSVCR71.dll_rand]
cdq
idiv esi
jmp 0x437e94
xor edx, edx
add edx, edi
add word [ebx + 0x871eae], dx
test byte [ebp + 0x870a08], 0x20
je 0x437f5e
mov ecx, dword [esp + 0x20]
xor edx, edx
lea eax, [ecx + ecx]
cmp edi, eax
setg dl
cmp edi, ecx
mov dword [esp + 0x64], edx
jge 0x437ecd
lea eax, [edi + edi]
mov edi, eax
sub edi, ecx
mov dword [esp + 0x1c], edi
jmp 0x437ed5
sub eax, edi
mov ecx, eax
mov dword [esp + 0x20], ecx
mov esi, edi
shl esi, 4
test esi, esi
jle 0x437ef1
call dword [sym.imp.MSVCR71.dll_rand]
cdq
idiv esi
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x50], edx
jmp 0x437ef9
mov dword [esp + 0x50], 0
mov esi, ecx
shl esi, 4
test esi, esi
jle 0x437f11
call dword [sym.imp.MSVCR71.dll_rand]
mov ecx, dword [esp + 0x20]
cdq
idiv esi
jmp 0x437f13
xor edx, edx
cmp dword [esp + 0x50], edx
jge 0x437f31
mov eax, dword [0x85c158]
test eax, eax
jne 0x437f26
cmp edi, ecx
jge 0x437f31
mov word [ebp + 0x8709ee], 0x64
jmp 0x437f5e
mov ecx, dword [esp + 0x64]
test ecx, ecx
mov eax, 0x64
mov word [ebx + 0x871eae], ax
jne 0x437f5e
movsx ecx, word [ebp + 0x8709ec]
sub eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
add word [ebp + 0x8709ee], ax
or dword [ebp + 0x870a08], 0x400
jmp 0x437f6e
mov edi, dword [esp + 0x1c]
test byte [0x8ef61c], 1
jne 0x437f89
or dword [0x8ef61c], 1
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x8ef618], eax
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [0x8ef618]
mov ecx, dword [0x8cc968]
sub eax, edx
cmp eax, ecx
jle 0x438174
mov eax, dword [ebp + 0x870a08]
test al, 0x50
je 0x438174
test al, 0x10
je 0x437ffd
mov ax, word [ebx + 0x871eae]
cmp ax, 0x64
mov word [ebx + 0x871eac], ax
jl 0x437fe6
mov edx, dword [esp + 0x84]
test edx, edx
sete dl
lea eax, [ebx + 0x871ea8]
push edx
call fcn.004a91d0
add esp, 4
mov edx, 0xffffff9d
mov word [ebp + 0x870a02], dx
mov word [ebp + 0x870a04], 0
jmp 0x438002
mov edx, 0xffffff9d
test byte [ebp + 0x870a08], 0x20
je 0x438160
mov esi, dword [esp + 0x20]
xor ecx, ecx
lea eax, [esi + esi]
cmp edi, eax
setg cl
cmp edi, esi
jge 0x43802c
lea eax, [edi + edi]
sub eax, esi
mov dword [esp + 0x1c], eax
jmp 0x438032
sub eax, edi
mov dword [esp + 0x20], eax
mov eax, 0x64
cmp word [ebp + 0x8709ee], ax
jne 0x43807f
mov esi, dword [esp + 0x84]
mov word [ebp + 0x8709ec], ax
xor eax, eax
cmp esi, eax
setne cl
mov dword [ebp + 0x870a1c], eax
mov word [ebp + 0x870a04], ax
mov dword [ebp + 0x870a10], 0xffffffff
mov word [ebp + 0x870a02], dx
lea eax, [ebp + 0x8709e8]
push ecx
jmp 0x438158
mov word [ebx + 0x871eac], ax
mov eax, dword [ebx + 0x871ed0]
mov dword [ebp + 0x870a1c], eax
mov dword [ebp + 0x870a10], eax
mov eax, dword [ebx + 0x871ed4]
mov dword [ebp + 0x870a20], eax
mov dword [ebp + 0x870a14], eax
mov ax, word [ebx + 0x871eb8]
mov word [ebp + 0x8709f8], ax
mov ax, word [ebx + 0x871eba]
xor edi, edi
cmp ecx, edi
mov word [ebp + 0x8709fa], ax
je 0x4380d5
and dword [ebp + 0x870a08], 0xffffffbf
jmp 0x438145
add word [ebp + 0x8709ec], 0x14
lea ecx, [ebp + 0x870a5c]
mov word [ebp + 0x870a02], dx
mov word [ebp + 0x870a04], di
mov dword [esp + 0x50], ecx
mov edx, dword [esp + 0x50]
cmp dword [edx], 0
je 0x438134
mov esi, dword [esp + 0x54]
imul esi, esi, 0xa6
add esi, edi
shl esi, 1
cmp word [esi + 0x870aec], 0x77
je 0x438134
mov word [esi + 0x870aec], 0x76
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 0x64
idiv ecx
mov word [esi + 0x870b04], dx
mov ecx, dword [esp + 0x50]
inc edi
add ecx, 4
cmp edi, 0xc
mov dword [esp + 0x50], ecx
jl 0x4380f5
mov edx, dword [esp + 0x84]
test edx, edx
sete dl
lea eax, [ebx + 0x871ea8]
push edx
call fcn.004a91d0
add esp, 4
and dword [ebp + 0x870a08], 0xfffffb8f
and dword [ebx + 0x871ec8], 0xfffffdd7
movsx eax, word [ebp + 0x8709e8]
imul eax, eax, 7
movsx ecx, byte [eax + 0x727418]
mov ebx, dword [ebp + 0x870a5c]
imul ecx, ecx, 0x3e8
mov eax, 0x51eb851f
imul ecx
mov eax, dword [0x727520]
imul eax, eax, 0x3e8
sar edx, 4
mov edi, dword [ebp + 0x870a8c]
mov esi, edx
mov ecx, ebx
sub ecx, eax
add ecx, 0x2134
shr esi, 0x1f
add esi, edx
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
and eax, 0x8000000f
jns 0x4381dc
dec eax
or eax, 0xfffffff0
inc eax
shl eax, 4
mov dword [esp + 0x64], eax
mov eax, dword [0x727524]
imul eax, eax, 0x3e8
mov ecx, edi
sub ecx, eax
add ecx, 0x2134
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
and eax, 0x8000000f
jns 0x438215
dec eax
or eax, 0xfffffff0
inc eax
mov ecx, dword [esp + 0x64]
cmp byte [ecx + eax + 0x873978], 1
jne 0x438228
mov esi, 0x28
lea ecx, [esi + esi]
mov dword [esp + 0x3c], ecx
mov ecx, dword [ebp + 0x870a0c]
test ecx, ecx
mov edi, 0x7d
jns 0x438249
mov edi, 0xffffff83
and ecx, 0x7fffffff
test ecx, 0x40000000
je 0x43825a
mov edx, 0x7fffffff
sub edx, ecx
mov ecx, edx
mov eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov esi, 1
jle 0x438287
lea ecx, [ecx]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov edi, eax
cdq
xor eax, edx
sub eax, edx
add esi, esi
cmp eax, 0x7d00
jg 0x438270
mov edx, edi
call fcn.00495330
imul eax, esi
mov ecx, dword [ebp + 0x870a0c]
add eax, ebx
add ecx, 0x40000000
test ecx, ecx
mov dword [esp + 0x60], eax
mov edi, 0x7d
jns 0x4382b7
mov edi, 0xffffff83
and ecx, 0x7fffffff
test ecx, 0x40000000
je 0x4382c8
mov eax, 0x7fffffff
sub eax, ecx
mov ecx, eax
mov eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov ebx, 1
jle 0x4382f7
jmp 0x4382e0
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov edi, eax
cdq
xor eax, edx
sub eax, edx
add ebx, ebx
cmp eax, 0x7d00
jg 0x4382e0
mov edx, edi
call fcn.00495330
imul eax, ebx
mov ecx, dword [ebp + 0x870a8c]
mov edi, dword [0x72ed78]
add eax, ecx
mov dword [esp + 0x64], eax
push 0
sub esp, 8
fild dword [esp + 0x70]
mov al, 1
fstp dword [esp + 4]
fild dword [esp + 0x6c]
fstp dword [esp]
call fcn.004e8db0
call fcn.005f275c
mov edx, dword [ebp + 0x870a18]
mov esi, dword [esp + 0x3c]
sub eax, edx
cmp word [ebp + 0x8709ec], 0x64
mov dword [esp + 0x60], eax
jl 0x438350
add esi, 0x28
mov ecx, dword [0x727530]
imul ecx, eax
imul ecx, esi
mov eax, 0x10624dd3
imul ecx
mov ebx, dword [ebp + 0x870a08]
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x2aaaaaab
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, esi
sub eax, ecx
mov ecx, ebx
shr ecx, 5
not ecx
and ecx, 1
or ecx, 2
cdq
idiv ecx
mov ecx, eax
cmp ecx, 0xa
jge 0x4383a1
mov ecx, 0xa
mov edi, dword [esp + 0x84]
test edi, edi
je 0x4383c0
test bl, 2
jne 0x4383c0
cmp word [ebp + 0x8709f0], 0
jne 0x4383c0
shl ecx, 3
jmp 0x4383c9
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov eax, dword [ebp + 0x870a1c]
test eax, eax
mov dword [esp + 0x3c], ecx
je 0x4384c6
mov edx, dword [ebp + 0x870a5c]
mov esi, dword [ebp + 0x870a20]
sub eax, edx
mov ebx, eax
sub esi, dword [ebp + 0x870a8c]
test ebx, ebx
mov eax, esi
mov edx, ebx
jge 0x4383fb
neg edx
test esi, esi
jge 0x438403
mov eax, esi
neg eax
cmp edx, eax
jle 0x43840c
lea eax, [eax + edx*2]
jmp 0x43840f
lea eax, [edx + eax*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, ecx
jge 0x43849d
test edi, edi
mov dword [ebp + 0x870a1c], 0
jne 0x4384b2
mov ecx, dword [0x8cc978]
mov eax, 0x8000
test eax, ecx
jne 0x4384b2
mov ecx, dword [0x85c158]
test ecx, ecx
jne 0x4384b2
mov ecx, dword [0x8cc97c]
test ecx, ecx
jne 0x4384b2
mov ebx, dword [0x8cc978]
or ebx, eax
push str.Your_goal_is_to_defeat_the_enemy_and_reach_the_city_gates._n
mov esi, 0x8ebf58
mov dword [0x8cc978], ebx
call fcn.004f7660
add esp, 4
push edi
push 0x28
call fcn.00487950
add esp, 8
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x86bb48]
mov byte [eax + 0x86e460], cl
inc eax
test cl, cl
jne 0x438480
mov dword [0x727534], 0x96
jmp 0x4384b2
mov eax, esi
mov ecx, ebx
call fcn.004dcb20
mov dword [ebp + 0x870a0c], eax
mov dword [ebp + 0x870abc], eax
cmp word [ebp + 0x8709ec], 0x64
jge 0x4384c6
mov dword [0x8cc964], 1
xor eax, eax
mov word [ebp + 0x8709f6], ax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x54]
imul eax, eax, 0x53
mov dword [esp + 0x64], eax
jmp 0x4384e4
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x24]
lea ebx, [edx + eax]
shl ebx, 2
mov eax, dword [ebx + 0x870a5c]
test eax, eax
je 0x438d1c
mov esi, dword [esp + 0x54]
imul esi, esi, 0xa6
mov eax, edx
add esi, eax
shl esi, 1
cmp word [esi + 0x870aec], 0x77
jne 0x438598
movsx eax, word [ebp + 0x8709e8]
lea eax, [eax + eax*4]
mov ecx, dword [eax*4 + 0x86e390]
mov eax, 0x77
mov dword [esp + 0x68], 0
call fcn.004bc7a0
test eax, eax
je 0x438546
fld dword [eax + 0xc]
jmp 0x438550
fld dword [esp + 0x68]
lea ebx, [ebx]
fmul dword [0x715698]
call fcn.005f275c
mov edx, dword [0x727530]
lea ecx, [eax - 1]
movsx eax, word [esi + 0x870b04]
add eax, edx
jns 0x438571
xor eax, eax
cmp eax, ecx
jle 0x438577
mov eax, ecx
movsx edx, ax
cmp edx, ecx
mov word [esi + 0x870b04], ax
jne 0x438d1c
mov dword [ebx + 0x870a5c], 0
jmp 0x438d1c
inc word [ebp + 0x8709f6]
test eax, eax
je 0x4385e9
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x5c]
push edx
mov edx, dword [esp + 0x8c]
xor ecx, ecx
test edx, edx
mov edx, dword [ebp + 0x870a8c]
push eax
movsx eax, word [ebp + 0x8709e8]
push edx
mov edx, dword [ebp + 0x870a5c]
sete cl
push edx
mov edx, dword [ebp + 0x870abc]
call fcn.00431b20
mov eax, dword [esp + 0x70]
mov edi, dword [esp + 0x6c]
add esp, 0x14
jmp 0x4385fd
mov edi, dword [ebp + 0x870a1c]
mov eax, dword [ebp + 0x870a20]
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], eax
mov edx, dword [ebx + 0x870a5c]
mov ecx, edi
sub ecx, edx
sub eax, dword [ebx + 0x870a8c]
test ecx, ecx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x6c], eax
jge 0x43861b
neg ecx
test eax, eax
jge 0x438621
neg eax
cmp ecx, eax
jle 0x43862a
lea eax, [eax + ecx*2]
jmp 0x43862d
lea eax, [ecx + eax*2]
cdq
sub eax, edx
sar eax, 1
test edi, edi
mov dword [esp + 0x50], eax
jne 0x43863e
mov dword [esp + 0x50], edi
cmp word [esi + 0x870aec], 0x64
mov edi, dword [0x727530]
jne 0x438698
lea eax, [edi + edi*2]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x24]
lea eax, [eax + eax*2]
sar ecx, 1
add ecx, eax
imul ecx, dword [esp + 0x60]
shl ecx, 3
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea eax, [edi + edi*4]
cdq
sub eax, edx
mov edx, eax
mov eax, dword [esp + 0x24]
sar edx, 1
sub edx, ecx
lea eax, [eax + eax*2]
add edx, eax
add word [esi + 0x870b04], dx
jmp 0x4386a8
mov eax, dword [esp + 0x24]
lea ecx, [edi + eax*2]
add ecx, eax
add word [esi + 0x870b04], cx
mov edx, dword [0x727520]
mov ecx, dword [ebp + 0x870a5c]
imul edx, edx, 0x3e8
sub ecx, edx
add ecx, 0x2134
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
and eax, 0x8000000f
jns 0x4386df
dec eax
or eax, 0xfffffff0
inc eax
mov edx, dword [0x727524]
mov ecx, dword [ebp + 0x870a8c]
imul edx, edx, 0x3e8
shl eax, 4
mov dword [esp + 0x34], eax
sub ecx, edx
add ecx, 0x2134
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
and eax, 0x8000000f
jns 0x43871d
dec eax
or eax, 0xfffffff0
inc eax
mov ecx, dword [esp + 0x34]
cmp byte [ecx + eax + 0x873978], 1
jne 0x43873f
mov eax, edi
cdq
and edx, 3
add eax, edx
sar eax, 2
neg eax
add word [esi + 0x870b04], ax
cmp word [ebp + 0x8709ec], 0x64
jl 0x438757
mov eax, edi
cdq
sub eax, edx
sar eax, 1
add word [esi + 0x870b04], ax
xor edx, edx
cmp word [esi + 0x870b04], dx
jge 0x438769
mov word [esi + 0x870b04], dx
mov ecx, dword [esp + 0x50]
cmp ecx, dword [esp + 0x3c]
jl 0x438822
mov ax, word [esi + 0x870aec]
cmp ax, 0x76
je 0x438822
cmp ax, 0x64
je 0x4387ac
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 6
idiv ecx
test edx, edx
je 0x4387ac
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x438d1c
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
call fcn.004dcb20
mov edi, eax
mov eax, dword [esp + 0x3c]
mov ecx, edi
mov dword [ebx + 0x870abc], edi
call fcn.004dcac0
mov edx, dword [ebx + 0x870a5c]
add edx, eax
mov eax, dword [esp + 0x3c]
lea ecx, [edi + 0x40000000]
mov dword [ebx + 0x870a5c], edx
call fcn.004dcac0
mov ecx, dword [ebx + 0x870a8c]
add ecx, eax
cmp word [esi + 0x870aec], 0x64
mov dword [ebx + 0x870a8c], ecx
je 0x43880a
mov word [esi + 0x870b04], 0
mov word [esi + 0x870aec], 0x64
or dword [ebp + 0x870a08], 0x800
jmp 0x438d1c
mov eax, dword [ebp + 0x870abc]
mov dword [ebx + 0x870abc], eax
movsx ecx, word [ebp + 0x8709e8]
lea eax, [ecx - 1]
cmp eax, 7
ja case.0x438844.4
movzx eax, byte [eax + 0x438d7c]
jmp dword [eax*4 + 0x438d70]
cmp dword [esp + 0x40], edx
je case.0x438844.3
mov eax, ecx
imul eax, eax, 7
cmp byte [eax + 0x72741c], 0
je case.0x438844.3
mov dword [esp + 0x34], 0x71
jmp 0x4388a8
mov dword [esp + 0x34], 0x70
jmp 0x4388a8
cmp dword [esp + 0x40], edx
je 0x438891
mov eax, ecx
imul eax, eax, 7
cmp byte [eax + 0x72741c], 0
je 0x438891
mov dword [esp + 0x34], 0x71
jmp 0x4388a8
mov eax, dword [esp + 0x24]
and eax, 0x80000003
jns 0x4388a1
dec eax
or eax, 0xfffffffc
inc eax
add eax, 0x70
mov dword [esp + 0x34], eax
cmp dword [esp + 0x4c], edx
je 0x438c15
mov ecx, dword [esp + 0x44]
xor eax, eax
mov ax, word [esi + 0x870b1c]
movsx edi, ax
imul edi, edi, 0x1e
inc eax
mov dword [ebx + 0x870abc], ecx
mov word [esi + 0x870b1c], ax
movsx eax, word [ebp + 0x8709e8]
lea edx, [eax + eax*4]
mov ecx, dword [edx*4 + 0x86e390]
mov eax, 0x74
mov dword [esp + 0x74], 0
call fcn.004bc7a0
test eax, eax
je 0x4388ff
fld dword [eax + 0xc]
jmp 0x438903
fld dword [esp + 0x74]
fmul dword [0x715698]
call fcn.005f275c
test edi, edi
mov ebx, eax
jne 0x43892f
mov ecx, dword [esp + 0x24]
mov eax, 0x10000
shl eax, cl
mov ecx, dword [ebp + 0x870a08]
not eax
and ecx, eax
mov dword [ebp + 0x870a08], ecx
mov eax, dword [esp + 0x40]
test eax, eax
je 0x438939
add edi, ebx
cmp edi, ebx
jge 0x438952
mov word [esi + 0x870aec], 0x74
mov word [esi + 0x870b04], di
jmp 0x438d1c
movsx ecx, word [ebp + 0x8709e8]
mov edx, ecx
imul edx, edx, 7
movsx eax, byte [edx + 0x72741d]
imul eax, eax, 0x1f4
cmp edi, eax
jge 0x43899b
test ebx, ebx
lea eax, [ebx - 1]
mov word [esi + 0x870aec], 0x74
mov word [esi + 0x870b04], ax
jne 0x438d1c
mov cx, word [esp + 0x34]
mov word [esi + 0x870aec], cx
jmp 0x438d13
sub edi, eax
cmp dword [esp + 0x34], 0xffffffff
lea edx, [ecx + ecx*4]
mov ecx, dword [edx*4 + 0x86e390]
mov dword [esp + 0x78], 0
jne 0x4389bb
fld dword [ecx + 0x2c]
jmp 0x4389d1
mov eax, dword [esp + 0x34]
call fcn.004bc7a0
test eax, eax
je 0x4389cd
fld dword [eax + 0xc]
jmp 0x4389d1
fld dword [esp + 0x78]
fmul dword [0x715698]
call fcn.005f275c
cmp edi, eax
jge 0x438b9b
mov ax, word [esp + 0x34]
mov ebx, dword [esp + 0x48]
mov ecx, dword [esp + 0x24]
mov word [esi + 0x870b04], di
mov word [esi + 0x870aec], ax
mov esi, dword [esp + 0x30]
sub esi, ebx
mov ebx, esi
imul ebx, ebx, 0x14c
or dword [ebx + 0x871ec8], 8
mov eax, dword [ebp + 0x870a08]
mov edi, 0x10000
shl edi, cl
test edi, eax
jne 0x438d1c
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x24]
push ecx
push edx
lea eax, [ebp + 0x8709e8]
call fcn.004a9000
mov ecx, dword [ebp + 0x870a08]
mov eax, dword [ebp + 0x870a5c]
or edi, 6
or ecx, edi
mov edi, dword [esp + 0x48]
add esp, 8
neg edi
sbb edi, edi
and edi, 0x50
mov dword [ebp + 0x870a08], ecx
mov ecx, dword [ebp + 0x870a8c]
add edi, 0x14
test edi, edi
mov dword [0x8cc978], 0xffffffff
mov dword [ebp + 0x870a24], eax
mov dword [ebp + 0x870a28], ecx
jle 0x438a91
call dword [sym.imp.MSVCR71.dll_rand]
cdq
idiv edi
jmp 0x438a93
xor edx, edx
cmp dword [esp + 0x38], edx
jle 0x438d1c
movsx edx, word [ebx + 0x871eae]
mov ecx, 0x64
sub ecx, edx
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
lea ecx, [edx + eax + 1]
movsx edx, word [ebx + 0x871eaa]
cmp edx, ecx
jle 0x438d1c
mov dword [esp + 0x50], 0
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 0xc
idiv ecx
mov eax, dword [esp + 0x50]
inc eax
cmp eax, 0x64
mov dword [esp + 0x50], eax
mov edi, edx
jge 0x438d1c
mov edx, esi
imul edx, edx, 0xa6
add edx, edi
cmp word [edx*2 + 0x871fac], 0x77
je 0x438ad5
mov eax, esi
imul eax, eax, 0x53
add eax, edi
mov ecx, dword [eax*4 + 0x871f1c]
test ecx, ecx
je 0x438ad5
test edi, edi
je 0x438ad5
mov eax, esi
imul esi, esi, 0x53
imul eax, eax, 0xa6
add eax, edi
shl eax, 1
add esi, edi
shl esi, 2
mov word [eax + 0x871fac], 0x77
mov dword [esi + 0x871eec], 1
mov word [eax + 0x871fc4], 0
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 0x168
idiv ecx
push edi
lea eax, [ebx + 0x871ea8]
imul edx, edx, 0xb60b60
mov dword [esi + 0x871f7c], edx
call fcn.004a9140
xor eax, eax
mov ax, word [ebx + 0x871eaa]
add esp, 4
cmp ax, 2
jle 0x438d1c
dec eax
mov word [ebx + 0x871eaa], ax
jmp 0x438d1c
sub edi, eax
mov eax, dword [esp + 0x40]
test eax, eax
je 0x438bae
mov word [esi + 0x870b1c], 0
cmp edi, ebx
jge 0x438bca
sub ebx, edi
dec ebx
mov word [esi + 0x870aec], 0x74
mov word [esi + 0x870b04], bx
jmp 0x438d1c
movsx edx, word [ebp + 0x8709e8]
imul edx, edx, 7
movsx eax, byte [edx + 0x72741d]
imul eax, eax, 0x320
cmp edi, eax
jl 0x438c07
call dword [sym.imp.MSVCR71.dll_rand]
and eax, 0x8000000f
jns 0x438bf7
dec eax
or eax, 0xfffffff0
inc eax
jne 0x438c07
mov word [esi + 0x870b1c], 0
jmp 0x438d1c
mov word [esi + 0x870aec], 0x74
jmp 0x438d13
mov ax, word [esi + 0x870aec]
cmp ax, 0x6f
je 0x438cc3
cmp ax, 0x76
je 0x438cc3
cmp ax, 0x6e
je 0x438c3d
mov word [esi + 0x870b04], dx
cmp dword [esp + 0x84], edx
mov word [esi + 0x870aec], 0x6e
jne 0x438d1c
mov ecx, dword [esp + 0x2c]
cmp ecx, dword [0x8cc95c]
jne 0x438d1c
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 0x32
idiv ecx
test edx, edx
jne 0x438d1c
mov esi, dword [esp + 0x2c]
mov eax, esi
imul eax, eax, 0x14c
mov ecx, dword [eax + 0x870a8c]
mov eax, dword [eax + 0x870a5c]
call fcn.00431910
cmp eax, 1
je 0x438d1c
mov edx, dword [esp + 0x24]
mov eax, esi
imul eax, eax, 0xa6
add eax, edx
shl eax, 1
mov word [eax + 0x870aec], 0x6f
mov word [eax + 0x870b04], 0
jmp 0x438d1c
movsx eax, ax
cmp eax, 0xffffffff
lea edx, [ecx + ecx*4]
mov ecx, dword [edx*4 + 0x86e390]
mov dword [esp + 0x7c], 0
jne 0x438ce2
fld dword [ecx + 0x2c]
jmp 0x438cf4
call fcn.004bc7a0
test eax, eax
je 0x438cf0
fld dword [eax + 0xc]
jmp 0x438cf4
fld dword [esp + 0x7c]
fmul dword [0x715698]
call fcn.005f275c
movsx ecx, word [esi + 0x870b04]
cmp ecx, eax
jle 0x438d1c
mov word [esi + 0x870aec], 0x6e
mov word [esi + 0x870b04], 0
mov eax, dword [esp + 0x24]
inc eax
cmp eax, 0xc
mov dword [esp + 0x24], eax
jl 0x4384e0
mov eax, dword [esp + 0x2c]
inc eax
cmp eax, 0x10
mov dword [esp + 0x2c], eax
jl 0x436bb0
mov al, byte [esp + 0x17]
test al, al
jne 0x438d66
mov ecx, dword [esp + 0x84]
mov eax, dword [0x8cc974]
xor edx, edx
test ecx, ecx
setne dl
lea edx, [edx + edx - 1]
add eax, edx
mov dword [0x8cc974], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret