Function at 0x489130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebp, dword [edi + 0x72578]
mov edx, dword [edi + 0x725bc]
mov ax, word [edi + 0x1f70]
mov bx, word [edi + 0x1f6c]
mov si, word [edi + 0x1f6e]
mov ecx, ebp
sub ecx, edx
mov word [esp + 0x14], ax
cmp ecx, 0x2710
jbe 0x4891b1
push 0
push 0x4bdaa0
push 0
push 0
push 3
push 0
push 0xa52
push 0xfa314dc
mov ecx, edi
call fcn.00405900
push 0
push 0x4bdaa0
push 0
push 0
push 1
push 0
push 0xa52
push 0xfa314dc
mov ecx, edi
call fcn.00405900
mov dword [edi + 0x725bc], ebp
mov ecx, dword [edi + 0x3824c]
mov edx, dword [edi + 0x72578]
movsx esi, si
test ecx, ecx
mov dword [esp + 0x10], esi
lea eax, [esi - 0xc]
movsx ebx, bx
je 0x4891f7
cmp dword [edi + 0x72db4], 1
jne 0x4891e6
push edx
push 0
push eax
lea eax, [ebx - 1]
push eax
call fcn.004a13b0
jmp 0x4891f7
push 0
push 0
push edx
push 0
push eax
lea eax, [ebx - 1]
push eax
call fcn.0049e020
mov ecx, dword [edi + 0x38244]
mov eax, dword [edi + 0x72578]
test ecx, ecx
je 0x48922a
cmp dword [edi + 0x72db4], 1
jne 0x48921c
push eax
push 0xf
push esi
push ebx
call fcn.004a13b0
jmp 0x48922a
push 0
push 0
push eax
push 0xf
push esi
push ebx
call fcn.0049e020
movsx eax, byte [edi + 0x1ff6]
cmp eax, 4
ja case.default.0x48923a
jmp dword [eax*4 + 0x48bb0c]
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
lea esi, [edx + 0x154]
push ebp
lea eax, [ebx + 0x14]
push 3
push esi
push eax
call fcn.0049e020
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
lea eax, [ebx + 0x46]
push 1
push esi
push eax
call fcn.0049e020
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
lea eax, [ebx + 0x78]
push 2
push esi
push eax
call fcn.0049e020
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
lea eax, [ebx + 0xaa]
push 0x1e
push esi
push eax
call fcn.0049e020
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
lea eax, [ebx + 0xf4]
push 4
push esi
push eax
call fcn.0049e020
lea esi, [edi + 0x7f1c]
mov ecx, esi
call fcn.00402880
mov eax, dword [esp + 0x10]
movsx edx, word [esp + 0x14]
add eax, 0x23
add edx, ebx
lea ecx, [eax + 0xf]
push ecx
push edx
push eax
lea eax, [esp + 0x38]
push ebx
push eax
call dword [sym.imp.user32.dll_SetRect]
push 0
lea ecx, [esp + 0x30]
push 0x4c702c
push ecx
mov ecx, esi
call fcn.004028e0
mov ecx, esi
call fcn.004028c0
mov ecx, dword [esp + 0x40]
lea eax, [ebx + 0x14]
cmp ecx, eax
jl 0x4893e0
lea edx, [ebx + 0x42]
cmp ecx, edx
jg 0x4893e4
mov eax, dword [esp + 0x10]
lea edx, [eax + 0x154]
mov eax, dword [esp + 0x44]
cmp eax, edx
jl 0x4893e8
mov edx, dword [esp + 0x10]
add edx, 0x188
cmp eax, edx
jg 0x4893e8
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
add eax, 0x154
push 0x11
push eax
lea eax, [ebx + 0x14]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
add edx, 0x14
lea ebp, [ecx + 0x23]
mov ecx, esi
mov dword [esp + 0x1c], edx
call fcn.00402880
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c7008
push ebp
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
lea eax, [ebp + 1]
push 0
push 0x4c7008
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c7008
push eax
lea eax, [edx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0xffffff
push 0x4c7008
push ebp
jmp 0x489728
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
lea edx, [ebx + 0x46]
cmp ecx, edx
jl 0x4894b5
lea edx, [ebx + 0x74]
cmp ecx, edx
jg 0x4894b5
mov edx, dword [esp + 0x10]
add edx, 0x154
cmp eax, edx
jl 0x4894b5
mov edx, dword [esp + 0x10]
add edx, 0x188
cmp eax, edx
jg 0x4894b5
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
add eax, 0x154
push 0xf
push eax
lea eax, [ebx + 0x46]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
add edx, 0x14
lea ebp, [ecx + 0x23]
mov ecx, esi
mov dword [esp + 0x1c], edx
call fcn.00402880
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6fe8
push ebp
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
lea eax, [ebp + 1]
push 0
push 0x4c6fe8
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6fe8
push eax
lea eax, [edx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0xffffff
push 0x4c6fe8
push ebp
jmp 0x489728
lea edx, [ebx + 0x78]
cmp ecx, edx
jl 0x489585
lea edx, [ebx + 0xa6]
cmp ecx, edx
jg 0x489585
mov edx, dword [esp + 0x10]
add edx, 0x154
cmp eax, edx
jl 0x489585
mov edx, dword [esp + 0x10]
add edx, 0x188
cmp eax, edx
jg 0x489585
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
add eax, 0x154
push 0x10
push eax
lea eax, [ebx + 0x78]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
add edx, 0x14
lea ebp, [ecx + 0x23]
mov ecx, esi
mov dword [esp + 0x1c], edx
call fcn.00402880
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6fd0
push ebp
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
lea eax, [ebp + 1]
push 0
push 0x4c6fd0
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6fd0
push eax
lea eax, [edx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0xffffff
push 0x4c6fd0
push ebp
jmp 0x489728
lea edx, [ebx + 0xaa]
cmp ecx, edx
jl 0x48965b
lea edx, [ebx + 0xd8]
cmp ecx, edx
jg 0x48965b
mov edx, dword [esp + 0x10]
add edx, 0x154
cmp eax, edx
jl 0x48965b
mov edx, dword [esp + 0x10]
add edx, 0x188
cmp eax, edx
jg 0x48965b
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
add eax, 0x154
push 0x18
push eax
lea eax, [ebx + 0xaa]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
add edx, 0x14
lea ebp, [ecx + 0x23]
mov ecx, esi
mov dword [esp + 0x1c], edx
call fcn.00402880
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6fa8
push ebp
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
lea eax, [ebp + 1]
push 0
push 0x4c6fa8
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6fa8
push eax
lea eax, [edx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0xffffff
push 0x4c6fa8
push ebp
jmp 0x489728
lea edx, [ebx + 0xf4]
cmp ecx, edx
jl 0x489737
lea edx, [ebx + 0x122]
cmp ecx, edx
jg 0x489737
mov edx, dword [esp + 0x10]
lea ecx, [edx + 0x154]
cmp eax, ecx
jl 0x489737
add edx, 0x188
cmp eax, edx
jg 0x489737
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
add eax, 0x154
push 0x12
push eax
lea eax, [ebx + 0xf4]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
add edx, 0x14
lea ebp, [ecx + 0x23]
mov ecx, esi
mov dword [esp + 0x1c], edx
call fcn.00402880
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6f90
push ebp
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
lea eax, [ebp + 1]
push 0
push 0x4c6f90
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6f90
push eax
lea eax, [edx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0xffffff
push 0x4c6f90
push ebp
push eax
mov ecx, esi
call fcn.00402520
mov ecx, esi
call fcn.004028c0
mov ecx, dword [edi + 0x3824c]
mov eax, dword [edi + 0x72578]
test ecx, ecx
je case.default.0x48923a
cmp dword [edi + 0x72db4], 1
jne 0x489d92
mov edx, dword [esp + 0x10]
push eax
push 0x15
push edx
push ebx
jmp 0x48b517
mov ecx, dword [esp + 0x10]
push 0
push 0
push ebp
lea esi, [ecx + 0x154]
mov ecx, dword [edi + 0x3824c]
lea eax, [ebx + 0xc2]
push 0x14
push esi
push eax
call fcn.0049e020
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
lea eax, [ebx + 0xf4]
push 4
push esi
push eax
call fcn.0049e020
lea esi, [edi + 0x7f1c]
mov ecx, esi
call fcn.00402880
mov edx, dword [esp + 0x10]
lea eax, [edx + 0x23]
movsx edx, word [esp + 0x14]
lea ecx, [eax + 0xf]
add edx, ebx
push ecx
push edx
push eax
lea eax, [esp + 0x38]
push ebx
push eax
call dword [sym.imp.user32.dll_SetRect]
push 0
lea ecx, [esp + 0x30]
push 0x4c6f68
push ecx
mov ecx, esi
call fcn.004028e0
mov ecx, esi
call fcn.004028c0
mov ecx, dword [esp + 0x40]
lea eax, [ebx + 0xc2]
cmp ecx, eax
jl 0x4898c8
lea edx, [ebx + 0xf0]
mov eax, ecx
cmp eax, edx
jg 0x4898c8
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x44]
lea ecx, [edx + 0x154]
cmp eax, ecx
jl 0x4898cc
add edx, 0x188
cmp eax, edx
jg 0x4898cc
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
add eax, 0x154
push 0x13
push eax
lea eax, [ebx + 0xc2]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
add edx, 0x14
lea ebp, [ecx + 0x23]
mov ecx, esi
mov dword [esp + 0x1c], edx
call fcn.00402880
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6f44
push ebp
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
lea eax, [ebp + 1]
push 0
push 0x4c6f44
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6f44
push eax
lea eax, [edx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0xffffff
push 0x4c6f44
push ebp
push eax
jmp 0x4899a1
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
lea ecx, [ebx + 0xf4]
cmp edx, ecx
jl 0x4899af
lea ecx, [ebx + 0x122]
cmp edx, ecx
jg 0x4899af
mov edx, dword [esp + 0x10]
lea ecx, [edx + 0x154]
cmp eax, ecx
jl 0x4899af
add edx, 0x188
cmp eax, edx
jg 0x4899af
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
lea eax, [edx + 0x154]
push 0x12
push eax
lea eax, [ebx + 0xf4]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
add ecx, 0x14
mov dword [esp + 0x1c], ecx
mov ecx, esi
lea ebp, [eax + 0x23]
call fcn.00402880
mov edx, dword [esp + 0x1c]
push 0
push 0x4c6f28
push ebp
lea eax, [edx + 1]
mov ecx, esi
push eax
call fcn.00402520
lea eax, [ebp + 1]
push 0
push 0x4c6f28
push eax
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6f28
push eax
lea eax, [ecx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6f28
push ebp
push edx
mov ecx, esi
call fcn.00402520
mov ecx, esi
call fcn.004028c0
mov ecx, dword [edi + 0x3824c]
mov eax, dword [edi + 0x72578]
test ecx, ecx
je 0x4899ea
cmp dword [edi + 0x72db4], 1
jne 0x4899d8
push eax
mov eax, dword [esp + 0x14]
push 0x15
push eax
push ebx
call fcn.004a13b0
jmp 0x4899ea
mov edx, dword [esp + 0x10]
push 0
push 0
push eax
push 0x15
push edx
push ebx
call fcn.0049e020
mov ecx, dword [esp + 0x40]
lea eax, [ebx + 0xf]
cmp ecx, eax
jl case.default.0x48923a
mov eax, dword [esp + 0x40]
lea ecx, [ebx + 0x127]
cmp eax, ecx
jg case.default.0x48923a
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x44]
add edx, 0x3c
cmp eax, edx
jl case.default.0x48923a
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x44]
add eax, 0x139
cmp ecx, eax
jg case.default.0x48923a
mov ecx, dword [edi + 0x3824c]
test ecx, ecx
je case.default.0x48923a
mov edx, dword [edi + 0x72578]
push edx
push 0x2a
jmp 0x48b50d
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
lea esi, [eax + 0x154]
push ebp
lea eax, [ebx + 0x46]
push 1
push esi
push eax
mov dword [esp + 0x30], esi
call fcn.0049e020
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
lea eax, [ebx + 0xc2]
push 0x14
push esi
push eax
call fcn.0049e020
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
lea eax, [ebx + 0xf4]
push 4
push esi
push eax
call fcn.0049e020
lea esi, [edi + 0x7f1c]
mov ecx, esi
call fcn.00402880
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 0x23]
movsx ecx, word [esp + 0x14]
lea edx, [eax + 0xf]
add ecx, ebx
push edx
push ecx
push eax
lea edx, [esp + 0x38]
push ebx
push edx
call dword [sym.imp.user32.dll_SetRect]
push 0
lea eax, [esp + 0x30]
push 0x4c6fe8
push eax
mov ecx, esi
call fcn.004028e0
mov ecx, esi
call fcn.004028c0
mov ecx, dword [esp + 0x40]
lea eax, [ebx + 0x46]
cmp ecx, eax
jl 0x489bc0
mov edx, dword [esp + 0x40]
lea ecx, [ebx + 0x74]
cmp edx, ecx
jg 0x489bc4
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jl 0x489bc8
mov ecx, dword [esp + 0x10]
add ecx, 0x188
cmp eax, ecx
jg 0x489bc8
mov edx, dword [esp + 0x18]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
push 0xf
lea eax, [ebx + 0x46]
push edx
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
add ecx, 0x14
mov dword [esp + 0x1c], ecx
mov ecx, esi
lea ebp, [eax + 0x23]
call fcn.00402880
mov edx, dword [esp + 0x1c]
push 0
push 0x4c6f00
push ebp
lea eax, [edx + 1]
mov ecx, esi
push eax
call fcn.00402520
lea eax, [ebp + 1]
push 0
push 0x4c6f00
push eax
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6f00
push eax
lea eax, [ecx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6f00
push ebp
push edx
jmp 0x489d59
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
lea ecx, [ebx + 0xc2]
cmp edx, ecx
jl 0x489c94
lea ecx, [ebx + 0xf0]
cmp edx, ecx
jg 0x489c94
cmp eax, dword [esp + 0x18]
jl 0x489c94
mov ecx, dword [esp + 0x10]
add ecx, 0x188
cmp eax, ecx
jg 0x489c94
mov edx, dword [esp + 0x18]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
push 0x13
lea eax, [ebx + 0xc2]
push edx
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
add ecx, 0x14
mov dword [esp + 0x1c], ecx
mov ecx, esi
lea ebp, [eax + 0x23]
call fcn.00402880
mov edx, dword [esp + 0x1c]
push 0
push 0x4c6f44
push ebp
lea eax, [edx + 1]
mov ecx, esi
push eax
call fcn.00402520
lea eax, [ebp + 1]
push 0
push 0x4c6f44
push eax
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6f44
push eax
lea eax, [ecx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6f44
push ebp
push edx
jmp 0x489d59
lea ecx, [ebx + 0xf4]
cmp edx, ecx
jl 0x489d67
lea ecx, [ebx + 0x122]
cmp edx, ecx
jg 0x489d67
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jl 0x489d67
mov edx, dword [esp + 0x10]
add edx, 0x188
cmp eax, edx
jg 0x489d67
push 0
push 0
push ebp
mov eax, ecx
mov ecx, dword [edi + 0x3824c]
push 0x12
push eax
lea eax, [ebx + 0xf4]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
add edx, 0x14
lea ebp, [ecx + 0x23]
mov ecx, esi
mov dword [esp + 0x1c], edx
call fcn.00402880
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6edc
push ebp
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
lea eax, [ebp + 1]
push 0
push 0x4c6edc
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6edc
push eax
lea eax, [edx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0xffffff
push 0x4c6edc
push ebp
push eax
mov ecx, esi
call fcn.00402520
mov ecx, esi
call fcn.004028c0
mov ecx, dword [edi + 0x3824c]
mov eax, dword [edi + 0x72578]
test ecx, ecx
je case.default.0x48923a
cmp dword [edi + 0x72db4], 1
jne 0x489d92
mov edx, dword [esp + 0x10]
push eax
push 0x15
push edx
push ebx
jmp 0x48b517
push 0
push 0
push eax
mov eax, dword [esp + 0x1c]
push 0x15
push eax
push ebx
call fcn.0049e020
jmp case.default.0x48923a
mov eax, dword [edi + 0x725dc]
cmp eax, 1
jne 0x489e98
cmp dword [edi + 0x725d8], eax
jne 0x489e20
mov ecx, dword [esp + 0x10]
push 0
push 0
push ebp
lea esi, [ecx + 0xdc]
mov ecx, dword [edi + 0x3824c]
push 6
lea edx, [ebx + 0x14]
push esi
push edx
call fcn.0049e020
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
push 5
lea eax, [ebx + 0x46]
push esi
push eax
call fcn.0049e020
push 0
push 0
push ebp
push 7
lea ecx, [ebx + 0x78]
push esi
push ecx
mov ecx, dword [edi + 0x3824c]
call fcn.0049e020
push 0
push 0
push ebp
push 0x23
lea edx, [ebx + 0xaa]
push esi
push edx
jmp 0x489e8d
cmp eax, 1
jne 0x489e98
mov eax, dword [edi + 0x725d8]
test eax, eax
jne 0x489e98
mov eax, dword [esp + 0x10]
push 0
push 0
push ebp
lea esi, [eax + 0xdc]
push 9
lea ecx, [ebx + 0x14]
push esi
push ecx
mov ecx, dword [edi + 0x3824c]
call fcn.0049e020
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
push 8
lea edx, [ebx + 0x46]
push esi
push edx
call fcn.0049e020
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
push 7
lea eax, [ebx + 0x78]
push esi
push eax
call fcn.0049e020
push 0
push 0
push ebp
push 0x23
lea ecx, [ebx + 0xaa]
push esi
push ecx
mov ecx, dword [edi + 0x3824c]
call fcn.0049e020
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
lea esi, [edx + 0x142]
push ebp
lea eax, [ebx + 0xc2]
push 0x14
push esi
push eax
call fcn.0049e020
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
lea eax, [ebx + 0xf4]
push 4
push esi
push eax
call fcn.0049e020
lea esi, [edi + 0x7f1c]
mov ecx, esi
call fcn.00402880
mov eax, dword [esp + 0x10]
movsx edx, word [esp + 0x14]
add eax, 0x23
add edx, ebx
lea ecx, [eax + 0xf]
push ecx
push edx
push eax
lea eax, [esp + 0x38]
push ebx
push eax
call dword [sym.imp.user32.dll_SetRect]
push 0
lea ecx, [esp + 0x30]
push 0x4c6fd0
push ecx
mov ecx, esi
call fcn.004028e0
mov ecx, esi
call fcn.004028c0
mov edx, dword [edi + 0x72f8c]
lea eax, [edi + 0x730ed]
push edx
push 0x4c6ec4
push 0x4c6ebc
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x10
mov ecx, esi
call fcn.00402880
mov eax, dword [esp + 0x10]
lea ecx, [ebx + 0x143]
add eax, 0xbe
lea edx, [eax + 0xf]
push edx
push ecx
push eax
lea eax, [esp + 0x38]
push ebx
push eax
call dword [sym.imp.user32.dll_SetRect]
lea eax, [edi + 0x730ed]
push 0
lea ecx, [esp + 0x30]
push eax
push ecx
mov ecx, esi
call fcn.004028e0
mov ecx, esi
call fcn.004028c0
mov eax, dword [edi + 0x725dc]
cmp eax, 1
jne 0x48b074
cmp dword [edi + 0x725d8], eax
jne 0x48a7f8
mov ecx, dword [esp + 0x40]
lea eax, [ebx + 0x14]
cmp ecx, eax
jl 0x48a0f2
lea edx, [ebx + 0x42]
cmp ecx, edx
jg 0x48a0f2
mov eax, dword [esp + 0x10]
lea edx, [eax + 0xdc]
mov eax, dword [esp + 0x44]
cmp eax, edx
mov dword [esp + 0x14], edx
jl 0x48a0f6
mov edx, dword [esp + 0x10]
add edx, 0x10e
cmp eax, edx
jg 0x48a0f6
cmp dword [edi + 0x72f8c], 0xbb8
jl 0x48a00a
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
push 0xb
push eax
lea eax, [ebx + 0x14]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x40]
lea ebp, [ecx + 0x14]
mov ecx, esi
call fcn.00402880
mov edx, dword [esp + 0x44]
push 0
lea ecx, [ebp + 1]
push 0x4c232c
lea eax, [edx + 0x23]
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x44]
push 0
add eax, 0x24
push 0x4c232c
push eax
push ebp
mov ecx, esi
mov dword [esp + 0x38], eax
call fcn.00402520
mov ecx, dword [esp + 0x28]
push 0
push 0x4c232c
lea eax, [ebp + 1]
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x44]
push 0xffffff
push 0x4c232c
mov ecx, esi
lea eax, [edx + 0x23]
push eax
push ebp
call fcn.00402520
mov ecx, esi
call fcn.004028c0
mov eax, dword [esp + 0x44]
mov ecx, esi
add eax, 0x32
mov dword [esp + 0x1c], eax
call fcn.00402880
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6ea8
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
push 0x4c6ea8
mov ecx, esi
lea eax, [edx + 1]
push eax
push ebp
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6ea8
push eax
lea eax, [ebp + 1]
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6ea8
push ecx
push ebp
jmp 0x48b066
mov eax, dword [esp + 0x44]
lea edx, [ebx + 0x46]
cmp ecx, edx
jl 0x48a243
lea edx, [ebx + 0x73]
cmp ecx, edx
jg 0x48a243
mov edx, dword [esp + 0x10]
add edx, 0xdc
cmp eax, edx
mov dword [esp + 0x14], edx
jl 0x48a243
mov edx, dword [esp + 0x10]
add edx, 0x10e
cmp eax, edx
jg 0x48a243
cmp dword [edi + 0x72f8c], 0x7d0
jl 0x48a15b
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
push 0xa
push eax
lea eax, [ebx + 0x46]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x40]
lea ebp, [ecx + 0x14]
mov ecx, esi
call fcn.00402880
mov edx, dword [esp + 0x44]
push 0
lea ecx, [ebp + 1]
push 0x4c233c
lea eax, [edx + 0x23]
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x44]
push 0
add eax, 0x24
push 0x4c233c
push eax
push ebp
mov ecx, esi
mov dword [esp + 0x38], eax
call fcn.00402520
mov ecx, dword [esp + 0x28]
push 0
push 0x4c233c
lea eax, [ebp + 1]
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x44]
push 0xffffff
push 0x4c233c
mov ecx, esi
lea eax, [edx + 0x23]
push eax
push ebp
call fcn.00402520
mov ecx, esi
call fcn.004028c0
mov eax, dword [esp + 0x44]
mov ecx, esi
add eax, 0x32
mov dword [esp + 0x1c], eax
call fcn.00402880
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6e94
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
push 0x4c6e94
mov ecx, esi
lea eax, [edx + 1]
push eax
push ebp
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6e94
push eax
lea eax, [ebp + 1]
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6e94
push ecx
push ebp
jmp 0x48b066
lea edx, [ebx + 0x78]
cmp ecx, edx
jl 0x48a393
lea edx, [ebx + 0xa5]
cmp ecx, edx
jg 0x48a393
mov edx, dword [esp + 0x10]
add edx, 0xdc
cmp eax, edx
mov dword [esp + 0x14], edx
jl 0x48a393
mov edx, dword [esp + 0x10]
add edx, 0x10e
cmp eax, edx
jg 0x48a393
cmp dword [edi + 0x72f8c], 0x3e8
jl 0x48a2ab
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
push 0xc
push eax
lea eax, [ebx + 0x78]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x40]
lea ebp, [ecx + 0x14]
mov ecx, esi
call fcn.00402880
mov edx, dword [esp + 0x44]
push 0
lea ecx, [ebp + 1]
push 0x4c2360
lea eax, [edx + 0x23]
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x44]
push 0
add eax, 0x24
push 0x4c2360
push eax
push ebp
mov ecx, esi
mov dword [esp + 0x38], eax
call fcn.00402520
mov ecx, dword [esp + 0x28]
push 0
push 0x4c2360
lea eax, [ebp + 1]
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x44]
push 0xffffff
push 0x4c2360
mov ecx, esi
lea eax, [edx + 0x23]
push eax
push ebp
call fcn.00402520
mov ecx, esi
call fcn.004028c0
mov eax, dword [esp + 0x44]
mov ecx, esi
add eax, 0x32
mov dword [esp + 0x1c], eax
call fcn.00402880
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6e80
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
push 0x4c6e80
mov ecx, esi
lea eax, [edx + 1]
push eax
push ebp
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6e80
push eax
lea eax, [ebp + 1]
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6e80
push ecx
push ebp
jmp 0x48b066
lea edx, [ebx + 0xaa]
cmp ecx, edx
jl 0x48a4e9
lea edx, [ebx + 0xd7]
cmp ecx, edx
jg 0x48a4e9
mov edx, dword [esp + 0x10]
add edx, 0xdc
cmp eax, edx
mov dword [esp + 0x14], edx
jl 0x48a4e9
mov edx, dword [esp + 0x10]
add edx, 0x10e
cmp eax, edx
jg 0x48a4e9
cmp dword [edi + 0x72f8c], 0x1388
jl 0x48a401
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
push 0x1d
push eax
lea eax, [ebx + 0xaa]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x40]
lea ebp, [ecx + 0x14]
mov ecx, esi
call fcn.00402880
mov edx, dword [esp + 0x44]
push 0
lea ecx, [ebp + 1]
push 0x4bd350
lea eax, [edx + 0x23]
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x44]
push 0
add eax, 0x24
push 0x4bd350
push eax
push ebp
mov ecx, esi
mov dword [esp + 0x38], eax
call fcn.00402520
mov ecx, dword [esp + 0x28]
push 0
push 0x4bd350
lea eax, [ebp + 1]
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x44]
push 0xffffff
push 0x4bd350
mov ecx, esi
lea eax, [edx + 0x23]
push eax
push ebp
call fcn.00402520
mov ecx, esi
call fcn.004028c0
mov eax, dword [esp + 0x44]
mov ecx, esi
add eax, 0x32
mov dword [esp + 0x1c], eax
call fcn.00402880
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6e6c
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
push 0x4c6e6c
mov ecx, esi
lea eax, [edx + 1]
push eax
push ebp
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6e6c
push eax
lea eax, [ebp + 1]
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6e6c
push ecx
push ebp
jmp 0x48b066
lea edx, [ebx + 0x14]
cmp ecx, edx
jl 0x48a598
lea edx, [ebx + 0x17c]
cmp ecx, edx
jg 0x48a598
mov edx, dword [esp + 0x10]
add edx, 0x8c
cmp eax, edx
jle 0x48a598
mov edx, dword [esp + 0x10]
add edx, 0xa0
cmp eax, edx
jge 0x48a598
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
add ecx, 0x14
mov dword [esp + 0x1c], ecx
mov ecx, esi
lea ebp, [eax + 0x23]
call fcn.00402880
mov edx, dword [esp + 0x1c]
push 0
push 0x4c6e48
push ebp
lea eax, [edx + 1]
mov ecx, esi
push eax
call fcn.00402520
lea eax, [ebp + 1]
push 0
push 0x4c6e48
push eax
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6e48
push eax
lea eax, [ecx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6e48
push ebp
push edx
jmp 0x48b066
lea edx, [ebx + 0x14]
cmp ecx, edx
jl 0x48a647
lea edx, [ebx + 0x17c]
cmp ecx, edx
jg 0x48a647
mov edx, dword [esp + 0x10]
add edx, 0xa0
cmp eax, edx
jle 0x48a647
mov edx, dword [esp + 0x10]
add edx, 0xaf
cmp eax, edx
jge 0x48a647
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
add ecx, 0x14
mov dword [esp + 0x1c], ecx
mov ecx, esi
lea ebp, [eax + 0x23]
call fcn.00402880
mov edx, dword [esp + 0x1c]
push 0
push 0x4c6e2c
push ebp
lea eax, [edx + 1]
mov ecx, esi
push eax
call fcn.00402520
lea eax, [ebp + 1]
push 0
push 0x4c6e2c
push eax
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6e2c
push eax
lea eax, [ecx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6e2c
push ebp
push edx
jmp 0x48b066
lea edx, [ebx + 0xc2]
cmp ecx, edx
jl 0x48a71e
lea edx, [ebx + 0xf0]
cmp ecx, edx
jg 0x48a71e
mov edx, dword [esp + 0x10]
add edx, 0x142
cmp eax, edx
jl 0x48a71e
mov edx, dword [esp + 0x10]
add edx, 0x176
cmp eax, edx
jg 0x48a71e
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
add eax, 0x142
push 0x13
push eax
lea eax, [ebx + 0xc2]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
add edx, 0x14
lea ebp, [ecx + 0x23]
mov ecx, esi
mov dword [esp + 0x1c], edx
call fcn.00402880
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6e04
push ebp
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
lea eax, [ebp + 1]
push 0
push 0x4c6e04
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6e04
push eax
lea eax, [edx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0xffffff
push 0x4c6e04
push ebp
push eax
jmp 0x48b066
lea eax, [ebx + 0xf4]
cmp ecx, eax
jl 0x48b074
mov eax, dword [esp + 0x40]
lea ecx, [ebx + 0x122]
cmp eax, ecx
jg 0x48b074
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x44]
lea eax, [edx + 0x142]
cmp ecx, eax
jl 0x48b074
mov eax, edx
add eax, 0x176
cmp ecx, eax
jg 0x48b074
mov ecx, edx
push 0
push 0
push ebp
lea eax, [ecx + 0x142]
mov ecx, dword [edi + 0x3824c]
push 0x12
push eax
lea eax, [ebx + 0xf4]
push eax
call fcn.0049e020
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
add eax, 0x14
mov ecx, esi
lea ebp, [edx + 0x23]
mov dword [esp + 0x1c], eax
call fcn.00402880
mov ecx, dword [esp + 0x1c]
push 0
push 0x4c6de0
push ebp
lea eax, [ecx + 1]
mov ecx, esi
push eax
call fcn.00402520
mov edx, dword [esp + 0x1c]
lea eax, [ebp + 1]
push 0
push 0x4c6de0
push eax
push edx
mov ecx, esi
call fcn.00402520
push 0
lea eax, [ebp + 1]
push 0x4c6de0
push eax
mov eax, dword [esp + 0x28]
mov ecx, esi
inc eax
push eax
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6de0
push ebp
jmp 0x48b065
cmp eax, 1
jne 0x48b074
mov eax, dword [edi + 0x725d8]
test eax, eax
jne 0x48b074
mov ecx, dword [esp + 0x40]
lea eax, [ebx + 0x14]
cmp ecx, eax
jl 0x48a964
lea edx, [ebx + 0x42]
cmp ecx, edx
jg 0x48a964
mov eax, dword [esp + 0x10]
lea edx, [eax + 0xdc]
mov eax, dword [esp + 0x44]
cmp eax, edx
mov dword [esp + 0x14], edx
jl 0x48a968
mov edx, dword [esp + 0x10]
add edx, 0x10e
cmp eax, edx
jg 0x48a968
cmp dword [edi + 0x72f8c], 0xbb8
jl 0x48a87c
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
push 0xe
push eax
lea eax, [ebx + 0x14]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x40]
lea ebp, [ecx + 0x14]
mov ecx, esi
call fcn.00402880
mov edx, dword [esp + 0x44]
push 0
lea ecx, [ebp + 1]
push 0x4c6dc4
lea eax, [edx + 0x23]
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x44]
push 0
add eax, 0x24
push 0x4c6dc4
push eax
push ebp
mov ecx, esi
mov dword [esp + 0x38], eax
call fcn.00402520
mov ecx, dword [esp + 0x28]
push 0
push 0x4c6dc4
lea eax, [ebp + 1]
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x44]
push 0xffffff
push 0x4c6dc4
mov ecx, esi
lea eax, [edx + 0x23]
push eax
push ebp
call fcn.00402520
mov ecx, esi
call fcn.004028c0
mov eax, dword [esp + 0x44]
mov ecx, esi
add eax, 0x32
mov dword [esp + 0x1c], eax
call fcn.00402880
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6ea8
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
push 0x4c6ea8
mov ecx, esi
lea eax, [edx + 1]
push eax
push ebp
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6ea8
push eax
lea eax, [ebp + 1]
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6ea8
push ecx
push ebp
jmp 0x48b066
mov eax, dword [esp + 0x44]
lea edx, [ebx + 0x46]
cmp ecx, edx
jl 0x48aab5
lea edx, [ebx + 0x73]
cmp ecx, edx
jg 0x48aab5
mov edx, dword [esp + 0x10]
add edx, 0xdc
cmp eax, edx
mov dword [esp + 0x14], edx
jl 0x48aab5
mov edx, dword [esp + 0x10]
add edx, 0x10e
cmp eax, edx
jg 0x48aab5
cmp dword [edi + 0x72f8c], 0x7d0
jl 0x48a9cd
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
push 0xd
push eax
lea eax, [ebx + 0x46]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x40]
lea ebp, [ecx + 0x14]
mov ecx, esi
call fcn.00402880
mov edx, dword [esp + 0x44]
push 0
lea ecx, [ebp + 1]
push 0x4c234c
lea eax, [edx + 0x23]
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x44]
push 0
add eax, 0x24
push 0x4c234c
push eax
push ebp
mov ecx, esi
mov dword [esp + 0x38], eax
call fcn.00402520
mov ecx, dword [esp + 0x28]
push 0
push 0x4c234c
lea eax, [ebp + 1]
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x44]
push 0xffffff
push 0x4c234c
mov ecx, esi
lea eax, [edx + 0x23]
push eax
push ebp
call fcn.00402520
mov ecx, esi
call fcn.004028c0
mov eax, dword [esp + 0x44]
mov ecx, esi
add eax, 0x32
mov dword [esp + 0x1c], eax
call fcn.00402880
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6e94
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
push 0x4c6e94
mov ecx, esi
lea eax, [edx + 1]
push eax
push ebp
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6e94
push eax
lea eax, [ebp + 1]
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6e94
push ecx
push ebp
jmp 0x48b066
lea edx, [ebx + 0x78]
cmp ecx, edx
jl 0x48ac05
lea edx, [ebx + 0xa5]
cmp ecx, edx
jg 0x48ac05
mov edx, dword [esp + 0x10]
add edx, 0xdc
cmp eax, edx
mov dword [esp + 0x14], edx
jl 0x48ac05
mov edx, dword [esp + 0x10]
add edx, 0x10e
cmp eax, edx
jg 0x48ac05
cmp dword [edi + 0x72f8c], 0x3e8
jl 0x48ab1d
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
push 0xc
push eax
lea eax, [ebx + 0x78]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x40]
lea ebp, [ecx + 0x14]
mov ecx, esi
call fcn.00402880
mov edx, dword [esp + 0x44]
push 0
lea ecx, [ebp + 1]
push 0x4c2360
lea eax, [edx + 0x23]
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x44]
push 0
add eax, 0x24
push 0x4c2360
push eax
push ebp
mov ecx, esi
mov dword [esp + 0x38], eax
call fcn.00402520
mov ecx, dword [esp + 0x28]
push 0
push 0x4c2360
lea eax, [ebp + 1]
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x44]
push 0xffffff
push 0x4c2360
mov ecx, esi
lea eax, [edx + 0x23]
push eax
push ebp
call fcn.00402520
mov ecx, esi
call fcn.004028c0
mov eax, dword [esp + 0x44]
mov ecx, esi
add eax, 0x32
mov dword [esp + 0x1c], eax
call fcn.00402880
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6e80
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
push 0x4c6e80
mov ecx, esi
lea eax, [edx + 1]
push eax
push ebp
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6e80
push eax
lea eax, [ebp + 1]
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6e80
push ecx
push ebp
jmp 0x48b066
lea edx, [ebx + 0xaa]
cmp ecx, edx
jl 0x48ad5b
lea edx, [ebx + 0xd7]
cmp ecx, edx
jg 0x48ad5b
mov edx, dword [esp + 0x10]
add edx, 0xdc
cmp eax, edx
mov dword [esp + 0x14], edx
jl 0x48ad5b
mov edx, dword [esp + 0x10]
add edx, 0x10e
cmp eax, edx
jg 0x48ad5b
cmp dword [edi + 0x72f8c], 0x1388
jl 0x48ac73
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
push 0x1d
push eax
lea eax, [ebx + 0xaa]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x40]
lea ebp, [ecx + 0x14]
mov ecx, esi
call fcn.00402880
mov edx, dword [esp + 0x44]
push 0
lea ecx, [ebp + 1]
push 0x4bd350
lea eax, [edx + 0x23]
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x44]
push 0
add eax, 0x24
push 0x4bd350
push eax
push ebp
mov ecx, esi
mov dword [esp + 0x38], eax
call fcn.00402520
mov ecx, dword [esp + 0x28]
push 0
push 0x4bd350
lea eax, [ebp + 1]
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x44]
push 0xffffff
push 0x4bd350
mov ecx, esi
lea eax, [edx + 0x23]
push eax
push ebp
call fcn.00402520
mov ecx, esi
call fcn.004028c0
mov eax, dword [esp + 0x44]
mov ecx, esi
add eax, 0x32
mov dword [esp + 0x1c], eax
call fcn.00402880
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6e6c
push ecx
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
push 0x4c6e6c
mov ecx, esi
lea eax, [edx + 1]
push eax
push ebp
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6e6c
push eax
lea eax, [ebp + 1]
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6e6c
push ecx
push ebp
jmp 0x48b066
lea edx, [ebx + 0x14]
cmp ecx, edx
jl 0x48ae0a
lea edx, [ebx + 0x17c]
cmp ecx, edx
jg 0x48ae0a
mov edx, dword [esp + 0x10]
add edx, 0x8c
cmp eax, edx
jle 0x48ae0a
mov edx, dword [esp + 0x10]
add edx, 0xa0
cmp eax, edx
jge 0x48ae0a
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
add ecx, 0x14
mov dword [esp + 0x1c], ecx
mov ecx, esi
lea ebp, [eax + 0x23]
call fcn.00402880
mov edx, dword [esp + 0x1c]
push 0
push 0x4c6e48
push ebp
lea eax, [edx + 1]
mov ecx, esi
push eax
call fcn.00402520
lea eax, [ebp + 1]
push 0
push 0x4c6e48
push eax
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6e48
push eax
lea eax, [ecx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6e48
push ebp
push edx
jmp 0x48b066
lea edx, [ebx + 0x14]
cmp ecx, edx
jl 0x48aeb9
lea edx, [ebx + 0x17c]
cmp ecx, edx
jg 0x48aeb9
mov edx, dword [esp + 0x10]
add edx, 0xa0
cmp eax, edx
jle 0x48aeb9
mov edx, dword [esp + 0x10]
add edx, 0xaf
cmp eax, edx
jge 0x48aeb9
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
add ecx, 0x14
mov dword [esp + 0x1c], ecx
mov ecx, esi
lea ebp, [eax + 0x23]
call fcn.00402880
mov edx, dword [esp + 0x1c]
push 0
push 0x4c6e2c
push ebp
lea eax, [edx + 1]
mov ecx, esi
push eax
call fcn.00402520
lea eax, [ebp + 1]
push 0
push 0x4c6e2c
push eax
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6e2c
push eax
lea eax, [ecx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6e2c
push ebp
push edx
jmp 0x48b066
lea edx, [ebx + 0xc2]
cmp ecx, edx
jl 0x48af90
lea edx, [ebx + 0xf0]
cmp ecx, edx
jg 0x48af90
mov edx, dword [esp + 0x10]
add edx, 0x142
cmp eax, edx
jl 0x48af90
mov edx, dword [esp + 0x10]
add edx, 0x176
cmp eax, edx
jg 0x48af90
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
add eax, 0x142
push 0x13
push eax
lea eax, [ebx + 0xc2]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
add edx, 0x14
lea ebp, [ecx + 0x23]
mov ecx, esi
mov dword [esp + 0x1c], edx
call fcn.00402880
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6f44
push ebp
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
lea eax, [ebp + 1]
push 0
push 0x4c6f44
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6f44
push eax
lea eax, [edx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0xffffff
push 0x4c6f44
push ebp
push eax
jmp 0x48b066
lea eax, [ebx + 0xf4]
cmp ecx, eax
jl 0x48b074
mov eax, dword [esp + 0x40]
lea ecx, [ebx + 0x122]
cmp eax, ecx
jg 0x48b074
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x44]
lea eax, [edx + 0x142]
cmp ecx, eax
jl 0x48b074
mov eax, edx
add eax, 0x176
cmp ecx, eax
jg 0x48b074
mov ecx, edx
push 0
push 0
push ebp
lea eax, [ecx + 0x142]
mov ecx, dword [edi + 0x3824c]
push 0x12
push eax
lea eax, [ebx + 0xf4]
push eax
call fcn.0049e020
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
add eax, 0x14
mov ecx, esi
lea ebp, [edx + 0x23]
mov dword [esp + 0x1c], eax
call fcn.00402880
mov ecx, dword [esp + 0x1c]
push 0
push 0x4c6de0
push ebp
lea eax, [ecx + 1]
mov ecx, esi
push eax
call fcn.00402520
mov edx, dword [esp + 0x1c]
lea eax, [ebp + 1]
push 0
push 0x4c6de0
push eax
push edx
mov ecx, esi
call fcn.00402520
push 0
lea eax, [ebp + 1]
push 0x4c6de0
push eax
mov eax, dword [esp + 0x28]
mov ecx, esi
inc eax
push eax
call fcn.00402520
mov ecx, dword [esp + 0x1c]
push 0xffffff
push 0x4c6de0
push ebp
push ecx
mov ecx, esi
call fcn.00402520
mov ecx, esi
call fcn.004028c0
mov edx, dword [esp + 0x10]
mov ecx, esi
lea ebp, [edx + 0x50]
call fcn.00402880
mov eax, dword [esp + 0x10]
add ebp, 0xf
push ebp
lea ebp, [ebx + 0x143]
add eax, 0x50
push ebp
push eax
lea ecx, [esp + 0x38]
push ebx
push ecx
call dword [sym.imp.user32.dll_SetRect]
push 0
lea edx, [esp + 0x30]
push 0x4c6d90
push edx
mov ecx, esi
call fcn.004028e0
mov ecx, esi
call fcn.004028c0
mov ecx, esi
call fcn.00402880
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x2c]
add eax, 0x5f
lea ecx, [eax + 0xf]
push ecx
push ebp
push eax
push ebx
push edx
call dword [sym.imp.user32.dll_SetRect]
push 0
lea eax, [esp + 0x30]
push 0x4c6d6c
push eax
mov ecx, esi
call fcn.004028e0
mov ecx, esi
call fcn.004028c0
mov ecx, esi
call fcn.00402880
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 0x6e]
lea edx, [eax + 0xf]
push edx
push ebp
push eax
lea eax, [esp + 0x38]
push ebx
push eax
call dword [sym.imp.user32.dll_SetRect]
push 0
lea ecx, [esp + 0x30]
push 0x4c6d44
push ecx
mov ecx, esi
call fcn.004028e0
mov ecx, esi
call fcn.004028c0
mov eax, dword [edi + 0x1f24]
sub eax, 0
je 0x48b1d2
dec eax
jne case.default.0x48923a
mov ecx, esi
call fcn.00402880
mov edx, dword [esp + 0x10]
lea eax, [edx + 0x8c]
lea edx, [esp + 0x2c]
lea ecx, [eax + 0xf]
push ecx
push ebp
push eax
push ebx
push edx
call dword [sym.imp.user32.dll_SetRect]
push 0x320004
lea eax, [esp + 0x30]
push 0x4c6d38
push eax
mov ecx, esi
call fcn.004028e0
mov ecx, esi
call fcn.004028c0
mov ecx, dword [esp + 0x10]
add ecx, 0xa0
mov dword [esp + 0x28], ecx
mov ecx, esi
call fcn.00402880
mov eax, dword [esp + 0x28]
lea edx, [eax + 0xf]
push edx
push ebp
push eax
lea eax, [esp + 0x38]
push ebx
push eax
call dword [sym.imp.user32.dll_SetRect]
push 0xffffff
lea ecx, [esp + 0x30]
push 0x4c6d2c
push ecx
mov ecx, esi
call fcn.004028e0
mov ecx, esi
call fcn.004028c0
jmp case.default.0x48923a
mov ecx, esi
call fcn.00402880
mov edx, dword [esp + 0x10]
lea eax, [edx + 0x8c]
lea edx, [esp + 0x2c]
lea ecx, [eax + 0xf]
push ecx
push ebp
push eax
push ebx
push edx
call dword [sym.imp.user32.dll_SetRect]
push 0xffffff
lea eax, [esp + 0x30]
push 0x4c6d38
push eax
mov ecx, esi
call fcn.004028e0
mov ecx, esi
call fcn.004028c0
mov ecx, dword [esp + 0x10]
add ecx, 0xa0
mov dword [esp + 0x28], ecx
mov ecx, esi
call fcn.00402880
mov eax, dword [esp + 0x28]
lea edx, [eax + 0xf]
push edx
push ebp
push eax
lea eax, [esp + 0x38]
push ebx
push eax
call dword [sym.imp.user32.dll_SetRect]
push 0x320004
lea ecx, [esp + 0x30]
push 0x4c6d2c
push ecx
mov ecx, esi
call fcn.004028e0
mov ecx, esi
call fcn.004028c0
jmp case.default.0x48923a
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
lea esi, [edx + 0x154]
push ebp
lea eax, [ebx + 0xc2]
push 0x14
push esi
push eax
call fcn.0049e020
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
lea eax, [ebx + 0xf4]
push 4
push esi
push eax
call fcn.0049e020
lea esi, [edi + 0x7f1c]
mov ecx, esi
call fcn.00402880
mov eax, dword [esp + 0x10]
movsx edx, word [esp + 0x14]
add eax, 0x23
add edx, ebx
lea ecx, [eax + 0xf]
push ecx
push edx
push eax
lea eax, [esp + 0x38]
push ebx
push eax
call dword [sym.imp.user32.dll_SetRect]
push 0
lea ecx, [esp + 0x30]
push 0x4c6d04
push ecx
mov ecx, esi
call fcn.004028e0
mov ecx, esi
call fcn.004028c0
mov ecx, dword [esp + 0x40]
lea eax, [ebx + 0xc2]
cmp ecx, eax
jl 0x48b3be
lea edx, [ebx + 0xf0]
mov eax, ecx
cmp eax, edx
jg 0x48b3be
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x44]
lea edx, [ecx + 0x154]
cmp eax, edx
jl 0x48b3c6
lea edx, [ecx + 0x188]
cmp eax, edx
jg 0x48b3c6
push 0
mov eax, ecx
mov ecx, dword [edi + 0x3824c]
push 0
push ebp
add eax, 0x154
push 0x13
push eax
lea eax, [ebx + 0xc2]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
add edx, 0x14
lea ebp, [ecx + 0x23]
mov ecx, esi
mov dword [esp + 0x1c], edx
call fcn.00402880
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6f44
push ebp
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
lea eax, [ebp + 1]
push 0
push 0x4c6f44
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6f44
push eax
lea eax, [edx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0xffffff
push 0x4c6f44
push ebp
jmp 0x48b493
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x10]
lea edx, [ebx + 0xf4]
cmp dword [esp + 0x40], edx
jl 0x48b4a2
lea edx, [ebx + 0x122]
cmp dword [esp + 0x40], edx
jg 0x48b4a2
lea edx, [ecx + 0x154]
cmp eax, edx
jl 0x48b4a2
add ecx, 0x188
cmp eax, ecx
jg 0x48b4a2
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x3824c]
push 0
push 0
push ebp
add eax, 0x154
push 0x12
push eax
lea eax, [ebx + 0xf4]
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
add edx, 0x14
lea ebp, [ecx + 0x23]
mov ecx, esi
mov dword [esp + 0x1c], edx
call fcn.00402880
mov eax, dword [esp + 0x1c]
push 0
inc eax
push 0x4c6ce0
push ebp
push eax
mov ecx, esi
call fcn.00402520
mov ecx, dword [esp + 0x1c]
lea eax, [ebp + 1]
push 0
push 0x4c6ce0
push eax
push ecx
mov ecx, esi
call fcn.00402520
mov edx, dword [esp + 0x1c]
push 0
lea eax, [ebp + 1]
push 0x4c6ce0
push eax
lea eax, [edx + 1]
push eax
mov ecx, esi
call fcn.00402520
mov eax, dword [esp + 0x1c]
push 0xffffff
push 0x4c6ce0
push ebp
push eax
mov ecx, esi
call fcn.00402520
mov ecx, esi
call fcn.004028c0
mov ecx, dword [edi + 0x3824c]
test ecx, ecx
je 0x48b4c4
mov edx, dword [edi + 0x72578]
mov eax, dword [esp + 0x10]
push 0
push 0
push edx
push 0x15
push eax
push ebx
call fcn.0049e020
mov eax, dword [esp + 0x40]
lea ecx, [ebx + 0xf]
cmp eax, ecx
jl case.default.0x48923a
lea edx, [ebx + 0x127]
cmp eax, edx
jg case.default.0x48923a
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x44]
add eax, 0x3c
cmp ecx, eax
jl case.default.0x48923a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x44]
add ecx, 0x139
cmp eax, ecx
jg case.default.0x48923a
mov ecx, dword [edi + 0x3824c]
test ecx, ecx
je case.default.0x48923a
mov edx, dword [edi + 0x72578]
push edx
push 0x29
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
push eax
push edx
call fcn.004a13b0
mov al, byte [edi + 0x1ff6]
test al, al
jl 0x48b9e1
cmp al, 2
jle 0x48b536
cmp al, 4
jne 0x48b9e1
xor eax, eax
lea ecx, [edi + 0x735b0]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov ebp, 0x4bd870
mov esi, ecx
mov dl, byte [esi]
mov al, dl
cmp dl, byte [ebp]
jne 0x48b572
test al, al
je 0x48b56e
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x48b572
add esi, 2
add ebp, 2
test al, al
jne 0x48b54d
xor eax, eax
jmp 0x48b577
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x48b58d
mov eax, 0xfa
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
jmp 0x48b628
mov ebp, 0x4bd85c
mov esi, ecx
mov dl, byte [esi]
mov al, dl
cmp dl, byte [ebp]
jne 0x48b5b9
test al, al
je 0x48b5b5
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [ebp + 1]
jne 0x48b5b9
add esi, 2
add ebp, 2
test al, al
jne 0x48b594
xor eax, eax
jmp 0x48b5be
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x48b5d1
mov eax, 0xfa
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
jmp 0x48b628
mov ebp, 0x4bdaa0
mov esi, ecx
mov cl, byte [esi]
mov dl, byte [ebp]
mov al, cl
cmp cl, dl
jne 0x48b601
test al, al
je 0x48b5fd
mov dl, byte [esi + 1]
mov cl, byte [ebp + 1]
mov al, dl
cmp dl, cl
jne 0x48b601
add esi, 2
add ebp, 2
test al, al
jne 0x48b5d8
xor eax, eax
jmp 0x48b606
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x48b9e1
mov eax, 0x118
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov eax, 0x20c
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov ebp, dword [esp + 0x10]
lea eax, [edi + 0x5180]
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], 0x12c
mov ecx, dword [esp + 0x18]
cmp byte [ecx], 0
je case.0x48b6c4.40
mov edx, ecx
movsx ecx, word [esp + 0x14]
movsx eax, word [edx - 4]
movsx edx, word [esp + 0x24]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
mov dword [esp + 0x10], edx
fmulp st(1)
fild dword [esp + 0x10]
fdivp st(1)
call fcn.004a7234
movsx edx, word [esp + 0x1c]
mov esi, eax
mov eax, dword [esp + 0x18]
movsx ecx, word [eax - 2]
movsx eax, word [esp + 0x20]
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
mov dword [esp + 0x10], eax
fmulp st(1)
fild dword [esp + 0x10]
fdivp st(1)
call fcn.004a7234
mov ecx, dword [esp + 0x18]
movsx ecx, byte [ecx]
add ecx, 0xffffffdc
cmp ecx, 6
ja case.0x48b6c4.40
jmp dword [ecx*4 + 0x48bb20]
mov edx, dword [esp + 0x18]
mov cl, byte [edx + 1]
cmp cl, 1
mov ecx, dword [edi + 0x3824c]
jne 0x48b702
test ecx, ecx
je case.0x48b6c4.40
mov edx, dword [edi + 0x72578]
lea eax, [eax + ebp + 0x3c]
push edx
push 0x27
lea edx, [ebx + esi + 0xf]
push eax
push edx
call fcn.004a13b0
jmp case.0x48b6c4.40
test ecx, ecx
je case.0x48b6c4.40
mov edx, dword [edi + 0x72578]
lea eax, [eax + ebp + 0x3c]
push edx
push 0x25
lea edx, [ebx + esi + 0xf]
push eax
push edx
call fcn.004a13b0
jmp case.0x48b6c4.40
mov ecx, dword [esp + 0x18]
mov dl, byte [ecx + 1]
mov ecx, dword [edi + 0x3824c]
cmp dl, 1
jne 0x48b754
test ecx, ecx
je case.0x48b6c4.40
mov edx, dword [edi + 0x72578]
lea eax, [eax + ebp + 0x3c]
push edx
push 0x26
lea edx, [ebx + esi + 0xf]
push eax
push edx
call fcn.004a13b0
jmp case.0x48b6c4.40
test ecx, ecx
je case.0x48b6c4.40
mov edx, dword [edi + 0x72578]
lea eax, [eax + ebp + 0x3c]
push edx
push 0x24
lea edx, [ebx + esi + 0xf]
push eax
push edx
call fcn.004a13b0
jmp case.0x48b6c4.40
mov ecx, dword [edi + 0x3824c]
test ecx, ecx
je case.0x48b6c4.40
mov edx, dword [edi + 0x72578]
push 0
push 0
push edx
lea eax, [eax + ebp + 0x3c]
push 0x28
lea edx, [ebx + esi + 0xf]
push eax
push edx
call fcn.0049e020
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
add ecx, 6
dec eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x28], eax
jne 0x48b63e
mov eax, dword [edi + 0x72fa0]
cmp eax, 0xffffffff
mov dword [esp + 0x28], eax
je 0x48b85a
movsx eax, word [esp + 0x14]
fild dword [esp + 0x28]
movsx ecx, word [esp + 0x24]
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
mov dword [esp + 0x28], ecx
fmulp st(1)
fild dword [esp + 0x28]
fdivp st(1)
call fcn.004a7234
movsx edx, word [esp + 0x1c]
fild dword [edi + 0x72fa4]
mov esi, eax
mov dword [esp + 0x28], edx
movsx eax, word [esp + 0x20]
fild dword [esp + 0x28]
mov dword [esp + 0x28], eax
fmulp st(1)
fild dword [esp + 0x28]
fdivp st(1)
call fcn.004a7234
cmp byte [edi + 0x1ff6], 1
jne 0x48b838
cmp eax, 0x64
jl 0x48b838
cmp eax, 0x2d4
jg 0x48b838
mov ecx, dword [edi + 0x3824c]
test ecx, ecx
je 0x48b85a
jmp 0x48b842
mov ecx, dword [edi + 0x3824c]
test ecx, ecx
je 0x48b85a
mov edx, dword [edi + 0x72578]
lea eax, [eax + ebp + 0x3c]
push edx
push 0x2a
lea edx, [ebx + esi + 0xf]
push eax
push edx
call fcn.004a13b0
cmp byte [edi + 0x1ff6], 2
je 0x48b8ea
mov eax, dword [edi + 0x72f94]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
je 0x48b8ea
mov esi, dword [edi + 0x3824c]
test esi, esi
je 0x48b8ea
movsx ecx, word [esp + 0x1c]
fild dword [edi + 0x72f98]
movsx edx, word [esp + 0x20]
mov dword [esp + 0x28], ecx
mov eax, dword [edi + 0x72578]
fild dword [esp + 0x28]
mov dword [esp + 0x28], edx
push eax
fmulp st(1)
fild dword [esp + 0x2c]
push 0x29
fdivp st(1)
call fcn.004a7234
movsx ecx, word [esp + 0x1c]
fild dword [esp + 0x20]
movsx edx, word [esp + 0x2c]
mov dword [esp + 0x30], ecx
lea eax, [eax + ebp + 0x3c]
fild dword [esp + 0x30]
mov dword [esp + 0x30], edx
push eax
fmulp st(1)
fild dword [esp + 0x34]
fdivp st(1)
call fcn.004a7234
lea eax, [eax + ebx + 0xf]
mov ecx, esi
push eax
call fcn.004a13b0
mov eax, 0x4bdaa0
lea esi, [edi + 0x733bc]
mov dl, byte [esi]
mov cl, dl
cmp dl, byte [eax]
jne 0x48b919
test cl, cl
je 0x48b915
mov dl, byte [esi + 1]
mov cl, dl
cmp dl, byte [eax + 1]
jne 0x48b919
add esi, 2
add eax, 2
test cl, cl
jne 0x48b8f5
xor eax, eax
jmp 0x48b91e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x48b9e5
movsx eax, word [edi + 0x72fd6]
movsx ecx, word [esp + 0x14]
mov esi, dword [edi + 0x6ea9c]
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
movsx edx, word [esi + 0x93ab78]
mov dword [esp + 0x28], ecx
fild dword [esp + 0x28]
mov dword [esp + 0x28], edx
fmulp st(1)
fild dword [esp + 0x28]
fdivp st(1)
call fcn.004a7234
mov dword [esp + 0x24], eax
movsx eax, word [esi + 0x93ab7a]
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
fcom qword [0x4b72d8]
fnstsw ax
test ah, 0x40
je 0x48b988
fstp st(0)
fld qword [0x4b72d8]
mov esi, dword [edi + 0x3824c]
test esi, esi
je 0x48b9dd
movsx edx, word [edi + 0x72fd8]
movsx eax, word [esp + 0x1c]
mov dword [esp + 0x28], edx
mov ecx, dword [edi + 0x72578]
fild dword [esp + 0x28]
mov dword [esp + 0x28], eax
push 0
fild dword [esp + 0x2c]
push 0
push ecx
fmulp st(1)
push 0x2b
fdiv st(1)
call fcn.004a7234
mov edx, dword [esp + 0x34]
lea ecx, [eax + ebp + 0x3c]
push ecx
mov ecx, esi
lea eax, [ebx + edx + 0xf]
push eax
fstp st(0)
call fcn.0049e020
jmp 0x48b9e5
fstp st(0)
jmp 0x48b9e5
mov ebp, dword [esp + 0x10]
mov al, byte [edi + 0x1ff6]
test al, al
jl 0x48baff
cmp al, 1
jle 0x48b9ff
cmp al, 4
jne 0x48baff
mov eax, dword [esp + 0x40]
lea ecx, [ebx + 0xf]
cmp eax, ecx
jl 0x48baff
lea edx, [ebx + 0x127]
cmp eax, edx
jg 0x48baff
mov ecx, dword [esp + 0x44]
lea edx, [ebp + 0x3c]
cmp ecx, edx
jl 0x48baff
lea edx, [ebp + 0x139]
cmp ecx, edx
jg 0x48baff
sub eax, ebx
sub eax, 0xf
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
fmul qword [0x4b72d8]
fmul qword [0x4b72d0]
call fcn.004a7234
mov esi, eax
mov eax, dword [esp + 0x44]
sub eax, ebp
sub eax, 0x3c
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
fmul qword [0x4b72d8]
fmul qword [0x4b72d0]
call fcn.004a7234
cmp esi, 0x1e
jge 0x48ba85
mov esi, 0x1e
cmp eax, 0x1e
jge 0x48ba8f
mov eax, 0x1e
cmp esi, 0x20c
jle 0x48ba9c
mov esi, 0x20c
cmp eax, 0x20c
jle 0x48baa8
mov eax, 0x20c
push eax
lea ebx, [edi + 0x730ed]
push esi
push 0x4be070
push ebx
call dword [sym.imp.user32.dll_wsprintfA]
mov cx, word [edi + 0x73076]
mov dx, word [edi + 0x73056]
mov ax, word [edi + 0x73036]
add esp, 0x10
shl cx, 2
push 2
push 0
shl dx, 2
push ecx
mov ecx, dword [esp + 0x50]
push edx
mov edx, dword [esp + 0x50]
shl ax, 2
push eax
add ecx, 0xfffffff6
push ebx
add edx, 0xa
push ecx
push edx
mov ecx, edi
call fcn.004173d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8