Function at 0x434660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4e4
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x4fc]
lea eax, [esp + 0xb4]
push 0x20
push eax
push 0x2c
push 1
mov esi, ecx
push edi
mov dword [esp + 0x6c], 0
call fcn.00402750
lea ecx, [esp + 0xe8]
push 0x20
push ecx
push 0x2c
push 2
push edi
call fcn.00402750
lea edx, [esp + 0xc4]
push edx
push 0x2c
push 0
push edi
call fcn.00402a50
lea eax, [esp + 0x50]
push eax
push 0x2c
push 3
push edi
call fcn.00402a50
add esp, 0x48
lea ecx, [esp + 0x10]
push ecx
push 0x2c
push 4
push edi
call fcn.00402a50
lea edx, [esp + 0x3c]
push edx
push 0x2c
push 5
push edi
call fcn.00402a50
lea eax, [esp + 0x54]
push eax
push 0x2c
push 6
push edi
call fcn.00402a50
lea ecx, [esp + 0x70]
push ecx
push 0x2c
push 7
push edi
call fcn.00402a50
add esp, 0x40
lea edx, [esp + 0x44]
push edx
push 0x2c
push 8
push edi
call fcn.00402a50
lea eax, [esp + 0x2c]
push eax
push 0x2c
push 9
push edi
call fcn.00402a50
lea ecx, [esp + 0x70]
push ecx
push 0x2c
push 0xa
push edi
call fcn.00402a50
lea edx, [esp + 0xac]
push edx
push 0x2c
push 0xb
push edi
call fcn.00402a50
add esp, 0x40
lea eax, [esp + 0x48]
push eax
push 0x2c
push 0xc
push edi
call fcn.00402a50
lea ecx, [esp + 0x5c]
push ecx
push 0x2c
push 0xd
push edi
call fcn.00402a50
lea edx, [esp + 0x8c]
push edx
push 0x2c
push 0xe
push edi
call fcn.00402a50
lea eax, [esp + 0x94]
push eax
push 0x2c
push 0xf
push edi
call fcn.00402a50
add esp, 0x40
lea ecx, [esp + 0x80]
push ecx
push 0x2c
push 0x10
push edi
call fcn.00402a50
lea edx, [esp + 0x88]
push edx
push 0x2c
push 0x11
push edi
call fcn.00402a50
lea eax, [esp + 0x80]
push eax
push 0x2c
push 0x12
push edi
call fcn.00402a50
lea ecx, [esp + 0x8c]
push ecx
push 0x2c
push 0x13
push edi
call fcn.00402a50
mov ebx, dword [esp + 0xdc]
mov ecx, dword [esi + 0xa67413]
add esp, 0x40
lea edx, [esp + 0xb4]
add ebx, ecx
mov ecx, esi
push edx
mov dword [esp + 0x74], ebx
call fcn.00436ca0
and eax, 0xffff
lea ecx, [esp + 0xd4]
shl eax, 4
mov edi, eax
xor ebp, ebp
push ecx
mov ecx, esi
mov eax, dword [edi + 0x4d0d14]
mov bp, word [edi + 0x4d0d0c]
mov dword [esp + 0x2c], eax
call fcn.00436ce0
and eax, 0xffff
xor ecx, ecx
xor edx, edx
cmp ebp, 0x602
mov cx, word [eax*8 + 0x4d10ec]
mov dword [esp + 0x68], eax
mov dword [esp + 0x94], ecx
mov dword [esp + 0x74], edx
jg 0x435616
je 0x435661
cmp ebp, 0x4a1
jg 0x434cac
je case.0x434ccd.1286
cmp ebp, 0x203
jg 0x434a58
cmp ebp, 0x201
jge case.0x434ccd.1286
cmp ebp, 0x21
jg 0x434a22
je case.0x434ccd.1286
lea eax, [ebp - 1]
cmp eax, 6
ja case.default.0x435a40
xor edx, edx
mov dl, byte [eax + 0x436c64]
jmp dword [edx*4 + 0x436c5c]
mov ecx, dword [esp + 0x1c]
xor eax, eax
test ecx, ecx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x14], eax
jle 0x434997
jmp 0x4348cc
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x50]
jge 0x434997
mov edx, dword [esp + 0x28]
xor ecx, ecx
mov cl, byte [edx + esi + 0x5a6baa]
cmp ecx, eax
jne 0x4348f1
mov eax, dword [esi + 0x5a6796]
mov dword [esp + 0x30], eax
mov ecx, esi
call fcn.0041f410
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.0041f770
mov edx, dword [edi + 0x4d0d10]
lea ecx, [esi + 0xa5bea3]
mov eax, dword [esp + 0x44]
push 1
push ecx
mov ecx, dword [esp + 0x48]
push 0xb
push edx
mov edx, dword [esp + 0x44]
push 0x10
push ebx
push 1
push 1
push 0x211
push eax
mov eax, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x48]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0041f450
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x4c]
add edx, ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x6c]
add eax, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x64]
add ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x1c]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x4348c8
xor ecx, ecx
add ebp, 0xfffffffa
mov cl, byte [esi + 0x5a6bab]
cmp ebp, ecx
jne 0x4349f4
mov eax, dword [esp + 0x30]
cmp eax, 0xffffffff
jle 0x4349f4
mov ebx, eax
push 2
shl eax, 5
sub eax, ebx
lea eax, [eax + eax*2]
shl eax, 4
add eax, ebx
lea edx, [eax + eax*2]
lea eax, [esi + edx*2]
lea ecx, [eax + 0x2ab11e]
mov byte [eax + 0x2ac036], 1
call fcn.0041ba40
mov eax, dword [edi + 0x4d0d10]
mov ecx, dword [esp + 0x4f8]
push ebx
push eax
push ecx
push 0x211
mov ecx, esi
call fcn.0041f980
mov al, byte [esi + 0x5a6baa]
test al, al
je case.default.0x435a40
push 0
push 0x700006
mov ecx, esi
call fcn.0041fba0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
cmp ebp, 0xff
je case.0x434ccd.1286
cmp ebp, 0x100
jle case.default.0x435a40
cmp ebp, 0x102
jle case.0x434ccd.1286
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
cmp ebp, 0x206
jg 0x434c6a
je case.0x434ccd.1286
sub ebp, 0x204
je 0x434b4b
dec ebp
jne case.default.0x435a40
mov eax, dword [esp + 0x1c]
xor ebp, ebp
test eax, eax
jle case.default.0x435a40
cmp ebp, dword [esp + 0x50]
jge case.default.0x435a40
mov ecx, esi
call fcn.0041f410
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.0041f770
mov eax, dword [edi + 0x4d0d10]
mov ecx, dword [esp + 0x4f8]
lea edx, [esi + 0xa5bea3]
push 1
push edx
mov edx, dword [esp + 0x4c]
push 0xb
push eax
mov eax, dword [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x48]
push ebx
push 1
push 1
push 0x200
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x48]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0041f450
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
add eax, edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4c]
add ecx, eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x6c]
add edx, ecx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x64]
add eax, edx
inc ebp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x1c]
cmp ebp, eax
jl 0x434a8b
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
mov al, byte [esi + 0x5a6796]
xor ebx, ebx
mov byte [esi + 0x5a6be0], al
mov eax, dword [esp + 0x1c]
test eax, eax
jle case.default.0x435a40
cmp ebx, dword [esp + 0x50]
jge case.default.0x435a40
mov ecx, dword [esp + 0x28]
xor eax, eax
lea edx, [ebx + ecx]
mov al, byte [edx + esi + 0x5a6baa]
mov dword [esp + 0x58], eax
fild dword [esp + 0x58]
fmul dword [0x4b656c]
fild dword [esp + 0x60]
fmul st(1)
call fcn.004a74cc
fild dword [esp + 0x5c]
mov ebp, eax
fmul st(1)
call fcn.004a74cc
mov ecx, esi
mov dword [esp + 0x68], eax
fstp st(0)
call fcn.0041f410
mov edx, dword [edi + 0x4d0d10]
lea ecx, [esi + 0xa5bea3]
push 0
push ecx
mov ecx, dword [esp + 0x78]
push 0xb
lea eax, [ebx + 0x700]
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x4c]
push 1
push 1
push 0x200
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x98]
push edx
mov edx, dword [esp + 0x4c]
add ecx, eax
add ebp, edx
push ecx
push ebp
mov ecx, esi
call fcn.0041f450
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
push 1
add ecx, eax
push 0x221
push ecx
mov ecx, dword [esp + 0x24]
add edx, ecx
push edx
push eax
push ecx
mov ecx, esi
call fcn.0041f510
mov eax, dword [esp + 0x48]
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x10]
add ebp, eax
mov eax, dword [esp + 0x1c]
add edx, ecx
inc ebx
cmp ebx, eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], edx
jl 0x434b65
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
cmp ebp, 0x405
jg case.default.0x435a40
cmp ebp, 0x401
jge case.0x434ccd.1286
cmp ebp, 0x301
jl case.default.0x435a40
cmp ebp, 0x302
jle case.0x434ccd.1286
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
cmp ebp, 0x601
jg case.default.0x435a40
je 0x435662
lea eax, [ebp - 0x501]
cmp eax, 8
ja case.default.0x435a40
jmp dword [eax*4 + 0x436c6c]
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp ecx, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
jle case.default.0x435a40
jmp 0x434cf4
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x7c]
jge case.default.0x435a40
mov ebx, eax
mov ebp, eax
mov edx, eax
imul eax, dword [esp + 0x5c]
imul edx, dword [esp + 0x60]
imul ebx, dword [esp + 0x80]
imul ebp, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x38], edx
mov edx, dword [esi + 0x5a6796]
cmp eax, ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x20], 0
jge 0x434e37
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
cmp edx, dword [esp + 0x50]
jge 0x434e37
mov ecx, eax
shl ecx, 6
add ecx, eax
lea edx, [eax + ecx*2]
mov eax, dword [esi + edx*2 + 0x79c90f]
test eax, eax
je 0x434d7a
mov eax, dword [esp + 0x20]
test eax, eax
je 0x434d7a
mov eax, dword [esi + 0x5a6796]
mov dword [esp + 0x30], eax
mov ecx, esi
call fcn.0041f410
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.0041f770
mov eax, dword [esp + 0x14]
mov edx, dword [edi + 0x4d0d10]
lea ecx, [esi + 0xa5bea3]
push 1
push ecx
mov ecx, dword [esp + 0x78]
push 0xb
add eax, 0x100
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x4c]
push 1
push 1
push 0x211
push edx
mov edx, dword [esp + 0x64]
push eax
mov eax, dword [esp + 0x58]
add edx, ecx
mov ecx, dword [esp + 0x64]
push edx
mov edx, dword [esp + 0x40]
add ecx, eax
push ecx
mov ecx, dword [esp + 0x4c]
lea eax, [edx + ebp]
lea edx, [ebx + ecx]
push eax
push edx
mov ecx, esi
call fcn.0041f450
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x38]
add ebx, eax
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x4c]
add ecx, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x64]
add ebp, edx
add eax, ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
inc eax
inc ecx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x434d41
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x434e94
mov eax, ebx
push 2
shl eax, 5
sub eax, ebx
lea eax, [eax + eax*2]
shl eax, 4
add eax, ebx
lea edx, [eax + eax*2]
lea eax, [esi + edx*2]
lea ecx, [eax + 0x2ab11e]
mov byte [eax + 0x2ac036], 1
call fcn.0041ba40
mov ecx, dword [esp + 0x14]
mov eax, dword [edi + 0x4d0d10]
push ebx
add ecx, 0x100
push eax
push ecx
push 0x211
mov ecx, esi
call fcn.0041f980
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
inc edx
cmp eax, ecx
mov dword [esp + 0x14], edx
jl 0x434cf0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
mov eax, dword [esp + 0x1c]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x28], ebx
jle case.default.0x435a40
cmp ebx, dword [esp + 0x50]
jge case.default.0x435a40
mov edx, dword [esp + 0x28]
lea eax, [ebx + edx]
mov ecx, eax
shl ecx, 6
add ecx, eax
lea edx, [eax + ecx*2]
lea ecx, [esi + edx*2 + 0x79c84b]
call fcn.0044baa0
mov dword [esp + 0x58], eax
fild dword [esp + 0x58]
fmul dword [0x4b6580]
fild dword [esp + 0x60]
fmul st(1)
call fcn.004a74cc
fild dword [esp + 0x5c]
mov ebp, eax
fmul st(1)
call fcn.004a74cc
mov ecx, esi
mov dword [esp + 0x68], eax
fstp st(0)
call fcn.0041f410
mov ecx, dword [edi + 0x4d0d10]
lea eax, [esi + 0xa5bea3]
push 0
push eax
mov eax, dword [esp + 0x78]
push 0xb
lea edx, [ebx + 0x200]
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x4c]
push 1
push 1
push 0x200
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x4c]
add eax, edx
add ebp, ecx
push eax
push ebp
mov ecx, esi
call fcn.0041f450
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x18]
push 1
add edx, eax
push 0x221
push edx
mov edx, dword [esp + 0x6c]
add edx, ecx
push edx
push eax
push ecx
mov ecx, esi
call fcn.0041f510
mov eax, dword [esp + 0x48]
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x10]
add ebp, eax
mov eax, dword [esp + 0x1c]
add edx, ecx
inc ebx
cmp ebx, eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], edx
jl 0x434ecd
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp ecx, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
jle case.default.0x435a40
jmp 0x434fff
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x7c]
jge case.default.0x435a40
mov ebx, eax
mov ebp, eax
mov edx, eax
imul eax, dword [esp + 0x5c]
imul edx, dword [esp + 0x60]
imul ebx, dword [esp + 0x80]
imul ebp, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x38], edx
mov edx, dword [esi + 0x5a6796]
cmp eax, ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x20], 0
jge 0x435140
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
cmp edx, dword [esp + 0x50]
jge 0x435140
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + ecx*4 + 0x79ce73]
test eax, eax
je 0x435082
mov eax, edx
test eax, eax
je 0x435082
mov edx, dword [esi + 0x5a6796]
mov dword [esp + 0x30], edx
mov ecx, esi
call fcn.0041f410
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.0041f770
mov edx, dword [esp + 0x14]
mov ecx, dword [edi + 0x4d0d10]
lea eax, [esi + 0xa5bea3]
push 1
push eax
mov eax, dword [esp + 0x78]
push 0xb
add edx, 0x110
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x4c]
push 1
push 1
push 0x211
push ecx
mov ecx, dword [esp + 0x64]
push edx
mov edx, dword [esp + 0x58]
add ecx, eax
mov eax, dword [esp + 0x64]
push ecx
mov ecx, dword [esp + 0x40]
add eax, edx
push eax
mov eax, dword [esp + 0x4c]
lea edx, [ecx + ebp]
lea ecx, [ebx + eax]
push edx
push ecx
mov ecx, esi
call fcn.0041f450
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x4c]
add ebx, edx
mov edx, dword [esp + 0x6c]
add ebp, ecx
mov ecx, dword [esp + 0x3c]
add eax, edx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x64]
add ecx, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x20]
inc eax
inc ecx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x43504c
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x43519c
mov eax, ebx
push 2
shl eax, 5
sub eax, ebx
lea eax, [eax + eax*2]
shl eax, 4
add eax, ebx
lea ecx, [eax + eax*2]
lea eax, [esi + ecx*2]
lea ecx, [eax + 0x2ab11e]
mov byte [eax + 0x2ac036], 1
call fcn.0041ba40
mov eax, dword [esp + 0x14]
mov edx, dword [edi + 0x4d0d10]
push ebx
add eax, 0x110
push edx
push eax
push 0x211
mov ecx, esi
call fcn.0041f980
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
inc edx
cmp eax, ecx
mov dword [esp + 0x14], edx
jl 0x434ffb
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
mov eax, dword [esp + 0x1c]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x28], ebx
jle case.default.0x435a40
cmp ebx, dword [esp + 0x50]
jge case.default.0x435a40
mov ecx, dword [esp + 0x28]
lea eax, [ebx + ecx]
lea edx, [eax*8]
sub edx, eax
lea ecx, [esi + edx*4 + 0x79ce6f]
call fcn.0044be90
mov dword [esp + 0x58], eax
fild dword [esp + 0x58]
fmul dword [0x4b6580]
fild dword [esp + 0x60]
fmul st(1)
call fcn.004a74cc
fild dword [esp + 0x5c]
mov ebp, eax
fmul st(1)
call fcn.004a74cc
mov ecx, esi
mov dword [esp + 0x68], eax
fstp st(0)
call fcn.0041f410
mov ecx, dword [edi + 0x4d0d10]
lea eax, [esi + 0xa5bea3]
push 0
push eax
mov eax, dword [esp + 0x78]
push 0xb
lea edx, [ebx + 0x210]
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x4c]
push 1
push 1
push 0x200
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x4c]
add eax, edx
add ebp, ecx
push eax
push ebp
mov ecx, esi
call fcn.0041f450
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x18]
push 1
add edx, eax
push 0x221
push edx
mov edx, dword [esp + 0x6c]
add edx, ecx
push edx
push eax
push ecx
mov ecx, esi
call fcn.0041f510
mov eax, dword [esp + 0x48]
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x10]
add ebp, eax
mov eax, dword [esp + 0x1c]
add edx, ecx
inc ebx
cmp ebx, eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], edx
jl 0x4351d5
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
mov ebx, 4
jmp 0x4352f8
mov ebx, 3
jmp 0x4352f8
mov ebx, dword [esp + 0x58]
mov edx, dword [esp + 0x1c]
xor eax, eax
cmp edx, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
jle case.default.0x435a40
mov ecx, dword [esp + 0x4f8]
add ebx, ecx
mov dword [esp + 0x74], ebx
mov ebx, 0x300
sub ebx, ecx
mov dword [esp + 0x58], ebx
jmp 0x43532c
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x7c]
jge case.default.0x435a40
mov ebx, eax
mov ebp, eax
mov ecx, eax
imul eax, dword [esp + 0x5c]
imul ecx, dword [esp + 0x60]
imul ebx, dword [esp + 0x80]
imul ebp, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
cmp eax, edx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x20], 0
jge 0x4354be
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x50]
cmp eax, ecx
jge 0x4354be
mov eax, dword [esp + 0x68]
test eax, eax
jne 0x4353a8
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, byte [edx + esi + 0x5a6baa]
cmp ecx, eax
jne 0x4353b2
mov eax, dword [esi + 0x5a6796]
mov dword [esp + 0x30], eax
jmp 0x4353b2
mov ecx, dword [esi + 0x5a6796]
mov dword [esp + 0x30], ecx
mov ecx, esi
call fcn.0041f410
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.0041f770
mov eax, dword [edi + 0x4d0d10]
mov ecx, dword [esp + 0x58]
lea edx, [esi + 0xa5bea3]
push 1
push edx
mov edx, dword [esp + 0x7c]
push 0xb
push eax
mov eax, dword [esp + 0x80]
add ecx, edx
mov edx, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0xa8]
push eax
mov eax, dword [esp + 0x58]
push 1
push 1
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x64]
push eax
mov eax, dword [esp + 0x58]
add edx, ecx
mov ecx, dword [esp + 0x64]
push edx
mov edx, dword [esp + 0x40]
add ecx, eax
push ecx
mov ecx, dword [esp + 0x4c]
lea eax, [edx + ebp]
lea edx, [ebx + ecx]
push eax
push edx
mov ecx, esi
call fcn.0041f450
mov eax, dword [esp + 0x68]
test eax, eax
je 0x435478
mov eax, dword [esp + 0x28]
mov cl, byte [eax + esi + 0x5a6baa]
test cl, cl
je 0x435474
mov ecx, dword [esp + 0x30]
push 2
mov eax, ecx
shl eax, 5
sub eax, ecx
lea eax, [eax + eax*2]
shl eax, 4
add eax, ecx
lea ecx, [eax + eax*2]
lea eax, [esi + ecx*2]
lea ecx, [eax + 0x2ab11e]
mov byte [eax + 0x2ac036], 1
call fcn.0041ba40
inc dword [esp + 0x28]
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x38]
add ebx, edx
mov edx, dword [esp + 0x6c]
mov ecx, dword [esp + 0x4c]
add eax, edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x64]
add ebp, ecx
add edx, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x20]
inc eax
inc edx
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x1c]
cmp eax, edx
mov dword [esp + 0x24], eax
jl 0x43536f
mov eax, dword [esp + 0x68]
test eax, eax
jne 0x435519
mov ebx, dword [esp + 0x30]
push 2
mov eax, ebx
shl eax, 5
sub eax, ebx
lea eax, [eax + eax*2]
shl eax, 4
add eax, ebx
lea ecx, [eax + eax*2]
lea eax, [esi + ecx*2]
lea ecx, [eax + 0x2ab11e]
mov byte [eax + 0x2ac036], 1
call fcn.0041ba40
mov edx, dword [edi + 0x4d0d10]
mov eax, dword [esp + 0x74]
push ebx
push edx
push eax
push 0x211
mov ecx, esi
call fcn.0041f980
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x24]
inc ebx
inc ecx
cmp eax, edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x74], ecx
jl 0x435328
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
mov eax, dword [esp + 0x1c]
xor ebp, ebp
test eax, eax
jle case.default.0x435a40
cmp ebp, dword [esp + 0x50]
jge case.default.0x435a40
mov ecx, esi
call fcn.0041f410
push 0
push 0
push 0
push 0x63
mov ecx, esi
call fcn.0041f770
mov edx, dword [edi + 0x4d0d10]
lea ecx, [esi + 0xa5bea3]
push 1
push ecx
mov ecx, dword [esp + 0x4c]
push 0xb
lea eax, [ebp + 0x3f0]
push edx
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x48]
push ebx
push 1
push 1
push 0x200
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x48]
push ecx
push edx
push eax
mov ecx, esi
call fcn.0041f450
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
add edx, ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x4c]
add eax, edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
add ecx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x64]
add edx, ecx
inc ebp
test eax, eax
mov dword [esp + 0x34], edx
jg 0x435557
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
cmp ebp, 0x1008
jg 0x435a47
je 0x435a80
cmp ebp, 0x1003
jg 0x435a31
je 0x435a85
cmp ebp, 0x621
jg 0x435a14
je 0x435845
sub ebp, 0x603
je 0x435660
dec ebp
jne case.default.0x435a40
mov edx, 1
inc edx
inc edx
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp ecx, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
jle case.default.0x435a40
add edx, 0x400
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], edx
jmp 0x43568c
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x7c]
jge case.default.0x435a40
mov ebx, eax
mov ebp, eax
mov edx, eax
imul eax, dword [esp + 0x5c]
imul edx, dword [esp + 0x60]
imul ebx, dword [esp + 0x80]
imul ebp, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x20], 0
jge 0x4357b4
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x50]
cmp edx, eax
jge 0x4357b4
mov ecx, dword [esp + 0x28]
xor eax, eax
mov al, byte [ecx + esi + 0x5a6baa]
mov ecx, edx
cmp eax, ecx
jne 0x4356fc
mov edx, dword [esi + 0x5a6796]
mov dword [esp + 0x30], edx
mov ecx, esi
call fcn.0041f410
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.0041f770
mov ecx, dword [edi + 0x4d0d10]
mov edx, dword [esp + 0x54]
lea eax, [esi + 0xa5bea3]
push 1
push eax
mov eax, dword [esp + 0x78]
push 0xb
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x4c]
push 1
push 1
push 0x211
push ecx
mov ecx, dword [esp + 0x64]
push edx
mov edx, dword [esp + 0x58]
add ecx, eax
mov eax, dword [esp + 0x64]
add eax, edx
push ecx
mov ecx, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x4c]
lea edx, [ecx + ebp]
lea ecx, [ebx + eax]
push edx
push ecx
mov ecx, esi
call fcn.0041f450
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x4c]
add ebx, edx
mov edx, dword [esp + 0x6c]
add ebp, ecx
mov ecx, dword [esp + 0x3c]
add eax, edx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x64]
add ecx, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x20]
inc eax
inc ecx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x4356cf
mov eax, dword [esp + 0x68]
test eax, eax
jne 0x435815
mov ebx, dword [esp + 0x30]
push 2
mov eax, ebx
shl eax, 5
sub eax, ebx
lea eax, [eax + eax*2]
shl eax, 4
add eax, ebx
lea ecx, [eax + eax*2]
lea eax, [esi + ecx*2]
lea ecx, [eax + 0x2ab11e]
mov byte [eax + 0x2ac036], 1
call fcn.0041ba40
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x14]
mov edx, dword [edi + 0x4d0d10]
push ebx
add eax, ecx
push edx
push eax
push 0x211
mov ecx, esi
call fcn.0041f980
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x24]
inc ebx
inc edx
cmp eax, ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x54], edx
jl 0x435688
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp ecx, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
jle case.default.0x435a40
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x7c]
cmp edx, eax
jge case.default.0x435a40
mov eax, edx
imul edx, dword [esp + 0x60]
mov ebx, eax
mov ebp, eax
imul eax, dword [esp + 0x5c]
imul ebx, dword [esp + 0x80]
imul ebp, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x20], 0
jge 0x43598c
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x50]
cmp eax, edx
jge 0x43598c
mov edx, dword [esp + 0x28]
xor ecx, ecx
mov cl, byte [edx + esi + 0x5a6baa]
cmp ecx, eax
jne 0x4358cf
mov eax, dword [esi + 0x5a6796]
mov dword [esp + 0x30], eax
mov ecx, esi
call fcn.0041f410
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.0041f770
mov eax, dword [esp + 0x14]
mov edx, dword [edi + 0x4d0d10]
lea ecx, [esi + 0xa5bea3]
push 1
push ecx
mov ecx, dword [esp + 0x78]
push 0xb
add eax, 0x800
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x4c]
push 1
push 1
push 0x211
push edx
mov edx, dword [esp + 0x64]
push eax
mov eax, dword [esp + 0x58]
add edx, ecx
mov ecx, dword [esp + 0x64]
push edx
mov edx, dword [esp + 0x40]
add ecx, eax
push ecx
mov ecx, dword [esp + 0x4c]
lea eax, [edx + ebp]
lea edx, [ebx + ecx]
push eax
push edx
mov ecx, esi
call fcn.0041f450
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x38]
add ebx, eax
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x4c]
add ecx, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x64]
add ebp, edx
add eax, ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
inc eax
inc ecx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x4358a4
mov eax, dword [esp + 0x68]
test eax, eax
jne 0x4359ed
mov ebx, dword [esp + 0x30]
push 2
mov eax, ebx
shl eax, 5
sub eax, ebx
lea eax, [eax + eax*2]
shl eax, 4
add eax, ebx
lea edx, [eax + eax*2]
lea eax, [esi + edx*2]
lea ecx, [eax + 0x2ab11e]
mov byte [eax + 0x2ac036], 1
call fcn.0041ba40
mov ecx, dword [esp + 0x14]
mov eax, dword [edi + 0x4d0d10]
push ebx
add ecx, 0x800
push eax
push ecx
push 0x211
mov ecx, esi
call fcn.0041f980
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
inc edx
cmp eax, ecx
mov dword [esp + 0x14], edx
jl 0x43585b
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
sub ebp, 0x1001
je 0x435a8b
dec ebp
je 0x435a86
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
lea eax, [ebp - 0x1004]
cmp eax, 3
ja case.default.0x435a40
jmp dword [eax*4 + 0x436c90]
cmp ebp, 0x2101
jg 0x4368a7
je 0x4368d7
cmp ebp, 0x1010
jg 0x4365fc
je 0x436427
sub ebp, 0x1009
je 0x435a7f
dec ebp
jne case.default.0x435a40
mov edx, 1
inc edx
inc edx
inc edx
inc edx
inc edx
inc edx
inc edx
inc edx
mov dword [esp + 0x74], edx
lea edx, [esp + 0xf4]
push 0x400
push edx
push str.PLAY_SWITCH
lea ecx, [esi + 0x2a9c6c]
push str.CHARACTER
mov dword [esp + 0x38], 0
mov dword [esp + 0x68], 0x3f800000
call fcn.00407b80
lea eax, [esp + 0x28]
lea ecx, [esp + 0xf4]
push eax
push 0x2c
push 0
push ecx
call fcn.00402a50
mov eax, dword [esp + 0x38]
add esp, 0x10
test eax, eax
je 0x4360fd
lea edx, [esp + 0x9c]
lea eax, [esp + 0xf4]
push edx
push 0x2c
push 1
push eax
call fcn.00402a50
lea ecx, [esp + 0xb8]
lea edx, [esp + 0x104]
push ecx
push 0x2c
push 2
push edx
call fcn.00402a50
lea eax, [esp + 0xb8]
lea ecx, [esp + 0x114]
push eax
push 0x2c
push 3
push ecx
call fcn.00402a50
lea edx, [esp + 0xc4]
lea eax, [esp + 0x124]
push edx
push 0x2c
push 4
push eax
call fcn.00402a50
add esp, 0x40
lea ecx, [esp + 0x2c]
lea edx, [esp + 0xf4]
push ecx
push 0x2c
push 5
push edx
call fcn.00402a50
lea eax, [esp + 0x44]
lea ecx, [esp + 0x104]
push eax
push 0x2c
push 6
push ecx
call fcn.00402a50
lea edx, [esp + 0x60]
lea eax, [esp + 0x114]
push edx
push 0x2c
push 7
push eax
call fcn.00402a50
lea ecx, [esp + 0x74]
lea edx, [esp + 0x124]
push ecx
push 0x2c
push 8
push edx
call fcn.00402a50
add esp, 0x40
lea eax, [esp + 0xa0]
lea ecx, [esp + 0xf4]
push eax
push 0x2c
push 9
push ecx
call fcn.00402a50
lea edx, [esp + 0xc0]
lea eax, [esp + 0x104]
push edx
push 0x2c
push 0xa
push eax
call fcn.00402a50
lea ecx, [esp + 0xcc]
lea edx, [esp + 0x114]
push ecx
push 0x2c
push 0xb
push edx
call fcn.00402a50
lea eax, [esp + 0xd4]
push eax
push 0x2c
lea ecx, [esp + 0x12c]
push 0xc
push ecx
call fcn.00402a50
add esp, 0x40
lea edx, [esp + 0x6c]
lea eax, [esp + 0xf4]
push edx
push 0x2c
push 0xd
push eax
call fcn.00402a50
lea ecx, [esp + 0x74]
lea edx, [esp + 0x104]
push ecx
push 0x2c
push 0xe
push edx
call fcn.00402a50
lea eax, [esp + 0x80]
lea ecx, [esp + 0x114]
push eax
push 0x2c
push 0xf
push ecx
call fcn.00402a50
lea edx, [esp + 0x8c]
lea eax, [esp + 0x124]
push edx
push 0x2c
push 0x10
push eax
call fcn.00402a50
mov eax, dword [esp + 0xdc]
mov edx, dword [esi + 0xa67413]
add eax, edx
xor edx, edx
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0xe8]
add esp, 0x40
sub eax, edx
je 0x435f2e
dec eax
jne 0x4360fd
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp ecx, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
jle 0x4360fd
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x7c]
cmp eax, edx
jge 0x4360fd
mov edx, eax
mov dword [esp + 0x20], 0
imul edx, dword [esp + 0x80]
mov dword [esp + 0x84], edx
mov edx, eax
imul edx, dword [esp + 0x78]
mov dword [esp + 0x68], edx
mov edx, eax
imul eax, dword [esp + 0x5c]
imul edx, dword [esp + 0x60]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov dword [esp + 0x38], edx
jge 0x435f14
mov edx, eax
mov eax, dword [esp + 0x74]
add edx, eax
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x50]
cmp edx, eax
jge 0x435f14
mov ebp, dword [esp + 0x98]
mov ebx, dword [esp + 0x94]
xor eax, eax
mov dword [esp + 0x88], 2
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov eax, dword [esi + 0x5a6796]
mov dword [esp + 0x30], eax
mov ecx, esi
call fcn.0041f410
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.0041f770
mov edx, dword [esp + 0x54]
mov ecx, dword [edi + 0x4d0d10]
lea eax, [esi + 0xa5bea3]
push 1
push eax
push 0xb
lea eax, [edx + 0x600]
push ecx
mov ecx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x84]
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0xa8]
push 1
push 1
push 0x211
push ecx
mov ecx, dword [esp + 0x64]
push edx
mov edx, dword [esp + 0xb8]
add eax, ecx
mov ecx, dword [esp + 0x60]
add eax, ecx
mov ecx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x68]
add edx, eax
mov eax, dword [esp + 0xb4]
add edx, ecx
mov ecx, dword [esp + 0x98]
push edx
lea edx, [ebx + ecx]
mov ecx, dword [esp + 0x44]
add edx, ecx
lea ecx, [eax + ebp]
push edx
mov edx, dword [esp + 0x50]
add ecx, edx
push ecx
mov ecx, esi
call fcn.0041f450
mov edx, dword [esp + 0xa0]
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0xb0]
add ebp, edx
mov edx, dword [esp + 0xac]
add ebx, ecx
mov ecx, dword [esp + 0x90]
add eax, edx
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0xa4]
add ecx, eax
mov eax, dword [esp + 0x88]
dec eax
mov dword [esp + 0x90], ecx
mov dword [esp + 0x88], eax
jne 0x435d53
mov edx, dword [esp + 0x54]
lea ecx, [esp + 0x58]
push ecx
push edx
lea ecx, [esi + 0xaa48a3]
call fcn.0044cfb0
mov ebx, dword [esp + 0x30]
test eax, eax
je 0x435e65
inc ebx
cmp ebx, 0xffffffff
jle 0x435eaf
mov eax, ebx
push 2
shl eax, 5
sub eax, ebx
lea eax, [eax + eax*2]
shl eax, 4
add eax, ebx
lea eax, [eax + eax*2]
lea eax, [esi + eax*2]
lea ecx, [eax + 0x2ab11e]
mov byte [eax + 0x2ac036], 1
call fcn.0041ba40
mov ecx, dword [edi + 0x4d0d10]
mov edx, dword [esp + 0x4f8]
push ebx
push ecx
push edx
push 0x211
mov ecx, esi
call fcn.0041f980
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x6c]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x68]
add ecx, eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x4c]
add ebx, edx
mov edx, dword [esp + 0x3c]
add ebp, ecx
mov ecx, dword [esp + 0x1c]
add edx, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x68], ebp
mov ebp, dword [esp + 0x54]
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0x20]
inc eax
inc ebp
inc ebx
cmp eax, ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x54], ebp
mov dword [esp + 0x20], ebx
jl 0x435d10
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
inc edx
cmp eax, ecx
mov dword [esp + 0x14], edx
jl 0x435cb0
jmp 0x4360fd
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], edx
cmp ecx, edx
mov dword [esp + 0x14], edx
jle 0x4360fd
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x7c]
cmp eax, edx
jge 0x4360fd
mov ebx, eax
mov ebp, eax
mov edx, eax
imul eax, dword [esp + 0x5c]
imul edx, dword [esp + 0x60]
imul ebx, dword [esp + 0x80]
imul ebp, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x20], 0
jge 0x4360e8
mov edx, dword [esp + 0x74]
add eax, edx
mov dword [esp + 0x54], eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x50]
cmp edx, eax
jge 0x4360e8
mov ecx, dword [esp + 0x94]
mov eax, dword [esp + 0x98]
mov edx, dword [esi + 0x5a6796]
mov dword [esp + 0x88], ecx
mov ecx, esi
mov dword [esp + 0x84], eax
mov dword [esp + 0x30], edx
call fcn.0041f410
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.0041f770
mov edx, dword [esp + 0x54]
mov ecx, dword [edi + 0x4d0d10]
lea eax, [esi + 0xa5bea3]
push 1
push eax
mov eax, dword [esp + 0x78]
push 0xb
add edx, 0x500
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x4c]
push 1
push 1
push 0x202
push ecx
mov ecx, dword [esp + 0x64]
push edx
mov edx, dword [esp + 0x58]
add ecx, eax
mov eax, dword [esp + 0x64]
push ecx
mov ecx, dword [esp + 0xb8]
add eax, edx
mov edx, dword [esp + 0xb4]
push eax
mov eax, dword [esp + 0x44]
add ecx, ebp
add ecx, eax
add edx, ebx
push ecx
mov ecx, dword [esp + 0x50]
add edx, ecx
mov ecx, esi
push edx
call fcn.0041f450
mov ecx, dword [esp + 0x54]
lea eax, [esp + 0x58]
push eax
push ecx
lea ecx, [esi + 0xaa48a3]
call fcn.0044cfb0
test eax, eax
je 0x436099
mov ecx, dword [esp + 0x30]
push 2
mov eax, ecx
shl eax, 5
sub eax, ecx
lea eax, [eax + eax*2]
shl eax, 4
add eax, ecx
lea edx, [eax + eax*2]
lea eax, [esi + edx*2]
lea ecx, [eax + 0x2ab11e]
mov byte [eax + 0x2ac036], 1
call fcn.0041ba40
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x4c]
add ebx, eax
mov eax, dword [esp + 0x6c]
add ebp, edx
mov edx, dword [esp + 0x3c]
add ecx, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x64]
add edx, ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x54]
inc eax
inc edx
inc ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
mov dword [esp + 0x54], edx
jl 0x435f95
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
inc edx
cmp eax, ecx
mov dword [esp + 0x14], edx
jl 0x435f42
lea edx, [esp + 0xf4]
push 0x400
push edx
push str.PLAY_VOLUME
push str.CHARACTER
lea ecx, [esi + 0x2a9c6c]
call fcn.00407b80
lea eax, [esp + 0x28]
xor ebx, ebx
push eax
push 0x2c
lea ecx, [esp + 0xfc]
push ebx
push ecx
call fcn.00402a50
mov eax, dword [esp + 0x38]
add esp, 0x10
cmp eax, ebx
je case.default.0x435a40
lea edx, [esp + 0x9c]
lea eax, [esp + 0xf4]
push edx
push 0x2c
push 1
push eax
call fcn.00402a50
lea ecx, [esp + 0x9c]
lea edx, [esp + 0x104]
push ecx
push 0x2c
push 3
push edx
call fcn.00402a50
lea eax, [esp + 0xa8]
lea ecx, [esp + 0x114]
push eax
push 0x2c
push 4
push ecx
call fcn.00402a50
lea edx, [esp + 0x5c]
lea eax, [esp + 0x124]
push edx
push 0x2c
push 5
push eax
call fcn.00402a50
add esp, 0x40
lea ecx, [esp + 0x34]
lea edx, [esp + 0xf4]
push ecx
push 0x2c
push 6
push edx
call fcn.00402a50
lea eax, [esp + 0x50]
lea ecx, [esp + 0x104]
push eax
push 0x2c
push 7
push ecx
call fcn.00402a50
lea edx, [esp + 0x64]
lea eax, [esp + 0x114]
push edx
push 0x2c
push 8
push eax
call fcn.00402a50
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x124]
push ecx
push 0x2c
push 9
push edx
call fcn.00402a50
add esp, 0x40
lea eax, [esp + 0x84]
lea ecx, [esp + 0xf4]
push eax
push 0x2c
push 0xa
push ecx
call fcn.00402a50
mov eax, dword [esp + 0xac]
mov edx, dword [esi + 0xa67413]
add eax, edx
add esp, 0x10
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov dword [esp + 0x14], ebx
jle case.default.0x435a40
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x7c]
cmp edx, ecx
jge case.default.0x435a40
mov ebp, edx
mov dword [esp + 0x20], 0
mov edi, ebp
imul ebp, dword [esp + 0x78]
imul edi, dword [esp + 0x80]
cmp ebx, eax
jge 0x436404
mov ecx, dword [esp + 0x74]
lea edx, [ebx + ecx]
mov dword [esp + 0x54], edx
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x50]
cmp ecx, edx
jge 0x436404
mov edx, dword [esp + 0x54]
lea ecx, [esi + 0xaa48a3]
push edx
call fcn.0044d010
mov ecx, dword [esp + 0x90]
mov dword [esp + 0x58], eax
xor eax, eax
cmp ecx, eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x94], eax
je 0x4362de
fild dword [esp + 0x58]
fmul dword [0x4b6580]
fimul dword [esp + 0x90]
call fcn.004a74cc
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x84]
test eax, eax
je 0x436306
fild dword [esp + 0x58]
fmul dword [0x4b6580]
fimul dword [esp + 0x84]
call fcn.004a74cc
mov dword [esp + 0x94], eax
mov ecx, esi
call fcn.0041f410
mov ecx, dword [esp + 0x74]
lea eax, [esi + 0xa5bea3]
push 0
push eax
mov eax, dword [esp + 0x78]
push 0xb
lea edx, [ebx + ecx + 0x500]
mov ecx, dword [esp + 0x50]
push 0x701002
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x4c]
push 1
push 1
push 0x200
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0xb4]
push eax
mov eax, dword [esp + 0xc4]
add eax, edx
mov edx, dword [esp + 0x40]
add eax, ebp
push ecx
mov ecx, dword [esp + 0xc0]
add eax, edx
mov edx, dword [esp + 0xcc]
push eax
add edx, ecx
mov ecx, dword [esp + 0x50]
add edx, edi
add edx, ecx
mov ecx, esi
push edx
call fcn.0041f450
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x10]
add ecx, eax
add ecx, ebp
push 1
add ecx, edx
mov edx, dword [esp + 0x94]
push 0x221
push ecx
mov ecx, dword [esp + 0x98]
add eax, ebp
add edx, ecx
mov ecx, dword [esp + 0x24]
add edx, edi
add edx, ecx
push edx
mov edx, dword [esp + 0x20]
add eax, edx
mov edx, dword [esp + 0x9c]
add edx, edi
push eax
add edx, ecx
mov ecx, esi
push edx
call fcn.0041f510
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
add edi, eax
mov eax, dword [esp + 0x54]
add ebp, edx
mov edx, dword [esp + 0x20]
inc ebx
inc eax
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x1c]
inc edx
cmp ebx, eax
mov dword [esp + 0x20], edx
jl 0x436282
mov edx, dword [esp + 0x14]
inc edx
cmp ebx, eax
mov dword [esp + 0x14], edx
jl 0x436246
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp ecx, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
jle case.default.0x435a40
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x7c]
cmp eax, edx
jge case.default.0x435a40
mov ebx, eax
mov ebp, eax
mov edx, eax
imul eax, dword [esp + 0x5c]
imul edx, dword [esp + 0x60]
imul ebx, dword [esp + 0x80]
imul ebp, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x38], edx
mov edx, dword [esi + 0x5a6796]
cmp eax, ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x20], 0
jge 0x436578
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x50]
cmp eax, edx
jge 0x436578
mov edx, dword [esp + 0x28]
xor ecx, ecx
mov cl, byte [edx + esi + 0x5a6baa]
cmp ecx, eax
jne 0x4364bb
mov eax, dword [esi + 0x5a6796]
mov dword [esp + 0x30], eax
mov ecx, esi
call fcn.0041f410
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.0041f770
mov eax, dword [esp + 0x14]
mov edx, dword [edi + 0x4d0d10]
lea ecx, [esi + 0xa5bea3]
push 1
push ecx
mov ecx, dword [esp + 0x78]
push 0xb
add eax, 0x610
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x4c]
push 1
push 1
push 0x211
push edx
mov edx, dword [esp + 0x64]
push eax
mov eax, dword [esp + 0x58]
add edx, ecx
mov ecx, dword [esp + 0x64]
push edx
mov edx, dword [esp + 0x40]
add ecx, eax
push ecx
mov ecx, dword [esp + 0x4c]
lea eax, [edx + ebp]
lea edx, [ebx + ecx]
push eax
push edx
mov ecx, esi
call fcn.0041f450
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x38]
add ebx, eax
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x4c]
add ecx, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x64]
add ebp, edx
add eax, ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
inc eax
inc ecx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x436490
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x4365d5
mov eax, ebx
push 2
shl eax, 5
sub eax, ebx
lea eax, [eax + eax*2]
shl eax, 4
add eax, ebx
lea edx, [eax + eax*2]
lea eax, [esi + edx*2]
lea ecx, [eax + 0x2ab11e]
mov byte [eax + 0x2ac036], 1
call fcn.0041ba40
mov ecx, dword [esp + 0x14]
mov eax, dword [edi + 0x4d0d10]
push ebx
add ecx, 0x610
push eax
push ecx
push 0x211
mov ecx, esi
call fcn.0041f980
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
inc edx
cmp eax, ecx
mov dword [esp + 0x14], edx
jl 0x43643d
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
cmp ebp, 0x1101
je 0x43670c
cmp ebp, 0x2001
jne case.default.0x435a40
mov eax, dword [esp + 0x1c]
xor ebp, ebp
test eax, eax
mov dword [esp + 0x30], 0xffffffff
jle case.default.0x435a40
cmp ebp, dword [esp + 0x50]
jge 0x4366f8
mov eax, dword [esp + 0x28]
cmp eax, 0xffffffff
jle 0x436654
xor edx, edx
mov dl, byte [eax + esi + 0x5a6baa]
cmp edx, ebp
jne 0x436654
mov eax, dword [esi + 0x5a6796]
mov dword [esp + 0x30], eax
mov ecx, esi
call fcn.0041f410
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.0041f770
mov edx, dword [edi + 0x4d0d10]
mov eax, dword [esp + 0x4f8]
lea ecx, [esi + 0xa5bea3]
push 1
push ecx
mov ecx, dword [esp + 0x4c]
push 0xb
push edx
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x48]
push ebx
push 1
push 1
push 0x211
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x48]
push ecx
push edx
push eax
mov ecx, esi
call fcn.0041f450
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
add edx, ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x4c]
add eax, edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
add ecx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x64]
add edx, ecx
inc ebp
cmp ebp, eax
mov dword [esp + 0x34], edx
jl 0x43662a
mov eax, dword [esp + 0x30]
cmp eax, 0xffffffff
jle case.default.0x435a40
mov ebx, eax
jmp 0x436850
mov eax, dword [esp + 0x1c]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x20], ebx
jle case.default.0x435a40
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x7c]
cmp edx, ecx
jge 0x436843
xor ebp, ebp
cmp ebx, eax
jge 0x436813
cmp ebp, dword [esp + 0x50]
jge 0x436813
mov eax, dword [esp + 0x28]
cmp eax, 0xffffffff
jle 0x43676a
xor ecx, ecx
mov cl, byte [eax + esi + 0x5a6baa]
cmp ecx, ebx
jne 0x43676a
mov edx, dword [esi + 0x5a6796]
mov dword [esp + 0x30], edx
mov ecx, esi
call fcn.0041f410
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.0041f770
mov ecx, dword [edi + 0x4d0d10]
mov edx, dword [esp + 0x4f8]
lea eax, [esi + 0xa5bea3]
push 1
push eax
mov eax, dword [esp + 0x78]
push 0xb
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x4c]
push 1
push 1
push 0x211
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x48]
push ecx
push edx
push eax
mov ecx, esi
call fcn.0041f450
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
add edx, ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x4c]
add eax, edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
add ecx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x64]
add edx, ecx
inc ebx
inc ebp
cmp ebx, eax
mov dword [esp + 0x34], edx
jl 0x436740
mov edx, dword [esp + 0x80]
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
add ecx, edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x78]
add ebp, ecx
inc edx
cmp ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], edx
jl 0x436726
mov ebx, dword [esp + 0x30]
cmp ebx, 0xffffffff
jle case.default.0x435a40
mov eax, ebx
push 2
shl eax, 5
sub eax, ebx
lea eax, [eax + eax*2]
shl eax, 4
add eax, ebx
lea edx, [eax + eax*2]
lea eax, [esi + edx*2]
lea ecx, [eax + 0x2ab11e]
mov byte [eax + 0x2ac036], 1
call fcn.0041ba40
mov eax, dword [edi + 0x4d0d10]
mov ecx, dword [esp + 0x4f8]
push ebx
push eax
push ecx
push 0x211
mov ecx, esi
call fcn.0041f980
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
cmp ebp, 0xf101
jg 0x436b85
je 0x436a63
cmp ebp, 0xf001
je 0x436948
jle case.default.0x435a40
cmp ebp, 0xf004
jg case.default.0x435a40
mov ecx, esi
call fcn.0041f410
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.0041f770
mov eax, dword [edi + 0x4d0d10]
mov ecx, dword [esp + 0x4f8]
lea edx, [esi + 0xa5bea3]
push 1
push edx
mov edx, dword [esp + 0x4c]
push 0xb
push eax
mov eax, dword [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x48]
push ebx
push 1
push 1
push 0x200
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x48]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0041f450
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
mov eax, dword [esp + 0x1c]
xor ebp, ebp
test eax, eax
jle 0x436a08
cmp ebp, dword [esp + 0x50]
jge 0x436a08
cmp dword [esi + 0xa67421], ebp
jne 0x436972
mov edx, dword [esi + 0x5a6796]
mov dword [esp + 0x30], edx
mov ecx, esi
call fcn.0041f410
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.0041f770
mov ecx, dword [edi + 0x4d0d10]
mov edx, dword [esp + 0x4f8]
lea eax, [esi + 0xa5bea3]
push 1
push eax
mov eax, dword [esp + 0x4c]
push 0xb
push ecx
mov ecx, dword [esp + 0x50]
push edx
mov edx, dword [esp + 0x48]
push ebx
push 1
push 1
push 0x211
push eax
mov eax, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x48]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0041f450
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x4c]
add edx, ecx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x40]
add eax, edx
inc ebp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
cmp ebp, eax
jl 0x436956
mov ebx, dword [esp + 0x30]
mov eax, dword [edi + 0x4d0d10]
mov ecx, dword [esp + 0x4f8]
push ebx
push eax
push ecx
push 0x211
mov ecx, esi
call fcn.0041f980
mov eax, ebx
push 2
shl eax, 5
sub eax, ebx
lea eax, [eax + eax*2]
shl eax, 4
add eax, ebx
lea edx, [eax + eax*2]
lea esi, [esi + edx*2]
lea ecx, [esi + 0x2ab11e]
mov byte [esi + 0x2ac036], 1
call fcn.0041ba40
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
mov eax, dword [esi + 0x5a6796]
xor ebp, ebp
inc eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x1c]
test eax, eax
jle 0x436b2a
cmp ebp, dword [esp + 0x50]
jge 0x436b2a
mov ecx, esi
call fcn.0041f410
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.0041f770
mov ecx, dword [edi + 0x4d0d10]
mov edx, dword [esp + 0x4f8]
lea eax, [esi + 0xa5bea3]
push 1
push eax
mov eax, dword [esp + 0x4c]
push 0xb
push ecx
mov ecx, dword [esp + 0x50]
push edx
mov edx, dword [esp + 0x48]
push ebx
push 1
push 1
push 0x211
push eax
mov eax, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x48]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0041f450
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x4c]
add edx, ecx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x6c]
add eax, edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x64]
add edx, eax
mov eax, dword [esp + 0x1c]
inc ebp
mov dword [esp + 0x34], edx
cmp ebp, eax
jl 0x436a7c
mov ebx, dword [esp + 0x30]
push 2
mov eax, ebx
shl eax, 5
sub eax, ebx
lea eax, [eax + eax*2]
shl eax, 4
add eax, ebx
lea ecx, [eax + eax*2]
lea eax, [esi + ecx*2]
lea ecx, [eax + 0x2ab11e]
mov byte [eax + 0x2ac036], 1
call fcn.0041ba40
mov edx, dword [edi + 0x4d0d10]
mov eax, dword [esp + 0x4f8]
push ebx
push edx
push eax
push 0x211
mov ecx, esi
call fcn.0041f980
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8
cmp ebp, 0xf102
jne case.default.0x435a40
mov eax, dword [esp + 0x1c]
xor ebp, ebp
test eax, eax
jle case.default.0x435a40
cmp ebp, dword [esp + 0x50]
jge case.default.0x435a40
mov ecx, esi
call fcn.0041f410
mov edx, dword [edi + 0x4d0d10]
lea ecx, [esi + 0xa5bea3]
mov eax, dword [esp + 0x44]
push 0
push ecx
mov ecx, dword [esp + 0x48]
push 0xb
push edx
mov edx, dword [esp + 0x44]
push 0
push ebx
push 1
push 1
push 0x200
push eax
mov eax, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x48]
push eax
xor eax, eax
mov eax, ecx
mov ecx, esi
push eax
xor eax, eax
mov eax, edx
push eax
call fcn.0041f450
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
push 1
add ecx, eax
push 0x221
push ecx
mov ecx, dword [esp + 0x24]
add edx, ecx
push edx
push eax
push ecx
mov ecx, esi
call fcn.0041f510
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x4c]
add edx, ecx
inc ebp
cmp ebp, eax
mov dword [esp + 0x10], edx
jl 0x436b9f
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4e4
ret 8