Function at 0x46cc20
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x1d0
push ebx
push ebp
push esi
mov esi, ecx
push edi
movsx eax, byte [esi + 0x16e6]
mov edi, dword [esi + 0x4dd44]
dec eax
cmp eax, 5
mov dword [esp + 0x14], edi
ja case.default.0x46cc47
jmp dword [eax*4 + 0x46ef8c]
mov al, byte [esi + 0x1666]
test al, al
je 0x46cca0
mov bl, al
call fcn.004921f1
movsx ecx, bl
cdq
shl ecx, 1
idiv ecx
mov ax, word [esi + 0x165c]
movsx cx, bl
mov bl, byte [esi + 0x1666]
sub ax, dx
lea ebp, [eax + ecx + 5]
call fcn.004921f1
movsx ecx, bl
cdq
shl ecx, 1
idiv ecx
mov ax, word [esi + 0x165e]
movsx cx, bl
sub ax, dx
lea eax, [eax + ecx + 8]
jmp 0x46ccae
mov bp, word [esi + 0x165c]
mov ax, word [esi + 0x165e]
mov ecx, dword [esi + 0x360e4]
push edi
movsx ebx, ax
movsx ebp, bp
push 1
push ebx
push ebp
call fcn.00488ff0
mov eax, dword [esi + 0x1614]
cmp eax, 0xffffffff
je 0x46cd23
mov edx, dword [esi + eax*4 + 0x4b038]
push edi
movsx eax, word [edx + 0x22]
push eax
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x40
push eax
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x1614]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x4b038]
add eax, 0x3d
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.0048b080
mov eax, dword [esi + 0x1618]
cmp eax, 0xffffffff
je 0x46cd82
mov ecx, dword [esi + eax*4 + 0x4b038]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x40
push eax
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x1618]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x4b038]
add eax, 0x6a
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.0048b080
mov eax, dword [esi + 0x161c]
cmp eax, 0xffffffff
je 0x46cde3
mov ecx, dword [esi + eax*4 + 0x4b038]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x40
push eax
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x161c]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x4b038]
add eax, 0x97
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.0048b080
mov eax, dword [esi + 0x1620]
cmp eax, 0xffffffff
je 0x46ce42
mov ecx, dword [esi + eax*4 + 0x4b038]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x6d
push eax
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x1620]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x4b038]
add eax, 0x3d
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.0048b080
mov eax, dword [esi + 0x1624]
cmp eax, 0xffffffff
je 0x46cea1
mov ecx, dword [esi + eax*4 + 0x4b038]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x6d
push eax
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x1624]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x4b038]
add eax, 0x6a
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.0048b080
mov eax, dword [esi + 0x1628]
cmp eax, 0xffffffff
je 0x46cf02
mov ecx, dword [esi + eax*4 + 0x4b038]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x6d
push eax
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x1628]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x4b038]
add eax, 0x97
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.0048b080
movsx ecx, word [esp + 0x1e4]
lea eax, [ebp + 0x41]
cmp ecx, eax
jl 0x46cf58
add ebp, 0x9e
cmp ecx, ebp
jg 0x46cf58
movsx edx, word [esp + 0x1e8]
lea ecx, [ebx + 0xb7]
cmp edx, ecx
jl 0x46cf58
lea edi, [ebx + 0xcb]
cmp edx, edi
jg 0x46cf58
push 0x1e
push 0x10
push 0x10
push 0x4ac664
push ecx
push eax
mov ecx, esi
call fcn.00414550
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d0
ret 0x10
push 0x14
push 6
push 6
add ebx, 0xb7
push 0x4ac664
push ebx
push eax
mov ecx, esi
call fcn.00414550
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d0
ret 0x10
mov al, byte [esi + 0x1666]
test al, al
je 0x46cfd1
mov bl, al
call fcn.004921f1
movsx ecx, bl
cdq
shl ecx, 1
idiv ecx
mov ax, word [esi + 0x165c]
movsx cx, bl
mov bl, byte [esi + 0x1666]
sub ax, dx
lea ebp, [eax + ecx + 5]
call fcn.004921f1
movsx ecx, bl
cdq
shl ecx, 1
idiv ecx
mov ax, word [esi + 0x165e]
movsx cx, bl
sub ax, dx
lea eax, [eax + ecx + 8]
jmp 0x46cfdf
mov bp, word [esi + 0x165c]
mov ax, word [esi + 0x165e]
mov ecx, dword [esi + 0x360e4]
push edi
movsx ebx, ax
movsx ebp, bp
push 1
push ebx
push ebp
call fcn.00488ff0
mov eax, dword [esi + 0x1614]
cmp eax, 0xffffffff
je 0x46d054
mov edx, dword [esi + eax*4 + 0x4b038]
push edi
movsx eax, word [edx + 0x22]
push eax
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x40
push eax
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x1614]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x4b038]
add eax, 0x3d
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.0048b080
mov eax, dword [esi + 0x1618]
cmp eax, 0xffffffff
je 0x46d0b3
mov ecx, dword [esi + eax*4 + 0x4b038]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x40
push eax
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x1618]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x4b038]
add eax, 0x6a
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.0048b080
mov eax, dword [esi + 0x161c]
cmp eax, 0xffffffff
je 0x46d114
mov ecx, dword [esi + eax*4 + 0x4b038]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x40
push eax
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x161c]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x4b038]
add eax, 0x97
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.0048b080
mov eax, dword [esi + 0x1620]
cmp eax, 0xffffffff
je 0x46d173
mov ecx, dword [esi + eax*4 + 0x4b038]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x6d
push eax
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x1620]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x4b038]
add eax, 0x3d
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.0048b080
mov eax, dword [esi + 0x1624]
cmp eax, 0xffffffff
je 0x46d1d2
mov ecx, dword [esi + eax*4 + 0x4b038]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x6d
push eax
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x1624]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x4b038]
add eax, 0x6a
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.0048b080
mov eax, dword [esi + 0x1628]
cmp eax, 0xffffffff
je 0x46d233
mov ecx, dword [esi + eax*4 + 0x4b038]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x6d
push eax
call fcn.004921f1
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x1628]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x4b038]
add eax, 0x97
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.0048b080
push 6
push 6
push 0x14
add ebx, 0xb7
push 0x4adf94
add ebp, 0x41
push ebx
push ebp
mov ecx, esi
call fcn.00414550
mov edx, dword [esi + 0x1654]
mov ecx, edi
sub ecx, edx
cmp ecx, 0x3e8
jbe 0x46d276
mov al, byte [esi + 0x1666]
mov dword [esi + 0x1654], edi
inc al
mov byte [esi + 0x1666], al
cmp byte [esi + 0x1666], 5
jl case.default.0x46cc47
push 0
push 0
push 0
push 0
push 0
push 0
push 0xa19
push 0xfa314dc
mov ecx, esi
call fcn.00404de0
push 0x1a
mov ecx, esi
call fcn.00432950
push 0
push 0
push 0x2a
push 0x45
mov ecx, esi
call fcn.0043cc00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d0
ret 0x10
mov ecx, dword [esi + 0x36170]
mov bp, word [esi + 0x165e]
mov bx, word [esi + 0x165c]
mov dword [esp + 0x18], ebp
test ecx, ecx
je 0x46d2f7
mov edx, dword [esi + 0x4dd34]
push edx
push 0
movsx eax, bp
movsx edx, bx
push eax
push edx
call fcn.00488ff0
mov ecx, dword [esi + 0x36190]
test ecx, ecx
je 0x46d317
mov eax, dword [esi + 0x4dd34]
push eax
push 8
movsx edx, bp
movsx eax, bx
push edx
push eax
call fcn.00488ff0
lea ebp, [esi + 0x6004]
mov ecx, ebp
call fcn.00402250
movsx eax, word [esp + 0x18]
movsx ebx, bx
mov dword [esp + 0x10], eax
add eax, 0x2e
push 0
push 0x4adf8c
lea ecx, [ebx + 0x31]
push eax
push ecx
mov ecx, ebp
call fcn.00401ef0
mov ecx, ebp
call fcn.00402290
mov ecx, ebp
call fcn.00402250
mov edx, dword [esp + 0x10]
push 0
push 0x4adf80
mov ecx, ebp
lea eax, [edx + 0x2e]
push eax
lea eax, [ebx + 0xb0]
push eax
call fcn.00401ef0
mov ecx, ebp
call fcn.00402290
mov ecx, dword [esp + 0x10]
xor eax, eax
add ecx, 0x3f
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], ecx
movsx edx, word [esi + 0x1664]
add edx, eax
mov ecx, dword [esi + edx*4 + 0x4c508]
lea edx, [esi + edx*4 + 0x4c508]
test ecx, ecx
je 0x46d54d
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0x70]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xe8]
lea ecx, [esp + 0x128]
push eax
push ecx
mov ecx, dword [edx]
lea eax, [esp + 0x38]
push eax
add ecx, 8
push 0
push ecx
mov ecx, esi
call fcn.00454500
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4a7454
push eax
call dword [sym.imp.user32.dll_wsprintfA]
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0x174]
add esp, 0xc
rep stosd dword es:[edi], eax
movsx ecx, word [esi + 0x1664]
add ecx, dword [esp + 0x2c]
mov edx, dword [esi + ecx*4 + 0x4c508]
lea ecx, [esp + 0x168]
mov eax, dword [edx + 0x24]
push eax
push 0x4adf78
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
movsx eax, word [esp + 0x1f0]
lea ecx, [ebx + 0x1e]
add esp, 0xc
cmp eax, ecx
jl 0x46d4a2
lea edx, [ebx + 0xb4]
cmp eax, edx
jg 0x46d4a2
movsx eax, word [esp + 0x1e8]
mov edi, dword [esp + 0x18]
cmp eax, edi
jl 0x46d4a6
lea ecx, [edi + 0xe]
cmp eax, ecx
jg 0x46d4a6
mov ecx, ebp
call fcn.00402250
lea edx, [esp + 0x70]
push 0xffffff
push edx
lea eax, [ebx + 0x1e]
push edi
push eax
mov ecx, ebp
call fcn.00401ef0
mov ecx, ebp
call fcn.00402290
mov ecx, ebp
call fcn.00402250
lea eax, [esp + 0x168]
push 0xffffff
push eax
lea ecx, [ebx + 0xbe]
push edi
push ecx
jmp 0x46d530
mov edi, dword [esp + 0x18]
movsx edx, word [esi + 0x1664]
add edx, dword [esp + 0x2c]
mov eax, dword [esi + edx*4 + 0x4c508]
mov ecx, dword [eax + 4]
cmp ecx, 1
mov ecx, ebp
jne 0x46d4f2
call fcn.00402250
lea ecx, [esp + 0x70]
push 0x781e22
push ecx
lea eax, [ebx + 0x1e]
push edi
push eax
mov ecx, ebp
call fcn.00401ef0
mov ecx, ebp
call fcn.00402290
mov ecx, ebp
call fcn.00402250
push 0x781e22
jmp 0x46d520
call fcn.00402250
lea ecx, [esp + 0x70]
push 0x19192d
push ecx
lea eax, [ebx + 0x1e]
push edi
push eax
mov ecx, ebp
call fcn.00401ef0
mov ecx, ebp
call fcn.00402290
mov ecx, ebp
call fcn.00402250
push 0x19192d
lea edx, [esp + 0x16c]
lea eax, [ebx + 0xbe]
push edx
push edi
push eax
mov ecx, ebp
call fcn.00401ef0
mov ecx, ebp
call fcn.00402290
mov eax, dword [esp + 0x2c]
add edi, 0xf
mov dword [esp + 0x18], edi
mov edi, dword [esp + 0x14]
inc eax
cmp eax, 0xd
mov dword [esp + 0x2c], eax
jl 0x46d389
mov ax, word [esi + 0x1664]
cmp ax, 1
jl 0x46d598
movsx ecx, ax
mov eax, dword [esi + ecx*4 + 0x4c504]
test eax, eax
je 0x46d598
mov edx, dword [esp + 0x10]
push edi
lea ecx, [ebx + 0xe6]
push 0x17
lea eax, [edx + 0xda]
push eax
push ecx
mov ecx, dword [esi + 0x3616c]
call fcn.00488ff0
jmp 0x46d5bd
mov eax, dword [esp + 0x10]
push edi
push 5
push 5
add eax, 0xda
push 5
lea ecx, [ebx + 0xe6]
push 0x17
push eax
push ecx
mov ecx, dword [esi + 0x3616c]
call fcn.0048d110
movsx ecx, word [esi + 0x1664]
mov eax, dword [esi + ecx*4 + 0x4c53c]
test eax, eax
je 0x46d5f1
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 0x3616c]
push edi
push 0x18
lea eax, [edx + 0xee]
push eax
lea eax, [ebx + 0xe6]
push eax
call fcn.00488ff0
jmp 0x46d616
mov eax, dword [esp + 0x10]
push edi
mov ecx, dword [esi + 0x3616c]
push 5
push 5
add eax, 0xee
push 5
push 0x18
push eax
lea eax, [ebx + 0xe6]
push eax
call fcn.0048d110
mov al, byte [esp + 0x1f0]
test al, al
je 0x46d6e4
mov eax, 0x26
mov cl, byte [esi + eax + 0x4eafd]
test cl, cl
jne 0x46d63d
dec eax
jns 0x46d62a
jmp 0x46d6e4
movsx eax, byte [eax + esi + 0x4eafd]
cmp eax, 0x1a
jne 0x46d6e4
movsx eax, word [esp + 0x1e4]
lea edi, [ebx + 0xe6]
cmp eax, edi
jl 0x46d6e4
lea ecx, [ebx + 0xfa]
cmp eax, ecx
jg 0x46d699
movsx ecx, word [esp + 0x1e8]
mov edx, dword [esp + 0x10]
add edx, 0xda
cmp ecx, edx
jl 0x46d699
mov edx, dword [esp + 0x10]
add edx, 0xee
cmp ecx, edx
jg 0x46d699
dec word [esi + 0x1664]
cmp eax, edi
jl 0x46d6e4
lea ecx, [ebx + 0xfa]
cmp eax, ecx
jg 0x46d6e4
mov edx, dword [esp + 0x10]
movsx eax, word [esp + 0x1e8]
lea ecx, [edx + 0xee]
cmp eax, ecx
jl 0x46d6e4
add edx, 0x102
cmp eax, edx
jg 0x46d6e4
mov ax, word [esi + 0x1664]
movsx edx, ax
mov ecx, dword [esi + edx*4 + 0x4c53c]
test ecx, ecx
je 0x46d6e4
inc eax
mov word [esi + 0x1664], ax
mov cx, word [esp + 0x1ec]
xor edi, edi
cmp cx, di
je 0x46d739
mov eax, 0x26
mov dl, byte [esi + eax + 0x4eafd]
test dl, dl
jne 0x46d708
dec eax
jns 0x46d6f8
jmp 0x46d739
movsx eax, byte [eax + esi + 0x4eafd]
cmp eax, 0x1a
jne 0x46d739
movsx ecx, cx
mov eax, 0x77777777
mov word [esi + 0x36070], di
imul ecx
sub edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
add word [esi + 0x1664], dx
movsx ecx, word [esi + 0x1664]
cmp dword [esi + ecx*4 + 0x4c538], edi
jne 0x46d769
dec word [esi + 0x1664]
mov ax, word [esi + 0x1664]
cmp ax, 1
jl 0x46d769
movsx edx, ax
cmp dword [esi + edx*4 + 0x4c538], edi
je 0x46d749
cmp word [esi + 0x1664], di
jge 0x46d779
mov word [esi + 0x1664], di
mov eax, dword [esp + 0x10]
mov ecx, ebp
movsx edi, word [esi + 0x1660]
add eax, 0x109
add edi, ebx
mov dword [esp + 0x18], eax
call fcn.00402250
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
lea ecx, [eax + 0xf]
push ecx
push edi
mov edi, dword [sym.imp.user32.dll_SetRect]
push eax
push ebx
push edx
call edi
push 0x191937
lea eax, [esp + 0x20]
push 0x4adf50
push eax
mov ecx, ebp
call fcn.004022b0
mov ecx, ebp
call fcn.00402290
movsx eax, word [esi + 0x1660]
add eax, ebx
mov ecx, ebp
mov dword [esp + 0x18], eax
call fcn.00402250
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 0x118]
mov ecx, dword [esp + 0x18]
lea edx, [eax + 0xf]
push edx
push ecx
push eax
lea edx, [esp + 0x28]
push ebx
push edx
call edi
push 0x191937
lea eax, [esp + 0x20]
push 0x4adf28
push eax
mov ecx, ebp
call fcn.004022b0
mov ecx, ebp
call fcn.00402290
movsx eax, word [esi + 0x1660]
add eax, ebx
mov ecx, ebp
mov dword [esp + 0x18], eax
call fcn.00402250
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 0x127]
mov ecx, dword [esp + 0x18]
lea edx, [eax + 0xf]
push edx
push ecx
push eax
lea edx, [esp + 0x28]
push ebx
push edx
call edi
push 0x191937
lea eax, [esp + 0x20]
push 0x4adf00
push eax
mov ecx, ebp
call fcn.004022b0
mov ecx, ebp
call fcn.00402290
movsx eax, word [esi + 0x1660]
add eax, ebx
mov ecx, ebp
mov dword [esp + 0x18], eax
call fcn.00402250
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 0x136]
lea edx, [eax + 0xf]
mov ecx, dword [esp + 0x18]
push edx
push ecx
push eax
lea edx, [esp + 0x28]
push ebx
push edx
call edi
push 0x191937
lea eax, [esp + 0x20]
push 0x4adee8
push eax
mov ecx, ebp
call fcn.004022b0
mov ecx, ebp
call fcn.00402290
mov ecx, dword [esp + 0x10]
movsx esi, word [esi + 0x1660]
add ecx, 0x154
add esi, ebx
mov dword [esp + 0x18], ecx
mov ecx, ebp
call fcn.00402250
mov eax, dword [esp + 0x18]
lea edx, [eax + 0xf]
push edx
push esi
push eax
lea eax, [esp + 0x28]
push ebx
push eax
call edi
push 0x191937
lea ecx, [esp + 0x20]
push 0x4adec0
push ecx
mov ecx, ebp
call fcn.004022b0
mov ecx, ebp
call fcn.00402290
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d0
ret 0x10
mov ecx, dword [esi + 0x36170]
mov dx, word [esi + 0x1660]
mov di, word [esi + 0x165c]
mov bx, word [esi + 0x165e]
test ecx, ecx
mov word [esp + 0x18], dx
je 0x46d946
mov eax, dword [esi + 0x4dd34]
push eax
push 0
movsx edx, bx
movsx eax, di
push edx
push eax
call fcn.00488ff0
mov ecx, dword [esi + 0x36190]
test ecx, ecx
je 0x46d966
mov edx, dword [esi + 0x4dd34]
push edx
push 8
movsx eax, bx
movsx edx, di
push eax
push edx
call fcn.00488ff0
movsx eax, byte [esi + 0x1666]
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + eax*4 + 0x4c508]
push ecx
movsx ebx, bx
mov edx, dword [eax + 0x2c]
mov eax, dword [eax + 0x28]
movsx ebp, di
push edx
lea ecx, [ebx + 0x5e]
lea edx, [ebp + 0x42]
push ecx
mov ecx, dword [esi + eax*4 + 0x36528]
push edx
call fcn.00488ff0
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0x70]
lea edx, [esp + 0x128]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xe8]
lea eax, [esp + 0x30]
push ecx
push edx
movsx ecx, byte [esi + 0x1666]
push eax
push 0
mov edx, dword [esi + ecx*4 + 0x4c508]
mov ecx, esi
add edx, 8
push edx
call fcn.00454500
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4a7454
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
lea edi, [esi + 0x6004]
add esp, 0xc
mov ecx, edi
call fcn.00402250
lea edx, [esp + 0x70]
push 0xffffff
lea ecx, [ebx + 0x30]
lea eax, [ebp + 0x71]
push edx
push ecx
push eax
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
movsx edx, byte [esi + 0x1666]
mov eax, dword [esi + edx*4 + 0x4c508]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
lea eax, [esp + 0x78]
push 0x4adeac
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x10
mov ecx, edi
call fcn.00402250
lea ecx, [esp + 0x70]
push 0x19192d
lea edx, [ebx + 0x4e]
push ecx
lea eax, [ebp + 0x71]
push edx
push eax
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
mov ecx, edi
call fcn.00402250
push 0x19192d
push 0x4ade98
lea eax, [ebx + 0x62]
mov ecx, edi
push eax
lea eax, [ebp + 0x71]
push eax
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
movsx ecx, byte [esi + 0x1666]
mov dword [esp + 0x10], 4
mov eax, dword [esi + ecx*4 + 0x4c508]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x46db45
lea edx, [esp + 0xe8]
lea ecx, [esp + 0x128]
push edx
lea edx, [esp + 0x34]
push ecx
push edx
add eax, 0x30
push 0
push eax
mov ecx, esi
call fcn.00454500
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4a7454
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
movsx edx, byte [esi + 0x1666]
add esp, 0xc
mov eax, dword [esi + edx*4 + 0x4c508]
mov ecx, dword [eax + 0xd0]
cmp ecx, 1
mov ecx, edi
jne 0x46db18
call fcn.00402250
push 0x19192d
jmp 0x46db22
call fcn.00402250
push 0x969696
lea ecx, [esp + 0x74]
lea edx, [ebx + 0x71]
push ecx
lea eax, [ebp + 0x7b]
push edx
push eax
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
mov dword [esp + 0x10], 5
movsx ecx, byte [esi + 0x1666]
mov eax, dword [esi + ecx*4 + 0x4c508]
mov ecx, dword [eax + 0xb8]
test ecx, ecx
je 0x46dc0e
lea edx, [esp + 0xe8]
lea ecx, [esp + 0x128]
push edx
lea edx, [esp + 0x34]
push ecx
push edx
add eax, 0x45
push 0
push eax
mov ecx, esi
call fcn.00454500
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4a7454
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
movsx edx, byte [esi + 0x1666]
add esp, 0xc
mov eax, dword [esi + edx*4 + 0x4c508]
mov ecx, dword [eax + 0xd4]
cmp ecx, 1
mov ecx, edi
jne 0x46dbda
call fcn.00402250
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x70]
push 0x19192d
push ecx
lea eax, [eax + eax*2]
lea ecx, [ebp + 0x7b]
lea edx, [ebx + eax*4]
lea eax, [eax + edx + 0x35]
push eax
push ecx
jmp 0x46dbfc
call fcn.00402250
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x70]
push 0x969696
push edx
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
lea eax, [ebp + 0x7b]
push edx
push eax
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
inc dword [esp + 0x10]
movsx ecx, byte [esi + 0x1666]
mov eax, dword [esi + ecx*4 + 0x4c508]
mov ecx, dword [eax + 0xbc]
test ecx, ecx
je 0x46dcd7
lea edx, [esp + 0xe8]
lea ecx, [esp + 0x128]
push edx
lea edx, [esp + 0x34]
push ecx
push edx
add eax, 0x5a
push 0
push eax
mov ecx, esi
call fcn.00454500
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4a7454
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
movsx edx, byte [esi + 0x1666]
add esp, 0xc
mov eax, dword [esi + edx*4 + 0x4c508]
mov ecx, dword [eax + 0xd8]
cmp ecx, 1
mov ecx, edi
jne 0x46dca3
call fcn.00402250
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x70]
push 0x19192d
push ecx
lea eax, [eax + eax*2]
lea ecx, [ebp + 0x7b]
lea edx, [ebx + eax*4]
lea eax, [eax + edx + 0x35]
push eax
push ecx
jmp 0x46dcc5
call fcn.00402250
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x70]
push 0x969696
push edx
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
lea eax, [ebp + 0x7b]
push edx
push eax
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
inc dword [esp + 0x10]
movsx ecx, byte [esi + 0x1666]
mov eax, dword [esi + ecx*4 + 0x4c508]
mov ecx, dword [eax + 0xc0]
test ecx, ecx
je 0x46dda0
lea edx, [esp + 0xe8]
lea ecx, [esp + 0x128]
push edx
lea edx, [esp + 0x34]
push ecx
push edx
add eax, 0x6f
push 0
push eax
mov ecx, esi
call fcn.00454500
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4a7454
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
movsx edx, byte [esi + 0x1666]
add esp, 0xc
mov eax, dword [esi + edx*4 + 0x4c508]
mov ecx, dword [eax + 0xdc]
cmp ecx, 1
mov ecx, edi
jne 0x46dd6c
call fcn.00402250
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x70]
push 0x19192d
push ecx
lea eax, [eax + eax*2]
lea ecx, [ebp + 0x7b]
lea edx, [ebx + eax*4]
lea eax, [eax + edx + 0x35]
push eax
push ecx
jmp 0x46dd8e
call fcn.00402250
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x70]
push 0x969696
push edx
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
lea eax, [ebp + 0x7b]
push edx
push eax
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
inc dword [esp + 0x10]
movsx ecx, byte [esi + 0x1666]
mov eax, dword [esi + ecx*4 + 0x4c508]
mov ecx, dword [eax + 0xc4]
test ecx, ecx
je 0x46de6b
lea edx, [esp + 0xe8]
lea ecx, [esp + 0x128]
push edx
lea edx, [esp + 0x34]
push ecx
push edx
add eax, 0x84
push 0
push eax
mov ecx, esi
call fcn.00454500
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4a7454
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
movsx edx, byte [esi + 0x1666]
add esp, 0xc
mov eax, dword [esi + edx*4 + 0x4c508]
mov ecx, dword [eax + 0xe0]
cmp ecx, 1
mov ecx, edi
jne 0x46de37
call fcn.00402250
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x70]
push 0x19192d
push ecx
lea eax, [eax + eax*2]
lea ecx, [ebp + 0x7b]
lea edx, [ebx + eax*4]
lea eax, [eax + edx + 0x35]
push eax
push ecx
jmp 0x46de59
call fcn.00402250
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x70]
push 0x969696
push edx
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
lea eax, [ebp + 0x7b]
push edx
push eax
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
inc dword [esp + 0x10]
movsx ecx, byte [esi + 0x1666]
mov eax, dword [esi + ecx*4 + 0x4c508]
mov ecx, dword [eax + 0xc8]
test ecx, ecx
je 0x46df32
lea edx, [esp + 0xe8]
lea ecx, [esp + 0x128]
push edx
lea edx, [esp + 0x34]
push ecx
push edx
add eax, 0x99
push 0
push eax
mov ecx, esi
call fcn.00454500
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4a7454
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
movsx edx, byte [esi + 0x1666]
add esp, 0xc
mov eax, dword [esi + edx*4 + 0x4c508]
mov ecx, dword [eax + 0xe4]
cmp ecx, 1
mov ecx, edi
jne 0x46df02
call fcn.00402250
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x70]
push 0x19192d
push ecx
lea eax, [eax + eax*2]
lea ecx, [ebp + 0x7b]
lea edx, [ebx + eax*4]
lea eax, [eax + edx + 0x35]
push eax
push ecx
jmp 0x46df24
call fcn.00402250
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x70]
push 0x969696
push edx
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
lea eax, [ebp + 0x7b]
push edx
push eax
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
movsx ecx, byte [esi + 0x1666]
mov edx, dword [esi + ecx*4 + 0x4c508]
cmp dword [edx + 4], 1
jne 0x46e313
mov edx, dword [esp + 0x14]
lea eax, [ebx + 0xe4]
push edx
lea ecx, [ebp + 0x61]
push 2
push eax
push ecx
mov ecx, dword [esi + 0x360e4]
call fcn.00488ff0
mov eax, dword [esp + 0x14]
lea ecx, [ebp + 0x8e]
push eax
lea eax, [ebx + 0xe4]
push 2
push eax
push ecx
mov ecx, dword [esi + 0x360e4]
call fcn.00488ff0
mov edx, dword [esp + 0x14]
lea eax, [ebx + 0xe4]
push edx
lea ecx, [ebp + 0xbb]
push 2
push eax
push ecx
mov ecx, dword [esi + 0x360e4]
call fcn.00488ff0
mov ecx, dword [esp + 0x14]
lea eax, [ebx + 0x111]
push ecx
mov ecx, dword [esi + 0x360e4]
push 2
push eax
lea eax, [ebp + 0x61]
push eax
call fcn.00488ff0
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x360e4]
push edx
lea eax, [ebx + 0x111]
push 2
push eax
lea eax, [ebp + 0x8e]
push eax
call fcn.00488ff0
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x360e4]
push eax
lea eax, [ebx + 0x111]
push 2
push eax
lea eax, [ebp + 0xbb]
push eax
call fcn.00488ff0
mov eax, dword [esi + 0x1614]
cmp eax, 0xffffffff
je 0x46e03b
mov eax, dword [esi + eax*4 + 0x4b038]
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [ebx + 0xe4]
movsx edx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push edx
push ecx
lea ecx, [ebp + 0x61]
push ecx
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.00488ff0
mov eax, dword [esi + 0x1618]
cmp eax, 0xffffffff
je 0x46e075
mov eax, dword [esi + eax*4 + 0x4b038]
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [ebx + 0xe4]
movsx edx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push edx
push ecx
lea ecx, [ebp + 0x8e]
push ecx
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.00488ff0
mov eax, dword [esi + 0x161c]
cmp eax, 0xffffffff
je 0x46e0af
mov eax, dword [esi + eax*4 + 0x4b038]
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [ebx + 0xe4]
movsx edx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push edx
push ecx
lea ecx, [ebp + 0xbb]
push ecx
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.00488ff0
mov eax, dword [esi + 0x1620]
cmp eax, 0xffffffff
je 0x46e0e6
mov eax, dword [esi + eax*4 + 0x4b038]
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [ebx + 0x111]
movsx edx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push edx
push ecx
lea ecx, [ebp + 0x61]
push ecx
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.00488ff0
mov eax, dword [esi + 0x1624]
cmp eax, 0xffffffff
je 0x46e120
mov eax, dword [esi + eax*4 + 0x4b038]
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [ebx + 0x111]
movsx edx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push edx
push ecx
lea ecx, [ebp + 0x8e]
push ecx
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.00488ff0
mov eax, dword [esi + 0x1628]
cmp eax, 0xffffffff
je 0x46e15a
mov eax, dword [esi + eax*4 + 0x4b038]
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [ebx + 0x111]
movsx edx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push edx
push ecx
lea ecx, [ebp + 0xbb]
push ecx
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.00488ff0
mov ecx, edi
call fcn.00402250
movsx ecx, word [esp + 0x18]
lea eax, [ebx + 0x12a]
add ecx, ebp
mov dword [esp + 0x14], ecx
lea edx, [eax + 0xf]
push edx
push ecx
push eax
lea eax, [esp + 0x28]
push ebp
push eax
call dword [sym.imp.user32.dll_SetRect]
push 0x191937
lea ecx, [esp + 0x20]
push 0x4ade78
push ecx
mov ecx, edi
call fcn.004022b0
mov ecx, edi
call fcn.00402290
mov ecx, edi
call fcn.00402250
mov ecx, dword [esp + 0x14]
lea eax, [ebx + 0x139]
lea edx, [eax + 0xf]
push edx
push ecx
push eax
lea edx, [esp + 0x28]
push ebp
push edx
call dword [sym.imp.user32.dll_SetRect]
push 0x191937
lea eax, [esp + 0x20]
push 0x4ade54
push eax
mov ecx, edi
call fcn.004022b0
mov ecx, edi
call fcn.00402290
mov ecx, edi
call fcn.00402250
mov edx, dword [esp + 0x14]
lea eax, [ebx + 0x148]
lea ecx, [eax + 0xf]
push ecx
push edx
push eax
lea eax, [esp + 0x28]
push ebp
push eax
call dword [sym.imp.user32.dll_SetRect]
push 0x191937
lea ecx, [esp + 0x20]
push 0x4ade38
push ecx
mov ecx, edi
call fcn.004022b0
mov ecx, edi
call fcn.00402290
movsx eax, word [esp + 0x1e4]
lea edx, [ebp + 0x1f]
cmp eax, edx
jl 0x46e26d
movsx eax, word [esp + 0x1e4]
lea ecx, [ebp + 0x5e]
cmp eax, ecx
jg 0x46e26d
movsx eax, word [esp + 0x1e8]
lea edi, [ebx + 0x15a]
cmp eax, edi
jl 0x46e26d
lea edx, [ebx + 0x16d]
cmp eax, edx
jg 0x46e26d
push 0x14
push 6
push 6
push 0x4ade30
lea eax, [ebp + 0x18]
push edi
push eax
jmp 0x46e283
push 7
push 0
lea edi, [ebx + 0x15a]
push 0
push 0x4ade30
lea ecx, [ebp + 0x18]
push edi
push ecx
mov ecx, esi
call fcn.00414550
movsx eax, word [esp + 0x1e4]
lea edx, [ebp + 0x9f]
cmp eax, edx
jl 0x46e2dc
lea ecx, [ebp + 0xfe]
cmp eax, ecx
jg 0x46e2dc
movsx eax, word [esp + 0x1e8]
cmp eax, edi
jl 0x46e2dc
add ebx, 0x16d
cmp eax, ebx
jg 0x46e2dc
cmp byte [esi + 0x166a], 1
jne 0x46e2fc
push 0x14
push 6
push 6
push 0x4ade24
push edi
add ebp, 0x98
jmp 0x46ef76
cmp byte [esi + 0x166a], 1
jne 0x46e2fc
push 7
push 0
push 0
push 0x4ade24
push edi
add ebp, 0x98
jmp 0x46ef76
push 0xa
push 0xa
push 0xa
push 0x4ade24
push edi
add ebp, 0x98
jmp 0x46ef76
mov ecx, edi
call fcn.00402250
movsx edx, word [esp + 0x18]
lea eax, [ebx + 0x10c]
lea ecx, [edx + ebp]
lea edx, [eax + 0xf]
mov dword [esp + 0x14], ecx
push edx
push ecx
push eax
lea eax, [esp + 0x28]
push ebp
push eax
call dword [sym.imp.user32.dll_SetRect]
push 0x191937
lea ecx, [esp + 0x20]
push 0x4addfc
push ecx
mov ecx, edi
call fcn.004022b0
mov ecx, edi
call fcn.00402290
mov ecx, edi
call fcn.00402250
mov ecx, dword [esp + 0x14]
lea eax, [ebx + 0x11b]
lea edx, [eax + 0xf]
push edx
push ecx
push eax
lea edx, [esp + 0x28]
push ebp
push edx
call dword [sym.imp.user32.dll_SetRect]
push 0x191937
lea eax, [esp + 0x20]
push 0x4addd8
push eax
mov ecx, edi
call fcn.004022b0
mov ecx, edi
call fcn.00402290
mov ecx, edi
call fcn.00402250
mov edx, dword [esp + 0x14]
lea eax, [ebx + 0x12a]
lea ecx, [eax + 0xf]
push ecx
push edx
push eax
lea eax, [esp + 0x28]
push ebp
push eax
call dword [sym.imp.user32.dll_SetRect]
push 0x191937
lea ecx, [esp + 0x20]
push 0x4addc4
push ecx
mov ecx, edi
call fcn.004022b0
mov ecx, edi
call fcn.00402290
movsx eax, word [esp + 0x1e4]
lea edx, [ebp + 0x1f]
cmp eax, edx
jl 0x46e421
lea ecx, [ebp + 0x5e]
cmp eax, ecx
jg 0x46e421
movsx ecx, word [esp + 0x1e8]
lea eax, [ebx + 0x15a]
cmp ecx, eax
jl 0x46e421
lea edx, [ebx + 0x16d]
cmp ecx, edx
jg 0x46e421
push 0x14
push 6
push 6
push 0x4ade30
push eax
add ebp, 0x18
jmp 0x46ef76
push 7
push 0
push 0
add ebx, 0x15a
push 0x4ade30
push ebx
add ebp, 0x18
jmp 0x46ef76
mov ecx, dword [esi + 0x36170]
mov di, word [esi + 0x165c]
mov bx, word [esi + 0x165e]
test ecx, ecx
je 0x46e469
mov eax, dword [esi + 0x4dd34]
push eax
push 0
movsx edx, bx
movsx eax, di
push edx
push eax
call fcn.00488ff0
mov ecx, dword [esi + 0x36190]
test ecx, ecx
je 0x46e489
mov edx, dword [esi + 0x4dd34]
push edx
push 8
movsx eax, bx
movsx edx, di
push eax
push edx
call fcn.00488ff0
movsx eax, byte [esi + 0x1666]
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + eax*4 + 0x4c508]
push ecx
movsx ebx, bx
mov edx, dword [eax + 0x2c]
mov eax, dword [eax + 0x28]
movsx ebp, di
push edx
lea ecx, [ebx + 0x5e]
lea edx, [ebp + 0x42]
push ecx
mov ecx, dword [esi + eax*4 + 0x36528]
push edx
mov dword [esp + 0x20], ebp
call fcn.00488ff0
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0x70]
lea edx, [esp + 0x128]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xe8]
lea eax, [esp + 0x30]
push ecx
push edx
movsx ecx, byte [esi + 0x1666]
push eax
push 0
mov edx, dword [esi + ecx*4 + 0x4c508]
mov ecx, esi
add edx, 8
push edx
call fcn.00454500
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4a7454
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
lea edi, [esi + 0x6004]
add esp, 0xc
mov ecx, edi
call fcn.00402250
lea edx, [esp + 0x70]
push 0xffffff
lea eax, [ebx + 0x30]
add ebp, 0x71
push edx
push eax
push ebp
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
movsx ecx, byte [esi + 0x1666]
mov eax, dword [esi + ecx*4 + 0x4c508]
lea ecx, [esp + 0x70]
mov edx, dword [eax + 0x24]
mov eax, dword [eax + 0x20]
push edx
push eax
push 0x4adeac
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x10
mov ecx, edi
call fcn.00402250
lea edx, [esp + 0x70]
push 0x19192d
lea eax, [ebx + 0x4e]
push edx
push eax
push ebp
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
mov ecx, edi
call fcn.00402250
push 0x19192d
push 0x4ade98
lea ecx, [ebx + 0x62]
push ecx
push ebp
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
movsx edx, byte [esi + 0x1666]
mov ebp, 4
mov eax, dword [esi + edx*4 + 0x4c508]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x46e662
lea ecx, [esp + 0xe8]
lea edx, [esp + 0x128]
push ecx
lea ecx, [esp + 0x34]
push edx
push ecx
add eax, 0x30
push 0
push eax
mov ecx, esi
call fcn.00454500
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4a7454
push eax
call dword [sym.imp.user32.dll_wsprintfA]
movsx ecx, byte [esi + 0x1666]
add esp, 0xc
mov edx, dword [esi + ecx*4 + 0x4c508]
mov ecx, edi
cmp dword [edx + 0xd0], 1
jne 0x46e634
call fcn.00402250
push 0x19192d
jmp 0x46e63e
call fcn.00402250
push 0x787878
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x74]
lea ecx, [ebx + 0x71]
push eax
add edx, 0x7b
push ecx
push edx
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
mov ebp, 5
movsx eax, byte [esi + 0x1666]
mov eax, dword [esi + eax*4 + 0x4c508]
mov ecx, dword [eax + 0xb8]
test ecx, ecx
je 0x46e728
lea ecx, [esp + 0xe8]
lea edx, [esp + 0x128]
push ecx
lea ecx, [esp + 0x34]
push edx
push ecx
add eax, 0x45
push 0
push eax
mov ecx, esi
call fcn.00454500
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4a7454
push eax
call dword [sym.imp.user32.dll_wsprintfA]
movsx ecx, byte [esi + 0x1666]
add esp, 0xc
mov edx, dword [esi + ecx*4 + 0x4c508]
mov ecx, edi
cmp dword [edx + 0xd4], 1
jne 0x46e6f6
call fcn.00402250
lea eax, [esp + 0x70]
push 0x19192d
push eax
lea eax, [ebp + ebp*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
mov eax, dword [esp + 0x18]
add eax, 0x7b
push edx
push eax
jmp 0x46e719
call fcn.00402250
lea eax, [ebp + ebp*2]
lea ecx, [esp + 0x70]
push 0x787878
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [ebx + eax*4]
add ecx, 0x7b
lea eax, [eax + edx + 0x35]
push eax
push ecx
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
inc ebp
movsx edx, byte [esi + 0x1666]
mov eax, dword [esi + edx*4 + 0x4c508]
mov ecx, dword [eax + 0xbc]
test ecx, ecx
je 0x46e7ee
lea ecx, [esp + 0xe8]
lea edx, [esp + 0x128]
push ecx
lea ecx, [esp + 0x34]
push edx
push ecx
add eax, 0x5a
push 0
push eax
mov ecx, esi
call fcn.00454500
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4a7454
push eax
call dword [sym.imp.user32.dll_wsprintfA]
movsx ecx, byte [esi + 0x1666]
add esp, 0xc
mov edx, dword [esi + ecx*4 + 0x4c508]
mov ecx, edi
cmp dword [edx + 0xd8], 1
jne 0x46e7bc
call fcn.00402250
lea eax, [esp + 0x70]
push 0x19192d
push eax
lea eax, [ebp + ebp*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
mov eax, dword [esp + 0x18]
add eax, 0x7b
push edx
push eax
jmp 0x46e7df
call fcn.00402250
lea eax, [ebp + ebp*2]
lea ecx, [esp + 0x70]
push 0x787878
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [ebx + eax*4]
add ecx, 0x7b
lea eax, [eax + edx + 0x35]
push eax
push ecx
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
inc ebp
movsx edx, byte [esi + 0x1666]
mov eax, dword [esi + edx*4 + 0x4c508]
mov ecx, dword [eax + 0xc0]
test ecx, ecx
je 0x46e8b4
lea ecx, [esp + 0xe8]
lea edx, [esp + 0x128]
push ecx
lea ecx, [esp + 0x34]
push edx
push ecx
add eax, 0x6f
push 0
push eax
mov ecx, esi
call fcn.00454500
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4a7454
push eax
call dword [sym.imp.user32.dll_wsprintfA]
movsx ecx, byte [esi + 0x1666]
add esp, 0xc
mov edx, dword [esi + ecx*4 + 0x4c508]
mov ecx, edi
cmp dword [edx + 0xdc], 1
jne 0x46e882
call fcn.00402250
lea eax, [esp + 0x70]
push 0x19192d
push eax
lea eax, [ebp + ebp*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
mov eax, dword [esp + 0x18]
add eax, 0x7b
push edx
push eax
jmp 0x46e8a5
call fcn.00402250
lea eax, [ebp + ebp*2]
lea ecx, [esp + 0x70]
push 0x787878
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [ebx + eax*4]
add ecx, 0x7b
lea eax, [eax + edx + 0x35]
push eax
push ecx
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
inc ebp
movsx edx, byte [esi + 0x1666]
mov eax, dword [esi + edx*4 + 0x4c508]
mov ecx, dword [eax + 0xc4]
test ecx, ecx
je 0x46e97c
lea ecx, [esp + 0xe8]
lea edx, [esp + 0x128]
push ecx
lea ecx, [esp + 0x34]
push edx
push ecx
add eax, 0x84
push 0
push eax
mov ecx, esi
call fcn.00454500
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4a7454
push eax
call dword [sym.imp.user32.dll_wsprintfA]
movsx ecx, byte [esi + 0x1666]
add esp, 0xc
mov edx, dword [esi + ecx*4 + 0x4c508]
mov ecx, edi
cmp dword [edx + 0xe0], 1
jne 0x46e94a
call fcn.00402250
lea eax, [esp + 0x70]
push 0x19192d
push eax
lea eax, [ebp + ebp*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
mov eax, dword [esp + 0x18]
add eax, 0x7b
push edx
push eax
jmp 0x46e96d
call fcn.00402250
lea eax, [ebp + ebp*2]
lea ecx, [esp + 0x70]
push 0x787878
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [ebx + eax*4]
add ecx, 0x7b
lea eax, [eax + edx + 0x35]
push eax
push ecx
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
inc ebp
movsx edx, byte [esi + 0x1666]
mov eax, dword [esi + edx*4 + 0x4c508]
mov ecx, dword [eax + 0xc8]
test ecx, ecx
je 0x46ea43
lea ecx, [esp + 0xe8]
lea edx, [esp + 0x128]
push ecx
lea ecx, [esp + 0x34]
push edx
push ecx
add eax, 0x99
push 0
push eax
mov ecx, esi
call fcn.00454500
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4a7454
push eax
call dword [sym.imp.user32.dll_wsprintfA]
movsx ecx, byte [esi + 0x1666]
add esp, 0xc
mov edx, dword [esi + ecx*4 + 0x4c508]
mov ecx, edi
cmp dword [edx + 0xe4], 1
jne 0x46ea12
call fcn.00402250
lea eax, [esp + 0x70]
push 0x19192d
push eax
lea eax, [ebp + ebp*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
mov eax, dword [esp + 0x18]
add eax, 0x7b
push edx
push eax
jmp 0x46ea35
call fcn.00402250
lea eax, [ebp + ebp*2]
lea ecx, [esp + 0x70]
push 0x787878
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [ebx + eax*4]
add ecx, 0x7b
lea eax, [eax + edx + 0x35]
push eax
push ecx
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
mov edx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
lea eax, [ebx + 0xe4]
push ebp
lea ecx, [edx + 0x61]
push 2
push eax
push ecx
mov ecx, dword [esi + 0x360e4]
call fcn.00488ff0
mov eax, dword [esp + 0x10]
push ebp
push 2
lea ecx, [eax + 0x8e]
lea eax, [ebx + 0xe4]
push eax
push ecx
mov ecx, dword [esi + 0x360e4]
call fcn.00488ff0
mov ecx, dword [esp + 0x10]
push ebp
lea eax, [ebx + 0xe4]
add ecx, 0xbb
push 2
push eax
push ecx
mov ecx, dword [esi + 0x360e4]
call fcn.00488ff0
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 0x360e4]
lea eax, [ebx + 0x111]
push ebp
push 2
push eax
lea eax, [edx + 0x61]
push eax
call fcn.00488ff0
mov ecx, dword [esi + 0x360e4]
push ebp
lea eax, [ebx + 0x111]
push 2
push eax
mov eax, dword [esp + 0x1c]
add eax, 0x8e
push eax
call fcn.00488ff0
mov ecx, dword [esp + 0x10]
push ebp
lea eax, [ebx + 0x111]
push 2
push eax
lea eax, [ecx + 0xbb]
mov ecx, dword [esi + 0x360e4]
push eax
call fcn.00488ff0
mov eax, dword [esi + 0x1614]
cmp eax, 0xffffffff
je 0x46eb37
mov eax, dword [esi + eax*4 + 0x4b038]
push ebp
lea ecx, [ebx + 0xe4]
movsx edx, word [eax + 0x22]
push edx
push ecx
mov ecx, dword [esp + 0x1c]
movsx edx, word [eax + 0x20]
add ecx, 0x61
push ecx
mov ecx, dword [esi + edx*4 + 0x36528]
call fcn.00488ff0
mov eax, dword [esi + 0x1618]
cmp eax, 0xffffffff
je 0x46eb71
mov eax, dword [esi + eax*4 + 0x4b038]
mov edx, dword [esp + 0x10]
push ebp
movsx ecx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ecx
lea ecx, [ebx + 0xe4]
push ecx
lea ecx, [edx + 0x8e]
push ecx
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.00488ff0
mov eax, dword [esi + 0x161c]
cmp eax, 0xffffffff
je 0x46ebab
mov eax, dword [esi + eax*4 + 0x4b038]
mov edx, dword [esp + 0x10]
push ebp
movsx ecx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ecx
lea ecx, [ebx + 0xe4]
push ecx
lea ecx, [edx + 0xbb]
push ecx
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.00488ff0
mov eax, dword [esi + 0x1620]
cmp eax, 0xffffffff
je 0x46ebe2
mov eax, dword [esi + eax*4 + 0x4b038]
mov edx, dword [esp + 0x10]
push ebp
movsx ecx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ecx
lea ecx, [ebx + 0x111]
push ecx
lea ecx, [edx + 0x61]
push ecx
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.00488ff0
mov eax, dword [esi + 0x1624]
cmp eax, 0xffffffff
je 0x46ec1c
mov eax, dword [esi + eax*4 + 0x4b038]
mov edx, dword [esp + 0x10]
push ebp
movsx ecx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ecx
lea ecx, [ebx + 0x111]
push ecx
lea ecx, [edx + 0x8e]
push ecx
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.00488ff0
mov eax, dword [esi + 0x1628]
cmp eax, 0xffffffff
je 0x46ec56
mov eax, dword [esi + eax*4 + 0x4b038]
mov edx, dword [esp + 0x10]
push ebp
movsx ecx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ecx
lea ecx, [ebx + 0x111]
push ecx
lea ecx, [edx + 0xbb]
push ecx
mov ecx, dword [esi + eax*4 + 0x36528]
call fcn.00488ff0
mov ecx, edi
call fcn.00402250
mov ecx, dword [esp + 0x10]
push 0x191937
lea edx, [ebx + 0x12a]
push 0x4adda4
lea eax, [ecx + 0x20]
push edx
push eax
mov ecx, edi
mov dword [esp + 0x28], eax
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
mov ecx, edi
call fcn.00402250
mov eax, dword [esp + 0x18]
push 0x191937
add ebx, 0x139
push 0x4add7c
push ebx
push eax
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
mov edx, dword [esi + 0x1654]
mov ecx, ebp
sub ecx, edx
cmp ecx, 0x3e8
jbe 0x46ece6
mov dl, byte [esi + 0x1667]
mov dword [esi + 0x1654], ebp
inc dl
mov al, dl
mov byte [esi + 0x1667], dl
cmp al, 7
jl 0x46ece6
mov byte [esi + 0x1667], 7
cmp byte [esi + 0x1667], 4
jne case.default.0x46cc47
movsx edx, byte [esi + 0x1666]
push 0
mov ecx, esi
mov eax, dword [esi + edx*4 + 0x4c508]
add eax, 8
push eax
push 0
push 0
push 0
push 0
push 0xa23
push 0xfa314dc
call fcn.00404de0
mov al, byte [esi + 0x1667]
pop edi
inc al
mov byte [esi + 0x1667], al
pop esi
pop ebp
pop ebx
add esp, 0x1d0
ret 0x10
mov ecx, dword [esi + 0x36170]
mov di, word [esi + 0x165c]
mov bx, word [esi + 0x165e]
test ecx, ecx
je 0x46ed69
mov edx, dword [esi + 0x4dd34]
push edx
push 0
movsx eax, bx
movsx edx, di
push eax
push edx
call fcn.00488ff0
mov ecx, dword [esi + 0x36190]
test ecx, ecx
je 0x46ed89
mov eax, dword [esi + 0x4dd34]
push eax
push 8
movsx edx, bx
movsx eax, di
push edx
push eax
call fcn.00488ff0
movsx ecx, byte [esi + 0x1666]
mov edx, dword [esp + 0x14]
mov eax, dword [esi + ecx*4 + 0x4c508]
push edx
movsx ebx, bx
mov ecx, dword [eax + 0x2c]
movsx ebp, di
lea edx, [ebx + 0x5e]
push ecx
push edx
mov edx, dword [eax + 0x28]
lea ecx, [ebp + 0x42]
push ecx
mov ecx, dword [esi + edx*4 + 0x36528]
call fcn.00488ff0
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0x70]
lea edx, [esp + 0x30]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xe8]
lea ecx, [esp + 0x128]
push eax
push ecx
movsx eax, byte [esi + 0x1666]
push edx
push 0
mov ecx, dword [esi + eax*4 + 0x4c508]
add ecx, 8
push ecx
mov ecx, esi
call fcn.00454500
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4a7454
push eax
call dword [sym.imp.user32.dll_wsprintfA]
lea edi, [esi + 0x6004]
add esp, 0xc
mov ecx, edi
call fcn.00402250
lea ecx, [esp + 0x70]
push 0xffffff
lea edx, [ebx + 0x30]
push ecx
lea eax, [ebp + 0x71]
push edx
push eax
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
mov al, byte [esi + 0x1668]
mov ecx, edi
cmp al, 1
jne 0x46eef9
call fcn.00402250
push 0x191937
lea ecx, [ebx + 0x94]
lea eax, [ebp + 0x2b]
push 0x4add60
push ecx
push eax
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
mov eax, dword [esi + 0x1614]
cmp eax, 0xc
lea eax, [esi + 0x4e763]
jne 0x46eebf
movsx edx, byte [esi + 0x1669]
push edx
push 0x4add40
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
mov ecx, edi
call fcn.00402250
lea eax, [esi + 0x4e763]
push 0x191937
push eax
lea eax, [ebx + 0xa3]
push eax
lea eax, [ebp + 0x2b]
push eax
jmp 0x46ef13
movsx ecx, byte [esi + 0x1669]
add ecx, 0x64
push ecx
push 0x4add1c
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
mov ecx, edi
call fcn.00402250
lea eax, [esi + 0x4e763]
push 0x191937
push eax
lea edx, [ebx + 0xa3]
lea eax, [ebp + 0x20]
push edx
push eax
jmp 0x46ef13
call fcn.00402250
push 0x191937
lea ecx, [ebx + 0xc1]
push 0x4add04
lea edx, [ebp + 0x2b]
push ecx
push edx
mov ecx, edi
call fcn.00401ef0
mov ecx, edi
call fcn.00402290
movsx eax, word [esp + 0x1e4]
lea ecx, [ebp + 0x1f]
cmp eax, ecx
jl 0x46ef61
lea edx, [ebp + 0x5e]
cmp eax, edx
jg 0x46ef61
movsx ecx, word [esp + 0x1e8]
lea eax, [ebx + 0x15a]
cmp ecx, eax
jl 0x46ef61
lea edx, [ebx + 0x16d]
cmp ecx, edx
jg 0x46ef61
push 0x14
push 6
push 6
push 0x4ade30
push eax
jmp 0x46ef73
push 7
push 0
push 0
add ebx, 0x15a
push 0x4ade30
push ebx
add ebp, 0x22
push ebp
mov ecx, esi
call fcn.00414550
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d0
ret 0x10