Function at 0x4cda08
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x22
push 0
push 0
dec ecx
jne 0x4cda10
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404750
xor eax, eax
push ebp
push 0x4cfeca
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
mov eax, dword [ebp - 8]
call fcn.00404560
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 8]
mov eax, 0x4cfee4
call fcn.004048a4
test eax, eax
jle 0x4cda66
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004c70dc
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4cfef4
call fcn.004048a4
test eax, eax
jle 0x4cdae7
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4cff04
mov edx, 0x4cff14
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [ebp - 0x10]
call fcn.00404560
test eax, eax
jle 0x4cfe4d
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004cbe84
mov byte [0x4d94da], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x20]
sub ecx, 7
mov edx, 8
mov eax, dword [ebp - 8]
call fcn.004047c0
mov eax, dword [ebp - 0x10]
call fcn.00404560
cmp eax, 2
jle 0x4cfe4d
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004cda08
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4cff24
call fcn.004048a4
test eax, eax
jle 0x4cdbb3
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4cff04
mov edx, 0x4cff14
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [ebp - 0x10]
call fcn.00404560
test eax, eax
jle 0x4cfe4d
push 0x41
lea ecx, [ebp - 0x40]
mov dx, 0x3a8
mov eax, dword [ebp - 0x10]
call fcn.004b746c
push dword [ebp - 0x40]
push 0x4cff34
push 0x4cff34
push 0x4cff3c
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.00404cb8
mov eax, dword [ebp - 0x3c]
call fcn.00404bd8
mov edx, eax
mov ecx, 0x4cff64
mov eax, dword [0x4d5ac0]
mov eax, dword [eax]
call fcn.0047aa00
dec eax
jne 0x4cfe4d
mov byte [0x4d94da], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0xb
mov edx, 0xc
mov eax, dword [ebp - 8]
call fcn.004047c0
mov eax, dword [ebp - 0x10]
call fcn.00404560
cmp eax, 2
jle 0x4cfe4d
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004cda08
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4cff74
call fcn.004048a4
test eax, eax
jle 0x4cdc0b
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4cff84
mov edx, 0x4cff94
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [ebp - 0x10]
call fcn.00404560
cmp eax, 2
jle 0x4cfe4d
lea eax, [ebp - 0x44]
mov ecx, dword [ebp - 0x10]
mov edx, 0x4cffa4
call fcn.004045ac
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004cda08
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4cffa4
call fcn.004048a4
test eax, eax
jle 0x4cdc7b
xor eax, eax
mov dword [0x4d9514], eax
xor eax, eax
mov dword [0x4d9510], eax
push 0x4d9390
mov ecx, dword [ebp - 0x20]
sub ecx, 5
mov edx, 6
mov eax, dword [ebp - 8]
call fcn.004047c0
mov edx, dword [0x4d9390]
mov eax, 0x4cffb4
call fcn.004048a4
test eax, eax
jle 0x4cdc60
mov dword [0x4d9514], 1
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x4c2734
xor edx, edx
xor eax, eax
call fcn.00404244
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4cffc0
call fcn.004048a4
test eax, eax
jle 0x4cdcbf
push 0x4d948c
mov ecx, dword [ebp - 0x20]
sub ecx, 5
mov edx, 6
mov eax, dword [ebp - 8]
call fcn.004047c0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x4c2000
xor edx, edx
xor eax, eax
call fcn.00404244
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4cffd0
call fcn.004048a4
test eax, eax
jle 0x4cdf33
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
sub ecx, 6
mov edx, 7
mov eax, dword [ebp - 8]
call fcn.004047c0
mov eax, dword [ebp - 0x14]
mov edx, 0x4cffe0
call fcn.004046ac
jne 0x4cdd81
mov eax, dword [0x4d612c]
cmp byte [eax + 9], 0
je 0x4cdd45
mov eax, dword [0x4d612c]
mov byte [eax + 9], 0
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0010
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d0020
mov ecx, 0x4d0000
mov edx, 0x4d0030
mov eax, dword [ebp - 4]
call fcn.004c3d68
jmp 0x4cdeb0
mov eax, dword [0x4d612c]
mov byte [eax + 9], 1
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0030
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d0020
mov ecx, 0x4d0000
mov edx, 0x4d0010
mov eax, dword [ebp - 4]
call fcn.004c3d68
jmp 0x4cdeb0
mov eax, dword [ebp - 0x14]
mov edx, 0x4d0040
call fcn.004046ac
jne 0x4cde26
mov eax, dword [0x4d612c]
cmp byte [eax + 0xa], 0
je 0x4cddd8
mov eax, dword [0x4d612c]
mov byte [eax + 0xa], 0
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0050
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d0020
mov ecx, 0x4d0000
mov edx, 0x4d0060
mov eax, dword [ebp - 4]
call fcn.004c3d68
jmp 0x4cde0f
mov eax, dword [0x4d612c]
mov byte [eax + 0xa], 1
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0060
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d0020
mov ecx, 0x4d0000
mov edx, 0x4d0050
mov eax, dword [ebp - 4]
call fcn.004c3d68
cmp byte [0x4d94d8], 0
je 0x4cdeb0
call fcn.004b89f0
jmp 0x4cdeb0
mov eax, dword [ebp - 0x14]
mov edx, 0x4d0070
call fcn.004046ac
jne 0x4cdeb0
mov eax, dword [0x4d612c]
cmp byte [eax + 0xb], 0
je 0x4cde79
mov eax, dword [0x4d612c]
mov byte [eax + 0xb], 0
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0080
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d0020
mov ecx, 0x4d0000
mov edx, 0x4d0090
mov eax, dword [ebp - 4]
call fcn.004c3d68
jmp 0x4cdeb0
mov eax, dword [0x4d612c]
mov byte [eax + 0xb], 1
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0090
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d0020
mov ecx, 0x4d0000
mov edx, 0x4d0080
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d00a0
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d00c0
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00d0
mov ecx, 0x4cff04
mov edx, 0x4d00e4
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov edx, 0x4d00f8
mov eax, dword [ebp - 4]
call fcn.004c3b5c
cmp byte [0x4d94d8], 0
je 0x4cdf10
call fcn.004bdc98
cmp byte [0x4d94d8], 0
je 0x4cdf21
mov eax, dword [ebp - 4]
call fcn.004c79b4
call fcn.004bb3c0
mov eax, dword [ebp - 4]
call fcn.004c687c
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0120
call fcn.004048a4
test eax, eax
jle 0x4ce427
mov byte [ebp - 0x25], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4cff84
mov edx, 0x4d0130
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [ebp - 0x18]
mov edx, 0x4d0144
call fcn.004046ac
jne 0x4cdf7e
lea eax, [ebp - 0x18]
mov edx, 0x4d0158
call fcn.00404328
cmp dword [ebp - 0x18], 0
jne 0x4cdf95
lea eax, [ebp - 0x18]
mov edx, dword [0x4d612c]
mov edx, dword [edx + 0x10]
call fcn.00404328
mov eax, dword [ebp - 0x18]
mov edx, 0x4d0158
call fcn.004046ac
jne 0x4cdfeb
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0168
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d017c
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov edx, 0x4d018c
mov eax, dword [ebp - 4]
call fcn.004c3b5c
mov byte [0x4d94da], 0
jmp 0x4cfe54
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4cff84
mov edx, 0x4d01a4
mov eax, dword [ebp - 4]
call fcn.004c41d0
cmp dword [ebp - 0x1c], 0
jne 0x4ce018
lea eax, [ebp - 0x1c]
mov edx, dword [0x4d612c]
mov edx, dword [edx + 0x14]
call fcn.00404328
mov eax, dword [0x4d612c]
mov al, byte [eax + 8]
mov byte [ebp - 0x26], al
xor eax, eax
push ebp
push 0x4ce0bd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4d01b4
push 0x4d01bc
push 0x4d01d0
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
call fcn.004afd24
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00411360
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00411360
add esp, 0x10
lea edx, [ebp - 0x54]
lea eax, [ebp - 0x38]
call fcn.004159a4
lea eax, [ebp - 0x78]
lea edx, [ebp - 0x38]
call fcn.0041552c
cmp dword [ebp - 0x78], 0
je 0x4ce0b3
push 0x4d01dc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00411360
add esp, 0xc
lea eax, [ebp - 0x88]
call fcn.00413208
mov byte [ebp - 0x26], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ce0c7
mov eax, dword [0x4d612c]
mov al, byte [eax + 8]
cmp al, byte [ebp - 0x26]
je 0x4ce0e3
mov byte [ebp - 0x25], 1
mov eax, dword [0x4d612c]
mov dl, byte [ebp - 0x26]
mov byte [eax + 8], dl
mov eax, dword [ebp - 0x1c]
mov edx, dword [0x4d612c]
mov edx, dword [edx + 0x14]
call fcn.004046ac
je 0x4ce172
mov byte [ebp - 0x25], 1
mov eax, dword [0x4d612c]
add eax, 0x14
mov edx, dword [ebp - 0x1c]
call fcn.004042e4
mov dl, 1
mov eax, dword [0x4a56ec]
call fcn.004a5780
mov ebx, eax
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x94]
mov edx, dword [0x4d612c]
mov edx, dword [edx + 0x14]
mov eax, ebx
call fcn.004a5468
mov eax, dword [ebp - 0x94]
mov ecx, 0xa
xor edx, edx
call fcn.004047c0
mov eax, dword [ebp - 0x90]
lea edx, [ebp - 0x8c]
call fcn.004089f8
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x4d612c]
add eax, 0x1c
call fcn.004042e4
mov eax, ebx
call fcn.00403440
mov eax, dword [ebp - 0x18]
mov edx, dword [0x4d612c]
mov edx, dword [edx + 0x10]
call fcn.004046ac
je 0x4ce239
mov byte [ebp - 0x25], 1
mov eax, dword [0x4d612c]
add eax, 0x10
mov edx, dword [ebp - 0x18]
call fcn.004042e4
mov byte [0x4d94e2], 1
mov eax, 0x4d93c8
call fcn.00404290
mov eax, 0x4d93cc
call fcn.00404290
lea eax, [ebp - 0x9c]
mov ecx, 0x4d01f0
mov edx, dword [0x4d9370]
call fcn.004045ac
mov eax, dword [ebp - 0x9c]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x98]
call fcn.00404498
mov eax, dword [ebp - 0x98]
call fcn.004099c8
lea eax, [ebp - 0xa4]
mov ecx, 0x4d0200
mov edx, dword [0x4d9370]
call fcn.004045ac
mov eax, dword [ebp - 0xa4]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0xa0]
call fcn.00404498
mov eax, dword [ebp - 0xa0]
call fcn.004099c8
mov eax, 0x4d94a0
mov edx, 0x4d0210
call fcn.004042e4
cmp byte [ebp - 0x25], 0
je 0x4ce244
call fcn.004bb3c0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
sub ecx, 8
mov edx, 9
mov eax, dword [ebp - 8]
call fcn.004047c0
mov eax, dword [ebp - 0x14]
mov edx, 0x4d021c
call fcn.004046ac
jne 0x4ce402
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0168
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d0228
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov eax, dword [ebp - 0x18]
push eax
mov ecx, 0x4cff04
mov edx, 0x4d0238
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d024c
mov ecx, 0x4cff04
mov edx, 0x4d025c
mov eax, dword [ebp - 4]
call fcn.004c3d68
cmp byte [0x4d94e2], 0
je 0x4ce3cb
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d026c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d027c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d028c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d029c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02ac
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02bc
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02cc
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02dc
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02ec
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d0020
mov ecx, 0x4d0000
mov edx, 0x4d02fc
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov edx, 0x4d030c
mov eax, dword [ebp - 4]
call fcn.004c611c
jmp 0x4ce3f0
mov eax, 0x4d948c
mov edx, 0x4d031c
call fcn.004042e4
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x4c2000
xor edx, edx
xor eax, eax
call fcn.00404244
mov edx, 0x4d0334
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov eax, dword [ebp - 0x14]
mov edx, 0x4d034c
call fcn.004046ac
jne 0x4cfe4d
mov edx, 0x4d035c
mov eax, dword [ebp - 4]
call fcn.004c611c
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d036c
call fcn.004048a4
test eax, eax
jle 0x4ce579
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d017c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0228
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d0168
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d026c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d027c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d028c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d029c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02ac
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02bc
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02cc
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02dc
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02ec
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d0020
mov ecx, 0x4d0000
mov edx, 0x4d02fc
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov edx, 0x4d037c
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0394
call fcn.004048a4
test eax, eax
jle 0x4ce600
lea eax, [ebp - 0xa8]
push eax
mov ecx, 0x4cff84
mov edx, 0x4d03a4
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [ebp - 0xa8]
push eax
mov ecx, 0x4cff84
mov edx, 0x4d0130
mov eax, dword [ebp - 4]
call fcn.004c3d68
lea eax, [ebp - 0xac]
push eax
mov ecx, 0x4cff84
mov edx, 0x4d03b8
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [ebp - 0xac]
push eax
mov ecx, 0x4cff84
mov edx, 0x4d01a4
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov edx, 0x4d03cc
mov eax, dword [ebp - 4]
call fcn.004cda08
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d03e0
call fcn.004048a4
test eax, eax
jle 0x4ce769
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4cff84
mov edx, 0x4d03a4
mov eax, dword [ebp - 4]
call fcn.004c41d0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4cff84
mov edx, 0x4d03b8
mov eax, dword [ebp - 4]
call fcn.004c41d0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4cff84
mov edx, 0x4d03f4
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [ebp - 0x18]
call fcn.00404560
cmp eax, 3
jl 0x4ce681
mov eax, dword [ebp - 0x18]
call fcn.00404560
cmp eax, 0x28
jg 0x4ce681
mov edx, dword [ebp - 0x18]
mov eax, 0x4d0408
call fcn.004048a4
dec eax
jge 0x4ce693
mov edx, 0x4d0414
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov eax, dword [ebp - 0x1c]
call fcn.00404560
cmp eax, 3
jl 0x4ce6ad
mov eax, dword [ebp - 0x1c]
call fcn.00404560
cmp eax, 0x1e
jle 0x4ce6bf
mov edx, 0x4d0450
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
call fcn.004046ac
je 0x4ce6de
mov edx, 0x4d0488
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov edx, 0x4d04b8
mov eax, dword [ebp - 4]
call fcn.004c3b5c
mov dl, 1
mov eax, dword [0x4a56ec]
call fcn.004a5780
mov ebx, eax
lea ecx, [ebp - 0xb4]
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.004a5468
mov eax, dword [ebp - 0xb4]
lea edx, [ebp - 0xb0]
call fcn.004089f8
mov edx, dword [ebp - 0xb0]
lea eax, [ebp - 0x1c]
call fcn.00404328
mov eax, ebx
call fcn.00403440
push 0x4d04cc
push dword [ebp - 0x18]
push 0x4d04ec
push dword [ebp - 0x1c]
mov eax, 0x4d948c
mov edx, 4
call fcn.00404620
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x4c2000
xor edx, edx
xor eax, eax
call fcn.00404244
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0500
call fcn.004048a4
test eax, eax
jle 0x4ce7ba
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0168
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d017c
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov edx, 0x4d018c
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0510
call fcn.004048a4
test eax, eax
jle 0x4ce8be
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d028c
mov eax, dword [ebp - 4]
call fcn.004c3d68
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4cff84
mov edx, 0x4d0520
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [ebp - 0x1c]
call fcn.00404560
cmp eax, 3
jle 0x4cfe4d
mov eax, dword [0x4d612c]
add eax, 0x14
mov edx, dword [ebp - 0x1c]
call fcn.004042e4
mov dl, 1
mov eax, dword [0x4a56ec]
call fcn.004a5780
mov ebx, eax
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0xc0]
mov edx, dword [0x4d612c]
mov edx, dword [edx + 0x14]
mov eax, ebx
call fcn.004a5468
mov eax, dword [ebp - 0xc0]
mov ecx, 0xa
xor edx, edx
call fcn.004047c0
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb8]
call fcn.004089f8
mov edx, dword [ebp - 0xb8]
mov eax, dword [0x4d612c]
add eax, 0x1c
call fcn.004042e4
mov eax, ebx
call fcn.00403440
push 0
mov ecx, 0x4cff84
mov edx, 0x4d0520
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov eax, dword [0x4d612c]
mov eax, dword [eax + 0x14]
push eax
mov ecx, 0x4cff84
mov edx, 0x4d01a4
mov eax, dword [ebp - 4]
call fcn.004c3d68
call fcn.004bb3c0
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0534
call fcn.004048a4
test eax, eax
jle 0x4ce8eb
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d028c
mov eax, dword [ebp - 4]
call fcn.004c3d68
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0548
call fcn.004048a4
test eax, eax
jle 0x4ce9f0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4cff84
mov edx, 0x4d0520
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [0x4d612c]
mov eax, dword [eax + 0x10]
mov edx, 0x4d0158
call fcn.004046ac
je 0x4ce941
mov edx, dword [0x4d612c]
mov edx, dword [edx + 0x10]
mov eax, 0x4d055c
call fcn.004048a4
test eax, eax
jle 0x4ce953
mov edx, 0x4d056c
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov eax, dword [ebp - 0x1c]
call fcn.00404560
cmp eax, 6
jge 0x4ce972
mov edx, 0x4d0590
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov dl, 1
mov eax, dword [0x4a56ec]
call fcn.004a5780
mov ebx, eax
lea ecx, [ebp - 0xc8]
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.004a5468
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0xc4]
call fcn.004089f8
mov edx, dword [ebp - 0xc4]
lea eax, [ebp - 0x1c]
call fcn.00404328
mov eax, ebx
call fcn.00403440
mov eax, 0x4d948c
mov ecx, dword [ebp - 0x1c]
mov edx, 0x4d05b8
call fcn.004045ac
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x4c2000
xor edx, edx
xor eax, eax
call fcn.00404244
mov edx, 0x4d05d8
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d028c
call fcn.004048a4
test eax, eax
jle 0x4cea62
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d027c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d029c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02ac
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d028c
mov eax, dword [ebp - 4]
call fcn.004c3d68
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d05f0
call fcn.004048a4
test eax, eax
jle 0x4ceab3
push 0x4d0600
mov ecx, 0x4cff04
mov edx, 0x4d025c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d026c
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov edx, 0x4d062c
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d066c
call fcn.004048a4
test eax, eax
jle 0x4ceb64
push 0x4d067c
mov ecx, 0x4cff04
mov edx, 0x4d025c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02dc
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d0020
mov ecx, 0x4d0000
mov edx, 0x4d02ec
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02bc
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02cc
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02fc
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov edx, 0x4d02ec
mov eax, dword [ebp - 4]
call fcn.004cda08
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d06a8
call fcn.004048a4
test eax, eax
jle 0x4cec64
push 0x4d06b8
mov ecx, 0x4cff04
mov edx, 0x4d025c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d06e4
mov ecx, 0x4cff04
mov edx, 0x4d02bc
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d0020
mov ecx, 0x4d0000
mov edx, 0x4d02bc
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02cc
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02dc
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02ec
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d028c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d029c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02ac
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02fc
mov eax, dword [ebp - 4]
call fcn.004c3d68
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d02dc
call fcn.004048a4
test eax, eax
jle 0x4ced5a
push 0x4d06f4
mov ecx, 0x4cff04
mov edx, 0x4d025c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d0020
mov ecx, 0x4d0000
mov edx, 0x4d02dc
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d0020
mov ecx, 0x4d0000
mov edx, 0x4d02ec
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02bc
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d028c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d027c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02ac
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d029c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02fc
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov edx, 0x4d0720
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d02ec
call fcn.004048a4
test eax, eax
jle 0x4cedf4
push 0x4d0020
mov ecx, 0x4d0000
mov edx, 0x4d02ec
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d027c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d028c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d029c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d02ac
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov edx, 0x4d0744
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0774
call fcn.004048a4
test eax, eax
jle 0x4cee53
push 0x4d0784
mov ecx, 0x4cff04
mov edx, 0x4d025c
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov eax, 0x4d948c
mov edx, 0x4d031c
call fcn.004042e4
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x4c2000
xor edx, edx
xor eax, eax
call fcn.00404244
mov edx, 0x4d07ac
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d07c4
call fcn.004048a4
test eax, eax
jle 0x4cee80
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d027c
mov eax, dword [ebp - 4]
call fcn.004c3d68
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d07d8
call fcn.004048a4
test eax, eax
jle 0x4ceedf
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d027c
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov eax, 0x4d948c
mov edx, 0x4d07ec
call fcn.004042e4
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x4c2000
xor edx, edx
xor eax, eax
call fcn.00404244
mov edx, 0x4d05d8
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d02bc
call fcn.004048a4
test eax, eax
jle 0x4cef51
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d028c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d029c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d02ac
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d027c
mov eax, dword [ebp - 4]
call fcn.004c3d68
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0804
call fcn.004048a4
test eax, eax
jle 0x4cf0f8
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4d0000
mov edx, 0x4d00a0
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [ebp - 0x10]
mov edx, 0x4d00b0
call fcn.004046ac
jne 0x4cefe2
push 0x4d00d0
mov ecx, 0x4cff04
mov edx, 0x4d00e4
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d00a0
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d00c0
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov edx, 0x4d0814
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cf0ab
push 0x4d0830
mov ecx, 0x4cff04
mov edx, 0x4d00e4
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d00c0
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d00a0
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov eax, dword [0x4d612c]
mov eax, dword [eax + 0x24]
push eax
mov ecx, 0x4cff04
mov edx, 0x4d0844
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0858
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0868
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d087c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d088c
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov edx, 0x4d08a0
mov eax, dword [ebp - 4]
call fcn.004c3b5c
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4cff84
mov edx, 0x4cff94
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [ebp - 0x10]
call fcn.00404560
cmp eax, 2
jle 0x4cfe4d
lea eax, [ebp - 0xcc]
mov ecx, dword [ebp - 0x10]
mov edx, 0x4cffa4
call fcn.004045ac
mov edx, dword [ebp - 0xcc]
mov eax, dword [ebp - 4]
call fcn.004cda08
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d08c0
call fcn.004048a4
test eax, eax
jle 0x4cf14a
push 0x4d08d0
mov ecx, 0x4cff04
mov edx, 0x4d025c
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov eax, 0x4d948c
mov edx, 0x4d08fc
call fcn.004042e4
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x4c2000
xor edx, edx
xor eax, eax
call fcn.00404244
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0914
call fcn.004048a4
test eax, eax
jle 0x4cf1b6
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0928
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0228
mov eax, dword [ebp - 4]
call fcn.004c3d68
lea eax, [ebp - 0xd0]
push eax
mov ecx, dword [ebp - 0x20]
sub ecx, 8
mov edx, 9
mov eax, dword [ebp - 8]
call fcn.004047c0
mov edx, dword [ebp - 0xd0]
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0938
call fcn.004048a4
test eax, eax
jle 0x4cf2cd
push 0x4d00d0
mov ecx, 0x4cff04
mov edx, 0x4d00e4
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d00a0
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d00c0
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0928
mov eax, dword [ebp - 4]
call fcn.004c3d68
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4d0000
mov edx, 0x4d0228
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [ebp - 0x10]
mov edx, 0x4d00b0
call fcn.004046ac
jne 0x4cf275
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0228
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov edx, 0x4d0948
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d0228
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov dword [0x4d5608], 3
mov edx, 0x4d0964
mov eax, dword [ebp - 4]
call fcn.004c3b5c
mov eax, 0x4d948c
mov edx, 0x4d08fc
call fcn.004042e4
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x4c2000
xor edx, edx
xor eax, eax
call fcn.00404244
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0984
call fcn.004048a4
test eax, eax
jle 0x4cf3b5
push 0x4d00d0
mov ecx, 0x4cff04
mov edx, 0x4d00e4
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d00a0
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d00c0
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0228
mov eax, dword [ebp - 4]
call fcn.004c3d68
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4d0000
mov edx, 0x4d0928
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [ebp - 0x10]
mov edx, 0x4d00b0
call fcn.004046ac
jne 0x4cf38c
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0928
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov edx, 0x4d0994
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov edx, 0x4d09a8
mov eax, dword [ebp - 4]
call fcn.004c68b0
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d0928
mov eax, dword [ebp - 4]
call fcn.004c3d68
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d09b4
call fcn.004048a4
test eax, eax
jle 0x4cf455
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4d0000
mov edx, 0x4d087c
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [ebp - 0x10]
mov edx, 0x4cfff0
call fcn.004046ac
jne 0x4cf422
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0858
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d087c
mov eax, dword [ebp - 4]
call fcn.004c3d68
jmp 0x4cfe4d
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d087c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d0858
mov eax, dword [ebp - 4]
call fcn.004c3d68
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d09c8
call fcn.004048a4
test eax, eax
jle 0x4cf4f5
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4d0000
mov edx, 0x4d0858
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [ebp - 0x10]
mov edx, 0x4cfff0
call fcn.004046ac
jne 0x4cf4c2
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d087c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d0858
mov eax, dword [ebp - 4]
call fcn.004c3d68
jmp 0x4cfe4d
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0858
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d087c
mov eax, dword [ebp - 4]
call fcn.004c3d68
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d09dc
call fcn.004048a4
test eax, eax
jle 0x4cf708
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d0868
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d088c
mov eax, dword [ebp - 4]
call fcn.004c3d68
lea eax, [ebp - 0x10]
push eax
mov ecx, 2
mov edx, 0xc
mov eax, dword [ebp - 8]
call fcn.004047c0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xd4]
mov ecx, dword [ebp - 0x10]
mov edx, 0x4d09f0
call fcn.004045ac
mov edx, dword [ebp - 0xd4]
mov ecx, 0x4cff04
mov eax, dword [ebp - 4]
call fcn.004c41d0
lea ecx, [ebp - 0x14]
mov edx, 3
mov eax, dword [ebp - 0x18]
call fcn.00435a10
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [ebp - 0x14]
mov edx, dword [0x4d94a4]
call fcn.004046ac
jne 0x4cf5b2
mov eax, ebx
sub eax, dword [0x4d955c]
cmp eax, 0x3e8
jle 0x4cf6e2
mov dword [0x4d955c], ebx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, 0x4cff04
mov edx, 0x4d0844
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov eax, 0x4d94a4
mov edx, dword [ebp - 0x14]
call fcn.004042e4
lea ecx, [ebp - 0x1c]
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00435a10
mov eax, dword [ebp - 0x1c]
mov edx, 0x4d09fc
call fcn.004046ac
je 0x4cf618
mov eax, dword [ebp - 0x1c]
mov edx, 0x4d09f0
call fcn.004046ac
je 0x4cf618
mov eax, dword [ebp - 0x1c]
mov edx, 0x4d0a08
call fcn.004046ac
jne 0x4cf645
push 0x4d0a14
push dword [ebp - 0x18]
push 0x4d0a2c
lea eax, [ebp - 0xd8]
mov edx, 3
call fcn.00404620
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cf670
push 0x4d0a14
push dword [ebp - 0x18]
push 0x4d0a60
lea eax, [ebp - 0xdc]
mov edx, 3
call fcn.00404620
mov edx, dword [ebp - 0xdc]
mov eax, dword [ebp - 4]
call fcn.004c3b5c
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0xe4]
mov ecx, dword [ebp - 0x10]
mov edx, 0x4d0a84
call fcn.004045ac
mov edx, dword [ebp - 0xe4]
mov ecx, 0x4cff84
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov edx, dword [ebp - 0xe0]
lea eax, [ebp - 0x10]
call fcn.00404328
mov eax, dword [ebp - 0x10]
call fcn.00404560
cmp eax, 2
jle 0x4cfe4d
lea eax, [ebp - 0xe8]
mov ecx, dword [ebp - 0x10]
mov edx, 0x4cffa4
call fcn.004045ac
mov edx, dword [ebp - 0xe8]
mov eax, dword [ebp - 4]
call fcn.004cda08
jmp 0x4cfe4d
lea eax, [ebp - 0xec]
mov ecx, dword [ebp - 0x10]
mov edx, 0x4d0a90
call fcn.004045ac
mov edx, dword [ebp - 0xec]
mov eax, dword [ebp - 4]
call fcn.004cda08
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0a90
call fcn.004048a4
test eax, eax
jle 0x4cf9fc
mov byte [ebp - 0x25], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 2
mov edx, 0xb
mov eax, dword [ebp - 8]
call fcn.004047c0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xf0]
mov ecx, dword [ebp - 0x10]
mov edx, 0x4d09f0
call fcn.004045ac
mov edx, dword [ebp - 0xf0]
mov ecx, 0x4cff04
mov eax, dword [ebp - 4]
call fcn.004c41d0
lea ecx, [ebp - 0x14]
mov edx, 3
mov eax, dword [ebp - 0x18]
call fcn.00435a10
push 0x4d00d0
mov ecx, 0x4cff04
mov edx, 0x4d00e4
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d00a0
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d00c0
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov eax, dword [0x4d612c]
mov eax, dword [eax + 0x24]
mov edx, dword [ebp - 0x18]
call fcn.004046ac
je 0x4cf8a1
mov byte [ebp - 0x25], 1
mov eax, dword [0x4d612c]
add eax, 0x24
mov edx, dword [ebp - 0x18]
call fcn.004042e4
lea eax, [ebp - 0xf4]
push eax
mov ecx, 0x4cff84
mov edx, 0x4d0aa4
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov eax, dword [ebp - 0xf4]
mov edx, 0x1f90
call fcn.004093f4
mov edx, dword [0x4d612c]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, 0x4cff04
mov edx, 0x4d0ab4
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d9454
mov eax, dword [0x4d612c]
mov eax, dword [eax + 0x24]
mov ecx, 3
mov edx, 1
call fcn.004047c0
mov al, byte [0x4d0abc]
push eax
lea eax, [ebp - 0xf8]
push eax
xor ecx, ecx
mov edx, 0x4d0ac8
mov eax, dword [0x4d9454]
call fcn.0040ef70
mov edx, dword [ebp - 0xf8]
mov eax, 0x4d9454
call fcn.004042e4
mov eax, dword [0x4d9454]
mov edx, 0x4d09fc
call fcn.004046ac
jne 0x4cf893
mov eax, 0x4d9454
mov edx, dword [0x4d92fc]
call fcn.004042e4
cmp byte [0x4d94d8], 0
je 0x4cf8a1
call fcn.004bdc98
mov eax, 0x4d94a4
call fcn.00404290
lea ecx, [ebp - 0x1c]
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.00435a10
mov eax, dword [ebp - 0x1c]
mov edx, 0x4d09fc
call fcn.004046ac
je 0x4cf8e8
mov eax, dword [ebp - 0x1c]
mov edx, 0x4d09f0
call fcn.004046ac
je 0x4cf8e8
mov eax, dword [ebp - 0x1c]
mov edx, 0x4d0a08
call fcn.004046ac
jne 0x4cf928
cmp byte [0x4d94d8], 0
je 0x4cf8f6
call fcn.004b89f0
push 0x4d0ad4
mov eax, dword [0x4d612c]
push dword [eax + 0x24]
push 0x4d0afc
lea eax, [ebp - 0xfc]
mov edx, 3
call fcn.00404620
mov edx, dword [ebp - 0xfc]
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cf958
push 0x4d0ad4
mov eax, dword [0x4d612c]
push dword [eax + 0x24]
push 0x4d0b34
lea eax, [ebp - 0x100]
mov edx, 3
call fcn.00404620
mov edx, dword [ebp - 0x100]
mov eax, dword [ebp - 4]
call fcn.004c3b5c
cmp byte [ebp - 0x25], 0
je 0x4cf96b
call fcn.004bb3c0
mov eax, dword [ebp - 4]
call fcn.004c687c
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x108]
mov ecx, dword [ebp - 0x10]
mov edx, 0x4d0a84
call fcn.004045ac
mov edx, dword [ebp - 0x108]
mov ecx, 0x4cff84
mov eax, dword [ebp - 4]
call fcn.004c41d0
mov edx, dword [ebp - 0x104]
lea eax, [ebp - 0x10]
call fcn.00404328
mov eax, dword [ebp - 0x10]
call fcn.00404560
cmp eax, 2
jle 0x4cf9d4
lea eax, [ebp - 0x10c]
mov ecx, dword [ebp - 0x10]
mov edx, 0x4cffa4
call fcn.004045ac
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 4]
call fcn.004cda08
cmp byte [0x4d94de], 0
jne 0x4cfe4d
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x4c2980
xor edx, edx
xor eax, eax
call fcn.00404244
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0b60
call fcn.004048a4
test eax, eax
jle 0x4cfab9
lea eax, [ebp - 0x10]
push eax
mov ecx, 2
mov edx, 0xa
mov eax, dword [ebp - 8]
call fcn.004047c0
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.004093f4
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
cmp esi, dword [0x4d5600]
jne 0x4cfa51
mov eax, ebx
sub eax, dword [0x4d9558]
cmp eax, 0x1388
jle 0x4cfaac
mov dword [0x4d9558], ebx
mov dword [0x4d5600], esi
mov eax, dword [0x4d5600]
lea eax, [eax + eax*8]
mov edx, dword [0x4d5e18]
mov eax, dword [edx + eax*4 + 0x14]
lea ecx, [ebp - 0x10]
mov edx, 0x18
call fcn.00435a10
push 0x4d0b74
push dword [ebp - 0x10]
push 0x4d0b9c
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.00404620
mov edx, dword [ebp - 0x110]
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov eax, dword [ebp - 4]
call fcn.004cc100
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0bc4
call fcn.004048a4
test eax, eax
jle 0x4cfafd
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d088c
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d0868
mov eax, dword [ebp - 4]
call fcn.004c3d68
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0bd4
call fcn.004048a4
test eax, eax
jle 0x4cfb6e
push 0x41
mov ecx, 0x4cff64
mov edx, 0x4d0bdc
mov eax, dword [0x4d5ac0]
mov eax, dword [eax]
call fcn.0047aa00
dec eax
jne 0x4cfe4d
mov byte [0x4d94da], 0
mov eax, 0x4d948c
mov ecx, dword [ebp - 8]
mov edx, 0x4d0c1c
call fcn.004045ac
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x4c2000
xor edx, edx
xor eax, eax
call fcn.00404244
mov edx, 0x4d0c2c
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0c44
call fcn.004048a4
test eax, eax
jle 0x4cfbbc
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d00a0
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d00c0
mov eax, dword [ebp - 4]
call fcn.004c3d68
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ccc34
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0c54
call fcn.004048a4
test eax, eax
jle 0x4cfc29
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d00a0
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d00c0
mov eax, dword [ebp - 4]
call fcn.004c3d68
cmp dword [0x4d5600], 0
jge 0x4cfc16
mov edx, 0x4d0c64
mov eax, dword [ebp - 4]
call fcn.004c3b5c
jmp 0x4cfe4d
mov edx, dword [0x4d5600]
mov eax, dword [ebp - 4]
call fcn.004ccb04
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0c8c
call fcn.004048a4
test eax, eax
jle 0x4cfc75
push 0x4cfff0
mov ecx, 0x4d0000
mov edx, 0x4d00a0
mov eax, dword [ebp - 4]
call fcn.004c3d68
push 0x4d00b0
mov ecx, 0x4d0000
mov edx, 0x4d00c0
mov eax, dword [ebp - 4]
call fcn.004c3d68
mov eax, dword [ebp - 4]
call fcn.004cc100
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0c9c
call fcn.004048a4
test eax, eax
jle 0x4cfc93
mov eax, dword [ebp - 4]
call fcn.0046b618
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0cac
call fcn.004048a4
test eax, eax
jle 0x4cfcb3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ccfdc
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0cbc
call fcn.004048a4
test eax, eax
jle 0x4cfcd3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004c45fc
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0cd0
call fcn.004048a4
test eax, eax
jle 0x4cfcf3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ccfc8
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0ce4
call fcn.004048a4
test eax, eax
jle 0x4cfd22
call sub.user32.dll_ReleaseCapture
push 0
mov ecx, 0xf012
mov edx, 0x112
mov eax, dword [ebp - 4]
call fcn.0044fcc4
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0cf4
call fcn.004048a4
test eax, eax
jle 0x4cfd42
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004c7050
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0d08
call fcn.004048a4
test eax, eax
jle 0x4cfd65
mov edx, 0x4d0d18
mov eax, dword [ebp - 4]
call fcn.004c611c
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d034c
call fcn.004048a4
test eax, eax
jle 0x4cfd88
mov edx, 0x4d035c
mov eax, dword [ebp - 4]
call fcn.004c611c
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0d28
call fcn.004048a4
test eax, eax
jle 0x4cfda3
call fcn.004b89f0
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0d38
call fcn.004048a4
test eax, eax
jle 0x4cfdde
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x20]
sub ecx, 7
mov edx, 8
mov eax, dword [ebp - 8]
call fcn.004047c0
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 4]
call fcn.004c6d08
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0d48
call fcn.004048a4
test eax, eax
jle 0x4cfdfe
mov edx, 0x4d09a8
mov eax, dword [ebp - 4]
call fcn.004c68b0
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0d58
call fcn.004048a4
test eax, eax
jle 0x4cfe19
mov eax, dword [ebp - 4]
call fcn.004c812c
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0d68
call fcn.004048a4
test eax, eax
jle 0x4cfe34
mov eax, dword [ebp - 4]
call fcn.004c79b4
jmp 0x4cfe4d
mov edx, dword [ebp - 8]
mov eax, 0x4d0d58
call fcn.004048a4
test eax, eax
jle 0x4cfe4d
mov eax, dword [ebp - 4]
call fcn.004c812c
mov byte [0x4d94da], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cfed1
lea eax, [ebp - 0x114]
mov edx, 0x23
call fcn.004042b4
lea eax, [ebp - 0x88]
call fcn.00411358
lea eax, [ebp - 0x78]
call fcn.00405f58
lea eax, [ebp - 0x74]
mov edx, dword [0x4010f4]
mov ecx, 3
call fcn.004050cc
lea eax, [ebp - 0x44]
call fcn.00404290
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.004049c4
lea eax, [ebp - 0x38]
call fcn.00411358
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004042b4
lea eax, [ebp - 8]
call fcn.00404290
ret