Function at 0x408824
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov dword [ebp - 0x10], 0x5b668583
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [ebp - 0x10]
cmp eax, 0xf490fa58
jle 0x40889c
cmp eax, 0x4147df61
jg 0x4088f5
cmp eax, 0x1347eb9b
jle 0x408989
cmp eax, 0x2d53bf5f
jle 0x408b3c
cmp eax, 0x34436422
jle 0x408d84
cmp eax, 0x34436423
je 0x40913f
cmp eax, 0x34a85f49
je 0x409179
cmp eax, 0x367e9265
jne 0x40883d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x8fe8d881
jmp 0x40883d
cmp eax, 0xc4aa367b
jg 0x408943
cmp eax, 0xac54653b
jle 0x408a1c
cmp eax, 0xb5c9ae71
jle 0x408b88
cmp eax, 0xb9650f6f
jle 0x408dc1
cmp eax, 0xb9650f70
je 0x409191
cmp eax, 0xbdd9fdec
je 0x4091d9
cmp eax, 0xc443767f
jne 0x40883d
mov dword [ebp - 0x10], 0x5a2b3fc9
jmp 0x40883d
cmp eax, 0x5ead8a10
jle 0x408a68
cmp eax, 0x74fd6f1e
jle 0x408bc3
cmp eax, 0x79c5bcd4
jle 0x408dfb
cmp eax, 0x79c5bcd5
je 0x409212
cmp eax, 0x79dcd6a1
je 0x40922b
cmp eax, 0x7b77bc8f
jne 0x40883d
mov dword [ebp - 0x10], 0x25ed8bdd
jmp 0x40883d
cmp eax, 0xdc89495c
jg 0x408aa0
cmp eax, 0xd339d5fd
jg 0x408bf0
cmp eax, 0xc74ee641
jle 0x408e2c
cmp eax, 0xcb2d4c25
je 0x40923a
cmp eax, 0xd0460e08
jne 0x409747
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0xb296c61
jmp 0x40883d
cmp eax, 0x446e548
jg 0x408c44
cmp eax, 0x2231c24
jg 0x408e70
cmp eax, 0xf490fa59
je 0x409287
cmp eax, 0xf8e559fe
jne 0x40883d
push eax
sub esp, 0xc
mov esi, esp
mov byte [esi + 0xe], 0
movzx eax, word [0x47a82e]
mov word [esi + 0xc], ax
mov eax, dword [0x47a82a]
mov dword [esi + 8], eax
mov eax, dword [0x47a826]
mov dword [esi + 4], eax
mov eax, dword [0x47a822]
mov dword [esi], eax
push 8
push 0x47a830
push 0xe
push esi
call fcn.00409f70
add esp, 0x10
mov eax, dword [esi + 0xb]
mov dword [ebp - 0x7d], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x80], eax
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x10], 0x79ae4a35
jmp 0x40883d
cmp eax, 0x8fe8d880
jg 0x408c9c
cmp eax, 0x8a146f17
jg 0x408ecb
cmp eax, 0x840a5579
je 0x4092c4
cmp eax, 0x87946877
jne 0x40883d
mov eax, dword [ebp - 0x18]
shr eax, 6
lea eax, [eax + eax*2]
shl eax, 4
add eax, 0xffffff5e
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xf8e559fe
jmp 0x40883d
cmp eax, 0x52c0094e
jg 0x408cdb
cmp eax, 0x4fa8551c
jg 0x408ef0
cmp eax, 0x4147df62
je 0x4092d0
cmp eax, 0x4b79651c
jne 0x40883d
mov dword [ebp - 0x10], 0x4fa8551d
jmp 0x40883d
cmp eax, 0xe9f6d0e5
jg 0x408d17
cmp eax, 0xe544d741
jg 0x408f30
cmp eax, 0xdc89495d
je 0x409309
cmp eax, 0xe2605302
jne 0x40883d
mov eax, dword [ebp - 0x58]
mov byte [eax], 0
mov esi, 0xf
push esi
push 0x47a80c
push dword [ebp - 0x38]
call fcn.00448eb0
add esp, 0xc
push 7
push 0x47a81b
push esi
push dword [ebp - 0x38]
call fcn.00409f70
add esp, 0x10
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x90], ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0x20]
call ebx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x10], 0x87946877
jmp 0x40883d
cmp eax, 0x1fa40e08
jg 0x408fc1
cmp eax, 0x1347eb9c
je 0x409371
cmp eax, 0x15d9955a
jne 0x40883d
mov esi, dword [ebp - 0x14]
shr esi, 0x12
add esi, 0xfffffff2
mov dword [ebp - 0x14], esi
push esi
call fcn.00408824
add esp, 4
mov eax, 0xd4b78af1
cmp esi, 0xe1
jne 0x4091cf
jmp 0x40973f
cmp eax, 0xb274466e
jg 0x408ff5
cmp eax, 0xac54653c
je 0x40937d
cmp eax, 0xb10facfd
jne 0x40883d
mov eax, dword [ebp - 0x60]
push dword [ebp - 0x1c]
push dword [ebp - 0x48]
call eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x10], 0x79c5bcd5
jmp 0x40883d
cmp eax, 0x7399185e
jg 0x40903e
cmp eax, 0x5ead8a11
je 0x40939b
cmp eax, 0x6c07dc46
jne 0x40883d
mov dword [ebp - 0x10], 0x367e9265
jmp 0x40883d
cmp eax, 0xd4b78af0
jg 0x409060
cmp eax, 0xd339d5fe
je 0x4093ae
cmp eax, 0xd39e5d44
jne 0x40883d
mov esi, dword [ebp - 0x14]
shl esi, 0x10
or esi, 0xa800
mov dword [ebp - 0x14], esi
push esi
call fcn.00408824
add esp, 4
call fcn.00409760
mov eax, 0xb5a096ce
cmp esi, 0xf8
jl 0x40927d
jmp 0x40973f
cmp eax, 0xa0be243
jg 0x409082
cmp eax, 0x446e549
je 0x4093ba
cmp eax, 0x5ca5926
jne 0x40883d
imul esi, dword [ebp - 0x14], 0x2036
add esi, 0xffffff9b
shr esi, 0xb
add esi, 7
mov dword [ebp - 0x14], esi
push esi
call fcn.00408824
add esp, 4
mov eax, 0x5b668583
cmp esi, 0xbf
je 0x40973f
mov eax, 0xf4593bdd
jmp 0x40973f
cmp eax, 0xa10ace43
jg 0x4090b6
cmp eax, 0x8fe8d881
je 0x4093fb
cmp eax, 0x9ef395ad
jne 0x40883d
push eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
add eax, 0xf
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x10], 0xe2605302
jmp 0x40883d
cmp eax, 0x5a2b3fc8
jg 0x4090e1
cmp eax, 0x52c0094f
je 0x409426
cmp eax, 0x578adb76
jne 0x40883d
imul eax, dword [ebp - 0x14], 0x1440
add eax, 0xffffff62
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0xed0da876
jmp 0x40883d
cmp eax, 0xf2c135a4
jg 0x409114
cmp eax, 0xe9f6d0e6
je 0x40945b
cmp eax, 0xed0da876
jne 0x40883d
imul edi, dword [ebp - 0x14], 0x4500
add edi, 0x3e14a4
mov esi, edi
shr esi, 1
mov dword [ebp - 0x14], esi
call fcn.00409760
push esi
push 0xc61
push 0x1cb6
push 0x15ea
call fcn.00409e40
add esp, 0x10
mov eax, 0x4147df62
cmp edi, 0x173
jae 0x40973f
mov eax, 0xc5f299bf
jmp 0x40973f
cmp eax, 0x2d53bf60
je 0x40949f
cmp eax, 0x2fc64b54
jne 0x40883d
mov ecx, dword [ebp - 0x14]
mov eax, ecx
shr eax, 0x13
dec eax
mov dword [ebp - 0x14], eax
mov eax, 0xa0be244
cmp ecx, 0x3e00000
jb 0x40973f
mov eax, 0x5ca5926
jmp 0x40973f
cmp eax, 0xb5c9ae72
je 0x4094bf
cmp eax, 0xb6e7b0da
jne 0x40883d
mov eax, dword [ebp - 0x14]
lea eax, [eax*4 + 0x304]
shr eax, 4
add eax, 0x20
mov dword [ebp - 0x14], eax
call fcn.00409760
mov dword [ebp - 0x10], 0x15d9955a
jmp 0x40883d
cmp eax, 0x74fd6f1f
je 0x4094ee
cmp eax, 0x79ae4a35
jne 0x40883d
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x20]
call ebx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x10], 0x52c0094f
jmp 0x40883d
cmp eax, 0xc4aa367c
je 0x409545
cmp eax, 0xc5f299bf
jne 0x40883d
push eax
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov byte [eax + 0x18], 0
push 0x18
push 0x47a7f0
push dword [ebp - 0x34]
call fcn.00448eb0
add esp, 0xc
mov dword [ebp - 0x10], 0x5ead8a11
jmp 0x40883d
cmp eax, 0x2231c25
je 0x40955e
cmp eax, 0x231b4d6
jne 0x40883d
imul esi, dword [ebp - 0x14], 0x1ac0
mov eax, esi
shr eax, 0x14
add eax, 0x2f
mov dword [ebp - 0x14], eax
push eax
push 0x34ea
push 0x4f56
push 0x3c28
call fcn.00409f70
add esp, 0x10
mov eax, 0xf8e559fe
cmp esi, 0x800000
jb 0x40973f
mov eax, 0xe2605302
jmp 0x40973f
cmp eax, 0x8a146f18
je 0x40958f
cmp eax, 0x8ba168fd
jne 0x40883d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], 0xe9f6d0e6
jmp 0x40883d
cmp eax, 0x4fa8551d
je 0x4095a5
cmp eax, 0x5101437e
jne 0x40883d
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x64]
push dword [eax]
push 0
push 1
call ecx
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
mov eax, 0x8a146f18
je 0x40973f
mov eax, 0x7b77bc8f
jmp 0x40973f
cmp eax, 0xe544d742
je 0x4095c9
cmp eax, 0xe9975444
jne 0x40883d
mov eax, dword [ebp - 0x6c]
mov byte [eax], 0
mov eax, dword [ebp - 0x44]
mov cl, byte [0x47a86a]
mov byte [eax + 0xa], cl
movzx ecx, word [0x47a868]
mov word [eax + 8], cx
mov ecx, dword [0x47a864]
mov dword [eax + 4], ecx
mov ecx, dword [0x47a860]
mov dword [eax], ecx
push 4
push 0x47a86b
push 0xb
push dword [ebp - 0x44]
call fcn.00409f70
add esp, 0x10
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov dword [eax], edx
push dword [ebp - 0x2c]
push dword [ebp - 0x20]
call ebx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x54]
push 0
push 0xf
call eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], 0x34436423
jmp 0x40883d
cmp eax, 0x1fa40e09
je 0x4095f5
cmp eax, 0x25ed8bdd
jne 0x40883d
mov eax, dword [ebp - 0x68]
push 0
push dword [ebp - 0x4c]
call eax
mov eax, dword [ebp - 0x50]
push dword [ebp - 0x4c]
call eax
mov dword [ebp - 0x10], 0xa10ace44
jmp 0x40883d
cmp eax, 0xb274466f
je 0x409622
cmp eax, 0xb5a096ce
jne 0x40883d
mov eax, dword [ebp - 0x14]
shl eax, 8
lea eax, [eax + eax*2]
or eax, 0x2e
mov dword [ebp - 0x14], eax
push 0x5e16
push 0x22aa
push 0x4899
push eax
call fcn.00409f70
add esp, 0x10
mov dword [ebp - 0x10], 0xd4b78af1
jmp 0x40883d
cmp eax, 0x7399185f
je 0x40963c
cmp eax, 0x742e0221
jne 0x40883d
mov dword [ebp - 0x10], 0xb274466f
jmp 0x40883d
cmp eax, 0xd4b78af1
je 0x409651
cmp eax, 0xd62d79db
jne 0x40883d
mov dword [ebp - 0x10], 0xd0460e08
jmp 0x40883d
cmp eax, 0xa0be244
je 0x409694
cmp eax, 0xb296c61
jne 0x40883d
push eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add eax, 0xb
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0x2231c25
jmp 0x40883d
cmp eax, 0xa10ace44
je 0x4096cb
cmp eax, 0xa140a1ab
jne 0x40883d
mov eax, dword [ebp - 0x1c]
add eax, 8
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x10], 0x34a85f49
jmp 0x40883d
cmp eax, 0x5a2b3fc9
je 0x4096e1
cmp eax, 0x5b668583
jne 0x40883d
push eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x24], eax
sub esp, 0x14
mov eax, esp
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0xd4b78af1
jmp 0x40883d
cmp eax, 0xf2c135a5
je 0x4096ed
cmp eax, 0xf4593bdd
jne 0x40883d
mov eax, dword [ebp - 0x1c]
add eax, 0x24
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x10], 0xa140a1ab
jmp 0x40883d
mov eax, dword [ebp - 0x18]
lea ecx, [eax + 0xd3]
mov edx, ecx
imul edx, ecx
imul esi, edx, 0x48e7
shl ecx, 7
dec esi
lea eax, [ecx + eax*2]
add eax, 0x29d
mov dword [ebp - 0x18], eax
mov eax, 0x446e549
cmp edx, esi
je 0x40973f
mov eax, 0x6c07dc46
jmp 0x40973f
mov eax, dword [ebp - 0x18]
shl eax, 0xb
or eax, 0x2f
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0x4b79651c
jmp 0x40883d
imul esi, dword [ebp - 0x14], 0x9a
shr esi, 0x15
and esi, 0xfffffff0
mov dword [ebp - 0x14], esi
call fcn.00409760
push 0x41e4
push 0x4b63
push 0x5b0c
push esi
call fcn.00409e40
add esp, 0x10
mov eax, 0x7399185f
cmp esi, 0xc4
jb 0x40973f
mov eax, 0xf490fa59
jmp 0x40973f
mov eax, dword [ebp - 0x18]
mov ecx, 0xffffff7c
add eax, ecx
mov ecx, eax
shl ecx, 0xe
imul eax, eax
imul edx, eax, 0x3ce7
dec edx
add ecx, 0x79000
mov dword [ebp - 0x18], ecx
mov ecx, 0x578adb76
cmp edx, eax
je 0x4095c1
mov ecx, 0xd339d5fe
jmp 0x4095c1
imul eax, dword [ebp - 0x18], 0x17808000
shr eax, 0x1c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0x840a5579
jmp 0x40883d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0x7399185f
jmp 0x40883d
mov eax, dword [ebp - 0x14]
add eax, 0xffffffc0
shr eax, 0xb
imul eax, eax, 0x87
shr eax, 2
imul esi, eax, 0x27
mov dword [ebp - 0x14], esi
call fcn.00409760
push 0x47c8
push esi
push 0xf4b
push 0x419c
call fcn.00409e40
add esp, 0x10
mov eax, 0xf490fa59
cmp esi, 0x6e
jae 0x40973f
mov eax, 0xe544d742
jmp 0x40973f
push 4
push 0x47a808
push 0x18
push dword [ebp - 0x34]
call fcn.00409f70
add esp, 0x10
push 0x19
push dword [ebp - 0x34]
lea esi, [ebp - 0xb1]
push esi
call fcn.00448eb0
add esp, 0xc
push esi
push dword [ebp - 0x20]
call ebx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], 0xbdd9fdec
jmp 0x40883d
mov dword [ebp - 0x10], 0xc4aa367c
jmp 0x40883d
imul eax, dword [ebp - 0x14], 0x9a
add eax, 0xbf
shr eax, 0xb
add eax, 0xffffffd9
mov dword [ebp - 0x14], eax
push 0x51b4
push eax
push 0x34b8
push 0x958
call fcn.00409e40
add esp, 0x10
mov dword [ebp - 0x10], 0xe544d742
jmp 0x40883d
mov eax, dword [ebp - 0x40]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0x40]
mov ecx, dword [0x47a856]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x47a852]
mov dword [eax + 8], ecx
mov ecx, dword [0x47a84e]
mov dword [eax + 4], ecx
mov ecx, dword [0x47a84a]
mov dword [eax], ecx
push 6
push 0x47a85a
push 0x10
push dword [ebp - 0x40]
call fcn.00409f70
add esp, 0x10
push 0x11
push dword [ebp - 0x40]
push dword [ebp - 0x28]
call fcn.00448eb0
add esp, 0xc
push dword [ebp - 0x28]
push dword [ebp - 0x20]
call ebx
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x10], 0xd62d79db
jmp 0x40883d
mov dword [ebp - 0x10], 0xc5f299bf
jmp 0x40883d
imul eax, dword [ebp - 0x18], 0x182
add eax, 0x55f2
shr eax, 0xa
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xc74ee642
jmp 0x40883d
mov dword [ebp - 0x18], 0x80000000
mov dword [ebp - 0x10], 0xf490fa59
jmp 0x40883d
mov dword [ebp - 0x10], 0x9ef395ad
jmp 0x40883d
push 7
push 0x47a843
push 0xb
push dword [ebp - 0x3c]
call fcn.00409f70
add esp, 0x10
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov dword [eax], edx
push dword [ebp - 0x24]
push dword [ebp - 0x20]
call ebx
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x10], 0x79dcd6a1
jmp 0x40883d
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x22c
mov eax, dword [ebp - 0x5c]
push dword [ebp - 0x1c]
push dword [ebp - 0x48]
call eax
mov ecx, 0x742e0221
test eax, eax
je 0x4095c1
mov ecx, 0xf4593bdd
jmp 0x4095c1
mov eax, dword [ebp - 0x18]
lea ecx, [eax + 0xa3]
imul ecx, ecx
imul edx, ecx, 0x539d
dec edx
shl eax, 0xd
add eax, 0x312000
mov dword [ebp - 0x18], eax
mov eax, 0xcb2d4c25
cmp ecx, edx
je 0x40973f
mov eax, 0x8ba168fd
jmp 0x40973f
push eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0x3c]
mov cl, byte [0x47a842]
mov byte [eax + 0xa], cl
movzx ecx, word [0x47a840]
mov word [eax + 8], cx
mov ecx, dword [0x47a83c]
mov dword [eax + 4], ecx
mov ecx, dword [0x47a838]
mov dword [eax], ecx
mov dword [ebp - 0x10], 0x446e549
jmp 0x40883d
imul eax, dword [ebp - 0x14], 0x1900
add eax, 0x3bc
mov dword [ebp - 0x14], eax
call fcn.00409760
mov dword [ebp - 0x10], 0xf2c135a5
jmp 0x40883d
mov eax, dword [ebp - 0x18]
add eax, 0x4d
shr eax, 0xd
mov dword [ebp - 0x18], eax
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x641
dec edx
mov eax, 0x8fe8d881
cmp ecx, edx
je 0x40973f
mov eax, 0xc443767f
jmp 0x40973f
mov eax, dword [ebp - 0x14]
shr eax, 5
imul esi, eax, 0x5f
add esi, 0xffffffe4
mov dword [ebp - 0x14], esi
push 0x612f
push 0x34bb
push esi
push 0x83e
call fcn.00409f70
add esp, 0x10
push 0x15f4
push esi
push 0x5da1
push 0x2bc1
call fcn.00409f70
add esp, 0x10
mov eax, 0xd39e5d44
cmp esi, 0x7b
je 0x40973f
mov eax, 0x5b668583
jmp 0x40973f
cmp dword [ebp - 0x78], 0
mov eax, 0x742e0221
je 0x40973f
mov eax, 0x4b79651c
jmp 0x40973f
mov eax, dword [ebp - 0x18]
shr eax, 0xb
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x528f
dec edx
add eax, 0xcf
mov dword [ebp - 0x18], eax
mov eax, 0xf490fa59
cmp edx, ecx
je 0x40973f
mov eax, 0xe9975444
jmp 0x40973f
imul eax, dword [ebp - 0x18], 0x940
add eax, 0x7ffef6
and eax, 0x7ffff6
jmp 0x4096d2
push dword [ebp + 8]
push dword [ebp - 0x70]
call fcn.0045af8d
add esp, 8
mov ecx, 0x5101437e
test eax, eax
je 0x4095c1
mov ecx, 0xb5c9ae72
mov dword [ebp - 0x10], ecx
jmp 0x40883d
push 8
push 0x46d558
push 0xc
push dword [ebp - 0x30]
call fcn.00409e40
add esp, 0x10
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0x1347eb9c
jmp 0x40883d
mov eax, dword [ebp - 0x14]
lea ecx, [eax + eax]
add ecx, 0xdb
shr ecx, 0xf
add ecx, 0xffffffab
mov dword [ebp - 0x14], ecx
mov eax, 0xe544d742
cmp ecx, 0x2c
jb 0x40973f
mov eax, 0xe9f6d0e6
jmp 0x40973f
mov eax, dword [ebp - 0x50]
push dword [ebp - 0x48]
call eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0xac54653c
jmp 0x40883d
push eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], 0xdc89495d
jmp 0x40883d
push eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x2c], eax
sub esp, 0x22c
mov eax, esp
mov dword [ebp - 0x1c], eax
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov word [eax + 0x18], 0
push 0x18
push 0x46d540
push dword [ebp - 0x30]
call fcn.00448eb0
add esp, 0xc
mov dword [ebp - 0x10], 0xe544d742
jmp 0x40883d
mov eax, dword [ebp - 0x14]
shl eax, 4
and eax, 0x1ffffff0
add eax, 0xffffff6b
mov dword [ebp - 0x14], eax
push eax
push 0x5d8
push 0x338f
push 0x25fe
call fcn.00409f70
add esp, 0x10
mov dword [ebp - 0x10], 0x446e549
jmp 0x40883d
imul eax, dword [ebp - 0x18], 0xf800000
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xc443767f
jmp 0x40883d
mov dword [ebp - 0x10], 0xb10facfd
jmp 0x40883d
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*4]
lea esi, [eax*4 - 0x8fc]
mov dword [ebp - 0x14], esi
push esi
push 0x3624
push 0x1834
push 0x344e
call fcn.00409f70
add esp, 0x10
push 0x5ee8
push 0x4c50
push esi
push 0x609
call fcn.00409f70
add esp, 0x10
mov eax, 0x1fa40e09
cmp esi, 0xf8
jae 0x40973f
mov eax, 0xb9650f70
mov dword [ebp - 0x10], eax
jmp 0x40883d
cmp eax, 0xc74ee642
jne 0x40883d
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret