Function at 0x4f6220
Capabilities:
Access peb ldr_data
Check os version
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x190
push 0
push 0
dec ecx
jne 0x4f6228
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404d9c
xor eax, eax
push ebp
push 0x4f8ea2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x419ff4]
call fcn.00403aa8
mov dword [ebp - 0x34], eax
cmp dword [ebp - 8], 0
je 0x4f8b2d
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 8]
call fcn.004090dc
mov eax, dword [ebp - 0x60]
mov edx, 0x4f8ec0
call fcn.00404cf8
jne 0x4f62c1
push 0x50b390
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x4f62ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x509a0c]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8b2d
push 0x50b390
call sub.kernel32.dll_LeaveCriticalSection_1
ret
mov edx, dword [ebp - 8]
mov eax, dword [0x4c2b08]
call fcn.004c4ce4
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4f8b26
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x50b390
call sub.kernel32.dll_EnterCriticalSection_1
lea eax, [ebp - 0x70]
mov edx, 0x4f8ed0
call fcn.004157ac
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x90]
mov edx, 0x4f8ee0
call fcn.004157ac
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x80]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x80]
call fcn.00411d80
mov edx, dword [0x509784]
mov dword [edx + 8], eax
lea eax, [ebp - 0xb0]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0xb0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0xc0]
mov edx, 0x4f8efc
call fcn.004157ac
lea edx, [ebp - 0xc0]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0xa0]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0xa0]
call fcn.00411d80
mov edx, dword [0x509784]
mov dword [edx + 0x30], eax
lea eax, [ebp - 0xe0]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0xf0]
mov edx, 0x4f8f0c
call fcn.004157ac
lea edx, [ebp - 0xf0]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0xd0]
mov ecx, dword [eax]
call dword [ecx]
lea edx, [ebp - 0xd0]
mov eax, dword [0x509784]
add eax, 0x34
call fcn.004146e0
lea eax, [ebp - 0x110]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x120]
mov edx, 0x4f8f1c
call fcn.004157ac
lea edx, [ebp - 0x120]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x100]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x100]
call fcn.00411d80
mov edx, dword [0x509784]
mov dword [edx + 0xc], eax
lea eax, [ebp - 0x140]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x150]
mov edx, 0x4f8f2c
call fcn.004157ac
lea edx, [ebp - 0x150]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x130]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x130]
call fcn.00411d80
mov edx, dword [0x509784]
mov dword [edx + 0x1c], eax
lea eax, [ebp - 0x170]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0x170]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x180]
mov edx, 0x4f8f3c
call fcn.004157ac
lea edx, [ebp - 0x180]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x160]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x160]
call fcn.00411d80
mov edx, dword [0x509784]
mov dword [edx + 0x18], eax
lea eax, [ebp - 0x1a0]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x1b0]
mov edx, 0x4f8f54
call fcn.004157ac
lea edx, [ebp - 0x1b0]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x190]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x190]
call fcn.00411d80
mov edx, dword [0x509784]
mov dword [edx + 0x20], eax
lea eax, [ebp - 0x1d0]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0x1d0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x1e0]
mov edx, 0x4f8f68
call fcn.004157ac
lea edx, [ebp - 0x1e0]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x1c0]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x1c0]
call fcn.00411d80
mov edx, dword [0x509784]
mov dword [edx + 0x24], eax
lea eax, [ebp - 0x1f4]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0x1f4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x204]
mov edx, 0x4f8f80
call fcn.004157ac
lea edx, [ebp - 0x204]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, eax
lea ecx, [ebp - 0x1e4]
mov eax, dword [0x4c2b08]
call fcn.004c3f78
mov edx, dword [ebp - 0x1e4]
mov eax, dword [0x509784]
add eax, 0x70
call fcn.00404940
lea eax, [ebp - 0x224]
mov edx, 0x4f8f94
call fcn.004157ac
lea edx, [ebp - 0x224]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x234]
mov edx, 0x4f8fa4
call fcn.004157ac
lea edx, [ebp - 0x234]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x214]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x214]
call fcn.00411d80
mov edx, dword [0x509784]
mov dword [edx + 4], eax
lea eax, [ebp - 0x254]
mov edx, 0x4f8f94
call fcn.004157ac
lea edx, [ebp - 0x254]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x264]
mov edx, 0x4f8fb0
call fcn.004157ac
lea edx, [ebp - 0x264]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x244]
mov ecx, dword [eax]
call dword [ecx]
lea edx, [ebp - 0x244]
mov eax, dword [0x509784]
add eax, 0x4c
call fcn.004146e0
lea eax, [ebp - 0x284]
mov edx, 0x4f8f94
call fcn.004157ac
lea edx, [ebp - 0x284]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x294]
mov edx, 0x4f8fc0
call fcn.004157ac
lea edx, [ebp - 0x294]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x274]
mov ecx, dword [eax]
call dword [ecx]
lea edx, [ebp - 0x274]
mov eax, dword [0x509784]
add eax, 0x40
call fcn.004146e0
lea eax, [ebp - 0x2b4]
mov edx, 0x4f8f94
call fcn.004157ac
lea edx, [ebp - 0x2b4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x2c4]
mov edx, 0x4f8fd0
call fcn.004157ac
lea edx, [ebp - 0x2c4]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x2a4]
mov ecx, dword [eax]
call dword [ecx]
lea edx, [ebp - 0x2a4]
mov eax, dword [0x509784]
add eax, 0x44
call fcn.004146e0
lea eax, [ebp - 0x2e4]
mov edx, 0x4f8f94
call fcn.004157ac
lea edx, [ebp - 0x2e4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x2f4]
mov edx, 0x4f8fe0
call fcn.004157ac
lea edx, [ebp - 0x2f4]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x2d4]
mov ecx, dword [eax]
call dword [ecx]
lea edx, [ebp - 0x2d4]
mov eax, dword [0x509784]
add eax, 0x48
call fcn.004146e0
xor eax, eax
push ebp
push 0x4f67e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x509784]
mov dword [eax + 0x50], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f67ef
lea eax, [ebp - 0x314]
mov edx, 0x4f8ff0
call fcn.004157ac
lea edx, [ebp - 0x314]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x304]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x304]
call fcn.00411d80
mov edx, dword [0x509784]
mov dword [edx + 0x3c], eax
lea eax, [ebp - 0x334]
mov edx, 0x4f8f94
call fcn.004157ac
lea edx, [ebp - 0x334]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x344]
mov edx, 0x4f9000
call fcn.004157ac
lea edx, [ebp - 0x344]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x324]
mov ecx, dword [eax]
call dword [ecx]
lea edx, [ebp - 0x324]
mov eax, dword [0x509784]
add eax, 0x68
call fcn.004146e0
lea eax, [ebp - 0x364]
mov edx, 0x4f8f94
call fcn.004157ac
lea edx, [ebp - 0x364]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x374]
mov edx, 0x4f9010
call fcn.004157ac
lea edx, [ebp - 0x374]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x354]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x354]
call fcn.00411d80
mov edx, dword [0x509784]
mov dword [edx + 0x60], eax
lea eax, [ebp - 0x394]
mov edx, 0x4f8f94
call fcn.004157ac
lea edx, [ebp - 0x394]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x3a4]
mov edx, 0x4f901c
call fcn.004157ac
lea edx, [ebp - 0x3a4]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x384]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x384]
call fcn.00411d80
mov edx, dword [0x509784]
mov dword [edx + 0x64], eax
lea eax, [ebp - 0x3b8]
mov edx, 0x4f9030
call fcn.004157ac
lea edx, [ebp - 0x3b8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, eax
lea ecx, [ebp - 0x3a8]
mov eax, dword [0x4c2b08]
call fcn.004c3f78
mov edx, dword [ebp - 0x3a8]
mov eax, dword [0x509784]
add eax, 0x9c
call fcn.00404940
xor eax, eax
push ebp
push 0x4f6a4b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3cc]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0x3cc]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x3dc]
mov edx, 0x4f9044
call fcn.004157ac
lea edx, [ebp - 0x3dc]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, eax
lea ecx, [ebp - 0x3bc]
mov eax, dword [0x4c2b08]
call fcn.004c3f78
mov edx, dword [ebp - 0x3bc]
mov eax, dword [0x509784]
add eax, 0x74
call fcn.00404940
lea eax, [ebp - 0x3fc]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0x3fc]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x40c]
mov edx, 0x4f9058
call fcn.004157ac
lea edx, [ebp - 0x40c]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x3ec]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x3ec]
call fcn.00411d80
mov edx, dword [0x509784]
mov dword [edx + 0x2c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f6a55
lea eax, [ebp - 0x430]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0x430]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x440]
mov edx, 0x4f906c
call fcn.004157ac
lea edx, [ebp - 0x440]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x420]
mov ecx, dword [eax]
call dword [ecx]
lea edx, [ebp - 0x420]
lea eax, [ebp - 0x410]
call fcn.004146e0
mov eax, dword [ebp - 0x410]
lea ecx, [ebp - 0x44]
mov edx, dword [0x509804]
mov edx, dword [edx]
call fcn.004d7cd8
mov edx, dword [ebp - 0x44]
mov eax, dword [0x4c2b08]
call fcn.004c4ce4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x460]
mov edx, 0x4f907c
call fcn.004157ac
lea edx, [ebp - 0x460]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x450]
mov ecx, dword [eax]
call dword [ecx]
lea edx, [ebp - 0x450]
mov eax, dword [0x509784]
add eax, 0x28
call fcn.004146e0
lea eax, [ebp - 0x484]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0x484]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x494]
mov edx, 0x4f9090
call fcn.004157ac
lea edx, [ebp - 0x494]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x4a4]
mov edx, 0x4f906c
call fcn.004157ac
lea edx, [ebp - 0x4a4]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x474]
mov ecx, dword [eax]
call dword [ecx]
lea edx, [ebp - 0x474]
lea eax, [ebp - 0x464]
call fcn.004146e0
mov eax, dword [ebp - 0x464]
lea ecx, [ebp - 0x44]
mov edx, dword [0x509804]
mov edx, dword [edx]
call fcn.004d7cd8
mov eax, dword [ebp - 0x44]
mov edx, 0x4f90a4
call fcn.00404cf8
je 0x4f6d07
mov edx, dword [ebp - 0x44]
mov eax, dword [0x4c2b08]
call fcn.004c4ce4
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4f6d00
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x10]
dec eax
test eax, eax
jl 0x4f6caf
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [0x4c295c]
call fcn.00403c88
mov edx, dword [eax + 8]
lea eax, [ebp - 0x48]
call fcn.00404b74
cmp dword [ebp - 0x48], 0
je 0x4f6ca3
lea eax, [ebp - 0x4b4]
mov edx, dword [ebp - 0x48]
call fcn.004157ac
lea edx, [ebp - 0x4b4]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x4c4]
mov edx, 0x4f90b0
call fcn.004157ac
lea edx, [ebp - 0x4c4]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
test eax, eax
je 0x4f6ca3
lea eax, [ebp - 0x4e4]
mov edx, dword [ebp - 0x48]
call fcn.004157ac
lea edx, [ebp - 0x4e4]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x4f4]
mov edx, 0x4f90c0
call fcn.004157ac
lea edx, [ebp - 0x4f4]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x4d4]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x4d4]
call fcn.00411d80
mov edx, dword [0x509784]
mov dword [edx + 0x54], eax
jmp 0x4f6caf
inc dword [ebp - 0x20]
dec dword [ebp - 0x5c]
jne 0x4f6be2
lea eax, [ebp - 0x514]
mov edx, 0x4f907c
call fcn.004157ac
lea edx, [ebp - 0x514]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x504]
mov ecx, dword [eax]
call dword [ecx]
lea edx, [ebp - 0x504]
mov eax, dword [0x509784]
add eax, 0x5c
call fcn.004146e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6d07
mov eax, dword [ebp - 0x18]
call fcn.00403ad8
ret
lea eax, [ebp - 0x524]
mov edx, 0x4f90d0
call fcn.004157ac
lea edx, [ebp - 0x524]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, eax
lea ecx, [ebp - 0x44]
mov eax, dword [0x4c2b08]
call fcn.004c3f78
xor eax, eax
push ebp
push 0x4f6e2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x44]
mov eax, dword [0x4c2b08]
call fcn.004c4ce4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x10]
test eax, eax
jle 0x4f6e1c
lea eax, [ebp - 0x4c]
call fcn.004048ec
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x10]
dec eax
test eax, eax
jl 0x4f6e01
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [0x4c295c]
call fcn.00403c88
mov edx, dword [eax + 8]
lea eax, [ebp - 0x48]
call fcn.00404b74
push dword [ebp - 0x4c]
lea eax, [ebp - 0x548]
mov edx, dword [ebp - 0x48]
call fcn.004157ac
lea edx, [ebp - 0x548]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x538]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x538]
lea edx, [ebp - 0x528]
call fcn.00417658
push dword [ebp - 0x528]
push 0x4f90e0
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.00404c6c
inc dword [ebp - 0x20]
dec dword [ebp - 0x5c]
jne 0x4f6d86
lea eax, [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov edx, 0x4f90ec
call fcn.00404bf8
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 0x4c]
call fcn.00404984
mov eax, dword [ebp - 0x18]
call fcn.00403ad8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f6e40
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x44]
call fcn.00404bac
mov ecx, eax
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x44]
call fcn.00404e0c
xor eax, eax
push ebp
push 0x4f6f3c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x44], 0
je 0x4f6f32
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
call dword [edx + 0x44]
mov dl, 0x2c
mov eax, dword [ebp - 0x34]
call fcn.0041e50c
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
call fcn.0041e37c
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4f6ec4
lea ecx, [ebp - 0x54c]
xor edx, edx
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x54c]
call fcn.00409858
inc eax
mov edx, dword [0x509784]
mov dword [edx + 0x7c], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x4f6efa
lea ecx, [ebp - 0x550]
mov edx, 1
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x550]
call fcn.00409858
inc eax
mov edx, dword [0x509784]
mov dword [edx + 0x80], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 2
jle 0x4f6f32
lea ecx, [ebp - 0x554]
mov edx, 2
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x554]
call fcn.00409858
inc eax
mov edx, dword [0x509784]
mov dword [edx + 0x84], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f6f46
lea eax, [ebp - 0x564]
mov edx, 0x4f90f8
call fcn.004157ac
lea edx, [ebp - 0x564]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, eax
lea ecx, [ebp - 0x44]
mov eax, dword [0x4c2b08]
call fcn.004c3f78
xor eax, eax
push ebp
push 0x4f706d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x44]
mov eax, dword [0x4c2b08]
call fcn.004c4ce4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x10]
test eax, eax
jle 0x4f705b
lea eax, [ebp - 0x4c]
call fcn.004048ec
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x10]
dec eax
test eax, eax
jl 0x4f7040
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [0x4c295c]
call fcn.00403c88
mov edx, dword [eax + 8]
lea eax, [ebp - 0x48]
call fcn.00404b74
push dword [ebp - 0x4c]
lea eax, [ebp - 0x588]
mov edx, dword [ebp - 0x48]
call fcn.004157ac
lea edx, [ebp - 0x588]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x578]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x578]
lea edx, [ebp - 0x568]
call fcn.00417658
push dword [ebp - 0x568]
push 0x4f90e0
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.00404c6c
inc dword [ebp - 0x20]
dec dword [ebp - 0x5c]
jne 0x4f6fc5
lea eax, [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov edx, 0x4f90ec
call fcn.00404bf8
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 0x4c]
call fcn.00404984
mov eax, dword [ebp - 0x18]
call fcn.00403ad8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f707f
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x44]
call fcn.00404bac
mov ecx, eax
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x44]
call fcn.00404e0c
xor eax, eax
push ebp
push 0x4f717e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x44], 0
je 0x4f7174
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
call dword [edx + 0x44]
mov dl, 0x2c
mov eax, dword [ebp - 0x34]
call fcn.0041e50c
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
call fcn.0041e37c
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4f7106
lea ecx, [ebp - 0x58c]
xor edx, edx
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x58c]
call fcn.00409858
inc eax
mov edx, dword [0x509784]
mov dword [edx + 0x88], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x4f713c
lea ecx, [ebp - 0x590]
mov edx, 1
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x590]
call fcn.00409858
inc eax
mov edx, dword [0x509784]
mov dword [edx + 0x8c], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 2
jle 0x4f7174
lea ecx, [ebp - 0x594]
mov edx, 2
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x594]
call fcn.00409858
inc eax
mov edx, dword [0x509784]
mov dword [edx + 0x90], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f7188
lea eax, [ebp - 0x5b4]
mov edx, 0x4f9108
call fcn.004157ac
lea edx, [ebp - 0x5b4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x5a4]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x5a4]
call fcn.00411d80
mov edx, dword [0x509784]
mov dword [edx + 0x94], eax
mov eax, dword [0x5096fc]
cmp dword [eax], 0
je 0x4f74de
lea ecx, [ebp - 0x5b8]
mov eax, dword [0x5096fc]
mov eax, dword [eax]
mov edx, 0x4f9114
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x5b8]
mov edx, dword [eax]
call dword [edx + 0x90]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4f745e
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x5c4]
mov eax, dword [0x5096fc]
mov eax, dword [eax]
mov edx, 0x4f9114
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x5c4]
mov edx, dword [eax]
call dword [edx + 0x90]
lea ecx, [ebp - 0x5c0]
mov edx, dword [ebp - 0x20]
call fcn.00492a0c
mov eax, dword [ebp - 0x5c0]
lea ecx, [ebp - 0x5bc]
mov edx, 0x4f9128
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x5bc]
mov edx, dword [eax]
call dword [edx + 0x80]
push edx
push eax
mov eax, dword [0x509784]
mov eax, dword [eax + 4]
cdq
cmp edx, dword [esp + 4]
jne 0x4f727c
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4f7452
xor eax, eax
push ebp
push 0x4f7446
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x5d0]
mov eax, dword [0x5096fc]
mov eax, dword [eax]
mov edx, 0x4f9114
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x5d0]
mov edx, dword [eax]
call dword [edx + 0x90]
lea ecx, [ebp - 0x5cc]
mov edx, dword [ebp - 0x20]
call fcn.00492a0c
mov eax, dword [ebp - 0x5cc]
lea ecx, [ebp - 0x5c8]
mov edx, 0x4f9134
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x5c8]
mov edx, dword [eax]
call dword [edx + 0x80]
mov edx, dword [0x509784]
mov dword [edx + 0xa0], eax
lea ecx, [ebp - 0x5dc]
mov eax, dword [0x5096fc]
mov eax, dword [eax]
mov edx, 0x4f9114
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x5dc]
mov edx, dword [eax]
call dword [edx + 0x90]
lea ecx, [ebp - 0x5d8]
mov edx, dword [ebp - 0x20]
call fcn.00492a0c
mov eax, dword [ebp - 0x5d8]
lea ecx, [ebp - 0x5d4]
mov edx, 0x4f9148
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x5d4]
mov edx, dword [eax]
call dword [edx + 0x80]
mov edx, dword [0x509784]
mov dword [edx + 0xa8], eax
mov eax, dword [0x509784]
cmp dword [eax + 0xa4], 2
jge 0x4f737d
mov eax, dword [0x509784]
mov eax, dword [eax + 0xa8]
mov edx, dword [0x509784]
mov dword [edx + 0xa4], eax
lea ecx, [ebp - 0x5ec]
mov eax, dword [0x5096fc]
mov eax, dword [eax]
mov edx, 0x4f9114
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x5ec]
mov edx, dword [eax]
call dword [edx + 0x90]
lea ecx, [ebp - 0x5e8]
mov edx, dword [ebp - 0x20]
call fcn.00492a0c
mov eax, dword [ebp - 0x5e8]
lea ecx, [ebp - 0x5e4]
mov edx, 0x4f9158
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [ebp - 0x5e4]
lea edx, [ebp - 0x5e0]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov edx, dword [ebp - 0x5e0]
mov eax, dword [0x509784]
add eax, 0x98
call fcn.00404b74
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
call dword [edx + 0x44]
mov dl, 0x2c
mov eax, dword [ebp - 0x34]
call fcn.0041e50c
mov edx, dword [0x509784]
mov edx, dword [edx + 0x98]
mov eax, dword [ebp - 0x34]
call fcn.0041e37c
lea ecx, [ebp - 0x5f0]
mov edx, 8
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x5f0]
call fcn.00409858
mov edx, dword [0x509784]
mov dword [edx + 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f745e
inc dword [ebp - 0x20]
dec dword [ebp - 0x5c]
jne 0x4f7211
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
call dword [edx + 0x14]
sub eax, 2
test eax, eax
jl 0x4f74de
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x5f4]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x5f4]
call fcn.00409858
mov edx, dword [0x509784]
cmp eax, dword [edx + 0xc]
jg 0x4f74d6
lea ecx, [ebp - 0x5f8]
mov edx, dword [ebp - 0x20]
inc edx
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x5f8]
call fcn.00409858
mov edx, dword [0x509784]
cmp eax, dword [edx + 0xc]
jl 0x4f74d6
mov eax, dword [ebp - 0x20]
inc eax
mov edx, dword [0x509784]
mov dword [edx + 0x78], eax
jmp 0x4f74de
inc dword [ebp - 0x20]
dec dword [ebp - 0x5c]
jne 0x4f7478
lea eax, [ebp - 0x608]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0x608]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x618]
mov edx, 0x4f916c
call fcn.004157ac
lea edx, [ebp - 0x618]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [eax]
call dword [edx + 0x10]
push eax
mov eax, dword [0x509794]
mov ecx, 1
mov edx, dword [0x4d8c2c]
call fcn.0040600c
add esp, 4
xor edx, edx
push ebp
push 0x4f78a2
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x628]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0x628]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x638]
mov edx, 0x4f916c
call fcn.004157ac
lea edx, [ebp - 0x638]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [eax]
call dword [edx + 0x10]
dec eax
test eax, eax
jl 0x4f7898
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x648]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0x648]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x658]
mov edx, 0x4f916c
call fcn.004157ac
lea edx, [ebp - 0x658]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [0x4c295c]
call fcn.00403c88
mov edx, dword [eax + 8]
lea eax, [ebp - 0x44]
call fcn.00404b74
lea eax, [ebp - 0x668]
mov edx, 0x4f8eec
call fcn.004157ac
lea edx, [ebp - 0x668]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x678]
mov edx, 0x4f916c
call fcn.004157ac
lea edx, [ebp - 0x678]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x688]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0x688]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x20]
shl ebx, 2
mov eax, dword [0x509794]
mov eax, dword [eax]
lea eax, [eax + ebx*8 + 0xc]
mov edx, dword [ebp - 0x44]
call fcn.00404940
lea eax, [ebp - 0x6b0]
mov edx, 0x4f90c0
call fcn.004157ac
lea edx, [ebp - 0x6b0]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x6a0]
mov ecx, dword [eax]
call dword [ecx]
lea edx, [ebp - 0x6a0]
lea eax, [ebp - 0x690]
call fcn.004146e0
mov eax, dword [ebp - 0x690]
lea edx, [ebp - 0x68c]
call fcn.004f4e74
mov edx, dword [ebp - 0x68c]
mov eax, dword [0x509794]
mov eax, dword [eax]
lea eax, [eax + ebx*8 + 4]
call fcn.00404940
lea eax, [ebp - 0x6d0]
mov edx, 0x4f90c0
call fcn.004157ac
lea edx, [ebp - 0x6d0]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x6c0]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x6c0]
call fcn.00411d80
mov edx, dword [0x509794]
mov edx, dword [edx]
mov dword [edx + ebx*8], eax
lea eax, [ebp - 0x6f0]
mov edx, 0x4f8fa4
call fcn.004157ac
lea edx, [ebp - 0x6f0]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x6e0]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x6e0]
call fcn.00411d80
mov edx, dword [0x509794]
mov edx, dword [edx]
mov dword [edx + ebx*8 + 8], eax
lea eax, [ebp - 0x710]
mov edx, 0x4f917c
call fcn.004157ac
lea edx, [ebp - 0x710]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x700]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x700]
call fcn.00411d80
mov edx, dword [0x509794]
mov edx, dword [edx]
mov dword [edx + ebx*8 + 0x10], eax
mov eax, dword [0x509cd4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4f77e2
inc ebx
xor esi, esi
lea ecx, [ebp - 0x714]
mov eax, dword [0x509cd4]
mov eax, dword [eax]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x714]
mov eax, dword [ebp - 0x20]
shl eax, 2
mov ecx, dword [0x509794]
mov ecx, dword [ecx]
mov eax, dword [ecx + eax*8 + 0xc]
call fcn.00404cf8
jne 0x4f77de
mov eax, dword [ebp - 0x20]
shl eax, 2
mov edx, dword [0x509794]
mov edx, dword [edx]
mov byte [edx + eax*8 + 0x14], 1
jmp 0x4f77e2
inc esi
dec ebx
jne 0x4f7796
mov eax, dword [ebp - 0x20]
shl eax, 2
mov edx, dword [0x509794]
mov edx, dword [edx]
mov edx, dword [edx + eax*8]
cmp edx, 5
ja case.0x4f77fc.0
jmp dword [edx*4 + 0x4f7803]
mov edx, dword [0x509794]
mov edx, dword [edx]
mov ecx, dword [0x509d50]
mov ecx, dword [ecx + 0x38]
mov dword [edx + eax*8 + 0x18], ecx
jmp case.0x4f77fc.0
mov edx, dword [0x509794]
mov edx, dword [edx]
mov ecx, dword [0x509d50]
mov ecx, dword [ecx + 0x3c]
mov dword [edx + eax*8 + 0x18], ecx
jmp case.0x4f77fc.0
mov edx, dword [0x509794]
mov edx, dword [edx]
mov ecx, dword [0x509d50]
mov ecx, dword [ecx + 0x40]
mov dword [edx + eax*8 + 0x18], ecx
jmp case.0x4f77fc.0
mov edx, dword [0x509794]
mov edx, dword [edx]
mov ecx, dword [0x509d50]
mov ecx, dword [ecx + 0x44]
mov dword [edx + eax*8 + 0x18], ecx
jmp case.0x4f77fc.0
mov edx, dword [0x509794]
mov edx, dword [edx]
mov ecx, dword [0x509d50]
mov ecx, dword [ecx + 0x48]
mov dword [edx + eax*8 + 0x18], ecx
inc dword [ebp - 0x20]
dec dword [ebp - 0x5c]
jne 0x4f7599
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f78ac
lea eax, [ebp - 0x724]
mov edx, 0x4f9188
call fcn.004157ac
lea edx, [ebp - 0x724]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [eax]
call dword [edx + 0x10]
push eax
mov eax, dword [0x5098f8]
mov ecx, 1
mov edx, dword [0x4d8c6c]
call fcn.0040600c
add esp, 4
xor eax, eax
push ebp
push 0x4f7a1b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x734]
mov edx, 0x4f9188
call fcn.004157ac
lea edx, [ebp - 0x734]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [eax]
call dword [edx + 0x10]
dec eax
test eax, eax
jl 0x4f7a11
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x744]
mov edx, 0x4f9188
call fcn.004157ac
lea edx, [ebp - 0x744]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [0x4c295c]
call fcn.00403c88
mov edx, dword [eax + 8]
lea eax, [ebp - 0x44]
call fcn.00404b74
mov ebx, dword [ebp - 0x20]
lea ebx, [ebx + ebx*2]
mov eax, dword [0x5098f8]
mov eax, dword [eax]
lea eax, [eax + ebx*4]
mov edx, dword [ebp - 0x44]
call fcn.00404940
lea eax, [ebp - 0x748]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004fc260
mov edx, dword [ebp - 0x748]
mov eax, dword [0x5098f8]
mov eax, dword [eax]
lea eax, [eax + ebx*4 + 4]
call fcn.00404940
lea eax, [ebp - 0x768]
mov edx, 0x4f9188
call fcn.004157ac
lea edx, [ebp - 0x768]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x778]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0x778]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x758]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x758]
call fcn.00411d80
mov edx, dword [0x5098f8]
mov edx, dword [edx]
mov dword [edx + ebx*4 + 8], eax
inc dword [ebp - 0x20]
dec dword [ebp - 0x5c]
jne 0x4f792d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f7a25
lea eax, [ebp - 0x788]
mov edx, 0x4f9198
call fcn.004157ac
lea edx, [ebp - 0x788]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [eax]
call dword [edx + 0x10]
push eax
mov eax, dword [0x509700]
mov ecx, 1
mov edx, dword [0x4d8c4c]
call fcn.0040600c
add esp, 4
mov byte [ebp - 0x35], 1
lea eax, [ebp - 0x798]
mov edx, 0x4f9198
call fcn.004157ac
lea edx, [ebp - 0x798]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [eax]
call dword [edx + 0x10]
dec eax
test eax, eax
jl 0x4f80ef
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x20], 0
xor eax, eax
push ebp
push 0x4f80d9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x7a8]
mov edx, 0x4f9198
call fcn.004157ac
lea edx, [ebp - 0x7a8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, eax
lea ecx, [ebp - 0x44]
mov eax, dword [0x4c2b08]
call fcn.004c3f78
cmp byte [ebp - 0x35], 0
je 0x4f7e7d
xor eax, eax
push ebp
push 0x4f7e6f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x7b8]
mov edx, 0x4f9198
call fcn.004157ac
lea edx, [ebp - 0x7b8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [0x4c295c]
call fcn.00403c88
mov edx, dword [eax + 8]
lea eax, [ebp - 0x44]
call fcn.00404b74
lea eax, [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x7e0]
mov edx, 0x4f9198
call fcn.004157ac
lea edx, [ebp - 0x7e0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x7f0]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0x7f0]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x800]
mov edx, 0x4f91a8
call fcn.004157ac
lea edx, [ebp - 0x800]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x7d0]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x7d0]
lea edx, [ebp - 0x7c0]
call fcn.00417658
mov edx, dword [ebp - 0x7c0]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004fc260
mov edx, dword [ebp - 0x7bc]
mov eax, dword [ebp - 0x20]
mov ecx, eax
shl eax, 3
sub eax, ecx
mov ecx, dword [0x509700]
mov ecx, dword [ecx]
lea eax, [ecx + eax*4 + 8]
call fcn.00404940
mov eax, dword [0x50964c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4f7c3e
inc ebx
xor esi, esi
lea edx, [ebp - 0x804]
mov eax, dword [ebp - 0x20]
call fcn.0040971c
mov eax, dword [ebp - 0x804]
push eax
lea ecx, [ebp - 0x808]
mov eax, dword [0x50964c]
mov eax, dword [eax]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x808]
pop eax
call fcn.00404cf8
jne 0x4f7c3a
mov eax, dword [ebp - 0x20]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x509700]
mov edx, dword [edx]
mov byte [edx + eax*4 + 0x18], 1
jmp 0x4f7c3e
inc esi
dec ebx
jne 0x4f7bea
mov ebx, dword [ebp - 0x20]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [0x509700]
mov eax, dword [eax]
lea eax, [eax + ebx*4]
mov edx, dword [ebp - 0x44]
call fcn.00404940
lea eax, [ebp - 0x828]
mov edx, 0x4f9198
call fcn.004157ac
lea edx, [ebp - 0x828]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x838]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0x838]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x848]
mov edx, 0x4f91a8
call fcn.004157ac
lea edx, [ebp - 0x848]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x818]
mov ecx, dword [eax]
call dword [ecx]
lea edx, [ebp - 0x818]
mov eax, dword [0x509700]
mov eax, dword [eax]
lea eax, [eax + ebx*4 + 4]
call fcn.004146e0
lea eax, [ebp - 0x868]
mov edx, 0x4f9198
call fcn.004157ac
lea edx, [ebp - 0x868]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x878]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0x878]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x888]
mov edx, 0x4f8fa4
call fcn.004157ac
lea edx, [ebp - 0x888]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x858]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x858]
call fcn.00411d80
mov edx, dword [0x509700]
mov edx, dword [edx]
mov dword [edx + ebx*4 + 0xc], eax
lea eax, [ebp - 0x8a8]
mov edx, 0x4f9198
call fcn.004157ac
lea edx, [ebp - 0x8a8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x8b8]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0x8b8]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x8c8]
mov edx, 0x4f91b4
call fcn.004157ac
lea edx, [ebp - 0x8c8]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x898]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x898]
call fcn.00411d80
mov edx, dword [0x509700]
mov edx, dword [edx]
mov dword [edx + ebx*4 + 0x10], eax
lea eax, [ebp - 0x8e8]
mov edx, 0x4f9198
call fcn.004157ac
lea edx, [ebp - 0x8e8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x8f8]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0x8f8]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0x908]
mov edx, 0x4f91c4
call fcn.004157ac
lea edx, [ebp - 0x908]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x8d8]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x8d8]
lea edx, [ebp - 0x48]
call fcn.00417658
lea eax, [ebp - 0x90c]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.004f5260
mov edx, dword [ebp - 0x90c]
mov eax, dword [0x509700]
mov eax, dword [eax]
lea eax, [eax + ebx*4 + 0x14]
call fcn.00404940
mov eax, dword [0x509700]
mov eax, dword [eax]
mov byte [eax + ebx*4 + 0x19], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f7e7d
cmp byte [ebp - 0x35], 0
jne 0x4f80cf
lea eax, [ebp - 0x910]
push eax
lea eax, [ebp - 0x934]
mov edx, 0x4f9198
call fcn.004157ac
lea edx, [ebp - 0x934]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 8]
push eax
lea eax, [ebp - 0x944]
mov edx, 0x4f91a8
call fcn.004157ac
lea edx, [ebp - 0x944]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x924]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x924]
lea edx, [ebp - 0x914]
call fcn.00417658
mov edx, dword [ebp - 0x914]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004fc260
mov edx, dword [ebp - 0x910]
mov ebx, dword [ebp - 0x20]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [0x509700]
mov eax, dword [eax]
lea eax, [eax + ebx*4 + 8]
call fcn.00404940
lea eax, [ebp - 0x964]
mov edx, 0x4f9198
call fcn.004157ac
lea edx, [ebp - 0x964]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 8]
push eax
lea eax, [ebp - 0x974]
mov edx, 0x4f91a8
call fcn.004157ac
lea edx, [ebp - 0x974]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x954]
mov ecx, dword [eax]
call dword [ecx]
lea edx, [ebp - 0x954]
mov eax, dword [0x509700]
mov eax, dword [eax]
lea eax, [eax + ebx*4 + 4]
call fcn.004146e0
lea eax, [ebp - 0x994]
mov edx, 0x4f9198
call fcn.004157ac
lea edx, [ebp - 0x994]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 8]
push eax
lea eax, [ebp - 0x9a4]
mov edx, 0x4f8fa4
call fcn.004157ac
lea edx, [ebp - 0x9a4]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x984]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x984]
call fcn.00411d80
mov edx, dword [0x509700]
mov edx, dword [edx]
mov dword [edx + ebx*4 + 0xc], eax
lea eax, [ebp - 0x9c4]
mov edx, 0x4f9198
call fcn.004157ac
lea edx, [ebp - 0x9c4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 8]
push eax
lea eax, [ebp - 0x9d4]
mov edx, 0x4f91b4
call fcn.004157ac
lea edx, [ebp - 0x9d4]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x9b4]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x9b4]
call fcn.00411d80
mov edx, dword [0x509700]
mov edx, dword [edx]
mov dword [edx + ebx*4 + 0x10], eax
lea eax, [ebp - 0x9f4]
mov edx, 0x4f9198
call fcn.004157ac
lea edx, [ebp - 0x9f4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 8]
push eax
lea eax, [ebp - 0xa04]
mov edx, 0x4f91c4
call fcn.004157ac
lea edx, [ebp - 0xa04]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0x9e4]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0x9e4]
lea edx, [ebp - 0x48]
call fcn.00417658
lea eax, [ebp - 0xa08]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.004f5260
mov edx, dword [ebp - 0xa08]
mov eax, dword [0x509700]
mov eax, dword [eax]
lea eax, [eax + ebx*4 + 0x14]
call fcn.00404940
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f80e3
inc dword [ebp - 0x20]
dec dword [ebp - 0x5c]
jne 0x4f7a9c
lea eax, [ebp - 0xa18]
mov edx, 0x4f91d4
call fcn.004157ac
lea edx, [ebp - 0xa18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [eax]
call dword [edx + 0x10]
push eax
mov eax, dword [0x509d00]
mov ecx, 1
mov edx, dword [0x4d8c8c]
call fcn.0040600c
add esp, 4
xor eax, eax
push ebp
push 0x4f8446
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xa28]
mov edx, 0x4f91d4
call fcn.004157ac
lea edx, [ebp - 0xa28]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [eax]
call dword [edx + 0x10]
dec eax
test eax, eax
jle 0x4f843c
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x20], 1
xor eax, eax
push ebp
push 0x4f8426
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xa38]
mov edx, 0x4f91d4
call fcn.004157ac
lea edx, [ebp - 0xa38]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [0x4c295c]
call fcn.00403c88
mov edx, dword [eax + 8]
lea eax, [ebp - 0x44]
call fcn.00404b74
lea eax, [ebp - 0xa3c]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004f5260
mov edx, dword [ebp - 0xa3c]
mov ebx, dword [ebp - 0x20]
mov eax, ebx
shl ebx, 3
sub ebx, eax
mov eax, dword [0x509d00]
mov eax, dword [eax]
lea eax, [eax + ebx*4 + 4]
call fcn.00404940
mov eax, dword [0x509d00]
mov eax, dword [eax]
lea eax, [eax + ebx*4]
mov edx, dword [ebp - 0x44]
call fcn.00404940
lea eax, [ebp - 0xa5c]
mov edx, 0x4f91d4
call fcn.004157ac
lea edx, [ebp - 0xa5c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0xa6c]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0xa6c]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0xa7c]
mov edx, 0x4f8fa4
call fcn.004157ac
lea edx, [ebp - 0xa7c]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0xa4c]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0xa4c]
call fcn.00411d80
mov edx, dword [0x509d00]
mov edx, dword [edx]
mov dword [edx + ebx*4 + 0xc], eax
lea eax, [ebp - 0xa9c]
mov edx, 0x4f91d4
call fcn.004157ac
lea edx, [ebp - 0xa9c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0xaac]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0xaac]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0xabc]
mov edx, 0x4f91e4
call fcn.004157ac
lea edx, [ebp - 0xabc]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0xa8c]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0xa8c]
call fcn.00411d80
mov edx, dword [0x509d00]
mov edx, dword [edx]
mov dword [edx + ebx*4 + 0x10], eax
mov eax, dword [0x509848]
mov eax, dword [eax]
call fcn.00405e58
add eax, 2
push eax
mov eax, dword [0x509848]
mov ecx, 1
mov edx, dword [0x4d8d0c]
call fcn.0040600c
add esp, 4
mov eax, dword [0x509848]
mov eax, dword [eax]
call fcn.00405e58
lea eax, [eax + eax*2]
mov edx, dword [0x509848]
mov edx, dword [edx]
lea eax, [edx + eax*4]
push eax
mov eax, dword [ebp - 0x44]
call fcn.00409858
pop edx
mov dword [edx], eax
mov eax, dword [0x509848]
mov eax, dword [eax]
call fcn.00405e58
lea eax, [eax + eax*2]
mov edx, dword [0x509848]
mov edx, dword [edx]
mov ecx, dword [0x509d00]
mov ecx, dword [ecx]
mov ecx, dword [ecx + ebx*4 + 0xc]
mov dword [edx + eax*4 + 4], ecx
mov eax, dword [0x509848]
mov eax, dword [eax]
call fcn.00405e58
lea eax, [eax + eax*2]
mov edx, dword [0x509848]
mov edx, dword [edx]
lea eax, [edx + eax*4 + 8]
push eax
lea eax, [ebp - 0xac0]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004f5260
mov edx, dword [ebp - 0xac0]
pop eax
call fcn.00404940
mov eax, dword [0x509d00]
mov eax, dword [eax]
mov dword [eax + ebx*4 + 8], 0xa
mov eax, dword [0x509c74]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4f841c
inc ebx
xor esi, esi
lea ecx, [ebp - 0xac4]
mov eax, dword [0x509c74]
mov eax, dword [eax]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xac4]
mov eax, dword [ebp - 0x20]
mov ecx, eax
shl eax, 3
sub eax, ecx
mov ecx, dword [0x509d00]
mov ecx, dword [ecx]
mov eax, dword [ecx + eax*4]
call fcn.00404cf8
jne 0x4f8418
mov eax, dword [ebp - 0x20]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [0x509d00]
mov edx, dword [edx]
mov byte [edx + eax*4 + 0x14], 1
jmp 0x4f841c
inc esi
dec ebx
jne 0x4f83c9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f8430
inc dword [ebp - 0x20]
dec dword [ebp - 0x5c]
jne 0x4f816f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f8450
push 0
mov eax, dword [0x509d94]
mov ecx, 1
mov edx, dword [0x4d8ccc]
call fcn.0040600c
add esp, 4
lea eax, [ebp - 0xad4]
mov edx, 0x4f91f0
call fcn.004157ac
lea edx, [ebp - 0xad4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [eax]
call dword [edx + 0x10]
dec eax
test eax, eax
jl 0x4f8b0e
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0xae4]
mov edx, 0x4f91f0
call fcn.004157ac
lea edx, [ebp - 0xae4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, eax
lea ecx, [ebp - 0x48]
mov eax, dword [0x4c2b08]
call fcn.004c3f78
lea eax, [ebp - 0xaf4]
mov edx, 0x4f91f0
call fcn.004157ac
lea edx, [ebp - 0xaf4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [0x4c295c]
call fcn.00403c88
mov edx, dword [eax + 8]
lea eax, [ebp - 0x44]
call fcn.00404b74
mov eax, dword [ebp - 0x44]
mov edx, 0x4f9200
call fcn.00404cf8
je 0x4f8b02
mov eax, dword [ebp - 0x44]
mov edx, 0x4f9210
call fcn.00404cf8
je 0x4f8b02
mov eax, dword [0x509d94]
mov eax, dword [eax]
call fcn.00405e58
add eax, 2
push eax
mov eax, dword [0x509d94]
mov ecx, 1
mov edx, dword [0x4d8ccc]
call fcn.0040600c
add esp, 4
lea eax, [ebp - 0xb04]
mov edx, 0x4f91f0
call fcn.004157ac
lea edx, [ebp - 0xb04]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4f8846
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xb24]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0xb24]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0xb34]
mov edx, 0x4f9220
call fcn.004157ac
lea edx, [ebp - 0xb34]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0xb14]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0xb14]
call fcn.00411d80
mov ebx, eax
mov eax, dword [0x509d94]
mov eax, dword [eax]
call fcn.00405e58
imul eax, eax, 0xd
mov edx, dword [0x509d94]
mov edx, dword [edx]
mov dword [edx + eax*4 + 8], ebx
mov eax, dword [0x509d94]
mov eax, dword [eax]
call fcn.00405e58
imul eax, eax, 0xd
mov edx, dword [0x509d94]
mov edx, dword [edx]
lea eax, [edx + eax*4]
mov edx, dword [0x509784]
mov edx, dword [edx + 0x34]
call fcn.00404940
lea eax, [ebp - 0xb54]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0xb54]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0xb64]
mov edx, 0x4f8fa4
call fcn.004157ac
lea edx, [ebp - 0xb64]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0xb44]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0xb44]
call fcn.00411d80
mov ebx, eax
mov eax, dword [0x509d94]
mov eax, dword [eax]
call fcn.00405e58
imul eax, eax, 0xd
mov edx, dword [0x509d94]
mov edx, dword [edx]
mov dword [edx + eax*4 + 0x10], ebx
lea eax, [ebp - 0xb84]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0xb84]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0xb94]
mov edx, 0x4f922c
call fcn.004157ac
lea edx, [ebp - 0xb94]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0xb74]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0xb74]
call fcn.00411d80
mov ebx, eax
mov eax, dword [0x509d94]
mov eax, dword [eax]
call fcn.00405e58
imul eax, eax, 0xd
mov edx, dword [0x509d94]
mov edx, dword [edx]
mov dword [edx + eax*4 + 0x1c], ebx
lea eax, [ebp - 0xba4]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0xba4]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0xbb4]
mov edx, 0x4f9240
call fcn.004157ac
lea edx, [ebp - 0xbb4]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov edx, eax
lea ecx, [ebp - 0x48]
mov eax, dword [0x4c2b08]
call fcn.004c3f78
mov eax, dword [ebp - 0x48]
mov edx, 0x4f9250
call fcn.00404cf8
je 0x4f87b4
lea eax, [ebp - 0xbd4]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0xbd4]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0xbe4]
mov edx, 0x4f9240
call fcn.004157ac
lea edx, [ebp - 0xbe4]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0xbc4]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0xbc4]
call fcn.00411d80
mov ebx, eax
mov eax, dword [0x509d94]
mov eax, dword [eax]
call fcn.00405e58
imul eax, eax, 0xd
mov edx, dword [0x509d94]
mov edx, dword [edx]
mov dword [edx + eax*4 + 0x28], ebx
jmp 0x4f87d1
mov eax, dword [0x509d94]
mov eax, dword [eax]
call fcn.00405e58
imul eax, eax, 0xd
mov edx, dword [0x509d94]
mov edx, dword [edx]
xor ecx, ecx
mov dword [edx + eax*4 + 0x28], ecx
lea eax, [ebp - 0xc04]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0xc04]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0xc14]
mov edx, 0x4f9260
call fcn.004157ac
lea edx, [ebp - 0xc14]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0xbf4]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [ebp - 0xbf4]
call fcn.00411d80
mov ebx, eax
mov eax, dword [0x509d94]
mov eax, dword [eax]
call fcn.00405e58
imul eax, eax, 0xd
mov edx, dword [0x509d94]
mov edx, dword [edx]
mov dword [edx + eax*4 + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f8870
xor eax, eax
push ebp
push 0x4f8af8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x509848]
mov eax, dword [eax]
call fcn.00405e58
add eax, 2
push eax
mov eax, dword [0x509848]
mov ecx, 1
mov edx, dword [0x4d8d0c]
call fcn.0040600c
add esp, 4
mov eax, dword [0x509848]
mov eax, dword [eax]
call fcn.00405e58
lea eax, [eax + eax*2]
mov edx, dword [0x509848]
mov edx, dword [edx]
lea eax, [edx + eax*4]
push eax
mov eax, dword [ebp - 0x44]
call fcn.00409858
pop edx
mov dword [edx], eax
mov eax, dword [0x509d94]
mov eax, dword [eax]
call fcn.00405e58
imul eax, eax, 0xd
mov edx, dword [0x509d94]
mov edx, dword [edx]
mov ebx, dword [edx + eax*4 + 0x10]
mov eax, dword [0x509848]
mov eax, dword [eax]
call fcn.00405e58
lea eax, [eax + eax*2]
mov edx, dword [0x509848]
mov edx, dword [edx]
mov dword [edx + eax*4 + 4], ebx
mov eax, dword [0x509848]
mov eax, dword [eax]
call fcn.00405e58
lea eax, [eax + eax*2]
mov edx, dword [0x509848]
mov edx, dword [edx]
lea eax, [edx + eax*4 + 8]
push eax
lea eax, [ebp - 0xc18]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004f5260
mov edx, dword [ebp - 0xc18]
pop eax
call fcn.00404940
mov eax, dword [0x509d94]
mov eax, dword [eax]
call fcn.00405e58
imul eax, eax, 0xd
mov edx, dword [0x509d94]
mov edx, dword [edx]
lea eax, [edx + eax*4 + 0x20]
push eax
mov eax, dword [ebp - 0x44]
call fcn.00409858
pop edx
mov dword [edx], eax
mov eax, dword [0x509d94]
mov eax, dword [eax]
call fcn.00405e58
imul eax, eax, 0xd
mov edx, dword [0x509d94]
mov edx, dword [edx]
lea eax, [edx + eax*4 + 0x24]
push eax
lea eax, [ebp - 0xc1c]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004f5260
mov edx, dword [ebp - 0xc1c]
pop eax
call fcn.00404940
mov eax, dword [0x509d94]
mov eax, dword [eax]
call fcn.00405e58
imul eax, eax, 0xd
mov edx, dword [0x509d94]
mov edx, dword [edx]
lea eax, [edx + eax*4 + 0xc]
push eax
lea eax, [ebp - 0xc3c]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0xc3c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0xc4c]
mov edx, 0x4f9270
call fcn.004157ac
lea edx, [ebp - 0xc4c]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0xc2c]
mov ecx, dword [eax]
call dword [ecx]
lea edx, [ebp - 0xc2c]
pop eax
call fcn.004146e0
mov eax, dword [0x5099f4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4f8a83
inc ebx
xor esi, esi
imul eax, dword [ebp - 0x20], 0xd
mov edx, dword [0x509d94]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 0x20]
lea edx, [ebp - 0xc50]
call fcn.0040971c
mov eax, dword [ebp - 0xc50]
push eax
lea ecx, [ebp - 0xc54]
mov eax, dword [0x5099f4]
mov eax, dword [eax]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xc54]
pop eax
call fcn.00404cf8
jne 0x4f8a7f
imul eax, dword [ebp - 0x20], 0xd
mov edx, dword [0x509d94]
mov edx, dword [edx]
mov byte [edx + eax*4 + 0x2c], 1
jmp 0x4f8a83
inc esi
dec ebx
jne 0x4f8a28
mov eax, dword [0x509d94]
mov eax, dword [eax]
call fcn.00405e58
imul eax, eax, 0xd
mov edx, dword [0x509d94]
mov edx, dword [edx]
lea eax, [edx + eax*4 + 0x14]
push eax
lea eax, [ebp - 0xc74]
mov edx, dword [ebp - 0x44]
call fcn.004157ac
lea edx, [ebp - 0xc74]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x14]
push eax
lea eax, [ebp - 0xc84]
mov edx, 0x4f8fd0
call fcn.004157ac
lea edx, [ebp - 0xc84]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea edx, [ebp - 0xc64]
mov ecx, dword [eax]
call dword [ecx]
lea edx, [ebp - 0xc64]
pop eax
call fcn.004146e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f8b02
inc dword [ebp - 0x20]
dec dword [ebp - 0x5c]
jne 0x4f84a1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8b2d
push 0x50b390
call sub.kernel32.dll_LeaveCriticalSection_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8eac
lea eax, [ebp - 0xc84]
mov edx, dword [0x401140]
mov ecx, 3
call fcn.00405508
lea eax, [ebp - 0xc54]
mov edx, 2
call fcn.00404910
lea eax, [ebp - 0xc4c]
mov edx, dword [0x401140]
mov ecx, 3
call fcn.00405508
lea eax, [ebp - 0xc1c]
mov edx, 2
call fcn.00404910
lea eax, [ebp - 0xc14]
mov edx, dword [0x401140]
mov ecx, 0x15
call fcn.00405508
lea eax, [ebp - 0xac4]
mov edx, 2
call fcn.00404910
lea eax, [ebp - 0xabc]
mov edx, dword [0x401140]
mov ecx, 8
call fcn.00405508
lea eax, [ebp - 0xa3c]
call fcn.004048ec
lea eax, [ebp - 0xa38]
mov edx, dword [0x401140]
mov ecx, 3
call fcn.00405508
lea eax, [ebp - 0xa08]
call fcn.004048ec
lea eax, [ebp - 0xa04]
mov edx, dword [0x401140]
mov ecx, 0xf
call fcn.00405508
lea eax, [ebp - 0x914]
mov edx, 3
call fcn.00404910
lea eax, [ebp - 0x908]
mov edx, dword [0x401140]
mov ecx, 0x10
call fcn.00405508
lea eax, [ebp - 0x808]
mov edx, 2
call fcn.00404910
lea eax, [ebp - 0x800]
mov edx, dword [0x401140]
mov ecx, 4
call fcn.00405508
lea eax, [ebp - 0x7c0]
mov edx, 2
call fcn.00404910
lea eax, [ebp - 0x7b8]
mov edx, dword [0x401140]
mov ecx, 7
call fcn.00405508
lea eax, [ebp - 0x748]
call fcn.004048ec
lea eax, [ebp - 0x744]
mov edx, dword [0x401140]
mov ecx, 3
call fcn.00405508
lea eax, [ebp - 0x714]
call fcn.004048ec
lea eax, [ebp - 0x710]
mov edx, dword [0x401140]
mov ecx, 8
call fcn.00405508
lea eax, [ebp - 0x690]
mov edx, 2
call fcn.00404910
lea eax, [ebp - 0x688]
mov edx, dword [0x401140]
mov ecx, 9
call fcn.00405508
lea eax, [ebp - 0x5f8]
mov edx, 3
call fcn.00404910
lea eax, [ebp - 0x5ec]
mov edx, dword [0x48b66c]
mov ecx, 3
call fcn.00405508
lea eax, [ebp - 0x5e0]
call fcn.00404ff8
lea eax, [ebp - 0x5dc]
mov edx, dword [0x48b66c]
mov ecx, 0xa
call fcn.00405508
lea eax, [ebp - 0x5b4]
mov edx, dword [0x401140]
mov ecx, 2
call fcn.00405508
lea eax, [ebp - 0x594]
mov edx, 3
call fcn.00404910
lea eax, [ebp - 0x588]
mov edx, dword [0x401140]
mov ecx, 2
call fcn.00405508
lea eax, [ebp - 0x568]
call fcn.004048ec
lea eax, [ebp - 0x564]
call fcn.0041118c
lea eax, [ebp - 0x554]
mov edx, 3
call fcn.00404910
lea eax, [ebp - 0x548]
mov edx, dword [0x401140]
mov ecx, 2
call fcn.00405508
lea eax, [ebp - 0x528]
call fcn.004048ec
lea eax, [ebp - 0x524]
mov edx, dword [0x401140]
mov ecx, 0xc
call fcn.00405508
lea eax, [ebp - 0x464]
call fcn.004048ec
lea eax, [ebp - 0x460]
mov edx, dword [0x401140]
mov ecx, 5
call fcn.00405508
lea eax, [ebp - 0x410]
call fcn.004048ec
lea eax, [ebp - 0x40c]
mov edx, dword [0x401140]
mov ecx, 5
call fcn.00405508
lea eax, [ebp - 0x3bc]
call fcn.004048ec
lea eax, [ebp - 0x3b8]
call fcn.0041118c
lea eax, [ebp - 0x3a8]
call fcn.004048ec
lea eax, [ebp - 0x3a4]
mov edx, dword [0x401140]
mov ecx, 0x15
call fcn.00405508
lea eax, [ebp - 0x244]
call fcn.0041118c
lea eax, [ebp - 0x254]
call fcn.0041118c
lea eax, [ebp - 0x234]
mov edx, dword [0x401140]
mov ecx, 5
call fcn.00405508
lea eax, [ebp - 0x1e4]
call fcn.004048ec
lea eax, [ebp - 0x1e0]
mov edx, dword [0x401140]
mov ecx, 0x18
call fcn.00405508
lea eax, [ebp - 0x60]
call fcn.004048ec
lea eax, [ebp - 0x58]
mov edx, 8
call fcn.00404910
lea eax, [ebp - 8]
call fcn.004048ec
ret