Function at 0x43ff20
Capabilities:
Get geographical location
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x34c
mov ecx, dword [0x8eaedc]
push ebx
push ebp
or ebp, 0xffffffff
test ecx, ecx
push esi
push edi
mov dword [esp + 0x38], 0
mov byte [esp + 0x2b], 0
mov dword [esp + 0xa0], ebp
je 0x43ff61
mov edx, dword [0x8eaee0]
mov eax, edx
sub eax, ecx
sar eax, 2
test eax, eax
jbe 0x43ff61
mov eax, dword [edx - 4]
jmp 0x43ff63
mov eax, ebp
mov ecx, dword [0x85c164]
cmp eax, 3
sete dl
mov eax, ecx
shr eax, 2
and al, 1
and ecx, 0xfffffffb
test dl, dl
mov byte [esp + 0x2a], dl
mov byte [esp + 0x33], al
mov dword [0x85c164], ecx
je 0x43ffe3
push 0
call fcn.00488e30
add esp, 4
call fcn.004a2920
sub esp, 0x64
lea eax, [esp + 0x1bc]
mov ebx, esp
mov dword [esp + 0xf4], 0x5f
mov dword [esp + 0x10c], 0x60
mov dword [esp + 0x21c], 0x8cccd0
mov dword [esp + 0x1bc], 0x32
call fcn.00498530
mov edi, 0x8e87b4
call fcn.004a1410
jmp 0x440003
push 1
call fcn.004a79a0
add esp, 4
mov dword [esp + 0x90], 7
mov dword [esp + 0xa8], 9
movsx eax, word [0x86ba74]
cdq
sub eax, edx
sar eax, 1
xor ecx, ecx
test eax, eax
jl 0x440020
inc ecx
mov edx, ebp
shl edx, cl
add eax, edx
cmp eax, ecx
jge 0x440015
xor ecx, ecx
mov dword [esp + 0xa4], ecx
mov eax, 0x864014
mov edi, edi
cmp dword [eax], 0
jne 0x440036
inc ecx
add eax, 0x1c
cmp eax, 0x864110
jl 0x440030
mov dword [esp + 0xa4], ecx
xor ecx, ecx
mov dword [esp + 0x9c], ecx
mov eax, 0x864018
test byte [eax], 1
je 0x44005b
inc ecx
add eax, 0x1c
cmp eax, 0x864114
jl 0x440055
xor esi, esi
mov dword [esp + 0x9c], ecx
mov dword [esp + 0x98], esi
mov dword [esp + 0x2c], ebp
xor ebx, ebx
mov edx, 0x85df78
mov edi, 0x862b70
mov cx, word [edx]
test cx, cx
je 0x4400bb
cmp dword [edi], 0
js 0x4400bb
mov eax, dword [edx - 4]
movsx ecx, cx
and eax, 3
lea ebp, [eax + ecx]
cmp ebp, esi
jle 0x4400bb
test ecx, ecx
jge 0x4400aa
xor ecx, ecx
jmp 0x4400b4
cmp ecx, 8
jle 0x4400b4
mov ecx, 8
lea esi, [eax + ecx]
mov dword [esp + 0x2c], ebx
add edi, 0x20
inc ebx
add edx, 0x94
cmp edi, 0x8630f0
jl 0x440085
mov eax, dword [0x85c164]
mov dword [esp + 0x98], esi
xor esi, esi
xor ebx, ebx
test eax, 0x80000
mov dword [esp + 0x78], esi
je 0x4400f2
mov dword [esp + 0x78], 0xa
jmp 0x440130
mov edi, dword [0x85c648]
cmp edi, ebx
je 0x440130
mov edx, dword [0x85c758]
mov eax, edx
xor ecx, ecx
and eax, 0x80000000
jmp 0x440110
cmp eax, ebx
jne 0x440126
cmp edi, ebx
jle 0x440126
mov ebp, 0x100
shl ebp, cl
test edx, ebp
jne 0x440126
add esi, 2
inc ecx
cmp ecx, 4
jl 0x440110
mov dword [esp + 0x78], esi
mov esi, dword [0x85c4c8]
mov edi, dword [0x85c610]
mov eax, esi
mov edx, edi
xor ecx, ecx
and eax, 0x80000000
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x94], ebx
and edx, 0x80000000
test eax, eax
jne 0x440175
mov ebp, dword [0x85c3b8]
test ebp, ebp
jle 0x440175
mov ebp, 0x100
shl ebp, cl
test esi, ebp
jne 0x440175
inc dword [esp + 0x7c]
test edx, edx
jne 0x44018f
mov ebp, dword [0x85c500]
test ebp, ebp
jle 0x44018f
mov ebp, 0x100
shl ebp, cl
test edi, ebp
jne 0x44018f
inc ebx
inc ecx
cmp ecx, 4
jl 0x440158
mov ebp, dword [0x86bb14]
xor ecx, ecx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x88], ecx
mov ebx, 0x85df90
add ecx, dword [ebx]
mov eax, ecx
xor esi, esi
imul eax, eax, 0x1f4
lea edi, [eax + ebp]
mov edx, 1
mov eax, 0x3e8
lea esp, [esp]
add esi, eax
cmp edi, esi
jl 0x4401dd
mov dword [esp + 0x88], edx
add eax, 0x3e8
inc edx
cmp eax, 0x61a8
jl 0x4401d0
add ebx, 0x94
cmp ebx, 0x85f900
jl 0x4401b0
mov dword [esp + 0xc8], ecx
call fcn.0043fcd0
xor ecx, ecx
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xc0], ecx
mov dword [esp + 0xdc], eax
mov dword [esp + 0xc4], ecx
xor edi, edi
jmp 0x440230
mov edx, dword [edi + 0x7290ac]
push edx
push str.smallMap__s.dds
lea edx, [esp + 0x44]
mov dword [esp + 0x44], 0x8cccd0
call fcn.004f3ce0
push 0xc0
call fcn.005354b8
mov ebp, dword [esp + 0x48]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4402a5
mov eax, dword [0x8ec008]
mov ebx, dword [0x729444]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push 0xffffffffffffffff
push ecx
push ecx
mov dword [esi + 4], ecx
push ecx
mov dword [esi], 0x6ff14c
mov dword [esi + 0x1c], ecx
inc ebx
push ecx
mov dword [esi + 0x64], ecx
mov dword [0x729444], ebx
mov dword [esi + 0xbc], ecx
push eax
xor ebx, ebx
mov eax, ebp
mov ecx, esi
call fcn.004be370
jmp 0x4402a7
xor esi, esi
mov ecx, dword [esp + edi + 0xb8]
cmp ecx, esi
je 0x4402cf
test ecx, ecx
je 0x4402c1
dec dword [ecx + 4]
jne 0x4402c1
mov eax, dword [ecx]
push 1
call dword [eax]
test esi, esi
mov dword [esp + edi + 0xb8], esi
je 0x4402cf
inc dword [esi + 4]
lea eax, [ebp - 8]
test eax, eax
je 0x4402e6
cmp eax, 0x8cccc8
je 0x4402e6
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
add edi, 4
cmp edi, 0x10
jl 0x440230
cmp dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x3c], 0
je 0x4403a9
push 0xc0
call fcn.005354b8
mov edi, eax
add esp, 4
test edi, edi
je 0x44037b
mov eax, dword [esp + 0x2c]
lea esi, [esp + 0x8c]
mov dword [esp + 0x38], 1
call fcn.00457060
mov ecx, dword [0x8ec008]
mov eax, dword [eax]
mov esi, dword [0x729444]
xor edx, edx
push edx
push edx
push edx
push edx
push 0xffffffffffffffff
push edx
push edx
push edx
mov dword [edi + 4], edx
mov dword [edi], 0x6ff14c
push edx
mov dword [edi + 0x1c], edx
push ecx
inc esi
mov dword [edi + 0x64], edx
xor ebx, ebx
mov ecx, edi
mov dword [0x729444], esi
mov dword [edi + 0xbc], edx
call fcn.004be370
mov eax, dword [edi + 4]
inc eax
mov dword [esp + 0x3c], edi
mov dword [edi + 4], eax
test byte [esp + 0x38], 1
je 0x4403a9
mov eax, dword [esp + 0x8c]
add eax, 0xfffffff8
je 0x44039e
cmp eax, 0x8cccc8
je 0x44039e
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esp + 0x8c], 0x8cccd0
xor ecx, ecx
mov dword [esp + 0xe0], ecx
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xe8], ecx
mov dword [esp + 0xec], ecx
mov dword [esp + 0xf0], ecx
mov dword [esp + 0xf4], ecx
mov dword [esp + 0xf8], ecx
mov dword [esp + 0xfc], ecx
mov dword [esp + 0x100], ecx
mov dword [esp + 0x104], ecx
xor edi, edi
mov eax, edi
call fcn.00456a80
mov ecx, dword [esp + edi*4 + 0xe0]
mov esi, eax
cmp ecx, esi
je 0x440424
test ecx, ecx
je 0x440416
dec dword [ecx + 4]
jne 0x440416
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + edi*4 + 0xe0], esi
je 0x440424
inc dword [esi + 4]
inc edi
cmp edi, 9
jle 0x4403f3
push 0xc0
call fcn.005354b8
mov esi, eax
add esp, 4
test esi, esi
je 0x440481
mov eax, dword [0x8ec008]
mov edi, dword [0x729444]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push 0xffffffffffffffff
push ecx
push ecx
mov dword [esi + 4], ecx
push ecx
mov dword [esi], 0x6ff14c
mov dword [esi + 0x1c], ecx
push ecx
mov dword [esi + 0x64], ecx
inc edi
mov dword [esi + 0xbc], ecx
push eax
xor ebx, ebx
mov eax, str.xMark.dds
mov ecx, esi
mov dword [0x729444], edi
call fcn.004be370
jmp 0x440483
xor esi, esi
test esi, esi
mov dword [esp + 0x38], esi
je 0x440490
inc dword [esi + 4]
mov edi, edi
mov al, byte [0x8ccc27]
test al, al
jne 0x44385b
mov eax, dword [0x8ccbe8]
xor ebp, ebp
push ebp
push eax
mov word [0x86e330], bp
call fcn.004b2b90
mov edx, dword [0x728638]
mov eax, dword [0x72863c]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [0x728640]
mov dword [ecx + 4], eax
push str.The_Illustrious_Captain__PCNAME
mov esi, 0x8ebf58
mov dword [ecx + 8], edx
call fcn.004f7660
mov eax, dword [0x8cb568]
push eax
mov eax, dword [0x85c26c]
cdq
sub eax, edx
sar eax, 1
add eax, 0x28
push eax
call fcn.00487f30
mov ecx, dword [0x7281ec]
mov edx, dword [0x7281dc]
mov eax, dword [0x8cb568]
push ebp
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
mov ebx, 0x64
push ebx
add ecx, 0xffffffe2
push ecx
add edx, 0xffffffe0
push edx
push 0x86bb48
mov dword [0x85c11c], ebx
call fcn.004b0b40
mov edi, dword [esp + 0x114]
push edi
push str.Achievement_Points:__NUM
call fcn.004f7660
mov eax, dword [0x8cb568]
add esp, 0x40
push eax
mov eax, dword [0x85c26c]
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, 0x32
push eax
call fcn.00487f30
mov ecx, dword [0x7281ec]
mov eax, dword [0x85c26c]
push ebp
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push ebx
add ecx, 0xffffffe2
add eax, 0xffffffe0
push ecx
push eax
mov eax, dword [0x8cb568]
push 0x86bb48
mov dword [0x85c11c], ebx
call fcn.004b0b40
add esp, 0x28
cmp edi, 1
jle 0x4405d2
push str._click_an_icon_to_relive_your_adventures_
call fcn.004f7660
mov eax, dword [0x85c26c]
mov ecx, dword [0x7281ec]
add esp, 4
push ebp
push 0xffffffffffffffff
push 4
cdq
push 0xffffffffffffffff
sub eax, edx
push 0x32
add ecx, 0xffffffe0
sar eax, 1
push ecx
push eax
push 0x86bb48
xor eax, eax
call fcn.004b0b40
add esp, 0x20
mov edx, dword [0x86bb14]
push edx
push str.Wealth:__NUM_gold
mov esi, 0x8ebf58
call fcn.004f7660
mov eax, dword [0x7281ec]
push ebp
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
add eax, 0x20
push 0x37
push eax
mov eax, dword [0x7281dc]
add eax, 0xffffffe0
push eax
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov ecx, dword [esp + 0xf0]
imul ecx, ecx, 0x32
push ecx
push str.Land:__NUM_acres
call fcn.004f7660
mov eax, dword [0x7281ec]
mov edx, dword [0x7281dc]
push ebp
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
add eax, 0x30
push 0x37
push eax
add edx, 0xffffffe0
push edx
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov eax, dword [esp + 0xd8]
add esp, 0x50
push 0x18
push eax
push str.Wealth_Points:___NUM__NUM_
call fcn.004f7660
mov eax, dword [0x7281ec]
mov ecx, dword [0x7281dc]
add esp, 0xc
push ebp
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
add eax, 8
push 0x4b
push eax
add ecx, 0xffffffe0
push ecx
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov ecx, dword [0x85c268]
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
mov dword [esp + 0x3c], ebp
mov ebp, dword [0x7281ec]
shr eax, 0x1f
add esp, 0x20
lea ecx, [edx + eax + 5]
mov ebx, 0x86ba88
add ebp, 0x66
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebp
movzx eax, byte [ebx]
lea ecx, [eax - 1]
test ecx, ecx
mov esi, 0x8ebf58
push 8
jle 0x4406ee
mov edx, dword [esp + 0x20]
push ecx
push eax
push edx
push str._NATIONALITY:__RANK___NUM__NUM_
call fcn.004f7660
add esp, 0x14
jmp 0x440702
mov eax, dword [esp + 0x20]
push 0
push eax
push str._NATIONALITY:_No_Rank___NUM__NUM_
call fcn.004f7660
add esp, 0x10
mov ecx, dword [0x7281dc]
push 0
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
lea eax, [ebp + 8]
mov dword [esp + 0x30], eax
push 0x4b
add eax, 0xffffffe8
push eax
add ecx, 0xffffffe0
push ecx
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov al, byte [ebx]
add esp, 0x20
test al, al
ja 0x440da6
mov ax, word [ebx - 0x10]
test ax, ax
mov esi, 0x8ebf58
jge 0x4407e1
movsx edx, ax
neg edx
push edx
push str._NUM_000_gold_reward
call fcn.004f7660
add esp, 8
xor edi, edi
xor esi, esi
movsx ecx, word [ebx - 0x10]
mov eax, 3
sub eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp eax, 0xe
jle 0x440781
mov eax, 0xe
cmp edi, eax
jge 0x440836
fild dword [0x8cfcd0]
mov edx, ebp
mov dword [esp + 0x20], edx
push 0
fmul dword [0x7158e8]
push 0x420c0000
fiadd dword [esp + 0x28]
call fcn.005f275c
push eax
mov eax, dword [0x7281dc]
lea ecx, [esi + eax - 0x1c]
mov dword [esp + 0x2c], ecx
fild dword [esp + 0x2c]
fild dword [0x8cfccc]
fmul dword [0x7158e8]
faddp st(1)
call fcn.005f275c
push eax
push 0x8cfc98
call fcn.004bc130
inc edi
add esi, 0xc
jmp 0x440763
push str.No_Rank
call fcn.004f7660
mov esi, dword [esp + 0x3c]
add esp, 4
test esi, esi
je 0x440836
fild dword [esi + 0x38]
push 0
push 0x42340000
fmul dword [0x715964]
fiadd dword [esp + 0x28]
call fcn.005f275c
fild dword [esi + 0x34]
mov edx, dword [0x7281dc]
add edx, 0xffffffe4
fmul dword [0x715964]
mov dword [esp + 0x28], edx
push eax
fiadd dword [esp + 0x2c]
call fcn.005f275c
push eax
push esi
call fcn.004bc130
mov eax, dword [0x7281dc]
push 0
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0x33
lea edx, [ebp + 0x16]
push edx
add eax, 0xffffffe0
push eax
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov esi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
add esp, 0x20
add ebx, 2
inc esi
add ebp, ecx
cmp ebx, 0x86ba8e
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebp
jle 0x4406c7
mov ecx, dword [esp + 0xa4]
push 9
push ecx
push str.Pirates_Defeated:___NUM__NUM_
mov esi, 0x8ebf58
call fcn.004f7660
mov eax, dword [0x7281ec]
mov edx, dword [0x7281e0]
add esp, 0xc
push 0
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
add eax, 8
push 0x4b
push eax
add edx, 0xfffffff0
push edx
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov eax, 0x864014
add esp, 0x20
xor ebx, ebx
mov dword [esp + 0x18], 0x8cd10c
mov dword [esp + 0x14], 0x8d6718
mov dword [esp + 0x24], eax
cmp dword [eax], 0
jne 0x440a4f
mov eax, ebx
and eax, 0x80000001
jns 0x4408fc
dec eax
or eax, 0xfffffffe
inc eax
mov ecx, dword [0x7281e0]
mov esi, dword [esp + 0x14]
lea eax, [eax + eax*2]
shl eax, 5
lea edi, [eax + ecx - 0x10]
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
test esi, esi
lea edx, [eax + eax*2]
mov eax, dword [0x7281ec]
lea ebp, [eax + edx*8 + 0x16]
mov dword [esp + 0x20], edi
mov dword [esp + 0x10], ebp
je 0x440962
fild dword [esi + 0x38]
push 0
push 0x425c0000
fmul dword [0x7158cc]
fiadd dword [esp + 0x18]
call fcn.005f275c
fild dword [esi + 0x34]
push eax
fmul dword [0x7158cc]
fiadd dword [esp + 0x2c]
call fcn.005f275c
push eax
push esi
call fcn.004bc130
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [edx + 4], eax
push str._TOP10
mov esi, 0x8ebf58
mov dword [edx + 8], ecx
call fcn.004f7660
push 0
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
mov esi, 0x33
push esi
lea edx, [ebp + 0xa]
push edx
lea eax, [edi + 0x1c]
push eax
push 0x86bb48
xor eax, eax
mov dword [0x85c11c], esi
call fcn.004b0b40
mov eax, dword [0x8ccc18]
imul eax, eax, 0x33
cdq
and edx, 0x3ff
add esp, 0x30
add eax, edx
sar eax, 0xa
push 0
mov dword [esp + 0x14], eax
mov eax, dword [0x8cbdd8]
push 0x86bb48
push eax
mov dword [0x85c11c], esi
mov dword [0x8cbde0], eax
call fcn.0050ac80
fimul dword [0x72837c]
fidiv dword [0x8ccc18]
fimul dword [esp + 0x10]
fmul dword [0x715584]
call fcn.005f275c
mov si, word [0x86e330]
movsx ecx, si
shl ecx, 1
lea edx, [ebp + 4]
mov word [ecx + 0x86de80], dx
add edx, 0x12
lea eax, [edi + eax + 0x1c]
lea ebp, [ebx + 9]
inc si
mov word [ecx + 0x86dcf0], ax
mov eax, dword [esp + 0x24]
mov word [ecx + 0x86e1a0], bp
mov word [ecx + 0x86e010], di
mov word [ecx + 0x86db60], dx
mov word [0x86e330], si
inc ebx
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add eax, 0x1c
add esi, 0xc0
add edx, 0xc
cmp eax, 0x864110
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edx
jl 0x4408e5
mov ecx, dword [esp + 0x9c]
push 9
push ecx
push str.Treasure_Found:___NUM__NUM_
mov esi, 0x8ebf58
call fcn.004f7660
mov ecx, dword [0x85c268]
mov edi, dword [0x7281ec]
mov eax, 0x55555556
imul ecx
add esp, 0xc
push 0
push 0xffffffffffffffff
mov eax, edx
push 1
shr eax, 0x1f
add eax, edx
mov edx, dword [0x7281e0]
push 0xffffffffffffffff
add eax, edi
push 0x4b
push eax
add edx, 0xfffffff0
push edx
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov eax, 0x864018
add esp, 0x20
xor edi, edi
mov dword [esp + 0x18], 0x8cd10c
mov dword [esp + 0x14], 0x8d7798
mov dword [esp + 0x24], eax
test byte [eax], 1
je 0x440c75
mov eax, edi
and eax, 0x80000001
jns 0x440b08
dec eax
or eax, 0xfffffffe
inc eax
mov ecx, dword [0x7281e0]
lea eax, [eax + eax*2]
shl eax, 5
lea ebx, [eax + ecx - 6]
mov ecx, dword [0x85c268]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
inc eax
lea esi, [eax + eax*2]
mov eax, 0x55555556
imul ecx
mov ecx, dword [0x7281ec]
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ecx
lea ebp, [eax + esi*8]
mov esi, dword [esp + 0x14]
test esi, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], ebp
je 0x440b85
fild dword [esi + 0x38]
push 0
push 0x425c0000
fmul dword [0x7158cc]
fiadd dword [esp + 0x18]
call fcn.005f275c
fild dword [esi + 0x34]
push eax
fmul dword [0x7158cc]
fiadd dword [esp + 0x2c]
call fcn.005f275c
push eax
push esi
call fcn.004bc130
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [edx + 4], eax
push str._TOP10
mov esi, 0x8ebf58
mov dword [edx + 8], ecx
call fcn.004f7660
push 0
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
mov esi, 0x33
push esi
lea edx, [ebp + 2]
push edx
lea eax, [ebx + 0x12]
push eax
push 0x86bb48
xor eax, eax
mov dword [0x85c11c], esi
call fcn.004b0b40
mov eax, dword [0x8ccc18]
imul eax, eax, 0x33
cdq
and edx, 0x3ff
add esp, 0x30
add eax, edx
sar eax, 0xa
push 0
mov dword [esp + 0x14], eax
mov eax, dword [0x8cbdd8]
push 0x86bb48
push eax
mov dword [0x85c11c], esi
mov dword [0x8cbde0], eax
call fcn.0050ac80
fimul dword [0x72837c]
fidiv dword [0x8ccc18]
fimul dword [esp + 0x10]
fmul dword [0x715584]
call fcn.005f275c
lea esi, [ebx - 2]
mov bx, word [0x86e330]
movsx ecx, bx
shl ecx, 1
lea edx, [ebp - 2]
mov word [ecx + 0x86de80], dx
add edx, 0x12
lea eax, [esi + eax + 0x15]
lea ebp, [edi + 0x12]
inc bx
mov word [ecx + 0x86dcf0], ax
mov eax, dword [esp + 0x24]
mov word [ecx + 0x86e1a0], bp
mov word [ecx + 0x86e010], si
mov word [ecx + 0x86db60], dx
mov word [0x86e330], bx
inc edi
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add eax, 0x1c
add esi, 0xc0
add edx, 0xc
cmp eax, 0x864114
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edx
jl 0x440af1
movsx ecx, word [0x86bb1c]
mov edx, dword [esp + 0x7c]
push 0x10
lea eax, [edx + ecx*4]
push eax
push str.Lost_Relatives_Quest:___NUM__NUM_
mov esi, 0x8ebf58
call fcn.004f7660
mov eax, dword [0x8ccc18]
mov esi, dword [0x7281e4]
imul eax, eax, 0x4b
cdq
and edx, 0x3ff
add esp, 0xc
add eax, edx
sar eax, 0xa
push 0
mov dword [esp + 0x14], eax
mov eax, dword [0x8cbdd8]
push 0x86bb48
push eax
mov dword [0x85c11c], 0x4b
mov dword [0x8cbde0], eax
call fcn.0050ac80
fimul dword [0x72837c]
fidiv dword [0x8ccc18]
fimul dword [esp + 0x10]
fmul dword [0x715584]
call fcn.005f275c
mov edx, dword [0x85c26c]
lea ecx, [eax + esi + 0x10]
add edx, 0xfffffffb
cmp ecx, edx
push 0
jle 0x440f3b
mov eax, dword [0x85c11c]
imul eax, dword [0x8ccc18]
cdq
and edx, 0x3ff
add eax, edx
sar eax, 0xa
mov dword [esp + 0x14], eax
mov eax, dword [0x8cbdd8]
push 0x86bb48
push eax
mov dword [0x8cbde0], eax
call fcn.0050ac80
mov esi, dword [0x7281ec]
fimul dword [0x72837c]
add esi, 8
fidiv dword [0x8ccc18]
fimul dword [esp + 0x10]
fmul dword [0x715584]
call fcn.005f275c
push 0
push 0xffffffffffffffff
push 1
mov ecx, eax
mov eax, dword [0x85c26c]
push 0xffffffffffffffff
push 0x4b
sub eax, ecx
sub eax, 0xa
push esi
push eax
jmp 0x440f56
cmp al, 1
jne 0x440e05
push str.Letter_of_Marque
mov esi, 0x8ebf58
call fcn.004f7660
fild dword [0x8d6090]
add esp, 4
push 0
fmul dword [0x7158e8]
push 0x420c0000
fiadd dword [esp + 0x20]
call fcn.005f275c
fild dword [0x8d608c]
push eax
mov eax, dword [0x7281dc]
fmul dword [0x7158e8]
add eax, 0xffffffe0
mov dword [esp + 0x2c], eax
fiadd dword [esp + 0x2c]
call fcn.005f275c
push eax
push 0x8d6058
jmp 0x440831
mov ax, word [ebx - 0x10]
test ax, ax
jge 0x440e47
movsx ecx, ax
neg ecx
push ecx
push str._NUM_000_gold_reward
mov esi, 0x8ebf58
call fcn.004f7660
mov edx, dword [0x7281dc]
push 0
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
push 0x37
push ebp
add edx, 0xffffffe0
push edx
push 0x86bb48
xor eax, eax
call fcn.004b0b40
add esp, 0x28
mov byte [0x86bb48], 0
mov edi, 2
mov dword [esp + 0x14], 0x2e
jmp 0x440e60
mov al, byte [ebx]
cmp al, 9
jbe 0x440e6d
mov eax, 9
jmp 0x440e70
movzx eax, al
cmp edi, eax
jg 0x440836
mov eax, dword [0x7281dc]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + edi*4 + 0xe0]
add ebp, 0xc
test esi, esi
lea ebx, [ecx + eax - 0x4e]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x20], ebp
je 0x440ed2
fild dword [esi + 0x38]
push 0
push 0x420c0000
fmul dword [0x7158e8]
fiadd dword [esp + 0x28]
call fcn.005f275c
fild dword [esi + 0x34]
push eax
fmul dword [0x7158e8]
fiadd dword [esp + 0x40]
call fcn.005f275c
push eax
push esi
call fcn.004bc130
mov dx, word [0x86e330]
mov ecx, dword [esp + 0x1c]
movsx eax, dx
shl eax, 1
lea ecx, [ecx + ecx*4]
shl ecx, 1
mov esi, 0xc7
sub esi, ecx
mov word [eax + 0x86e010], bx
mov word [eax + 0x86de80], bp
add ebx, 0x18
add ebp, 0x18
sub esi, edi
mov word [eax + 0x86dcf0], bx
mov ebx, dword [esp + 0x24]
mov word [eax + 0x86db60], bp
mov ebp, dword [esp + 0x18]
mov word [eax + 0x86e1a0], si
mov eax, dword [esp + 0x14]
inc dx
inc edi
add eax, 0x17
mov word [0x86e330], dx
mov dword [esp + 0x14], eax
jmp 0x440e60
mov eax, dword [0x7281ec]
mov edx, dword [0x7281e4]
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
add eax, 8
push 0x4b
push eax
add edx, 0x10
push edx
xor eax, eax
push 0x86bb48
call fcn.004b0b40
mov dx, word [0x86bb1c]
add esp, 0x20
xor ebp, ebp
xor ebx, ebx
mov dword [esp + 0x18], 0x8d6358
cmp dx, 3
mov dword [esp + 0x14], ebx
mov eax, 3
jg 0x440f8a
movsx eax, dx
cmp ebp, eax
jg 0x4410ee
xor edi, edi
movsx eax, dx
cmp ebp, eax
jl 0x440fb9
mov ecx, edi
mov eax, 0x100
shl eax, cl
test dword [0x85c4c8], eax
jne 0x441019
mov eax, dword [0x85c3b8]
test eax, eax
jle 0x441019
mov esi, dword [esp + edi*4 + 0xb8]
test esi, esi
je 0x441019
fild dword [esi + 0x38]
mov ecx, dword [0x7281ec]
add ecx, 0x1c
mov dword [esp + 0x10], ecx
fmul dword [0x715960]
push 0
push 0x42820000
fiadd dword [esp + 0x18]
call fcn.005f275c
fild dword [esi + 0x34]
mov edx, dword [0x7281e4]
push eax
fmul dword [0x715960]
lea eax, [ebx + edx + 0x10]
mov dword [esp + 0x1c], eax
fiadd dword [esp + 0x1c]
call fcn.005f275c
push eax
push esi
call fcn.004bc130
mov dx, word [0x86bb1c]
inc edi
cmp edi, 4
jl 0x440f94
movsx ecx, dx
cmp ebp, ecx
jge 0x4410d8
mov ebx, dword [0x7281ec]
mov edx, dword [0x7281e4]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 0
push 0x425c0000
add ebx, 0x2c
push ebx
lea edi, [eax + edx + 0x22]
push edi
push ecx
call fcn.004bc130
push ebp
push str._RELATIVE
mov esi, 0x8ebf58
call fcn.004f7660
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0x32
lea edx, [ebx + 0xe]
push edx
push edi
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov cx, word [0x86e330]
movsx eax, cx
shl eax, 1
add ebx, 0xffffffef
add edi, 0xffffffec
mov word [eax + 0x86de80], bx
add ebx, 0x2c
lea edx, [ebp + 5]
mov word [eax + 0x86e010], di
add edi, 0x28
add esp, 0x28
inc cx
mov word [eax + 0x86e1a0], dx
mov dx, word [0x86bb1c]
mov word [eax + 0x86db60], bx
mov ebx, dword [esp + 0x14]
mov word [eax + 0x86dcf0], di
mov word [0x86e330], cx
mov eax, dword [esp + 0x18]
inc ebp
add ebx, 0x30
add eax, 0xc0
mov dword [esp + 0x18], eax
jmp 0x440f78
movsx eax, word [0x86bb1e]
mov ecx, dword [esp + 0x94]
push 0x10
lea edx, [ecx + eax*4]
push edx
push str.Lost_Cities_Quest:___NUM__NUM_
mov esi, 0x8ebf58
call fcn.004f7660
mov eax, dword [0x8ccc18]
mov esi, dword [0x7281e4]
imul eax, eax, 0x4b
cdq
and edx, 0x3ff
add esp, 0xc
add eax, edx
sar eax, 0xa
push 0
mov dword [esp + 0x14], eax
mov eax, dword [0x8cbdd8]
push 0x86bb48
push eax
mov dword [0x85c11c], 0x4b
mov dword [0x8cbde0], eax
call fcn.0050ac80
fimul dword [0x72837c]
fidiv dword [0x8ccc18]
fimul dword [esp + 0x10]
fmul dword [0x715584]
call fcn.005f275c
mov ecx, dword [0x85c26c]
lea eax, [eax + esi + 0x10]
add ecx, 0xfffffffb
cmp eax, ecx
push 0
jle 0x44120e
mov eax, dword [0x85c11c]
imul eax, dword [0x8ccc18]
cdq
and edx, 0x3ff
add eax, edx
sar eax, 0xa
mov dword [esp + 0x14], eax
mov eax, dword [0x8cbdd8]
push 0x86bb48
push eax
mov dword [0x8cbde0], eax
call fcn.0050ac80
mov ecx, dword [0x85c268]
fimul dword [0x72837c]
mov eax, 0x92492493
imul ecx
fidiv dword [0x8ccc18]
add edx, ecx
mov ecx, dword [0x7281ec]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea esi, [eax + ecx + 8]
fimul dword [esp + 0x10]
fmul dword [0x715584]
call fcn.005f275c
push 0
push 0xffffffffffffffff
push 1
mov edx, eax
mov eax, dword [0x85c26c]
push 0xffffffffffffffff
push 0x4b
sub eax, edx
sub eax, 0xa
push esi
push eax
jmp 0x441244
mov ecx, dword [0x85c268]
mov eax, 0x92492493
imul ecx
add edx, ecx
mov ecx, dword [0x7281ec]
sar edx, 2
push 0xffffffffffffffff
mov eax, edx
push 1
shr eax, 0x1f
add eax, edx
mov edx, dword [0x7281e4]
push 0xffffffffffffffff
push 0x4b
lea eax, [eax + ecx + 8]
push eax
add edx, 0x10
push edx
xor eax, eax
push 0x86bb48
call fcn.004b0b40
mov dx, word [0x86bb1e]
add esp, 0x20
xor ebp, ebp
xor ebx, ebx
cmp dx, 3
mov dword [esp + 0x14], ebx
mov eax, 3
jg 0x441270
movsx eax, dx
cmp ebp, eax
jg 0x44140d
xor edi, edi
lea ebx, [ebx]
movsx eax, dx
cmp ebp, eax
jl 0x4412a9
mov ecx, edi
mov eax, 0x100
shl eax, cl
test dword [0x85c610], eax
jne 0x44132b
mov eax, dword [0x85c500]
test eax, eax
jle 0x44132b
mov esi, dword [esp + edi*4 + 0xb8]
test esi, esi
je 0x44132b
mov ecx, dword [0x85c268]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x7281ec]
lea eax, [ecx + edx + 0x1c]
mov dword [esp + 0x10], eax
push 0
fild dword [esp + 0x14]
push 0x42820000
fild dword [esi + 0x38]
fmul dword [0x715960]
faddp st(1)
call fcn.005f275c
mov ecx, dword [0x7281e4]
lea edx, [ebx + ecx + 0x10]
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
fild dword [esi + 0x34]
push eax
fmul dword [0x715960]
faddp st(1)
call fcn.005f275c
push eax
push esi
call fcn.004bc130
mov dx, word [0x86bb1e]
inc edi
cmp edi, 4
jl 0x441280
movsx eax, dx
cmp ebp, eax
jge 0x441404
mov ecx, dword [0x7281e4]
mov edx, dword [esp + 0x14]
lea edi, [edx + ecx + 0x22]
mov ecx, dword [0x85c268]
mov eax, 0x92492493
imul ecx
add edx, ecx
mov ecx, dword [0x7281ec]
sar edx, 2
mov eax, edx
push 0
shr eax, 0x1f
add eax, edx
push 0x425c0000
lea ebx, [eax + ecx + 0x2c]
push ebx
push edi
push 0x8d7258
call fcn.004bc130
push ebp
push str._LOSTCITY
mov esi, 0x8ebf58
call fcn.004f7660
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0x32
lea edx, [ebx + 0xe]
push edx
push edi
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov cx, word [0x86e330]
movsx eax, cx
shl eax, 1
add ebx, 0xffffffef
add edi, 0xffffffec
mov word [eax + 0x86de80], bx
add ebx, 0x2c
lea edx, [ebp + 0x1c]
mov word [eax + 0x86e010], di
add edi, 0x28
add esp, 0x28
inc cx
mov word [eax + 0x86e1a0], dx
mov dx, word [0x86bb1e]
mov word [eax + 0x86db60], bx
mov ebx, dword [esp + 0x14]
mov word [eax + 0x86dcf0], di
mov word [0x86e330], cx
inc ebp
add ebx, 0x30
jmp 0x44125e
mov eax, dword [esp + 0x98]
push 0xa
push eax
push str.Romance:___NUM__NUM_
mov esi, 0x8ebf58
call fcn.004f7660
mov ecx, dword [0x85c268]
add ecx, ecx
mov eax, 0x92492493
imul ecx
add esp, 0xc
add edx, ecx
push 0
sar edx, 2
push 0xffffffffffffffff
mov ecx, edx
push 1
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x7281ec]
push 0xffffffffffffffff
lea eax, [ecx + edx + 8]
push 0x4b
push eax
mov eax, dword [0x7281e4]
add eax, 0x10
push eax
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov edi, dword [esp + 0x4c]
add esp, 0x20
cmp edi, 0xffffffff
je 0x4418be
mov ecx, dword [0x7281e4]
mov esi, dword [esp + 0x3c]
add ecx, 0xfffffff0
mov dword [esp + 0x18], ecx
mov ecx, dword [0x85c268]
add ecx, ecx
mov eax, 0x92492493
imul ecx
add edx, ecx
mov ecx, dword [0x7281ec]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ecx
test esi, esi
mov dword [esp + 0x14], eax
je 0x4414ed
fild dword [esi + 0x38]
push 0
push 0x42480000
fmul dword [0x715574]
fiadd dword [esp + 0x1c]
call fcn.005f275c
fild dword [esi + 0x34]
push eax
fmul dword [0x715574]
fiadd dword [esp + 0x24]
call fcn.005f275c
push eax
push esi
call fcn.004bc130
lea edx, [edi + edi*2]
lea eax, [edx*4 + 0x8ddd08]
mov edx, dword [eax]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ecx + 4], edx
push str.City:__CITYNAME
mov esi, 0x8ebf58
mov dword [ecx + 8], eax
call fcn.004f7660
mov ecx, dword [0x85c268]
add ecx, ecx
mov eax, 0x92492493
imul ecx
add edx, ecx
push 0
sar edx, 2
push 0xffffffffffffffff
mov ecx, edx
push 1
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x7281ec]
push 0xffffffffffffffff
lea eax, [ecx + edx + 0x20]
mov ebp, 0x32
push ebp
push eax
mov eax, dword [0x7281e4]
add eax, 0x50
push eax
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov eax, dword [0x8ccc18]
imul eax, eax, 0x32
cdq
and edx, 0x3ff
add esp, 0x30
add eax, edx
sar eax, 0xa
push 0
mov dword [esp + 0x14], eax
mov eax, dword [0x8cbdd8]
push 0x86bb48
push eax
mov dword [0x85c11c], ebp
mov dword [0x8cbde0], eax
call fcn.0050ac80
fimul dword [0x72837c]
fidiv dword [0x8ccc18]
fimul dword [esp + 0x10]
fmul dword [0x715584]
call fcn.005f275c
push str.Romance:
mov ebx, eax
call fcn.004f7660
mov eax, dword [0x8ccc18]
imul eax, eax, 0x32
cdq
and edx, 0x3ff
add esp, 4
add eax, edx
sar eax, 0xa
push 0
mov dword [esp + 0x14], eax
mov eax, dword [0x8cbdd8]
push 0x86bb48
push eax
mov dword [0x85c11c], ebp
mov dword [0x8cbde0], eax
call fcn.0050ac80
fimul dword [0x72837c]
fidiv dword [0x8ccc18]
fimul dword [esp + 0x10]
fmul dword [0x715584]
call fcn.005f275c
mov ecx, dword [0x85c268]
mov dword [esp + 0x24], eax
add ecx, ecx
mov eax, 0x92492493
imul ecx
add edx, ecx
push 0
sar edx, 2
push 0xffffffffffffffff
mov ecx, edx
push 1
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x7281ec]
push 0xffffffffffffffff
lea eax, [ecx + edx + 0x2e]
push ebp
push eax
mov eax, dword [0x7281e4]
add eax, 0x50
push eax
push 0x86bb48
xor eax, eax
call fcn.004b0b40
imul edi, edi, 0x94
xor esi, esi
add esp, 0x20
cmp word [edi + 0x85df78], si
jle 0x4416cf
mov ebp, dword [esp + 0x24]
add ebp, 0x58
lea esp, [esp]
mov ecx, dword [0x85c268]
add ecx, ecx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x7281ec]
push 0
lea eax, [ecx + edx + 0x34]
push 0x41f00000
push eax
mov eax, dword [0x7281e4]
lea ecx, [eax + ebp]
push ecx
push 0x8d0a18
call fcn.004bc130
movsx edx, word [edi + 0x85df78]
inc esi
add ebp, 8
cmp esi, edx
jl 0x441680
movsx eax, word [edi + 0x85df78]
mov ecx, dword [esp + 0x24]
lea eax, [ecx + eax*8]
cmp eax, ebx
jle 0x4416e3
mov ebx, eax
mov edx, dword [edi + 0x85df74]
push edx
push str.Attractiveness:__BEAUTY
mov esi, 0x8ebf58
call fcn.004f7660
mov ecx, dword [0x85c268]
add ecx, ecx
mov eax, 0x92492493
imul ecx
add edx, ecx
mov ecx, dword [0x7281ec]
push 0
sar edx, 2
push 0xffffffffffffffff
mov eax, edx
push 1
shr eax, 0x1f
add eax, edx
mov edx, dword [0x7281e4]
push 0xffffffffffffffff
mov ebp, 0x32
lea eax, [eax + ecx + 0x3c]
push ebp
push eax
add edx, 0x50
push edx
push 0x86bb48
xor eax, eax
mov dword [0x85c11c], ebp
call fcn.004b0b40
mov eax, dword [0x8ccc18]
imul eax, eax, 0x32
cdq
and edx, 0x3ff
add esp, 0x28
add eax, edx
sar eax, 0xa
push 0
mov dword [esp + 0x14], eax
mov eax, dword [0x8cbdd8]
push 0x86bb48
push eax
mov dword [0x85c11c], ebp
mov dword [0x8cbde0], eax
call fcn.0050ac80
fimul dword [0x72837c]
fidiv dword [0x8ccc18]
fimul dword [esp + 0x10]
fmul dword [0x715584]
call fcn.005f275c
cmp eax, ebx
jle 0x4417a2
mov ebx, eax
test dword [0x85c164], 0x200000
je 0x44186f
test byte [edi + 0x85df70], 8
je 0x44186f
push str._Married_
mov esi, 0x8ebf58
call fcn.004f7660
mov ecx, dword [0x85c268]
add ecx, ecx
mov eax, 0x92492493
imul ecx
add esp, 4
add edx, ecx
mov ecx, dword [0x7281ec]
push 0
sar edx, 2
push 0xffffffffffffffff
mov eax, edx
push 1
shr eax, 0x1f
add eax, edx
mov edx, dword [0x7281e4]
push 0xffffffffffffffff
lea eax, [eax + ecx + 0x4a]
push ebp
push eax
add edx, 0x50
push edx
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov eax, dword [0x8ccc18]
imul eax, eax, 0x32
cdq
and edx, 0x3ff
add esp, 0x20
add eax, edx
sar eax, 0xa
push 0
mov dword [esp + 0x14], eax
mov eax, dword [0x8cbdd8]
push 0x86bb48
push eax
mov dword [0x85c11c], ebp
mov dword [0x8cbde0], eax
call fcn.0050ac80
fimul dword [0x72837c]
fidiv dword [0x8ccc18]
fimul dword [esp + 0x10]
fmul dword [0x715584]
call fcn.005f275c
cmp eax, ebx
jle 0x44186f
mov ebx, eax
mov si, word [0x86e330]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
movsx eax, si
shl eax, 1
add ecx, 0x1c
add edx, 0x24
mov word [eax + 0x86de80], cx
add ecx, 0x48
mov word [eax + 0x86e010], dx
lea edx, [ebx + edx + 0x40]
inc si
mov word [eax + 0x86e1a0], 0x1b
mov word [eax + 0x86dcf0], dx
mov word [eax + 0x86db60], cx
mov word [0x86e330], si
mov eax, dword [esp + 0x78]
push 0xa
push eax
push str.Villains_Avenged:___NUM__NUM_
mov esi, 0x8ebf58
call fcn.004f7660
mov eax, dword [0x85c268]
mov ecx, dword [0x7281ec]
add esp, 0xc
push 0
cdq
push 0xffffffffffffffff
sub eax, edx
mov edx, dword [0x7281e4]
push 1
push 0xffffffffffffffff
sar eax, 1
lea eax, [eax + ecx + 8]
push 0x4b
push eax
add edx, 0x10
push edx
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov edi, dword [0x85c268]
mov ebx, dword [0x7281ec]
add esp, 0x20
xor ebp, ebp
lea ecx, [ecx]
test dword [0x85c164], 0x80000
jne 0x44194e
mov eax, dword [0x85c648]
test eax, eax
jle 0x4419b4
mov ecx, ebp
mov eax, 0x100
shl eax, cl
test dword [0x85c758], eax
jne 0x4419b4
mov esi, dword [esp + ebp*4 + 0xb8]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
test esi, esi
lea ecx, [eax + ebx + 0x1c]
mov dword [esp + 0x10], ecx
je 0x4419b4
fild dword [esi + 0x38]
push 0
push 0x42aa0000
fmul dword [0x71595c]
fiadd dword [esp + 0x18]
call fcn.005f275c
fild dword [esi + 0x34]
mov edx, dword [0x7281e4]
add edx, 0x50
fmul dword [0x71595c]
mov dword [esp + 0x18], edx
push eax
fiadd dword [esp + 0x1c]
call fcn.005f275c
push eax
push esi
call fcn.004bc130
mov edi, dword [0x85c268]
mov ebx, dword [0x7281ec]
inc ebp
cmp ebp, 4
jl 0x441920
test dword [0x85c164], 0x80000
je 0x441a79
fild dword [0x8d7710]
mov esi, dword [0x7281e4]
mov eax, edi
cdq
fmul dword [0x715958]
sub eax, edx
sar eax, 1
lea ebx, [eax + ebx + 0x1a]
mov dword [esp + 0x10], ebx
fiadd dword [esp + 0x10]
add esi, 0x52
push 0
mov dword [esp + 0x24], esi
push 0x42960000
call fcn.005f275c
fild dword [0x8d770c]
push eax
fmul dword [0x715958]
fiadd dword [esp + 0x2c]
call fcn.005f275c
push eax
push 0x8d76d8
call fcn.004bc130
mov edi, dword [0x85c268]
lea edx, [esi - 2]
mov si, word [0x86e330]
movsx eax, si
shl eax, 1
lea ecx, [ebx + 2]
mov ebx, dword [0x7281ec]
mov word [eax + 0x86e010], dx
mov word [eax + 0x86de80], cx
add edx, 0x35
add ecx, 0x2c
inc si
mov word [eax + 0x86e1a0], 4
mov word [eax + 0x86dcf0], dx
mov word [eax + 0x86db60], cx
mov word [0x86e330], si
mov edx, dword [0x8de310]
mov esi, dword [0x8de30c]
call fcn.0042c6c0
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x1c], ebp
mov byte [0x86bb48], 0
je 0x44217f
cmp dword [esp + 0xa0], ebp
je 0x441ad1
push 0xffffffffffffffff
push 0xbf800000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x36
push 0x8ca278
call fcn.00488920
mov edi, dword [0x85c268]
mov ebx, dword [0x7281ec]
add esp, 0x1c
cmp ebp, 0x9f
jle 0x441b86
cmp ebp, 0xc8
jge 0x441b86
mov eax, 0xc7
sub eax, ebp
cdq
mov ecx, 0xa
idiv ecx
cmp ebp, 0xbd
mov ecx, edx
jle 0x441b06
xor esi, esi
jmp 0x441b25
cmp ebp, 0xb3
jle 0x441b15
mov esi, 1
jmp 0x441b25
xor edx, edx
cmp ebp, 0xa9
setle dl
add edx, 2
mov esi, edx
mov edx, dword [0x7281dc]
mov eax, ecx
imul eax, eax, 0x17
lea ebp, [eax + edx - 0x4e]
mov eax, 0x38e38e39
imul edi
sar edx, 1
mov eax, edx
shr eax, 0x1f
lea edx, [edx + eax + 5]
imul edx, esi
push ecx
push str._RANK
mov esi, 0x8ebf58
lea ebx, [edx + ebx + 0x83]
call fcn.004f7660
push 0
push 0xffffffffffffffff
push 4
push 0xffffcc00
push 0x33
push ebx
add ebp, 0xc
push ebp
push 0x86bb48
xor eax, eax
call fcn.004b0b40
add esp, 0x28
jmp 0x44217b
cmp ebp, 4
jne 0x441bfa
mov ecx, dword [0x8cd190]
mov ebp, dword [0x7281e4]
mov eax, edi
cdq
sub eax, edx
mov edx, dword [0x8cd194]
sar eax, 1
lea ebx, [eax + ebx + 0x1a]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x8cd198]
mov dword [eax + 4], edx
push str._EVILNAME
mov esi, 0x8ebf58
add ebp, 0x52
mov dword [eax + 8], ecx
call fcn.004f7660
push 0
push 0xffffffffffffffff
push 4
push 0xffffcc00
push 0x33
add ebx, 0x2b
push ebx
add ebp, 0x1a
push ebp
push 0x86bb48
xor eax, eax
call fcn.004b0b40
add esp, 0x30
jmp 0x44217b
cmp ebp, 5
jl 0x441c95
cmp ebp, 8
setle al
test al, al
je 0x441c95
mov ecx, dword [0x7281e4]
lea eax, [ebp - 5]
lea edx, [eax + eax*2]
push eax
shl edx, 4
push str._RELATIVE
mov esi, 0x8ebf58
lea edi, [edx + ecx + 0x22]
add ebx, 0x2c
call fcn.004f7660
mov eax, dword [0x8cbdd8]
add esp, 8
push 0
push 0x86bb48
mov esi, 0x32
push eax
mov dword [0x85c11c], esi
mov dword [0x8cbde0], eax
call fcn.0050ac80
mov edx, dword [0x8cbdd8]
push 0
push 0xffffffffffffffff
push 4
push 0xffffcc00
mov dword [0x8cbde0], edx
push esi
add ebx, 0xe
push ebx
fstp st(0)
push edi
push 0x86bb48
xor eax, eax
mov dword [0x85c11c], esi
call fcn.004b0b40
add esp, 0x20
jmp 0x44217f
cmp ebp, 9
jl 0x441d6e
cmp ebp, 0x11
setle al
test al, al
je 0x441d6e
xor eax, eax
xor esi, esi
mov ecx, 0x864014
cmp dword [ecx], 0
jne 0x441cc2
lea edx, [ebp - 9]
cmp eax, edx
je 0x441cce
inc eax
add ecx, 0x1c
inc esi
cmp ecx, 0x864110
jl 0x441cb5
mov ecx, eax
and ecx, 0x80000001
jns 0x441cdd
dec ecx
or ecx, 0xfffffffe
inc ecx
mov edx, dword [0x7281e0]
lea ecx, [ecx + ecx*2]
shl ecx, 5
lea edi, [ecx + edx - 0x10]
cdq
sub eax, edx
sar eax, 1
lea eax, [eax + eax*2]
lea ecx, [esi + esi*2]
lea edx, [ecx*4 + 0x8cd10c]
mov ecx, dword [edx]
lea ebx, [ebx + eax*8 + 0x16]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov edx, dword [edx + 8]
mov dword [eax + 4], ecx
push str._TOP10
mov esi, 0x8ebf58
mov dword [eax + 8], edx
call fcn.004f7660
mov eax, dword [0x8cbdd8]
add esp, 0x10
push 0
push 0x86bb48
mov esi, 0x32
push eax
mov dword [0x85c11c], esi
mov dword [0x8cbde0], eax
call fcn.0050ac80
mov eax, dword [0x8cbdd8]
push 0
push 0xffffffffffffffff
push 1
push 0xffffcc00
add ebx, 0xa
mov dword [0x8cbde0], eax
push 0x33
add edi, 0x1c
jmp 0x441c77
cmp ebp, 0x12
jl 0x441e58
cmp ebp, 0x1a
setle al
test al, al
je 0x441e58
xor eax, eax
xor esi, esi
mov ecx, 0x864018
mov edi, edi
test byte [ecx], 1
je 0x441d9d
lea edx, [ebp - 0x12]
cmp eax, edx
je 0x441da9
inc eax
add ecx, 0x1c
inc esi
cmp ecx, 0x864114
jl 0x441d90
mov ecx, eax
and ecx, 0x80000001
jns 0x441db8
dec ecx
or ecx, 0xfffffffe
inc ecx
mov edx, dword [0x7281e0]
lea ecx, [ecx + ecx*2]
shl ecx, 5
lea ebp, [ecx + edx - 6]
cdq
sub eax, edx
sar eax, 1
inc eax
lea ecx, [eax + eax*2]
mov eax, 0x55555556
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ebx
lea edi, [eax + ecx*8]
lea ecx, [esi + esi*2]
lea edx, [ecx*4 + 0x8cd10c]
mov ecx, dword [edx]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov edx, dword [edx + 8]
mov dword [eax + 4], ecx
push str._TOP10
mov esi, 0x8ebf58
mov dword [eax + 8], edx
call fcn.004f7660
mov eax, dword [0x8cbdd8]
add esp, 0x10
push 0
push 0x86bb48
mov esi, 0x32
push eax
mov dword [0x85c11c], esi
mov dword [0x8cbde0], eax
call fcn.0050ac80
mov eax, dword [0x8cbdd8]
push 0
push 0xffffffffffffffff
add edi, 2
mov dword [0x85c11c], esi
mov dword [0x8cbde0], eax
push 1
add ebp, 0x12
jmp 0x442161
cmp ebp, 0x1c
jl 0x441ef8
cmp ebp, 0x1f
setle al
test al, al
je 0x441ef8
mov ecx, dword [esp + 0x1c]
mov eax, dword [0x7281e4]
add ecx, 0xffffffe4
lea edx, [ecx + ecx*2]
shl edx, 4
lea ebp, [edx + eax + 0x22]
mov eax, 0x92492493
imul edi
add edx, edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
push ecx
add eax, edx
push str._LOSTCITY
mov esi, 0x8ebf58
lea ebx, [eax + ebx + 0x2c]
call fcn.004f7660
mov eax, dword [0x8cbdd8]
add esp, 8
push 0
push 0x86bb48
mov esi, 0x32
push eax
mov dword [0x85c11c], esi
mov dword [0x8cbde0], eax
call fcn.0050ac80
mov ecx, dword [0x8cbdd8]
push 0
push 0xffffffffffffffff
push 4
push 0xffffcc00
push esi
add ebx, 0xe
mov dword [0x85c11c], esi
mov dword [0x8cbde0], ecx
push ebx
jmp 0x442169
cmp ebp, 0x1b
jne 0x44217f
lea ecx, [edi + edi]
mov ebp, dword [0x7281e4]
mov eax, 0x92492493
imul ecx
mov eax, dword [esp + 0x2c]
add edx, ecx
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
lea edx, [eax + eax*2]
lea eax, [edx*4 + 0x8ddd08]
mov edx, dword [eax]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ecx + 4], edx
push str.City:__CITYNAME
mov esi, 0x8ebf58
add ebp, 0xfffffff0
add edi, ebx
mov dword [ecx + 8], eax
call fcn.004f7660
mov ecx, dword [0x85c268]
add ecx, ecx
mov eax, 0x92492493
imul ecx
add edx, ecx
push 0
sar edx, 2
push 0xffffffffffffffff
mov ecx, edx
push 1
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x7281ec]
push 0xffffcc00
lea eax, [ecx + edx + 0x20]
push 0x32
push eax
mov eax, dword [0x7281e4]
add eax, 0x50
push eax
push 0x86bb48
xor eax, eax
call fcn.004b0b40
push str.Romance:
call fcn.004f7660
mov eax, dword [0x8cbdd8]
add esp, 0x34
push 0
push 0x86bb48
push eax
mov dword [0x85c11c], 0x32
mov dword [0x8cbde0], eax
call fcn.0050ac80
fstp st(0)
mov ecx, dword [0x85c268]
add ecx, ecx
mov eax, 0x92492493
imul ecx
add edx, ecx
push 0
sar edx, 2
push 0xffffffffffffffff
mov ecx, edx
push 1
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x7281ec]
push 0xffffcc00
push 0x32
lea eax, [ecx + edx + 0x2e]
push eax
mov eax, dword [0x7281e4]
add eax, 0x50
push eax
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov ebx, dword [esp + 0x4c]
imul ebx, ebx, 0x94
mov ecx, dword [ebx + 0x85df74]
push ecx
push str.Attractiveness:__BEAUTY
call fcn.004f7660
mov ecx, dword [0x85c268]
add ecx, ecx
mov eax, 0x92492493
imul ecx
add edx, ecx
mov ecx, dword [0x7281ec]
push 0
sar edx, 2
push 0xffffffffffffffff
mov eax, edx
push 1
shr eax, 0x1f
add eax, edx
mov edx, dword [0x7281e4]
push 0xffffcc00
lea eax, [eax + ecx + 0x3c]
push 0x32
push eax
add edx, 0x50
push edx
push 0x86bb48
xor eax, eax
call fcn.004b0b40
mov eax, dword [0x85c164]
add esp, 0x48
test eax, 0x200000
je 0x4420ed
test byte [ebx + 0x85df70], 8
je 0x4420ed
push str._Married_
call fcn.004f7660
mov ecx, dword [0x85c268]
add ecx, ecx
mov eax, 0x92492493
imul ecx
add esp, 4
add edx, ecx
mov ecx, dword [0x7281ec]
push 0
sar edx, 2
push 0xffffffffffffffff
mov eax, edx
push 1
shr eax, 0x1f
add eax, edx
mov edx, dword [0x7281e4]
push 0xffffcc00
lea eax, [eax + ecx + 0x4a]
push 0x32
push eax
add edx, 0x50
push edx
push 0x86bb48
xor eax, eax
call fcn.004b0b40
add esp, 0x20
mov eax, dword [esp + 0x2c]
shl eax, 5
mov al, byte [eax + 0x862b74]
test al, al
mov byte [0x86bb48], 0
jne 0x44210c
push str.Spanish_Daughter
jmp 0x442127
cmp al, 2
jne 0x442117
push str.French_Daughter
jmp 0x442127
cmp al, 1
jne 0x442122
push str.English_Daughter
jmp 0x442127
push str.Dutch_Daughter
mov esi, 0x8ebf58
call fcn.004f7660
mov eax, dword [0x8cbdd8]
add esp, 4
push 0
push 0x86bb48
push eax
mov dword [0x85c11c], 0x33
mov dword [0x8cbde0], eax
call fcn.0050ac80
push 0
push 0xffffffffffffffff
add edi, 0x60
push 4
add ebp, 0x40
push 0xffffcc00
push 0x33
push edi
push ebp
fstp st(0)
xor eax, eax
push 0x86bb48
call fcn.004b0b40
add esp, 0x20
mov ebp, dword [esp + 0x1c]
mov edi, dword [0x8ccbe8]
push 0
mov dword [esp + 0xa4], ebp
call fcn.004b2e50
mov esi, eax
cmp esi, 0x29f
mov dword [esp + 0x14], esi
jle 0x442533
cmp esi, 0x2c8
jge 0x442533
add esi, 0xfffffe00
cmp esi, 0xbd
jle 0x4421c3
xor ebx, ebx
jmp 0x4421e0
cmp esi, 0xb3
jle 0x4421d2
mov ebx, 1
jmp 0x4421e0
xor ebx, ebx
cmp esi, 0xa9
setle bl
add ebx, 2
mov al, byte [ebx*2 + 0x86ba88]
cmp al, 1
lea ebp, [ebx*2 + 0x86ba88]
jbe 0x443851
push 0
call fcn.00488e30
movsx edx, word [ebp]
lea eax, [ebx*2 + 0x86ba98]
mov dword [esp + 0x28], eax
movsx eax, word [eax]
shl eax, 5
movsx ecx, byte [eax + 0x862b74]
lea eax, [eax + 0x862b74]
mov byte [eax], bl
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x18]
mov eax, 0x2c7
sub eax, ecx
mov dword [esp + 0x38], edx
cdq
mov ecx, 0xa
idiv ecx
mov al, byte [0x8ca27f]
add esp, 4
test al, al
mov word [ebp], dx
je 0x442260
push 0x8ca288
call fcn.00489090
add esp, 4
mov byte [0x8ca27f], 0
mov al, byte [0x8ca27e]
test al, al
push 0
je 0x442272
mov byte [0x8ca27e], 0
call fcn.00488e30
mov eax, dword [0x7283bc]
mov edx, dword [0x728a84]
mov dword [edx*4 + 0x7288f4], eax
mov eax, dword [0x728a84]
add esp, 4
inc eax
mov dword [0x728a84], eax
mov dword [0x7283bc], 0xff7ffff
xor eax, eax
mov cl, byte [eax + 0x6f7896]
mov byte [eax + 0x8c0a80], cl
inc eax
test cl, cl
jne 0x4422a3
mov edi, dword [esp + 0x24]
movsx ecx, word [edi]
push ecx
push 1
mov dword [0x8c09f4], 1
call fcn.00482dc0
mov eax, 0x424
call fcn.00484110
movzx edx, byte [ebp]
push edx
push ebx
push str.In_recognition_of_your_service_to_the__NATIONALITY_crown__I_am_pleased_to_promote_you_to_the_rank_of__RANK__Congratulations_
mov esi, 0x8ebf58
call fcn.004f7660
movsx eax, word [edi]
add esp, 0x14
or edi, 0xffffffff
call fcn.00483ad0
movzx eax, byte [ebp]
push ebx
push eax
push str.__RANKBONUS_in__NATIONALITY_ports__n
call fcn.004f7680
xor eax, eax
mov al, byte [ebp]
mov cl, 1
add esp, 0xc
cmp cl, al
sbb eax, eax
and eax, 0x3c
add eax, 0x3f2
call fcn.00484110
push 0
push 0x30
call fcn.00487950
mov eax, dword [0x85c164]
mov dword [esp + 0x20], eax
or eax, 0x100000
push 0
push 0x30
mov dword [0x85c164], eax
call fcn.00487950
mov edx, dword [0x8eed78]
add esp, 0x10
mov ecx, 0x8eed78
mov dword [esp + 0x10], 0xd
call dword [edx + 0x18]
test al, al
je 0x4423c5
mov al, byte [0x8ccc27]
test al, al
je 0x442379
mov al, byte [0x8ccc26]
test al, al
je 0x4423c5
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
mov eax, dword [0x8eaec4]
sub eax, dword [0x8eaec8]
jns 0x442390
add eax, 0x64
test eax, eax
je 0x44239a
push 0x28
call esi
jmp 0x442380
lea edx, [esp + 0x10]
mov esi, 0x8eaee8
call fcn.004a0ce0
mov eax, dword [0x8ef2c8]
mov eax, dword [eax]
push 0
push eax
mov edi, 0x8e87b0
call fcn.0049aec0
push 0xfffffffffffffffe
push 0x15
call fcn.0049ae20
push ebx
push 0x17
mov edi, 0x8e87b0
call fcn.0049ae20
mov ecx, dword [esp + 0xa8]
push ebx
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push 1
push ecx
call fcn.00488cf0
mov eax, dword [0x85c268]
mov ecx, dword [0x85c26c]
add esp, 0x24
push 0
push 0
push 0xffffffffffffffff
cdq
push 0
push fcn.00484b30
push 0xffffffffffffffff
and edx, 0xf
add eax, edx
sar eax, 4
push 0
push 0x6f7896
push eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
call fcn.00430160
push 0x8c9340
call fcn.00489090
add esp, 0x2c
push 0x3f800000
call fcn.00488e30
mov edx, dword [0x8eed78]
add esp, 4
mov ecx, 0x8eed78
call dword [edx + 0x18]
test al, al
je 0x4424e7
mov al, byte [0x8ccc27]
test al, al
je 0x442480
mov al, byte [0x8ccc26]
test al, al
je 0x4424e7
jmp 0x442480
mov eax, dword [0x8eaec4]
sub eax, dword [0x8eaec8]
jns 0x442490
add eax, 0x64
test eax, eax
je 0x44249e
push 0x28
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x442480
mov ecx, dword [0x8eaeec]
test ecx, ecx
je 0x4424bd
mov eax, dword [0x8eaef0]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x4424bd
sub dword [0x8eaef0], 4
mov eax, dword [0x8ef2c8]
mov eax, dword [eax]
push 0
push eax
mov edi, 0x8e87b0
call fcn.0049aec0
mov ecx, dword [0x8eaef0]
mov eax, dword [ecx - 4]
push 0xfffffffffffffffe
call fcn.004a0ac0
push eax
call fcn.0049ae20
call fcn.00483c00
mov eax, dword [0x728a84]
mov esi, dword [esp + 0x14]
dec eax
mov dword [0x728a84], eax
mov edx, dword [eax*4 + 0x7288f4]
mov eax, dword [esp + 0x24]
movsx ecx, word [eax]
mov ax, word [esp + 0x34]
mov dword [0x7283bc], edx
mov dl, byte [esp + 0x20]
shl ecx, 5
mov byte [ecx + 0x862b74], dl
mov ecx, dword [esp + 0x18]
mov word [ebp], ax
mov ebp, dword [esp + 0x1c]
mov dword [0x85c164], ecx
cmp esi, 0x211
jg 0x4436e9
cmp esi, 0x209
jge 0x442cb8
cmp esi, 0x204
jg 0x442c6a
je 0x44256f
dec esi
je 0x442565
sub esi, 0x1a
jne case.default.0x4436ff
mov byte [esp + 0x2b], 1
jmp case.default.0x4436ff
push 0
push 1
push 1
call fcn.004a2250
mov edi, 0x8cccd0
add esp, 0xc
push str.You_are_a_master_tactician__sir._Truly_I_have_done_your_family_a_terrible_injustice.
mov esi, 0x8ebf58
mov dword [esp + 0x134], edi
mov dword [esp + 0x138], edi
mov dword [esp + 0x13c], edi
mov dword [esp + 0x140], 0
mov dword [0x72eb4c], 6
mov dword [0x72ecc4], 0x259
mov dword [0x72eb44], 5
call fcn.004f7660
add esp, 4
push str.I_give_you_100_000_gold_pieces_which_are_rightfully_yours.
call fcn.004f7680
add esp, 4
push str.Among_my_crew_are_eight_specialists_of_extraordinary_skill__henceforth_they_will_serve_you.
call fcn.004f7680
add esp, 4
push str.I_myself_will_serve_as_your_cabin_steward._n
call fcn.004f7680
add esp, 4
mov ecx, 0x28
call fcn.00487df0
mov ebx, 0x86bb48
lea eax, [esp + 0x134]
call fcn.00412f10
push str.Marquis_Montalban
call fcn.004f7660
add esp, 4
push 0
push 0x2a
lea edx, [esp + 0x8c]
push 5
push edx
or eax, 0xffffffff
xor ecx, ecx
or edx, 0xffffffff
mov dword [esp + 0x24], edi
call fcn.0041a300
add esp, 0x10
lea ecx, [esp + 0x14]
call fcn.00412ec0
mov eax, dword [esp + 0x84]
add eax, 0xfffffff8
je 0x442668
cmp eax, 0x8cccc8
je 0x442668
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
xor eax, eax
mov dword [esp + 0x70], eax
push 0xc0
mov dword [esp + 0x88], edi
mov dword [esp + 0x78], eax
call fcn.005354b8
add esp, 4
test eax, eax
je 0x4426b5
mov ecx, dword [esp + 0x14]
mov edx, dword [0x8ebffc]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push ecx
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x4426b7
xor esi, esi
mov eax, dword [esp + 0x74]
cmp eax, esi
je 0x4426e5
test eax, eax
je 0x4426da
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x4426da
mov eax, dword [ecx]
push 1
call dword [eax]
test esi, esi
mov dword [esp + 0x74], esi
je 0x4426e5
inc dword [esi + 4]
xor ecx, ecx
mov dword [esp + 0xcc], ecx
lea edx, [esp + 0xcc]
mov dword [esp + 0xd0], ecx
push edx
push ecx
lea eax, [esp + 0x160]
lea edx, [esp + 0x260]
mov dword [esp + 0xdc], ecx
call fcn.0041a9f0
add esp, 8
push 0
push 0
push 0
push 0
push 1
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push 0x86bb48
push ecx
mov ecx, dword [0x8ebffc]
mov eax, esp
mov dword [eax], ecx
mov eax, ecx
test eax, eax
je 0x442748
inc dword [eax + 4]
call fcn.004afb00
mov esi, eax
mov eax, dword [esp + 0xa0]
add esp, 0x30
cmp eax, esi
je 0x442783
test eax, eax
je 0x442778
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x442778
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x70], esi
je 0x442783
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x44298d
mov ecx, dword [0x8ebffc]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.uber_sword.kfm
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
test eax, eax
mov dword [esp + 0x1c], eax
je 0x4427ca
inc dword [eax + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x44299a
mov ecx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
lea edx, [esp + 0x17c]
push edx
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
test eax, eax
mov dword [esp + 0x18], eax
je 0x442817
inc dword [eax + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x4429a7
mov ecx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
lea edx, [esp + 0x27c]
push edx
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
test eax, eax
mov dword [esp + 0x24], eax
je 0x442864
inc dword [eax + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x4429b4
mov edx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.ramparts_01.nif
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov ebp, eax
test ebp, ebp
je 0x4428ac
inc dword [ebp + 4]
xor eax, eax
xor edx, edx
test eax, eax
mov ecx, eax
mov dword [esp + 0x60], edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x64], edx
je 0x4428ea
mov eax, 4
mov esi, dword [eax]
dec esi
mov edx, esi
test edx, edx
mov dword [eax], esi
jne 0x4428e0
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x4c]
xor eax, eax
mov dword [esp + 0x50], eax
cmp ecx, eax
je 0x44291c
test ecx, ecx
je 0x44290b
mov esi, dword [ecx + 4]
lea eax, [ecx + 4]
dec esi
mov edx, esi
test edx, edx
mov dword [eax], esi
jne 0x442907
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x50]
test eax, eax
mov ecx, eax
mov dword [esp + 0x4c], ecx
je 0x44291c
inc dword [eax + 4]
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
cmp eax, ecx
je 0x44294e
test eax, eax
je 0x442943
mov esi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec esi
mov edx, esi
test edx, edx
mov dword [eax], esi
jne 0x44293f
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x4c]
test ecx, ecx
mov dword [esp + 0x48], ecx
je 0x44294e
inc dword [ecx + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x4429bb
mov ecx, dword [0x8ec000]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.duel_props.kfm
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x4429bd
mov dword [esp + 0x1c], 0
jmp 0x4427ca
mov dword [esp + 0x18], 0
jmp 0x442817
mov dword [esp + 0x24], 0
jmp 0x442864
xor ebp, ebp
jmp 0x4428ac
xor esi, esi
mov eax, dword [esp + 0x60]
cmp eax, esi
je 0x4429eb
test eax, eax
je 0x4429e0
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x4429e0
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x60], esi
je 0x4429eb
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x442a2a
mov ecx, dword [0x8ec000]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.duel_props.kfm
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x442a2c
xor esi, esi
mov eax, dword [esp + 0x64]
cmp eax, esi
je 0x442a60
test eax, eax
je 0x442a4f
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x442a4f
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov eax, esi
mov dword [esp + 0x64], eax
je 0x442a60
inc dword [esi + 4]
mov eax, dword [esp + 0x64]
call fcn.004bb170
mov eax, dword [0x728a84]
mov ecx, dword [0x7283bc]
mov ebx, dword [0x85c164]
mov esi, dword [0x8cbdec]
mov dword [eax*4 + 0x7288f4], ecx
mov eax, dword [0x728a84]
inc eax
push 0xc37a0000
mov dword [0x728a84], eax
mov dword [0x7283bc], 0xff7ffff
and ebx, 0xfffffffb
mov dword [0x85c164], ebx
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx]
add esi, 0x14
push 0
push 0
call dword [edx + 0x10]
mov ecx, dword [esi]
mov eax, dword [ecx]
push 0
call dword [eax + 0xc]
mov ecx, dword [0x8cbdec]
push 0x41a00000
push ecx
call fcn.004da870
mov esi, dword [0x8ccbd4]
push 0x4b0
call fcn.004ae1f0
mov ebx, dword [esp + 0x28]
add esp, 4
lea edx, [esp + 0x130]
push edx
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0xd4]
push ecx
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x80]
push eax
push 0
push ecx
push ebp
push ebx
call fcn.00425ad0
add esp, 0x24
push esi
call fcn.004ae1f0
mov esi, dword [0x8cbdec]
mov eax, dword [0x7275f8]
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx]
add esp, 4
push eax
add esi, 0x14
push 0
push 0
call dword [edx + 0x10]
mov ecx, dword [esi]
mov edx, dword [ecx]
push 0
call dword [edx + 0xc]
mov eax, dword [0x8cbdec]
push 0x41a00000
push eax
call fcn.004da870
mov eax, dword [0x728a84]
dec eax
mov dword [0x728a84], eax
mov ecx, dword [eax*4 + 0x7288f4]
mov dword [0x7283bc], ecx
lea esi, [esp + 0x68]
mov edi, 2
mov ecx, dword [esi - 4]
sub esi, 4
test ecx, ecx
je 0x442b8c
dec dword [ecx + 4]
jne 0x442b8c
mov edx, dword [ecx]
push 1
call dword [edx]
dec edi
jne 0x442b77
lea esi, [esp + 0x54]
mov edi, 3
mov ecx, dword [esi - 4]
sub esi, 4
test ecx, ecx
je 0x442bad
dec dword [ecx + 4]
jne 0x442bad
mov eax, dword [ecx]
push 1
call dword [eax]
dec edi
jne 0x442b98
test ebp, ebp
je 0x442bc2
dec dword [ebp + 4]
jne 0x442bc2
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx]
test ebx, ebx
je 0x442bd3
dec dword [ebx + 4]
jne 0x442bd3
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x442be6
dec dword [ecx + 4]
jne 0x442be6
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x442bfb
dec dword [eax + 4]
jne 0x442bfb
mov ecx, eax
mov eax, dword [ecx]
push 1
call dword [eax]
lea esi, [esp + 0xd8]
mov edi, 3
mov ecx, dword [esi - 4]
sub esi, 4
test ecx, ecx
je 0x442c1c
dec dword [ecx + 4]
jne 0x442c1c
mov edx, dword [ecx]
push 1
call dword [edx]
dec edi
jne 0x442c07
lea esi, [esp + 0x78]
mov edi, 2
mov ecx, dword [esi - 4]
sub esi, 4
test ecx, ecx
je 0x442c3d
dec dword [ecx + 4]
jne 0x442c3d
mov eax, dword [ecx]
push 1
call dword [eax]
dec edi
jne 0x442c28
mov eax, dword [esp + 0x14]
add eax, 0xfffffff8
je 0x442c59
cmp eax, 0x8cccc8
je 0x442c59
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
lea esi, [esp + 0x130]
call fcn.0040a610
jmp case.default.0x4436ff
cmp esi, 0x205
jl case.default.0x4436ff
cmp esi, 0x208
jg case.default.0x4436ff
push 0
push 1
push 1
call fcn.004a2250
add esp, 0xc
lea edi, [esi - 0x205]
push edi
push str.You_have_rescued_your_long_lost__RELATIVE_
mov esi, 0x8ebf58
call fcn.004f7660
push 0
push 0xffffffffffffffff
push edi
call fcn.00451db0
add esp, 0x14
jmp case.default.0x4436ff
xor ecx, ecx
xor esi, esi
mov dword [esp + 0x14], esi
mov eax, 0x864014
cmp dword [eax], 0
jne 0x442cd2
lea edx, [ebp - 9]
cmp ecx, edx
je 0x442cdd
inc ecx
add eax, 0x1c
inc esi
cmp eax, 0x864110
jl 0x442cc5
push 0
mov dword [esp + 0x18], esi
call fcn.00488e30
add esp, 4
push 0
push 1
push 1
call fcn.004a2250
mov al, byte [0x727d98]
mov ecx, dword [0x728820]
mov byte [ecx + 0x728814], al
mov edx, dword [0x728820]
add esp, 0xc
mov ebp, 0x8cccd0
inc edx
test al, al
mov dword [esp + 0x108], ebp
mov dword [esp + 0x10c], ebp
mov dword [esp + 0x110], ebp
mov dword [0x728820], edx
je 0x442d6c
mov ecx, dword [0x8cb7c0]
mov edx, dword [0x8cb7c4]
mov byte [ecx + 0xb4], 0
mov byte [edx + 0xb4], 0
mov eax, dword [0x8ebfe8]
push eax
call fcn.00537020
mov ecx, dword [0x8ebfe8]
push ecx
mov ecx, dword [0x8cb7c4]
call fcn.00537020
mov eax, dword [0x7283bc]
mov edx, dword [0x728a84]
push 0x2d
push 0
mov dword [edx*4 + 0x7288f4], eax
mov ebx, dword [0x728a84]
push 0
push 0
inc ebx
push 0
xor eax, eax
xor edi, edi
xor ecx, ecx
mov byte [0x727d98], 0
mov byte [0x8cbdf4], 1
mov dword [0x728a84], ebx
mov dword [0x7283bc], 0xff7ffff
call fcn.004892c0
add esp, 0x14
mov ebx, 0x6f7896
lea eax, [esp + 0x10c]
mov dword [esp + 0x114], edi
call fcn.00412f10
lea ecx, [esi + 1]
mov eax, ecx
mov dword [esp + 0x12c], eax
imul eax, eax, 0x1c
mov eax, dword [eax + 0x863ffc]
test al, 0x10
mov dword [0x72eb4c], edi
mov dword [0x72eb44], 5
mov dword [0x72ecc4], 0x12c
je 0x442e13
mov dword [esp + 0x128], 3
jmp 0x442e23
movsx edx, al
and edx, 8
shr edx, 2
mov dword [esp + 0x128], edx
push 0
push ecx
lea eax, [esp + 0x88]
push 5
push eax
or eax, 0xffffffff
mov ecx, 4
or edx, 0xffffffff
mov dword [esp + 0x34], ebp
call fcn.0041a300
add esp, 0x10
lea ecx, [esp + 0x24]
call fcn.00412ec0
mov eax, dword [esp + 0x80]
add eax, 0xfffffff8
je 0x442e6c
cmp eax, 0x8cccc8
je 0x442e6c
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
mov esi, dword [esp + 0x24]
push 0xa
push str.blackbeard
push esi
mov dword [esp + 0x8c], ebp
call dword [sym.imp.MSVCR71.dll__strnicmp]
add esp, 0xc
mov ebx, eax
neg ebx
sbb bl, bl
xor ecx, ecx
mov dword [esp + 0x40], ecx
inc bl
push 0xc0
mov byte [esp + 0x2d], bl
mov dword [esp + 0x48], ecx
call fcn.005354b8
add esp, 4
test eax, eax
je 0x442edd
mov edx, dword [0x8ebffc]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push esi
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov bl, byte [esp + 0x29]
mov esi, eax
jmp 0x442edf
xor esi, esi
mov eax, dword [esp + 0x44]
cmp eax, esi
je 0x442f0d
test eax, eax
je 0x442f02
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x442f02
mov eax, dword [ecx]
push 1
call dword [eax]
test esi, esi
mov dword [esp + 0x44], esi
je 0x442f0d
inc dword [esi + 4]
xor edi, edi
xor ebp, ebp
test bl, bl
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ebp
je 0x443010
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x442f62
mov ecx, dword [0x8ec000]
push ebp
push ebp
push ebp
push ebp
push 0xffffffffffffffff
push ebp
push ebp
push ebp
push ebp
push str.fx_blackbeard_fire.nif
push ecx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
test eax, eax
je 0x442f62
mov ecx, dword [eax + 4]
mov edi, eax
inc ecx
mov dword [esp + 0x1c], edi
mov dword [eax + 4], ecx
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x50]
or ecx, 0x4000
test eax, eax
mov dword [edi + 0x20], ecx
je 0x442f83
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x8eafdc], eax
je 0x442f9d
mov ecx, dword [edi + 0xbc]
test ecx, ecx
je 0x442f92
call fcn.004c1010
mov eax, dword [edi + 0x1c]
push eax
mov ecx, edi
call fcn.004c0f80
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x442fe6
mov edx, dword [0x8ec000]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.fx_blackbeard_smoke.nif
push edx
xor ebx, ebx
mov esi, eax
call fcn.004bb100
test eax, eax
je 0x442fe6
mov ecx, dword [eax + 4]
mov ebp, eax
inc ecx
mov dword [esp + 0x18], ebp
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x44]
push 0xffffffffffffffff
push 0x64
push str.fx_blackbeard_fire
push eax
mov ebx, edi
call fcn.004c1750
mov ecx, dword [esp + 0x44]
push 0xffffffffffffffff
push 0x64
push str.fx_blackbeard_fire
push ecx
mov ebx, ebp
call fcn.004c1750
xor edx, edx
mov dword [esp + 0xac], edx
mov dword [esp + 0xb0], edx
lea eax, [esp + 0xac]
push eax
mov dword [esp + 0xb8], edx
push 4
lea eax, [esp + 0x1e0]
lea edx, [esp + 0x2e0]
call fcn.0041a9f0
add esp, 8
push 0
push 0
push 0
push 0
push 1
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push 0x86bb48
push ecx
mov ecx, dword [0x8ebffc]
mov eax, esp
mov dword [eax], ecx
mov eax, ecx
test eax, eax
je 0x443074
inc dword [eax + 4]
call fcn.004afb00
mov esi, dword [esp + 0x70]
mov edi, eax
add esp, 0x30
cmp esi, edi
je 0x4430b2
test esi, esi
je 0x4430a1
mov edx, dword [esi + 4]
lea eax, [esi + 4]
dec edx
mov ecx, edx
test ecx, ecx
mov dword [eax], edx
jne 0x4430a1
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
test edi, edi
mov esi, edi
mov dword [esp + 0x40], esi
je 0x4430b2
inc dword [edi + 4]
mov esi, dword [esp + 0x40]
call fcn.00419ac0
mov esi, dword [esp + 0xac]
call fcn.00419ac0
mov esi, dword [esp + 0xb0]
call fcn.00419ac0
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x4431e7
mov edx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x1fc]
push ecx
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
test eax, eax
mov dword [esp + 0x20], eax
je 0x44311c
inc dword [eax + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x4431f4
mov edx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x2fc]
push ecx
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
test eax, eax
mov dword [esp + 0x34], eax
je 0x443169
inc dword [eax + 4]
mov eax, dword [0x8ccbd4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
imul eax, eax, 0x1c
mov eax, dword [eax + 0x864018]
xor ebp, ebp
test al, al
push 0xc0
jns 0x443201
call fcn.005354b8
add esp, 4
test eax, eax
je 0x4431c9
mov ecx, dword [0x8ebfec]
push ebp
push ebp
push ebp
push ebp
push 0xffffffffffffffff
push ebp
push ebp
push ebp
push ebp
push str.Ship_Deck_01n.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
test eax, eax
je 0x4431c9
mov ecx, dword [eax + 4]
inc ecx
mov ebp, eax
mov dword [eax + 4], ecx
mov eax, dword [0x8cbdec]
push 0x3f266666
push str.skydome_night.nif
call fcn.004da420
push 0x8fc
jmp 0x4432ab
mov dword [esp + 0x20], 0
jmp 0x44311c
mov dword [esp + 0x34], 0
jmp 0x443169
test al, 0x40
je 0x443263
call fcn.005354b8
add esp, 4
test eax, eax
je 0x443248
mov edx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Ship_Deck_01s.nif
push edx
mov ebx, 1
mov esi, eax
call fcn.004bb100
test eax, eax
je 0x443248
mov ecx, dword [eax + 4]
inc ecx
mov ebp, eax
mov dword [eax + 4], ecx
mov eax, dword [0x8cbdec]
push 0x3f266666
push str.skydome_lateday.nif
call fcn.004da420
push 0x78a
jmp 0x4432ab
call fcn.005354b8
add esp, 4
test eax, eax
je 0x4432a6
mov ecx, dword [0x8ebfec]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.Ship_Deck_01.nif
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
test eax, eax
je 0x4432a6
mov ecx, dword [eax + 4]
inc ecx
mov ebp, eax
mov dword [eax + 4], ecx
push 0x4b0
call fcn.004ae1f0
xor eax, eax
xor edx, edx
add esp, 4
test eax, eax
mov ecx, eax
mov dword [esp + 0x68], edx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ecx
mov dword [esp + 0x6c], edx
je 0x4432f1
mov eax, 4
mov esi, dword [eax]
dec esi
mov edx, esi
test edx, edx
mov dword [eax], esi
jne 0x4432e7
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x58]
xor eax, eax
mov dword [esp + 0x5c], eax
cmp ecx, eax
je 0x443323
test ecx, ecx
je 0x443312
mov esi, dword [ecx + 4]
lea eax, [ecx + 4]
dec esi
mov edx, esi
test edx, edx
mov dword [eax], esi
jne 0x44330e
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x5c]
test eax, eax
mov ecx, eax
mov dword [esp + 0x58], ecx
je 0x443323
inc dword [eax + 4]
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
cmp eax, ecx
je 0x443355
test eax, eax
je 0x44334a
mov esi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec esi
mov edx, esi
test edx, edx
mov dword [eax], esi
jne 0x443346
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x58]
test ecx, ecx
mov dword [esp + 0x54], ecx
je 0x443355
inc dword [ecx + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x443394
mov ecx, dword [0x8ec000]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.duel_props.kfm
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x443396
xor esi, esi
mov eax, dword [esp + 0x68]
cmp eax, esi
je 0x4433c4
test eax, eax
je 0x4433b9
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x4433b9
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov dword [esp + 0x68], esi
je 0x4433c4
inc dword [esi + 4]
push 0xc0
call fcn.005354b8
add esp, 4
test eax, eax
je 0x443403
mov ecx, dword [0x8ec000]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push str.duel_props.kfm
push ecx
mov ebx, 1
mov esi, eax
call fcn.004bb100
mov esi, eax
jmp 0x443405
xor esi, esi
mov eax, dword [esp + 0x6c]
cmp eax, esi
je 0x443439
test eax, eax
je 0x443428
mov edi, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edi
mov edx, edi
test edx, edx
mov dword [eax], edi
jne 0x443428
mov edx, dword [ecx]
push 1
call dword [edx]
test esi, esi
mov eax, esi
mov dword [esp + 0x6c], eax
je 0x443439
inc dword [esi + 4]
mov eax, dword [esp + 0x6c]
call fcn.004bb170
mov esi, dword [0x72ed74]
fld dword [esi + 0x2c]
call fcn.005f275c
push 0x64
mov ecx, esi
mov edi, eax
call fcn.004e5e80
lea eax, [esp + 0xd8]
push eax
push 4
push str.fWaterTexScale
mov dword [esp + 0xe4], 0x40200000
call fcn.005bf910
mov ecx, dword [0x85c164]
mov esi, dword [0x8cbdec]
add esp, 0xc
and ecx, 0xfffffffb
push 0xc37a0000
mov dword [0x85c164], ecx
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx]
add esi, 0x14
push 0
push 0
call dword [edx + 0x10]
mov ecx, dword [esi]
mov eax, dword [ecx]
push 0
call dword [eax + 0xc]
mov ecx, dword [0x8cbdec]
push 0x41a00000
push ecx
call fcn.004da870
push ebp
call fcn.00427f80
mov ebx, dword [esp + 0x38]
add esp, 4
lea edx, [esp + 0x108]
push edx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0xb4]
push ecx
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x50]
push eax
push 0
push 0
push ebp
push ebx
call fcn.00425ad0
add esp, 0x24
mov eax, ebp
call fcn.00428140
mov eax, dword [0x8cbdec]
push 0x3f266666
push str.skydome006.nif
call fcn.004da420
mov esi, dword [0x8cbdec]
mov eax, dword [0x7275f8]
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx]
push eax
add esi, 0x14
push 0
push 0
call dword [edx + 0x10]
mov ecx, dword [esi]
mov edx, dword [ecx]
push 0
call dword [edx + 0xc]
mov ecx, dword [0x72ed74]
push edi
call fcn.004e5e80
mov esi, dword [0x8cbdec]
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
mov edx, dword [0x7275f8]
add esi, 0x14
push edx
push 0
push 0
call dword [eax + 0x10]
mov ecx, dword [esi]
mov eax, dword [ecx]
push 0
call dword [eax + 0xc]
mov ecx, dword [0x8cbdec]
push 0x41a00000
push ecx
call fcn.004da870
mov al, byte [esp + 0x29]
test al, al
je 0x4435a5
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x1c]
push str.fx_blackbeard_fire
push edx
call fcn.004c1820
mov eax, dword [esp + 0x44]
push str.fx_blackbeard_fire
push eax
mov eax, dword [esp + 0x20]
call fcn.004c1820
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004ae1f0
add esp, 4
call fcn.004810e0
mov eax, dword [0x728a84]
dec eax
mov dword [0x728a84], eax
mov edx, dword [eax*4 + 0x7288f4]
mov dword [0x7283bc], edx
lea esi, [esp + 0x70]
mov edi, 2
mov ecx, dword [esi - 4]
sub esi, 4
test ecx, ecx
je 0x4435ed
dec dword [ecx + 4]
jne 0x4435ed
mov eax, dword [ecx]
push 1
call dword [eax]
dec edi
jne 0x4435d8
lea esi, [esp + 0x60]
mov edi, 3
lea esp, [esp]
mov ecx, dword [esi - 4]
sub esi, 4
test ecx, ecx
je 0x443615
dec dword [ecx + 4]
jne 0x443615
mov edx, dword [ecx]
push 1
call dword [edx]
dec edi
jne 0x443600
test ebp, ebp
je 0x44362a
dec dword [ebp + 4]
jne 0x44362a
mov eax, dword [ebp]
push 1
mov ecx, ebp
call dword [eax]
test ebx, ebx
je 0x44363b
dec dword [ebx + 4]
jne 0x44363b
mov edx, dword [ebx]
push 1
mov ecx, ebx
call dword [edx]
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x44364e
dec dword [ecx + 4]
jne 0x44364e
mov eax, dword [ecx]
push 1
call dword [eax]
lea esi, [esp + 0xb8]
mov edi, 3
lea ebx, [ebx]
mov ecx, dword [esi - 4]
sub esi, 4
test ecx, ecx
je 0x443675
dec dword [ecx + 4]
jne 0x443675
mov edx, dword [ecx]
push 1
call dword [edx]
dec edi
jne 0x443660
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x44368b
dec dword [ecx + 4]
jne 0x44368b
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x44369e
dec dword [ecx + 4]
jne 0x44369e
mov edx, dword [ecx]
push 1
call dword [edx]
lea esi, [esp + 0x48]
mov edi, 2
mov ecx, dword [esi - 4]
sub esi, 4
test ecx, ecx
je 0x4436bc
dec dword [ecx + 4]
jne 0x4436bc
mov eax, dword [ecx]
push 1
call dword [eax]
dec edi
jne 0x4436a7
mov eax, dword [esp + 0x24]
add eax, 0xfffffff8
je 0x4436d8
cmp eax, 0x8cccc8
je 0x4436d8
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
lea esi, [esp + 0x108]
call fcn.0040a610
jmp case.default.0x4436ff
lea eax, [esi - 0x212]
cmp eax, 0xd
ja case.default.0x4436ff
movzx ecx, byte [eax + 0x443950]
jmp dword [ecx*4 + 0x443944]
push 0
push 1
push 1
call fcn.004a2250
add esp, 0xc
add esi, 0xfffffde4
push esi
push str.A_thorough_search_of_the_legendary_lost_city_of_the__LOSTCITY_reveals_treasure_worth_over_50_000_gold_pieces__n
mov esi, 0x8ebf58
call fcn.004f7660
mov ecx, 0x20
call fcn.00487df0
push 0
call fcn.0044f9a0
add esp, 0xc
jmp case.default.0x4436ff
test dword [0x85c164], 0x200000
je case.default.0x4436ff
push 0
push 1
push 1
call fcn.004a2250
add esp, 0xc
push str.I_now_pronounce_you_man_and_wife___you_may_kiss_the_bride._n
mov esi, 0x8ebf58
call fcn.004f7660
add esp, 4
mov ecx, 0x28
call fcn.00487df0
mov eax, dword [esp + 0x2c]
push 0
push 0
call fcn.0044f0b0
add esp, 8
jmp case.default.0x4436ff
xor ecx, ecx
xor esi, esi
mov eax, 0x864018
jmp 0x4437a0
test byte [eax], 1
je 0x4437ad
lea edx, [ebp - 0x12]
cmp ecx, edx
je 0x4437b8
inc ecx
add eax, 0x1c
inc esi
cmp eax, 0x864114
jl 0x4437a0
push 0
push 1
push 1
call fcn.004a2250
mov eax, 0xa
sub eax, esi
imul eax, eax, 0x3e8
add esp, 0xc
push eax
lea ecx, [esi + esi*2]
lea edx, [ecx*4 + 0x8cd10c]
mov ecx, dword [edx]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov edx, dword [edx + 8]
mov dword [eax + 4], ecx
push str.A_few_hours_of_digging_uncovers__TOP10s_buried_treasure_worth__NUM_gold_pieces__n
mov esi, 0x8ebf58
mov dword [eax + 8], edx
call fcn.004f7660
add esp, 0x14
mov ecx, 0x2c
call fcn.00487df0
call fcn.004527f0
mov al, byte [esp + 0x2a]
test al, al
jne 0x443843
mov eax, dword [0x8ca200]
mov ecx, dword [esp + 0x90]
push eax
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0x40000000
push 1
push ecx
call fcn.00488d50
add esp, 0x24
mov al, byte [esp + 0x2b]
test al, al
je 0x440490
jmp 0x44385b
mov eax, 3
call fcn.0042e700
mov al, byte [esp + 0x2a]
test al, al
je 0x443883
xor ebx, ebx
push ebx
call fcn.00488e30
mov cl, 1
add esp, 4
mov al, cl
mov esi, 0x8e87b0
call fcn.004984c0
call fcn.004a2410
jmp 0x44388f
push 1
call fcn.004a7800
add esp, 4
xor ebx, ebx
mov al, byte [esp + 0x33]
mov ecx, dword [0x85c164]
neg al
mov word [0x86e330], bx
sbb eax, eax
and eax, 4
or ecx, eax
mov dword [0x85c164], ecx
nop
push ebx
call fcn.0042e1a0
add esp, 4
cmp eax, ebx
jne 0x4438b0
mov ecx, dword [esp + 0x38]
cmp ecx, ebx
mov dword [0x86e35c], ebx
mov dword [0x86e360], ebx
je 0x4438dc
dec dword [ecx + 4]
jne 0x4438dc
mov edx, dword [ecx]
push 1
call dword [edx]
lea esi, [esp + 0x108]
mov edi, 0xa
mov ecx, dword [esi - 4]
sub esi, 4
cmp ecx, ebx
je 0x4438fd
dec dword [ecx + 4]
jne 0x4438fd
mov eax, dword [ecx]
push 1
call dword [eax]
dec edi
jne 0x4438e8
mov ecx, dword [esp + 0x3c]
cmp ecx, ebx
je 0x443913
dec dword [ecx + 4]
jne 0x443913
mov edx, dword [ecx]
push 1
call dword [edx]
lea esi, [esp + 0xc8]
mov edi, 4
nop
mov ecx, dword [esi - 4]
sub esi, 4
cmp ecx, ebx
je 0x443935
dec dword [ecx + 4]
jne 0x443935
mov eax, dword [ecx]
push 1
call dword [eax]
dec edi
jne 0x443920
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34c
ret