Function at 0x46ab99
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x4044c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x3dc
call fcn.004044c0
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x4028a8
mov dword [ebp - 0x36c], 1
mov dword [ebp - 0x374], 0x8002
push 0x5211c8
lea eax, [ebp - 0x374]
push eax
call fcn.0040480e
movsx eax, ax
test eax, eax
je 0x46ad3b
mov word [ebp - 0xf8], 0x8e
mov word [ebp - 0x2a0], 0x70
mov word [ebp - 0x164], 0xbe
mov word [ebp - 0x160], 0x6f
mov word [ebp - 0x15c], 0x2e
mov word [ebp - 0x5c], 0x91
mov word [ebp - 0x29c], 0x92
mov word [ebp - 0x298], 0xdb
mov word [ebp - 0x1c], 0xc7
mov word [ebp - 0x90], pe_nt_image_headers32
mov word [ebp - 0x26c], 0xc5
mov word [ebp - 0x58], 0xc6
mov word [ebp - 0x18], 0xc3
mov word [ebp - 0x8c], 0xc4
mov word [ebp - 0x64], 0xca
mov word [ebp - 0x268], 0xda
mov word [ebp - 0x54], 0xcb
mov word [ebp - 0xf4], 0xcc
mov word [ebp - 0x158], 0x8d
mov word [ebp - 0x1c4], 0x3a
mov word [ebp - 0x1c0], 0x20
mov word [ebp - 0x264], 0x95
mov word [ebp - 0x258], 0x5c
mov word [ebp - 0xf0], 0x4a
mov word [ebp - 0x60], 0x96
mov word [ebp - 0x88], 0x37
mov word [ebp - 0xec], 0x24
mov word [ebp - 0x1fc], 0x98
mov word [ebp - 0xe8], 0x1f
mov word [ebp - 0x260], 0x99
mov word [ebp - 0x154], 0x49
mov word [ebp - 0x1bc], 0x93
mov word [ebp - 0x150], 0x94
mov word [ebp - 0x50], 0x35
mov word [ebp - 0x254], 0x36
mov word [ebp - 0x280], 0x45
mov word [ebp - 0xe4], 0x6c
and word [ebp - 0x1f8], 0
jmp 0x46af41
mov word [ebp - 0xf8], 0x2c
mov word [ebp - 0x2a0], 0x28
mov word [ebp - 0x164], 0x16
mov word [ebp - 0x160], 0x27
mov word [ebp - 0x15c], 0xf
mov word [ebp - 0x5c], 0xdd
mov word [ebp - 0x29c], 0xd8
mov word [ebp - 0x298], 0xe1
mov word [ebp - 0x1c], 0xcb
mov word [ebp - 0x90], 0xd0
mov word [ebp - 0x26c], 0xcc
mov word [ebp - 0x58], 0xd3
mov word [ebp - 0x18], 0xce
mov word [ebp - 0x8c], 0xd5
mov word [ebp - 0x64], 0xdc
mov word [ebp - 0x268], 0xda
mov word [ebp - 0x54], 0xe2
mov word [ebp - 0xf4], 0xde
mov word [ebp - 0x158], 0xd
mov word [ebp - 0x1c4], 0x15
mov word [ebp - 0x1c0], 6
mov word [ebp - 0x264], 0xd0
mov word [ebp - 0x258], 0x22
mov word [ebp - 0xf0], 0x1d
mov word [ebp - 0x60], 0xd6
mov word [ebp - 0x88], 0x13
mov word [ebp - 0xec], 0x37
mov word [ebp - 0x1fc], 0xcd
mov word [ebp - 0xe8], 5
mov word [ebp - 0x260], 0xdf
mov word [ebp - 0x154], 0x1c
mov word [ebp - 0x1bc], 0xc9
mov word [ebp - 0x150], 0xd3
mov word [ebp - 0x50], 0x11
mov word [ebp - 0x254], 0x12
mov word [ebp - 0x280], 0x18
mov word [ebp - 0xe4], 0xd9
mov word [ebp - 0x1f8], 0xe0
cmp word [0x521220], 0x1e
jl 0x46af41
mov word [ebp - 0x160], 0x27
mov word [ebp - 0x1bc], 0xbc
mov word [ebp - 0x264], 0xc3
mov word [ebp - 0x150], 0xc6
mov word [ebp - 0x1c], 0xbe
mov word [ebp - 0x26c], 0xbf
mov word [ebp - 0x18], 0xc1
mov word [ebp - 0x1fc], 0xc0
mov word [ebp - 0x90], 0xc3
mov word [ebp - 0x58], 0xc6
mov word [ebp - 0x8c], pe_nt_image_headers32
mov word [ebp - 0x29c], 0xcb
mov word [ebp - 0x268], 0xcd
mov word [ebp - 0x264], 0xc3
mov word [ebp - 0x5c], 0xd0
mov word [ebp - 0x64], 0xcf
mov word [ebp - 0x260], 0xd2
mov word [ebp - 0x1f8], 0xd3
mov word [ebp - 0x60], 0xc9
mov word [ebp - 0xe4], 0xcc
mov word [ebp - 0x298], 0xd4
mov word [ebp - 0x54], 0xd5
mov word [ebp - 0x160], 0xd1
mov word [0x5210dc], 2
mov edx, 0x40e7c0
lea ecx, [ebp - 0x13c]
call fcn.004048b0
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
mov al, byte [eax]
mov byte [ebp - 0x36c], al
mov dword [ebp - 0x374], 0x11
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x250]
call fcn.004048d4
lea edx, [ebp - 0x250]
lea ecx, [ebp - 0x3cc]
call fcn.00404766
mov ax, word [ebp - 0x1c0]
mov word [ebp - 0x36c], ax
mov dword [ebp - 0x374], 0x8002
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x374]
push eax
call fcn.0040480e
movsx eax, ax
test eax, eax
je 0x46bcaf
push dword [ebp - 0x13c]
push 0x40e7d4
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, 0xfd
jne 0x46b0d3
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x264]
jne 0x46b126
push dword [ebp - 0x13c]
push 0x40e504
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044506b
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
mov edx, 0x40e7e4
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
cmp word [0x521220], 0x1e
jge 0x46b33d
mov edx, 0x40e7f8
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xcb
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xe0]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
jmp 0x46b38c
mov edx, 0x40e7f8
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xbe
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xe0]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004047c6
push eax
call fcn.004d8bec
xor ecx, ecx
cmp eax, 2
setl cl
neg ecx
mov word [ebp - 0x3bc], cx
lea ecx, [ebp - 0x2d4]
call fcn.00404868
movsx eax, word [ebp - 0x3bc]
test eax, eax
je 0x46b41b
mov edx, 0x40e80c
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0x2d
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xe0]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004047c6
push eax
call fcn.004d8bec
xor ecx, ecx
test eax, eax
setg cl
neg ecx
mov word [ebp - 0x3bc], cx
lea ecx, [ebp - 0x2d4]
call fcn.00404868
movsx eax, word [ebp - 0x3bc]
test eax, eax
je 0x46b575
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea ecx, [ebp - 0x2e4]
call fcn.00404844
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, 6
jne 0x46b4df
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044506b
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
lea eax, [ebp - 0x2e4]
push eax
call fcn.00451b94
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xb0]
call fcn.004048d4
mov edx, 0x40d514
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x2d0]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
and dword [ebp - 0x36c], 0
mov dword [ebp - 0x374], 0x8002
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00404634
push eax
lea eax, [ebp - 0x374]
push eax
call fcn.004046e8
movsx eax, ax
test eax, eax
je 0x46b683
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x2d0]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x2c0]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x60]
jne 0x46b7ec
mov dword [ebp - 0x36c], 0x40e81c
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x2c0]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x88]
jne 0x46b7ec
mov dword [ebp - 0x36c], 0x40c2d4
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x2c0]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x2c0]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044bb2e
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x128]
call fcn.004048d4
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x4c]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ebx, ebx
cmp ax, 0xd4
setne bl
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ecx, ecx
cmp ax, 0xc7
setne cl
and ebx, ecx
test ebx, ebx
jne 0x46b91a
mov dword [ebp - 0x36c], 0x40e82c
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x4c]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x4c]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x118]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, 0x17
jne 0x46bac4
mov dword [ebp - 0x36c], 0x40e040
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x118]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x118]
call fcn.004048d4
lea ecx, [ebp - 0x2e4]
call fcn.00404844
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, 7
jne 0x46ba89
mov dword [ebp - 0x36c], 0x40bf4c
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x118]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x118]
call fcn.004048d4
lea ecx, [ebp - 0x2e4]
call fcn.00404844
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x118]
call fcn.004048d4
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, 0x5f
jne 0x46bba1
mov edx, 0x40e83c
lea ecx, [ebp - 0x294]
call fcn.004048b0
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x294]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x37c], eax
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 7
call fcn.00404898
add esp, 0x20
jmp 0x470acc
mov ax, word [ebp - 0xec]
mov word [ebp - 0x36c], ax
mov dword [ebp - 0x374], 0x8002
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x374]
push eax
call fcn.0040480e
movsx eax, ax
test eax, eax
je 0x46c233
push dword [ebp - 0x13c]
push 0x40e854
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 2
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
mov edx, 0x40e86c
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
mov edx, 0x40e878
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0xe8]
jne 0x46c0e7
push dword [ebp - 0x13c]
push 0x40e88c
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 2
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
mov al, byte [eax]
mov byte [ebp - 0x3e0], al
mov ecx, dword [ebp - 0x260]
call fcn.004046b8
cmp byte [ebp - 0x3e0], al
jne 0x46c14d
push dword [ebp - 0x13c]
push 0x40c858
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
jmp 0x46c22e
mov ecx, dword [ebp - 0x15c]
call fcn.004046b8
cmp byte [ebp - 0x3e0], al
jne 0x46c198
push dword [ebp - 0x13c]
push 0x40c86c
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
jmp 0x46c22e
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
jmp 0x470acc
mov ax, word [ebp - 0x154]
mov word [ebp - 0x36c], ax
mov dword [ebp - 0x374], 0x8002
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x374]
push eax
call fcn.0040480e
movsx eax, ax
test eax, eax
je 0x46ca45
push dword [ebp - 0x13c]
push 0x40da60
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044506b
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x1c0]
jne 0x46c476
push dword [ebp - 0x13c]
push 0x40e7d4
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0xe8]
jne 0x46c476
push dword [ebp - 0x13c]
push 0x40e88c
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 2
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x2d0]
call fcn.00404766
lea eax, [ebp - 0x2e4]
push eax
call fcn.00451b94
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xb0]
call fcn.004048d4
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0xf0]
jne 0x46c58a
mov dword [ebp - 0x36c], 0x40daac
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x2d0]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x2d0]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044bb2e
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x128]
call fcn.004048d4
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x4c]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ebx, ebx
cmp ax, 0xd4
setne bl
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ecx, ecx
cmp ax, 0xc7
setne cl
and ebx, ecx
test ebx, ebx
jne 0x46c6b8
mov dword [ebp - 0x36c], 0x40e82c
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x4c]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x4c]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x118]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, 0x17
jne 0x46c7ac
mov dword [ebp - 0x36c], 0x40e040
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x118]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x118]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x108]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x164]
jne 0x46c8a3
mov dword [ebp - 0x36c], 0x40c298
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x108]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044506b
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x108]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
cmp word [0x521220], 0x1e
jge 0x46c8fe
mov edx, 0x40e8a4
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xdf
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x21c]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
jmp 0x46c94d
mov edx, 0x40e8a4
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xd2
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x21c]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 7
call fcn.00404898
add esp, 0x20
jmp 0x470acc
mov ax, word [ebp - 0x1bc]
mov word [ebp - 0x36c], ax
mov dword [ebp - 0x374], 0x8002
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x374]
push eax
call fcn.0040480e
movsx eax, ax
test eax, eax
je 0x46d9e8
push dword [ebp - 0x13c]
push 0x40e8bc
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044506b
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x264]
jne 0x46cc31
push dword [ebp - 0x13c]
push 0x40e504
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044506b
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x258]
jne 0x46cd1e
push dword [ebp - 0x13c]
push 0x40da98
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
cmp word [0x521220], 0x1e
jge 0x46cd79
mov edx, 0x40e7f8
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xcb
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xe0]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
jmp 0x46cdc8
mov edx, 0x40e7f8
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xbe
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xe0]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004047c6
push eax
call fcn.004d8bec
xor ecx, ecx
cmp eax, 2
setl cl
neg ecx
mov word [ebp - 0x3bc], cx
lea ecx, [ebp - 0x2d4]
call fcn.00404868
movsx eax, word [ebp - 0x3bc]
test eax, eax
je 0x46ce57
mov edx, 0x40e80c
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0x2d
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xe0]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004047c6
push eax
call fcn.004d8bec
xor ecx, ecx
test eax, eax
setg cl
neg ecx
mov word [ebp - 0x3bc], cx
lea ecx, [ebp - 0x2d4]
call fcn.00404868
movsx eax, word [ebp - 0x3bc]
test eax, eax
je 0x46cf09
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044506b
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0xe0]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x1f4]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0xe8]
jne 0x46d08f
mov dword [ebp - 0x36c], 0x40c018
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x1f4]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x1f4]
call fcn.004048d4
lea ecx, [ebp - 0x2e4]
call fcn.00404844
mov dword [ebp - 0x36c], 0x40bf4c
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x1f4]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x1f4]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
lea eax, [ebp - 0x2e4]
push eax
call fcn.00451b94
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xb0]
call fcn.004048d4
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x2d0]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0xf0]
jne 0x46d1a3
mov dword [ebp - 0x36c], 0x40daac
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x2d0]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x2d0]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x2c0]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x60]
jne 0x46d30c
mov dword [ebp - 0x36c], 0x40e81c
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x2c0]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x88]
jne 0x46d30c
mov dword [ebp - 0x36c], 0x40c2d4
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x2c0]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x2c0]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044bb2e
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x128]
call fcn.004048d4
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x4c]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ebx, ebx
cmp ax, 0xd4
setne bl
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ecx, ecx
cmp ax, 0xc7
setne cl
and ebx, ecx
test ebx, ebx
jne 0x46d43a
mov dword [ebp - 0x36c], 0x40e82c
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x4c]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x4c]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x118]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, 0x17
jne 0x46d5e4
mov dword [ebp - 0x36c], 0x40e040
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x118]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x118]
call fcn.004048d4
lea ecx, [ebp - 0x2e4]
call fcn.00404844
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, 7
jne 0x46d5a9
mov dword [ebp - 0x36c], 0x40bf4c
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x118]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x118]
call fcn.004048d4
lea ecx, [ebp - 0x2e4]
call fcn.00404844
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x118]
call fcn.004048d4
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x84]
call fcn.00404766
cmp word [0x521220], 0x1e
jl 0x46d8ba
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, 0xfe
je 0x46d8ba
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
mov al, byte [eax]
mov byte [ebp - 0x3e4], al
mov cx, 0x54
call fcn.004046b8
cmp byte [ebp - 0x3e4], al
jne 0x46d6ba
mov dword [ebp - 0x36c], 0x40e8cc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x84]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
jmp 0x46d8b5
mov cx, 0x55
call fcn.004046b8
cmp byte [ebp - 0x3e4], al
jne 0x46d721
mov dword [ebp - 0x36c], 0x40e8e8
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x84]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
jmp 0x46d8b5
mov cx, 0xcb
call fcn.004046b8
cmp byte [ebp - 0x3e4], al
jne 0x46d788
mov dword [ebp - 0x36c], 0x40e8fc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x84]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
jmp 0x46d8b5
mov cx, 7
call fcn.004046b8
cmp byte [ebp - 0x3e4], al
jne 0x46d7ef
mov dword [ebp - 0x36c], 0x40bf4c
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x84]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
jmp 0x46d8b5
mov cx, 0x58
call fcn.004046b8
cmp byte [ebp - 0x3e4], al
jne 0x46d853
mov dword [ebp - 0x36c], 0x40e90c
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x84]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
jmp 0x46d8b5
mov cx, 0x59
call fcn.004046b8
cmp byte [ebp - 0x3e4], al
jne 0x46d8b5
mov dword [ebp - 0x36c], 0x40e91c
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x84]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
jmp 0x46d617
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x354]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x364]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 9
call fcn.00404898
add esp, 0x28
jmp 0x470acc
mov ax, word [ebp - 0x150]
mov word [ebp - 0x36c], ax
mov dword [ebp - 0x374], 0x8002
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x374]
push eax
call fcn.0040480e
movsx eax, ax
test eax, eax
je 0x46ee5f
push dword [ebp - 0x13c]
push 0x40dc0c
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044506b
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x1c4]
jne 0x46dc80
push dword [ebp - 0x13c]
push 0x40dbfc
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bf4c
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x2a0]
jne 0x46de19
push dword [ebp - 0x13c]
push 0x40c0c0
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bf4c
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x27c]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x258]
jne 0x46e16e
mov dword [ebp - 0x36c], 0x40da98
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x27c]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
mov al, byte [eax]
mov byte [ebp - 0x3e8], al
mov ecx, dword [ebp - 0x50]
call fcn.004046b8
cmp byte [ebp - 0x3e8], al
jne 0x46df95
mov dword [ebp - 0x36c], 0x40e930
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x27c]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x27c]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
jmp 0x46e16e
mov ecx, dword [ebp - 0x254]
call fcn.004046b8
cmp byte [ebp - 0x3e8], al
jne 0x46e0ea
mov dword [ebp - 0x36c], 0x40e944
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x27c]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x280]
jne 0x46e0e5
mov dword [ebp - 0x36c], 0x40ccac
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x27c]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x27c]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
jmp 0x46e16e
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
sub ax, word [ebp - 0xe4]
neg ax
sbb eax, eax
inc eax
neg eax
movzx cx, byte [ebp - 0x3e8]
cmp cx, ax
jne 0x46e16e
mov dword [ebp - 0x36c], 0x40e474
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x27c]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x2d0]
call fcn.00404766
lea eax, [ebp - 0x2e4]
push eax
call fcn.00451b94
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xb0]
call fcn.004048d4
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0xf0]
jne 0x46e282
mov dword [ebp - 0x36c], 0x40daac
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x2d0]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x2d0]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x1e4]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x160]
jne 0x46e379
mov dword [ebp - 0x36c], 0x40da70
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x1e4]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x1e4]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044bb2e
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x128]
call fcn.004048d4
mov edx, 0x40e958
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x198]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004047c6
push eax
call fcn.004d8bec
xor ecx, ecx
cmp eax, 2
setl cl
neg ecx
mov word [ebp - 0x3bc], cx
lea ecx, [ebp - 0x2d4]
call fcn.00404868
movsx eax, word [ebp - 0x3bc]
test eax, eax
je 0x46e45f
mov edx, 0x40e96c
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x198]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x3c]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ebx, ebx
cmp ax, 0xd4
setne bl
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ecx, ecx
cmp ax, 0xc7
setne cl
and ebx, ecx
test ebx, ebx
jne 0x46e570
mov dword [ebp - 0x36c], 0x40e82c
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x3c]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x3c]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x118]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, 0x17
jne 0x46e664
mov dword [ebp - 0x36c], 0x40e040
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x118]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x118]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
cmp word [0x521220], 0x1e
jge 0x46e6d2
mov edx, 0x40d4d8
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xd5
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea eax, [ebp - 0x2e4]
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x25c]
call fcn.004048b6
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea ecx, [ebp - 0x2e4]
call fcn.00404844
jmp 0x46e734
mov edx, 0x40d4d8
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], pe_nt_image_headers32
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea eax, [ebp - 0x2e4]
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x25c]
call fcn.004048b6
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea ecx, [ebp - 0x2e4]
call fcn.00404844
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x108]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x164]
jne 0x46e82b
mov dword [ebp - 0x36c], 0x40c298
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x108]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044506b
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x108]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
cmp word [0x521220], 0x1e
jge 0x46e886
mov edx, 0x40e984
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xd9
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x240]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
jmp 0x46e8d5
mov edx, 0x40e984
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xcc
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x240]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
cmp word [0x521220], 0x1e
jge 0x46e930
mov edx, 0x40e99c
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xe2
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x290]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
jmp 0x46e97f
mov edx, 0x40e99c
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xd5
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x290]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0xa0]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ebx, ebx
cmp ax, 0xcd
setne bl
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ecx, ecx
cmp ax, 0xc0
setne cl
and ebx, ecx
test ebx, ebx
jne 0x46ea9c
mov dword [ebp - 0x36c], 0x40e9ac
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0xa0]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0xa0]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
cmp word [0x521220], 0x1e
jge 0x46eb4a
mov edx, 0x40e9c0
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xca
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x20c]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
mov edx, 0x40dc8c
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xdb
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x2c]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
jmp 0x46ebe5
mov edx, 0x40dc8c
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xce
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x2c]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
mov edx, 0x40e9c0
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xbd
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x20c]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, 0x57
jne 0x46ec12
mov edx, 0x40e9d0
lea ecx, [ebp - 0x178]
call fcn.004048b0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x37c], eax
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x354]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 8
call fcn.00404898
add esp, 0x24
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x37c], eax
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x354]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 8
call fcn.00404898
add esp, 0x24
jmp 0x470acc
mov ax, word [ebp - 0xf8]
mov word [ebp - 0x36c], ax
mov dword [ebp - 0x374], 0x8002
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x374]
push eax
call fcn.0040480e
movsx eax, ax
test eax, eax
je 0x470acc
push dword [ebp - 0x13c]
push 0x40bfe8
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044506b
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, 0x4a
jne 0x46f048
push dword [ebp - 0x13c]
push 0x40c7cc
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0xe8]
jne 0x46f1e1
push dword [ebp - 0x13c]
push 0x40c018
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bf4c
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x1c4]
jne 0x46f37a
push dword [ebp - 0x13c]
push 0x40dbfc
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bf4c
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x2a0]
jne 0x46f513
push dword [ebp - 0x13c]
push 0x40c0c0
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bf4c
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x37c], 0x40bffc
mov dword [ebp - 0x384], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 3
call fcn.00404898
add esp, 0x10
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
sub ax, word [ebp - 0x1f8]
neg ax
sbb eax, eax
inc eax
neg eax
mov word [ebp - 0x37c], ax
mov dword [ebp - 0x384], 0xb
and dword [ebp - 0x36c], 0
mov dword [ebp - 0x374], 0x8002
lea eax, [ebp - 0x384]
push eax
push 0x5211f8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047f6
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.00404808
push eax
call fcn.00404892
mov word [ebp - 0x3bc], ax
lea ecx, [ebp - 0x384]
call fcn.00404844
movsx eax, word [ebp - 0x3bc]
test eax, eax
je 0x46f6d9
push dword [ebp - 0x13c]
push 0x40d9cc
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
lea eax, [ebp - 0x2e4]
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x220]
call fcn.004048b6
lea ecx, [ebp - 0x2e4]
call fcn.00404844
push dword [ebp - 0x13c]
push dword [ebp - 0x220]
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x2d4]
call fcn.004048b6
push eax
push 0x40bf4c
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea ecx, [ebp - 0x2d4]
call fcn.00404868
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
lea eax, [ebp - 0x2e4]
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x220]
call fcn.004048b6
lea ecx, [ebp - 0x2e4]
call fcn.00404844
push dword [ebp - 0x13c]
push dword [ebp - 0x220]
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x2d4]
call fcn.004048b6
push eax
push 0x40bffc
call fcn.0040486e
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0x2e4]
push eax
call fcn.00451b94
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xb0]
call fcn.004048d4
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044bb2e
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x128]
call fcn.004048d4
mov edx, 0x40e9e8
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x230]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004047c6
push eax
call fcn.004d8bec
xor ecx, ecx
cmp eax, 2
setl cl
neg ecx
mov word [ebp - 0x3bc], cx
lea ecx, [ebp - 0x2d4]
call fcn.00404868
movsx eax, word [ebp - 0x3bc]
test eax, eax
je 0x46f7dc
mov edx, 0x40e9f8
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x230]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
mov edx, 0x40ea0c
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xd0]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004047c6
push eax
call fcn.004d8bec
xor ecx, ecx
cmp eax, 2
setl cl
neg ecx
mov word [ebp - 0x3bc], cx
lea ecx, [ebp - 0x2d4]
call fcn.00404868
movsx eax, word [ebp - 0x3bc]
test eax, eax
je 0x46f8a5
mov edx, 0x40ea1c
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xd0]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
mov edx, 0x40ea30
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x1d4]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004047c6
push eax
call fcn.004d8bec
xor ecx, ecx
cmp eax, 2
setl cl
neg ecx
mov word [ebp - 0x3bc], cx
lea ecx, [ebp - 0x2d4]
call fcn.00404868
movsx eax, word [ebp - 0x3bc]
test eax, eax
je 0x46f96e
mov edx, 0x40ea40
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x1d4]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
mov edx, 0x40ea54
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x1a8]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004047c6
push eax
call fcn.004d8bec
xor ecx, ecx
cmp eax, 2
setl cl
neg ecx
mov word [ebp - 0x3bc], cx
lea ecx, [ebp - 0x2d4]
call fcn.00404868
movsx eax, word [ebp - 0x3bc]
test eax, eax
je 0x46fa37
mov edx, 0x40ea64
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x1a8]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
mov edx, 0x40e958
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x198]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004047c6
push eax
call fcn.004d8bec
xor ecx, ecx
cmp eax, 2
setl cl
neg ecx
mov word [ebp - 0x3bc], cx
lea ecx, [ebp - 0x2d4]
call fcn.00404868
movsx eax, word [ebp - 0x3bc]
test eax, eax
je 0x46fb00
mov edx, 0x40e96c
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x198]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x1e4]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ebx, ebx
cmp ax, word [ebp - 0x160]
setne bl
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ecx, ecx
cmp ax, 0x27
setne cl
and ebx, ecx
test ebx, ebx
jne 0x46fc36
mov dword [ebp - 0x36c], 0x40ea78
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x1e4]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 2
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40ea8c
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x1e4]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x108]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, word [ebp - 0x164]
jne 0x46fd2d
mov dword [ebp - 0x36c], 0x40c298
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x108]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044506b
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x108]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x74]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
mov al, byte [eax]
mov byte [ebp - 0x39c], al
mov dword [ebp - 0x3a4], 0x8011
mov dword [ebp - 0x30c], 0xe3
mov dword [ebp - 0x314], 2
mov dword [ebp - 0x2fc], 0xe0
mov dword [ebp - 0x304], 2
and dword [ebp - 0x36c], 0
mov dword [ebp - 0x374], 0x8002
push 0x5211f8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00404658
mov edx, eax
lea ecx, [ebp - 0x2f4]
call fcn.004048d4
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.004047a2
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
sub ax, 0xd6
neg ax
sbb eax, eax
inc eax
neg eax
mov word [ebp - 0x3ac], ax
mov dword [ebp - 0x3b4], 0xb
lea eax, [ebp - 0x3a4]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.00404886
push eax
lea eax, [ebp - 0x3b4]
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.0040488c
push eax
call fcn.00404892
mov word [ebp - 0x3bc], ax
lea eax, [ebp - 0x3b4]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
push 5
call fcn.00404898
add esp, 0x18
movsx eax, word [ebp - 0x3bc]
test eax, eax
je 0x46ffab
mov dword [ebp - 0x36c], 0x40d94c
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x74]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, 0x12
jne 0x46ff3e
mov dword [ebp - 0x36c], 0x40e434
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x74]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x74]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0xa0]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ebx, ebx
cmp ax, 0xcd
setne bl
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ecx, ecx
cmp ax, 0xc0
setne cl
and ebx, ecx
test ebx, ebx
jne 0x4700c8
mov dword [ebp - 0x36c], 0x40e9ac
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0xa0]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0xa0]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
cmp word [0x521220], 0x1e
jge 0x470123
mov edx, 0x40ea98
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xca
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xc0]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
jmp 0x470172
mov edx, 0x40ea98
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xbd
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xc0]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004047c6
push eax
call fcn.004d8bec
xor ecx, ecx
cmp eax, 2
setl cl
neg ecx
mov word [ebp - 0x3bc], cx
lea ecx, [ebp - 0x2d4]
call fcn.00404868
movsx eax, word [ebp - 0x3bc]
test eax, eax
je 0x470260
cmp word [0x521220], 0x1e
jge 0x470211
mov edx, 0x40eab0
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xd7
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xc0]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
jmp 0x470260
mov edx, 0x40eab0
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xca
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0xc0]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
cmp word [0x521220], 0x1e
jge 0x4702bb
mov edx, 0x40eacc
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xcf
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x188]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
jmp 0x47030a
mov edx, 0x40eacc
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xc2
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x188]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x2b0]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ebx, ebx
cmp ax, 0xd1
setne bl
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
xor ecx, ecx
cmp ax, 0xc4
setne cl
and ebx, ecx
test ebx, ebx
jne 0x470495
mov dword [ebp - 0x36c], 0x40eae8
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x2b0]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
movzx ax, byte [eax]
cmp ax, 0x12
jne 0x470422
mov dword [ebp - 0x36c], 0x40e434
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x2b0]
call fcn.004048d4
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x2b0]
call fcn.004048d4
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 2
call fcn.00404898
add esp, 0xc
cmp word [0x521220], 0x1e
jge 0x4704f0
mov edx, 0x40eaf8
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xd4
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x14c]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
jmp 0x47053f
mov edx, 0x40eaf8
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xc7
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x14c]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004047c6
push eax
call fcn.004d8bec
xor ecx, ecx
cmp eax, 2
setl cl
neg ecx
mov word [ebp - 0x3bc], cx
lea ecx, [ebp - 0x2d4]
call fcn.00404868
movsx eax, word [ebp - 0x3bc]
test eax, eax
je 0x47062d
cmp word [0x521220], 0x1e
jge 0x4705de
mov edx, 0x40eb04
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xd6
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x14c]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
jmp 0x47062d
mov edx, 0x40eb04
lea ecx, [ebp - 0x2d4]
call fcn.004048b0
mov word [ebp - 0x3b8], 0xc9
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0044b956
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x14c]
call fcn.004048d4
lea ecx, [ebp - 0x2d4]
call fcn.00404868
mov dword [ebp - 0x36c], 0x40a6cc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x174]
call fcn.00404766
movsx eax, word [0x5210dc]
push eax
push dword [0x5210d8]
call fcn.00404832
mov al, byte [eax]
mov byte [ebp - 0x36c], al
mov dword [ebp - 0x374], 0x11
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x250]
call fcn.004048d4
lea edx, [ebp - 0x250]
lea ecx, [ebp - 0x3dc]
call fcn.00404766
mov ax, word [ebp - 0x15c]
mov word [ebp - 0x36c], ax
mov dword [ebp - 0x374], 0x8002
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0x374]
push eax
call fcn.0040480e
movsx eax, ax
test eax, eax
je 0x47070b
mov dword [ebp - 0x36c], 0x40c86c
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x174]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
jmp 0x4708ad
mov ax, word [ebp - 0x5c]
mov word [ebp - 0x36c], ax
mov dword [ebp - 0x374], 0x8002
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0x374]
push eax
call fcn.0040480e
movsx eax, ax
test eax, eax
je 0x47077a
mov dword [ebp - 0x36c], 0x40eb14
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x174]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
jmp 0x4708ad
mov ax, word [ebp - 0x29c]
mov word [ebp - 0x36c], ax
mov dword [ebp - 0x374], 0x8002
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0x374]
push eax
call fcn.0040480e
movsx eax, ax
test eax, eax
je 0x4707ec
mov dword [ebp - 0x36c], 0x40e8fc
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x174]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
jmp 0x4708ad
mov ax, word [ebp - 0x298]
mov word [ebp - 0x36c], ax
mov dword [ebp - 0x374], 0x8002
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0x374]
push eax
call fcn.0040480e
movsx eax, ax
test eax, eax
je 0x47085b
mov dword [ebp - 0x36c], 0x40eb28
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x174]
call fcn.00404766
mov ax, word [0x5210dc]
add ax, 1
jo 0x470d29
mov word [0x5210dc], ax
jmp 0x4708ad
lea eax, [ebp - 0x2e4]
push eax
call fcn.00444aa2
mov dword [ebp - 0x36c], 0x40bffc
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
mov edx, eax
lea ecx, [ebp - 0x174]
call fcn.004048d4
lea ecx, [ebp - 0x2e4]
call fcn.00404844
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x354]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 8
call fcn.00404898
add esp, 0x24
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.004047d2
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x354]
push eax
call fcn.004047d2
push eax
call fcn.004048aa
mov edx, eax
lea ecx, [ebp - 0x13c]
call fcn.004048b6
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 8
call fcn.00404898
add esp, 0x24
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x374], 8
lea edx, [ebp - 0x374]
lea ecx, [ebp - 0x138]
call fcn.00404766
push 0x470d08
jmp 0x470b64
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0x3cc]
push eax
push 2
call fcn.00404898
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.00404844
lea ecx, [ebp - 0x3c]
call fcn.00404844
lea ecx, [ebp - 0x4c]
call fcn.00404844
lea ecx, [ebp - 0x74]
call fcn.00404844
lea ecx, [ebp - 0x84]
call fcn.00404844
lea ecx, [ebp - 0xa0]
call fcn.00404844
lea ecx, [ebp - 0xb0]
call fcn.00404844
lea ecx, [ebp - 0xc0]
call fcn.00404844
lea ecx, [ebp - 0xd0]
call fcn.00404844
lea ecx, [ebp - 0xe0]
call fcn.00404844
lea ecx, [ebp - 0x108]
call fcn.00404844
lea ecx, [ebp - 0x118]
call fcn.00404844
lea ecx, [ebp - 0x128]
call fcn.00404844
lea ecx, [ebp - 0x13c]
call fcn.00404868
lea ecx, [ebp - 0x14c]
call fcn.00404844
lea ecx, [ebp - 0x174]
call fcn.00404844
lea ecx, [ebp - 0x178]
call fcn.00404868
lea ecx, [ebp - 0x188]
call fcn.00404844
lea ecx, [ebp - 0x198]
call fcn.00404844
lea ecx, [ebp - 0x1a8]
call fcn.00404844
lea ecx, [ebp - 0x1b8]
call fcn.00404844
lea ecx, [ebp - 0x1d4]
call fcn.00404844
lea ecx, [ebp - 0x1e4]
call fcn.00404844
lea ecx, [ebp - 0x1f4]
call fcn.00404844
lea ecx, [ebp - 0x20c]
call fcn.00404844
lea ecx, [ebp - 0x21c]
call fcn.00404844
lea ecx, [ebp - 0x220]
call fcn.00404868
lea ecx, [ebp - 0x230]
call fcn.00404844
lea ecx, [ebp - 0x240]
call fcn.00404844
lea ecx, [ebp - 0x250]
call fcn.00404844
lea ecx, [ebp - 0x25c]
call fcn.00404868
lea ecx, [ebp - 0x27c]
call fcn.00404844
lea ecx, [ebp - 0x290]
call fcn.00404844
lea ecx, [ebp - 0x294]
call fcn.00404868
lea ecx, [ebp - 0x2b0]
call fcn.00404844
lea ecx, [ebp - 0x2c0]
call fcn.00404844
lea ecx, [ebp - 0x2d0]
call fcn.00404844
ret
call fcn.0040477e