Function at 0x46c179
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c4469
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
mov eax, dword [0x51eea4]
xor eax, dword [esp + 0x150]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x150], eax
mov dword [esp + 0xc0], esi
call fcn.004151d0
xor ebp, ebp
lea ecx, [esi + 0xc0]
mov dword [esp + 0x15c], ebp
mov dword [esi], 0x4f6538
call fcn.004a0720
lea edi, [esi + 0xe0]
mov dword [edi + 4], ebp
mov dword [edi + 8], ebp
mov dword [edi + 0xc], ebp
mov dword [esi + 0xf4], ebp
mov dword [esi + 0xf8], ebp
mov dword [esi + 0xfc], ebp
mov dword [esi + 0x100], ebp
mov dword [esi + 0x104], ebp
mov dword [esi + 0x108], ebp
mov dword [esi + 0x10c], ebp
lea ecx, [esi + 0x110]
call fcn.0041bd20
lea ecx, [esi + 0x118]
call fcn.0041bd20
mov dword [esi + 0x144], ebp
lea eax, [esp + 0x84]
push eax
mov byte [esp + 0x160], 0xa
call fcn.00437070
mov ecx, eax
call fcn.00437010
mov eax, dword [eax]
lea ecx, [esp + 0x80]
push ecx
mov ecx, eax
call fcn.00437210
mov eax, dword [esp + 0x84]
cmp eax, ebp
mov byte [esp + 0x15c], 0xb
je 0x46c256
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov dword [esp + 0x14], edx
jne 0x46c256
mov eax, dword [ecx]
push 1
call dword [eax]
mov ebx, dword [esp + 0x80]
mov eax, dword [ebx + 0x28]
push eax
mov ecx, ebx
call fcn.0043a8b0
add ebx, 0x240
push 0xf
mov ecx, edi
mov dword [esi + 0x13c], eax
mov dword [esi + 0x140], ebx
call fcn.0046b030
mov ecx, edi
call fcn.00468460
mov eax, str._gui_shopscreen.xml
mov dword [esi + 0xf0], ebp
mov byte [esi + 0x148], 0
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46c2b0
sub eax, ecx
push eax
push str._gui_shopscreen.xml
lea ecx, [esp + 0x30]
call fcn.00402cd0
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov byte [esp + 0x160], 0xc
call fcn.0041b630
mov bl, al
mov eax, dword [esp + 0x40]
mov edi, 0x10
cmp eax, edi
mov byte [esp + 0x15c], 0xb
jb 0x46c300
mov edx, dword [esp + 0x2c]
push edx
call fcn.004ade5d
add esp, 4
test bl, bl
je 0x46c933
mov ebx, 0xf
mov eax, str.closebutton
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46c322
sub eax, edx
push eax
push str.closebutton
lea ecx, [esp + 0x30]
call fcn.00402cd0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
mov byte [esp + 0x164], 0xd
call fcn.0040fff0
cmp dword [esp + 0x40], edi
mov byte [esp + 0x15c], 0xf
jb 0x46c36e
mov edx, dword [esp + 0x2c]
push edx
call fcn.004ade5d
add esp, 4
mov ecx, dword [esp + 0x18]
push 0x465280
push 1
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], ebp
mov byte [esp + 0x34], 0
call fcn.0040d960
mov eax, dword [esi + 0x140]
mov edx, dword [eax + 0x1d8]
add eax, 0x1d4
cmp edx, ebp
jne 0x46c3a6
mov dword [esp + 0x68], ebp
jmp 0x46c3c2
mov ecx, dword [eax + 8]
sub ecx, edx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x68], edx
xor ebx, ebx
push ebx
lea ecx, [esp + 0x74]
call fcn.0040dc90
push 1
lea ecx, [esp + 0x74]
mov ebp, eax
call fcn.0040dc90
mov dword [esp + 0x7c], eax
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x64], 0x14
jmp 0x46c3f0
mov eax, str.item
mov dword [esp + 0xa0], 0xf
mov dword [esp + 0x9c], 0
mov byte [esp + 0x8c], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46c416
sub eax, edx
push eax
push str.item
lea ecx, [esp + 0x90]
call fcn.00402cd0
push ebx
lea ecx, [esp + 0x48]
push 0x4f1300
push ecx
mov byte [esp + 0x168], 0x10
call fcn.004ae68f
lea eax, [esp + 0x50]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46c453
sub eax, ecx
push eax
lea edx, [esp + 0x48]
push edx
lea ecx, [esp + 0x90]
call fcn.00402620
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.0040fff0
mov eax, dword [eax]
test eax, eax
mov byte [esp + 0x15c], 0x11
je 0x46c493
inc dword [eax + 4]
mov ecx, dword [esp + 0x18]
test ecx, ecx
mov dword [esp + 0x18], eax
je 0x46c4b2
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
test eax, eax
mov dword [ecx + 4], edx
jne 0x46c4b2
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x14]
test ecx, ecx
mov byte [esp + 0x15c], 0x10
je 0x46c4d9
mov edx, dword [ecx + 4]
lea eax, [ecx + 4]
dec edx
mov dword [eax], edx
mov eax, edx
mov dword [esp + 0x60], eax
jne 0x46c4d9
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x18]
push 0x468670
push 1
call fcn.0040d960
mov ecx, dword [esp + 0x18]
push 0x466ac0
push 2
call fcn.0040d960
mov ecx, dword [esp + 0x18]
push 0x466d50
push 3
call fcn.0040d960
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x70]
mov byte [eax + 0xc4], 1
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0040fd00
fld dword [ebp]
fadd dword [0x4f2a20]
mov eax, dword [esp + 0x7c]
sub esp, 0xc
lea edx, [esp + 0x7c]
fstp dword [ebp]
mov ecx, esp
fild dword [esp + 0x70]
mov dword [esp + 0x28], esp
push edx
fstp dword [esp + 0x70]
fld dword [esp + 0x70]
fadd dword [eax]
fstp dword [eax]
mov edi, dword [esp + 0x28]
call fcn.0040dc60
mov ecx, edi
call fcn.0040dfe0
cmp ebx, dword [esp + 0x68]
jge 0x46c6b0
mov eax, str.hierarchy.Screen.Shop.
mov dword [esp + 0xbc], 0xf
mov dword [esp + 0xb8], 0
mov byte [esp + 0xa8], 0
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46c590
sub eax, ecx
push eax
push str.hierarchy.Screen.Shop.
lea ecx, [esp + 0xac]
call fcn.00402cd0
mov eax, dword [esi + 0x140]
mov ecx, dword [esp + 0x6c]
add eax, 0x1d4
mov eax, dword [eax + 4]
push 0xffffffffffffffff
add eax, ecx
push 0
push eax
lea ecx, [esp + 0xb0]
mov byte [esp + 0x168], 0x12
call fcn.00402530
mov eax, str.Hint
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46c5e0
sub eax, ecx
push eax
push str.Hint
lea ecx, [esp + 0xac]
call fcn.00402620
lea edx, [esp + 0xa4]
push edx
lea eax, [esp + 0xc8]
push eax
call fcn.00416de0
mov ecx, eax
call fcn.004118f0
mov ecx, dword [esp + 0x18]
push 0xffffffffffffffff
push 0
push eax
add ecx, 0x98
mov byte [esp + 0x168], 0x13
call fcn.00402aa0
mov eax, dword [esp + 0xdc]
mov edi, 0x10
cmp eax, edi
jb 0x46c653
mov ecx, dword [esp + 0xc8]
push ecx
call fcn.004ade5d
add esp, 4
cmp dword [esp + 0xbc], edi
mov dword [esp + 0xdc], 0xf
mov dword [esp + 0xd8], 0
mov byte [esp + 0xc8], 0
mov byte [esp + 0x15c], 0x10
jb 0x46c692
mov edx, dword [esp + 0xa8]
push edx
call fcn.004ade5d
add esp, 4
mov dword [esp + 0xbc], 0xf
mov dword [esp + 0xb8], 0
mov byte [esp + 0xa8], 0
mov eax, str.disabled
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46c6b8
sub eax, ecx
push eax
push str.disabled
lea ecx, [esp + 0x90]
call fcn.00402620
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
call fcn.0040fff0
mov ecx, dword [esp + 0x24]
push 0
mov byte [esp + 0x160], 0x14
call fcn.0040f5b0
mov ecx, dword [esp + 0x24]
push 0
call fcn.004198f0
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0xe0]
push edx
call fcn.0040fd00
mov ecx, dword [eax]
mov dword [esp + 0x70], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x74], edx
mov eax, dword [eax + 8]
mov dword [esp + 0x78], eax
fld dword [ebp]
fadd dword [0x4f2a20]
mov eax, dword [esp + 0x7c]
sub esp, 0xc
lea edx, [esp + 0x7c]
fstp dword [ebp]
mov ecx, esp
fld dword [esp + 0x6c]
mov dword [esp + 0x28], esp
fadd dword [eax]
push edx
fstp dword [eax]
mov edi, dword [esp + 0x34]
call fcn.0040dc60
mov ecx, edi
call fcn.0040dfe0
cmp ebx, dword [esp + 0x68]
jl 0x46c77c
mov ecx, dword [esp + 0x18]
push 0
call fcn.0040f5b0
mov ecx, dword [esp + 0x24]
push 1
call fcn.0040f5b0
mov eax, dword [esp + 0x24]
test eax, eax
mov byte [esp + 0x15c], 0x10
je 0x46c7a5
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov eax, edx
mov dword [esp + 0x1c], eax
jne 0x46c7a5
mov edx, dword [ecx]
push 1
call dword [edx]
cmp dword [esp + 0xa0], 0x10
mov byte [esp + 0x15c], 0xf
jb 0x46c7c7
mov eax, dword [esp + 0x8c]
push eax
call fcn.004ade5d
add esp, 4
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x6c]
sub eax, 8
add edi, 0x1c
inc ebx
cmp eax, 0xffffffe4
mov dword [esp + 0xa0], 0xf
mov dword [esp + 0x9c], 0
mov byte [esp + 0x8c], 0
mov dword [esp + 0x6c], edi
mov dword [esp + 0x64], eax
jg 0x46c3f0
push 0x3c
call fcn.004ad909
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x15c], 0x15
je 0x46c828
mov ecx, eax
call fcn.00482f10
jmp 0x46c82a
xor eax, eax
test eax, eax
mov byte [esp + 0x15c], 0xf
je 0x46c839
inc dword [eax + 4]
mov ecx, dword [esi + 0x144]
test ecx, ecx
mov dword [esi + 0x144], eax
je 0x46c85c
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
test eax, eax
mov dword [ecx + 4], edx
jne 0x46c85c
mov edx, dword [ecx]
push 1
call dword [edx]
mov edi, dword [esi + 0x144]
push 0xc3fa0000
push 0xc35c0000
push 0xc25c0000
lea ecx, [esp + 0x7c]
call fcn.00401450
mov ecx, dword [edi + 8]
push 1
lea eax, [esp + 0x74]
push eax
call fcn.00424690
mov ecx, dword [esi + 0x144]
push 8
call fcn.004828a0
push 0x10
push 0xc
push 0
sub esp, 0x1c
mov ecx, esp
mov eax, str._texture_animation_moneta.png
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
mov dword [esp + 0x44], esp
mov byte [ecx + 4], 0
lea edi, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46c8c0
sub eax, edi
push eax
push str._texture_animation_moneta.png
call fcn.00402cd0
mov ecx, dword [esi + 0x144]
push 0
push 0xc1800000
call fcn.00482a80
mov ecx, dword [esi + 0x144]
push 2
call fcn.00482940
lea ecx, [esi + 0xc0]
call fcn.004a0790
mov ecx, esi
call fcn.004699a0
mov ecx, esi
call fcn.0046b650
mov eax, dword [esp + 0x18]
test eax, eax
mov byte [esp + 0x15c], 0xb
je 0x46c933
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov dword [esp + 0x1c], edx
jne 0x46c933
mov eax, dword [ecx]
push 1
call dword [eax]
xor ebp, ebp
push ebp
push ebp
lea ecx, [esp + 0x24]
call fcn.00422600
mov ecx, dword [eax]
mov dword [esi + 0x110], ecx
mov edx, dword [eax + 4]
push 0xbf800000
push ebp
lea ecx, [esp + 0x24]
mov dword [esi + 0x114], edx
call fcn.00422600
mov edx, dword [eax]
lea ecx, [esi + 0x118]
mov dword [ecx], edx
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
call fcn.00465170
fstp dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esi + 0x120], eax
mov dword [esi + 0x124], eax
mov eax, str.data_objects_catapult_body.xml
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46c9a2
sub eax, ecx
push eax
push str.data_objects_catapult_body.xml
lea ecx, [esp + 0x30]
call fcn.00402cd0
push ebp
push ebp
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x20]
mov bl, 0x16
push edx
mov byte [esp + 0x16c], bl
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov eax, dword [eax]
cmp eax, ebp
mov byte [esp + 0x15c], 0x17
je 0x46c9ec
inc dword [eax + 4]
mov ecx, dword [esi + 0xf4]
cmp ecx, ebp
mov dword [esi + 0xf4], eax
je 0x46ca0f
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebp
mov dword [ecx + 4], edx
jne 0x46ca0f
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esp + 0x14]
cmp eax, ebp
mov byte [esp + 0x15c], bl
je 0x46ca35
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov dword [esp + 0x1c], edx
jne 0x46ca35
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esp + 0x40], 0x10
mov byte [esp + 0x15c], 0xb
jb 0x46ca51
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004ade5d
add esp, 4
mov edi, dword [esi + 0xf4]
push 0x43480000
lea ebx, [esi + 0x110]
push 1
mov ecx, ebx
call fcn.0040dc90
mov edx, dword [eax]
push edx
push ebp
mov ecx, ebx
call fcn.0040dc90
mov eax, dword [eax]
push eax
mov ecx, edi
call fcn.00424870
mov eax, dword [esi + 0xf4]
cmp eax, ebp
push 1
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
mov dword [ecx], eax
je 0x46ca9a
inc dword [eax + 4]
mov byte [esp + 0x168], 0x18
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0x168], 0xb
call dword [edx + 0x10]
mov eax, str.data_objects_catapult_wheel.xml
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46cad0
sub eax, edx
push eax
push str.data_objects_catapult_wheel.xml
lea ecx, [esp + 0x30]
call fcn.00402cd0
push ebp
push ebp
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
mov bl, 0x19
push ecx
mov byte [esp + 0x16c], bl
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov eax, dword [eax]
cmp eax, ebp
mov byte [esp + 0x15c], 0x1a
je 0x46cb1a
inc dword [eax + 4]
mov ecx, dword [esi + 0x10c]
cmp ecx, ebp
mov dword [esi + 0x10c], eax
je 0x46cb3d
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebp
mov dword [ecx + 4], edx
jne 0x46cb3d
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x14]
cmp eax, ebp
mov byte [esp + 0x15c], bl
je 0x46cb65
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov eax, edx
mov dword [esp + 0x1c], eax
jne 0x46cb65
mov edx, dword [ecx]
push 1
call dword [edx]
cmp dword [esp + 0x40], 0x10
mov byte [esp + 0x15c], 0xb
jb 0x46cb81
mov eax, dword [esp + 0x2c]
push eax
call fcn.004ade5d
add esp, 4
mov ecx, dword [esi + 0x140]
cmp dword [ecx + 0xf0], ebp
jle 0x46cd07
mov ecx, dword [esi + 0x10c]
lea edx, [esp + 0x44]
push edx
call fcn.00426af0
push 1
push ebp
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x168], 0x1b
mov byte [esp + 0x1c], 0x2e
call fcn.00401760
mov ecx, dword [esp + 0x5c]
cmp ecx, 0x10
mov ebx, dword [esp + 0x48]
mov edx, ebx
jae 0x46cbd4
lea edx, [esp + 0x48]
mov edi, dword [esp + 0x58]
add edi, edx
cmp ecx, 0x10
mov edx, ebx
jae 0x46cbe5
lea edx, [esp + 0x48]
add edx, eax
cmp ecx, 0x10
mov ecx, ebx
jae 0x46cbf2
lea ecx, [esp + 0x48]
cmp edx, ebp
jne 0x46cbfa
xor eax, eax
jmp 0x46cbfe
mov eax, edx
sub eax, ecx
cmp edi, ebp
jne 0x46cc06
xor ecx, ecx
jmp 0x46cc0a
sub edi, edx
mov ecx, edi
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.00402850
mov eax, dword [esp + 0x5c]
cmp eax, 0x10
mov ebx, dword [esp + 0x48]
mov ecx, ebx
jae 0x46cc28
lea ecx, [esp + 0x48]
mov edx, dword [esp + 0x58]
add ecx, edx
cmp eax, 0x10
mov edi, ebx
jae 0x46cc39
lea edi, [esp + 0x48]
cmp eax, 0x10
lea edx, [edx + edi - 1]
mov edi, ebx
jae 0x46cc48
lea edi, [esp + 0x48]
cmp edx, ebp
jne 0x46cc50
xor eax, eax
jmp 0x46cc54
mov eax, edx
sub eax, edi
cmp ecx, ebp
jne 0x46cc5c
xor ecx, ecx
jmp 0x46cc5e
sub ecx, edx
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.00402850
mov ecx, dword [esi + 0x140]
add ecx, 0xf0
mov eax, dword [ecx]
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [edx + 4], eax
mov dword [edx + 8], ecx
lea edx, [esp + 0x30]
push 0x4f1300
push edx
call fcn.004ae68f
lea eax, [esp + 0x38]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46cca3
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x4c]
call fcn.00402620
mov eax, str..png
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46ccc3
sub eax, edx
push eax
push str..png
lea ecx, [esp + 0x4c]
call fcn.00402620
mov ecx, dword [esi + 0x10c]
lea edx, [esp + 0x44]
push edx
call fcn.0042c070
cmp dword [esp + 0x5c], 0x10
mov byte [esp + 0x15c], 0xb
jb 0x46cd07
mov eax, dword [esp + 0x48]
push eax
call fcn.004ade5d
add esp, 4
mov eax, dword [esi + 0x10c]
cmp eax, ebp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov dword [ecx], eax
je 0x46cd1d
inc dword [eax + 4]
mov ecx, dword [esi + 0xf4]
mov edx, dword [ecx]
call dword [edx + 8]
mov edi, dword [esi + 0x10c]
push 0x3f800000
push 1
mov ecx, edi
call fcn.00481fe0
mov ecx, eax
call fcn.0040dca0
push ecx
fstp dword [esp]
push ebp
mov ecx, edi
call fcn.00481fe0
mov ecx, eax
call fcn.0040dca0
push ecx
mov ecx, edi
fstp dword [esp]
call fcn.00424870
mov eax, dword [esi + 0x10c]
cmp eax, ebp
push 1
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
mov dword [ecx], eax
je 0x46cd7b
inc dword [eax + 4]
mov byte [esp + 0x168], 0x1c
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0x168], 0xb
call dword [edx + 0x10]
mov eax, str.data_objects_catapult_wing.xml
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46cdb0
sub eax, ecx
push eax
push str.data_objects_catapult_wing.xml
lea ecx, [esp + 0x30]
call fcn.00402cd0
push ebp
push ebp
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
mov bl, 0x1d
push ecx
mov byte [esp + 0x16c], bl
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov eax, dword [eax]
cmp eax, ebp
mov byte [esp + 0x15c], 0x1e
je 0x46cdfa
inc dword [eax + 4]
mov ecx, dword [esi + 0xf8]
cmp ecx, ebp
mov dword [esi + 0xf8], eax
je 0x46ce1d
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebp
mov dword [ecx + 4], edx
jne 0x46ce1d
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x14]
cmp eax, ebp
mov byte [esp + 0x15c], bl
je 0x46ce45
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov eax, edx
mov dword [esp + 0x1c], eax
jne 0x46ce45
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x40]
mov edi, 0x10
cmp eax, edi
mov byte [esp + 0x15c], 0xb
jb 0x46ce67
mov eax, dword [esp + 0x2c]
push eax
call fcn.004ade5d
add esp, 4
mov eax, str.data_objects_catapult_wing.xml
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46ce80
sub eax, edx
push eax
push str.data_objects_catapult_wing.xml
lea ecx, [esp + 0x30]
call fcn.00402cd0
push ebp
push ebp
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x20]
mov bl, 0x1f
push edx
mov byte [esp + 0x16c], bl
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov eax, dword [eax]
cmp eax, ebp
mov byte [esp + 0x15c], 0x20
je 0x46ceca
inc dword [eax + 4]
mov ecx, dword [esi + 0xfc]
cmp ecx, ebp
mov dword [esi + 0xfc], eax
je 0x46ceed
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebp
mov dword [ecx + 4], edx
jne 0x46ceed
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esp + 0x14]
cmp eax, ebp
mov byte [esp + 0x15c], bl
je 0x46cf13
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov dword [esp + 0x1c], edx
jne 0x46cf13
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esp + 0x40], edi
mov byte [esp + 0x15c], 0xb
jb 0x46cf2e
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004ade5d
add esp, 4
mov eax, dword [esi + 0xf8]
cmp eax, ebp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov dword [ecx], eax
je 0x46cf44
inc dword [eax + 4]
mov ecx, dword [esi + 0xf4]
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [esi + 0xfc]
cmp eax, ebp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov dword [ecx], eax
je 0x46cf65
inc dword [eax + 4]
mov ecx, dword [esi + 0xf4]
mov eax, dword [ecx]
call dword [eax + 8]
mov edi, dword [esi + 0xf8]
push 0xbf800000
push 1
mov ecx, edi
call fcn.00481fe0
mov ecx, eax
call fcn.0040dca0
push ecx
fstp dword [esp]
push ebp
mov ecx, edi
call fcn.00481fe0
mov ecx, eax
call fcn.0040dca0
push ecx
mov ecx, edi
fstp dword [esp]
call fcn.00424870
mov ecx, dword [esi + 0xf8]
mov edi, dword [esi + 0xfc]
push 0xbf800000
push 1
call fcn.00481fe0
mov ecx, eax
call fcn.0040dca0
push ecx
fstp dword [esp]
push ebp
mov ecx, edi
call fcn.00481fe0
mov ecx, eax
call fcn.0040dca0
push ecx
mov ecx, edi
fstp dword [esp]
call fcn.00424870
mov eax, dword [esi + 0x140]
cmp dword [eax + 0xe4], ebp
jg 0x46d000
cmp dword [eax + 0xd8], ebp
jle 0x46d19c
mov ecx, dword [esi + 0xf8]
lea edx, [esp + 0x44]
push edx
call fcn.00426af0
push 1
push ebp
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x168], 0x21
mov byte [esp + 0x1c], 0x31
call fcn.00401760
mov ecx, dword [esp + 0x5c]
cmp ecx, 0x10
mov ebx, dword [esp + 0x48]
mov edx, ebx
jae 0x46d041
lea edx, [esp + 0x48]
mov edi, dword [esp + 0x58]
add edi, edx
cmp ecx, 0x10
mov edx, ebx
jae 0x46d052
lea edx, [esp + 0x48]
add edx, eax
cmp ecx, 0x10
mov ecx, ebx
jae 0x46d05f
lea ecx, [esp + 0x48]
cmp edx, ebp
jne 0x46d067
xor eax, eax
jmp 0x46d06b
mov eax, edx
sub eax, ecx
cmp edi, ebp
jne 0x46d073
xor ecx, ecx
jmp 0x46d077
sub edi, edx
mov ecx, edi
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.00402850
mov ecx, dword [esi + 0x140]
add ecx, 0xd8
mov eax, dword [ecx]
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [edx + 4], eax
mov dword [edx + 8], ecx
lea edx, [esp + 0x30]
push 0x4f1300
push edx
call fcn.004ae68f
mov eax, dword [esi + 0x140]
add eax, 0xe4
mov edx, dword [eax]
add esp, 8
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ecx + 4], edx
mov dword [ecx + 8], eax
lea ecx, [esp + 0x24]
push 0x4f1300
push ecx
call fcn.004ae68f
lea eax, [esp + 0x38]
add esp, 0x14
lea edx, [eax + 1]
jmp 0x46d0f0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46d0f0
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x4c]
call fcn.00402620
mov eax, 0x4f2b9c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46d110
sub eax, edx
push eax
push 0x4f2b9c
lea ecx, [esp + 0x4c]
call fcn.00402620
lea eax, [esp + 0x18]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46d130
sub eax, edx
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x4c]
call fcn.00402620
mov eax, str..png
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46d150
sub eax, edx
push eax
push str..png
lea ecx, [esp + 0x4c]
call fcn.00402620
mov ecx, dword [esi + 0xf8]
lea edx, [esp + 0x44]
push edx
call fcn.0042c070
mov ecx, dword [esi + 0xfc]
lea eax, [esp + 0x44]
push eax
call fcn.0042c070
cmp dword [esp + 0x5c], 0x10
jb 0x46d19c
mov ecx, dword [esp + 0x48]
push ecx
call fcn.004ade5d
add esp, 4
mov eax, dword [esi + 0xf8]
cmp eax, ebp
push 1
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
mov dword [ecx], eax
je 0x46d1b6
inc dword [eax + 4]
mov byte [esp + 0x168], 0x22
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0x168], 0xb
call dword [edx + 0x10]
mov ecx, dword [esi + 0xfc]
call fcn.0040d980
push eax
lea ecx, [esp + 0xf0]
call fcn.0040de60
mov ecx, dword [esi + 0xfc]
lea eax, [esp + 0xec]
push eax
mov byte [esp + 0x118], 1
mov dword [esp + 0x100], ebp
call fcn.0042adf0
mov eax, dword [esi + 0xfc]
cmp eax, ebp
push 1
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
mov dword [ecx], eax
je 0x46d226
inc dword [eax + 4]
mov byte [esp + 0x168], 0x23
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0x168], 0xb
call dword [edx + 0x10]
mov eax, str.data_objects_catapult_sight.xml
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
lea edx, [eax + 1]
jmp 0x46d260
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46d260
sub eax, edx
push eax
push str.data_objects_catapult_sight.xml
lea ecx, [esp + 0x30]
call fcn.00402cd0
push ebp
push ebp
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
mov bl, 0x24
push ecx
mov byte [esp + 0x16c], bl
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov eax, dword [eax]
cmp eax, ebp
mov byte [esp + 0x15c], 0x25
je 0x46d2aa
inc dword [eax + 4]
mov ecx, dword [esi + 0x100]
cmp ecx, ebp
mov dword [esi + 0x100], eax
je 0x46d2cd
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebp
mov dword [ecx + 4], edx
jne 0x46d2cd
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x14]
cmp eax, ebp
mov byte [esp + 0x15c], bl
je 0x46d2f5
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov eax, edx
mov dword [esp + 0x1c], eax
jne 0x46d2f5
mov edx, dword [ecx]
push 1
call dword [edx]
cmp dword [esp + 0x40], 0x10
mov byte [esp + 0x15c], 0xb
jb 0x46d311
mov eax, dword [esp + 0x2c]
push eax
call fcn.004ade5d
add esp, 4
mov eax, dword [esi + 0x100]
cmp eax, ebp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov dword [ecx], eax
je 0x46d327
inc dword [eax + 4]
mov ecx, dword [esi + 0xf4]
mov edx, dword [ecx]
call dword [edx + 8]
mov edi, 0xf
mov eax, str.data_objects_catapult_sight_direction.xml
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46d350
sub eax, edx
push eax
push str.data_objects_catapult_sight_direction.xml
lea ecx, [esp + 0x30]
call fcn.00402cd0
push ebp
push ebp
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
mov bl, 0x26
push ecx
mov byte [esp + 0x16c], bl
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov eax, dword [eax]
cmp eax, ebp
mov byte [esp + 0x15c], 0x27
je 0x46d39a
inc dword [eax + 4]
mov ecx, dword [esi + 0x104]
cmp ecx, ebp
mov dword [esi + 0x104], eax
je 0x46d3bd
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebp
mov dword [ecx + 4], edx
jne 0x46d3bd
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x14]
cmp eax, ebp
mov byte [esp + 0x15c], bl
je 0x46d3e5
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov eax, edx
mov dword [esp + 0x1c], eax
jne 0x46d3e5
mov edx, dword [ecx]
push 1
call dword [edx]
cmp dword [esp + 0x40], 0x10
mov byte [esp + 0x15c], 0xb
jb 0x46d401
mov eax, dword [esp + 0x2c]
push eax
call fcn.004ade5d
add esp, 4
mov eax, dword [esi + 0x104]
cmp eax, ebp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov dword [ecx], eax
je 0x46d417
inc dword [eax + 4]
mov ecx, dword [esi + 0xf4]
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [esi + 0x100]
cmp eax, ebp
push 1
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
mov dword [ecx], eax
je 0x46d43c
inc dword [eax + 4]
mov byte [esp + 0x168], 0x28
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0x168], 0xb
call dword [edx + 0x10]
mov eax, dword [esi + 0x104]
cmp eax, ebp
push 1
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
mov dword [ecx], eax
je 0x46d472
inc dword [eax + 4]
mov byte [esp + 0x168], 0x29
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0x168], 0xb
call dword [edx + 0x10]
mov eax, dword [esi + 0x140]
mov edx, dword [eax + 0x108]
mov ecx, dword [esi + 0x100]
cmp edx, ebp
setne dl
push 1
push 1
push edx
call fcn.00424960
mov eax, dword [esi + 0x140]
mov edx, dword [eax + 0x108]
mov ecx, dword [esi + 0x104]
cmp edx, ebp
setne dl
push 1
push 1
push edx
call fcn.00424960
mov eax, str.data_objects_catapult_tail.xml
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46d4e5
sub eax, ecx
push eax
push str.data_objects_catapult_tail.xml
lea ecx, [esp + 0x30]
call fcn.00402cd0
push ebp
push ebp
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
mov bl, 0x2a
push ecx
mov byte [esp + 0x16c], bl
call fcn.00415620
mov ecx, eax
call fcn.00431b90
mov eax, dword [eax]
cmp eax, ebp
mov byte [esp + 0x15c], 0x2b
je 0x46d52f
inc dword [eax + 4]
mov ecx, dword [esi + 0x108]
cmp ecx, ebp
mov dword [esi + 0x108], eax
je 0x46d552
mov edx, dword [ecx + 4]
dec edx
mov eax, edx
cmp eax, ebp
mov dword [ecx + 4], edx
jne 0x46d552
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esp + 0x14]
cmp eax, ebp
mov byte [esp + 0x15c], bl
je 0x46d57a
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov eax, edx
mov dword [esp + 0x1c], eax
jne 0x46d57a
mov edx, dword [ecx]
push 1
call dword [edx]
cmp dword [esp + 0x40], 0x10
mov byte [esp + 0x15c], 0xb
jb 0x46d596
mov eax, dword [esp + 0x2c]
push eax
call fcn.004ade5d
add esp, 4
mov ecx, dword [esi + 0x140]
cmp dword [ecx + 0xcc], ebp
jle 0x46d71c
mov ecx, dword [esi + 0x108]
lea edx, [esp + 0x44]
push edx
call fcn.00426af0
push 1
push ebp
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x168], 0x2c
mov byte [esp + 0x1c], 0x2e
call fcn.00401760
mov ecx, dword [esp + 0x5c]
cmp ecx, 0x10
mov ebx, dword [esp + 0x48]
mov edx, ebx
jae 0x46d5e9
lea edx, [esp + 0x48]
mov edi, dword [esp + 0x58]
add edi, edx
cmp ecx, 0x10
mov edx, ebx
jae 0x46d5fa
lea edx, [esp + 0x48]
add edx, eax
cmp ecx, 0x10
mov ecx, ebx
jae 0x46d607
lea ecx, [esp + 0x48]
cmp edx, ebp
jne 0x46d60f
xor eax, eax
jmp 0x46d613
mov eax, edx
sub eax, ecx
cmp edi, ebp
jne 0x46d61b
xor ecx, ecx
jmp 0x46d61f
sub edi, edx
mov ecx, edi
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.00402850
mov eax, dword [esp + 0x5c]
cmp eax, 0x10
mov ebx, dword [esp + 0x48]
mov ecx, ebx
jae 0x46d63d
lea ecx, [esp + 0x48]
mov edx, dword [esp + 0x58]
add ecx, edx
cmp eax, 0x10
mov edi, ebx
jae 0x46d64e
lea edi, [esp + 0x48]
cmp eax, 0x10
lea edx, [edx + edi - 1]
mov edi, ebx
jae 0x46d65d
lea edi, [esp + 0x48]
cmp edx, ebp
jne 0x46d665
xor eax, eax
jmp 0x46d669
mov eax, edx
sub eax, edi
cmp ecx, ebp
jne 0x46d671
xor ecx, ecx
jmp 0x46d673
sub ecx, edx
push ecx
push eax
lea ecx, [esp + 0x4c]
call fcn.00402850
mov ecx, dword [esi + 0x140]
add ecx, 0xcc
mov eax, dword [ecx]
sub esp, 0xc
mov edx, esp
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [edx + 4], eax
mov dword [edx + 8], ecx
lea edx, [esp + 0x24]
push 0x4f1300
push edx
call fcn.004ae68f
lea eax, [esp + 0x2c]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46d6b8
sub eax, edx
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x4c]
call fcn.00402620
mov eax, str..png
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46d6d8
sub eax, edx
push eax
push str..png
lea ecx, [esp + 0x4c]
call fcn.00402620
mov ecx, dword [esi + 0x108]
lea edx, [esp + 0x44]
push edx
call fcn.0042c070
cmp dword [esp + 0x5c], 0x10
mov byte [esp + 0x15c], 0xb
jb 0x46d71c
mov eax, dword [esp + 0x48]
push eax
call fcn.004ade5d
add esp, 4
mov ecx, dword [esi + 0x108]
push 0xbf800000
push ebp
push ebp
call fcn.00424870
mov eax, dword [esi + 0x108]
cmp eax, ebp
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov dword [ecx], eax
je 0x46d744
inc dword [eax + 4]
mov ecx, dword [esi + 0xf4]
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [esi + 0x108]
cmp eax, ebp
push 1
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
mov dword [ecx], eax
je 0x46d769
inc dword [eax + 4]
mov byte [esp + 0x168], 0x2d
call fcn.0040e220
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0x168], 0xb
call dword [edx + 0x10]
mov ecx, dword [esi + 0xf4]
push 1
push 2
call fcn.00424cf0
lea eax, [esp + 0x14]
push eax
call fcn.0040d4d0
mov ecx, eax
call fcn.004016d0
mov ecx, dword [eax]
mov byte [esp + 0x15c], 0x2e
call fcn.00401120
mov dword [esi + 0x128], eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
mov dword [esi + 0x12c], edx
mov byte [esp + 0x15c], 0xb
je 0x46d7e7
mov edx, dword [eax + 4]
mov ecx, eax
add eax, 4
dec edx
mov dword [eax], edx
mov dword [esp + 0x1c], edx
jne 0x46d7e7
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esi + 0x128]
mov edx, dword [esi + 0x12c]
mov dword [esi + 0x130], ecx
mov ecx, dword [esp + 0x80]
mov dword [esi + 0x134], edx
mov dword [esi + 0x138], 0x3df5c28f
mov dword [esi + 0x14c], ebp
mov dword [esi + 0x150], ebp
mov eax, dword [ecx + 4]
dec eax
mov byte [esp + 0x15c], 0xa
mov dword [ecx + 4], eax
jne 0x46d833
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x154]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x148]
xor ecx, dword [esp + 0x158]
pop ebp
pop ebx
add esp, 0x150
jmp fcn.004ae650