Function at 0x43f230
Capabilities:
Check for peb beingdebugged flag
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4fb901
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov dword [esp + 0x18], ebp
call fcn.0046b880
xor ebx, ebx
mov dword [ebp], 0x503698
mov dword [ebp + 8], str.CharCreation_gump
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x58], 0x4ec
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x9c], 0xffffffff
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x48], ebx
lea edi, [ebp + 0x24]
mov dword [ebp + 0x44], ebx
mov eax, dword [ebp + 0x58]
lea esi, [ebp + 0x20]
push edi
push esi
push eax
mov dword [esp + 0x30], ebx
call fcn.004a9760
mov dword [esi], 0x280
mov dword [edi], 0x1e0
mov ecx, dword [esi]
mov eax, 1
mov dword [ebp + 0x1c], ecx
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x108], 0xee
mov dword [ebp + 0x10c], 0x62
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x128], eax
mov ecx, str.NONE
mov dword [ebp + 0x12c], ebx
mov dword [ebp + 0x13c], ecx
mov dword [ebp + 0x140], ebx
mov dword [ebp + 0x148], ebx
mov dword [ebp + 0x144], ebx
mov dword [ebp + 0x14c], ebx
mov eax, 0x203b
mov dword [ebp + 0x150], str.Short
mov dword [ebp + 0x154], eax
mov dword [ebp + 0x15c], 0x758
mov dword [ebp + 0x158], eax
mov dword [ebp + 0x160], 0x737
mov eax, 0x203c
mov dword [ebp + 0x164], str.Long
mov dword [ebp + 0x168], eax
mov dword [ebp + 0x170], 0x752
mov dword [ebp + 0x16c], eax
mov dword [ebp + 0x174], 0x72d
mov eax, 0x203d
mov dword [ebp + 0x178], str.Pony_Tail
mov dword [ebp + 0x17c], eax
mov dword [ebp + 0x184], 0x755
mov dword [ebp + 0x180], eax
mov dword [ebp + 0x188], 0x735
mov eax, 0x2044
mov dword [ebp + 0x18c], str.Mohawk
mov dword [ebp + 0x190], eax
mov dword [ebp + 0x198], 0x753
mov dword [ebp + 0x194], eax
mov dword [ebp + 0x19c], 0x733
mov eax, 0x2045
mov dword [ebp + 0x1a0], str.Pageboy
mov dword [ebp + 0x1a4], eax
mov dword [ebp + 0x1ac], 0x754
mov dword [ebp + 0x1a8], eax
mov dword [ebp + 0x1b0], 0x734
mov eax, 0x204a
mov dword [ebp + 0x1b4], str.Topknot
mov dword [ebp + 0x1b8], eax
mov dword [ebp + 0x1c0], 0x751
mov dword [ebp + 0x1bc], eax
mov dword [ebp + 0x1c4], 0x730
mov eax, 0x2047
mov dword [ebp + 0x1c8], str.Curly
mov dword [ebp + 0x1cc], eax
mov dword [ebp + 0x1d4], 0x750
mov dword [ebp + 0x1d0], eax
mov dword [ebp + 0x1d8], 0x72f
mov eax, 0x2048
mov dword [ebp + 0x1dc], str.Receding
mov dword [ebp + 0x1e0], eax
mov dword [ebp + 0x1e8], 0x756
mov edx, dword [ebp + 0x18]
mov dword [ebp + 0x1e4], eax
shl edx, 3
mov eax, 0x2049
push str.framedata_for_CDumbGump
push edx
mov dword [ebp + 0x1ec], 0x736
mov dword [ebp + 0x1f0], str.2_Tails
mov dword [ebp + 0x1f4], eax
mov dword [ebp + 0x1fc], 0x74e
mov dword [ebp + 0x1f8], eax
mov dword [ebp + 0x200], 0x72c
mov dword [ebp + 0x204], str.Buns
mov dword [ebp + 0x208], ebx
mov dword [ebp + 0x210], ebx
mov dword [ebp + 0x20c], 0x2046
mov dword [ebp + 0x214], 0x731
mov dword [ebp + 0x218], ebx
mov dword [ebp + 0x238], ecx
mov dword [ebp + 0x21c], 0x2040
mov dword [ebp + 0x23c], str.Goatee
mov dword [ebp + 0x220], 0x203e
mov dword [ebp + 0x240], str.Long_beard
mov dword [ebp + 0x224], 0x203f
mov dword [ebp + 0x244], str.Short_beard
mov dword [ebp + 0x228], 0x2041
mov dword [ebp + 0x248], str.Moustache
mov dword [ebp + 0x22c], 0x204b
mov dword [ebp + 0x24c], str.Short_beard_moustache
mov dword [ebp + 0x230], 0x204c
mov dword [ebp + 0x250], str.Long_beard_moustache
mov dword [ebp + 0x234], 0x204d
mov dword [ebp + 0x254], str.Vandyke
call fcn.004b9f50
mov ecx, dword [ebp + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebp + 0x40], edi
push str.dumb_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi]
imul eax, dword [ebp + 0x24]
lea ecx, [eax + eax + 4]
push ecx
call fcn.004b9f50
mov edx, dword [ebp + 0x40]
mov dword [edx + 4], eax
mov eax, dword [ebp + 0x40]
mov dx, word [esi]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [ebp + 0x40]
mov dx, word [ebp + 0x24]
mov ecx, dword [eax + 4]
xor eax, eax
mov word [ecx + 2], dx
mov ecx, dword [esi]
imul ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x40]
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, 0x7d
and ecx, 3
push 0x9d20
rep stosb byte es:[edi], al
mov dword [ebp + 0xf4], ebx
mov dword [ebp + 0xfc], ebx
mov dword [ebp + 0xf8], ebx
mov dword [ebp + 0x104], ebx
mov dword [ebp + 0x100], ebx
mov eax, dword [ebp + 0x128]
add eax, 0x10
lea eax, [eax + eax*4]
mov ecx, dword [ebp + eax*4]
mov dword [ebp + 0x130], ecx
mov edx, dword [ebp + 0x12c]
mov eax, dword [ebp + edx*4 + 0x218]
mov dword [ebp + 0x134], eax
mov dword [ebp + 0x138], ebx
mov dword [ebp + 0x258], 0x52
mov dword [ebp + 0x25c], esi
mov dword [ebp + 0x260], 0x1db
mov dword [ebp + 0x264], esi
mov dword [ebp + 0x268], 0xe
mov dword [ebp + 0x270], 0x18
mov dword [ebp + 0x274], 0x79
mov dword [ebp + 0x26c], 0x2d
mov dword [ebp + 0x278], 0xf
call fcn.004ed8ee
add esp, 0x20
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 1
je 0x43f6e4
mov ecx, dword [ebp + 0x278]
mov edx, dword [ebp + 0x264]
push ebx
push 0xe14
push ebp
push 1
push 0x118
lea edx, [ecx + edx - 2]
push esi
push edx
mov edx, dword [ebp + 0x260]
lea ecx, [ecx + edx - 1]
push ecx
mov ecx, eax
call fcn.004add40
jmp 0x43f6e6
xor eax, eax
mov dword [ebp + 0xc4], eax
mov dword [eax + 0x70], ebx
mov ecx, dword [ebp + 0xc4]
push 1
push ebp
mov byte [esp + 0x2c], bl
call fcn.0046af30
mov edx, dword [ebp + 0xc4]
xor eax, eax
push 0x9d20
mov ax, word [edx + 0xb8]
mov dword [ebp + 0xf8], eax
mov ecx, dword [ebp + 0xc4]
mov dword [ecx + 0x9c], 0x186c3
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 2
je 0x43f774
mov edx, dword [ebp + 0x278]
mov ecx, dword [ebp + 0x264]
push ebx
push 0xe14
push ebp
push 2
push 0x118
lea ecx, [edx + ecx - 2]
push esi
push ecx
mov ecx, dword [ebp + 0x260]
lea edx, [edx + ecx - 1]
mov ecx, eax
push edx
call fcn.004add40
jmp 0x43f776
xor eax, eax
mov dword [ebp + 0xc8], eax
mov dword [eax + 0x70], ebx
mov ecx, dword [ebp + 0xc8]
push 1
push ebp
mov byte [esp + 0x2c], bl
call fcn.0046af30
mov eax, dword [ebp + 0xc8]
xor edx, edx
push 0x9d20
mov dword [eax + 0x9c], 0x186c5
mov ecx, dword [ebp + 0xc8]
mov dx, word [ecx + 0xb8]
mov dword [ebp + 0xfc], edx
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 3
je 0x43f803
mov edx, dword [ebp + 0x278]
mov ecx, dword [ebp + 0x264]
push ebx
push 0xe14
push ebp
push ebx
push 0x118
lea ecx, [edx + ecx - 2]
push esi
push ecx
mov ecx, dword [ebp + 0x260]
lea edx, [edx + ecx - 1]
mov ecx, eax
push edx
call fcn.004add40
jmp 0x43f805
xor eax, eax
mov dword [ebp + 0xc0], eax
mov dword [eax + 0x70], ebx
mov ecx, dword [ebp + 0xc0]
push 1
push ebp
mov byte [esp + 0x2c], bl
call fcn.0046af30
mov eax, dword [ebp + 0xc0]
xor edx, edx
push 0x9d20
mov dword [eax + 0x9c], 0x186c7
mov ecx, dword [ebp + 0xc0]
mov dx, word [ecx + 0xb8]
mov dword [ebp + 0xf4], edx
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 4
je 0x43f894
mov edx, dword [ebp + 0x278]
mov ecx, dword [ebp + 0x264]
push 1
push 0xe14
push ebp
push 3
push 0x118
lea ecx, [edx + ecx - 2]
push esi
push ecx
mov ecx, dword [ebp + 0x260]
lea edx, [edx + ecx - 1]
mov ecx, eax
push edx
call fcn.004add40
jmp 0x43f896
xor eax, eax
mov dword [ebp + 0xcc], eax
mov dword [eax + 0x70], ebx
mov ecx, dword [ebp + 0xcc]
push 1
push ebp
mov byte [esp + 0x2c], bl
call fcn.0046af30
mov eax, dword [ebp + 0xcc]
xor edx, edx
push 0x9d20
mov dword [eax + 0x9c], 0x186c8
mov ecx, dword [ebp + 0xcc]
mov dx, word [ecx + 0xb8]
mov dword [ebp + 0x104], edx
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 5
je 0x43f925
mov edx, dword [ebp + 0x278]
mov ecx, dword [ebp + 0x264]
push 1
push 0xe14
push ebp
push 4
push 0x118
lea ecx, [edx + ecx - 2]
push esi
push ecx
mov ecx, dword [ebp + 0x260]
lea edx, [edx + ecx - 1]
mov ecx, eax
push edx
call fcn.004add40
jmp 0x43f927
xor eax, eax
mov dword [ebp + 0xd0], eax
mov dword [eax + 0x70], ebx
mov ecx, dword [ebp + 0xd0]
push 1
push ebp
mov byte [esp + 0x2c], bl
call fcn.0046af30
mov eax, dword [ebp + 0xd0]
xor edx, edx
push 0x1d0
mov dword [eax + 0x9c], 0x186c9
mov ecx, dword [ebp + 0xd0]
mov dx, word [ecx + 0xb8]
mov dword [ebp + 0x100], edx
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 6
je 0x43f9a7
push ebx
push ebx
push 1
push 0x386
push 5
push 0x10
push ebx
push 0x1e
push 0xd2
push ebp
push 0x3f
push 0xfa
mov ecx, eax
call fcn.00443f40
jmp 0x43f9a9
xor eax, eax
mov dword [ebp + 0xb4], eax
mov word [eax + 0xee], bx
mov eax, dword [ebp + 0xb4]
mov byte [esp + 0x24], bl
mov word [eax + 0xf0], bx
mov ecx, dword [ebp + 0xb4]
mov word [ecx + 0xec], bx
mov edx, dword [ebp + 0xb4]
mov byte [edx + 0xf2], 7
mov eax, dword [ebp + 0xb4]
mov byte [eax + 0xf3], 2
mov ecx, dword [ebp + 0xb4]
mov edx, dword [ecx]
call dword [edx + 0x17c]
mov eax, dword [ebp + 0xb4]
push 1
push ebp
mov dword [eax + 0x9c], 0x186cb
mov ecx, dword [ebp + 0xb4]
mov dword [ecx + 0xcc], 1
mov ecx, dword [ebp + 0xb4]
call fcn.0046af30
push 0x1d0
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 7
je 0x43fa83
mov edx, dword [ebp + 0x278]
mov esi, dword [ebp + 0x25c]
push ebx
push ebx
push ebx
push 0x481
push 9
mov ecx, edx
push 0x10
push 2
add ecx, esi
mov esi, dword [ebp + 0x258]
push 0x1e
push 0xa0
push ebp
add edx, esi
push ecx
push edx
mov ecx, eax
call fcn.00443f40
mov edx, eax
mov dword [esp + 0x10], edx
jmp 0x43fa89
mov dword [esp + 0x10], ebx
mov edx, ebx
mov edi, str.Hair_Style
or ecx, 0xffffffff
xor eax, eax
mov dword [edx + 0xf8], ebx
repne scasb al, byte es:[edi]
not ecx
lea esi, [edx + 0xfc]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x14], esi
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 1
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov byte [esp + 0x2c], bl
mov dword [edx + 0xc0], ebx
call fcn.0046af30
mov esi, dword [esp + 0x10]
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x17c]
mov dword [esi + 0x9c], 0x186c4
mov eax, dword [ebp + 0x278]
mov ecx, dword [ebp + 0x258]
push 0x1d4
add eax, ecx
mov dword [ebp + 0x110], eax
mov ecx, dword [ebp + 0x25c]
mov edi, dword [ebp + 0x278]
mov esi, dword [ebp + 0x268]
add ecx, edi
add ecx, esi
mov dword [ebp + 0x114], ecx
mov edx, dword [ebp + 0x274]
mov dword [ebp + 0x118], edx
call fcn.004ed8ee
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
cmp esi, ebx
mov byte [esp + 0x24], 8
je 0x43fb95
mov ax, word [ebp + 0x270]
mov cx, word [ebp + 0x118]
mov edx, dword [ebp + 0x114]
push ebx
mov edi, dword [ebp + 0x110]
push ebx
push ebx
push 0x386
push 9
push 0xa
push 2
push eax
push ecx
push ebp
push edx
push edi
mov ecx, esi
call fcn.00443f40
mov dword [esi], 0x503518
mov word [esi + 0x1d0], bx
mov word [esi + 0x1d2], bx
mov dword [esi + 0x1cc], 0xffffffff
jmp 0x43fb97
xor esi, esi
mov dword [ebp + 0xa4], esi
mov dword [esi + 0x1cc], 0xfd
mov eax, dword [ebp + 0xa4]
push 1
push ebp
mov byte [esp + 0x2c], bl
mov dword [eax + 0xc0], ebx
mov ecx, dword [ebp + 0xa4]
call fcn.0046af30
mov ecx, dword [ebp + 0xa4]
mov edx, dword [ebp + 0x130]
mov dword [ecx + 0xf8], edx
mov eax, dword [ebp + 0x128]
mov edx, dword [ebp + 0xa4]
or ecx, 0xffffffff
lea eax, [eax + eax*4]
add edx, 0xfc
mov edi, dword [ebp + eax*4 + 0x13c]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xa4]
mov edx, dword [ecx]
call dword [edx + 0x17c]
mov eax, dword [ebp + 0xa4]
push 0x1d0
mov dword [eax + 0x9c], 0x186c4
mov ecx, dword [ebp + 0xa4]
mov edx, dword [ecx + 0xf8]
mov dword [ebp + 0x130], edx
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 9
je 0x43fc9b
mov edx, dword [ebp + 0x278]
mov edi, dword [ebp + 0x26c]
mov esi, dword [ebp + 0x25c]
push ebx
push ebx
push ebx
mov ecx, edx
push 0x481
push 9
add ecx, edi
push 0x10
push 2
add ecx, esi
mov esi, dword [ebp + 0x258]
push 0x1e
push 0xa0
push ebp
add edx, esi
push ecx
push edx
mov ecx, eax
call fcn.00443f40
jmp 0x43fc9d
xor eax, eax
mov dword [ebp + 0xf0], eax
mov dword [eax + 0xf8], ebx
mov edx, dword [ebp + 0xf0]
mov edi, str.Facial_Hair_Style
or ecx, 0xffffffff
xor eax, eax
add edx, 0xfc
push 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
mov edi, edx
mov byte [esp + 0x2c], bl
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xf0]
mov dword [ecx + 0xc0], ebx
mov ecx, dword [ebp + 0xf0]
call fcn.0046af30
mov ecx, dword [ebp + 0xf0]
mov edx, dword [ecx]
call dword [edx + 0x17c]
mov eax, dword [ebp + 0xf0]
push 0x1d4
mov dword [eax + 0x9c], 0x186c5
mov ecx, dword [ebp + 0x278]
add ecx, dword [ebp + 0x258]
mov dword [ebp + 0x120], ecx
mov edx, dword [ebp + 0x26c]
mov eax, dword [ebp + 0x25c]
mov edi, dword [ebp + 0x278]
mov esi, dword [ebp + 0x268]
add edx, eax
add edx, edi
add edx, esi
mov dword [ebp + 0x124], edx
mov eax, dword [ebp + 0x274]
mov dword [ebp + 0x11c], eax
call fcn.004ed8ee
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
cmp esi, ebx
mov byte [esp + 0x24], 0xa
je 0x43fdc5
mov ax, word [ebp + 0x270]
mov cx, word [ebp + 0x11c]
mov edx, dword [ebp + 0x124]
push ebx
mov edi, dword [ebp + 0x120]
push ebx
push ebx
push 0x386
push 1
push 0xa
push 2
push eax
push ecx
push ebp
push edx
push edi
mov ecx, esi
call fcn.00443f40
mov dword [esi], 0x503518
mov word [esi + 0x1d0], bx
mov word [esi + 0x1d2], bx
mov dword [esi + 0x1cc], 0xffffffff
jmp 0x43fdc7
xor esi, esi
mov dword [ebp + 0xa8], esi
mov dword [esi + 0x1cc], 0xfd
mov ecx, dword [ebp + 0xa8]
push 1
push ebp
mov byte [esp + 0x2c], bl
mov dword [ecx + 0xc0], ebx
mov ecx, dword [ebp + 0xa8]
call fcn.0046af30
mov edx, dword [ebp + 0x12c]
mov eax, dword [ebp + 0xa8]
mov ecx, dword [ebp + edx*4 + 0x218]
mov dword [eax + 0xf8], ecx
mov eax, dword [ebp + 0x12c]
mov edx, dword [ebp + 0xa8]
or ecx, 0xffffffff
mov edi, dword [ebp + eax*4 + 0x238]
xor eax, eax
add edx, 0xfc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xa8]
mov edx, dword [ecx]
call dword [edx + 0x17c]
mov eax, dword [ebp + 0xa8]
push 0x6164
mov dword [eax + 0x9c], 0x186c5
mov ecx, dword [ebp + 0xa8]
mov edx, dword [ecx + 0xf8]
mov dword [ebp + 0x134], edx
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0xb
je 0x43fec0
mov edx, dword [ebp + 0x278]
mov esi, dword [ebp + 0x264]
push ebx
mov ecx, edx
push 0xdac
push ebx
add ecx, esi
mov esi, dword [ebp + 0x260]
push ebp
push 0x28
push 0x82
add edx, esi
push ecx
push edx
mov ecx, eax
call fcn.00442890
jmp 0x43fec2
xor eax, eax
mov esi, 1
mov dword [ebp + 0xdc], eax
mov dword [eax + 0x70], esi
mov ecx, dword [ebp + 0xdc]
push esi
push ebp
mov byte [esp + 0x2c], bl
call fcn.0046af30
mov edx, dword [ebp + 0xdc]
mov edi, str.Skin_Tone
mov eax, dword [edx + 0xd0]
mov dword [edx + eax*4 + 0xe4], esi
mov ecx, dword [edx + 0xd0]
mov word [edx + ecx*2 + 0x274], 0x481
mov eax, dword [edx + 0xd0]
or ecx, 0xffffffff
lea eax, [eax + eax*4]
shl eax, 4
lea esi, [eax + edx + 0x33c]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [edx + 0xd0]
inc edi
mov dword [edx + 0xd0], edi
mov ecx, dword [ebp + 0xdc]
call fcn.00442f40
mov ecx, dword [ebp + 0xdc]
push 0x6164
mov dword [ecx + 0x9c], 0x186c7
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0xc
je 0x43ffbb
mov edx, dword [ebp + 0x278]
mov edi, dword [ebp + 0x26c]
mov esi, dword [ebp + 0x264]
mov ecx, edx
push ebx
add ecx, edi
push 0xdac
push ebx
add ecx, esi
mov esi, dword [ebp + 0x260]
push ebp
push 0x28
push 0x82
add edx, esi
push ecx
push edx
mov ecx, eax
call fcn.00442890
jmp 0x43ffbd
xor eax, eax
mov esi, 1
mov dword [ebp + 0xe0], eax
mov dword [eax + 0x70], esi
mov ecx, dword [ebp + 0xe0]
push esi
push ebp
mov byte [esp + 0x2c], bl
call fcn.0046af30
mov edx, dword [ebp + 0xe0]
mov edi, str.Shirt_Color
mov eax, dword [edx + 0xd0]
mov dword [edx + eax*4 + 0xe4], esi
mov ecx, dword [edx + 0xd0]
mov word [edx + ecx*2 + 0x274], 0x481
mov eax, dword [edx + 0xd0]
or ecx, 0xffffffff
lea eax, [eax + eax*4]
shl eax, 4
lea esi, [eax + edx + 0x33c]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [edx + 0xd0]
inc edi
mov dword [edx + 0xd0], edi
mov ecx, dword [ebp + 0xe0]
call fcn.00442f40
mov ecx, dword [ebp + 0xe0]
push 0x6164
mov dword [ecx + 0x9c], 0x186c8
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0xd
je 0x4400b5
mov edx, dword [ebp + 0x278]
mov ecx, dword [ebp + 0x26c]
mov esi, dword [ebp + 0x264]
push ebx
lea ecx, [edx + ecx*2]
push 0xdac
push ebx
add ecx, esi
mov esi, dword [ebp + 0x260]
push ebp
push 0x28
push 0x82
add edx, esi
push ecx
push edx
mov ecx, eax
call fcn.00442890
jmp 0x4400b7
xor eax, eax
mov esi, 1
mov dword [ebp + 0xe4], eax
mov dword [eax + 0x70], esi
mov ecx, dword [ebp + 0xe4]
push esi
push ebp
mov byte [esp + 0x2c], bl
call fcn.0046af30
mov edx, dword [ebp + 0xe4]
mov edi, str.Pants_Color
mov eax, dword [edx + 0xd0]
mov dword [edx + eax*4 + 0xe4], esi
mov ecx, dword [edx + 0xd0]
mov word [edx + ecx*2 + 0x274], 0x481
mov eax, dword [edx + 0xd0]
or ecx, 0xffffffff
lea eax, [eax + eax*4]
shl eax, 4
lea esi, [eax + edx + 0x33c]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [edx + 0xd0]
inc edi
mov dword [edx + 0xd0], edi
mov ecx, dword [ebp + 0xe4]
call fcn.00442f40
mov ecx, dword [ebp + 0xe4]
push 0x6164
mov dword [ecx + 0x9c], 0x186c9
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0xe
je 0x4401af
mov edx, dword [ebp + 0x278]
mov ecx, dword [ebp + 0x26c]
mov esi, dword [ebp + 0x264]
push ebx
lea ecx, [edx + ecx*2]
push 0xdac
push ebx
add ecx, esi
mov esi, dword [ebp + 0x260]
push ebp
push 0x28
push 0x82
add edx, esi
push ecx
push edx
mov ecx, eax
call fcn.00442890
jmp 0x4401b1
xor eax, eax
mov dword [ebp + 0xe8], eax
mov dword [eax + 0x70], ebx
mov ecx, dword [ebp + 0xe8]
push 1
push ebp
mov byte [esp + 0x2c], bl
call fcn.0046af30
mov edx, dword [ebp + 0xe8]
mov edi, str.Skirt_Color
mov eax, dword [edx + 0xd0]
mov dword [edx + eax*4 + 0xe4], 1
mov ecx, dword [edx + 0xd0]
mov word [edx + ecx*2 + 0x274], 0x481
mov eax, dword [edx + 0xd0]
or ecx, 0xffffffff
lea eax, [eax + eax*4]
shl eax, 4
lea esi, [eax + edx + 0x33c]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [edx + 0xd0]
inc edi
mov dword [edx + 0xd0], edi
mov ecx, dword [ebp + 0xe8]
call fcn.00442f40
mov ecx, dword [ebp + 0xe8]
push 0x6164
mov dword [ecx + 0x9c], 0x186ca
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0xf
je 0x4402ab
mov esi, dword [ebp + 0x278]
mov edx, dword [ebp + 0x26c]
push ebx
push 0xdac
lea ecx, [esi + edx*2]
push ebx
add edx, ecx
mov ecx, dword [ebp + 0x264]
push ebp
push 0x28
add edx, ecx
push 0x82
push edx
mov edx, dword [ebp + 0x260]
add esi, edx
mov ecx, eax
push esi
call fcn.00442890
jmp 0x4402ad
xor eax, eax
mov esi, 1
mov dword [ebp + 0xd4], eax
mov dword [eax + 0x70], esi
mov ecx, dword [ebp + 0xd4]
push esi
push ebp
mov byte [esp + 0x2c], bl
call fcn.0046af30
mov edx, dword [ebp + 0xd4]
mov edi, str.Hair_Color
mov eax, dword [edx + 0xd0]
mov dword [edx + eax*4 + 0xe4], esi
mov ecx, dword [edx + 0xd0]
mov word [edx + ecx*2 + 0x274], 0x481
mov eax, dword [edx + 0xd0]
or ecx, 0xffffffff
lea eax, [eax + eax*4]
shl eax, 4
lea esi, [eax + edx + 0x33c]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [edx + 0xd0]
inc edi
mov dword [edx + 0xd0], edi
mov ecx, dword [ebp + 0xd4]
call fcn.00442f40
mov ecx, dword [ebp + 0xd4]
push 0x6164
mov dword [ecx + 0x9c], 0x186c3
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0x10
je 0x4403a5
mov edx, dword [ebp + 0x278]
mov ecx, dword [ebp + 0x26c]
mov esi, dword [ebp + 0x264]
push ebx
lea ecx, [edx + ecx*4]
push 0xdac
push ebx
add ecx, esi
mov esi, dword [ebp + 0x260]
push ebp
push 0x28
push 0x82
add edx, esi
push ecx
push edx
mov ecx, eax
call fcn.00442890
jmp 0x4403a7
xor eax, eax
mov esi, 1
mov dword [ebp + 0xd8], eax
mov dword [eax + 0x70], esi
mov ecx, dword [ebp + 0xd8]
push esi
push ebp
mov byte [esp + 0x2c], bl
call fcn.0046af30
mov edx, dword [ebp + 0xd8]
mov edi, str.Facial_Hair_Color
mov eax, dword [edx + 0xd0]
mov dword [edx + eax*4 + 0xe4], esi
mov ecx, dword [edx + 0xd0]
mov word [edx + ecx*2 + 0x274], 0x481
mov eax, dword [edx + 0xd0]
or ecx, 0xffffffff
lea eax, [eax + eax*4]
shl eax, 4
lea esi, [eax + edx + 0x33c]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [edx + 0xd0]
inc edi
mov dword [edx + 0xd0], edi
mov ecx, dword [ebp + 0xd8]
call fcn.00442f40
mov ecx, dword [ebp + 0xd8]
push 0xf0
mov dword [ecx + 0x9c], 0x186c5
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0x11
je 0x440499
mov edx, dword [ebp + 0x10c]
mov ecx, dword [ebp + 0x108]
push ebx
push 0x712
push 0x710
push 0x4a0c80
push ebx
push ebx
add edx, 0x136
push ebp
add ecx, 0x48
push edx
push ecx
mov ecx, eax
call fcn.0043ba10
jmp 0x44049b
xor eax, eax
mov edi, 1
mov dword [ebp + 0xb8], eax
mov dword [eax + 0xb0], 0x711
mov ecx, dword [ebp + 0xb8]
push edi
push ebp
mov byte [esp + 0x2c], bl
call fcn.0046af30
mov edx, dword [ebp + 0xb8]
mov esi, 0x186c6
push 0xf0
mov dword [edx + 0x70], edi
mov eax, dword [ebp + 0xb8]
mov dword [eax + 0x9c], esi
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0x12
je 0x440528
mov ecx, dword [ebp + 0x10c]
mov edx, dword [ebp + 0x108]
push ebx
push 0x70f
push 0x70d
push 0x4a0c80
push ebx
push ebx
add ecx, 0x136
push ebp
add edx, 0x48
push ecx
push edx
mov ecx, eax
call fcn.0043ba10
jmp 0x44052a
xor eax, eax
mov dword [ebp + 0xbc], eax
mov dword [eax + 0xb0], 0x70e
mov ecx, dword [ebp + 0xbc]
push edi
push ebp
mov byte [esp + 0x2c], bl
call fcn.0046af30
mov eax, dword [ebp + 0xbc]
push 0xf0
mov dword [eax + 0x70], ebx
mov ecx, dword [ebp + 0xbc]
mov dword [ecx + 0x9c], esi
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0x13
je 0x4405a2
push ebx
push 0x15a6
push 0x15a4
push 0x49e9e0
push ebx
push ebx
push ebp
push 0x1bd
push 0x262
mov ecx, eax
call fcn.0043ba10
mov esi, eax
jmp 0x4405a4
xor esi, esi
push edi
push ebp
mov ecx, esi
mov byte [esp + 0x2c], bl
mov dword [esi + 0xb0], 0x15a5
call fcn.0046af30
push 0xf0
mov dword [esi + 0x9c], 0x186cd
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0x14
je 0x440607
push ebx
push 0x15a3
push 0x15a1
push 0x49eb20
push ebx
push ebx
push ebp
push 0x1bd
push 0x24a
mov ecx, eax
call fcn.0043ba10
mov esi, eax
jmp 0x440609
xor esi, esi
push edi
push ebp
mov ecx, esi
mov byte [esp + 0x2c], bl
mov dword [esi + 0xb0], 0x15a2
call fcn.0046af30
push 0xf0
mov dword [esi + 0x9c], 0x186cc
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0x15
je 0x440669
push ebx
push 0x158e
push 0x158c
push 0x4a08f0
push ebx
push ebx
push ebp
push 0x10c
push 0xe
mov ecx, eax
call fcn.0043ba10
mov esi, eax
jmp 0x44066b
xor esi, esi
push edi
push ebp
mov ecx, esi
mov byte [esp + 0x2c], bl
mov dword [esi + 0xb0], 0x158d
mov dword [esi + 0xc8], edi
call fcn.0046af30
push 0xf0
mov dword [esi + 0x9c], 0x186a3
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0x16
je 0x4406d1
push ebx
push 0x1591
push 0x158f
push 0x4a0910
push ebx
push ebx
push ebp
push 0x92
push 0xe
mov ecx, eax
call fcn.0043ba10
mov esi, eax
jmp 0x4406d3
xor esi, esi
push edi
push ebp
mov ecx, esi
mov byte [esp + 0x2c], bl
mov dword [esi + 0xb0], 0x1590
mov dword [esi + 0xc8], ebx
call fcn.0046af30
push 0xf0
mov dword [esi + 0x9c], 0x186a0
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0x17
je 0x440739
push ebx
push 0x158b
push 0x1589
push 0x4a03a0
push ebx
push ebx
push ebp
push 4
push 0x22b
mov ecx, eax
call fcn.0043ba10
mov esi, eax
jmp 0x44073b
xor esi, esi
push edi
push ebp
mov ecx, esi
mov byte [esp + 0x2c], bl
mov dword [esi + 0xb0], 0x158a
call fcn.0046af30
push 0xf0
mov dword [esi + 0x9c], 0x186ab
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0x18
je 0x44079b
push ebx
push 0x1594
push 0x1592
push 0x4a0930
push ebx
push ebx
push ebp
push 0xcd
push 0xe
mov ecx, eax
call fcn.0043ba10
mov esi, eax
jmp 0x44079d
xor esi, esi
push edi
push ebp
mov ecx, esi
mov byte [esp + 0x2c], bl
mov dword [esi + 0xb0], 0x1593
call fcn.0046af30
push 0xf0
mov dword [esi + 0x9c], 0x186a1
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0x19
je 0x4407fd
push ebx
push 0x1597
push 0x1595
push 0x4a0950
push ebx
push ebx
push ebp
push 0x1b2
push 0xe
mov ecx, eax
call fcn.0043ba10
mov esi, eax
jmp 0x4407ff
xor esi, esi
push edi
push ebp
mov ecx, esi
mov byte [esp + 0x2c], bl
mov dword [esi + 0xb0], 0x1596
call fcn.0046af30
mov dword [esi + 0x9c], 0x186a2
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0x178]
test eax, eax
je 0x440891
push 0xf0
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0x1a
je 0x44086e
push ebx
push 0x1588
push 0x1586
push 0x4a07e0
push ebx
push ebx
push ebp
push 0x182
push 0xe
mov ecx, eax
call fcn.0043ba10
mov esi, eax
jmp 0x440870
xor esi, esi
push edi
push ebp
mov ecx, esi
mov byte [esp + 0x2c], bl
mov dword [esi + 0xb0], 0x1587
call fcn.0046af30
mov dword [esi + 0x9c], 0x186a5
push 0xf0
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x24], 0x1b
je 0x4408d0
push ebx
push 0x1585
push 0x1583
push 0x4a03d0
push ebx
push ebx
push ebp
push 0x19a
push 0xe
mov ecx, eax
call fcn.0043ba10
mov esi, eax
jmp 0x4408d2
xor esi, esi
push edi
push ebp
mov ecx, esi
mov byte [esp + 0x2c], bl
mov dword [esi + 0xb0], 0x1584
call fcn.0046af30
mov ecx, ebp
mov dword [esi + 0x9c], 0x186a6
call fcn.00440c60
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret