Function at 0x465090
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x4b557c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd4
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, ecx
mov dword [esp + 0x10], edi
call dword [sym.imp.winmm.dll_timeGetTime]
mov esi, eax
mov eax, dword [ebp + 0x72de8]
cmp eax, edi
mov dword [esp + 0x14], edi
jne 0x465277
cmp dword [ebp + 0x72de4], 1
jne 0x465277
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf8]
cmp ax, di
mov edx, 0x200
jne 0x46512a
cmp cx, di
mov eax, 0x2a0
jne 0x4651b9
cmp word [ebp + 0x7300c], ax
jle 0x465205
cmp word [ebp + 0x7300e], dx
jle 0x4651cc
push edi
push edi
push edi
push edi
push edi
push 8
jmp 0x465254
cmp ax, 0x280
jne 0x465205
cmp cx, di
jne 0x465170
mov eax, dword [ebp + 0x6ea9c]
movsx esi, word [ebp + 0x7300c]
movsx eax, word [eax + 0x93ab78]
sub eax, 0x15
shl eax, 5
cmp esi, eax
jge 0x4651de
cmp word [ebp + 0x7300e], dx
jle 0x4651de
push edi
push edi
push edi
push edi
push edi
push 2
jmp 0x465254
cmp cx, 0x1e0
jne 0x4651de
mov eax, dword [ebp + 0x6ea9c]
movsx ebx, word [ebp + 0x7300c]
movsx esi, word [eax + 0x93ab78]
sub esi, 0x15
shl esi, 5
cmp ebx, esi
jge 0x4651de
movsx eax, word [eax + 0x93ab7a]
movsx esi, word [ebp + 0x7300e]
sub eax, 0x10
shl eax, 5
cmp esi, eax
jge 0x4651de
push edi
push edi
push edi
push edi
push edi
push 4
jmp 0x465254
cmp cx, 0x1e0
jne 0x4651cc
push edi
push edi
push edi
push edi
push edi
push 6
jmp 0x465254
cmp word [ebp + 0x7300c], ax
jle 0x465205
push edi
push edi
push edi
push edi
push edi
push 7
jmp 0x465254
mov eax, dword [ebp + 0x6ea9c]
movsx esi, word [ebp + 0x7300c]
movsx eax, word [eax + 0x93ab78]
sub eax, 0x15
shl eax, 5
cmp esi, eax
jge 0x465205
push edi
push edi
push edi
push edi
push edi
push 3
jmp 0x465254
cmp cx, di
jne 0x465220
cmp word [ebp + 0x7300e], dx
jle case.0x4675d1.6
push edi
push edi
push edi
push edi
push edi
push 1
jmp 0x465254
cmp cx, 0x1e0
jne case.0x4675d1.6
mov ecx, dword [ebp + 0x6ea9c]
movsx eax, word [ebp + 0x7300e]
movsx edx, word [ecx + 0x93ab7a]
sub edx, 0x10
shl edx, 5
cmp eax, edx
jge case.0x4675d1.6
push edi
push edi
push edi
push edi
push edi
push 5
push edi
push 0x27b314d0
mov ecx, ebp
call fcn.00405900
mov dword [ebp + 0x72de8], 1
mov byte [ebp + 0x733f0], 0
jmp case.0x4675d1.6
mov eax, dword [ebp + 0x72de4]
mov ebx, 1
cmp eax, ebx
je case.0x4675d1.6
push 0x12
call dword [sym.imp.user32.dll_GetAsyncKeyState]
and eax, 0xffff8000
test ax, ax
je 0x4652a4
mov dword [ebp + 0x72de0], ebx
jmp 0x4652aa
mov dword [ebp + 0x72de0], edi
movsx eax, byte [ebp + 0xe]
mov ebx, dword [esp + 0xf8]
mov ecx, dword [esp + 0xf4]
cmp eax, 3
ja case.default.0x4652c1
jmp dword [eax*4 + 0x46800c]
mov al, byte [esp + 0x104]
test al, al
je 0x4653ba
push 1
push ebx
push ecx
mov ecx, ebp
call fcn.004371a0
cmp eax, 1
jne 0x4652f0
mov byte [ebp + 0xe], 2
jmp case.0x4675d1.6
cmp eax, edi
jne 0x4652fa
mov byte [ebp + 0xe], 1
jmp case.default.0x4652c1
cmp eax, 0xffffffff
je case.0x4675d1.6
lea ecx, [ebp + 0x725e8]
call fcn.004a6fd0
test eax, eax
je case.0x4675d1.6
sub esi, dword [ebp + 0x7257c]
cmp esi, 0x12c
jae 0x465840
mov ecx, dword [ebp + 0x6eaa0]
cmp ecx, edi
je 0x465338
mov edx, dword [ecx]
push 1
call dword [edx]
push edi
push 5
push 0xe
mov dword [ebp + 0x6eaa0], edi
push 0x45
mov ecx, ebp
mov dword [ebp + 0x72ac0], edi
call fcn.00446e60
cmp dword [ebp + 0x725f4], edi
je 0x465387
mov ecx, dword [ebp + 0x7c90]
push edi
call fcn.004a6080
cmp dword [ebp + 0x725f4], edi
je 0x465387
cmp dword [ebp + 0x725fc], 1
jne 0x465387
mov ecx, dword [ebp + 0x7f18]
cmp ecx, edi
je 0x465387
push edi
call fcn.004a6080
mov edi, 0x52bf5c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x465821
mov byte [ebp + 0x731c5], 0xff
mov byte [ebp + 0x7316d], al
mov eax, dword [ebp + 0x72578]
mov dword [ebp + 0x72584], eax
jmp case.0x4675d1.6
mov al, byte [esp + 0x108]
test al, al
je case.default.0x4652c1
push 2
push ebx
push ecx
mov ecx, ebp
call fcn.004371a0
cmp eax, 1
jmp 0x4652fd
mov al, byte [esp + 0x104]
test al, al
jne case.default.0x4652c1
mov byte [ebp + 0xe], 0
jmp case.default.0x4652c1
mov al, byte [esp + 0x104]
test al, al
jne 0x46546d
mov edx, dword [ebp + 0x1c]
mov edi, dword [esp + 0xf8]
mov ebx, dword [esp + 0xf4]
mov ecx, esi
sub ecx, edx
cmp ecx, 0x12c
jae 0x465433
cmp bx, word [ebp + 0x20]
jne 0x465433
cmp di, word [ebp + 0x22]
jne 0x465433
push edi
push ebx
mov ecx, ebp
call fcn.0040ee60
jmp 0x465444
push edi
push ebx
mov ecx, ebp
call fcn.0040e730
mov word [ebp + 0x20], bx
mov word [ebp + 0x22], di
mov dword [ebp + 0x1c], esi
mov byte [ebp + 0xe], 0
cmp byte [ebp + 0xf], 2
jne case.0x4675d1.6
push edi
push ebx
mov ecx, ebp
call fcn.0040f280
mov byte [ebp + 0xf], 0
mov word [ebp + 0x10], 0
jmp case.0x4675d1.6
mov dx, word [ebp + 0x72fd8]
mov ax, word [ebp + 0x72fd6]
mov ecx, dword [ebp + 0x6ea9c]
push edx
push eax
call fcn.004950f0
cmp eax, 1
jne 0x46549b
mov al, byte [ebp + 0x735ad]
test al, al
je case.default.0x4652c1
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf8]
cmp word [ebp + 0x12], ax
jne 0x4654b9
cmp word [ebp + 0x14], cx
je 0x46567b
mov byte [ebp + 0xe], 3
mov word [ebp + 0x12], ax
mov word [ebp + 0x14], cx
mov al, byte [ebp + 0xf]
cmp al, 1
jne case.0x4675d1.6
mov ax, word [ebp + 0x10]
cmp ax, 0x1e
je 0x4654e0
cmp ax, 0x1d
jne 0x4654e4
mov byte [ebp + 0xe], 0
cmp byte [ebp + 0xf], 1
jne case.0x4675d1.6
cmp word [ebp + 0x10], 7
jne 0x465563
cmp byte [ebp + 0x77e], 1
jne 0x465563
lea edx, [ebp + 0x730e9]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
mov dword [ebp + 0x72e1c], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x46555c
mov byte [ecx + ebp + 0x730e9], al
mov esi, dword [ebp + 0x72574]
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, edx
mov ebx, ecx
or ecx, 0xffffffff
add ebx, esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [edx], 0
mov byte [ebp + 0x77e], 0x14
cmp byte [ebp + 0xf], 1
jne case.0x4675d1.6
cmp word [ebp + 0x10], 0x11
jne case.0x4675d1.6
cmp byte [ebp + 0xfee], 1
jne case.0x4675d1.6
lea edx, [ebp + 0x730e9]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
mov dword [ebp + 0x72e1c], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4655e3
mov byte [ecx + ebp + 0x730e9], al
mov esi, dword [ebp + 0x72574]
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, edx
mov ebx, ecx
or ecx, 0xffffffff
add ebx, esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [edx], 0
mov byte [ebp + 0xfee], 0x14
jmp case.0x4675d1.6
mov al, byte [esp + 0x104]
test al, al
je 0x465696
mov cx, word [ebp + 0x72fd8]
mov dx, word [ebp + 0x72fd6]
push ecx
mov ecx, dword [ebp + 0x6ea9c]
push edx
call fcn.004950f0
cmp eax, 1
jne 0x46562c
mov al, byte [ebp + 0x735ad]
test al, al
je case.default.0x4652c1
mov al, byte [ebp + 0xf]
mov ecx, dword [esp + 0xf8]
mov edx, dword [esp + 0xf4]
cmp al, 1
jne 0x465673
movsx eax, word [ebp + 0x10]
mov si, dx
sub si, word [ebp + 0x16]
lea eax, [eax + eax*2]
lea eax, [eax + eax*8]
mov word [ebp + eax*8 + 0x10c], si
mov si, cx
movsx eax, word [ebp + 0x10]
sub si, word [ebp + 0x18]
lea eax, [eax + eax*2]
lea eax, [eax + eax*8]
mov word [ebp + eax*8 + 0x10e], si
mov word [ebp + 0x12], dx
mov word [ebp + 0x14], cx
mov al, byte [ebp + 0x733ea]
cmp al, 1
je case.0x4671d9.10
cmp al, 2
jne case.0x4675d1.6
jmp case.0x4671d9.10
mov al, byte [ebp + 0xf]
movsx ecx, al
dec ecx
je 0x4656db
dec ecx
je 0x4656b3
mov byte [ebp + 0xe], 0
mov byte [ebp + 0xf], 0
mov word [ebp + 0x10], di
jmp case.0x4675d1.6
mov ecx, dword [esp + 0xf8]
mov edx, dword [esp + 0xf4]
push ecx
push edx
mov ecx, ebp
call fcn.0040f280
mov byte [ebp + 0xe], 0
mov byte [ebp + 0xf], 0
mov word [ebp + 0x10], di
jmp case.0x4675d1.6
cmp al, 1
jne 0x465744
cmp word [ebp + 0x10], 7
jne 0x465744
cmp byte [ebp + 0x77e], 0x14
jne 0x465744
mov ax, word [ebp + 0x6f4]
mov cx, word [ebp + 0x6f6]
movsx eax, ax
movsx ecx, cx
add eax, 0x4b
mov dword [ebp + 0x72e1c], 1
mov dword [ebp + 0x72f38], eax
add ecx, 0x8c
lea edx, [ebp + 0x7339a]
lea eax, [ebp + 0x730e9]
mov dword [ebp + 0x72f3c], ecx
mov dword [ebp + 0x72574], edx
mov dword [eax], edi
mov byte [ebp + 0x730e8], 0x15
mov byte [ebp + 0x77e], 1
cmp byte [ebp + 0xf], 1
jne 0x4657ac
cmp word [ebp + 0x10], 0x11
jne 0x4657ac
cmp byte [ebp + 0xfee], 0x14
jne 0x4657ac
mov ax, word [ebp + 0xf64]
mov cx, word [ebp + 0xf66]
movsx edx, ax
movsx eax, cx
add edx, 0x28
mov dword [ebp + 0x72e1c], 1
mov dword [ebp + 0x72f38], edx
add eax, 0x39
lea ecx, [ebp + 0x731ac]
lea edx, [ebp + 0x730e9]
mov dword [ebp + 0x72f3c], eax
mov dword [ebp + 0x72574], ecx
mov dword [edx], edi
mov byte [ebp + 0x730e8], 0xb
mov byte [ebp + 0xfee], 1
cmp word [ebp + 0x10], 9
jne 0x465810
cmp word [esp + 0xf4], 0x140
jge 0x4657c8
mov word [ebp + 0x8a4], di
jmp 0x4657da
mov ax, 0x280
sub ax, word [ebp + 0x8a8]
mov word [ebp + 0x8a4], ax
cmp word [esp + 0xf8], 0xd5
jge 0x4657fe
mov word [ebp + 0x8a6], di
mov byte [ebp + 0xe], 0
mov byte [ebp + 0xf], 0
mov word [ebp + 0x10], di
jmp case.0x4675d1.6
mov cx, 0x1ab
sub cx, word [ebp + 0x8aa]
mov word [ebp + 0x8a6], cx
mov byte [ebp + 0xe], 0
mov byte [ebp + 0xf], 0
mov word [ebp + 0x10], di
jmp case.0x4675d1.6
mov byte [ebp + 0x731c5], 0
mov byte [ebp + 0x7316d], 0
mov ecx, dword [ebp + 0x72578]
mov dword [ebp + 0x72584], ecx
jmp case.0x4675d1.6
lea ecx, [ebp + 0x72e88]
call fcn.004a6fd0
test eax, eax
jle case.0x4675d1.6
cmp word [ebp + 0x72ffc], di
je 0x465868
mov byte [ebp + 0x733ea], 7
jmp case.0x4671d9.10
mov dx, word [ebp + 0x72fd8]
mov ax, word [ebp + 0x72fd6]
mov ecx, dword [ebp + 0x6ea9c]
push edx
push eax
call fcn.004950f0
cmp eax, 1
jne 0x465899
mov al, byte [ebp + 0x735ad]
test al, al
jne 0x465899
mov ecx, ebp
call fcn.00488070
mov al, byte [esp + 0x104]
test al, al
je 0x466e5c
lea edi, [ebp + 0x72ab0]
mov ecx, edi
call fcn.004a6fd0
cmp eax, 1
jne 0x465930
mov ax, word [ebp + 0x72fec]
xor esi, esi
cmp ax, si
jne 0x4658e6
cmp word [ebp + 0x72fee], si
jne 0x4658e6
movsx ecx, word [esp + 0x100]
movsx edx, word [esp + 0xfc]
push 0xffffffffffffffff
push ecx
jmp 0x4658f3
movsx ecx, word [ebp + 0x72fee]
push 0xffffffffffffffff
push ecx
movsx edx, ax
push edx
mov ecx, ebp
call fcn.00462310
lea eax, [esp + 0x1c]
lea ecx, [ebp + 0x725e8]
push eax
mov dword [esp + 0x20], esi
call fcn.004a6fb0
call dword [sym.imp.winmm.dll_timeGetTime]
lea ecx, [esp + 0x1c]
mov dword [ebp + 0x7257c], eax
push ecx
mov ecx, edi
mov dword [esp + 0x20], esi
call fcn.004a6fb0
jmp case.0x4675d1.6
lea eax, [ebp + 0x73018]
lea edx, [esp + 0x20]
push eax
push edx
mov dx, word [ebp + 0x72fee]
lea eax, [esp + 0x22]
lea ecx, [esp + 0x34]
push eax
dec dx
push ecx
mov ecx, dword [ebp + 0x6ea9c]
push edx
mov dx, word [ebp + 0x72fec]
call fcn.0049c720
lea edx, [ebp + 0x732ad]
lea esi, [ebp + 0x733b0]
mov ecx, 5
mov edi, edx
xor eax, eax
repe cmpsw word [esi], word es:[edi]
jne 0x465b5d
cmp word [esp + 0x1a], 6
jle 0x4659d2
mov esi, dword [ebp + 0x6ea9c]
movsx eax, word [ebp + 0x72fd6]
movsx ecx, word [esi + 0x93ab80]
sub eax, ecx
lea ecx, [eax*8]
sub ecx, eax
lea eax, [ecx + ecx*4]
movsx ecx, word [esi + 0x93ab82]
sub eax, ecx
movsx ecx, word [ebp + 0x72fd8]
add eax, ecx
mov ecx, eax
shl ecx, 4
add ecx, eax
cmp word [esi + ecx*8 + 0xb54], 0
je 0x465b5d
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl case.0x4671d9.10
cmp ax, 6
jg case.0x4671d9.10
mov byte [ebp + 0x733ea], 5
mov dx, word [ebp + 0x72fd6]
mov word [ebp + 0x72ff0], dx
mov ax, word [ebp + 0x72fd8]
mov word [ebp + 0x72ff2], ax
mov al, byte [ebp + 0x733ea]
test al, al
je case.0x4675d1.6
lea ecx, [ebp + 0x72e88]
call fcn.004a6fd0
test eax, eax
jle case.0x4675d1.6
cmp byte [ebp + 0x735ad], 5
jne 0x465a42
push 0
push 0xa
push 0x4c2d14
mov ecx, ebp
call fcn.004117a0
lea ecx, [ebp + 0x725e8]
xor esi, esi
call fcn.004a6fd0
test eax, eax
je case.0x4675d1.6
cmp byte [ebp + 0x735ad], 6
jge case.0x4675d1.6
mov ax, word [ebp + 0x72fdc]
cmp ax, si
jl 0x465a8f
cmp ax, 6
jle 0x465a8f
mov al, byte [ebp + 0x733ea]
cmp al, 2
je 0x465a88
cmp al, 3
jle 0x465a8f
cmp al, 5
jg 0x465a8f
mov byte [ebp + 0x733ea], 0
lea edi, [ebp + 0x72dc4]
mov ecx, edi
call fcn.004a6fd0
cmp eax, 1
jne 0x465af8
push eax
push 0xa
push 0x4c1f1c
mov ecx, ebp
call fcn.004117a0
push 0x18
mov ecx, ebp
call fcn.00439d10
push 0x1a
mov ecx, ebp
call fcn.00439d10
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x465af8
cmp ax, 6
jg 0x465af8
mov byte [ebp + 0x733ea], 0
mov cx, word [ebp + 0x72fd6]
mov word [ebp + 0x72ff0], cx
mov dx, word [ebp + 0x72fd8]
mov word [ebp + 0x72ff2], dx
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
mov dword [esp + 0x20], esi
call fcn.004a6fb0
cmp word [ebp + 0x72ffc], si
je 0x4675c0
mov byte [ebp + 0x733ea], 7
mov cx, word [ebp + 0x72fd6]
mov word [ebp + 0x72ff0], cx
mov ax, word [ebp + 0x72fd8]
mov word [ebp + 0x72ff2], ax
movsx ecx, word [ebp + 0x72ffc]
dec ecx
cmp ecx, 7
ja case.default.0x465b49
jmp dword [ecx*4 + 0x46801c]
dec eax
mov word [ebp + 0x72ff2], ax
jmp case.default.0x465b49
mov edi, edx
mov ecx, 5
lea esi, [ebp + 0x733b0]
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x465b78
dec word [ebp + 0x72fee]
mov dx, word [ebp + 0x72fec]
test dx, dx
je 0x466dec
mov ax, word [ebp + 0x72fee]
test ax, ax
je 0x466dec
mov ecx, dword [ebp + 0x72ac4]
cmp ecx, 1
lea ecx, [ebp + 0x73018]
push ecx
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x22]
push ecx
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [ebp + 0x6ea9c]
push eax
jne 0x466318
call fcn.0049c720
test byte [esp + 0x20], 0x10
jne case.0x4675d1.6
mov ax, word [esp + 0x1a]
cmp ax, 0xf
je case.0x4675d1.6
cmp ax, 0x14
je case.0x4675d1.6
cmp ax, 0x18
je case.0x4675d1.6
cmp ax, 0x5a
je case.0x4675d1.6
cmp ax, 0x43
je case.0x4675d1.6
cmp ax, 0x44
je case.0x4675d1.6
cmp ax, 0x45
je case.0x4675d1.6
cmp ax, 0x42
je 0x465c37
cmp ax, 0x49
je 0x465c37
cmp ax, 0x51
je 0x465c37
cmp ax, 0x5b
jne 0x465c3f
mov dword [esp + 0x10], 1
mov ax, word [ebp + 0x72fe0]
sar eax, 4
and eax, 0xff
cmp ax, 0xf
jne 0x465c59
add dword [esp + 0x10], 2
movsx edx, word [ebp + 0x72fec]
movsx eax, word [ebp + 0x72fd6]
sub eax, edx
mov word [ebp + 0xc], 3
cdq
mov ecx, eax
movsx eax, word [ebp + 0x72fd8]
xor ecx, edx
sub ecx, edx
movsx edx, word [ebp + 0x72fee]
sub eax, edx
mov byte [esp + 0x25], cl
cdq
mov ebx, eax
mov eax, dword [esp + 0x10]
xor ebx, edx
movsx esi, cl
sub ebx, edx
inc eax
cmp esi, eax
jg 0x465ca8
movsx ecx, bl
cmp ecx, eax
jle 0x467192
mov ecx, ebp
call fcn.004495a0
add eax, 0xfffffffb
cmp eax, 0x10
ja case.0x4671d9.10
xor ecx, ecx
mov cl, byte [eax + 0x46805c]
jmp dword [ecx*4 + 0x46803c]
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 2]
cmp esi, eax
jne 0x465cdc
movsx edx, bl
cmp edx, eax
je 0x465cf2
cmp esi, ecx
jne 0x465ce7
movsx edx, bl
cmp edx, eax
je 0x465cf2
cmp esi, eax
jne 0x465d49
movsx eax, bl
cmp eax, ecx
jne 0x465d49
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x465d0a
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466297
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466297
mov ecx, ebp
call fcn.004495a0
cmp byte [eax + ebp + 0x7353a], 0x64
jne 0x466268
mov ecx, ebp
mov byte [ebp + 0x733ea], 8
call fcn.004493d0
mov dword [esp + 0x14], eax
jmp 0x466276
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x465d61
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466dbd
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466dbd
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x466dbd
cmp ax, 6
jg 0x466dbd
mov byte [ebp + 0x733ea], 2
jmp 0x466dc4
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 3]
cmp esi, eax
jg 0x465dc4
movsx edx, bl
cmp edx, eax
jg 0x465dc4
mov eax, dword [ebp + 0x72f10]
test eax, eax
jle 0x465dc4
cmp dword [ebp + 0x72de0], 1
je case.0x467033.6
lea eax, [ecx + 2]
cmp esi, eax
jne 0x465dd2
movsx edx, bl
cmp edx, eax
je 0x465de8
cmp esi, ecx
jne 0x465ddd
movsx edx, bl
cmp edx, eax
je 0x465de8
cmp esi, eax
jne 0x465e3f
movsx eax, bl
cmp eax, ecx
jne 0x465e3f
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x465e00
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466297
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466297
mov ecx, ebp
call fcn.004495a0
cmp byte [eax + ebp + 0x7353a], 0x64
jne 0x466268
mov ecx, ebp
mov byte [ebp + 0x733ea], 8
call fcn.004493d0
mov dword [esp + 0x14], eax
jmp 0x466276
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x465e57
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466dbd
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466dbd
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x466dbd
cmp ax, 6
jg 0x466dbd
mov byte [ebp + 0x733ea], 2
jmp 0x466dc4
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 4]
cmp esi, eax
jg 0x465eba
movsx edx, bl
cmp edx, eax
jg 0x465eba
mov eax, dword [ebp + 0x72f10]
test eax, eax
jle 0x465eba
cmp dword [ebp + 0x72de0], 1
je case.0x467033.6
lea eax, [ecx + 2]
cmp esi, eax
jne 0x465ec8
movsx edx, bl
cmp edx, eax
je 0x465f24
mov al, byte [esp + 0x25]
test al, al
jne 0x465f1c
cmp bl, 2
je 0x465f24
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x465eed
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x465f8a
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x465f8a
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x465f8a
cmp ax, 6
jg 0x465f8a
mov byte [ebp + 0x733ea], 2
jmp 0x465f91
cmp al, 2
jne 0x465ed5
test bl, bl
jne 0x465ed5
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x465f3c
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466dbd
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466dbd
mov ecx, ebp
call fcn.004495a0
cmp byte [eax + ebp + 0x7353a], 0x64
jne 0x465f77
mov ecx, ebp
mov byte [ebp + 0x733ea], 8
call fcn.004493d0
mov dword [esp + 0x14], eax
jmp 0x466ff7
mov ecx, ebp
mov byte [ebp + 0x733ea], 2
call fcn.00437070
jmp 0x466ff7
mov byte [ebp + 0x733ea], 1
mov cx, word [ebp + 0x72fec]
mov word [ebp + 0x72ff0], cx
mov dx, word [ebp + 0x72fee]
mov ecx, ebp
mov word [ebp + 0x72ff2], dx
call fcn.00437070
jmp case.0x4671d9.10
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 2]
cmp esi, eax
jg 0x465fed
movsx edx, bl
cmp edx, eax
jg 0x465fe2
mov edx, dword [ebp + 0x72f10]
test edx, edx
jle 0x465fe2
cmp dword [ebp + 0x72de0], 1
je case.0x467033.6
cmp esi, eax
jne 0x465fed
movsx edx, bl
cmp edx, eax
je 0x466003
cmp esi, ecx
jne 0x465ff8
movsx edx, bl
cmp edx, eax
je 0x466003
cmp esi, eax
jne 0x46605a
movsx eax, bl
cmp eax, ecx
jne 0x46605a
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x46601b
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466297
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466297
mov ecx, ebp
call fcn.004495a0
cmp byte [eax + ebp + 0x7353a], 0x64
jne 0x466268
mov ecx, ebp
mov byte [ebp + 0x733ea], 8
call fcn.004493d0
mov dword [esp + 0x14], eax
jmp 0x466276
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x466072
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466dbd
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466dbd
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x466dbd
cmp ax, 6
jg 0x466dbd
mov byte [ebp + 0x733ea], 2
jmp 0x466dc4
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 2]
cmp esi, eax
jg 0x46610f
movsx edx, bl
cmp edx, eax
jg 0x466104
mov edx, dword [ebp + 0x72f10]
test edx, edx
jle 0x466104
cmp dword [ebp + 0x72de0], 1
jne 0x466104
mov byte [ebp + 0x733ea], 3
mov ax, word [ebp + 0x72fec]
mov word [ebp + 0x72ff0], ax
mov cx, word [ebp + 0x72fee]
mov word [ebp + 0x72ff2], cx
mov ecx, ebp
call fcn.004493d0
mov dword [esp + 0x14], eax
jmp case.0x4671d9.10
cmp esi, eax
jne 0x46610f
movsx edx, bl
cmp edx, eax
je 0x466125
cmp esi, ecx
jne 0x46611a
movsx edx, bl
cmp edx, eax
je 0x466125
cmp esi, eax
jne 0x46617c
movsx eax, bl
cmp eax, ecx
jne 0x46617c
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x46613d
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466297
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466297
mov ecx, ebp
call fcn.004495a0
cmp byte [eax + ebp + 0x7353a], 0x64
jne 0x466268
mov ecx, ebp
mov byte [ebp + 0x733ea], 8
call fcn.004493d0
mov dword [esp + 0x14], eax
jmp 0x466276
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x466194
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466dbd
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466dbd
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x466dbd
cmp ax, 6
jg 0x466dbd
mov byte [ebp + 0x733ea], 2
jmp 0x466dc4
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 2]
cmp esi, eax
jg 0x466202
movsx edx, bl
cmp edx, eax
jg 0x4661f7
mov edx, dword [ebp + 0x72f10]
test edx, edx
jle 0x4661f7
cmp dword [ebp + 0x72de0], 1
je case.0x467033.6
cmp esi, eax
jne 0x466202
movsx edx, bl
cmp edx, eax
je 0x466220
cmp esi, ecx
jne 0x46620d
movsx edx, bl
cmp edx, eax
je 0x466220
cmp esi, eax
jne 0x4662c6
movsx eax, bl
cmp eax, ecx
jne 0x4662c6
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x466234
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466297
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466297
mov ecx, ebp
call fcn.004495a0
cmp byte [eax + ebp + 0x7353a], 0x64
jne 0x466268
mov ecx, ebp
mov byte [ebp + 0x733ea], 8
call fcn.004493d0
mov dword [esp + 0x14], eax
jmp 0x466276
mov ecx, ebp
mov byte [ebp + 0x733ea], 2
call fcn.00437070
mov cx, word [ebp + 0x72fec]
mov word [ebp + 0x72ff0], cx
mov dx, word [ebp + 0x72fee]
mov word [ebp + 0x72ff2], dx
jmp case.0x4671d9.10
mov byte [ebp + 0x733ea], 1
mov ax, word [ebp + 0x72fec]
mov word [ebp + 0x72ff0], ax
mov cx, word [ebp + 0x72fee]
mov word [ebp + 0x72ff2], cx
mov ecx, ebp
call fcn.00437070
jmp case.0x4671d9.10
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x4662de
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466dbd
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466dbd
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x466dbd
cmp ax, 6
jg 0x466dbd
mov byte [ebp + 0x733ea], 2
jmp 0x466dc4
call fcn.0049c720
mov cx, word [esp + 0x1a]
cmp cx, 0x42
je 0x46633a
cmp cx, 0x49
je 0x46633a
cmp cx, 0x51
je 0x46633a
cmp cx, 0x5b
jne 0x466342
mov dword [esp + 0x10], 1
mov ax, word [ebp + 0x72fe0]
sar eax, 4
and eax, 0xff
cmp ax, 0xf
jne 0x46635c
add dword [esp + 0x10], 2
cmp cx, 0xa
jge 0x4663c0
cmp cx, 1
jl 0x46636e
cmp cx, 6
jle 0x4663c0
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x466386
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466dbd
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466dbd
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x466dbd
cmp ax, 6
jg 0x466dbd
mov byte [ebp + 0x733ea], 2
jmp 0x466dc4
movsx eax, cx
add eax, 0xfffffff1
cmp eax, 0x4b
ja case.0x4663d7.25
xor ecx, ecx
mov cl, byte [eax + 0x46809c]
jmp dword [ecx*4 + 0x468070]
cmp byte [esp + 0x2c], 0x31
jne case.0x4671d9.10
push 0
push 1
push 0xb
push 5
push 0x14
mov ecx, ebp
call fcn.00438f60
mov edx, dword [esp + 0xf4]
add ebx, 0xffffffce
lea eax, [edx - 0x75]
test ax, ax
jge 0x46640e
xor eax, eax
movsx ecx, ax
add ecx, 0xeb
cmp ecx, 0x27f
jle 0x466424
mov eax, 0x194
test bx, bx
jge 0x46642b
xor ebx, ebx
movsx edx, bx
add edx, 0x64
cmp edx, 0x1df
jle 0x46643e
mov ebx, 0x17b
mov word [ebp + 0x11ec], ax
mov word [ebp + 0x11ee], bx
mov dword [ebp + 0x11ac], 0xf
jmp case.0x4671d9.10
cmp byte [esp + 0x2c], 0x31
jne case.0x4671d9.10
push 0
push 0
push 0x10
push 0
push 0x14
mov ecx, ebp
call fcn.00438f60
mov eax, dword [esp + 0xf4]
add ebx, 0xffffffce
add eax, 0xffffff8b
test ax, ax
jge 0x46648b
xor eax, eax
movsx ecx, ax
add ecx, 0xeb
cmp ecx, 0x27f
jle 0x4664a1
mov eax, 0x194
test bx, bx
jge 0x4664a8
xor ebx, ebx
movsx edx, bx
add edx, 0x64
cmp edx, 0x1df
jle 0x4664bb
mov ebx, 0x17b
mov word [ebp + 0x11ec], ax
mov word [ebp + 0x11ee], bx
mov dword [ebp + 0x11ac], 0x13
jmp case.0x4671d9.10
cmp byte [esp + 0x2c], 0x31
jne case.0x4671d9.10
push 0
push 0
push 0xe
mov esi, 0x14
push 0
push esi
mov ecx, ebp
call fcn.00438f60
mov eax, dword [esp + 0xf4]
add ebx, 0xffffffce
add eax, 0xffffff8b
test ax, ax
jge 0x46650c
xor eax, eax
movsx ecx, ax
add ecx, 0xeb
cmp ecx, 0x27f
jle 0x466522
mov eax, 0x194
test bx, bx
jge 0x466529
xor ebx, ebx
movsx edx, bx
add edx, 0x64
cmp edx, 0x1df
jle 0x46653c
mov ebx, 0x17b
mov word [ebp + 0x11ec], ax
mov word [ebp + 0x11ee], bx
mov dword [ebp + 0x11ac], esi
mov dword [ebp + 0x21b4], esi
jmp 0x4665d7
cmp byte [esp + 0x2c], 0x31
jne case.0x4671d9.10
push 0
push 2
push 0xb
push 5
push 0x14
mov ecx, ebp
call fcn.00438f60
mov eax, dword [esp + 0xf4]
add ebx, 0xffffffce
add eax, 0xffffff8b
test ax, ax
jge 0x466588
xor eax, eax
movsx ecx, ax
add ecx, 0xeb
cmp ecx, 0x27f
jle 0x46659e
mov eax, 0x194
test bx, bx
jge 0x4665a5
xor ebx, ebx
movsx edx, bx
add edx, 0x64
cmp edx, 0x1df
jle 0x4665b8
mov ebx, 0x17b
mov word [ebp + 0x11ec], ax
mov eax, 0x18
mov word [ebp + 0x11ee], bx
mov dword [ebp + 0x11ac], eax
mov dword [ebp + 0x21b4], eax
movsx ecx, word [ebp + 0x72fec]
movsx edx, word [ebp + 0x72fee]
xor eax, eax
mov dword [ebp + 0x21bc], ecx
mov ax, word [ebp + 0x73018]
mov dword [ebp + 0x21c0], edx
mov dword [ebp + 0x21b8], eax
jmp case.0x4671d9.10
cmp byte [esp + 0x2c], 0x31
jne case.0x4671d9.10
push 0
push 0
push 0xd
push 0
push 0x14
mov ecx, ebp
call fcn.00438f60
mov eax, dword [esp + 0xf4]
add ebx, 0xffffffce
add eax, 0xffffff8b
test ax, ax
jge 0x466635
xor eax, eax
movsx ecx, ax
add ecx, 0xeb
cmp ecx, 0x27f
jle 0x46664b
mov eax, 0x194
test bx, bx
jge 0x466652
xor ebx, ebx
movsx edx, bx
add edx, 0x64
cmp edx, 0x1df
jle 0x466665
mov ebx, 0x17b
mov word [ebp + 0x11ec], ax
mov word [ebp + 0x11ee], bx
mov dword [ebp + 0x11ac], 0x19
jmp case.0x4671d9.10
cmp byte [esp + 0x2c], 0x31
jne case.0x4671d9.10
push 0
push 0
push 7
push 0
push 0x14
mov ecx, ebp
call fcn.00438f60
mov eax, dword [esp + 0xf4]
add ebx, 0xffffffce
add eax, 0xffffff8b
test ax, ax
jge 0x4666b2
xor eax, eax
movsx ecx, ax
add ecx, 0xeb
cmp ecx, 0x27f
jle 0x4666c8
mov eax, 0x194
test bx, bx
jge 0x4666cf
xor ebx, ebx
movsx edx, bx
add edx, 0x64
cmp edx, 0x1df
jle 0x4666e2
mov ebx, 0x17b
mov word [ebp + 0x11ec], ax
mov word [ebp + 0x11ee], bx
mov dword [ebp + 0x11ac], 0x1a
jmp case.0x4671d9.10
mov eax, dword [esp + 0x20]
mov ecx, ebp
push eax
call fcn.0044ad00
cmp eax, 1
jne case.0x4671d9.10
mov eax, dword [ebp + 0x72db8]
test eax, eax
jne case.0x4671d9.10
push 0
push 0
push 0
push 4
push 0x14
mov ecx, ebp
call fcn.00438f60
mov ecx, dword [esp + 0xf4]
add ebx, 0xffffffce
lea eax, [ecx - 0x75]
test ax, ax
jge 0x466747
xor eax, eax
movsx edx, ax
add edx, 0xeb
cmp edx, 0x27f
jle 0x46675d
mov eax, 0x194
test bx, bx
jge 0x466764
xor ebx, ebx
movsx ecx, bx
add ecx, 0x64
cmp ecx, 0x1df
jle 0x466777
mov ebx, 0x17b
mov word [ebp + 0x11ec], ax
mov word [ebp + 0x11ee], bx
mov dword [ebp + 0x11ac], 0x15
jmp case.0x4671d9.10
mov eax, dword [ebp + 0x72db8]
test eax, eax
jne case.0x4671d9.10
push 0
push 0
push 0
push 4
push 0x14
mov ecx, ebp
call fcn.00438f60
mov edx, dword [esp + 0xf4]
add ebx, 0xffffffce
lea eax, [edx - 0x75]
test ax, ax
jge 0x4667c7
xor eax, eax
movsx ecx, ax
add ecx, 0xeb
cmp ecx, 0x27f
jle 0x4667dd
mov eax, 0x194
test bx, bx
jge 0x4667e4
xor ebx, ebx
movsx edx, bx
add edx, 0x64
cmp edx, 0x1df
jle 0x4667f7
mov ebx, 0x17b
mov word [ebp + 0x11ec], ax
mov word [ebp + 0x11ee], bx
movsx eax, word [esp + 0x1a]
mov dword [ebp + 0x11ac], eax
jmp case.0x4671d9.10
push 0
push 0
push 0x2e
push 0
push 0x14
mov ecx, ebp
call fcn.00438f60
mov ecx, dword [esp + 0xf4]
add ebx, 0xffffffce
lea eax, [ecx - 0x75]
test ax, ax
jge 0x46683a
xor eax, eax
movsx edx, ax
add edx, 0xeb
cmp edx, 0x27f
jle 0x466850
mov eax, 0x194
test bx, bx
jge 0x466857
xor ebx, ebx
movsx ecx, bx
add ecx, 0x64
cmp ecx, 0x1df
jle 0x46686a
mov ebx, 0x17b
movsx edx, word [esp + 0x1a]
mov word [ebp + 0x11ec], ax
mov word [ebp + 0x11ee], bx
mov dword [ebp + 0x11ac], edx
jmp case.0x4671d9.10
mov eax, dword [ebp + 0x72db8]
test eax, eax
jne case.0x4671d9.10
push 0
push 0
push 0
push 4
push 0x14
mov ecx, ebp
call fcn.00438f60
mov eax, dword [esp + 0xf4]
add ebx, 0xffffffce
add eax, 0xffffff8b
test ax, ax
jge 0x4668bb
xor eax, eax
movsx ecx, ax
add ecx, 0xeb
cmp ecx, 0x27f
jle 0x4668d1
mov eax, 0x194
test bx, bx
jge 0x4668d8
xor ebx, ebx
movsx edx, bx
add edx, 0x64
cmp edx, 0x1df
jle 0x4668eb
mov ebx, 0x17b
mov word [ebp + 0x11ec], ax
mov word [ebp + 0x11ee], bx
mov dword [ebp + 0x11ac], 0x20
jmp case.0x4671d9.10
mov eax, dword [esp + 0x20]
mov ecx, ebp
push eax
call fcn.0044ad00
test eax, eax
jge case.0x4671d9.10
mov ax, word [esp + 0x1a]
cmp ax, 1
jl 0x46693b
cmp ax, 6
jg 0x46693b
mov eax, dword [ebp + 0x72e60]
test eax, eax
je case.0x4671d9.10
movsx ecx, word [ebp + 0x72fec]
movsx eax, word [ebp + 0x72fd6]
sub eax, ecx
cdq
mov ecx, eax
movsx eax, word [ebp + 0x72fd8]
xor ecx, edx
sub ecx, edx
movsx edx, word [ebp + 0x72fee]
sub eax, edx
cdq
mov ebx, eax
mov eax, dword [esp + 0x10]
movsx esi, cl
xor ebx, edx
lea edi, [eax + 1]
sub ebx, edx
cmp esi, edi
jg 0x466982
movsx ecx, bl
cmp ecx, edi
jle 0x467192
mov ecx, ebp
call fcn.004495a0
add eax, 0xfffffffb
cmp eax, 0x10
ja case.0x4671d9.10
xor ecx, ecx
mov cl, byte [eax + 0x468108]
jmp dword [ecx*4 + 0x4680e8]
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x4669bc
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x465f8a
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x465f8a
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x465f8a
cmp ax, 6
jg 0x465f8a
mov byte [ebp + 0x733ea], 2
jmp 0x465f91
mov eax, dword [esp + 0x10]
add eax, 3
cmp esi, eax
jg 0x466a86
movsx ecx, bl
cmp ecx, eax
jg 0x466a86
mov eax, dword [ebp + 0x72f10]
test eax, eax
jle 0x466a86
cmp dword [ebp + 0x72de0], 1
jne 0x466a86
cmp esi, edi
jg 0x466a53
cmp ecx, edi
jg 0x466a53
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x466a3b
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466a53
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466a53
mov byte [ebp + 0x733ea], 8
jmp 0x466a5a
mov byte [ebp + 0x733ea], 3
mov cx, word [ebp + 0x72fec]
mov word [ebp + 0x72ff0], cx
mov dx, word [ebp + 0x72fee]
mov ecx, ebp
mov word [ebp + 0x72ff2], dx
call fcn.004493d0
mov dword [esp + 0x14], eax
jmp case.0x4671d9.10
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x466a9e
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466297
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466297
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x466297
cmp ax, 6
jg 0x466297
mov byte [ebp + 0x733ea], 2
jmp 0x46629e
mov edx, dword [esp + 0x10]
lea eax, [edx + 4]
cmp esi, eax
jg 0x466b44
movsx ecx, bl
cmp ecx, eax
jg 0x466b44
mov eax, dword [ebp + 0x72f10]
test eax, eax
jle 0x466b44
cmp dword [ebp + 0x72de0], 1
jne 0x466b44
cmp esi, edi
jg case.0x467033.6
cmp ecx, edi
jg case.0x467033.6
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x466b25
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je case.0x467033.6
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle case.0x467033.6
mov byte [ebp + 0x733ea], 8
jmp 0x4660d8
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x466b5c
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466dbd
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466dbd
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x466dbd
cmp ax, 6
jg 0x466dbd
mov byte [ebp + 0x733ea], 2
jmp 0x466dc4
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 2]
cmp esi, eax
jg 0x466c02
movsx ecx, bl
cmp ecx, eax
jg 0x466c02
mov eax, dword [ebp + 0x72f10]
test eax, eax
jle 0x466c02
cmp dword [ebp + 0x72de0], 1
jne 0x466c02
cmp esi, edi
jg case.0x4671d9.6
cmp ecx, edi
jg case.0x4671d9.6
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x466be3
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je case.0x4671d9.6
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle case.0x4671d9.6
mov byte [ebp + 0x733ea], 8
jmp 0x4671e7
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x466c1a
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x465f8a
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x465f8a
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x465f8a
cmp ax, 6
jg 0x465f8a
mov byte [ebp + 0x733ea], 2
jmp 0x465f91
mov eax, dword [esp + 0x10]
add eax, 2
cmp esi, eax
jg 0x466cc0
movsx ecx, bl
cmp ecx, eax
jg 0x466cc0
mov eax, dword [ebp + 0x72f10]
test eax, eax
jle 0x466cc0
cmp dword [ebp + 0x72de0], 1
jne 0x466cc0
cmp esi, edi
jg 0x466a53
cmp ecx, edi
jg 0x466a53
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x466ca1
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466a53
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466a53
mov byte [ebp + 0x733ea], 8
jmp 0x466a5a
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x466cd8
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466297
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466297
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x466297
cmp ax, 6
jg 0x466297
mov byte [ebp + 0x733ea], 2
jmp 0x46629e
mov edx, dword [esp + 0x10]
lea eax, [edx + 2]
cmp esi, eax
jg 0x466d7e
movsx ecx, bl
cmp ecx, eax
jg 0x466d7e
mov eax, dword [ebp + 0x72f10]
test eax, eax
jle 0x466d7e
cmp dword [ebp + 0x72de0], 1
jne 0x466d7e
cmp esi, edi
jg case.0x467033.6
cmp ecx, edi
jg case.0x467033.6
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x466d5f
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je case.0x467033.6
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle case.0x467033.6
mov byte [ebp + 0x733ea], 8
jmp 0x4660d8
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x466d92
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466dbd
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466dbd
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x466dbd
cmp ax, 6
jg 0x466dbd
mov byte [ebp + 0x733ea], 2
jmp 0x466dc4
mov byte [ebp + 0x733ea], 1
mov dx, word [ebp + 0x72fec]
mov ecx, ebp
mov word [ebp + 0x72ff0], dx
mov ax, word [ebp + 0x72fee]
mov word [ebp + 0x72ff2], ax
call fcn.00437070
jmp case.0x4671d9.10
mov eax, dword [ebp + 0x72acc]
test eax, eax
jne 0x466e00
mov eax, dword [ebp + 0x72ac8]
test eax, eax
je 0x466e2b
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
test eax, eax
jle 0x466e2b
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x466e2b
cmp ax, 6
jg 0x466e2b
mov byte [ebp + 0x733ea], 2
jmp 0x466e32
mov byte [ebp + 0x733ea], 1
mov cx, word [esp + 0xfc]
mov dx, word [esp + 0x100]
mov word [ebp + 0x72ff0], cx
mov ecx, ebp
mov word [ebp + 0x72ff2], dx
call fcn.00437070
jmp case.0x4671d9.10
mov al, byte [esp + 0x108]
test al, al
je case.0x4671d9.10
lea edi, [ebp + 0x72ab0]
mov byte [ebp + 0x733ea], 0
mov ecx, edi
call fcn.004a6fd0
cmp eax, 1
jne 0x466ea8
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
mov dword [esp + 0x20], 0
call fcn.004a6fb0
push 1
push 0xa
push 0x4bef44
mov ecx, ebp
call fcn.004117a0
lea esi, [ebp + 0x725e8]
mov ecx, esi
call fcn.004a6fd0
test eax, eax
je case.0x4675d1.6
cmp byte [ebp + 0x735ad], 6
jge case.0x4675d1.6
mov di, word [ebp + 0x72fec]
test di, di
je 0x467250
mov cx, word [ebp + 0x72fee]
test cx, cx
je 0x467250
movsx eax, word [ebp + 0x72fd6]
movsx edx, di
sub eax, edx
cdq
mov ebx, eax
movsx eax, word [ebp + 0x72fd8]
xor ebx, edx
sub ebx, edx
movsx edx, cx
sub eax, edx
cdq
xor eax, edx
sub eax, edx
test bl, bl
mov dword [esp + 0x1c], eax
jne 0x466f1e
test al, al
je case.0x4675d1.6
mov eax, dword [ebp + 0x72ac4]
mov esi, 1
cmp eax, esi
jne 0x4670b2
lea eax, [ebp + 0x73018]
lea edx, [esp + 0x20]
push eax
push edx
lea eax, [esp + 0x22]
lea edx, [esp + 0x34]
push eax
push edx
push ecx
mov ecx, dword [ebp + 0x6ea9c]
mov edx, edi
call fcn.0049c720
test byte [esp + 0x20], 0x10
jne case.0x4675d1.6
mov ax, word [esp + 0x1a]
cmp ax, 0xf
je case.0x4675d1.6
cmp ax, 0x14
je case.0x4675d1.6
cmp ax, 0x18
je case.0x4675d1.6
cmp ax, 0x43
je case.0x4675d1.6
cmp ax, 0x44
je case.0x4675d1.6
cmp ax, 0x45
je case.0x4675d1.6
cmp ax, 0x42
je 0x466fb9
cmp ax, 0x49
je 0x466fb9
cmp ax, 0x51
je 0x466fb9
cmp ax, 0x5b
jne 0x466fbd
mov edi, esi
jmp 0x466fc1
mov edi, dword [esp + 0x10]
mov ax, word [ebp + 0x72fe0]
sar eax, 4
and eax, 0xff
cmp ax, 0xf
jne 0x466fd9
add edi, 2
cmp bl, 1
jg 0x467018
cmp byte [esp + 0x1c], 1
jg 0x467018
mov ecx, ebp
call fcn.004493d0
mov dword [esp + 0x14], eax
mov byte [ebp + 0x733ea], 3
mov ax, word [ebp + 0x72fec]
mov word [ebp + 0x72ff0], ax
mov cx, word [ebp + 0x72fee]
mov word [ebp + 0x72ff2], cx
jmp case.0x4671d9.10
mov ecx, ebp
call fcn.004495a0
add eax, 0xfffffffa
cmp eax, 0xf
ja case.0x4671d9.10
xor edx, edx
mov dl, byte [eax + 0x468134]
jmp dword [edx*4 + 0x46811c]
lea eax, [edi + 3]
movsx edx, bl
cmp edx, eax
jg case.0x4671d9.10
movsx ecx, byte [esp + 0x1c]
cmp ecx, eax
jg case.0x4671d9.10
mov eax, dword [ebp + 0x72f10]
test eax, eax
jle case.0x4671d9.10
cmp dword [ebp + 0x72de0], esi
jmp 0x46723e
lea eax, [edi + 4]
jmp 0x467076
lea eax, [edi + 2]
movsx ecx, bl
cmp ecx, eax
jg case.0x4671d9.10
movsx edx, byte [esp + 0x1c]
cmp edx, eax
jg case.0x4671d9.10
mov eax, dword [ebp + 0x72f10]
test eax, eax
jle case.0x4671d9.10
cmp dword [ebp + 0x72de0], esi
jne case.0x4671d9.10
jmp case.0x467033.6
lea eax, [edi + 2]
jmp 0x46703d
lea edx, [ebp + 0x73018]
lea eax, [esp + 0x20]
push edx
push eax
lea edx, [esp + 0x22]
lea eax, [esp + 0x34]
push edx
push eax
push ecx
mov ecx, dword [ebp + 0x6ea9c]
mov edx, edi
call fcn.0049c720
mov cx, word [esp + 0x1a]
cmp cx, 0x42
je 0x4670f3
cmp cx, 0x49
je 0x4670f3
cmp cx, 0x51
je 0x4670f3
cmp cx, 0x5b
jne 0x4670fa
mov esi, 1
jmp 0x4670fe
mov esi, dword [esp + 0x10]
mov ax, word [ebp + 0x72fe0]
sar eax, 4
and eax, 0xff
cmp ax, 0xf
jne 0x467116
add esi, 2
cmp cx, 0xa
jge 0x467130
cmp cx, 1
jl case.0x4671d9.10
cmp cx, 6
jg case.0x4671d9.10
movsx eax, cx
add eax, 0xfffffff1
cmp eax, 0x4b
ja case.0x467143.16
xor ecx, ecx
mov cl, byte [eax + 0x46814c]
jmp dword [ecx*4 + 0x468144]
mov edx, dword [esp + 0x20]
mov ecx, ebp
push edx
call fcn.0044ad00
test eax, eax
jge case.0x4671d9.10
mov ax, word [esp + 0x1a]
cmp ax, 1
jl 0x46717d
cmp ax, 6
jg 0x46717d
mov eax, dword [ebp + 0x72e60]
test eax, eax
je case.0x4671d9.10
movsx edi, bl
mov bl, byte [esp + 0x1c]
lea eax, [esi + 1]
cmp edi, eax
jg 0x4671be
movsx ecx, bl
cmp ecx, eax
jg 0x4671be
mov ecx, ebp
call fcn.004493d0
mov byte [ebp + 0x733ea], 3
mov dx, word [ebp + 0x72fec]
mov dword [esp + 0x14], eax
mov word [ebp + 0x72ff0], dx
mov ax, word [ebp + 0x72fee]
jmp 0x465a01
mov ecx, ebp
call fcn.004495a0
add eax, 0xfffffffa
cmp eax, 0xf
ja case.0x4671d9.10
xor ecx, ecx
mov cl, byte [eax + 0x4681ac]
jmp dword [ecx*4 + 0x468198]
mov byte [ebp + 0x733ea], 3
mov dx, word [ebp + 0x72fec]
mov ecx, ebp
mov word [ebp + 0x72ff0], dx
mov ax, word [ebp + 0x72fee]
mov word [ebp + 0x72ff2], ax
call fcn.004493d0
mov dword [esp + 0x14], eax
jmp case.0x4671d9.10
lea eax, [esi + 3]
cmp edi, eax
jg case.0x4671d9.10
movsx ecx, bl
cmp ecx, eax
jg case.0x4671d9.10
mov eax, dword [ebp + 0x72f10]
test eax, eax
jle case.0x4671d9.10
cmp dword [ebp + 0x72de0], 1
jne case.0x4671d9.10
jmp case.0x4671d9.6
lea eax, [esi + 4]
jmp 0x467216
lea eax, [esi + 2]
jmp 0x467216
mov ecx, dword [esp + 0x100]
mov edx, dword [esp + 0xfc]
mov ax, word [ebp + 0x72fd8]
push ecx
mov cx, word [ebp + 0x72fd6]
push edx
push eax
push ecx
lea ecx, [ebp + 0x38128]
call fcn.004a4fb0
mov bl, al
mov eax, dword [ebp + 0x72e00]
test eax, eax
mov byte [esp + 0x10], bl
je case.default.0x467294
movsx eax, bl
dec eax
cmp eax, 7
ja case.default.0x467294
jmp dword [eax*4 + 0x4681bc]
mov bl, 5
jmp 0x4672b9
mov bl, 6
jmp 0x4672b9
mov bl, 7
jmp 0x4672b9
mov bl, 8
jmp 0x4672b9
mov bl, 1
jmp 0x4672b9
mov bl, 2
jmp 0x4672b9
mov bl, 3
jmp 0x4672b9
mov bl, 4
mov byte [esp + 0x10], bl
lea ecx, [ebp + 0x72e88]
call fcn.004a6fd0
test eax, eax
jle case.0x4675d1.6
test bl, bl
je case.0x4675d1.6
cmp byte [ebp + 0x732b9], bl
je case.0x4675d1.6
lea edi, [ebp + 0x72dc4]
mov ecx, edi
call fcn.004a6fd0
cmp eax, 1
jne 0x46734d
push eax
push 0xa
push 0x4c1f1c
mov ecx, ebp
call fcn.004117a0
push 0x18
mov ecx, ebp
call fcn.00439d10
push 0x1a
mov ecx, ebp
call fcn.00439d10
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x46734d
cmp ax, 6
jg 0x46734d
mov byte [ebp + 0x733ea], 0
mov dx, word [ebp + 0x72fd6]
mov word [ebp + 0x72ff0], dx
mov ax, word [ebp + 0x72fd8]
mov word [ebp + 0x72ff2], ax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push ecx
mov ecx, edi
call fcn.004a6fb0
mov edx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
push 0
push edx
push 0
push 0xfa314d5
mov ecx, ebp
mov byte [ebp + 0x732b9], bl
call fcn.00405900
movsx ax, byte [ebp + 0x733ea]
mov edx, dword [ebp + 0x72fe8]
push 0xa
push 0
push 0
push 0
push 0
lea ecx, [ebp + 0x732ad]
push eax
mov eax, dword [ebp + 0x72e84]
push ecx
mov cx, word [ebp + 0x72fe4]
push edx
mov dx, word [ebp + 0x72fe2]
push eax
mov ax, word [ebp + 0x72fe0]
push ecx
mov cx, word [ebp + 0x72fde]
push edx
movsx edx, byte [ebp + 0x732b9]
push eax
push ecx
movsx eax, word [ebp + 0x72fdc]
movsx ecx, word [ebp + 0x72fd8]
push edx
push eax
movsx edx, word [ebp + 0x72fd6]
push ecx
mov ecx, dword [ebp + 0x6ea9c]
push edx
mov dx, word [ebp + 0x72fda]
call fcn.00495160
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
mov dword [esp + 0x20], 0
call fcn.004a6fb0
call dword [sym.imp.winmm.dll_timeGetTime]
mov dword [ebp + 0x7257c], eax
jmp case.0x4675d1.6
inc word [ebp + 0x72ff0]
jmp 0x46746f
inc word [ebp + 0x72ff0]
jmp case.default.0x465b49
inc word [ebp + 0x72ff0]
inc word [ebp + 0x72ff2]
jmp case.default.0x465b49
inc eax
mov word [ebp + 0x72ff2], ax
jmp case.default.0x465b49
dec word [ebp + 0x72ff0]
inc word [ebp + 0x72ff2]
jmp case.default.0x465b49
dec word [ebp + 0x72ff0]
jmp case.default.0x465b49
dec word [ebp + 0x72ff0]
dec word [ebp + 0x72ff2]
mov ebx, 1
lea eax, [ebp + 0x6eaac]
cmp dword [eax], esi
je 0x467496
inc ebx
add eax, 4
cmp ebx, 0x1f4
jl 0x467481
jmp 0x4675b9
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0x6c]
rep stosd dword es:[edi], eax
mov ax, word [ebp + 0x72ffe]
cmp ax, si
jle 0x4674c8
movsx edx, ax
push edx
lea eax, [esp + 0x70]
push 0x4c2d0c
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
jmp 0x4674f0
mov edi, 0x4c2d00
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x6c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
mov ax, word [ebp + 0x72ffe]
cmp ax, si
jl 0x467509
cmp ax, 0xc
jge 0x46750f
mov edi, 0x15
jmp 0x467532
cmp ax, 0xc
jl 0x46751c
cmp ax, 0x28
jge 0x467527
mov edi, 0x16
jmp 0x467532
cmp ax, 0x28
jge 0x467527
cmp ax, si
jge 0x46752e
mov edi, 0x17
jmp 0x467532
mov edi, dword [esp + 0x28]
push 0x18
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 0x28], eax
cmp eax, esi
mov dword [esp + 0xec], esi
je 0x467568
mov ecx, dword [ebp + 0x72588]
lea edx, [esp + 0x6c]
push ecx
push edx
push edi
mov ecx, eax
call fcn.004a5770
jmp 0x46756a
xor eax, eax
mov dword [ebp + ebx*4 + 0x6eaa8], eax
push ebx
movsx ecx, word [ebp + 0x72fda]
mov dword [eax + 0x14], ecx
mov dx, word [ebp + 0x72fda]
mov ecx, dword [ebp + 0x6ea9c]
push 0xfffffffffffffff6
push 0xfffffffffffffff6
mov dword [esp + 0xf8], 0xffffffff
call fcn.0049c3c0
test eax, eax
jne 0x4675b9
mov ecx, dword [ebp + ebx*4 + 0x6eaa8]
cmp ecx, esi
je 0x4675b2
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [ebp + ebx*4 + 0x6eaa8], esi
mov word [ebp + 0x72ffc], si
movsx eax, byte [ebp + 0x733ea]
dec eax
cmp eax, 7
ja case.0x4675d1.6
jmp dword [eax*4 + 0x4681dc]
cmp dword [ebp + 0x72e64], esi
jne case.0x4675d1.6
lea eax, [ebp + 0x73018]
lea ecx, [esp + 0x4c]
push eax
lea edx, [esp + 0x2a]
push ecx
mov cx, word [ebp + 0x72ff2]
lea eax, [esp + 0x5c]
push edx
mov dx, word [ebp + 0x72ff0]
push eax
push ecx
mov ecx, dword [ebp + 0x6ea9c]
call fcn.0049c720
mov cx, word [ebp + 0x72ff0]
mov ebx, eax
mov ax, word [ebp + 0x72fd6]
cmp ax, cx
jne 0x467645
mov dx, word [ebp + 0x72fd8]
cmp dx, word [ebp + 0x72ff2]
jne 0x467645
mov byte [ebp + 0x733ea], 0
jmp 0x467890
movsx edi, cx
movsx eax, ax
sub eax, edi
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
cmp ecx, 1
jg 0x46768b
movsx eax, word [ebp + 0x72fd8]
movsx edx, word [ebp + 0x72ff2]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 1
jg 0x46768b
cmp ebx, 1
jne 0x46768b
cmp word [esp + 0x26], si
je 0x46768b
mov byte [ebp + 0x733ea], 0
jmp 0x467890
cmp ecx, 2
jg 0x4676d7
movsx ecx, word [ebp + 0x72ff2]
movsx eax, word [ebp + 0x72fd8]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 2
jg 0x4676d7
lea eax, [edi + edi*2]
mov edx, dword [ebp + 0x6ea9c]
shl eax, 4
sub eax, edi
shl eax, 4
lea ecx, [eax + ecx + 0x5da8]
shl ecx, 4
cmp byte [ecx + edx], 0
jne 0x4676d7
mov byte [ebp + 0x733ea], 0
jmp 0x467890
cmp byte [ebp + 0x733ea], 1
jne 0x4676f7
cmp dword [ebp + 0x72ac8], esi
jne 0x4676f0
cmp dword [ebp + 0x72acc], esi
je 0x4676f7
mov byte [ebp + 0x733ea], 2
cmp byte [ebp + 0x733ea], 2
jne 0x46772e
cmp dword [ebp + 0x72ac8], esi
jne 0x467717
cmp dword [ebp + 0x72acc], esi
jne 0x467717
mov byte [ebp + 0x733ea], 1
lea ecx, [ebp + 0x72ea0]
call fcn.004a6fd0
cmp eax, 1
jge 0x46772e
mov byte [ebp + 0x733ea], 1
mov ax, word [ebp + 0x72ff2]
mov cx, word [ebp + 0x72ff0]
mov dx, word [ebp + 0x72fd8]
push 1
push eax
mov ax, word [ebp + 0x72fd6]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.004052c0
mov bl, al
test bl, bl
mov byte [esp + 0x10], bl
je 0x467890
movsx dx, byte [ebp + 0x733ea]
mov ecx, dword [esp + 0x10]
push esi
push esi
push esi
push esi
push esi
push ecx
push edx
push 0xfa314d5
mov ecx, ebp
mov byte [ebp + 0x732b9], bl
call fcn.00405900
movsx eax, bl
dec eax
cmp eax, 7
ja case.default.0x467793
jmp dword [eax*4 + 0x4681fc]
dec word [ebp + 0x72fd8]
inc word [ebp + 0x72fd6]
jmp case.default.0x467793
inc word [ebp + 0x72fd6]
inc word [ebp + 0x72fd8]
jmp case.default.0x467793
dec word [ebp + 0x72fd6]
inc word [ebp + 0x72fd8]
jmp case.default.0x467793
dec word [ebp + 0x72fd6]
jmp case.default.0x467793
dec word [ebp + 0x72fd6]
dec word [ebp + 0x72fd8]
movsx ax, byte [ebp + 0x733ea]
mov edx, dword [ebp + 0x72fe8]
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp + 0x732ad]
push eax
mov eax, dword [ebp + 0x72e84]
push ecx
mov cx, word [ebp + 0x72fe4]
push edx
mov dx, word [ebp + 0x72fe2]
push eax
mov ax, word [ebp + 0x72fe0]
push ecx
mov cx, word [ebp + 0x72fde]
push edx
movsx edx, byte [ebp + 0x732b9]
push eax
push ecx
movsx eax, word [ebp + 0x72fdc]
movsx ecx, word [ebp + 0x72fd8]
push edx
push eax
movsx edx, word [ebp + 0x72fd6]
push ecx
mov ecx, dword [ebp + 0x6ea9c]
push edx
mov dx, word [ebp + 0x72fda]
call fcn.00495160
lea eax, [esp + 0x40]
lea ecx, [ebp + 0x725e8]
push eax
mov dword [esp + 0x44], esi
call fcn.004a6fb0
call dword [sym.imp.winmm.dll_timeGetTime]
mov dword [ebp + 0x7257c], eax
movsx ecx, word [ebp + 0x72fd6]
movsx edx, word [ebp + 0x72fd8]
mov dword [ebp + 0x72f74], ecx
mov dword [ebp + 0x72f78], edx
cmp byte [ebp + 0x733ea], 7
jne case.0x4675d1.6
lea eax, [esp + 0x38]
lea ecx, [ebp + 0x72ab0]
push eax
mov dword [esp + 0x3c], esi
call fcn.004a6fb0
lea edi, [ebp + 0x72dc4]
mov dword [ebp + 0x72efc], 0xffffffff
mov ecx, edi
mov word [ebp + 0xc], si
call fcn.004a6fd0
cmp eax, 1
jne 0x467928
push eax
push 0xa
push 0x4c1f1c
mov ecx, ebp
call fcn.004117a0
push 0x18
mov ecx, ebp
call fcn.00439d10
push 0x1a
mov ecx, ebp
call fcn.00439d10
mov ax, word [ebp + 0x72fdc]
cmp ax, 1
jl 0x467928
cmp ax, 6
jg 0x467928
mov byte [ebp + 0x733ea], 0
mov cx, word [ebp + 0x72fd6]
mov word [ebp + 0x72ff0], cx
mov dx, word [ebp + 0x72fd8]
mov word [ebp + 0x72ff2], dx
lea eax, [esp + 0x10]
mov ecx, edi
push eax
mov dword [esp + 0x14], esi
call fcn.004a6fb0
mov byte [ebp + 0x733ea], 0
jmp case.0x4675d1.6
mov cx, word [ebp + 0x72ff2]
mov dx, word [ebp + 0x72ff0]
mov ax, word [ebp + 0x72fd8]
push ecx
mov cx, word [ebp + 0x72fd6]
push edx
push eax
push ecx
lea ecx, [ebp + 0x38128]
call fcn.004a4fb0
mov ecx, dword [ebp + 0x72e00]
mov byte [esp + 0x10], al
cmp ecx, esi
je case.default.0x467986
movsx ecx, al
dec ecx
cmp ecx, 7
ja case.default.0x467986
jmp dword [ecx*4 + 0x46821c]
mov al, 5
mov byte [esp + 0x10], al
jmp 0x4679d5
mov al, 6
mov byte [esp + 0x10], al
jmp 0x4679d5
mov al, 7
mov byte [esp + 0x10], al
jmp 0x4679d5
mov al, 8
mov byte [esp + 0x10], al
jmp 0x4679d5
mov al, 1
mov byte [esp + 0x10], al
jmp 0x4679d5
mov al, 2
mov byte [esp + 0x10], al
jmp 0x4679d5
mov al, 3
mov byte [esp + 0x10], al
jmp 0x4679d5
mov al, 4
mov byte [esp + 0x10], al
jmp 0x4679d5
test al, al
je 0x467b05
mov ebx, dword [esp + 0x14]
cmp bx, 2
je 0x4679e5
cmp bx, 0x19
jne 0x467a06
xor edi, edi
lea edx, [ebp + 0x6f87c]
mov ecx, dword [edx]
cmp ecx, esi
je 0x4679f9
cmp byte [ecx + 0x19], 6
je 0x467a06
inc edi
add edx, 4
cmp edi, 0x32
jl 0x4679ed
xor ebx, ebx
jmp 0x467a21
cmp bx, 0x14
jb 0x467a21
mov ecx, dword [ebp + 0x72f10]
dec ecx
mov dword [ebp + 0x72f10], ecx
jns 0x467a21
mov dword [ebp + 0x72f10], esi
movsx ecx, word [ebp + 0x72ff2]
xor edx, edx
mov byte [ebp + 0x732b9], al
mov dx, word [ebp + 0x73018]
mov eax, ebx
push edx
and eax, 0xffff
movsx edx, word [ebp + 0x72ff0]
push esi
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push 3
push 0xfa314d5
mov ecx, ebp
call fcn.00405900
mov ax, word [ebp + 0x72fd8]
mov dx, word [ebp + 0x72ff2]
mov cx, word [ebp + 0x72fd6]
push esi
push esi
sub dx, ax
push ebx
push edx
mov dx, word [ebp + 0x72ff0]
sub dx, cx
push edx
lea edx, [ebp + 0x732ad]
push 3
push edx
mov edx, dword [ebp + 0x72fe8]
push edx
mov edx, dword [ebp + 0x72e84]
push edx
mov dx, word [ebp + 0x72fe4]
push edx
mov dx, word [ebp + 0x72fe2]
push edx
mov dx, word [ebp + 0x72fe0]
push edx
mov dx, word [ebp + 0x72fde]
push edx
movsx edx, byte [ebp + 0x732b9]
push edx
movsx edx, word [ebp + 0x72fdc]
movsx eax, ax
movsx ecx, cx
push edx
mov dx, word [ebp + 0x72fda]
push eax
push ecx
mov ecx, dword [ebp + 0x6ea9c]
call fcn.00495160
lea edx, [esp + 0x48]
lea ecx, [ebp + 0x725e8]
push edx
mov dword [esp + 0x4c], esi
call fcn.004a6fb0
call dword [sym.imp.winmm.dll_timeGetTime]
mov dword [ebp + 0x7257c], eax
mov byte [ebp + 0x733ea], 0
jmp case.0x4675d1.6
cmp dword [ebp + 0x72e64], esi
jne case.0x4675d1.6
lea esi, [ebp + 0x73018]
lea eax, [esp + 0x4c]
push esi
lea ecx, [esp + 0x2a]
push eax
mov ax, word [ebp + 0x72ff2]
lea edx, [esp + 0x5c]
push ecx
mov ecx, dword [ebp + 0x6ea9c]
push edx
mov dx, word [ebp + 0x72ff0]
push eax
call fcn.0049c720
mov cx, word [ebp + 0x72fd6]
mov di, word [ebp + 0x72ff0]
cmp cx, di
mov ebx, eax
jne 0x467b85
mov dx, word [ebp + 0x72fd8]
cmp dx, word [ebp + 0x72ff2]
jne 0x467b85
mov byte [ebp + 0x733ea], 0
mov byte [ebp + 0x733ea], 0
jmp case.0x4675d1.6
movsx edx, di
movsx eax, cx
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 1
jg 0x467bd1
movsx eax, word [ebp + 0x72fd8]
movsx edx, word [ebp + 0x72ff2]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 1
jg 0x467bd1
cmp ebx, 1
jne 0x467bd1
cmp word [esp + 0x26], 0
je 0x467bd1
mov byte [ebp + 0x733ea], 0
mov byte [ebp + 0x733ea], 0
jmp case.0x4675d1.6
mov ax, word [ebp + 0x72ff2]
mov dx, word [ebp + 0x72fd8]
push 1
push eax
push edi
push edx
push ecx
mov ecx, ebp
call fcn.004052c0
mov bl, al
test bl, bl
mov byte [esp + 0x10], bl
je 0x467d5e
movsx edx, word [ebp + 0x72ff2]
xor eax, eax
mov byte [ebp + 0x732b9], bl
mov ax, word [esi]
mov esi, dword [esp + 0x14]
mov ecx, esi
push eax
movsx eax, word [ebp + 0x72ff0]
and ecx, 0xffff
push 0
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
push ecx
push 8
push 0xfa314d5
mov ecx, ebp
call fcn.00405900
movsx eax, bl
dec eax
cmp eax, 7
ja case.default.0x467c41
jmp dword [eax*4 + 0x46823c]
dec word [ebp + 0x72fd8]
inc word [ebp + 0x72fd6]
jmp case.default.0x467c41
inc word [ebp + 0x72fd6]
inc word [ebp + 0x72fd8]
jmp case.default.0x467c41
dec word [ebp + 0x72fd6]
inc word [ebp + 0x72fd8]
jmp case.default.0x467c41
dec word [ebp + 0x72fd6]
jmp case.default.0x467c41
dec word [ebp + 0x72fd6]
dec word [ebp + 0x72fd8]
mov ax, word [ebp + 0x72fd8]
mov dx, word [ebp + 0x72ff2]
mov cx, word [ebp + 0x72fd6]
push 0
push 0
sub dx, ax
push esi
push edx
mov dx, word [ebp + 0x72ff0]
sub dx, cx
push edx
movsx dx, byte [ebp + 0x733ea]
push edx
lea edx, [ebp + 0x732ad]
push edx
mov edx, dword [ebp + 0x72fe8]
push edx
mov edx, dword [ebp + 0x72e84]
push edx
mov dx, word [ebp + 0x72fe4]
push edx
mov dx, word [ebp + 0x72fe2]
push edx
mov dx, word [ebp + 0x72fe0]
push edx
mov dx, word [ebp + 0x72fde]
push edx
movsx edx, byte [ebp + 0x732b9]
push edx
movsx edx, word [ebp + 0x72fdc]
movsx eax, ax
movsx ecx, cx
push edx
mov dx, word [ebp + 0x72fda]
push eax
push ecx
mov ecx, dword [ebp + 0x6ea9c]
call fcn.00495160
lea edx, [esp + 0x44]
lea ecx, [ebp + 0x725e8]
push edx
mov dword [esp + 0x48], 0
call fcn.004a6fb0
call dword [sym.imp.winmm.dll_timeGetTime]
mov dword [ebp + 0x7257c], eax
movsx eax, word [ebp + 0x72fd6]
movsx ecx, word [ebp + 0x72fd8]
mov dword [ebp + 0x72f74], eax
mov dword [ebp + 0x72f78], ecx
mov byte [ebp + 0x733ea], 0
jmp case.0x4675d1.6
mov dl, byte [ebp + 0x732b9]
push esi
push esi
push esi
push esi
push esi
push edx
push 5
push 0xfa314d5
mov ecx, ebp
call fcn.00405900
mov ecx, dword [ebp + 0x72fe8]
mov edx, dword [ebp + 0x72e84]
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp + 0x732ad]
push 5
push eax
mov ax, word [ebp + 0x72fe4]
push ecx
mov cx, word [ebp + 0x72fe2]
push edx
mov dx, word [ebp + 0x72fe0]
push eax
mov ax, word [ebp + 0x72fde]
push ecx
movsx ecx, byte [ebp + 0x732b9]
push edx
push eax
movsx edx, word [ebp + 0x72fdc]
movsx eax, word [ebp + 0x72fd8]
push ecx
push edx
movsx ecx, word [ebp + 0x72fd6]
mov dx, word [ebp + 0x72fda]
push eax
push ecx
mov ecx, dword [ebp + 0x6ea9c]
call fcn.00495160
lea edx, [esp + 0x50]
lea ecx, [ebp + 0x725e8]
push edx
mov dword [esp + 0x54], esi
call fcn.004a6fb0
mov byte [ebp + 0x733ea], 0
jmp case.0x4675d1.6
mov eax, dword [ebp + 0x72ff8]
mov cl, byte [ebp + 0x732b9]
push 0
push 0
push 0
push 0
push eax
push ecx
push 4
push 0xfa314d5
mov ecx, ebp
call fcn.00405900
mov dx, word [ebp + 0x72ff8]
mov ecx, dword [ebp + 0x72fe8]
push 0
push 0
push 0
push 0
push edx
mov edx, dword [ebp + 0x72e84]
lea eax, [ebp + 0x732ad]
push 4
push eax
mov ax, word [ebp + 0x72fe4]
push ecx
mov cx, word [ebp + 0x72fe2]
push edx
mov dx, word [ebp + 0x72fe0]
push eax
mov ax, word [ebp + 0x72fde]
push ecx
push edx
movsx ecx, byte [ebp + 0x732b9]
movsx edx, word [ebp + 0x72fdc]
push eax
push ecx
movsx eax, word [ebp + 0x72fd8]
movsx ecx, word [ebp + 0x72fd6]
push edx
mov dx, word [ebp + 0x72fda]
push eax
push ecx
mov ecx, dword [ebp + 0x6ea9c]
call fcn.00495160
lea edx, [esp + 0x3c]
lea ecx, [ebp + 0x725e8]
push edx
mov dword [esp + 0x40], 0
call fcn.004a6fb0
call dword [sym.imp.winmm.dll_timeGetTime]
mov dword [ebp + 0x7257c], eax
lea eax, [esp + 0x28]
push eax
lea ecx, [ebp + 0x72ab0]
mov dword [esp + 0x2c], 1
call fcn.004a6fb0
movsx ecx, word [ebp + 0x72fda]
lea esi, [ebp + 0x6eaac]
mov byte [ebp + 0x733ea], 0
mov dword [esp + 0x1c], ecx
mov edi, esi
mov ebx, 0x1f3
mov ecx, dword [edi]
test ecx, ecx
je 0x467f2b
mov edx, dword [ecx + 0x14]
mov eax, dword [esp + 0x1c]
cmp edx, eax
jne 0x467f2b
test ecx, ecx
je 0x467f25
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi], 0
add edi, 4
dec ebx
jne 0x467f0a
mov ebx, 1
mov eax, esi
cmp dword [eax], 0
je 0x467f4e
inc ebx
add eax, 4
cmp ebx, 0x1f4
jl 0x467f38
jmp case.0x4675d1.6
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0x6c]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x72ff8]
lea eax, [esp + 0x6c]
mov edx, dword [ebp + ecx*4 + 0x6fb28]
add edx, 4
push edx
push 0x4c2cfc
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
push 0x18
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
mov dword [esp + 0xec], 1
je 0x467fbc
call dword [sym.imp.winmm.dll_timeGetTime]
lea ecx, [esp + 0x6c]
push eax
push ecx
push 0x29
mov ecx, edi
call fcn.004a5770
jmp 0x467fbe
xor eax, eax
mov dword [ebp + ebx*4 + 0x6eaa8], eax
push ebx
movsx edx, word [ebp + 0x72fda]
mov dword [eax + 0x14], edx
mov dx, word [ebp + 0x72fda]
mov ecx, dword [ebp + 0x6ea9c]
push 0xfffffffffffffff6
push 0xfffffffffffffff6
mov dword [esp + 0xf8], 0xffffffff
call fcn.0049c3c0
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xe0
ret 0x18