Function at 0x48f0c0
Capabilities:
Encode data using xor
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x8c4d40]
sub esp, 0x368
push ebx
push ebp
mov ebp, dword [esp + 0x374]
push esi
mov esi, dword [0x85c138]
push edi
mov edi, dword [esp + 0x380]
push 0
push 0x14
push 1
push eax
mov eax, esi
mov ecx, ebp
call fcn.004893a0
mov edx, dword [0x8c4d3c]
push 0
lea ecx, [esi + eax*2]
mov esi, dword [0x85c134]
push 0x14
mov dword [0x8c4d40], eax
mov dword [0x85c138], ecx
push 1
push edx
mov eax, esi
mov ecx, edi
call fcn.004893a0
mov ecx, dword [0x8c4d34]
push 0
mov dword [0x8c4d3c], eax
lea eax, [esi + eax*2]
mov esi, dword [0x8c43dc]
push 0x38e38e3
push 0xb60b60
mov dword [0x85c134], eax
mov eax, dword [0x8c4d38]
add esi, 0x12f684b
push ecx
mov ecx, esi
call fcn.004893a0
mov ecx, dword [0x8ccb1c]
mov ebx, dword [0x8c43ec]
mov dword [0x8c4d34], eax
mov eax, dword [0x85c164]
and eax, 0xffffffbf
add esp, 0x30
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffa
add ecx, 0xe
imul ecx, ecx, 0x3e8
test bl, 0x40
mov dword [0x8c4d38], esi
mov dword [0x85c164], eax
je 0x48f19b
or eax, 0x800
mov dword [0x85c164], eax
mov eax, ebx
and eax, 4
je 0x48f1b5
mov edx, dword [0x85c158]
mov ecx, 9
sub ecx, edx
imul ecx, ecx, 0x3e8
mov esi, dword [0x8c4d30]
cmp ecx, esi
jle 0x48f1c6
mov eax, 0x7d
jmp 0x48f1d2
neg eax
sbb eax, eax
and eax, 0xfa
add eax, 0x53
mov edx, dword [0x8c4d2c]
push 0
push eax
push 0x14
push edx
mov eax, esi
call fcn.004893a0
mov ecx, dword [0x85c164]
add esp, 0x10
test ch, 8
mov dword [0x8c4d2c], eax
jne 0x48f205
test bl, 0x10
jne 0x48f205
add esi, eax
mov dword [0x8c4d30], esi
mov eax, 0x10624dd3
imul ebp
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0xa4], eax
mov eax, 0x10624dd3
imul edi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0xa8], eax
mov eax, dword [0x8ccc58]
call fcn.004de4a0
mov edx, dword [0x85c164]
and edx, 0x800
neg edx
sbb edx, edx
and edx, 0xffffff9c
add edx, 0x44c
xor edi, edi
mov dword [0x728090], edx
mov dword [esp + 0x28], edi
jmp 0x48f26c
mov edx, dword [0x728090]
mov esi, dword [0x8c43c4]
mov ebx, dword [0x8c43c8]
xor ebp, ebp
cmp edi, ebp
jne 0x48f4fb
mov eax, dword [0x8c43dc]
add eax, 0x80000000
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
push ebp
push ebp
fmul qword [0x715728]
push ecx
lea eax, [esp + 0x80]
fstp dword [esp]
call fcn.004dc670
mov ecx, dword [0x8c43f4]
mov eax, dword [0x8c43f0]
add esp, 0xc
push ecx
push eax
push edx
lea ecx, [esp + 0x80]
push ecx
mov ecx, dword [0x8c4cf0]
push ebp
push ebx
push esi
call fcn.004bc350
mov esi, dword [0x8c430c]
mov dword [esp + 0x18], eax
cmp dword [0x8ccb1c], ebp
je 0x48f3be
cmp esi, 0xffffffff
mov dword [esp + 0x54], ebp
jne 0x48f2fd
mov ebx, dword [0x8c4cf0]
fld dword [ebx + 0x2c]
jmp 0x48f323
mov ecx, dword [0x8c4cf0]
mov eax, esi
call fcn.004bc7a0
cmp eax, ebp
mov esi, dword [0x8c430c]
mov ebx, dword [0x8c4cf0]
je 0x48f31f
fld dword [eax + 0xc]
jmp 0x48f323
fld dword [esp + 0x54]
fmul dword [0x715698]
call fcn.005f275c
mov ecx, dword [0x8ccb28]
cmp ecx, eax
jl 0x48f3ca
mov eax, dword [0x8c43ec]
test al, 4
je 0x48f353
mov edx, dword [0x8c43f4]
push edx
push 0x1c
jmp 0x48f4d2
mov ecx, dword [0x8c43f0]
cmp ecx, dword [0x8c4318]
jne 0x48f36e
mov eax, dword [0x8c43f4]
push eax
push 0x1a
jmp 0x48f4d2
cmp ecx, dword [0x8c4324]
je 0x48f37f
test ah, 2
je 0x48f4d9
cmp esi, 0xffffffff
mov dword [esp + 0x50], 0
jne 0x48f394
fld dword [ebx + 0x2c]
jmp 0x48f4c0
mov eax, esi
mov ecx, ebx
call fcn.004bc7a0
cmp eax, ebp
mov esi, dword [0x8c430c]
mov ebx, dword [0x8c4cf0]
je 0x48f3b5
fld dword [eax + 0xc]
jmp 0x48f4c0
fld dword [esp + 0x50]
jmp 0x48f4c0
mov ebx, dword [0x8c4cf0]
mov ecx, dword [0x8ccb28]
mov edx, dword [0x8c43f0]
cmp edx, dword [0x8c4310]
jne 0x48f3e3
mov dword [0x8ccb28], ebp
jmp 0x48f4d9
cmp dword [0x8ccb1c], ebp
jne 0x48f413
cmp ecx, ebp
jle 0x48f3f9
neg ecx
mov dword [0x8ccb28], ecx
cmp ecx, ebp
jge 0x48f420
add ecx, 0x32
cmp ecx, ebp
mov dword [0x8ccb28], ecx
jle 0x48f422
mov dword [0x8ccb28], ebp
jmp 0x48f4d9
cmp ecx, ebp
jl 0x48f424
add ecx, 0x32
mov dword [0x8ccb28], ecx
cmp ecx, ebp
je 0x48f47b
cmp esi, 0xffffffff
mov dword [esp + 0x40], 0
jne 0x48f436
fld dword [ebx + 0x2c]
jmp 0x48f460
mov eax, esi
mov ecx, ebx
call fcn.004bc7a0
cmp eax, ebp
mov esi, dword [0x8c430c]
mov ecx, dword [0x8ccb28]
mov ebx, dword [0x8c4cf0]
je 0x48f45a
fld dword [eax + 0xc]
jmp 0x48f460
fld dword [esp + 0x40]
mov edi, edi
fmul dword [0x715698]
mov eax, ecx
cdq
mov edi, eax
xor edi, edx
sub edi, edx
call fcn.005f275c
cmp edi, eax
jg 0x48f47b
push edi
jmp 0x48f4d1
cmp dword [0x8ccb1c], ebp
je 0x48f4d9
cmp esi, 0xffffffff
mov dword [esp + 0x3c], 0
jne 0x48f495
fld dword [ebx + 0x2c]
jmp 0x48f4c0
mov eax, esi
mov ecx, ebx
call fcn.004bc7a0
cmp eax, ebp
mov esi, dword [0x8c430c]
mov ebx, dword [0x8c4cf0]
je 0x48f4b3
fld dword [eax + 0xc]
jmp 0x48f4c0
fld dword [esp + 0x3c]
jmp 0x48f4c0
fmul dword [0x7157e4]
call fcn.005f275c
or ecx, 0xffffffff
sub ecx, eax
push ecx
push esi
mov ecx, ebx
call fcn.004bc4e0
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x48f87e
mov edx, dword [esp + 0x18]
mov dword [eax + 0x234], edx
jmp 0x48f87e
imul edi, edi, 0x44
cmp dword [edi + 0x8c43c0], ebp
je 0x48f87e
cmp dword [esp + 0x384], 1
jg 0x48f87e
mov ebp, dword [edi + 0x8c43c8]
mov eax, ebp
sub eax, ebx
mov ebx, dword [edi + 0x8c43c4]
mov ecx, ebx
sub ecx, esi
jns 0x48f530
neg ecx
test eax, eax
jge 0x48f536
neg eax
cmp ecx, eax
jle 0x48f53f
lea eax, [eax + ecx*2]
jmp 0x48f542
lea eax, [ecx + eax*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0xfa0
jle 0x48f5a4
mov dword [esp + 0x18], ebx
fild dword [esp + 0x18]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x4c], 0
mov edx, dword [esp + 0x4c]
fstp dword [esp + 0x44]
fild dword [esp + 0x38]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x64], eax
mov eax, dword [0x8ebfd8]
fstp dword [esp + 0x48]
mov ecx, dword [esp + 0x48]
lea esi, [esp + 0x64]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], 0x447a0000
call fcn.00501180
test al, al
je 0x48f87e
mov ebx, dword [edi + 0x8c43f0]
cmp ebx, dword [0x72809c]
jne 0x48f5e8
mov eax, dword [edi + 0x8c43e4]
test eax, eax
jne 0x48f5cf
mov al, byte [edi + 0x8c43ec]
test al, al
js 0x48f5cf
mov eax, dword [0x8c26cc]
test eax, eax
je 0x48f5e8
mov eax, dword [0x8c42ec]
mov ebx, eax
mov dword [edi + 0x8c43f0], eax
mov dword [edi + 0x8c43f4], 0
jmp 0x48f5f1
mov eax, dword [0x8c42ec]
cmp ebx, eax
jne 0x48f660
cmp eax, 0xffffffff
mov dword [esp + 0x1c], 0
jne 0x48f608
mov eax, dword [0x8c4c70]
fld dword [eax + 0x2c]
jmp 0x48f620
mov ecx, dword [0x8c4c70]
call fcn.004bc7a0
test eax, eax
je 0x48f61c
fld dword [eax + 0xc]
jmp 0x48f620
fld dword [esp + 0x1c]
fild dword [edi + 0x8c43f4]
fxch st(1)
fmul dword [0x715698]
call fcn.005f275c
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul dword [0x7156e8]
fcompp
fnstsw ax
test ah, 0x41
jp 0x48f660
mov ebx, dword [0x8c42e8]
mov dword [edi + 0x8c43f4], 0
mov dword [edi + 0x8c43f0], ebx
cmp ebx, dword [0x8c4304]
mov esi, dword [edi + 0x8c43f4]
mov dword [esp + 0x24], esi
jne 0x48f682
mov al, byte [edi + 0x8c43ec]
test al, al
jns 0x48f682
mov ebx, dword [0x8c4300]
mov eax, dword [edi + 0x8c43ec]
test ah, 4
mov ebp, dword [edi + 0x8c43fc]
mov dword [esp + 0x30], eax
je 0x48f73c
mov esi, dword [edi + 0x8c43c8]
mov eax, dword [0x8c43c8]
mov edx, dword [edi + 0x8c43c4]
sub eax, esi
mov esi, dword [0x8c43c4]
mov ecx, esi
sub ecx, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x38], ecx
call fcn.004dcb20
fild dword [esp + 0x18]
fild dword [esp + 0x38]
lea ecx, [esp + 0x58]
mov ebp, eax
mov dword [esp + 0x60], 0
fstp dword [esp + 0x58]
fstp dword [esp + 0x5c]
call fcn.004915a0
fstp st(0)
fld dword [esp + 0x58]
fmul dword [0x7158d4]
fld dword [esp + 0x5c]
fmul dword [0x7158d4]
fstp dword [esp + 0x5c]
fld dword [esp + 0x60]
fmul dword [0x7158d4]
fstp dword [esp + 0x60]
call fcn.005f275c
fld dword [esp + 0x5c]
sub esi, eax
mov dword [edi + 0x8c43c4], esi
call fcn.005f275c
mov ecx, dword [0x8c43c8]
mov esi, dword [esp + 0x24]
sub ecx, eax
mov eax, dword [esp + 0x30]
mov dword [edi + 0x8c43c8], ecx
mov ecx, dword [0x8c42f8]
cmp ebx, ecx
je 0x48f74e
cmp ebx, dword [0x8c42fc]
jne 0x48f775
mov edx, dword [edi + 0x8c43e4]
test edx, edx
jne 0x48f765
test al, al
js 0x48f765
mov eax, dword [0x8c26cc]
test eax, eax
je 0x48f775
cmp ebx, ecx
mov ebx, dword [0x8c42f0]
je 0x48f775
mov ebx, dword [0x8c42f4]
test esi, esi
jge 0x48f77d
xor esi, esi
jmp 0x48f78a
cmp esi, 0x7fff
jle 0x48f78a
mov esi, 0x7fff
mov eax, dword [esp + 0x28]
mov eax, dword [eax*4 + 0x8c4c70]
test eax, eax
mov ecx, dword [edi + 0x8c43c8]
mov edx, dword [edi + 0x8c43c4]
je 0x48f7c6
push esi
push ebx
push 0
push 0
add ebp, 0x80000000
push ebp
push 0
push ecx
push edx
mov edx, dword [0x728090]
push eax
mov byte [eax + 0x25], 1
call fcn.004bc2e0
mov dword [esp + 0x18], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x48f7e8
lea ecx, [esp + 0x18]
push ecx
add eax, 0x1d0
call fcn.004c3730
test byte [0x85c164], 0x20
je 0x48f837
mov edx, dword [esp + 0x28]
push edx
push str._NUM
mov esi, 0x8ebf58
call fcn.004f7660
mov eax, dword [edi + 0x8c43c8]
mov ecx, dword [edi + 0x8c43c4]
push 0
push 0xc
push 0x9c4
push 0
push 0
push 0x20000000
push 0x64
push eax
push ecx
or eax, 0xffffffff
mov ecx, 0x86bb48
call fcn.004af0b0
add esp, 0x2c
mov eax, dword [edi + 0x8c43f0]
cmp eax, dword [0x8c42fc]
jne 0x48f860
cmp eax, 0xffffffff
je 0x48f860
mov ecx, dword [0x8c4c70]
call fcn.004bc7a0
jmp 0x48f860
mov eax, dword [edi + 0x8c43f0]
cmp eax, dword [0x8c42f8]
jne 0x48f87e
cmp eax, 0xffffffff
je 0x48f87e
mov ecx, dword [0x8c4c70]
call fcn.004bc7a0
mov edi, dword [esp + 0x28]
inc edi
cmp edi, 0x20
mov dword [esp + 0x28], edi
jl 0x48f266
mov eax, dword [0x8c4d14]
or ebp, 0xffffffff
cmp eax, ebp
je 0x48fb95
mov esi, dword [0x8c4cfc]
mov edi, dword [0x8c4d00]
imul esi, esi, 0x3e8
mov eax, dword [0x8c43c8]
imul edi, edi, 0x3e8
mov ecx, dword [0x8c43c4]
sub eax, esi
sub ecx, edi
call fcn.004dcb20
sar eax, 0x1c
inc eax
sar eax, 1
and eax, 6
sub eax, 4
shl eax, 0x1d
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
push 0
push 0
lea eax, [esp + 0x7c]
fmul qword [0x715728]
fstp dword [esp + 0x20]
mov ebx, dword [esp + 0x20]
push ebx
call fcn.004dc670
mov eax, dword [0x8ca494]
mov ecx, dword [0x728090]
add esp, 0xc
push eax
push 0x65
push ecx
mov ecx, dword [0x8c4d48]
lea edx, [esp + 0x80]
push edx
push 0xa
push esi
push edi
call fcn.004bc350
mov esi, eax
mov eax, dword [0x8c4cf8]
push 0
push eax
mov ecx, esi
call fcn.004c28d0
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
mov dword [esp + 0x18], esi
je 0x48f95b
lea ecx, [esp + 0x18]
push ecx
add eax, 0x218
call fcn.004c3730
mov edx, dword [0x8c4cfc]
mov esi, dword [0x8c4d00]
imul edx, edx, 0x3e8
push 0
imul esi, esi, 0x3e8
push 0
push ebx
lea eax, [esp + 0x80]
call fcn.004dc670
mov eax, dword [0x8ca494]
mov ecx, dword [0x728090]
add esp, 0xc
push eax
push 0x65
push ecx
mov ecx, dword [0x8c4d4c]
lea eax, [esp + 0x80]
push eax
push 0xa
push edx
push esi
call fcn.004bc350
mov ecx, dword [0x8c4cf8]
push 0
mov esi, eax
push ecx
mov ecx, esi
call fcn.004c28d0
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
mov dword [esp + 0x18], esi
je 0x48f9e1
lea edx, [esp + 0x18]
push edx
add eax, 0x218
call fcn.004c3730
mov edx, dword [0x8c4cfc]
mov esi, dword [0x8c4d00]
imul edx, edx, 0x3e8
push 0
imul esi, esi, 0x3e8
push 0
push ebx
lea eax, [esp + 0x80]
call fcn.004dc670
mov eax, dword [0x8ca494]
mov ecx, dword [0x728090]
add esp, 0xc
push eax
push 0x65
push ecx
mov ecx, dword [0x8c4d50]
lea eax, [esp + 0x80]
push eax
push 0xa
push edx
push esi
call fcn.004bc350
mov ecx, dword [0x8c4cf8]
push 0
mov esi, eax
push ecx
mov ecx, esi
call fcn.004c28d0
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
mov dword [esp + 0x18], esi
je 0x48fa67
lea edx, [esp + 0x18]
push edx
add eax, 0x218
call fcn.004c3730
mov al, byte [0x8c9888]
test al, al
mov eax, dword [0x8c4d48]
je 0x48fafd
call fcn.004bb170
add eax, 0x5c
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ebx, dword [eax + 8]
mov eax, dword [0x8eed78]
mov ecx, 0x8eed78
call dword [eax + 0x18]
test al, al
jne 0x48faba
push 0
push str.The_audio_manager_has_not_been_properly_initialized_yet
mov eax, 1
call fcn.004887a0
add esp, 8
mov byte [0x8c9888], 0
jmp 0x48fb95
push 1
push ebp
push 0xbf800000
push 0x8c988c
push ebp
push ebp
push ebp
sub esp, 0xc
mov ecx, esp
mov dword [ecx], esi
mov dword [ecx + 4], edi
push ecx
mov eax, esp
push 0xc9
mov edx, ebp
push 0x8e87b0
mov dword [ecx + 8], ebx
mov dword [eax], 0
call fcn.0049f880
mov byte [0x8c9888], 0
jmp 0x48fb95
call fcn.004bb170
add eax, 0x5c
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 8]
mov eax, dword [0x8eed78]
mov dword [esp + 0x48], ecx
mov ecx, 0x8eed78
mov dword [esp + 0x4c], edx
call dword [eax + 0x18]
test al, al
je 0x48fb95
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
sub esp, 0x64
mov dword [esp + 0x184], eax
lea eax, [esp + 0x134]
mov ebx, esp
mov dword [esp + 0x194], 0x8cccd0
mov dword [esp + 0x134], 0x25
mov dword [esp + 0x16c], 0x8c988c
mov dword [esp + 0x13c], 0xc9
mov dword [esp + 0x17c], ecx
mov dword [esp + 0x180], edx
call fcn.00498530
mov edi, 0x8e87b4
call fcn.004a1410
or ebp, 0xffffffff
mov esi, 0x8c26f4
lea ebx, [ebx]
mov ebx, dword [esi - 0x1c]
test ebx, ebx
je 0x48fce2
mov eax, dword [esp + 0x384]
test eax, eax
je 0x48fbf2
mov eax, dword [esi - 0x14]
mov edi, dword [0x8c43c8]
mov ecx, dword [esi - 0x18]
mov edx, dword [0x8c43c4]
sub eax, edi
sub ecx, edx
jns 0x48fbd0
neg ecx
test eax, eax
jge 0x48fbd6
neg eax
cmp ecx, eax
jle 0x48fbdf
lea eax, [eax + ecx*2]
jmp 0x48fbe2
lea eax, [ecx + eax*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x1f40
jg 0x48fce2
cmp dword [esi + 0xc], ebp
push 0
push 0
jne 0x48fc4a
mov ecx, dword [esi]
sub ecx, 4
shl ecx, 0x1d
mov dword [esp + 0x20], ecx
fild dword [esp + 0x20]
push ecx
lea eax, [esp + 0x80]
fmul qword [0x715728]
fstp dword [esp]
call fcn.004dc670
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
mov ecx, dword [0x728090]
add esp, 0xc
push edx
push eax
mov eax, dword [esi - 0x14]
push ecx
mov ecx, dword [esi - 0x18]
lea edx, [esp + 0x80]
push edx
push 0
push eax
push ecx
jmp 0x48fcd6
mov edi, dword [esi]
dec edi
and edi, 7
lea edx, [edi - 4]
shl edx, 0x1d
mov dword [esp + 0x20], edx
fild dword [esp + 0x20]
push ecx
lea eax, [esp + 0xb8]
fmul qword [0x715728]
fstp dword [esp]
call fcn.004dc670
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
mov edx, dword [0x728090]
add esp, 0xc
push eax
push ecx
mov ecx, dword [edi*4 + 0x727350]
mov edi, dword [edi*4 + 0x7272f0]
imul ecx, ecx, 0x3e8
push edx
imul edi, edi, 0x3e8
lea eax, [esp + 0xb8]
push eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, dword [esi - 0x14]
mov eax, 0x66666667
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esi - 0x18]
push 0
push ecx
add eax, edx
push eax
mov ecx, dword [ebx*4 + 0x8c4c40]
call fcn.004bc350
add esi, 0x38
cmp esi, 0x8c42f4
jl 0x48fba0
push 0
push 0
push 0
lea eax, [esp + 0xb8]
mov dword [0x728090], 0x4b0
call fcn.004dc670
add esp, 0xc
push 0
push ebp
push 0x59d8
mov ecx, eax
push ecx
mov ecx, dword [0x8c4c64]
push 0
push 0x5dc0
push 0x5dc0
call fcn.004bc350
mov ecx, dword [0x8ccc58]
mov dl, byte [ecx + 0x24c]
test dl, dl
je 0x48fd48
mov dword [ecx + 0x230], eax
mov eax, dword [0x8c26c8]
add eax, 0xffffffe8
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xb
jg 0x48fe85
mov eax, dword [0x8c26c4]
add eax, 0xffffffe8
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xb
jg 0x48fe85
push 0
push 0
push 0
lea eax, [esp + 0x18c]
call fcn.004dc670
mov edx, dword [0x728090]
mov ecx, dword [0x8c4d84]
add esp, 0xc
push 0x7d0
push ebp
push edx
push eax
push 1
push 0x55f0
push 0x55f0
call fcn.004bc350
mov dword [esp + 0x18], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x48fdd0
lea ecx, [esp + 0x18]
push ecx
add eax, 0x1e8
call fcn.004c3730
mov eax, dword [0x72808c]
test eax, eax
jne 0x48fe85
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x9c]
push eax
lea ecx, [esp + 0x4c]
push ecx
mov ecx, dword [0x8ebfd8]
mov dword [esp + 0x50], 0xc4f70000
mov dword [esp + 0x54], 0xc5788000
mov dword [esp + 0x58], 0x42c80000
call fcn.00537240
fld dword [0x70deb0]
fsub dword [esp + 0x38]
mov bl, al
fstp dword [esp + 0x38]
fild dword [0x72837c]
fmul dword [esp + 0x98]
call fcn.005f275c
fild dword [0x728380]
mov edi, eax
fmul dword [esp + 0x38]
call fcn.005f275c
test bl, bl
mov ebp, eax
je 0x48fe85
push str.Mansion
mov esi, 0x8ebf58
call fcn.004f7660
add esp, 4
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0x64
add ebp, 0xfffffff0
push ebp
push edi
push 0x86bb48
xor eax, eax
mov dword [0x85c11c], 0x64
call fcn.004b0b40
add esp, 0x20
mov dword [esp + 0x30], 0
lea ecx, [ecx]
cmp dword [esp + 0x384], 1
jne 0x48fecc
mov eax, dword [esp + 0x30]
mov ebp, dword [esp + 0xa4]
mov esi, dword [0x8c4d30]
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
xor edx, edx
cmp esi, 0x4650
setg dl
lea edx, [edx*4 + 8]
cmp eax, edx
jg 0x490d79
xor ebp, ebp
mov edi, edi
cmp dword [esp + 0x384], 1
jne 0x48ff0a
mov ecx, dword [esp + 0xa8]
mov esi, dword [0x8c4d30]
mov eax, ebp
sub eax, ecx
cdq
xor eax, edx
xor ecx, ecx
sub eax, edx
cmp esi, 0x4650
setg cl
lea ecx, [ecx*4 + 8]
cmp eax, ecx
jg 0x490d6f
mov esi, dword [esp + 0x30]
mov eax, esi
cdq
mov ecx, 3
idiv ecx
mov edi, esi
mov ebx, ebp
imul edi, edi, 0x3e8
imul ebx, ebx, 0x3e8
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x50], eax
mov dword [esp + 0x28], edx
mov eax, ebp
cdq
idiv ecx
mov ecx, 5
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
lea eax, [esi + ebp*2]
cdq
idiv ecx
mov eax, edx
sub eax, 2
imul eax, eax, 0x38e38e3
cdq
and edx, 3
add eax, edx
sar eax, 2
test ebp, ebp
mov dword [esp + 0x54], eax
jne 0x48fff7
mov edx, esi
and edx, 0x80000003
jns 0x48ff7f
dec edx
or edx, 0xfffffffc
inc edx
jne 0x48fff7
mov eax, dword [0x728090]
cdq
and edx, 3
add edx, eax
push 0
push 0
sar edx, 2
push 0x3fc90fdb
lea eax, [esp + 0x360]
add edx, 0x38
call fcn.004dc670
mov eax, dword [0x8ca494]
add esp, 0xc
push eax
push 0xffffffffffffffff
push edx
lea ecx, [esp + 0x360]
push ecx
mov ecx, dword [0x8c4d5c]
lea edx, [esi + 0x190]
push edx
lea eax, [ebx - 0xabe]
push eax
push edi
call fcn.004bc350
mov dword [esp + 0x1c], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x48fff7
lea ecx, [esp + 0x1c]
push ecx
add eax, 0x200
call fcn.004c3730
cmp esi, 0x18
jg 0x490013
cmp esi, 0x13
jle 0x490013
cmp ebp, 0x18
jg 0x490013
cmp ebp, 0x13
jg 0x490d6f
mov esi, dword [esp + 0x30]
lea eax, [esi + esi*2]
shl eax, 4
mov cl, byte [eax + ebp + 0x8c83a0]
test cl, cl
mov dword [esp + 0x1c], eax
jne 0x4900df
lea edx, [esi + ebp]
test dl, 1
je 0x4900df
mov ecx, dword [0x728090]
mov eax, 0x55555556
imul ecx
mov edi, edx
shr edi, 0x1f
add edi, edx
lea eax, [ebp - 1]
cdq
and edx, 3
add eax, edx
mov ecx, eax
lea eax, [esi - 1]
cdq
and edx, 3
sar ecx, 2
add eax, edx
sar eax, 2
add ecx, eax
and ecx, 3
imul ecx, ecx, 0x15555555
mov dword [esp + 0x34], ecx
push 0
fild dword [esp + 0x38]
push 0
push ecx
lea eax, [esp + 0x144]
fmul qword [0x715728]
fstp dword [esp]
call fcn.004dc670
mov ecx, dword [esp + 0x30]
add esp, 0xc
push 0
push 0xffffffffffffffff
push edi
mov edx, eax
push edx
push 0
lea eax, [ebx - 0x1f4]
add ecx, 0xfffffe0c
push eax
push ecx
mov ecx, dword [0x8c4d80]
call fcn.004bc350
mov dword [esp + 0x34], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x4900df
lea edx, [esp + 0x34]
push edx
add eax, 0x200
call fcn.004c3730
test byte [0x85c164], 0x20
mov esi, dword [esp + 0x1c]
je 0x4901f7
cmp byte [esi + ebp + 0x8c83a0], 4
je 0x490205
fild dword [esp + 0x24]
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0xa4]
fstp dword [esp + 0x5c]
push ecx
fild dword [esp + 0x28]
mov ecx, dword [0x8ebfd8]
lea edx, [esp + 0x60]
push edx
fstp dword [esp + 0x68]
mov dword [esp + 0x6c], 0x3f800000
call fcn.00537240
fld dword [0x70deb0]
fsub dword [esp + 0x3c]
mov byte [esp + 0x2f], al
fstp dword [esp + 0x3c]
fild dword [0x72837c]
fmul dword [esp + 0xa0]
call fcn.005f275c
fild dword [0x728380]
mov dword [esp + 0x34], eax
fmul dword [esp + 0x3c]
call fcn.005f275c
mov dword [esp + 0x20], eax
mov al, byte [esp + 0x2f]
test al, al
je 0x4901f7
movsx eax, byte [esi + ebp + 0x8c83a0]
push 0xa
push 0x8c26b0
push eax
mov byte [0x86bb48], 0
call dword [sym.imp.MSVCR71.dll__itoa]
add esp, 0xc
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4901a0
mov edi, 0x86bb48
sub eax, esi
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4901b0
mov edx, dword [esp + 0x34]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 0xffffffffffffffff
push 4
mov ecx, eax
and ecx, 3
push 0xffffffffffffffff
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x30]
push 0x64
push ecx
push edx
push 0x86bb48
xor eax, eax
mov dword [0x85c11c], 0x64
call fcn.004b0b40
mov esi, dword [esp + 0x3c]
add esp, 0x20
cmp byte [esi + ebp + 0x8c83a0], 4
jne 0x490d6f
mov eax, dword [esp + 0x28]
test eax, eax
mov edi, dword [esp + 0x18]
jne 0x49091b
test edi, edi
jne 0x49091b
mov eax, dword [0x8ccb18]
test eax, eax
jne 0x490266
test byte [0x8c4d28], 3
jne 0x490266
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 3
idiv ecx
movsx eax, byte [esi + ebp + 0x8c7198]
lea eax, [edx + eax - 1]
cmp eax, 0xfffffff1
jge 0x490255
mov eax, 0xfffffff1
jmp 0x49025f
cmp eax, 0xf
jle 0x49025f
mov eax, 0xf
mov byte [esi + ebp + 0x8c7198], al
mov ecx, dword [esp + 0x30]
lea eax, [ecx + ebp]
cdq
mov edi, 5
idiv edi
test edx, edx
je 0x490285
mov dword [0x8ef5b8], 0
jmp 0x490298
movsx eax, byte [esi + ebp + 0x8c7198]
add eax, 0xf
imul eax, eax, 0x64
mov dword [0x8ef5b8], eax
cmp ecx, dword [0x8c4d24]
jne 0x49041b
cmp ebp, dword [0x8c4d20]
jne 0x49041b
lea eax, [ebp - 1]
cdq
and edx, 3
add eax, edx
mov esi, eax
lea eax, [ecx - 1]
cdq
and edx, 3
add eax, edx
sar esi, 2
sar eax, 2
add esi, eax
and esi, 3
shl esi, 0x1e
mov dword [esp + 0x20], esi
push 0
fild dword [esp + 0x24]
push 0
push ecx
lea eax, [esp + 0x2f4]
fmul qword [0x715728]
fstp dword [esp]
call fcn.004dc670
mov ecx, dword [0x728090]
add esp, 0xc
push 0xbb8
push 0
push ecx
mov ecx, dword [0x8c4d88]
mov edx, eax
mov eax, dword [esp + 0x30]
push edx
push 0
add ebx, 0xfffffe0c
push ebx
add eax, 0xfffffe0c
push eax
mov dword [esp + 0x50], ebx
call fcn.004bc350
mov dword [esp + 0x20], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x49034c
lea ecx, [esp + 0x20]
push ecx
add eax, 0x1e8
call fcn.004c3730
mov eax, dword [0x72808c]
test eax, eax
jne 0x490d6f
mov edx, dword [esp + 0x24]
add edx, 0xfffffa24
mov dword [esp + 0x20], edx
fild dword [esp + 0x20]
lea eax, [esp + 0x40]
push eax
fstp dword [esp + 0x68]
lea ecx, [esp + 0xa0]
fild dword [esp + 0x38]
push ecx
mov ecx, dword [0x8ebfd8]
lea edx, [esp + 0x6c]
push edx
fstp dword [esp + 0x74]
mov dword [esp + 0x78], 0x42c80000
call fcn.00537240
fld dword [0x70deb0]
fsub dword [esp + 0x40]
mov byte [esp + 0x2f], al
fstp dword [esp + 0x40]
fild dword [0x72837c]
fmul dword [esp + 0x9c]
call fcn.005f275c
fild dword [0x728380]
mov edi, eax
fmul dword [esp + 0x40]
call fcn.005f275c
mov ebx, eax
mov al, byte [esp + 0x2f]
test al, al
je 0x490d6f
push str.Tavern
mov esi, 0x8ebf58
call fcn.004f7660
add esp, 4
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push 0x64
push ebx
push edi
push 0x86bb48
xor eax, eax
mov dword [0x85c11c], 0x64
call fcn.004b0b40
add esp, 0x20
jmp 0x490d6f
mov eax, ebp
cdq
sub eax, edx
mov edx, dword [esp + 0x50]
sar eax, 1
add eax, edx
and al, 1
neg al
lea edx, [ebp - 0x18]
sbb eax, eax
and eax, 0xfffffff6
add eax, 0xa
mov edi, eax
lea eax, [ecx - 0x18]
test eax, eax
jge 0x490442
neg eax
test edx, edx
jge 0x490448
neg edx
cmp eax, edx
jle 0x490451
lea eax, [edx + eax*2]
jmp 0x490454
lea eax, [eax + edx*2]
cdq
sub eax, edx
sar eax, 1
cmp eax, 7
jg 0x4905b3
lea eax, [ecx + ebp]
test al, 1
je 0x4905b3
mov eax, dword [edi*4 + 0x8c4d68]
mov dword [esp + 0x34], eax
lea eax, [ebp - 1]
cdq
and edx, 3
add eax, edx
mov ecx, eax
mov eax, dword [esp + 0x30]
sar ecx, 2
dec eax
cdq
and edx, 3
add eax, edx
mov edx, dword [esp + 0x54]
sar eax, 2
add ecx, eax
and ecx, 3
shl ecx, 0x1e
add ecx, edx
mov dword [esp + 0x20], ecx
push 0
fild dword [esp + 0x24]
push 0
lea eax, [esp + 0x1d0]
fmul qword [0x715728]
fstp dword [esp + 0x30]
mov edx, dword [esp + 0x30]
push edx
call fcn.004dc670
mov eax, dword [0x8ef5b8]
mov ecx, dword [0x728090]
mov edi, dword [esp + 0x30]
add esp, 0xc
push eax
push 0xffffffffffffffff
push ecx
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x1d4]
push edx
push 0
lea esi, [ebx - 0x1f4]
push esi
add edi, 0xfffffe0c
push edi
call fcn.004bc350
mov dword [esp + 0x20], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x490522
lea ecx, [esp + 0x20]
push ecx
add eax, 0x1e8
call fcn.004c3730
mov edx, dword [esp + 0x30]
lea ecx, [edx + ebp]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
cdq
mov ecx, 3
idiv ecx
sub edx, 0
je 0x4907fa
dec edx
jne 0x490d6f
mov edx, dword [esp + 0x28]
push 0
push 0
push edx
lea eax, [esp + 0x264]
call fcn.004dc670
mov eax, dword [0x728090]
add esp, 0xc
push 0
push 0
push eax
lea ecx, [esp + 0x264]
push ecx
mov ecx, dword [0x8c4d78]
push 0
push esi
push edi
call fcn.004bc350
mov dword [esp + 0x14], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x490d6f
lea edx, [esp + 0x14]
push edx
add eax, 0x1e8
call fcn.004c3730
jmp 0x490d6f
mov dl, byte [esi + ebp + 0x8c83a1]
xor eax, eax
cmp dl, 4
jne 0x4905c6
mov eax, 1
cmp byte [esi + ebp + 0x8c8371], 4
jne 0x4905d5
mov eax, 1
cmp byte [esi + ebp + 0x8c83d0], 4
jne 0x4905e4
mov eax, 1
cmp byte [esi + ebp + 0x8c83cf], 4
jne 0x4905f3
mov eax, 1
cmp byte [esi + ebp + 0x8c839e], 4
jne 0x490602
mov eax, 1
cmp byte [esi + ebp + 0x8c836e], 4
jne 0x490611
mov eax, 1
lea edx, [ecx + ecx*2 - 6]
shl edx, 4
cmp byte [edx + ebp + 0x8c83a0], 4
jne 0x490627
mov eax, 1
cmp byte [esi + ebp + 0x8c833f], 4
jne 0x490636
mov eax, 1
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x50]
add edx, esi
test dl, 1
jne 0x49064d
test eax, eax
je 0x490700
mov eax, dword [edi*4 + 0x8c4d6c]
mov dword [esp + 0x20], eax
lea eax, [ebp - 1]
cdq
and edx, 3
add eax, edx
mov ecx, eax
mov eax, dword [esp + 0x30]
sar ecx, 2
dec eax
cdq
and edx, 3
add eax, edx
mov edx, dword [esp + 0x54]
sar eax, 2
add ecx, eax
and ecx, 3
shl ecx, 0x1e
add ecx, edx
mov dword [esp + 0x14], ecx
push 0
fild dword [esp + 0x18]
push 0
lea eax, [esp + 0x2a8]
fmul qword [0x715728]
fstp dword [esp + 0x30]
mov edx, dword [esp + 0x30]
push edx
call fcn.004dc670
mov eax, dword [0x8ef5b8]
mov ecx, dword [0x728090]
mov edi, dword [esp + 0x30]
add esp, 0xc
push eax
push 0xffffffffffffffff
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x2ac]
push edx
push 0
lea esi, [ebx - 0x1f4]
push esi
add edi, 0xfffffe0c
push edi
call fcn.004bc350
mov dword [esp + 0x14], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x490522
lea ecx, [esp + 0x14]
jmp 0x490517
mov esi, dword [0x728090]
lea eax, [ebp - 1]
cdq
and edx, 3
add eax, edx
mov edi, eax
dec ecx
mov eax, ecx
cdq
and edx, 3
sar edi, 2
add eax, edx
sar eax, 2
add edi, eax
push 0
and edi, 3
push 0
add esi, 0xffffff9c
shl edi, 0x1e
test cl, 1
mov dword [0x8ef5b8], 0x9c4
push ecx
je 0x490785
mov dword [esp + 0x20], edi
fild dword [esp + 0x20]
lea eax, [esp + 0x21c]
fmul qword [0x715728]
fstp dword [esp]
call fcn.004dc670
mov ecx, dword [0x8c4d58]
add esp, 0xc
push 0x9c4
push 0xffffffffffffffff
push esi
mov edx, eax
mov eax, dword [esp + 0x30]
push edx
push 0
add ebx, 0xfffffe0c
push ebx
add eax, 0xfffffe0c
push eax
jmp 0x4907ca
mov dword [esp + 0x20], edi
fild dword [esp + 0x20]
lea eax, [esp + 0x33c]
fmul qword [0x715728]
fstp dword [esp]
call fcn.004dc670
mov edx, dword [esp + 0x30]
add esp, 0xc
push 0x9c4
push 0xffffffffffffffff
push esi
mov ecx, eax
push ecx
mov ecx, dword [0x8c4d54]
push 0
add ebx, 0xfffffe0c
push ebx
add edx, 0xfffffe0c
push edx
call fcn.004bc350
mov dword [esp + 0x14], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x490d6f
lea ecx, [esp + 0x14]
push ecx
add eax, 0x1e8
call fcn.004c3730
jmp 0x490d6f
mov eax, dword [esp + 0x28]
push 0
push 0
push eax
lea eax, [esp + 0x168]
call fcn.004dc670
mov ecx, dword [0x728090]
add esp, 0xc
push 0
push 0
push ecx
mov ecx, dword [0x8c4d60]
mov edx, eax
push edx
push 0
push esi
push edi
call fcn.004bc350
mov dword [esp + 0x14], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x490851
lea ecx, [esp + 0x14]
push ecx
add eax, 0x1e8
call fcn.004c3730
cmp dword [0x85c158], 4
jge 0x490d6f
fild dword [0x728090]
fmul dword [0x715878]
call fcn.005f275c
mov ecx, dword [esp + 0x30]
mov edi, eax
push 0
mov eax, 0x18
mov esi, 0x18
push 0
sub eax, ebp
sub esi, ecx
call fcn.004dca00
mov edx, dword [0x72808c]
shl eax, 0x1d
neg edx
sbb edx, edx
and edx, 0x80000000
add edx, 0x40000000
sub eax, edx
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
push ecx
lea eax, [esp + 0x1b0]
fmul qword [0x715728]
fstp dword [esp]
call fcn.004dc670
mov ecx, dword [esp + 0x30]
add esp, 0xc
push 0
push 0
push edi
push eax
push 0x96
add ebx, 0x12c
add ecx, 0x12c
push ebx
push ecx
mov ecx, dword [0x8c4d44]
call fcn.004bc350
mov dword [esp + 0x14], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x490d6f
lea edx, [esp + 0x14]
push edx
add eax, 0x200
call fcn.004c3730
jmp 0x490d6f
mov eax, dword [0x8ccb18]
test eax, eax
jne 0x49095b
call dword [sym.imp.MSVCR71.dll_rand]
cdq
mov ecx, 3
idiv ecx
movsx eax, byte [esi + ebp + 0x8c7198]
lea eax, [edx + eax - 1]
cmp eax, 0xfffffff1
jge 0x49094a
mov eax, 0xfffffff1
jmp 0x490954
cmp eax, 0xf
jle 0x490954
mov eax, 0xf
mov byte [esi + ebp + 0x8c7198], al
cmp dword [esp + 0x28], 1
jne 0x490ad7
cmp byte [esi + ebp + 0x8c83d0], 4
jne 0x490acf
cmp byte [esi + ebp + 0x8c8370], 4
jne 0x490acf
xor ecx, ecx
test edi, edi
setne cl
push 0
push 0
lea ecx, [ecx + ecx - 1]
add ecx, ebp
cmp byte [ecx + esi + 0x8c83a0], 4
jne 0x490a2a
xor edx, edx
test edi, edi
setne dl
push ecx
lea eax, [esp + 0x1f8]
dec edx
and edx, 2
shl edx, 0x1e
mov dword [esp + 0x20], edx
fild dword [esp + 0x20]
fmul qword [0x715728]
fstp dword [esp]
call fcn.004dc670
mov eax, dword [0x728090]
mov edx, dword [esp + 0x30]
add esp, 0xc
push 0
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x1f8]
push ecx
mov ecx, dword [0x8c4d64]
push 0
push ebx
push edx
call fcn.004bc350
mov dword [esp + 0x14], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x490a17
lea ecx, [esp + 0x14]
push ecx
add eax, 0x200
call fcn.004c3730
lea edx, [esi + ebp]
mov dword [edx*4 + 0x8c4d98], 0
jmp 0x490ad7
mov eax, dword [0x72e774]
shl eax, 5
mov dl, byte [eax + 0x862b74]
xor ecx, ecx
cmp dl, 3
setne cl
xor edx, edx
lea eax, [esp + 0x23c]
dec ecx
and ecx, 0x40000000
test edi, edi
setne dl
dec edx
and edx, 2
shl edx, 0x1e
add ecx, edx
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x1c]
push ecx
fmul qword [0x715728]
fstp dword [esp]
call fcn.004dc670
mov eax, dword [0x728090]
mov edx, dword [esp + 0x30]
add esp, 0xc
push 0
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x240]
push ecx
mov ecx, dword [0x8c4d70]
push 0
push ebx
push edx
call fcn.004bc350
mov dword [esp + 0x14], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x490abf
lea ecx, [esp + 0x14]
push ecx
add eax, 0x200
call fcn.004c3730
lea edx, [esi + ebp]
mov dword [edx*4 + 0x8c4d98], 1
jmp 0x490ad7
mov byte [esi + ebp + 0x8c83a0], 1
cmp edi, 1
jne 0x490d6f
cmp byte [esi + ebp + 0x8c83a1], 4
jne 0x490d67
cmp byte [esi + ebp + 0x8c839f], 4
jne 0x490d67
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
xor eax, eax
test ecx, ecx
setne al
lea eax, [eax + eax - 1]
mov edi, eax
lea eax, [edi + edx]
lea eax, [eax + eax*2]
shl eax, 4
xor edx, edx
lea esi, [eax + ebp]
cmp byte [esi + 0x8c83a0], 4
push edx
push edx
push ecx
jne 0x490bb9
test ecx, ecx
sete dl
lea eax, [esp + 0x288]
lea edx, [edx + edx + 1]
shl edx, 0x1e
mov dword [esp + 0x20], edx
fild dword [esp + 0x20]
fmul qword [0x715728]
fstp dword [esp]
call fcn.004dc670
mov eax, dword [0x728090]
mov edx, dword [esp + 0x30]
add esp, 0xc
push 0
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x288]
push ecx
mov ecx, dword [0x8c4d64]
push 0
push ebx
push edx
call fcn.004bc350
mov dword [esp + 0x14], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x490ba2
lea ecx, [esp + 0x14]
push ecx
add eax, 0x200
call fcn.004c3730
mov edx, dword [esp + 0x1c]
lea eax, [edx + ebp]
mov dword [eax*4 + 0x8c4d98], 0
jmp 0x490d6f
test ecx, ecx
sete dl
lea eax, [esp + 0x80]
lea edx, [edx + edx + 1]
shl edx, 0x1e
mov dword [esp + 0x20], edx
fild dword [esp + 0x20]
fmul qword [0x715728]
fstp dword [esp]
call fcn.004dc670
mov eax, dword [0x728090]
mov edx, dword [esp + 0x30]
add esp, 0xc
push 0
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x80]
push ecx
mov ecx, dword [0x8c4d64]
push 0
push ebx
push edx
call fcn.004bc350
mov dword [esp + 0x14], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x490c2c
lea ecx, [esp + 0x14]
push ecx
add eax, 0x200
call fcn.004c3730
mov edx, dword [0x728090]
mov eax, dword [esp + 0x28]
add edx, 0xc8
neg eax
sbb eax, eax
and eax, 0xfffffffa
add eax, 7
imul eax, eax, 0x15555555
mov dword [esp + 0x14], eax
push 0
fild dword [esp + 0x18]
push 0
push ecx
lea eax, [esp + 0x2d0]
fmul qword [0x715728]
mov dword [esi*4 + 0x8c4d98], 0x1869f
fstp dword [esp]
mov dword [esp + 0x2c], edx
call fcn.004dc670
mov ecx, edi
imul edi, edi, 0x4b0
imul ecx, ecx, 0x3e8
mov eax, 0x55555556
imul ecx
mov ecx, dword [esp + 0x30]
add esp, 0xc
push 0
mov esi, edx
push 0xffffffffffffffff
shr esi, 0x1f
add esi, edx
mov edx, dword [esp + 0x28]
push edx
lea eax, [esp + 0x2d0]
push eax
add edi, ecx
push 0
lea ecx, [esi + ebx]
push ecx
mov ecx, dword [0x8c4d7c]
push edi
call fcn.004bc350
mov dword [esp + 0x14], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x490ce7
lea edx, [esp + 0x14]
push edx
add eax, 0x200
call fcn.004c3730
mov edx, dword [0x728090]
mov eax, dword [esp + 0x28]
add edx, 0xc8
neg eax
sbb eax, eax
and eax, 0xfffffffa
add eax, 0xb
imul eax, eax, 0x15555555
mov dword [esp + 0x14], eax
push 0
fild dword [esp + 0x18]
push 0
push ecx
lea eax, [esp + 0x318]
fmul qword [0x715728]
fstp dword [esp]
call fcn.004dc670
mov ecx, dword [0x8c4d7c]
add esp, 0xc
push 0
push 0xffffffffffffffff
push edx
push eax
push 0
sub ebx, esi
push ebx
push edi
call fcn.004bc350
mov dword [esp + 0x14], eax
mov eax, dword [0x8ccc58]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x490d6f
lea ecx, [esp + 0x14]
push ecx
add eax, 0x200
call fcn.004c3730
jmp 0x490d6f
mov byte [esi + ebp + 0x8c83a0], 1
inc ebp
cmp ebp, 0x30
jl 0x48fed0
mov eax, dword [esp + 0x30]
inc eax
cmp eax, 0x30
mov dword [esp + 0x30], eax
jl 0x48fe90
mov eax, dword [esp + 0x384]
test eax, eax
je 0x491372
mov ebx, dword [0x8ebfd8]
fld dword [0x715768]
mov eax, dword [0x85c164]
lea edx, [ebx + 0x128]
lea edi, [esp + 0x74]
mov ecx, 7
mov esi, edx
rep movsd dword es:[edi], dword [esi]
fld dword [esp + 0x88]
fucompp
test ah, 8
fnstsw ax
je 0x491270
test ah, 0x44
jp 0x490ded
fld dword [0x715798]
fld dword [esp + 0x84]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x490e20
mov esi, edx
mov ecx, 7
lea edi, [esp + 0x74]
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x74]
mov ecx, ebx
mov dword [esp + 0x84], 0x42480000
mov dword [esp + 0x88], 0x47c35000
call fcn.004cdb50
call fcn.004adca0
mov ecx, dword [0x8c43dc]
mov eax, dword [0x8c43ec]
sar ecx, 0x1c
inc ecx
sar ecx, 1
and ecx, 7
test ah, 1
mov dword [0x8c4d30], 0x2ee0
je 0x490fc5
mov edx, dword [0x8c43c4]
add edx, 0x1f4
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov edi, dword [ecx*4 + 0x7272f0]
mov esi, edx
mov ecx, dword [ecx*4 + 0x727350]
shr esi, 0x1f
add esi, edx
mov edx, dword [0x8c43c8]
add edx, 0x1f4
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [esi + edi*2]
lea edx, [edx + edx*2]
lea edx, [ecx + edx*8]
cmp byte [eax + edx*2 + 0x8c83a0], 1
jne 0x490ef9
lea edx, [esi + edi*2]
add edx, edi
shl edx, 4
add edx, ecx
lea ebx, [eax + edx*2]
cmp byte [edx + ebx + 0x8c83a0], 1
jne 0x490eea
lea edx, [esi + edi*4]
lea edx, [edx + edx*2]
lea ecx, [ecx + edx*4]
cmp byte [eax + ecx*4 + 0x8c83a0], 1
jne 0x490edb
mov ebx, 0x1387
mov dword [esp + 0x1c], 0xfffffc18
jmp 0x490f06
mov ebx, 0xf9f
mov dword [esp + 0x1c], 0xfffffe0c
jmp 0x490f06
mov ebx, 0xbb7
mov dword [esp + 0x1c], 0xfffffeb3
jmp 0x490f06
mov dword [esp + 0x1c], 0xffffff5a
mov ebx, 0x7cf
mov ebp, dword [0x8c4d38]
mov eax, ebx
mov ecx, 0x638e38e3
mov dword [0x8c4d30], ebx
add ebp, 0xf8e38e39
call fcn.004dcac0
mov ecx, ebp
mov edi, eax
call fcn.004dcac0
mov edx, dword [0x85c138]
mov ecx, eax
mov eax, dword [0x8c43c4]
add eax, edx
cdq
sub eax, edx
mov esi, eax
sar esi, 1
sub esi, ecx
lea ecx, [ebp + 0x40000000]
mov eax, edi
call fcn.004dcac0
mov edx, dword [0x85c134]
mov ecx, eax
mov eax, dword [0x8c43c8]
add eax, edx
cdq
sub eax, edx
mov edi, eax
mov eax, ebx
cdq
xor eax, edx
sar edi, 1
sub edi, ecx
sub eax, edx
cmp eax, 0x7d00
mov ecx, ebx
mov dword [esp + 0x18], 1
mov ebx, dword [esp + 0x18]
jle 0x490f9d
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
cdq
xor eax, edx
sub eax, edx
add ebx, ebx
cmp eax, 0x7d00
jg 0x490f86
push 0x471c71c7
push 0
push 0x238e38e3
mov edx, ecx
push ebp
mov ecx, 0x238e38e3
call fcn.00495330
imul eax, ebx
add eax, dword [esp + 0x2c]
push eax
push edi
push esi
jmp 0x4913a3
test cl, 1
mov dword [esp + 0x14], ecx
jne 0x490fd1
and ecx, 7
mov ebp, dword [0x8c43c4]
lea edx, [ebp + 0x1f4]
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x8c43c8]
add edx, 0x1f4
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov edi, edx
shr edi, 0x1f
xor ebx, ebx
add edi, edx
lea ecx, [ecx]
mov edx, dword [ecx*4 + 0x7272f0]
mov eax, esi
sub eax, edx
lea edx, [eax + eax*2]
mov eax, dword [ecx*4 + 0x727350]
shl edx, 4
sub edx, eax
cmp byte [edx + edi + 0x8c83a0], 4
jne 0x4910f7
inc ecx
and ecx, 7
inc ebx
cmp ebx, 8
jl 0x491010
mov ebx, dword [0x8c4d38]
mov eax, 0x960
mov ecx, 0x60000000
add ebx, 0xfaaaaaab
call fcn.004dcac0
mov ecx, ebx
mov edi, eax
call fcn.004dcac0
mov edx, dword [0x85c138]
mov ecx, eax
lea eax, [edx + ebp]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
sub esi, ecx
lea ecx, [ebx + 0x40000000]
mov eax, edi
call fcn.004dcac0
mov edx, dword [0x85c134]
mov ecx, eax
mov eax, dword [0x8c43c8]
add eax, edx
cdq
sub eax, edx
mov edi, eax
sar edi, 1
sub edi, ecx
mov ecx, 0x960
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov ebp, 1
jle 0x4910ce
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
cdq
xor eax, edx
sub eax, edx
add ebp, ebp
cmp eax, 0x7d00
jg 0x4910b7
push 0x20000000
push 0
mov edx, ecx
push 0x20000000
mov ecx, 0x20000000
push ebx
call fcn.00495330
imul eax, ebp
add eax, 0x1f4
push eax
push edi
push esi
jmp 0x4913a3
mov eax, dword [esp + 0x14]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 2
je 0x4911b1
cmp eax, 6
je 0x4911b1
shl ecx, 0x1d
mov ebx, ecx
mov eax, 0x7d0
mov ecx, 0x57777777
call fcn.004dcac0
mov ecx, ebx
mov edi, eax
call fcn.004dcac0
mov edx, dword [0x85c138]
mov ecx, eax
lea eax, [edx + ebp]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
sub esi, ecx
lea ecx, [ebx + 0x40000000]
mov eax, edi
call fcn.004dcac0
mov edx, dword [0x85c134]
mov ecx, eax
mov eax, dword [0x8c43c8]
add eax, edx
cdq
sub eax, edx
mov edi, eax
sar edi, 1
sub edi, ecx
mov ecx, 0x7d0
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov ebp, 1
jle 0x491199
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
cdq
xor eax, edx
sub eax, edx
add ebp, ebp
cmp eax, 0x7d00
jg 0x491182
push 0x31c71c71
push 0
mov edx, ecx
push 0x17777777
mov ecx, 0x17777777
jmp 0x4910e1
or esi, 0xffffffff
cmp ebx, 2
jle 0x4911be
mov esi, 1
lea esi, [esi + ecx*2]
mov eax, 0x7d0
mov ecx, 0x57777777
shl esi, 0x1c
call fcn.004dcac0
mov ecx, esi
mov ebx, eax
call fcn.004dcac0
mov edx, dword [0x85c138]
mov ecx, eax
lea eax, [edx + ebp]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
sub edi, ecx
lea ecx, [esi + 0x40000000]
mov eax, ebx
call fcn.004dcac0
mov edx, dword [0x85c134]
mov ecx, eax
mov eax, dword [0x8c43c8]
add eax, edx
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
sub ebx, ecx
mov ecx, 0x7d0
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov ebp, 1
jle 0x491247
lea ecx, [ecx]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
cdq
xor eax, edx
sub eax, edx
add ebp, ebp
cmp eax, 0x7d00
jg 0x491230
push 0x31c71c71
push 0
push 0x17777777
mov edx, ecx
push esi
mov ecx, 0x17777777
call fcn.00495330
imul eax, ebp
add eax, 0x1f4
push eax
push ebx
push edi
jmp 0x4913a3
test ah, 0x44
jp 0x49128b
fld dword [0x7158b0]
fld dword [esp + 0x84]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x4912be
mov esi, edx
mov ecx, 7
lea edi, [esp + 0x74]
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x74]
mov ecx, ebx
mov dword [esp + 0x84], 0x43fa0000
mov dword [esp + 0x88], 0x47c35000
call fcn.004cdb50
call fcn.004adca0
mov ecx, dword [0x8c4d38]
mov edx, dword [0x8ccb10]
mov eax, dword [0x8c4d30]
lea eax, [eax + eax*4]
lea edi, [edx + ecx]
cdq
and edx, 3
add eax, edx
mov esi, eax
sar esi, 2
mov eax, esi
mov ecx, 0x638e38e3
call fcn.004dcac0
mov ecx, edi
mov ebp, eax
call fcn.004dcac0
mov ebx, dword [0x85c138]
sub ebx, eax
lea ecx, [edi + 0x40000000]
mov eax, ebp
call fcn.004dcac0
mov ebp, dword [0x85c134]
sub ebp, eax
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov dword [esp + 0x1c], 1
jle 0x49134a
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov esi, eax
mov eax, dword [esp + 0x1c]
lea ecx, [eax + eax]
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov dword [esp + 0x1c], ecx
jg 0x491328
push 0x17777777
push 0
push 0x238e38e3
push edi
mov edx, esi
mov ecx, 0x238e38e3
call fcn.00495330
imul eax, dword [esp + 0x2c]
add eax, 0x1f4
push eax
push ebp
push ebx
jmp 0x4913a3
mov edx, dword [esp + 0x380]
mov eax, dword [esp + 0x37c]
push 0x20000000
push 0
push 0x20000000
push 0x20000000
push 0x9c40
add edx, 0xffff8300
push edx
add eax, 0xffff8300
push eax
call fcn.004ad540
mov al, byte [0x85c164]
add esp, 0x1c
test al, 4
je 0x4913fd
push str.Paused
mov esi, 0x8ebf58
call fcn.004f7660
mov eax, dword [0x85c268]
mov ecx, dword [0x85c11c]
add esp, 4
cdq
push 0
push 0xffffffffffffffff
sub eax, edx
push 4
sar eax, 1
sub eax, 0xc
push 0xffffffffffffffff
push ecx
push eax
mov eax, dword [0x85c26c]
cdq
sub eax, edx
sar eax, 1
push eax
push 0x86bb48
xor eax, eax
call fcn.004b0b40
add esp, 0x20
mov edx, dword [0x8c4cf0]
mov eax, dword [edx + 0x1c]
add eax, 0x90
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x64], ecx
lea ecx, [esp + 0x64]
push ecx
push 0
push 0
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], eax
call fcn.004d1a40
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x368
ret