Function at 0x4e6e88
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb7
push 0
push 0
dec ecx
jne 0x4e6e90
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov ecx, 4
lea eax, [ebp - 0x64]
mov edx, dword [0x401110]
call fcn.00405490
mov ecx, 5
lea eax, [ebp - 0xc8]
mov edx, dword [0x401110]
call fcn.00405490
mov ecx, 0x14
lea eax, [ebp - 0x118]
mov edx, dword [0x401110]
call fcn.00405490
lea eax, [ebp - 0x270]
mov edx, dword [0x4082bc]
call fcn.00405460
xor eax, eax
push ebp
push 0x4e8703
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x440]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445474
cmp dword [ebp - 0x440], 0
jne 0x4e6f27
mov eax, 0x4e871c
call fcn.0043e650
jmp 0x4e85f5
lea eax, [ebp - 0x444]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
mov ecx, 1
xor edx, edx
call fcn.004721e8
cmp dword [ebp - 0x444], 0
jne 0x4e6f5b
mov eax, 0x4e8738
call fcn.0043e650
jmp 0x4e85f5
mov dword [ebp - 8], 1
mov ebx, 0x4f1094
lea eax, [ebp - 0x30]
call fcn.00404968
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x448]
push eax
mov ecx, dword [ebp - 8]
dec ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
mov edx, dword [ebp - 0xc]
call fcn.004721e8
mov eax, dword [ebp - 0x448]
push eax
lea edx, [ebp - 0x44c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445474
mov edx, dword [ebp - 0x44c]
pop eax
call fcn.00404f5c
test eax, eax
jg 0x4e6fe5
lea eax, [ebp - 0x450]
push eax
mov ecx, dword [ebp - 8]
dec ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
mov edx, dword [ebp - 0xc]
call fcn.004721e8
mov edx, dword [ebp - 0x450]
lea eax, [ebp - 0x30]
call fcn.00404c28
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xa
jne 0x4e6f74
push ebx
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x30]
call fcn.00404e78
lea eax, [ebx + 0x28]
push eax
mov eax, dword [ebp - 0x30]
call fcn.00404c20
mov edx, eax
sub edx, 3
mov ecx, 4
mov eax, dword [ebp - 0x30]
call fcn.00404e78
inc dword [ebp - 8]
add ebx, 4
cmp dword [ebp - 8], 0xb
jne 0x4e6f67
mov dword [ebp - 8], 1
mov ebx, 0x4f10e4
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x454]
push eax
mov edi, dword [ebp - 8]
dec edi
mov ecx, edi
mov esi, dword [ebp - 0x10]
add esi, esi
mov edx, esi
sub edx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.004721e8
mov eax, dword [ebp - 0x454]
push eax
lea edx, [ebp - 0x458]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445474
mov edx, dword [ebp - 0x458]
pop eax
call fcn.00404f5c
test eax, eax
jg 0x4e70d7
lea eax, [ebp - 0x45c]
push eax
mov ecx, edi
mov edx, esi
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.004721e8
mov eax, dword [ebp - 0x45c]
push eax
lea edx, [ebp - 0x460]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445474
mov edx, dword [ebp - 0x460]
pop eax
call fcn.00404f5c
test eax, eax
jle 0x4e70e4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
jne 0x4e7042
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
inc eax
cmp eax, 5
jg 0x4e719c
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x464]
push eax
mov edi, dword [ebp - 8]
dec edi
mov ecx, edi
mov esi, dword [ebp - 0x10]
add esi, esi
mov edx, esi
sub edx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.004721e8
mov eax, dword [ebp - 0x464]
push eax
lea edx, [ebp - 0x468]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445474
mov edx, dword [ebp - 0x468]
pop eax
call fcn.00404f5c
test eax, eax
jg 0x4e718f
lea eax, [ebp - 0x46c]
push eax
mov ecx, edi
mov edx, esi
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.004721e8
mov eax, dword [ebp - 0x46c]
push eax
lea edx, [ebp - 0x470]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445474
mov edx, dword [ebp - 0x470]
pop eax
call fcn.00404f5c
test eax, eax
jle 0x4e719c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
jne 0x4e70fa
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x474]
push eax
mov ecx, dword [ebp - 8]
dec ecx
mov edx, dword [ebp - 0x38]
add edx, edx
sub edx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.004721e8
push dword [ebp - 0x474]
lea eax, [ebp - 0x478]
push eax
mov ecx, dword [ebp - 8]
dec ecx
mov edx, dword [ebp - 0x38]
add edx, edx
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.004721e8
push dword [ebp - 0x478]
lea eax, [ebp - 0x47c]
push eax
mov ecx, dword [ebp - 8]
dec ecx
mov edx, dword [ebp - 0x34]
add edx, edx
sub edx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.004721e8
push dword [ebp - 0x47c]
lea eax, [ebp - 0x480]
push eax
mov ecx, dword [ebp - 8]
dec ecx
mov edx, dword [ebp - 0x34]
add edx, edx
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.004721e8
push dword [ebp - 0x480]
mov eax, ebx
mov edx, 4
call fcn.00404ce0
inc dword [ebp - 8]
add ebx, 4
cmp dword [ebp - 8], 0xb
jne 0x4e703b
mov dword [ebp - 8], 1
mov ebx, 0x4f110c
lea eax, [ebp - 0x30]
call fcn.00404968
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xc], 1
lea eax, [ebp - 0x484]
push eax
mov ecx, dword [ebp - 0xc]
dec ecx
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.004721e8
mov eax, dword [ebp - 0x484]
mov edx, dword [ebp - 0x30]
call fcn.00404f5c
test eax, eax
jg 0x4e72d9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jg 0x4e72e2
lea eax, [ebp - 0x488]
push eax
mov ecx, dword [ebp - 0xc]
dec ecx
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.004721e8
mov edx, dword [ebp - 0x488]
lea eax, [ebp - 0x30]
call fcn.00404c28
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xb
jne 0x4e7276
mov eax, ebx
mov edx, dword [ebp - 0x30]
call fcn.004049bc
lea eax, [ebp - 0x30]
call fcn.00404968
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xc], 0xa
lea eax, [ebp - 0x48c]
push eax
mov ecx, dword [ebp - 0xc]
dec ecx
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.004721e8
mov eax, dword [ebp - 0x48c]
mov edx, dword [ebp - 0x30]
call fcn.00404f5c
test eax, eax
jg 0x4e7363
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jg 0x4e736c
lea eax, [ebp - 0x490]
push eax
mov ecx, dword [ebp - 0xc]
dec ecx
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.004721e8
mov edx, dword [ebp - 0x490]
lea eax, [ebp - 0x30]
call fcn.00404c28
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x4e7300
lea eax, [ebx + 0x28]
mov edx, dword [ebp - 0x30]
call fcn.004049bc
inc dword [ebp - 8]
add ebx, 4
cmp dword [ebp - 8], 0xb
jne 0x4e7262
mov dword [ebp - 8], 0x32
mov ebx, 0x4f1094
mov edi, 1
lea esi, [ebp - 0x64]
push esi
mov ecx, 1
mov edx, edi
mov eax, dword [ebx]
call fcn.00404e78
inc edi
add esi, 4
cmp edi, 5
jne 0x4e739b
mov dword [ebp - 0x10], 1
lea esi, [ebp - 0x64]
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, 3
jg 0x4e740d
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
lea edi, [ebp + eax*4 - 0x68]
mov eax, dword [esi]
call fcn.00409600
push eax
mov eax, dword [edi]
call fcn.00409600
pop edx
cmp edx, eax
jle 0x4e7401
lea eax, [ebp - 0x30]
mov edx, dword [esi]
call fcn.00404a00
mov eax, esi
mov edx, dword [edi]
call fcn.004049bc
mov eax, edi
mov edx, dword [ebp - 0x30]
call fcn.004049bc
inc dword [ebp - 0x14]
add edi, 4
cmp dword [ebp - 0x14], 4
jne 0x4e73d0
inc dword [ebp - 0x10]
add esi, 4
cmp dword [ebp - 0x10], 3
jne 0x4e73bd
push dword [ebp - 0x64]
push dword [ebp - 0x60]
push dword [ebp - 0x5c]
push dword [ebp - 0x58]
mov eax, ebx
mov edx, 4
call fcn.00404ce0
add ebx, 4
dec dword [ebp - 8]
jne 0x4e7393
lea edx, [ebp - 0x498]
mov eax, dword [0x4ef78c]
mov eax, dword [eax]
call fcn.004657b0
mov eax, dword [ebp - 0x498]
lea edx, [ebp - 0x494]
call fcn.0040999c
mov edx, dword [ebp - 0x494]
lea eax, [ebp - 0x40]
mov ecx, 0x4e8750
call fcn.00404c6c
lea ecx, [ebp - 0x270]
mov edx, 0x10
mov eax, dword [ebp - 0x40]
call fcn.00409874
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x4e7568
lea eax, [ebp - 0x270]
call fcn.004098e8
lea eax, [ebp - 0x49c]
mov ecx, 0x4e8764
mov edx, dword [ebp - 0x40]
call fcn.00404c6c
mov eax, dword [ebp - 0x49c]
lea ecx, [ebp - 0x270]
mov edx, 0x3f
call fcn.00409874
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4e74e0
lea eax, [ebp - 0x270]
call fcn.004098e8
jmp 0x4e7583
mov eax, dword [ebp - 0x264]
mov edx, 0x4e8774
call fcn.00404d64
je 0x4e7555
mov eax, dword [ebp - 0x264]
mov edx, 0x4e8780
call fcn.00404d64
je 0x4e7555
lea ecx, [ebp - 0x4a0]
mov edx, 4
mov eax, dword [ebp - 0x264]
call fcn.0043eed4
mov eax, dword [ebp - 0x4a0]
mov edx, 0x4e878c
call fcn.00404d64
jne 0x4e7555
push dword [ebp - 0x40]
push 0x4e879c
push dword [ebp - 0x264]
lea eax, [ebp - 0x4a4]
mov edx, 3
call fcn.00404ce0
mov eax, dword [ebp - 0x4a4]
call fcn.00409904
lea eax, [ebp - 0x270]
call fcn.004098c4
mov dword [ebp - 0x28], eax
jmp 0x4e74ca
lea eax, [ebp - 0x270]
call fcn.004098e8
push 0
mov eax, dword [ebp - 0x40]
call fcn.00404e18
push eax
call sub.kernel32.dll_CreateDirectoryA
lea eax, [ebp - 0x44]
mov ecx, 0x4e87a8
mov edx, dword [ebp - 0x40]
call fcn.00404c6c
lea eax, [ebp - 0xc8]
mov edx, dword [ebp - 0x44]
call fcn.00404a00
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x43c]
call fcn.00402ea4
lea eax, [ebp - 0x43c]
call fcn.00402c40
call fcn.00402960
xor eax, eax
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0xb4]
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 4], eax
inc dword [ebp - 0x10]
add ebx, 8
cmp dword [ebp - 0x10], 0xa
jne 0x4e75ca
mov dword [ebp - 0x10], 0x32
mov ebx, 0x4f1094
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x4a8]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx]
call fcn.00404e78
mov eax, dword [ebp - 0x4a8]
call fcn.00409600
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
inc dword [ebp + eax*8 - 0xb0]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 5
jne 0x4e75f3
add ebx, 4
dec dword [ebp - 0x10]
jne 0x4e75ec
xor eax, eax
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0xb0]
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, 9
jg 0x4e7691
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
lea eax, [ebp + eax*8 - 0xb0]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
cmp eax, dword [ebx]
jle 0x4e7684
mov edi, 2
lea eax, [ebx - 4]
mov edx, dword [ebp - 0x50]
add edx, 0xfffffffc
mov ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x24]
mov dword [edx], ecx
add edx, 4
add eax, 4
dec edi
jne 0x4e766d
inc dword [ebp - 0x14]
add dword [ebp - 0x50], 8
cmp dword [ebp - 0x14], 0xa
jne 0x4e7656
inc dword [ebp - 0x10]
add ebx, 8
cmp dword [ebp - 0x10], 9
jne 0x4e763d
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x20], 3
lea edx, [ebp - 0x4ac]
mov eax, dword [ebp - 0xb4]
call fcn.0040959c
push dword [ebp - 0x4ac]
lea edx, [ebp - 0x4b0]
mov eax, dword [ebp - 0xac]
call fcn.0040959c
push dword [ebp - 0x4b0]
lea edx, [ebp - 0x4b4]
mov eax, dword [ebp - 0xa4]
call fcn.0040959c
push dword [ebp - 0x4b4]
lea edx, [ebp - 0x4b8]
mov eax, dword [ebp - 0x9c]
call fcn.0040959c
push dword [ebp - 0x4b8]
lea edx, [ebp - 0x4bc]
mov eax, dword [ebp - 0x94]
call fcn.0040959c
push dword [ebp - 0x4bc]
lea edx, [ebp - 0x4c0]
mov eax, dword [ebp - 0x8c]
call fcn.0040959c
push dword [ebp - 0x4c0]
lea eax, [ebp - 0x3c]
mov edx, 6
call fcn.00404ce0
mov dword [ebp - 8], 0x3e8
mov ebx, 0x4f1544
xor eax, eax
mov dword [ebp - 0x24], eax
mov edi, 1
lea eax, [ebp - 0x4c4]
push eax
mov ecx, 1
mov edx, edi
mov eax, dword [ebp - 0x3c]
call fcn.00404e78
mov eax, dword [ebp - 0x4c4]
push eax
lea edx, [ebp - 0x4cc]
mov eax, dword [ebx]
call fcn.0040959c
push dword [ebp - 0x4cc]
lea edx, [ebp - 0x4d0]
mov eax, dword [ebx + 4]
call fcn.0040959c
push dword [ebp - 0x4d0]
lea edx, [ebp - 0x4d4]
mov eax, dword [ebx + 8]
call fcn.0040959c
push dword [ebp - 0x4d4]
lea eax, [ebp - 0x4c8]
mov edx, 3
call fcn.00404ce0
mov edx, dword [ebp - 0x4c8]
pop eax
call fcn.00404f5c
test eax, eax
jle 0x4e77d3
inc dword [ebp - 0x24]
inc edi
cmp edi, 7
jne 0x4e7758
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1c]
jl 0x4e784d
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
jg 0x4e784d
lea edx, [ebp - 0x4d8]
mov eax, dword [ebx]
call fcn.0040959c
push dword [ebp - 0x4d8]
lea edx, [ebp - 0x4dc]
mov eax, dword [ebx + 4]
call fcn.0040959c
push dword [ebp - 0x4dc]
lea edx, [ebp - 0x4e0]
mov eax, dword [ebx + 8]
call fcn.0040959c
push dword [ebp - 0x4e0]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404ce0
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x43c]
call fcn.00405034
call fcn.00403578
call fcn.00402960
add ebx, 0x10
dec dword [ebp - 8]
jne 0x4e774e
lea eax, [ebp - 0x43c]
call fcn.00402f6c
call fcn.00402960
lea eax, [ebp - 0x44]
mov ecx, 0x4e87c0
mov edx, dword [ebp - 0x40]
call fcn.00404c6c
lea eax, [ebp - 0xc4]
mov edx, dword [ebp - 0x44]
call fcn.00404a00
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x43c]
call fcn.00402ea4
lea eax, [ebp - 0x43c]
call fcn.00402c40
call fcn.00402960
xor eax, eax
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0xb4]
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 4], eax
inc dword [ebp - 0x10]
add ebx, 8
cmp dword [ebp - 0x10], 0xa
jne 0x4e78b0
mov dword [ebp - 0x10], 0xa
mov ebx, 0x4f10e4
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x4e4]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx]
call fcn.00404e78
mov eax, dword [ebp - 0x4e4]
call fcn.00409600
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
inc dword [ebp + eax*8 - 0xb0]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 5
jne 0x4e78d9
add ebx, 4
dec dword [ebp - 0x10]
jne 0x4e78d2
xor eax, eax
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0xb0]
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, 9
jg 0x4e7977
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
lea eax, [ebp + eax*8 - 0xb0]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
cmp eax, dword [ebx]
jle 0x4e796a
mov edi, 2
lea eax, [ebx - 4]
mov edx, dword [ebp - 0x54]
add edx, 0xfffffffc
mov ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x24]
mov dword [edx], ecx
add edx, 4
add eax, 4
dec edi
jne 0x4e7953
inc dword [ebp - 0x14]
add dword [ebp - 0x54], 8
cmp dword [ebp - 0x14], 0xa
jne 0x4e793c
inc dword [ebp - 0x10]
add ebx, 8
cmp dword [ebp - 0x10], 9
jne 0x4e7923
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], 2
lea edx, [ebp - 0x4e8]
mov eax, dword [ebp - 0xb4]
call fcn.0040959c
push dword [ebp - 0x4e8]
lea edx, [ebp - 0x4ec]
mov eax, dword [ebp - 0xac]
call fcn.0040959c
push dword [ebp - 0x4ec]
lea edx, [ebp - 0x4f0]
mov eax, dword [ebp - 0xa4]
call fcn.0040959c
push dword [ebp - 0x4f0]
lea edx, [ebp - 0x4f4]
mov eax, dword [ebp - 0x9c]
call fcn.0040959c
push dword [ebp - 0x4f4]
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.00404ce0
cmp dword [0x4f1060], 1
jne 0x4e7a16
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
mov edx, dword [ebp - 0x3c]
call fcn.004454a4
jmp 0x4e7a84
cmp dword [0x4f1060], 2
jne 0x4e7a32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [ebp - 0x3c]
call fcn.004454a4
jmp 0x4e7a84
cmp dword [0x4f1060], 3
jne 0x4e7a4e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov edx, dword [ebp - 0x3c]
call fcn.004454a4
jmp 0x4e7a84
cmp dword [0x4f1060], 4
jne 0x4e7a6a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x338]
mov edx, dword [ebp - 0x3c]
call fcn.004454a4
jmp 0x4e7a84
cmp dword [0x4f1060], 5
jne 0x4e7a84
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
mov edx, dword [ebp - 0x3c]
call fcn.004454a4
mov dword [ebp - 8], 0x3e8
mov ebx, 0x4f1544
xor eax, eax
mov dword [ebp - 0x24], eax
mov edi, 1
lea eax, [ebp - 0x4f8]
push eax
mov ecx, 1
mov edx, edi
mov eax, dword [ebp - 0x3c]
call fcn.00404e78
mov eax, dword [ebp - 0x4f8]
push eax
lea edx, [ebp - 0x500]
mov eax, dword [ebx]
call fcn.0040959c
push dword [ebp - 0x500]
lea edx, [ebp - 0x504]
mov eax, dword [ebx + 4]
call fcn.0040959c
push dword [ebp - 0x504]
lea edx, [ebp - 0x508]
mov eax, dword [ebx + 8]
call fcn.0040959c
push dword [ebp - 0x508]
lea eax, [ebp - 0x4fc]
mov edx, 3
call fcn.00404ce0
mov edx, dword [ebp - 0x4fc]
pop eax
call fcn.00404f5c
test eax, eax
jle 0x4e7b15
inc dword [ebp - 0x24]
inc edi
cmp edi, 7
jne 0x4e7a9a
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1c]
jl 0x4e7b8f
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
jg 0x4e7b8f
lea edx, [ebp - 0x50c]
mov eax, dword [ebx]
call fcn.0040959c
push dword [ebp - 0x50c]
lea edx, [ebp - 0x510]
mov eax, dword [ebx + 4]
call fcn.0040959c
push dword [ebp - 0x510]
lea edx, [ebp - 0x514]
mov eax, dword [ebx + 8]
call fcn.0040959c
push dword [ebp - 0x514]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404ce0
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x43c]
call fcn.00405034
call fcn.00403578
call fcn.00402960
add ebx, 0x10
dec dword [ebp - 8]
jne 0x4e7a90
lea eax, [ebp - 0x43c]
call fcn.00402f6c
call fcn.00402960
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
mov ebx, 0x4f1094
mov byte [ebp - 0x29], 0
mov edi, dword [ebp - 8]
dec edi
test edi, edi
jle 0x4e7be2
mov esi, 0x4f1094
mov eax, dword [esi]
mov edx, dword [ebx]
call fcn.00404d64
jne 0x4e7bdc
mov byte [ebp - 0x29], 1
add esi, 4
dec edi
jne 0x4e7bcd
cmp byte [ebp - 0x29], 0
jne 0x4e7d8c
inc dword [ebp - 0xc]
push dword [ebp - 0x40]
push 0x4e87d8
lea edx, [ebp - 0x518]
mov eax, dword [ebp - 0xc]
call fcn.0040959c
push dword [ebp - 0x518]
push 0x4e878c
lea eax, [ebp - 0x44]
mov edx, 4
call fcn.00404ce0
mov eax, dword [ebp - 0xc]
lea eax, [ebp + eax*4 - 0x11c]
mov edx, dword [ebp - 0x44]
call fcn.00404a00
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x43c]
call fcn.00402ea4
lea eax, [ebp - 0x43c]
call fcn.00402c40
call fcn.00402960
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], 3
lea eax, [ebp - 0x3c]
mov edx, dword [ebx]
call fcn.00404a00
mov dword [ebp - 0x10], 0x3e8
mov esi, 0x4f1544
xor eax, eax
mov dword [ebp - 0x24], eax
mov edi, 1
lea eax, [ebp - 0x51c]
push eax
mov ecx, 1
mov edx, edi
mov eax, dword [ebp - 0x3c]
call fcn.00404e78
mov eax, dword [ebp - 0x51c]
push eax
lea edx, [ebp - 0x524]
mov eax, dword [esi]
call fcn.0040959c
push dword [ebp - 0x524]
lea edx, [ebp - 0x528]
mov eax, dword [esi + 4]
call fcn.0040959c
push dword [ebp - 0x528]
lea edx, [ebp - 0x52c]
mov eax, dword [esi + 8]
call fcn.0040959c
push dword [ebp - 0x52c]
lea eax, [ebp - 0x520]
mov edx, 3
call fcn.00404ce0
mov edx, dword [ebp - 0x520]
pop eax
call fcn.00404f5c
test eax, eax
jle 0x4e7cf6
inc dword [ebp - 0x24]
inc edi
cmp edi, 5
jne 0x4e7c7b
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1c]
jl 0x4e7d70
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
jg 0x4e7d70
lea edx, [ebp - 0x530]
mov eax, dword [esi]
call fcn.0040959c
push dword [ebp - 0x530]
lea edx, [ebp - 0x534]
mov eax, dword [esi + 4]
call fcn.0040959c
push dword [ebp - 0x534]
lea edx, [ebp - 0x538]
mov eax, dword [esi + 8]
call fcn.0040959c
push dword [ebp - 0x538]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404ce0
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x43c]
call fcn.00405034
call fcn.00403578
call fcn.00402960
add esi, 0x10
dec dword [ebp - 0x10]
jne 0x4e7c71
lea eax, [ebp - 0x43c]
call fcn.00402f6c
call fcn.00402960
inc dword [ebp - 8]
add ebx, 4
cmp dword [ebp - 8], 0x15
jne 0x4e7bbc
mov dword [ebp - 8], 0x3e8
mov ebx, 0x4f1550
xor eax, eax
mov dword [ebx], eax
add ebx, 0x10
dec dword [ebp - 8]
jne 0x4e7da8
mov edi, dword [ebp - 0xc]
test edi, edi
jle 0x4e7ed6
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 0xc]
mov edx, dword [ebp + edx*4 - 0x11c]
call fcn.00404a00
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x43c]
call fcn.00402ea4
lea eax, [ebp - 0x43c]
call fcn.00402c34
call fcn.00402960
lea eax, [ebp - 0x48]
call fcn.00404968
lea eax, [ebp - 0x30]
call fcn.00404968
jmp 0x4e7e37
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x43c]
call fcn.00403290
lea eax, [ebp - 0x43c]
call fcn.004032fc
call fcn.00402960
push dword [ebp - 0x48]
push dword [ebp - 0x30]
push 0x4e87ec
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.00404ce0
lea eax, [ebp - 0x43c]
call fcn.00403110
call fcn.00402960
test al, al
je 0x4e7e01
mov dword [ebp - 0x10], 0x3e8
mov ebx, 0x4f1544
lea edx, [ebp - 0x540]
mov eax, dword [ebx]
call fcn.0040959c
push dword [ebp - 0x540]
lea edx, [ebp - 0x544]
mov eax, dword [ebx + 4]
call fcn.0040959c
push dword [ebp - 0x544]
lea edx, [ebp - 0x548]
mov eax, dword [ebx + 8]
call fcn.0040959c
push dword [ebp - 0x548]
lea eax, [ebp - 0x53c]
mov edx, 3
call fcn.00404ce0
mov eax, dword [ebp - 0x53c]
mov edx, dword [ebp - 0x48]
call fcn.00404f5c
test eax, eax
jg 0x4e7eb7
inc dword [ebx + 0xc]
add ebx, 0x10
dec dword [ebp - 0x10]
jne 0x4e7e57
lea eax, [ebp - 0x43c]
call fcn.00402f6c
call fcn.00402960
dec edi
jne 0x4e7dbf
lea eax, [ebp - 0x44]
mov ecx, 0x4e87f8
mov edx, dword [ebp - 0x40]
call fcn.00404c6c
lea eax, [ebp - 0xc0]
mov edx, dword [ebp - 0x44]
call fcn.00404a00
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x43c]
call fcn.00402ea4
lea eax, [ebp - 0x43c]
call fcn.00402c40
call fcn.00402960
mov dword [ebp - 8], 0x3e8
mov ebx, 0x4f1550
cmp dword [ebx], 0
jl 0x4e7f89
cmp dword [ebx], 3
jg 0x4e7f89
lea edx, [ebp - 0x54c]
mov eax, dword [ebx - 0xc]
call fcn.0040959c
push dword [ebp - 0x54c]
lea edx, [ebp - 0x550]
mov eax, dword [ebx - 8]
call fcn.0040959c
push dword [ebp - 0x550]
lea edx, [ebp - 0x554]
mov eax, dword [ebx - 4]
call fcn.0040959c
push dword [ebp - 0x554]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404ce0
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x43c]
call fcn.00405034
call fcn.00403578
call fcn.00402960
add ebx, 0x10
dec dword [ebp - 8]
jne 0x4e7f1e
lea eax, [ebp - 0x43c]
call fcn.00402f6c
call fcn.00402960
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x1f
mov ebx, 0x4f110c
mov byte [ebp - 0x29], 0
mov edi, dword [ebp - 8]
dec edi
test edi, edi
jle 0x4e7fd8
mov esi, 0x4f1094
mov eax, dword [esi]
mov edx, dword [ebx]
call fcn.00404d64
jne 0x4e7fd2
mov byte [ebp - 0x29], 1
add esi, 4
dec edi
jne 0x4e7fc3
cmp byte [ebp - 0x29], 0
jne 0x4e8180
inc dword [ebp - 0xc]
push dword [ebp - 0x40]
push 0x4e8810
lea edx, [ebp - 0x558]
mov eax, dword [ebp - 0xc]
call fcn.0040959c
push dword [ebp - 0x558]
push 0x4e878c
lea eax, [ebp - 0x44]
mov edx, 4
call fcn.00404ce0
mov eax, dword [ebp - 0xc]
lea eax, [ebp + eax*4 - 0x11c]
mov edx, dword [ebp - 0x44]
call fcn.00404a00
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x43c]
call fcn.00402ea4
lea eax, [ebp - 0x43c]
call fcn.00402c40
call fcn.00402960
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 2
lea eax, [ebp - 0x3c]
mov edx, dword [ebx]
call fcn.00404a00
mov dword [ebp - 0x10], 0x3e8
mov esi, 0x4f1544
xor eax, eax
mov dword [ebp - 0x24], eax
mov edi, 1
lea eax, [ebp - 0x55c]
push eax
mov ecx, 1
mov edx, edi
mov eax, dword [ebp - 0x3c]
call fcn.00404e78
mov eax, dword [ebp - 0x55c]
push eax
lea edx, [ebp - 0x564]
mov eax, dword [esi]
call fcn.0040959c
push dword [ebp - 0x564]
lea edx, [ebp - 0x568]
mov eax, dword [esi + 4]
call fcn.0040959c
push dword [ebp - 0x568]
lea edx, [ebp - 0x56c]
mov eax, dword [esi + 8]
call fcn.0040959c
push dword [ebp - 0x56c]
lea eax, [ebp - 0x560]
mov edx, 3
call fcn.00404ce0
mov edx, dword [ebp - 0x560]
pop eax
call fcn.00404f5c
test eax, eax
jle 0x4e80ea
inc dword [ebp - 0x24]
inc edi
cmp edi, 5
jne 0x4e806f
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1c]
jl 0x4e8164
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
jg 0x4e8164
lea edx, [ebp - 0x570]
mov eax, dword [esi]
call fcn.0040959c
push dword [ebp - 0x570]
lea edx, [ebp - 0x574]
mov eax, dword [esi + 4]
call fcn.0040959c
push dword [ebp - 0x574]
lea edx, [ebp - 0x578]
mov eax, dword [esi + 8]
call fcn.0040959c
push dword [ebp - 0x578]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404ce0
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x43c]
call fcn.00405034
call fcn.00403578
call fcn.00402960
add esi, 0x10
dec dword [ebp - 0x10]
jne 0x4e8065
lea eax, [ebp - 0x43c]
call fcn.00402f6c
call fcn.00402960
inc dword [ebp - 8]
add ebx, 4
cmp dword [ebp - 8], 0x33
jne 0x4e7fb2
mov dword [ebp - 8], 0x3e8
mov ebx, 0x4f1550
xor eax, eax
mov dword [ebx], eax
add ebx, 0x10
dec dword [ebp - 8]
jne 0x4e819c
mov edi, dword [ebp - 0xc]
test edi, edi
jle 0x4e82ca
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 0xc]
mov edx, dword [ebp + edx*4 - 0x11c]
call fcn.00404a00
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x43c]
call fcn.00402ea4
lea eax, [ebp - 0x43c]
call fcn.00402c34
call fcn.00402960
lea eax, [ebp - 0x48]
call fcn.00404968
lea eax, [ebp - 0x30]
call fcn.00404968
jmp 0x4e822b
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x43c]
call fcn.00403290
lea eax, [ebp - 0x43c]
call fcn.004032fc
call fcn.00402960
push dword [ebp - 0x48]
push dword [ebp - 0x30]
push 0x4e87ec
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.00404ce0
lea eax, [ebp - 0x43c]
call fcn.00403110
call fcn.00402960
test al, al
je 0x4e81f5
mov dword [ebp - 0x10], 0x3e8
mov ebx, 0x4f1544
lea edx, [ebp - 0x580]
mov eax, dword [ebx]
call fcn.0040959c
push dword [ebp - 0x580]
lea edx, [ebp - 0x584]
mov eax, dword [ebx + 4]
call fcn.0040959c
push dword [ebp - 0x584]
lea edx, [ebp - 0x588]
mov eax, dword [ebx + 8]
call fcn.0040959c
push dword [ebp - 0x588]
lea eax, [ebp - 0x57c]
mov edx, 3
call fcn.00404ce0
mov eax, dword [ebp - 0x57c]
mov edx, dword [ebp - 0x48]
call fcn.00404f5c
test eax, eax
jg 0x4e82ab
inc dword [ebx + 0xc]
add ebx, 0x10
dec dword [ebp - 0x10]
jne 0x4e824b
lea eax, [ebp - 0x43c]
call fcn.00402f6c
call fcn.00402960
dec edi
jne 0x4e81b3
lea eax, [ebp - 0x44]
mov ecx, 0x4e8824
mov edx, dword [ebp - 0x40]
call fcn.00404c6c
lea eax, [ebp - 0xbc]
mov edx, dword [ebp - 0x44]
call fcn.00404a00
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x43c]
call fcn.00402ea4
lea eax, [ebp - 0x43c]
call fcn.00402c40
call fcn.00402960
mov dword [ebp - 8], 0x3e8
mov ebx, 0x4f1550
cmp dword [ebx], 0
jl 0x4e837d
cmp dword [ebx], 2
jg 0x4e837d
lea edx, [ebp - 0x58c]
mov eax, dword [ebx - 0xc]
call fcn.0040959c
push dword [ebp - 0x58c]
lea edx, [ebp - 0x590]
mov eax, dword [ebx - 8]
call fcn.0040959c
push dword [ebp - 0x590]
lea edx, [ebp - 0x594]
mov eax, dword [ebx - 4]
call fcn.0040959c
push dword [ebp - 0x594]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404ce0
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x43c]
call fcn.00405034
call fcn.00403578
call fcn.00402960
add ebx, 0x10
dec dword [ebp - 8]
jne 0x4e8312
lea eax, [ebp - 0x43c]
call fcn.00402f6c
call fcn.00402960
mov dword [ebp - 8], 0x3e8
mov ebx, 0x4f1550
xor eax, eax
mov dword [ebx], eax
add ebx, 0x10
dec dword [ebp - 8]
jne 0x4e83a1
mov dword [ebp - 0xc], 4
lea ebx, [ebp - 0xc8]
lea eax, [ebp - 0x44]
mov edx, dword [ebx]
call fcn.00404a00
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x43c]
call fcn.00402ea4
lea eax, [ebp - 0x43c]
call fcn.00402c34
call fcn.00402960
lea eax, [ebp - 0x48]
call fcn.00404968
lea eax, [ebp - 0x30]
call fcn.00404968
jmp 0x4e842a
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x43c]
call fcn.00403290
lea eax, [ebp - 0x43c]
call fcn.004032fc
call fcn.00402960
push dword [ebp - 0x48]
push dword [ebp - 0x30]
push 0x4e87ec
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.00404ce0
lea eax, [ebp - 0x43c]
call fcn.00403110
call fcn.00402960
test al, al
je 0x4e83f4
mov dword [ebp - 8], 0x3e8
mov esi, 0x4f1544
lea edx, [ebp - 0x59c]
mov eax, dword [esi]
call fcn.0040959c
push dword [ebp - 0x59c]
lea edx, [ebp - 0x5a0]
mov eax, dword [esi + 4]
call fcn.0040959c
push dword [ebp - 0x5a0]
lea edx, [ebp - 0x5a4]
mov eax, dword [esi + 8]
call fcn.0040959c
push dword [ebp - 0x5a4]
lea eax, [ebp - 0x598]
mov edx, 3
call fcn.00404ce0
mov eax, dword [ebp - 0x598]
mov edx, dword [ebp - 0x48]
call fcn.00404f5c
test eax, eax
jg 0x4e84aa
inc dword [esi + 0xc]
add esi, 0x10
dec dword [ebp - 8]
jne 0x4e844a
lea eax, [ebp - 0x43c]
call fcn.00402f6c
call fcn.00402960
add ebx, 4
dec dword [ebp - 0xc]
jne 0x4e83ba
lea eax, [ebp - 0x48]
call fcn.00404968
mov dword [ebp - 8], 0x3e8
mov ebx, 0x4f1550
cmp dword [ebx], 0
jl 0x4e853d
cmp dword [ebx], 1
jg 0x4e853d
push dword [ebp - 0x48]
lea edx, [ebp - 0x5a8]
mov eax, dword [ebx - 0xc]
call fcn.0040959c
push dword [ebp - 0x5a8]
lea edx, [ebp - 0x5ac]
mov eax, dword [ebx - 8]
call fcn.0040959c
push dword [ebp - 0x5ac]
lea edx, [ebp - 0x5b0]
mov eax, dword [ebx - 4]
call fcn.0040959c
push dword [ebp - 0x5b0]
push 0x4e87ec
lea eax, [ebp - 0x48]
mov edx, 5
call fcn.00404ce0
add ebx, 0x10
dec dword [ebp - 8]
jne 0x4e84e2
mov eax, dword [0x4f1060]
lea eax, [eax*4 + 0x4f1074]
mov edx, dword [ebp - 0x48]
call fcn.004049bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x324]
mov eax, dword [eax + 0x220]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x324]
mov eax, dword [eax + 0x220]
mov edx, dword [ebp - 0x48]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov dl, 1
mov eax, dword [0x416ca4]
call fcn.00403aec
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x48]
call fcn.00404e18
mov ecx, eax
mov edx, 0x4e8834
mov eax, 0x4e8834
call fcn.00418e14
mov dword [ebp - 0x18], eax
push 0x4e885c
lea edx, [ebp - 0x5b8]
mov eax, dword [ebp - 0x18]
call fcn.0040959c
push dword [ebp - 0x5b8]
push 0x4e8870
lea eax, [ebp - 0x5b4]
mov edx, 3
call fcn.00404ce0
mov edx, dword [ebp - 0x5b4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x328]
call fcn.004454a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e870d
lea eax, [ebp - 0x5b8]
mov edx, 0x52
call fcn.0040498c
lea eax, [ebp - 0x470]
call fcn.00404968
lea eax, [ebp - 0x46c]
call fcn.00404968
lea eax, [ebp - 0x468]
call fcn.00404968
lea eax, [ebp - 0x464]
call fcn.00404968
lea eax, [ebp - 0x460]
call fcn.00404968
lea eax, [ebp - 0x45c]
call fcn.00404968
lea eax, [ebp - 0x458]
call fcn.00404968
lea eax, [ebp - 0x454]
mov edx, 2
call fcn.0040498c
lea eax, [ebp - 0x44c]
call fcn.00404968
lea eax, [ebp - 0x448]
mov edx, 2
call fcn.0040498c
lea eax, [ebp - 0x440]
call fcn.00404968
lea eax, [ebp - 0x118]
mov ecx, 0x14
mov edx, dword [0x401110]
call fcn.00405564
lea eax, [ebp - 0xc8]
mov ecx, 5
mov edx, dword [0x401110]
call fcn.00405564
lea eax, [ebp - 0x64]
mov ecx, 4
mov edx, dword [0x401110]
call fcn.00405564
lea eax, [ebp - 0x3c]
call fcn.00404968
lea eax, [ebp - 0x30]
call fcn.00404968
lea eax, [ebp - 0x270]
mov edx, dword [0x4082bc]
call fcn.00405530
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.0040498c
ret