Function at 0x47dcb0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x1d0
push ebx
push ebp
push esi
mov esi, ecx
push edi
movsx eax, byte [esi + 0x1786]
mov edi, dword [esi + 0x72588]
dec eax
cmp eax, 5
mov dword [esp + 0x14], edi
ja case.default.0x47dcd7
jmp dword [eax*4 + 0x4800e0]
mov al, byte [esi + 0x1706]
test al, al
je 0x47dd30
mov bl, al
call fcn.004a71a7
movsx ecx, bl
cdq
shl ecx, 1
idiv ecx
mov ax, word [esi + 0x16fc]
movsx cx, bl
mov bl, byte [esi + 0x1706]
sub ax, dx
lea ebp, [eax + ecx + 5]
call fcn.004a71a7
movsx ecx, bl
cdq
shl ecx, 1
idiv ecx
mov ax, word [esi + 0x16fe]
movsx cx, bl
sub ax, dx
lea eax, [eax + ecx + 8]
jmp 0x47dd3e
mov bp, word [esi + 0x16fc]
mov ax, word [esi + 0x16fe]
mov ecx, dword [esi + 0x38198]
push 0
movsx ebx, ax
movsx ebp, bp
push 0
push edi
push 1
push ebx
push ebp
call fcn.0049e020
mov eax, dword [esi + 0x16b4]
cmp eax, 0xffffffff
je 0x47ddb7
mov edx, dword [esi + eax*4 + 0x6f87c]
push edi
movsx eax, word [edx + 0x22]
push eax
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x40
push eax
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x16b4]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x6f87c]
add eax, 0x3d
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.004a02f0
mov eax, dword [esi + 0x16b8]
cmp eax, 0xffffffff
je 0x47de16
mov ecx, dword [esi + eax*4 + 0x6f87c]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x40
push eax
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x16b8]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x6f87c]
add eax, 0x6a
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.004a02f0
mov eax, dword [esi + 0x16bc]
cmp eax, 0xffffffff
je 0x47de77
mov ecx, dword [esi + eax*4 + 0x6f87c]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x40
push eax
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x16bc]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x6f87c]
add eax, 0x97
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.004a02f0
mov eax, dword [esi + 0x16c0]
cmp eax, 0xffffffff
je 0x47ded6
mov ecx, dword [esi + eax*4 + 0x6f87c]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x6d
push eax
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x16c0]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x6f87c]
add eax, 0x3d
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.004a02f0
mov eax, dword [esi + 0x16c4]
cmp eax, 0xffffffff
je 0x47df35
mov ecx, dword [esi + eax*4 + 0x6f87c]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x6d
push eax
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x16c4]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x6f87c]
add eax, 0x6a
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.004a02f0
mov eax, dword [esi + 0x16c8]
cmp eax, 0xffffffff
je 0x47df96
mov ecx, dword [esi + eax*4 + 0x6f87c]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x6d
push eax
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x16c8]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x6f87c]
add eax, 0x97
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.004a02f0
movsx ecx, word [esp + 0x1e4]
lea eax, [ebp + 0x41]
cmp ecx, eax
jl 0x47dfec
add ebp, 0x9e
cmp ecx, ebp
jg 0x47dfec
movsx edx, word [esp + 0x1e8]
lea ecx, [ebx + 0xb7]
cmp edx, ecx
jl 0x47dfec
lea edi, [ebx + 0xcb]
cmp edx, edi
jg 0x47dfec
push 0x1e
push 0x10
push 0x10
push 0x4c3ba0
push ecx
push eax
mov ecx, esi
call fcn.00417090
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d0
ret 0x10
push 0x14
push 6
push 6
add ebx, 0xb7
push 0x4c3ba0
push ebx
push eax
mov ecx, esi
call fcn.00417090
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d0
ret 0x10
mov al, byte [esi + 0x1706]
test al, al
je 0x47e065
mov bl, al
call fcn.004a71a7
movsx ecx, bl
cdq
shl ecx, 1
idiv ecx
mov ax, word [esi + 0x16fc]
movsx cx, bl
mov bl, byte [esi + 0x1706]
sub ax, dx
lea ebp, [eax + ecx + 5]
call fcn.004a71a7
movsx ecx, bl
cdq
shl ecx, 1
idiv ecx
mov ax, word [esi + 0x16fe]
movsx cx, bl
sub ax, dx
lea eax, [eax + ecx + 8]
jmp 0x47e073
mov bp, word [esi + 0x16fc]
mov ax, word [esi + 0x16fe]
mov ecx, dword [esi + 0x38198]
push 0
movsx ebx, ax
movsx ebp, bp
push 0
push edi
push 1
push ebx
push ebp
call fcn.0049e020
mov eax, dword [esi + 0x16b4]
cmp eax, 0xffffffff
je 0x47e0ec
mov edx, dword [esi + eax*4 + 0x6f87c]
push edi
movsx eax, word [edx + 0x22]
push eax
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x40
push eax
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x16b4]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x6f87c]
add eax, 0x3d
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.004a02f0
mov eax, dword [esi + 0x16b8]
cmp eax, 0xffffffff
je 0x47e14b
mov ecx, dword [esi + eax*4 + 0x6f87c]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x40
push eax
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x16b8]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x6f87c]
add eax, 0x6a
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.004a02f0
mov eax, dword [esi + 0x16bc]
cmp eax, 0xffffffff
je 0x47e1ac
mov ecx, dword [esi + eax*4 + 0x6f87c]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x40
push eax
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x16bc]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x6f87c]
add eax, 0x97
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.004a02f0
mov eax, dword [esi + 0x16c0]
cmp eax, 0xffffffff
je 0x47e20b
mov ecx, dword [esi + eax*4 + 0x6f87c]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x6d
push eax
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x16c0]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x6f87c]
add eax, 0x3d
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.004a02f0
mov eax, dword [esi + 0x16c4]
cmp eax, 0xffffffff
je 0x47e26a
mov ecx, dword [esi + eax*4 + 0x6f87c]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x6d
push eax
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x16c4]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x6f87c]
add eax, 0x6a
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.004a02f0
mov eax, dword [esi + 0x16c8]
cmp eax, 0xffffffff
je 0x47e2cb
mov ecx, dword [esi + eax*4 + 0x6f87c]
push edi
movsx edx, word [ecx + 0x22]
push edx
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov eax, ebx
sub eax, edx
add eax, 0x6d
push eax
call fcn.004a71a7
cdq
mov ecx, 3
idiv ecx
mov ecx, dword [esi + 0x16c8]
mov eax, ebp
sub eax, edx
mov edx, dword [esi + ecx*4 + 0x6f87c]
add eax, 0x97
push eax
movsx eax, word [edx + 0x20]
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.004a02f0
push 6
push 6
push 0x14
add ebx, 0xb7
push 0x4c5524
add ebp, 0x41
push ebx
push ebp
mov ecx, esi
call fcn.00417090
mov edx, dword [esi + 0x16f4]
mov ecx, edi
sub ecx, edx
cmp ecx, 0x3e8
jbe 0x47e30e
mov al, byte [esi + 0x1706]
mov dword [esi + 0x16f4], edi
inc al
mov byte [esi + 0x1706], al
cmp byte [esi + 0x1706], 5
jl case.default.0x47dcd7
push 0
push 0
push 0
push 0
push 0
push 0
push 0xa19
push 0xfa314dc
mov ecx, esi
call fcn.00405900
push 0x1a
mov ecx, esi
call fcn.00439d10
push 0
push 0
push 0x2a
push 0x45
mov ecx, esi
call fcn.00446e60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d0
ret 0x10
mov ecx, dword [esi + 0x38224]
mov bp, word [esi + 0x16fe]
mov bx, word [esi + 0x16fc]
mov dword [esp + 0x18], ebp
test ecx, ecx
je 0x47e393
mov edx, dword [esi + 0x72578]
push 0
push 0
push edx
movsx eax, bp
movsx edx, bx
push 0
push eax
push edx
call fcn.0049e020
mov ecx, dword [esi + 0x38244]
test ecx, ecx
je 0x47e3b7
mov eax, dword [esi + 0x72578]
push 0
push 0
push eax
movsx edx, bp
movsx eax, bx
push 8
push edx
push eax
call fcn.0049e020
lea ebp, [esi + 0x7f1c]
mov ecx, ebp
call fcn.00402880
movsx eax, word [esp + 0x18]
movsx ebx, bx
mov dword [esp + 0x10], eax
add eax, 0x2e
push 0
push 0x4c551c
lea ecx, [ebx + 0x31]
push eax
push ecx
mov ecx, ebp
call fcn.00402520
mov ecx, ebp
call fcn.004028c0
mov ecx, ebp
call fcn.00402880
mov edx, dword [esp + 0x10]
push 0
push 0x4c5510
mov ecx, ebp
lea eax, [edx + 0x2e]
push eax
lea eax, [ebx + 0xb0]
push eax
call fcn.00402520
mov ecx, ebp
call fcn.004028c0
mov ecx, dword [esp + 0x10]
xor eax, eax
add ecx, 0x3f
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], ecx
movsx edx, word [esi + 0x1704]
add edx, eax
mov ecx, dword [esi + edx*4 + 0x70d4c]
lea edx, [esi + edx*4 + 0x70d4c]
test ecx, ecx
je 0x47e5ea
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0x70]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xe8]
lea ecx, [esp + 0x128]
push eax
push ecx
mov ecx, dword [edx]
lea eax, [esp + 0x38]
push eax
add ecx, 8
push 0
push ecx
mov ecx, esi
call fcn.004618f0
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4bc748
push eax
call dword [sym.imp.user32.dll_wsprintfA]
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0x174]
rep stosd dword es:[edi], eax
movsx ecx, word [esi + 0x1704]
add ecx, dword [esp + 0x38]
mov edx, dword [esi + ecx*4 + 0x70d4c]
lea ecx, [esp + 0x174]
mov eax, dword [edx + 0x24]
push eax
push 0x4c5508
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
movsx eax, word [esp + 0x1fc]
lea ecx, [ebx + 0x1e]
add esp, 0x18
cmp eax, ecx
jl 0x47e53f
lea edx, [ebx + 0xb4]
cmp eax, edx
jg 0x47e53f
movsx eax, word [esp + 0x1e8]
mov edi, dword [esp + 0x18]
cmp eax, edi
jl 0x47e543
lea ecx, [edi + 0xe]
cmp eax, ecx
jg 0x47e543
mov ecx, ebp
call fcn.00402880
lea edx, [esp + 0x70]
push 0xffffff
push edx
lea eax, [ebx + 0x1e]
push edi
push eax
mov ecx, ebp
call fcn.00402520
mov ecx, ebp
call fcn.004028c0
mov ecx, ebp
call fcn.00402880
lea eax, [esp + 0x168]
push 0xffffff
push eax
lea ecx, [ebx + 0xbe]
push edi
push ecx
jmp 0x47e5cd
mov edi, dword [esp + 0x18]
movsx edx, word [esi + 0x1704]
add edx, dword [esp + 0x2c]
mov eax, dword [esi + edx*4 + 0x70d4c]
mov ecx, dword [eax + 4]
cmp ecx, 1
mov ecx, ebp
jne 0x47e58f
call fcn.00402880
lea ecx, [esp + 0x70]
push 0x781e22
push ecx
lea eax, [ebx + 0x1e]
push edi
push eax
mov ecx, ebp
call fcn.00402520
mov ecx, ebp
call fcn.004028c0
mov ecx, ebp
call fcn.00402880
push 0x781e22
jmp 0x47e5bd
call fcn.00402880
lea ecx, [esp + 0x70]
push 0x19192d
push ecx
lea eax, [ebx + 0x1e]
push edi
push eax
mov ecx, ebp
call fcn.00402520
mov ecx, ebp
call fcn.004028c0
mov ecx, ebp
call fcn.00402880
push 0x19192d
lea edx, [esp + 0x16c]
lea eax, [ebx + 0xbe]
push edx
push edi
push eax
mov ecx, ebp
call fcn.00402520
mov ecx, ebp
call fcn.004028c0
mov eax, dword [esp + 0x2c]
add edi, 0xf
mov dword [esp + 0x18], edi
mov edi, dword [esp + 0x14]
inc eax
cmp eax, 0xd
mov dword [esp + 0x2c], eax
jl 0x47e429
mov ax, word [esi + 0x1704]
cmp ax, 1
jl 0x47e639
movsx ecx, ax
mov eax, dword [esi + ecx*4 + 0x70d48]
test eax, eax
je 0x47e639
mov edx, dword [esp + 0x10]
push 0
push 0
push edi
lea eax, [edx + 0xda]
lea ecx, [ebx + 0xe6]
push 0x17
push eax
push ecx
mov ecx, dword [esi + 0x38220]
call fcn.0049e020
jmp 0x47e65e
mov eax, dword [esp + 0x10]
push edi
push 5
push 5
add eax, 0xda
push 5
lea ecx, [ebx + 0xe6]
push 0x17
push eax
push ecx
mov ecx, dword [esi + 0x38220]
call fcn.004a2380
movsx ecx, word [esi + 0x1704]
mov eax, dword [esi + ecx*4 + 0x70d80]
test eax, eax
je 0x47e696
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 0x38220]
push 0
push 0
lea eax, [edx + 0xee]
push edi
push 0x18
push eax
lea eax, [ebx + 0xe6]
push eax
call fcn.0049e020
jmp 0x47e6bb
mov eax, dword [esp + 0x10]
push edi
mov ecx, dword [esi + 0x38220]
push 5
push 5
add eax, 0xee
push 5
push 0x18
push eax
lea eax, [ebx + 0xe6]
push eax
call fcn.004a2380
mov al, byte [esp + 0x1f0]
test al, al
je 0x47e79f
mov eax, 0x3b
mov cl, byte [esi + eax + 0x7349a]
test cl, cl
jne 0x47e6f8
dec eax
cmp eax, 0x29
jge 0x47e6cf
mov eax, 0x26
mov cl, byte [esi + eax + 0x7349a]
test cl, cl
jne 0x47e6f8
dec eax
jns 0x47e6e5
jmp 0x47e79f
movsx eax, byte [eax + esi + 0x7349a]
cmp eax, 0x1a
jne 0x47e79f
movsx eax, word [esp + 0x1e4]
lea edi, [ebx + 0xe6]
cmp eax, edi
jl 0x47e79f
lea ecx, [ebx + 0xfa]
cmp eax, ecx
jg 0x47e754
movsx ecx, word [esp + 0x1e8]
mov edx, dword [esp + 0x10]
add edx, 0xda
cmp ecx, edx
jl 0x47e754
mov edx, dword [esp + 0x10]
add edx, 0xee
cmp ecx, edx
jg 0x47e754
dec word [esi + 0x1704]
cmp eax, edi
jl 0x47e79f
lea ecx, [ebx + 0xfa]
cmp eax, ecx
jg 0x47e79f
mov edx, dword [esp + 0x10]
movsx eax, word [esp + 0x1e8]
lea ecx, [edx + 0xee]
cmp eax, ecx
jl 0x47e79f
add edx, 0x102
cmp eax, edx
jg 0x47e79f
mov ax, word [esi + 0x1704]
movsx edx, ax
mov ecx, dword [esi + edx*4 + 0x70d80]
test ecx, ecx
je 0x47e79f
inc eax
mov word [esi + 0x1704], ax
mov cx, word [esp + 0x1ec]
xor edi, edi
cmp cx, di
je 0x47e80a
mov eax, 0x3b
mov dl, byte [esi + eax + 0x7349a]
test dl, dl
jne 0x47e7d9
dec eax
cmp eax, 0x29
jge 0x47e7b3
mov eax, 0x26
mov dl, byte [esi + eax + 0x7349a]
test dl, dl
jne 0x47e7d9
dec eax
jns 0x47e7c9
jmp 0x47e80a
movsx eax, byte [eax + esi + 0x7349a]
cmp eax, 0x1a
jne 0x47e80a
movsx ecx, cx
mov eax, 0x77777777
mov word [esi + 0x38124], di
imul ecx
sub edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
add word [esi + 0x1704], dx
movsx ecx, word [esi + 0x1704]
cmp dword [esi + ecx*4 + 0x70d7c], edi
jne 0x47e83a
dec word [esi + 0x1704]
mov ax, word [esi + 0x1704]
cmp ax, 1
jl 0x47e83a
movsx edx, ax
cmp dword [esi + edx*4 + 0x70d7c], edi
je 0x47e81a
cmp word [esi + 0x1704], di
jge 0x47e84a
mov word [esi + 0x1704], di
mov eax, dword [esp + 0x10]
mov ecx, ebp
movsx edi, word [esi + 0x1700]
add eax, 0x109
add edi, ebx
mov dword [esp + 0x18], eax
call fcn.00402880
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
lea ecx, [eax + 0xf]
push ecx
push edi
mov edi, dword [sym.imp.user32.dll_SetRect]
push eax
push ebx
push edx
call edi
push 0x191937
lea eax, [esp + 0x20]
push 0x4c54e0
push eax
mov ecx, ebp
call fcn.004028e0
mov ecx, ebp
call fcn.004028c0
movsx eax, word [esi + 0x1700]
add eax, ebx
mov ecx, ebp
mov dword [esp + 0x18], eax
call fcn.00402880
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 0x118]
mov ecx, dword [esp + 0x18]
lea edx, [eax + 0xf]
push edx
push ecx
push eax
lea edx, [esp + 0x28]
push ebx
push edx
call edi
push 0x191937
lea eax, [esp + 0x20]
push 0x4c54b8
push eax
mov ecx, ebp
call fcn.004028e0
mov ecx, ebp
call fcn.004028c0
movsx eax, word [esi + 0x1700]
add eax, ebx
mov ecx, ebp
mov dword [esp + 0x18], eax
call fcn.00402880
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 0x127]
mov ecx, dword [esp + 0x18]
lea edx, [eax + 0xf]
push edx
push ecx
push eax
lea edx, [esp + 0x28]
push ebx
push edx
call edi
push 0x191937
lea eax, [esp + 0x20]
push 0x4c5490
push eax
mov ecx, ebp
call fcn.004028e0
mov ecx, ebp
call fcn.004028c0
movsx eax, word [esi + 0x1700]
add eax, ebx
mov ecx, ebp
mov dword [esp + 0x18], eax
call fcn.00402880
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 0x136]
lea edx, [eax + 0xf]
mov ecx, dword [esp + 0x18]
push edx
push ecx
push eax
lea edx, [esp + 0x28]
push ebx
push edx
call edi
push 0x191937
lea eax, [esp + 0x20]
push 0x4c5478
push eax
mov ecx, ebp
call fcn.004028e0
mov ecx, ebp
call fcn.004028c0
mov ecx, dword [esp + 0x10]
movsx esi, word [esi + 0x1700]
add ecx, 0x154
add esi, ebx
mov dword [esp + 0x18], ecx
mov ecx, ebp
call fcn.00402880
mov eax, dword [esp + 0x18]
lea edx, [eax + 0xf]
push edx
push esi
push eax
lea eax, [esp + 0x28]
push ebx
push eax
call edi
push 0x191937
lea ecx, [esp + 0x20]
push 0x4c5450
push ecx
mov ecx, ebp
call fcn.004028e0
mov ecx, ebp
call fcn.004028c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d0
ret 0x10
mov ecx, dword [esi + 0x38224]
mov dx, word [esi + 0x1700]
mov di, word [esi + 0x16fc]
mov bx, word [esi + 0x16fe]
test ecx, ecx
mov word [esp + 0x18], dx
je 0x47ea1b
mov eax, dword [esi + 0x72578]
push 0
push 0
push eax
movsx edx, bx
movsx eax, di
push 0
push edx
push eax
call fcn.0049e020
mov ecx, dword [esi + 0x38244]
test ecx, ecx
je 0x47ea3f
mov edx, dword [esi + 0x72578]
push 0
push 0
push edx
movsx eax, bx
movsx edx, di
push 8
push eax
push edx
call fcn.0049e020
movsx eax, byte [esi + 0x1706]
mov ecx, dword [esp + 0x14]
push 0
mov eax, dword [esi + eax*4 + 0x70d4c]
push 0
movsx ebx, bx
mov edx, dword [eax + 0x2c]
mov eax, dword [eax + 0x28]
movsx ebp, di
push ecx
push edx
lea ecx, [ebx + 0x5e]
lea edx, [ebp + 0x42]
push ecx
mov ecx, dword [esi + eax*4 + 0x385dc]
push edx
call fcn.0049e020
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0x70]
lea edx, [esp + 0x128]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xe8]
lea eax, [esp + 0x30]
push ecx
push edx
movsx ecx, byte [esi + 0x1706]
push eax
push 0
mov edx, dword [esi + ecx*4 + 0x70d4c]
mov ecx, esi
add edx, 8
push edx
call fcn.004618f0
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4bc748
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
lea edi, [esi + 0x7f1c]
add esp, 0xc
mov ecx, edi
call fcn.00402880
lea edx, [esp + 0x70]
push 0xffffff
lea ecx, [ebx + 0x30]
lea eax, [ebp + 0x71]
push edx
push ecx
push eax
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
movsx edx, byte [esi + 0x1706]
mov eax, dword [esi + edx*4 + 0x70d4c]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
lea eax, [esp + 0x78]
push 0x4c543c
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x10
mov ecx, edi
call fcn.00402880
lea ecx, [esp + 0x70]
push 0x19192d
lea edx, [ebx + 0x4e]
push ecx
lea eax, [ebp + 0x71]
push edx
push eax
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
mov ecx, edi
call fcn.00402880
push 0x19192d
lea eax, [ebx + 0x62]
push 0x4c5428
push eax
lea eax, [ebp + 0x71]
mov ecx, edi
push eax
call fcn.00402520
mov ecx, edi
call fcn.004028c0
movsx ecx, byte [esi + 0x1706]
mov dword [esp + 0x10], 4
mov eax, dword [esi + ecx*4 + 0x70d4c]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x47ec22
lea edx, [esp + 0xe8]
lea ecx, [esp + 0x128]
push edx
lea edx, [esp + 0x34]
push ecx
push edx
add eax, 0x30
push 0
push eax
mov ecx, esi
call fcn.004618f0
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4bc748
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
movsx edx, byte [esi + 0x1706]
add esp, 0xc
mov eax, dword [esi + edx*4 + 0x70d4c]
mov ecx, dword [eax + 0xd0]
cmp ecx, 1
mov ecx, edi
jne 0x47ebf5
call fcn.00402880
push 0x19192d
jmp 0x47ebff
call fcn.00402880
push 0x969696
lea ecx, [esp + 0x74]
lea edx, [ebx + 0x71]
push ecx
lea eax, [ebp + 0x7b]
push edx
push eax
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
mov dword [esp + 0x10], 5
movsx ecx, byte [esi + 0x1706]
mov eax, dword [esi + ecx*4 + 0x70d4c]
mov ecx, dword [eax + 0xb8]
test ecx, ecx
je 0x47eceb
lea edx, [esp + 0xe8]
lea ecx, [esp + 0x128]
push edx
lea edx, [esp + 0x34]
push ecx
push edx
add eax, 0x45
push 0
push eax
mov ecx, esi
call fcn.004618f0
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4bc748
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
movsx edx, byte [esi + 0x1706]
add esp, 0xc
mov eax, dword [esi + edx*4 + 0x70d4c]
mov ecx, dword [eax + 0xd4]
cmp ecx, 1
mov ecx, edi
jne 0x47ecb7
call fcn.00402880
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x70]
push 0x19192d
push ecx
lea eax, [eax + eax*2]
lea ecx, [ebp + 0x7b]
lea edx, [ebx + eax*4]
lea eax, [eax + edx + 0x35]
push eax
push ecx
jmp 0x47ecd9
call fcn.00402880
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x70]
push 0x969696
push edx
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
lea eax, [ebp + 0x7b]
push edx
push eax
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
inc dword [esp + 0x10]
movsx ecx, byte [esi + 0x1706]
mov eax, dword [esi + ecx*4 + 0x70d4c]
mov ecx, dword [eax + 0xbc]
test ecx, ecx
je 0x47edb4
lea edx, [esp + 0xe8]
lea ecx, [esp + 0x128]
push edx
lea edx, [esp + 0x34]
push ecx
push edx
add eax, 0x5a
push 0
push eax
mov ecx, esi
call fcn.004618f0
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4bc748
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
movsx edx, byte [esi + 0x1706]
add esp, 0xc
mov eax, dword [esi + edx*4 + 0x70d4c]
mov ecx, dword [eax + 0xd8]
cmp ecx, 1
mov ecx, edi
jne 0x47ed80
call fcn.00402880
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x70]
push 0x19192d
push ecx
lea eax, [eax + eax*2]
lea ecx, [ebp + 0x7b]
lea edx, [ebx + eax*4]
lea eax, [eax + edx + 0x35]
push eax
push ecx
jmp 0x47eda2
call fcn.00402880
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x70]
push 0x969696
push edx
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
lea eax, [ebp + 0x7b]
push edx
push eax
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
inc dword [esp + 0x10]
movsx ecx, byte [esi + 0x1706]
mov eax, dword [esi + ecx*4 + 0x70d4c]
mov ecx, dword [eax + 0xc0]
test ecx, ecx
je 0x47ee7d
lea edx, [esp + 0xe8]
lea ecx, [esp + 0x128]
push edx
lea edx, [esp + 0x34]
push ecx
push edx
add eax, 0x6f
push 0
push eax
mov ecx, esi
call fcn.004618f0
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4bc748
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
movsx edx, byte [esi + 0x1706]
add esp, 0xc
mov eax, dword [esi + edx*4 + 0x70d4c]
mov ecx, dword [eax + 0xdc]
cmp ecx, 1
mov ecx, edi
jne 0x47ee49
call fcn.00402880
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x70]
push 0x19192d
push ecx
lea eax, [eax + eax*2]
lea ecx, [ebp + 0x7b]
lea edx, [ebx + eax*4]
lea eax, [eax + edx + 0x35]
push eax
push ecx
jmp 0x47ee6b
call fcn.00402880
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x70]
push 0x969696
push edx
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
lea eax, [ebp + 0x7b]
push edx
push eax
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
inc dword [esp + 0x10]
movsx ecx, byte [esi + 0x1706]
mov eax, dword [esi + ecx*4 + 0x70d4c]
mov ecx, dword [eax + 0xc4]
test ecx, ecx
je 0x47ef48
lea edx, [esp + 0xe8]
lea ecx, [esp + 0x128]
push edx
lea edx, [esp + 0x34]
push ecx
push edx
add eax, 0x84
push 0
push eax
mov ecx, esi
call fcn.004618f0
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4bc748
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
movsx edx, byte [esi + 0x1706]
add esp, 0xc
mov eax, dword [esi + edx*4 + 0x70d4c]
mov ecx, dword [eax + 0xe0]
cmp ecx, 1
mov ecx, edi
jne 0x47ef14
call fcn.00402880
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x70]
push 0x19192d
push ecx
lea eax, [eax + eax*2]
lea ecx, [ebp + 0x7b]
lea edx, [ebx + eax*4]
lea eax, [eax + edx + 0x35]
push eax
push ecx
jmp 0x47ef36
call fcn.00402880
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x70]
push 0x969696
push edx
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
lea eax, [ebp + 0x7b]
push edx
push eax
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
inc dword [esp + 0x10]
movsx ecx, byte [esi + 0x1706]
mov eax, dword [esi + ecx*4 + 0x70d4c]
mov ecx, dword [eax + 0xc8]
test ecx, ecx
je 0x47f00f
lea edx, [esp + 0xe8]
lea ecx, [esp + 0x128]
push edx
lea edx, [esp + 0x34]
push ecx
push edx
add eax, 0x99
push 0
push eax
mov ecx, esi
call fcn.004618f0
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4bc748
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
movsx edx, byte [esi + 0x1706]
add esp, 0xc
mov eax, dword [esi + edx*4 + 0x70d4c]
mov ecx, dword [eax + 0xe4]
cmp ecx, 1
mov ecx, edi
jne 0x47efdf
call fcn.00402880
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x70]
push 0x19192d
push ecx
lea eax, [eax + eax*2]
lea ecx, [ebp + 0x7b]
lea edx, [ebx + eax*4]
lea eax, [eax + edx + 0x35]
push eax
push ecx
jmp 0x47f001
call fcn.00402880
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x70]
push 0x969696
push edx
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
lea eax, [ebp + 0x7b]
push edx
push eax
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
movsx ecx, byte [esi + 0x1706]
mov edx, dword [esi + ecx*4 + 0x70d4c]
cmp dword [edx + 4], 1
jne 0x47f420
mov edx, dword [esp + 0x14]
push 0
push 0
lea eax, [ebx + 0xe4]
push edx
lea ecx, [ebp + 0x61]
push 2
push eax
push ecx
mov ecx, dword [esi + 0x38198]
call fcn.0049e020
mov eax, dword [esp + 0x14]
push 0
push 0
push eax
lea eax, [ebx + 0xe4]
lea ecx, [ebp + 0x8e]
push 2
push eax
push ecx
mov ecx, dword [esi + 0x38198]
call fcn.0049e020
mov edx, dword [esp + 0x14]
push 0
push 0
push edx
lea eax, [ebx + 0xe4]
lea ecx, [ebp + 0xbb]
push 2
push eax
push ecx
mov ecx, dword [esi + 0x38198]
call fcn.0049e020
mov ecx, dword [esp + 0x14]
push 0
push 0
lea eax, [ebx + 0x111]
push ecx
mov ecx, dword [esi + 0x38198]
push 2
push eax
lea eax, [ebp + 0x61]
push eax
call fcn.0049e020
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x38198]
push 0
push 0
push edx
lea eax, [ebx + 0x111]
push 2
push eax
lea eax, [ebp + 0x8e]
push eax
call fcn.0049e020
mov eax, dword [esp + 0x14]
push 0
mov ecx, dword [esi + 0x38198]
push 0
push eax
lea eax, [ebx + 0x111]
push 2
push eax
lea eax, [ebp + 0xbb]
push eax
call fcn.0049e020
mov eax, dword [esi + 0x16b4]
cmp eax, 0xffffffff
je 0x47f134
mov eax, dword [esi + eax*4 + 0x6f87c]
mov ecx, dword [esp + 0x14]
push 0
push 0
movsx edx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ecx
lea ecx, [ebx + 0xe4]
push edx
push ecx
lea ecx, [ebp + 0x61]
push ecx
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.0049e020
mov eax, dword [esi + 0x16b8]
cmp eax, 0xffffffff
je 0x47f172
mov eax, dword [esi + eax*4 + 0x6f87c]
mov ecx, dword [esp + 0x14]
push 0
push 0
movsx edx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ecx
lea ecx, [ebx + 0xe4]
push edx
push ecx
lea ecx, [ebp + 0x8e]
push ecx
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.0049e020
mov eax, dword [esi + 0x16bc]
cmp eax, 0xffffffff
je 0x47f1b0
mov eax, dword [esi + eax*4 + 0x6f87c]
mov ecx, dword [esp + 0x14]
push 0
push 0
movsx edx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ecx
lea ecx, [ebx + 0xe4]
push edx
push ecx
lea ecx, [ebp + 0xbb]
push ecx
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.0049e020
mov eax, dword [esi + 0x16c0]
cmp eax, 0xffffffff
je 0x47f1eb
mov eax, dword [esi + eax*4 + 0x6f87c]
mov ecx, dword [esp + 0x14]
push 0
push 0
movsx edx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ecx
lea ecx, [ebx + 0x111]
push edx
push ecx
lea ecx, [ebp + 0x61]
push ecx
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.0049e020
mov eax, dword [esi + 0x16c4]
cmp eax, 0xffffffff
je 0x47f229
mov eax, dword [esi + eax*4 + 0x6f87c]
mov ecx, dword [esp + 0x14]
push 0
push 0
movsx edx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ecx
lea ecx, [ebx + 0x111]
push edx
push ecx
lea ecx, [ebp + 0x8e]
push ecx
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.0049e020
mov eax, dword [esi + 0x16c8]
cmp eax, 0xffffffff
je 0x47f267
mov eax, dword [esi + eax*4 + 0x6f87c]
mov ecx, dword [esp + 0x14]
push 0
push 0
movsx edx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ecx
lea ecx, [ebx + 0x111]
push edx
push ecx
lea ecx, [ebp + 0xbb]
push ecx
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.0049e020
mov ecx, edi
call fcn.00402880
movsx ecx, word [esp + 0x18]
lea eax, [ebx + 0x12a]
add ecx, ebp
mov dword [esp + 0x14], ecx
lea edx, [eax + 0xf]
push edx
push ecx
push eax
lea eax, [esp + 0x28]
push ebp
push eax
call dword [sym.imp.user32.dll_SetRect]
push 0x191937
lea ecx, [esp + 0x20]
push 0x4c5408
push ecx
mov ecx, edi
call fcn.004028e0
mov ecx, edi
call fcn.004028c0
mov ecx, edi
call fcn.00402880
mov ecx, dword [esp + 0x14]
lea eax, [ebx + 0x139]
lea edx, [eax + 0xf]
push edx
push ecx
push eax
lea edx, [esp + 0x28]
push ebp
push edx
call dword [sym.imp.user32.dll_SetRect]
push 0x191937
lea eax, [esp + 0x20]
push 0x4c53e4
push eax
mov ecx, edi
call fcn.004028e0
mov ecx, edi
call fcn.004028c0
mov ecx, edi
call fcn.00402880
mov edx, dword [esp + 0x14]
lea eax, [ebx + 0x148]
lea ecx, [eax + 0xf]
push ecx
push edx
push eax
lea eax, [esp + 0x28]
push ebp
push eax
call dword [sym.imp.user32.dll_SetRect]
push 0x191937
lea ecx, [esp + 0x20]
push 0x4c53c8
push ecx
mov ecx, edi
call fcn.004028e0
mov ecx, edi
call fcn.004028c0
movsx eax, word [esp + 0x1e4]
lea edx, [ebp + 0x1f]
cmp eax, edx
jl 0x47f37a
movsx eax, word [esp + 0x1e4]
lea ecx, [ebp + 0x5e]
cmp eax, ecx
jg 0x47f37a
movsx eax, word [esp + 0x1e8]
lea edi, [ebx + 0x15a]
cmp eax, edi
jl 0x47f37a
lea edx, [ebx + 0x16d]
cmp eax, edx
jg 0x47f37a
push 0x14
push 6
push 6
push 0x4c53c0
lea eax, [ebp + 0x18]
push edi
push eax
jmp 0x47f390
push 7
push 0
lea edi, [ebx + 0x15a]
push 0
push 0x4c53c0
lea ecx, [ebp + 0x18]
push edi
push ecx
mov ecx, esi
call fcn.00417090
movsx eax, word [esp + 0x1e4]
lea edx, [ebp + 0x9f]
cmp eax, edx
jl 0x47f3e9
lea ecx, [ebp + 0xfe]
cmp eax, ecx
jg 0x47f3e9
movsx eax, word [esp + 0x1e8]
cmp eax, edi
jl 0x47f3e9
add ebx, 0x16d
cmp eax, ebx
jg 0x47f3e9
cmp byte [esi + 0x170a], 1
jne 0x47f409
push 0x14
push 6
push 6
push 0x4c53b4
push edi
add ebp, 0x98
jmp 0x4800cb
cmp byte [esi + 0x170a], 1
jne 0x47f409
push 7
push 0
push 0
push 0x4c53b4
push edi
add ebp, 0x98
jmp 0x4800cb
push 0xa
push 0xa
push 0xa
push 0x4c53b4
push edi
add ebp, 0x98
jmp 0x4800cb
mov ecx, edi
call fcn.00402880
movsx edx, word [esp + 0x18]
lea eax, [ebx + 0x10c]
lea ecx, [edx + ebp]
lea edx, [eax + 0xf]
mov dword [esp + 0x14], ecx
push edx
push ecx
push eax
lea eax, [esp + 0x28]
push ebp
push eax
call dword [sym.imp.user32.dll_SetRect]
push 0x191937
lea ecx, [esp + 0x20]
push 0x4c538c
push ecx
mov ecx, edi
call fcn.004028e0
mov ecx, edi
call fcn.004028c0
mov ecx, edi
call fcn.00402880
mov ecx, dword [esp + 0x14]
lea eax, [ebx + 0x11b]
lea edx, [eax + 0xf]
push edx
push ecx
push eax
lea edx, [esp + 0x28]
push ebp
push edx
call dword [sym.imp.user32.dll_SetRect]
push 0x191937
lea eax, [esp + 0x20]
push 0x4c5368
push eax
mov ecx, edi
call fcn.004028e0
mov ecx, edi
call fcn.004028c0
mov ecx, edi
call fcn.00402880
mov edx, dword [esp + 0x14]
lea eax, [ebx + 0x12a]
lea ecx, [eax + 0xf]
push ecx
push edx
push eax
lea eax, [esp + 0x28]
push ebp
push eax
call dword [sym.imp.user32.dll_SetRect]
push 0x191937
lea ecx, [esp + 0x20]
push 0x4c5354
push ecx
mov ecx, edi
call fcn.004028e0
mov ecx, edi
call fcn.004028c0
movsx eax, word [esp + 0x1e4]
lea edx, [ebp + 0x1f]
cmp eax, edx
jl 0x47f52e
lea ecx, [ebp + 0x5e]
cmp eax, ecx
jg 0x47f52e
movsx ecx, word [esp + 0x1e8]
lea eax, [ebx + 0x15a]
cmp ecx, eax
jl 0x47f52e
lea edx, [ebx + 0x16d]
cmp ecx, edx
jg 0x47f52e
push 0x14
push 6
push 6
push 0x4c53c0
push eax
add ebp, 0x18
jmp 0x4800cb
push 7
push 0
push 0
add ebx, 0x15a
push 0x4c53c0
push ebx
add ebp, 0x18
jmp 0x4800cb
mov ecx, dword [esi + 0x38224]
mov di, word [esi + 0x16fc]
mov bx, word [esi + 0x16fe]
test ecx, ecx
je 0x47f57a
mov eax, dword [esi + 0x72578]
push 0
push 0
push eax
movsx edx, bx
movsx eax, di
push 0
push edx
push eax
call fcn.0049e020
mov ecx, dword [esi + 0x38244]
test ecx, ecx
je 0x47f59e
mov edx, dword [esi + 0x72578]
push 0
push 0
push edx
movsx eax, bx
movsx edx, di
push 8
push eax
push edx
call fcn.0049e020
movsx eax, byte [esi + 0x1706]
mov ecx, dword [esp + 0x14]
push 0
mov eax, dword [esi + eax*4 + 0x70d4c]
push 0
movsx ebx, bx
mov edx, dword [eax + 0x2c]
mov eax, dword [eax + 0x28]
movsx ebp, di
push ecx
push edx
lea ecx, [ebx + 0x5e]
lea edx, [ebp + 0x42]
push ecx
mov ecx, dword [esi + eax*4 + 0x385dc]
push edx
mov dword [esp + 0x28], ebp
call fcn.0049e020
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0x70]
lea edx, [esp + 0x128]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xe8]
lea eax, [esp + 0x30]
push ecx
push edx
movsx ecx, byte [esi + 0x1706]
push eax
push 0
mov edx, dword [esi + ecx*4 + 0x70d4c]
mov ecx, esi
add edx, 8
push edx
call fcn.004618f0
lea eax, [esp + 0x30]
lea ecx, [esp + 0x70]
push eax
push 0x4bc748
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
lea edi, [esi + 0x7f1c]
add esp, 0xc
mov ecx, edi
call fcn.00402880
lea edx, [esp + 0x70]
push 0xffffff
lea eax, [ebx + 0x30]
add ebp, 0x71
push edx
push eax
push ebp
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
movsx ecx, byte [esi + 0x1706]
mov eax, dword [esi + ecx*4 + 0x70d4c]
lea ecx, [esp + 0x70]
mov edx, dword [eax + 0x24]
mov eax, dword [eax + 0x20]
push edx
push eax
push 0x4c543c
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x10
mov ecx, edi
call fcn.00402880
lea edx, [esp + 0x70]
push 0x19192d
lea eax, [ebx + 0x4e]
push edx
push eax
push ebp
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
mov ecx, edi
call fcn.00402880
push 0x19192d
lea ecx, [ebx + 0x62]
push 0x4c5428
push ecx
push ebp
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
movsx edx, byte [esi + 0x1706]
mov ebp, 4
mov eax, dword [esi + edx*4 + 0x70d4c]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x47f77b
lea ecx, [esp + 0xe8]
lea edx, [esp + 0x128]
push ecx
lea ecx, [esp + 0x34]
push edx
push ecx
add eax, 0x30
push 0
push eax
mov ecx, esi
call fcn.004618f0
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4bc748
push eax
call dword [sym.imp.user32.dll_wsprintfA]
movsx ecx, byte [esi + 0x1706]
add esp, 0xc
mov edx, dword [esi + ecx*4 + 0x70d4c]
mov ecx, edi
cmp dword [edx + 0xd0], 1
jne 0x47f74d
call fcn.00402880
push 0x19192d
jmp 0x47f757
call fcn.00402880
push 0x787878
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x74]
lea ecx, [ebx + 0x71]
push eax
add edx, 0x7b
push ecx
push edx
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
mov ebp, 5
movsx eax, byte [esi + 0x1706]
mov eax, dword [esi + eax*4 + 0x70d4c]
mov ecx, dword [eax + 0xb8]
test ecx, ecx
je 0x47f841
lea ecx, [esp + 0xe8]
lea edx, [esp + 0x128]
push ecx
lea ecx, [esp + 0x34]
push edx
push ecx
add eax, 0x45
push 0
push eax
mov ecx, esi
call fcn.004618f0
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4bc748
push eax
call dword [sym.imp.user32.dll_wsprintfA]
movsx ecx, byte [esi + 0x1706]
add esp, 0xc
mov edx, dword [esi + ecx*4 + 0x70d4c]
mov ecx, edi
cmp dword [edx + 0xd4], 1
jne 0x47f80f
call fcn.00402880
lea eax, [esp + 0x70]
push 0x19192d
push eax
lea eax, [ebp + ebp*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
mov eax, dword [esp + 0x18]
add eax, 0x7b
push edx
push eax
jmp 0x47f832
call fcn.00402880
lea eax, [ebp + ebp*2]
lea ecx, [esp + 0x70]
push 0x787878
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [ebx + eax*4]
add ecx, 0x7b
lea eax, [eax + edx + 0x35]
push eax
push ecx
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
inc ebp
movsx edx, byte [esi + 0x1706]
mov eax, dword [esi + edx*4 + 0x70d4c]
mov ecx, dword [eax + 0xbc]
test ecx, ecx
je 0x47f907
lea ecx, [esp + 0xe8]
lea edx, [esp + 0x128]
push ecx
lea ecx, [esp + 0x34]
push edx
push ecx
add eax, 0x5a
push 0
push eax
mov ecx, esi
call fcn.004618f0
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4bc748
push eax
call dword [sym.imp.user32.dll_wsprintfA]
movsx ecx, byte [esi + 0x1706]
add esp, 0xc
mov edx, dword [esi + ecx*4 + 0x70d4c]
mov ecx, edi
cmp dword [edx + 0xd8], 1
jne 0x47f8d5
call fcn.00402880
lea eax, [esp + 0x70]
push 0x19192d
push eax
lea eax, [ebp + ebp*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
mov eax, dword [esp + 0x18]
add eax, 0x7b
push edx
push eax
jmp 0x47f8f8
call fcn.00402880
lea eax, [ebp + ebp*2]
lea ecx, [esp + 0x70]
push 0x787878
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [ebx + eax*4]
add ecx, 0x7b
lea eax, [eax + edx + 0x35]
push eax
push ecx
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
inc ebp
movsx edx, byte [esi + 0x1706]
mov eax, dword [esi + edx*4 + 0x70d4c]
mov ecx, dword [eax + 0xc0]
test ecx, ecx
je 0x47f9cd
lea ecx, [esp + 0xe8]
lea edx, [esp + 0x128]
push ecx
lea ecx, [esp + 0x34]
push edx
push ecx
add eax, 0x6f
push 0
push eax
mov ecx, esi
call fcn.004618f0
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4bc748
push eax
call dword [sym.imp.user32.dll_wsprintfA]
movsx ecx, byte [esi + 0x1706]
add esp, 0xc
mov edx, dword [esi + ecx*4 + 0x70d4c]
mov ecx, edi
cmp dword [edx + 0xdc], 1
jne 0x47f99b
call fcn.00402880
lea eax, [esp + 0x70]
push 0x19192d
push eax
lea eax, [ebp + ebp*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
mov eax, dword [esp + 0x18]
add eax, 0x7b
push edx
push eax
jmp 0x47f9be
call fcn.00402880
lea eax, [ebp + ebp*2]
lea ecx, [esp + 0x70]
push 0x787878
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [ebx + eax*4]
add ecx, 0x7b
lea eax, [eax + edx + 0x35]
push eax
push ecx
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
inc ebp
movsx edx, byte [esi + 0x1706]
mov eax, dword [esi + edx*4 + 0x70d4c]
mov ecx, dword [eax + 0xc4]
test ecx, ecx
je 0x47fa95
lea ecx, [esp + 0xe8]
lea edx, [esp + 0x128]
push ecx
lea ecx, [esp + 0x34]
push edx
push ecx
add eax, 0x84
push 0
push eax
mov ecx, esi
call fcn.004618f0
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4bc748
push eax
call dword [sym.imp.user32.dll_wsprintfA]
movsx ecx, byte [esi + 0x1706]
add esp, 0xc
mov edx, dword [esi + ecx*4 + 0x70d4c]
mov ecx, edi
cmp dword [edx + 0xe0], 1
jne 0x47fa63
call fcn.00402880
lea eax, [esp + 0x70]
push 0x19192d
push eax
lea eax, [ebp + ebp*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
mov eax, dword [esp + 0x18]
add eax, 0x7b
push edx
push eax
jmp 0x47fa86
call fcn.00402880
lea eax, [ebp + ebp*2]
lea ecx, [esp + 0x70]
push 0x787878
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [ebx + eax*4]
add ecx, 0x7b
lea eax, [eax + edx + 0x35]
push eax
push ecx
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
inc ebp
movsx edx, byte [esi + 0x1706]
mov eax, dword [esi + edx*4 + 0x70d4c]
mov ecx, dword [eax + 0xc8]
test ecx, ecx
je 0x47fb5c
lea ecx, [esp + 0xe8]
lea edx, [esp + 0x128]
push ecx
lea ecx, [esp + 0x34]
push edx
push ecx
add eax, 0x99
push 0
push eax
mov ecx, esi
call fcn.004618f0
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4bc748
push eax
call dword [sym.imp.user32.dll_wsprintfA]
movsx ecx, byte [esi + 0x1706]
add esp, 0xc
mov edx, dword [esi + ecx*4 + 0x70d4c]
mov ecx, edi
cmp dword [edx + 0xe4], 1
jne 0x47fb2b
call fcn.00402880
lea eax, [esp + 0x70]
push 0x19192d
push eax
lea eax, [ebp + ebp*2]
lea ecx, [ebx + eax*4]
lea edx, [eax + ecx + 0x35]
mov eax, dword [esp + 0x18]
add eax, 0x7b
push edx
push eax
jmp 0x47fb4e
call fcn.00402880
lea eax, [ebp + ebp*2]
lea ecx, [esp + 0x70]
push 0x787878
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [ebx + eax*4]
add ecx, 0x7b
lea eax, [eax + edx + 0x35]
push eax
push ecx
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
mov edx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
push 0
push 0
lea eax, [ebx + 0xe4]
push ebp
lea ecx, [edx + 0x61]
push 2
push eax
push ecx
mov ecx, dword [esi + 0x38198]
call fcn.0049e020
mov eax, dword [esp + 0x10]
push 0
push 0
push ebp
lea ecx, [eax + 0x8e]
lea eax, [ebx + 0xe4]
push 2
push eax
push ecx
mov ecx, dword [esi + 0x38198]
call fcn.0049e020
mov ecx, dword [esp + 0x10]
push 0
push 0
push ebp
lea eax, [ebx + 0xe4]
add ecx, 0xbb
push 2
push eax
push ecx
mov ecx, dword [esi + 0x38198]
call fcn.0049e020
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 0x38198]
push 0
push 0
lea eax, [ebx + 0x111]
push ebp
push 2
push eax
lea eax, [edx + 0x61]
push eax
call fcn.0049e020
push 0
push 0
mov ecx, dword [esi + 0x38198]
push ebp
lea eax, [ebx + 0x111]
push 2
push eax
mov eax, dword [esp + 0x24]
add eax, 0x8e
push eax
call fcn.0049e020
mov ecx, dword [esp + 0x10]
push 0
push 0
push ebp
lea eax, [ebx + 0x111]
push 2
push eax
lea eax, [ecx + 0xbb]
mov ecx, dword [esi + 0x38198]
push eax
call fcn.0049e020
mov eax, dword [esi + 0x16b4]
cmp eax, 0xffffffff
je 0x47fc6c
mov eax, dword [esi + eax*4 + 0x6f87c]
push 0
push 0
push ebp
movsx edx, word [eax + 0x22]
lea ecx, [ebx + 0xe4]
push edx
movsx edx, word [eax + 0x20]
push ecx
mov ecx, dword [esp + 0x24]
add ecx, 0x61
push ecx
mov ecx, dword [esi + edx*4 + 0x385dc]
call fcn.0049e020
mov eax, dword [esi + 0x16b8]
cmp eax, 0xffffffff
je 0x47fcaa
mov eax, dword [esi + eax*4 + 0x6f87c]
mov edx, dword [esp + 0x10]
push 0
push 0
movsx ecx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ebp
push ecx
lea ecx, [ebx + 0xe4]
push ecx
lea ecx, [edx + 0x8e]
push ecx
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.0049e020
mov eax, dword [esi + 0x16bc]
cmp eax, 0xffffffff
je 0x47fce8
mov eax, dword [esi + eax*4 + 0x6f87c]
mov edx, dword [esp + 0x10]
push 0
push 0
movsx ecx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ebp
push ecx
lea ecx, [ebx + 0xe4]
push ecx
lea ecx, [edx + 0xbb]
push ecx
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.0049e020
mov eax, dword [esi + 0x16c0]
cmp eax, 0xffffffff
je 0x47fd23
mov eax, dword [esi + eax*4 + 0x6f87c]
mov edx, dword [esp + 0x10]
push 0
push 0
movsx ecx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ebp
push ecx
lea ecx, [ebx + 0x111]
push ecx
lea ecx, [edx + 0x61]
push ecx
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.0049e020
mov eax, dword [esi + 0x16c4]
cmp eax, 0xffffffff
je 0x47fd61
mov eax, dword [esi + eax*4 + 0x6f87c]
mov edx, dword [esp + 0x10]
push 0
push 0
movsx ecx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ebp
push ecx
lea ecx, [ebx + 0x111]
push ecx
lea ecx, [edx + 0x8e]
push ecx
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.0049e020
mov eax, dword [esi + 0x16c8]
cmp eax, 0xffffffff
je 0x47fd9f
mov eax, dword [esi + eax*4 + 0x6f87c]
mov edx, dword [esp + 0x10]
push 0
push 0
movsx ecx, word [eax + 0x22]
movsx eax, word [eax + 0x20]
push ebp
push ecx
lea ecx, [ebx + 0x111]
push ecx
lea ecx, [edx + 0xbb]
push ecx
mov ecx, dword [esi + eax*4 + 0x385dc]
call fcn.0049e020
mov ecx, edi
call fcn.00402880
mov ecx, dword [esp + 0x10]
push 0x191937
lea edx, [ebx + 0x12a]
push 0x4c5334
lea eax, [ecx + 0x20]
push edx
push eax
mov ecx, edi
mov dword [esp + 0x28], eax
call fcn.00402520
mov ecx, edi
call fcn.004028c0
mov ecx, edi
call fcn.00402880
mov eax, dword [esp + 0x18]
push 0x191937
add ebx, 0x139
push 0x4c530c
push ebx
push eax
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
mov edx, dword [esi + 0x16f4]
mov ecx, ebp
sub ecx, edx
cmp ecx, 0x3e8
jbe 0x47fe2f
mov dl, byte [esi + 0x1707]
mov dword [esi + 0x16f4], ebp
inc dl
mov al, dl
mov byte [esi + 0x1707], dl
cmp al, 7
jl 0x47fe2f
mov byte [esi + 0x1707], 7
cmp byte [esi + 0x1707], 4
jne case.default.0x47dcd7
movsx edx, byte [esi + 0x1706]
push 0
mov ecx, esi
mov eax, dword [esi + edx*4 + 0x70d4c]
add eax, 8
push eax
push 0
push 0
push 0
push 0
push 0xa23
push 0xfa314dc
call fcn.00405900
mov al, byte [esi + 0x1707]
pop edi
inc al
mov byte [esi + 0x1707], al
pop esi
pop ebp
pop ebx
add esp, 0x1d0
ret 0x10
mov ecx, dword [esi + 0x38224]
mov di, word [esi + 0x16fc]
mov bx, word [esi + 0x16fe]
test ecx, ecx
je 0x47feb6
mov edx, dword [esi + 0x72578]
push 0
push 0
push edx
movsx eax, bx
movsx edx, di
push 0
push eax
push edx
call fcn.0049e020
mov ecx, dword [esi + 0x38244]
test ecx, ecx
je 0x47feda
mov eax, dword [esi + 0x72578]
push 0
push 0
push eax
movsx edx, bx
movsx eax, di
push 8
push edx
push eax
call fcn.0049e020
movsx ecx, byte [esi + 0x1706]
mov edx, dword [esp + 0x14]
push 0
mov eax, dword [esi + ecx*4 + 0x70d4c]
push 0
movsx ebx, bx
mov ecx, dword [eax + 0x2c]
push edx
movsx ebp, di
lea edx, [ebx + 0x5e]
push ecx
push edx
mov edx, dword [eax + 0x28]
lea ecx, [ebp + 0x42]
push ecx
mov ecx, dword [esi + edx*4 + 0x385dc]
call fcn.0049e020
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0x70]
lea edx, [esp + 0x30]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xe8]
lea ecx, [esp + 0x128]
push eax
push ecx
movsx eax, byte [esi + 0x1706]
push edx
push 0
mov ecx, dword [esi + eax*4 + 0x70d4c]
add ecx, 8
push ecx
mov ecx, esi
call fcn.004618f0
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
push 0x4bc748
push eax
call dword [sym.imp.user32.dll_wsprintfA]
lea edi, [esi + 0x7f1c]
add esp, 0xc
mov ecx, edi
call fcn.00402880
lea ecx, [esp + 0x70]
push 0xffffff
lea edx, [ebx + 0x30]
push ecx
lea eax, [ebp + 0x71]
push edx
push eax
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
mov al, byte [esi + 0x1708]
mov ecx, edi
cmp al, 1
jne 0x48004e
call fcn.00402880
push 0x191937
lea ecx, [ebx + 0x94]
lea eax, [ebp + 0x2b]
push 0x4c52f0
push ecx
push eax
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
mov eax, dword [esi + 0x16b4]
cmp eax, 0xc
lea eax, [esi + 0x730ed]
jne 0x480014
movsx edx, byte [esi + 0x1709]
push edx
push 0x4c52d0
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
mov ecx, edi
call fcn.00402880
lea eax, [esi + 0x730ed]
push 0x191937
push eax
lea eax, [ebx + 0xa3]
push eax
lea eax, [ebp + 0x2b]
push eax
jmp 0x480068
movsx ecx, byte [esi + 0x1709]
add ecx, 0x64
push ecx
push 0x4c52ac
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
mov ecx, edi
call fcn.00402880
lea eax, [esi + 0x730ed]
push 0x191937
push eax
lea edx, [ebx + 0xa3]
lea eax, [ebp + 0x20]
push edx
push eax
jmp 0x480068
call fcn.00402880
push 0x191937
lea ecx, [ebx + 0xc1]
push 0x4c5294
lea edx, [ebp + 0x2b]
push ecx
push edx
mov ecx, edi
call fcn.00402520
mov ecx, edi
call fcn.004028c0
movsx eax, word [esp + 0x1e4]
lea ecx, [ebp + 0x1f]
cmp eax, ecx
jl 0x4800b6
lea edx, [ebp + 0x5e]
cmp eax, edx
jg 0x4800b6
movsx ecx, word [esp + 0x1e8]
lea eax, [ebx + 0x15a]
cmp ecx, eax
jl 0x4800b6
lea edx, [ebx + 0x16d]
cmp ecx, edx
jg 0x4800b6
push 0x14
push 6
push 6
push 0x4c53c0
push eax
jmp 0x4800c8
push 7
push 0
push 0
add ebx, 0x15a
push 0x4c53c0
push ebx
add ebp, 0x22
push ebp
mov ecx, esi
call fcn.00417090
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d0
ret 0x10