Function at 0x4b99e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x4b99e8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x4ba7a7
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.004ba950
mov dl, 1
mov eax, dword [0x4190f0]
call fcn.00403ec8
mov dword [ebp - 0x18], eax
mov dl, 1
mov eax, dword [0x4190f0]
call fcn.00403ec8
mov dword [ebp - 0x1c], eax
mov dl, 1
mov eax, dword [0x4190f0]
call fcn.00403ec8
mov dword [ebp - 0x20], eax
mov dl, 1
mov eax, dword [0x4190f0]
call fcn.00403ec8
mov dword [ebp - 0x24], eax
mov eax, 0xff
call fcn.0040ba64
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x4ba77a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4fdde0]
cmp byte [eax], 0
je 0x4b9a78
lea eax, [ebp - 0x2c]
mov edx, 0x4ba7c0
call fcn.00404e44
jmp 0x4b9a85
lea eax, [ebp - 0x2c]
mov edx, 0x4ba7e8
call fcn.00404e44
call fcn.004b5c2c
mov esi, eax
mov eax, dword [0x4fdde0]
cmp byte [eax], 0
je 0x4ba268
mov edx, 0x80000002
mov eax, esi
call fcn.00462570
mov edx, 0x4ba7c0
xor ecx, ecx
mov eax, esi
call fcn.004625d8
test al, al
je 0x4ba73d
mov edx, dword [ebp - 0x18]
mov eax, esi
call fcn.004628dc
mov eax, esi
call fcn.00462540
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4ba73d
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 8], 0
push dword [ebp - 0x2c]
push 0x4ba7f8
lea ecx, [ebp - 0x64]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x64]
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.00405140
mov edx, dword [ebp - 0x60]
xor ecx, ecx
mov eax, esi
call fcn.004625d8
test al, al
je 0x4ba257
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.004628dc
mov eax, esi
call fcn.00462540
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4ba257
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xc], 0
push dword [ebp - 0x2c]
push 0x4ba7f8
lea ecx, [ebp - 0x6c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x6c]
push 0x4ba7f8
lea ecx, [ebp - 0x70]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x70]
lea eax, [ebp - 0x68]
mov edx, 5
call fcn.00405140
mov edx, dword [ebp - 0x68]
xor ecx, ecx
mov eax, esi
call fcn.004625d8
test al, al
je 0x4ba24b
mov edx, dword [ebp - 0x20]
mov eax, esi
call fcn.004628dc
mov eax, esi
call fcn.00462540
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4ba24b
inc eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], 0
push dword [ebp - 0x2c]
push 0x4ba7f8
lea ecx, [ebp - 0x78]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x78]
push 0x4ba7f8
lea ecx, [ebp - 0x7c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x7c]
push 0x4ba7f8
lea ecx, [ebp - 0x80]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x80]
lea eax, [ebp - 0x74]
mov edx, 7
call fcn.00405140
mov edx, dword [ebp - 0x74]
xor ecx, ecx
mov eax, esi
call fcn.004625d8
test al, al
je 0x4ba23f
mov edx, 0x4ba804
mov eax, esi
call fcn.00462eb4
test al, al
je 0x4ba23f
mov edx, dword [0x4b7b74]
mov eax, 0x90
call fcn.00406004
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ebx, eax
lea ecx, [ebp - 0x88]
mov edx, 0x4ba814
mov eax, esi
call fcn.00462b34
mov eax, dword [ebp - 0x88]
lea edx, [ebp - 0x84]
call fcn.0040abc4
mov edx, dword [ebp - 0x84]
lea eax, [ebx + 0x18]
call fcn.00404e00
lea ecx, [ebp - 0x8c]
mov edx, 0x4ba828
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0x8c]
lea eax, [ebx + 0x10]
call fcn.00404e00
mov edx, dword [ebx + 0x10]
mov eax, 0x4ba840
call fcn.004053bc
test eax, eax
jle 0x4b9ce2
lea eax, [ebx + 0x10]
push eax
mov edx, dword [ebx + 0x10]
mov eax, 0x4ba840
call fcn.004053bc
mov edx, eax
inc edx
mov eax, dword [ebx + 0x10]
mov ecx, 0x400
call fcn.004052d8
lea ecx, [ebp - 0x90]
mov edx, 0x4ba84c
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0x90]
lea eax, [ebx + 0x14]
call fcn.00404e00
mov edx, dword [ebx + 0x14]
mov eax, 0x4ba840
call fcn.004053bc
test eax, eax
jle 0x4b9d34
lea eax, [ebx + 0x14]
push eax
mov edx, dword [ebx + 0x14]
mov eax, 0x4ba840
call fcn.004053bc
mov edx, eax
inc edx
mov eax, dword [ebx + 0x14]
mov ecx, 0x400
call fcn.004052d8
lea edx, [ebp - 0x94]
mov eax, dword [ebx + 0x10]
call fcn.0040afb4
cmp dword [ebp - 0x94], 0
jne 0x4b9d57
mov eax, ebx
mov edx, dword [ebx + 0x14]
call fcn.00404e00
jmp 0x4b9d61
mov eax, ebx
mov edx, dword [ebx + 0x10]
call fcn.00404e00
lea ecx, [ebp - 0x98]
mov edx, 0x4ba860
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0x98]
lea eax, [ebx + 0x1c]
call fcn.00404e00
mov edx, dword [ebx + 0x1c]
mov eax, 0x4ba840
call fcn.004053bc
test eax, eax
jle 0x4b9db3
lea eax, [ebx + 0x1c]
push eax
mov edx, dword [ebx + 0x1c]
mov eax, 0x4ba840
call fcn.004053bc
mov edx, eax
inc edx
mov eax, dword [ebx + 0x1c]
mov ecx, 0x400
call fcn.004052d8
lea ecx, [ebp - 0x9c]
mov edx, 0x4ba86c
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0x9c]
lea eax, [ebx + 0x54]
call fcn.00404e00
lea ecx, [ebp - 0xa0]
mov edx, 0x4ba87c
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0xa0]
lea eax, [ebx + 0x20]
call fcn.00404e00
lea eax, [ebx + 0x2c]
push eax
lea ecx, [ebx + 0x28]
lea edx, [ebx + 0x24]
mov eax, dword [ebx + 0x20]
call fcn.004b7ddc
cmp dword [ebx + 0x20], 0
jne 0x4b9e31
lea eax, [ebx + 0x60]
push eax
lea ecx, [ebp - 0xa4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xa4]
lea ecx, [ebx + 0x5c]
lea edx, [ebx + 0x20]
call fcn.004b93f0
lea eax, [ebx + 0xc]
push eax
lea ecx, [ebx + 8]
lea edx, [ebx + 4]
mov eax, dword [ebx + 0x18]
call fcn.004b8f10
cmp dword [ebx + 4], 0
jne 0x4b9e69
lea ecx, [ebp - 0xa8]
mov edx, 0x4ba898
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0xa8]
lea eax, [ebx + 4]
call fcn.00404e00
lea ecx, [ebp - 0xac]
mov edx, 0x4ba8a8
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0xac]
lea eax, [ebx + 0x40]
call fcn.00404e00
lea eax, [ebx + 0x4c]
push eax
lea eax, [ebx + 0x50]
push eax
lea ecx, [ebx + 0x48]
lea edx, [ebx + 0x44]
mov eax, dword [ebx + 0x40]
call fcn.004b91c0
lea eax, [ebx + 0x60]
push eax
lea ecx, [ebx + 0x5c]
lea edx, [ebx + 0x58]
mov eax, dword [ebx + 0x54]
call fcn.004b93f0
push dword [ebp - 0x2c]
push 0x4ba7f8
lea ecx, [ebp - 0xb0]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xb0]
push 0x4ba7f8
lea ecx, [ebp - 0xb4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xb4]
push 0x4ba7f8
lea ecx, [ebp - 0xb8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xb8]
lea eax, [ebx + 0x64]
mov edx, 7
call fcn.00405140
lea ecx, [ebp - 0xbc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xbc]
lea eax, [ebx + 0x38]
call fcn.00404e00
push 0
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0x2c]
push 0x4ba7f8
lea ecx, [ebp - 0xc8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xc8]
push 0x4ba7f8
lea ecx, [ebp - 0xcc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xcc]
push 0x4ba7f8
lea ecx, [ebp - 0xd0]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xd0]
lea eax, [ebp - 0xc4]
mov edx, 7
call fcn.00405140
mov edx, dword [ebp - 0xc4]
mov ecx, 0x4ba8b8
mov eax, 0x80000002
call fcn.004b5c50
mov edx, dword [ebp - 0xc0]
lea eax, [ebx + 0x30]
call fcn.00404e00
lea eax, [ebx + 0x7c]
push eax
lea eax, [ebx + 0x80]
push eax
lea ecx, [ebx + 0x78]
lea edx, [ebx + 0x74]
mov eax, dword [ebx + 0x30]
call fcn.004b97f0
lea ecx, [ebx + 0x6c]
lea edx, [ebx + 0x68]
mov eax, dword [ebx + 0x64]
call fcn.004b9558
lea ecx, [ebp - 0xd4]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x30]
call fcn.004b8b60
mov edx, dword [ebp - 0xd4]
lea eax, [ebx + 0x34]
call fcn.00404e00
mov eax, esi
call fcn.00462540
push dword [ebp - 0x2c]
push 0x4ba7f8
lea ecx, [ebp - 0xdc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xdc]
push 0x4ba7f8
lea ecx, [ebp - 0xe0]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xe0]
push 0x4ba7f8
lea ecx, [ebp - 0xe4]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xe4]
push 0x4ba7f8
push 0x4ba804
lea eax, [ebp - 0xd8]
mov edx, 9
call fcn.00405140
mov edx, dword [ebp - 0xd8]
xor ecx, ecx
mov eax, esi
call fcn.004625d8
test al, al
je 0x4ba0c4
lea edx, [ebp - 0x5c]
mov eax, esi
call fcn.00462874
lea eax, [ebp - 0x48]
call fcn.004af85c
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.004af7cc
fstp qword [ebx + 0x88]
wait
mov eax, esi
call fcn.00462540
push dword [ebp - 0x2c]
push 0x4ba7f8
lea ecx, [ebp - 0xec]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xec]
push 0x4ba7f8
lea ecx, [ebp - 0xf0]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xf0]
push 0x4ba7f8
lea ecx, [ebp - 0xf4]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0xf4]
push 0x4ba7f8
push 0x4ba8cc
lea eax, [ebp - 0xe8]
mov edx, 9
call fcn.00405140
mov edx, dword [ebp - 0xe8]
xor ecx, ecx
mov eax, esi
call fcn.004625d8
test al, al
je 0x4ba1f1
mov edx, dword [ebp - 0x24]
mov eax, esi
call fcn.004629a4
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4ba1ea
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0xf8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp dword [ebp - 0xf8], 0
je 0x4ba1e2
lea ecx, [ebp - 0xfc]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xfc]
mov eax, esi
call fcn.00462ae4
cmp al, 1
jne 0x4ba1e2
lea ecx, [ebp - 0x104]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x104]
lea ecx, [ebp - 0x100]
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0x100]
lea eax, [ebx + 0x3c]
call fcn.00404e00
jmp 0x4ba1ea
inc dword [ebp - 0x14]
dec dword [ebp - 0x40]
jne 0x4ba172
mov eax, esi
call fcn.00462540
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
call fcn.0040afb4
cmp dword [ebp - 0x108], 0
je 0x4ba231
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
call fcn.004b7d38
mov edx, dword [ebp - 0x28]
mov byte [edx + 0x70], al
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
jmp 0x4ba23f
mov edx, dword [0x4b7b74]
mov eax, dword [ebp - 0x28]
call fcn.00406018
inc dword [ebp - 0x10]
dec dword [ebp - 0x3c]
jne 0x4b9bcd
inc dword [ebp - 0xc]
dec dword [ebp - 0x38]
jne 0x4b9b50
inc dword [ebp - 8]
dec dword [ebp - 0x34]
jne 0x4b9ae9
jmp 0x4ba73d
mov edx, 0x80000006
mov eax, esi
call fcn.00462570
xor ecx, ecx
mov edx, 0x4ba8e8
mov eax, esi
call fcn.004625d8
test al, al
je 0x4ba31c
mov edx, dword [ebp - 0x18]
mov eax, esi
call fcn.004628dc
mov eax, esi
call fcn.00462540
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4ba31c
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x110]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x110]
lea eax, [ebp - 0x10c]
mov edx, 0x4ba908
call fcn.004050cc
mov edx, dword [ebp - 0x10c]
xor ecx, ecx
mov eax, esi
call fcn.004625d8
test al, al
je 0x4ba314
lea ecx, [ebp - 0x114]
mov edx, 0x4ba928
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, esi
call fcn.00462540
inc dword [ebp - 8]
dec dword [ebp - 0x34]
jne 0x4ba2b3
mov edx, 0x80000002
mov eax, esi
call fcn.00462570
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4ba73d
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x11c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040abc4
mov edx, dword [ebp - 0x118]
mov eax, 0x4ba93c
call fcn.004053bc
test eax, eax
jne 0x4ba731
push dword [ebp - 0x2c]
push 0x4ba7f8
lea ecx, [ebp - 0x124]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x124]
lea eax, [ebp - 0x120]
mov edx, 3
call fcn.00405140
mov edx, dword [ebp - 0x120]
xor ecx, ecx
mov eax, esi
call fcn.004625d8
test al, al
je 0x4ba731
mov edx, dword [ebp - 0x24]
mov eax, esi
call fcn.004628dc
mov edx, dword [0x4b7b74]
mov eax, 0x90
call fcn.00406004
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ebx, eax
mov edx, 0x4ba814
lea ecx, [ebp - 0x12c]
mov eax, esi
call fcn.00462b34
mov eax, dword [ebp - 0x12c]
lea edx, [ebp - 0x128]
call fcn.0040abc4
mov edx, dword [ebp - 0x128]
lea eax, [ebx + 0x18]
call fcn.00404e00
mov edx, 0x4ba828
lea ecx, [ebp - 0x130]
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0x130]
lea eax, [ebx + 0x10]
call fcn.00404e00
mov edx, 0x4ba84c
lea ecx, [ebp - 0x134]
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0x134]
lea eax, [ebx + 0x14]
call fcn.00404e00
lea edx, [ebp - 0x138]
mov eax, dword [ebx + 0x10]
call fcn.0040afb4
cmp dword [ebp - 0x138], 0
jne 0x4ba47a
mov eax, ebx
mov edx, dword [ebx + 0x14]
call fcn.00404e00
jmp 0x4ba484
mov eax, ebx
mov edx, dword [ebx + 0x10]
call fcn.00404e00
mov edx, 0x4ba860
lea ecx, [ebp - 0x13c]
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0x13c]
lea eax, [ebx + 0x1c]
call fcn.00404e00
mov edx, 0x4ba86c
lea ecx, [ebp - 0x140]
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0x140]
lea eax, [ebx + 0x54]
call fcn.00404e00
mov edx, 0x4ba87c
lea ecx, [ebp - 0x144]
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0x144]
lea eax, [ebx + 0x20]
call fcn.00404e00
lea eax, [ebx + 0x2c]
push eax
lea ecx, [ebx + 0x28]
lea edx, [ebx + 0x24]
mov eax, dword [ebx + 0x20]
call fcn.004b7ddc
cmp dword [ebx + 0x20], 0
jne 0x4ba522
lea eax, [ebx + 0x60]
push eax
lea ecx, [ebp - 0x148]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x148]
lea ecx, [ebx + 0x5c]
lea edx, [ebx + 0x20]
call fcn.004b93f0
lea eax, [ebx + 0xc]
push eax
lea ecx, [ebx + 8]
lea edx, [ebx + 4]
mov eax, dword [ebx + 0x18]
call fcn.004b8f10
cmp dword [ebx + 4], 0
jne 0x4ba55a
mov edx, 0x4ba898
lea ecx, [ebp - 0x14c]
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0x14c]
lea eax, [ebx + 4]
call fcn.00404e00
mov edx, 0x4ba8a8
lea ecx, [ebp - 0x150]
mov eax, esi
call fcn.00462b34
mov edx, dword [ebp - 0x150]
lea eax, [ebx + 0x40]
call fcn.00404e00
lea eax, [ebx + 0x4c]
push eax
lea eax, [ebx + 0x50]
push eax
lea ecx, [ebx + 0x48]
lea edx, [ebx + 0x44]
mov eax, dword [ebx + 0x40]
call fcn.004b91c0
lea eax, [ebx + 0x60]
push eax
lea ecx, [ebx + 0x5c]
lea edx, [ebx + 0x58]
mov eax, dword [ebx + 0x54]
call fcn.004b93f0
push dword [ebp - 0x2c]
push 0x4ba7f8
lea ecx, [ebp - 0x154]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x154]
lea eax, [ebx + 0x64]
mov edx, 3
call fcn.00405140
lea ecx, [ebp - 0x158]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x158]
lea eax, [ebx + 0x38]
call fcn.00404e00
push 0
lea eax, [ebp - 0x15c]
push eax
push dword [ebp - 0x2c]
push 0x4ba7f8
lea ecx, [ebp - 0x164]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x164]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.00405140
mov edx, dword [ebp - 0x160]
mov ecx, 0x4ba8b8
mov eax, 0x80000002
call fcn.004b5c50
mov edx, dword [ebp - 0x15c]
lea eax, [ebx + 0x30]
call fcn.00404e00
lea eax, [ebx + 0x7c]
push eax
lea eax, [ebx + 0x80]
push eax
lea ecx, [ebx + 0x78]
lea edx, [ebx + 0x74]
mov eax, dword [ebx + 0x30]
call fcn.004b97f0
lea eax, [ebx + 0x34]
call fcn.00404dac
lea ecx, [ebx + 0x6c]
lea edx, [ebx + 0x68]
mov eax, dword [ebx + 0x64]
call fcn.004b97b0
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
call fcn.0040afb4
cmp dword [ebp - 0x168], 0
je 0x4ba71c
mov eax, dword [ebp - 0x28]
push dword [eax + 4]
push 0x4ba94c
mov eax, dword [ebp - 0x28]
push dword [eax + 0x14]
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00405140
mov edx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jne 0x4ba71c
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
call fcn.004b7d38
mov edx, dword [ebp - 0x28]
mov byte [edx + 0x70], al
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x28]
push dword [eax + 4]
push 0x4ba94c
mov eax, dword [ebp - 0x28]
push dword [eax + 0x14]
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.00405140
mov edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4ba72a
mov edx, dword [0x4b7b74]
mov eax, dword [ebp - 0x28]
call fcn.00406018
mov eax, esi
call fcn.00462540
inc dword [ebp - 8]
dec dword [ebp - 0x34]
jne 0x4ba344
mov eax, esi
call fcn.00403ef8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba781
mov eax, dword [ebp - 0x30]
call fcn.0040bab0
mov eax, dword [ebp - 0x18]
call fcn.00403ef8
mov eax, dword [ebp - 0x1c]
call fcn.00403ef8
mov eax, dword [ebp - 0x20]
call fcn.00403ef8
mov eax, dword [ebp - 0x24]
call fcn.00403ef8
ret