Function at 0x4a3c28
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x49
push 0
push 0
dec ecx
jne 0x4a3c30
push ebx
push esi
push edi
mov ebx, dword [0x4ab0d4]
xor eax, eax
push ebp
push 0x4a5487
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [0x4aaf1c]
mov esi, dword [esi]
mov edx, 0x46
mov al, 4
call fcn.004a5fb8
mov eax, dword [0x4aaf44]
mov edx, 0x4a54a4
call fcn.004048c4
push 0
push 1
mov ecx, dword [0x4aaf44]
mov ecx, dword [ecx]
mov edx, dword [0x4aaeb0]
mov edx, dword [edx]
lea eax, [ebp - 0x2c]
call fcn.00404b8c
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x4ab290]
mov eax, dword [eax]
xor ecx, ecx
call fcn.004780d0
test eax, eax
jne 0x4a3cbe
mov eax, dword [0x4aaeb8]
mov eax, dword [eax]
mov edx, dword [0x4ab384]
mov dword [edx], eax
mov esi, dword [0x4ab384]
mov esi, dword [esi]
jmp 0x4a53d6
lea edx, [ebp - 0x30]
mov eax, dword [0x4ab290]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
call fcn.00406994
mov edx, dword [ebp - 0x30]
mov eax, dword [0x4ab39c]
call fcn.00404b08
mov eax, 0x4a54bc
call fcn.004a3168
push 1
mov edx, dword [0x4ab39c]
mov edx, dword [edx]
mov ecx, 1
mov eax, 0x4a54cc
call fcn.00469914
test eax, eax
sete al
mov byte [ebp - 0x40], al
mov byte [ebp - 0x3c], 1
push 1
mov edx, dword [0x4ab39c]
mov edx, dword [edx]
mov ecx, 1
mov eax, 0x4a5508
call fcn.00469914
test eax, eax
sete al
mov byte [ebp - 0x38], al
mov byte [ebp - 0x34], 1
lea edx, [ebp - 0x40]
mov eax, dword [0x4aae24]
mov eax, dword [eax]
mov ecx, 1
call fcn.004a6000
call fcn.004a60cc
test al, al
je 0x4a3d5b
mov esi, dword [0x4ab384]
mov esi, dword [esi]
jmp 0x4a53d6
push 1
push 1
lea eax, [ebp - 0x20]
push eax
mov eax, dword [0x4ab39c]
mov eax, dword [eax]
mov ecx, 0x4a5534
mov edx, 0x4a5548
call fcn.00469e70
cmp dword [ebp - 0x20], 0
setne al
mov byte [ebp - 0x48], al
mov byte [ebp - 0x44], 1
lea edx, [ebp - 0x48]
mov eax, dword [0x4ab0c8]
mov eax, dword [eax]
xor ecx, ecx
call fcn.004a6000
call fcn.004a60cc
test al, al
jne 0x4a53d6
mov edx, 0x50
mov al, 4
call fcn.004a5fb8
mov eax, dword [0x4aaf44]
mov edx, 0x4a555c
call fcn.004048c4
mov eax, dword [0x4ab1c0]
mov edx, 0x4a557c
call fcn.004048c4
push 0
push 1
mov ecx, dword [0x4aaf44]
mov ecx, dword [ecx]
mov edx, dword [0x4aaeb0]
mov edx, dword [edx]
lea eax, [ebp - 0x4c]
call fcn.00404b8c
mov edx, dword [ebp - 0x4c]
mov ecx, dword [0x4ab1c0]
mov ecx, dword [ecx]
mov eax, dword [0x4ab290]
mov eax, dword [eax]
call fcn.004780d0
test eax, eax
jne 0x4a3e22
mov eax, dword [0x4aaeb8]
mov eax, dword [eax]
mov edx, dword [0x4ab384]
mov dword [edx], eax
mov esi, dword [0x4ab384]
mov esi, dword [esi]
jmp 0x4a53d6
lea edx, [ebp - 0x50]
mov eax, dword [0x4ab290]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
call fcn.00406994
mov edx, dword [ebp - 0x50]
mov eax, dword [0x4ab39c]
call fcn.00404b08
mov eax, 0x4a55b8
call fcn.004a3168
mov edx, dword [0x4ab39c]
mov edx, dword [edx]
mov eax, 0x4a55c8
call fcn.00404e84
test eax, eax
jle 0x4a3e7d
mov eax, dword [0x4ab244]
mov eax, dword [eax]
mov edx, dword [0x4ab384]
mov dword [edx], eax
mov esi, dword [0x4ab384]
mov esi, dword [esi]
jmp 0x4a53d6
push 1
mov edx, dword [0x4ab39c]
mov edx, dword [edx]
mov ecx, 1
mov eax, 0x4a54cc
call fcn.00469914
test eax, eax
sete al
mov byte [ebp - 0x40], al
mov byte [ebp - 0x3c], 1
push 1
mov edx, dword [0x4ab39c]
mov edx, dword [edx]
mov ecx, 1
mov eax, 0x4a5508
call fcn.00469914
test eax, eax
sete al
mov byte [ebp - 0x38], al
mov byte [ebp - 0x34], 1
lea edx, [ebp - 0x40]
mov eax, dword [0x4aae24]
mov eax, dword [eax]
mov ecx, 1
call fcn.004a6000
push 1
mov edx, dword [0x4ab39c]
mov edx, dword [edx]
mov ecx, 1
mov eax, 0x4a55e8
call fcn.00469914
test eax, eax
setne al
mov byte [ebp - 0x68], al
mov byte [ebp - 0x64], 1
push 1
mov edx, dword [0x4ab39c]
mov edx, dword [edx]
mov ecx, 1
mov eax, 0x4a55f8
call fcn.00469914
test eax, eax
setne al
mov byte [ebp - 0x60], al
mov byte [ebp - 0x5c], 1
push 1
mov edx, dword [0x4ab39c]
mov edx, dword [edx]
mov ecx, 1
mov eax, 0x4a560c
call fcn.00469914
test eax, eax
setne al
mov byte [ebp - 0x58], al
mov byte [ebp - 0x54], 1
lea edx, [ebp - 0x68]
mov eax, dword [0x4ab0c8]
mov eax, dword [eax]
add eax, 1
jno 0x4a3f5e
call fcn.00403a60
mov ecx, 2
call fcn.004a6000
call fcn.004a60cc
test al, al
jne 0x4a53d6
mov edx, 0x5a
mov al, 7
call fcn.004a5fb8
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x24]
call fcn.00404870
push 1
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4ab39c]
mov eax, dword [eax]
mov ecx, 0x4a5620
mov edx, 0x4a564c
call fcn.00469e70
cmp dword [ebp - 8], 0
jne 0x4a53a2
push 1
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4ab39c]
mov eax, dword [eax]
mov ecx, 0x4a5620
mov edx, 0x4a5674
call fcn.00469e70
jmp 0x4a53a2
push 1
push 1
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x6c]
push eax
mov ecx, 0x4a5698
mov edx, 0x4a56a4
mov eax, dword [ebp - 8]
call fcn.00469e70
mov eax, dword [ebp - 0x6c]
mov ecx, 0x4a56cc
mov edx, 0x4a56d8
call fcn.00469e70
push 2
push 1
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x70]
push eax
mov ecx, 0x4a5698
mov edx, 0x4a56a4
mov eax, dword [ebp - 8]
call fcn.00469e70
mov eax, dword [ebp - 0x70]
mov ecx, 0x4a56e4
mov edx, 0x4a56d8
call fcn.00469e70
push 1
push 1
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x74]
push eax
mov ecx, 0x4a5698
mov edx, 0x4a56a4
mov eax, dword [ebp - 8]
call fcn.00469e70
mov eax, dword [ebp - 0x74]
mov ecx, 0x4a56e4
mov edx, 0x4a56e4
call fcn.00469e70
cmp dword [ebp - 0x18], 0
setne al
mov byte [ebp - 0x48], al
mov byte [ebp - 0x44], 1
lea edx, [ebp - 0x48]
mov eax, dword [0x4ab0c8]
mov eax, dword [eax]
add eax, 2
jno 0x4a409f
call fcn.00403a60
xor ecx, ecx
call fcn.004a6000
call fcn.004a60cc
test al, al
je 0x4a40bc
mov esi, dword [0x4ab384]
mov esi, dword [esi]
jmp 0x4a53d6
mov eax, dword [0x4aaf44]
mov edx, 0x4a56f0
call fcn.004048c4
push 0x4a5710
lea ecx, [ebp - 0x78]
mov eax, dword [0x4aafe0]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
call fcn.0047d29c
push dword [ebp - 0x78]
push 0x4a5724
push 0x4a573c
lea ecx, [ebp - 0x7c]
mov eax, dword [0x4aafe0]
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
call fcn.0047d29c
push dword [ebp - 0x7c]
push 0x4a5750
lea ecx, [ebp - 0x80]
mov eax, dword [0x4aafe0]
mov eax, dword [eax]
mov edx, dword [ebp - 0x18]
call fcn.0047d29c
push dword [ebp - 0x80]
push 0x4a5764
mov eax, dword [0x4ab1c0]
mov edx, 8
call fcn.00404c00
push 0
push 1
mov ecx, dword [0x4aaf44]
mov ecx, dword [ecx]
mov edx, dword [0x4aaeb0]
mov edx, dword [edx]
lea eax, [ebp - 0x84]
call fcn.00404b8c
mov edx, dword [ebp - 0x84]
mov ecx, dword [0x4ab1c0]
mov ecx, dword [ecx]
mov eax, dword [0x4ab290]
mov eax, dword [eax]
call fcn.004780d0
test eax, eax
jne 0x4a418b
mov eax, dword [0x4aaeb8]
mov eax, dword [eax]
mov edx, dword [0x4ab384]
mov dword [edx], eax
mov esi, dword [0x4ab384]
mov esi, dword [esi]
jmp 0x4a53d6
lea edx, [ebp - 0x88]
mov eax, dword [0x4ab290]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
call fcn.00406994
mov edx, dword [ebp - 0x88]
mov eax, dword [0x4ab39c]
call fcn.00404b08
mov eax, dword [ebp - 0x1c]
cdq
push edx
push eax
lea eax, [ebp - 0x90]
call fcn.0047dd20
mov ecx, dword [ebp - 0x90]
lea eax, [ebp - 0x8c]
mov edx, 0x4a5778
call fcn.00404b8c
mov eax, dword [ebp - 0x8c]
call fcn.004a3168
push 1
mov edx, dword [0x4ab39c]
mov edx, dword [edx]
mov ecx, 1
mov eax, 0x4a54cc
call fcn.00469914
test eax, eax
sete al
mov byte [ebp - 0x40], al
mov byte [ebp - 0x3c], 1
push 1
mov edx, dword [0x4ab39c]
mov edx, dword [edx]
mov ecx, 1
mov eax, 0x4a5508
call fcn.00469914
test eax, eax
sete al
mov byte [ebp - 0x38], al
mov byte [ebp - 0x34], 1
lea edx, [ebp - 0x40]
mov eax, dword [0x4aae24]
mov eax, dword [eax]
mov ecx, 1
call fcn.004a6000
call fcn.004a60cc
test al, al
je 0x4a4256
mov esi, dword [0x4ab384]
mov esi, dword [esi]
jmp 0x4a53d6
lea eax, [ebp - 4]
push eax
push 1
push 0
lea eax, [ebp - 0x94]
push eax
mov eax, dword [0x4ab39c]
mov eax, dword [eax]
mov ecx, 0x4a5788
mov edx, 0x4a57a4
call fcn.00469e70
mov eax, dword [ebp - 0x94]
xor ecx, ecx
mov edx, 0x4a57d8
call fcn.00469a7c
mov edi, 0x14
lea esi, [ebx + 4]
mov eax, esi
call fcn.00404870
add esi, 4
dec edi
jne 0x4a4295
push 1
push 0
lea eax, [ebp - 0x98]
push eax
push 1
push 0
lea eax, [ebp - 0x9c]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a57f8
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0x9c]
mov ecx, 0x4a580c
mov edx, 0x4a581c
call fcn.00469e70
mov edx, dword [ebp - 0x98]
lea eax, [ebx + 4]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0xa4]
push eax
mov eax, dword [ebx + 4]
mov ecx, 0x4a582c
mov edx, 0x4a5838
call fcn.00469e70
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.0046a474
mov edx, dword [ebp - 0xa0]
lea eax, [ebx + 4]
call fcn.004048c4
lea eax, [ebp - 0x28]
mov edx, dword [ebx + 4]
call fcn.00404908
push 1
push 0
lea eax, [ebp - 0xa8]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0xac]
push eax
mov ecx, 0x4a5534
mov edx, 0x4a5844
mov eax, dword [ebp - 8]
call fcn.00469e70
mov eax, dword [ebp - 0xac]
mov ecx, 0x4a582c
mov edx, 0x4a5858
call fcn.00469e70
mov edx, dword [ebp - 0xa8]
lea eax, [ebx + 8]
call fcn.004048c4
mov eax, dword [ebx + 8]
call fcn.00404b40
cmp eax, 0x3f
jle 0x4a43ba
lea eax, [ebp - 0xb0]
push eax
mov eax, dword [ebx + 8]
mov ecx, 0x3c
mov edx, 1
call fcn.00469eb4
mov edx, dword [ebp - 0xb0]
lea eax, [ebx + 8]
mov ecx, 0x4a5868
call fcn.00404b8c
push 1
mov ecx, 1
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
call fcn.00469914
test eax, eax
jle 0x4a445e
push 1
push 1
lea eax, [ebp - 0xb4]
push eax
push 2
push 0
lea eax, [ebp - 0xb8]
push eax
push 1
push 0
lea eax, [ebp - 0xbc]
push eax
mov ecx, 0x4a5874
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
call fcn.00469e70
mov eax, dword [ebp - 0xbc]
mov ecx, 0x4a5884
mov edx, 0x4a5890
call fcn.00469e70
mov eax, dword [ebp - 0xb8]
xor ecx, ecx
mov edx, 0x4a5838
call fcn.00469e70
mov edx, dword [ebp - 0xb4]
lea eax, [ebx + 0xc]
call fcn.004048c4
lea eax, [ebp - 0xc0]
push eax
mov eax, dword [ebx + 0xc]
xor ecx, ecx
mov edx, 0x4a58a4
call fcn.00469a7c
mov edx, dword [ebp - 0xc0]
lea eax, [ebx + 0xc]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0xc4]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a58b0
mov eax, dword [ebp - 4]
call fcn.00469e70
mov edx, dword [ebp - 0xc4]
lea eax, [ebx + 0x10]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0xc8]
push eax
push 1
push 1
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [ebx + 0x10]
mov ecx, 0x4a5884
mov edx, 0x4a58c4
call fcn.00469e70
mov eax, dword [ebp - 0xcc]
xor ecx, ecx
mov edx, 0x4a5838
call fcn.00469e70
mov edx, dword [ebp - 0xc8]
lea eax, [ebx + 0x10]
call fcn.004048c4
lea edx, [ebp - 0xd0]
mov eax, dword [ebx + 0x10]
call fcn.0046a474
mov edx, dword [ebp - 0xd0]
lea eax, [ebx + 0x10]
call fcn.004048c4
lea eax, [ebp - 0xd4]
push eax
mov eax, dword [ebx + 0x10]
xor ecx, ecx
mov edx, 0x4a58a4
call fcn.00469a7c
mov edx, dword [ebp - 0xd4]
lea eax, [ebx + 0x10]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0xd8]
push eax
push 1
push 0
lea eax, [ebp - 0xdc]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a58d4
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0xdc]
mov ecx, 0x4a580c
mov edx, 0x4a581c
call fcn.00469e70
mov edx, dword [ebp - 0xd8]
lea eax, [ebx + 0x14]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0xe4]
push eax
mov eax, dword [ebx + 0x14]
mov ecx, 0x4a582c
mov edx, 0x4a58f4
call fcn.00469e70
mov eax, dword [ebp - 0xe4]
lea edx, [ebp - 0xe0]
call fcn.0046a474
mov edx, dword [ebp - 0xe0]
lea eax, [ebx + 0x14]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0xe8]
push eax
push 1
push 0
lea eax, [ebp - 0xec]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a5900
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0xec]
mov ecx, 0x4a580c
mov edx, 0x4a581c
call fcn.00469e70
mov edx, dword [ebp - 0xe8]
lea eax, [ebx + 0x18]
call fcn.004048c4
push 1
mov edx, dword [ebx + 0x18]
mov ecx, 1
mov eax, 0x4a5918
call fcn.00469914
test eax, eax
jle 0x4a4628
push 1
push 1
lea eax, [ebp - 0xf0]
push eax
mov eax, dword [ebx + 0x18]
mov ecx, 0x4a582c
mov edx, 0x4a5918
call fcn.00469e70
mov edx, dword [ebp - 0xf0]
lea eax, [ebx + 0x18]
call fcn.004048c4
jmp 0x4a4653
push 1
push 1
lea eax, [ebp - 0xf4]
push eax
mov eax, dword [ebx + 0x18]
mov ecx, 0x4a582c
mov edx, 0x4a5838
call fcn.00469e70
mov edx, dword [ebp - 0xf4]
lea eax, [ebx + 0x18]
call fcn.004048c4
lea eax, [ebp - 0xf8]
push eax
mov eax, dword [ebx + 0x18]
xor ecx, ecx
mov edx, 0x4a5924
call fcn.00469a7c
mov edx, dword [ebp - 0xf8]
lea eax, [ebx + 0x18]
call fcn.004048c4
lea eax, [ebp - 0xfc]
push eax
mov eax, dword [ebx + 0x18]
xor ecx, ecx
mov edx, 0x4a5930
call fcn.00469a7c
mov edx, dword [ebp - 0xfc]
lea eax, [ebx + 0x18]
call fcn.004048c4
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebx + 0x18]
xor ecx, ecx
mov edx, 0x4a593c
call fcn.00469a7c
mov edx, dword [ebp - 0x100]
lea eax, [ebx + 0x18]
call fcn.004048c4
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebx + 0x18]
xor ecx, ecx
mov edx, 0x4a58a4
call fcn.00469a7c
mov edx, dword [ebp - 0x104]
lea eax, [ebx + 0x18]
call fcn.004048c4
lea edx, [ebp - 0x108]
mov eax, dword [ebx + 0x18]
call fcn.0046a474
mov edx, dword [ebp - 0x108]
lea eax, [ebx + 0x18]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0x10c]
push eax
push 1
push 0
lea eax, [ebp - 0x110]
push eax
mov ecx, 0x4a5948
mov edx, 0x4a58d4
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0x110]
mov ecx, 0x4a580c
mov edx, 0x4a581c
call fcn.00469e70
mov edx, dword [ebp - 0x10c]
lea eax, [ebx + 0x1c]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebx + 0x1c]
mov ecx, 0x4a58f4
mov edx, 0x4a5838
call fcn.00469e70
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x114]
call fcn.0046a474
mov edx, dword [ebp - 0x114]
lea eax, [ebx + 0x1c]
call fcn.004048c4
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebx + 0x1c]
xor ecx, ecx
mov edx, 0x4a5958
call fcn.00469a7c
mov edx, dword [ebp - 0x11c]
lea eax, [ebx + 0x1c]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0x120]
push eax
push 1
push 0
lea eax, [ebp - 0x124]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a5964
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0x124]
mov ecx, 0x4a580c
mov edx, 0x4a581c
call fcn.00469e70
mov edx, dword [ebp - 0x120]
lea eax, [ebx + 0x20]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebx + 0x20]
mov ecx, 0x4a582c
mov edx, 0x4a5838
call fcn.00469e70
mov eax, dword [ebp - 0x12c]
lea edx, [ebp - 0x128]
call fcn.0046a474
mov edx, dword [ebp - 0x128]
lea eax, [ebx + 0x20]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0x134]
push eax
mov ecx, 0x4a5978
mov edx, 0x4a5988
mov eax, dword [ebp - 8]
call fcn.00469e70
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.0046a474
mov edx, dword [ebp - 0x130]
lea eax, [ebx + 0x24]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 1
push 0
lea eax, [ebp - 0x13c]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a599c
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0x13c]
mov ecx, 0x4a580c
mov edx, 0x4a581c
call fcn.00469e70
mov edx, dword [ebp - 0x138]
lea eax, [ebx + 0x30]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0x144]
push eax
mov eax, dword [ebx + 0x30]
mov ecx, 0x4a59b0
mov edx, 0x4a5838
call fcn.00469e70
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.0046a474
mov edx, dword [ebp - 0x140]
lea eax, [ebx + 0x30]
call fcn.004048c4
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebx + 0x30]
xor ecx, ecx
mov edx, 0x4a59bc
call fcn.00469a7c
mov edx, dword [ebp - 0x148]
lea eax, [ebx + 0x30]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0x14c]
push eax
push 1
push 0
lea eax, [ebp - 0x150]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a599c
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0x150]
mov ecx, 0x4a580c
mov edx, 0x4a581c
call fcn.00469e70
mov edx, dword [ebp - 0x14c]
lea eax, [ebx + 0x34]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0x158]
push eax
mov eax, dword [ebx + 0x34]
mov ecx, 0x4a582c
mov edx, 0x4a59b0
call fcn.00469e70
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.0046a474
mov edx, dword [ebp - 0x154]
lea eax, [ebx + 0x34]
call fcn.004048c4
lea eax, [ebp - 0x15c]
push eax
mov eax, dword [ebx + 0x34]
xor ecx, ecx
mov edx, 0x4a59bc
call fcn.00469a7c
mov edx, dword [ebp - 0x15c]
lea eax, [ebx + 0x34]
call fcn.004048c4
lea eax, [ebx + 0x28]
mov edx, dword [ebx + 0x30]
call fcn.004048c4
lea eax, [ebx + 0x2c]
mov edx, dword [ebx + 0x34]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0x160]
push eax
push 1
push 0
lea eax, [ebp - 0x164]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a59c8
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0x164]
mov ecx, 0x4a580c
mov edx, 0x4a581c
call fcn.00469e70
mov edx, dword [ebp - 0x160]
lea eax, [ebx + 0x38]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0x16c]
push eax
mov eax, dword [ebx + 0x38]
mov ecx, 0x4a582c
mov edx, 0x4a5838
call fcn.00469e70
mov eax, dword [ebp - 0x16c]
lea edx, [ebp - 0x168]
call fcn.0046a474
mov edx, dword [ebp - 0x168]
lea eax, [ebx + 0x38]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0x170]
push eax
push 1
push 0
lea eax, [ebp - 0x174]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a59c8
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0x174]
mov ecx, 0x4a580c
mov edx, 0x4a59dc
call fcn.00469e70
mov edx, dword [ebp - 0x170]
lea eax, [ebx + 0x3c]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0x17c]
push eax
push 1
push 0
lea eax, [ebp - 0x180]
push eax
mov eax, dword [ebx + 0x3c]
xor ecx, ecx
mov edx, 0x4a581c
call fcn.00469e70
mov eax, dword [ebp - 0x180]
mov ecx, 0x4a582c
mov edx, 0x4a5838
call fcn.00469e70
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x178]
call fcn.0046a474
mov edx, dword [ebp - 0x178]
lea eax, [ebx + 0x3c]
call fcn.004048c4
lea eax, [ebx + 0x40]
call fcn.00404870
push 1
push 0
lea eax, [ebp - 0x184]
push eax
push 1
push 0
lea eax, [ebp - 0x188]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a59f0
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0x188]
mov ecx, 0x4a580c
mov edx, 0x4a581c
call fcn.00469e70
mov edx, dword [ebp - 0x184]
lea eax, [ebx + 0x44]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0x190]
push eax
mov eax, dword [ebx + 0x44]
mov ecx, 0x4a582c
mov edx, 0x4a5838
call fcn.00469e70
mov eax, dword [ebp - 0x190]
lea edx, [ebp - 0x18c]
call fcn.0046a474
mov edx, dword [ebp - 0x18c]
lea eax, [ebx + 0x44]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0x194]
push eax
push 1
push 0
lea eax, [ebp - 0x198]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a59f0
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0x198]
mov ecx, 0x4a580c
mov edx, 0x4a59dc
call fcn.00469e70
mov edx, dword [ebp - 0x194]
lea eax, [ebx + 0x48]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0x1a0]
push eax
push 1
push 0
lea eax, [ebp - 0x1a4]
push eax
mov eax, dword [ebx + 0x48]
xor ecx, ecx
mov edx, 0x4a581c
call fcn.00469e70
mov eax, dword [ebp - 0x1a4]
mov ecx, 0x4a582c
mov edx, 0x4a5838
call fcn.00469e70
mov eax, dword [ebp - 0x1a0]
lea edx, [ebp - 0x19c]
call fcn.0046a474
mov edx, dword [ebp - 0x19c]
lea eax, [ebx + 0x48]
call fcn.004048c4
lea eax, [ebx + 0x4c]
call fcn.00404870
lea eax, [ebx + 0x50]
call fcn.00404870
xor eax, eax
push ebp
push 0x4a4c66
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, 1
call fcn.004a5ec4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a4c9e
mov eax, dword [0x4ab0cc]
mov eax, dword [eax + 0x38]
mov edx, 0x4a5a1c
call fcn.00404c8c
jne 0x4a5397
mov edi, 0x14
lea esi, [ebx + 4]
mov eax, esi
call fcn.00404870
add esi, 4
dec edi
jne 0x4a4cbe
lea eax, [ebx + 4]
mov edx, 0x4a5a28
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0x1a8]
push eax
push 1
push 0
lea eax, [ebp - 0x1ac]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a5a3c
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0x1ac]
mov ecx, 0x4a580c
mov edx, 0x4a581c
call fcn.00469e70
mov edx, dword [ebp - 0x1a8]
lea eax, [ebx + 8]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0x1b4]
push eax
mov eax, dword [ebx + 8]
mov ecx, 0x4a58f4
mov edx, 0x4a5838
call fcn.00469e70
mov eax, dword [ebp - 0x1b4]
lea edx, [ebp - 0x1b0]
call fcn.0046a474
mov edx, dword [ebp - 0x1b0]
lea eax, [ebx + 8]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0x1b8]
push eax
push 1
push 0
lea eax, [ebp - 0x1bc]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a5a58
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0x1bc]
mov ecx, 0x4a580c
mov edx, 0x4a581c
call fcn.00469e70
mov edx, dword [ebp - 0x1b8]
lea eax, [ebx + 0x18]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0x1c4]
push eax
mov eax, dword [ebx + 0x18]
mov ecx, 0x4a582c
mov edx, 0x4a5838
call fcn.00469e70
mov eax, dword [ebp - 0x1c4]
lea edx, [ebp - 0x1c0]
call fcn.0046a474
mov edx, dword [ebp - 0x1c0]
lea eax, [ebx + 0x18]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0x1c8]
push eax
push 1
push 0
lea eax, [ebp - 0x1cc]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a5a6c
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0x1cc]
mov ecx, 0x4a580c
mov edx, 0x4a581c
call fcn.00469e70
mov edx, dword [ebp - 0x1c8]
lea eax, [ebx + 0x1c]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0x1d4]
push eax
mov eax, dword [ebx + 0x1c]
mov ecx, 0x4a582c
mov edx, 0x4a5838
call fcn.00469e70
mov eax, dword [ebp - 0x1d4]
lea edx, [ebp - 0x1d0]
call fcn.0046a474
mov edx, dword [ebp - 0x1d0]
lea eax, [ebx + 0x1c]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0x1d8]
push eax
push 1
push 0
lea eax, [ebp - 0x1dc]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a5a80
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0x1dc]
mov ecx, 0x4a580c
mov edx, 0x4a581c
call fcn.00469e70
mov edx, dword [ebp - 0x1d8]
lea eax, [ebx + 0x20]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0x1e4]
push eax
mov eax, dword [ebx + 0x20]
mov ecx, 0x4a582c
mov edx, 0x4a5838
call fcn.00469e70
mov eax, dword [ebp - 0x1e4]
lea edx, [ebp - 0x1e0]
call fcn.0046a474
mov edx, dword [ebp - 0x1e0]
lea eax, [ebx + 0x20]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0x1e8]
push eax
push 1
push 0
lea eax, [ebp - 0x1ec]
push eax
mov ecx, 0x4a57e8
mov edx, 0x4a5a94
mov eax, dword [ebp - 4]
call fcn.00469e70
mov eax, dword [ebp - 0x1ec]
mov ecx, 0x4a580c
mov edx, 0x4a581c
call fcn.00469e70
mov edx, dword [ebp - 0x1e8]
lea eax, [ebx + 0x24]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0x1f4]
push eax
mov eax, dword [ebx + 0x24]
mov ecx, 0x4a582c
mov edx, 0x4a5838
call fcn.00469e70
mov eax, dword [ebp - 0x1f4]
lea edx, [ebp - 0x1f0]
call fcn.0046a474
mov edx, dword [ebp - 0x1f0]
lea eax, [ebx + 0x24]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0x1f8]
push eax
push 1
push 0
lea eax, [ebp - 0x1fc]
push eax
push 1
push 0
lea eax, [ebp - 0x200]
push eax
mov ecx, 0x4a57e8
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
call fcn.00469e70
mov eax, dword [ebp - 0x200]
mov ecx, 0x4a5884
mov edx, 0x4a5890
call fcn.00469e70
mov eax, dword [ebp - 0x1fc]
xor ecx, ecx
mov edx, 0x4a5838
call fcn.00469e70
mov edx, dword [ebp - 0x1f8]
lea eax, [ebx + 0x28]
call fcn.004048c4
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebx + 0x28]
xor ecx, ecx
mov edx, 0x4a58a4
call fcn.00469a7c
mov edx, dword [ebp - 0x204]
lea eax, [ebx + 0x28]
call fcn.004048c4
push 1
push 1
lea eax, [ebp - 0x208]
push eax
push 1
push 0
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
lea eax, [ebp - 0x210]
push eax
mov ecx, 0x4a5874
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
call fcn.00469e70
mov eax, dword [ebp - 0x210]
mov ecx, 0x4a5884
mov edx, 0x4a5aa8
call fcn.00469e70
mov eax, dword [ebp - 0x20c]
xor ecx, ecx
mov edx, 0x4a5838
call fcn.00469e70
mov edx, dword [ebp - 0x208]
lea eax, [ebx + 0x2c]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4a5abc
mov edx, 0x4a5ad0
mov eax, dword [ebp - 4]
call fcn.00469e70
push 1
push 0
lea eax, [ebp - 0x214]
push eax
mov ecx, 0x4a5884
mov edx, 0x4a5ae0
mov eax, dword [ebp - 0xc]
call fcn.00469e70
mov edx, dword [ebp - 0x214]
lea eax, [ebx + 0x30]
call fcn.004048c4
push 2
push 0
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x4a5884
mov edx, 0x4a5ae0
mov eax, dword [ebp - 0xc]
call fcn.00469e70
mov edx, dword [ebp - 0x218]
lea eax, [ebx + 0x34]
call fcn.004048c4
lea eax, [ebp - 0x220]
push eax
push 1
push 1
lea eax, [ebp - 0x224]
push eax
push 1
push 0
lea eax, [ebp - 0x228]
push eax
mov ecx, 0x4a5afc
mov edx, 0x4a5b0c
mov eax, dword [ebp - 0xc]
call fcn.00469e70
mov eax, dword [ebp - 0x228]
xor ecx, ecx
mov edx, 0x4a5b28
call fcn.00469e70
mov eax, dword [ebp - 0x224]
xor ecx, ecx
mov edx, 0x4a5958
call fcn.00469a7c
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.0046a474
mov edx, dword [ebp - 0x21c]
lea eax, [ebx + 0x38]
call fcn.004048c4
cmp dword [ebp - 0x24], 0
jne 0x4a528f
mov eax, dword [0x4aaf44]
mov edx, 0x4a5b34
call fcn.004048c4
mov eax, dword [0x4ab1c0]
mov edx, 0x4a5b58
call fcn.004048c4
push 0
push 1
mov ecx, dword [0x4aaf44]
mov ecx, dword [ecx]
mov edx, dword [0x4aaeb0]
mov edx, dword [edx]
lea eax, [ebp - 0x22c]
call fcn.00404b8c
mov edx, dword [ebp - 0x22c]
mov ecx, dword [0x4ab1c0]
mov ecx, dword [ecx]
mov eax, dword [0x4ab290]
mov eax, dword [eax]
call fcn.004780d0
test eax, eax
jne 0x4a51ce
mov eax, dword [0x4aaeb8]
mov eax, dword [eax]
mov edx, dword [0x4ab384]
mov dword [edx], eax
mov esi, dword [0x4ab384]
mov esi, dword [esi]
jmp 0x4a53d6
lea edx, [ebp - 0x230]
mov eax, dword [0x4ab290]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
call fcn.00406994
mov edx, dword [ebp - 0x230]
mov eax, dword [0x4ab39c]
call fcn.00404b08
mov eax, 0x4a5b84
call fcn.004a3168
push 1
mov edx, dword [0x4ab39c]
mov edx, dword [edx]
mov ecx, 1
mov eax, 0x4a54cc
call fcn.00469914
test eax, eax
sete al
mov byte [ebp - 0x40], al
mov byte [ebp - 0x3c], 1
push 1
mov edx, dword [0x4ab39c]
mov edx, dword [edx]
mov ecx, 1
mov eax, 0x4a5508
call fcn.00469914
test eax, eax
sete al
mov byte [ebp - 0x38], al
mov byte [ebp - 0x34], 1
lea edx, [ebp - 0x40]
mov eax, dword [0x4aae24]
mov eax, dword [eax]
mov ecx, 1
call fcn.004a6000
call fcn.004a60cc
test al, al
je 0x4a5271
mov esi, dword [0x4ab384]
mov esi, dword [esi]
jmp 0x4a53d6
push 1
push 0
lea eax, [ebp - 0x24]
push eax
mov eax, dword [0x4ab39c]
mov eax, dword [eax]
mov ecx, 0x4a5b94
mov edx, 0x4a5bb8
call fcn.00469e70
push 1
push 0
lea eax, [ebp - 0x234]
push eax
mov ecx, 0x4a5534
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.00469e70
mov edx, dword [ebp - 0x234]
lea eax, [ebx + 0x10]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0x238]
push eax
mov eax, dword [ebx + 0x10]
mov ecx, 0x4a5bd0
mov edx, 0x4a5bdc
call fcn.00469e70
mov edx, dword [ebp - 0x238]
lea eax, [ebx + 0x10]
call fcn.004048c4
push 1
push 0
lea eax, [ebp - 0x23c]
push eax
mov eax, dword [ebx + 0x10]
mov ecx, 0x4a582c
mov edx, 0x4a5bfc
call fcn.00469e70
mov edx, dword [ebp - 0x23c]
lea eax, [ebx + 0x10]
call fcn.004048c4
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebx + 0x10]
xor ecx, ecx
mov edx, 0x4a58a4
call fcn.00469a7c
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x240]
call fcn.0046a474
mov edx, dword [ebp - 0x240]
lea eax, [ebx + 0x10]
call fcn.004048c4
xor eax, eax
push ebp
push 0x4a5362
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, 1
call fcn.004a5ec4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a5397
add dword [ebp - 0x1c], 1
jno 0x4a53a2
call fcn.00403a60
mov eax, dword [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x248]
push eax
mov ecx, 0x4a5698
mov edx, 0x4a56a4
mov eax, dword [ebp - 8]
call fcn.00469e70
cmp dword [ebp - 0x248], 0
jne 0x4a3fdb
mov esi, dword [0x4ab148]
mov esi, dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5491
lea eax, [ebp - 0x248]
mov edx, 6
call fcn.00404894
lea eax, [ebp - 0x230]
call fcn.00404fb4
lea eax, [ebp - 0x22c]
mov edx, 0x5c
call fcn.00404894
lea eax, [ebp - 0xb4]
call fcn.00404870
lea eax, [ebp - 0xbc]
mov edx, 2
call fcn.00404894
lea eax, [ebp - 0xb0]
mov edx, 0xa
call fcn.00404894
lea eax, [ebp - 0x88]
call fcn.00404fb4
lea eax, [ebp - 0x84]
mov edx, 7
call fcn.00404894
lea eax, [ebp - 0x50]
call fcn.00404fb4
lea eax, [ebp - 0x4c]
call fcn.00404870
lea eax, [ebp - 0x30]
call fcn.00404fb4
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00404894
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404894
ret